208 files changed, 673 insertions, 459 deletions

diff --git a/src/shared/.gitignore b/src/basic/.gitignore
index e22411e484..e22411e484 100644
--- a/src/shared/.gitignore
+++ b/src/basic/.gitignore
diff --git a/src/shared/Makefile b/src/basic/Makefile
index d0b0e8e008..d0b0e8e008 120000
--- a/src/shared/Makefile
+++ b/src/basic/Makefile
diff --git a/src/shared/MurmurHash2.c b/src/basic/MurmurHash2.c
index 2f4149dbe9..2f4149dbe9 100644
--- a/src/shared/MurmurHash2.c
+++ b/src/basic/MurmurHash2.c
diff --git a/src/shared/MurmurHash2.h b/src/basic/MurmurHash2.h
index 93362dd485..93362dd485 100644
--- a/src/shared/MurmurHash2.h
+++ b/src/basic/MurmurHash2.h
diff --git a/src/shared/af-list.c b/src/basic/af-list.c
index f396115a34..f396115a34 100644
--- a/src/shared/af-list.c
+++ b/src/basic/af-list.c
diff --git a/src/shared/af-list.h b/src/basic/af-list.h
index e346ab87f5..e346ab87f5 100644
--- a/src/shared/af-list.h
+++ b/src/basic/af-list.h
diff --git a/src/shared/arphrd-list.c b/src/basic/arphrd-list.c
index 284043cd90..284043cd90 100644
--- a/src/shared/arphrd-list.c
+++ b/src/basic/arphrd-list.c
diff --git a/src/shared/arphrd-list.h b/src/basic/arphrd-list.h
index 5ca182c9e8..5ca182c9e8 100644
--- a/src/shared/arphrd-list.h
+++ b/src/basic/arphrd-list.h
diff --git a/src/shared/async.c b/src/basic/async.c
index 7725e6d7d3..7725e6d7d3 100644
--- a/src/shared/async.c
+++ b/src/basic/async.c
diff --git a/src/shared/async.h b/src/basic/async.h
index 7f1ef79532..7f1ef79532 100644
--- a/src/shared/async.h
+++ b/src/basic/async.h
diff --git a/src/shared/audit.c b/src/basic/audit.c
index 54148fcf18..54148fcf18 100644
--- a/src/shared/audit.c
+++ b/src/basic/audit.c
diff --git a/src/shared/audit.h b/src/basic/audit.h
index 6de331c73e..6de331c73e 100644
--- a/src/shared/audit.h
+++ b/src/basic/audit.h
diff --git a/src/shared/barrier.c b/src/basic/barrier.c
index 436ba95989..436ba95989 100644
--- a/src/shared/barrier.c
+++ b/src/basic/barrier.c
diff --git a/src/shared/barrier.h b/src/basic/barrier.h
index b8954694d3..b8954694d3 100644
--- a/src/shared/barrier.h
+++ b/src/basic/barrier.h
diff --git a/src/shared/blkid-util.h b/src/basic/blkid-util.h
index c689310324..c689310324 100644
--- a/src/shared/blkid-util.h
+++ b/src/basic/blkid-util.h
diff --git a/src/shared/btrfs-ctree.h b/src/basic/btrfs-ctree.h
index d3ae57331c..d3ae57331c 100644
--- a/src/shared/btrfs-ctree.h
+++ b/src/basic/btrfs-ctree.h
diff --git a/src/shared/btrfs-util.c b/src/basic/btrfs-util.c
index 49528dbf01..49528dbf01 100644
--- a/src/shared/btrfs-util.c
+++ b/src/basic/btrfs-util.c
diff --git a/src/shared/btrfs-util.h b/src/basic/btrfs-util.h
index a7eb895c93..a7eb895c93 100644
--- a/src/shared/btrfs-util.h
+++ b/src/basic/btrfs-util.h
diff --git a/src/shared/build.h b/src/basic/build.h
index 24873ab9d7..24873ab9d7 100644
--- a/src/shared/build.h
+++ b/src/basic/build.h
diff --git a/src/shared/bus-label.c b/src/basic/bus-label.c
index ccc9f2bf8e..ccc9f2bf8e 100644
--- a/src/shared/bus-label.c
+++ b/src/basic/bus-label.c
diff --git a/src/shared/bus-label.h b/src/basic/bus-label.h
index ed1dc4e0a7..ed1dc4e0a7 100644
--- a/src/shared/bus-label.h
+++ b/src/basic/bus-label.h
diff --git a/src/shared/calendarspec.c b/src/basic/calendarspec.c
index 2fde3e107e..2fde3e107e 100644
--- a/src/shared/calendarspec.c
+++ b/src/basic/calendarspec.c
diff --git a/src/shared/calendarspec.h b/src/basic/calendarspec.h
index 7baf318249..7baf318249 100644
--- a/src/shared/calendarspec.h
+++ b/src/basic/calendarspec.h
diff --git a/src/shared/cap-list.c b/src/basic/cap-list.c
index bd5bffbfa5..bd5bffbfa5 100644
--- a/src/shared/cap-list.c
+++ b/src/basic/cap-list.c
diff --git a/src/shared/cap-list.h b/src/basic/cap-list.h
index 9824fad70f..9824fad70f 100644
--- a/src/shared/cap-list.h
+++ b/src/basic/cap-list.h
diff --git a/src/shared/capability.c b/src/basic/capability.c
index 58f00e6dae..58f00e6dae 100644
--- a/src/shared/capability.c
+++ b/src/basic/capability.c
diff --git a/src/shared/capability.h b/src/basic/capability.h
index 4eb5c2a835..4eb5c2a835 100644
--- a/src/shared/capability.h
+++ b/src/basic/capability.h
diff --git a/src/shared/cgroup-util.c b/src/basic/cgroup-util.c
index 9988e5c574..66857f118f 100644
--- a/src/shared/cgroup-util.c
+++ b/src/basic/cgroup-util.c
@@ -40,7 +40,7 @@
 #include "fileio.h"
 #include "special.h"
 #include "mkdir.h"
-#include "login-shared.h"
+#include "login-util.h"
 
 int cg_enumerate_processes(const char *controller, const char *path, FILE **_f) {
         _cleanup_free_ char *fs = NULL;
@@ -441,9 +441,7 @@ static const char *normalize_controller(const char *controller) {
 
         assert(controller);
 
-        if (streq(controller, SYSTEMD_CGROUP_CONTROLLER))
-                return "systemd";
-        else if (startswith(controller, "name="))
+        if (startswith(controller, "name="))
                 return controller + 5;
         else
                 return controller;
@@ -483,7 +481,7 @@ int cg_get_path(const char *controller, const char *path, const char *suffix, ch
 
         assert(fs);
 
-        if (controller && !cg_controller_is_valid(controller, true))
+        if (controller && !cg_controller_is_valid(controller))
                 return -EINVAL;
 
         if (_unlikely_(!good)) {
@@ -526,7 +524,7 @@ int cg_get_path_and_check(const char *controller, const char *path, const char *
 
         assert(fs);
 
-        if (!cg_controller_is_valid(controller, true))
+        if (!cg_controller_is_valid(controller))
                 return -EINVAL;
 
         /* Normalize the controller syntax */
@@ -742,7 +740,7 @@ int cg_pid_get_path(const char *controller, pid_t pid, char **path) {
         assert(pid >= 0);
 
         if (controller) {
-                if (!cg_controller_is_valid(controller, true))
+                if (!cg_controller_is_valid(controller))
                         return -EINVAL;
 
                 controller = normalize_controller(controller);
@@ -971,7 +969,7 @@ int cg_split_spec(const char *spec, char **controller, char **path) {
 
         e = strchr(spec, ':');
         if (!e) {
-                if (!cg_controller_is_valid(spec, true))
+                if (!cg_controller_is_valid(spec))
                         return -EINVAL;
 
                 if (controller) {
@@ -994,7 +992,7 @@ int cg_split_spec(const char *spec, char **controller, char **path) {
         t = strdup(normalize_controller(v));
         if (!t)
                 return -ENOMEM;
-        if (!cg_controller_is_valid(t, true)) {
+        if (!cg_controller_is_valid(t)) {
                 free(t);
                 return -EINVAL;
         }
@@ -1610,17 +1608,15 @@ char *cg_unescape(const char *p) {
         DIGITS LETTERS                          \
         "_"
 
-bool cg_controller_is_valid(const char *p, bool allow_named) {
+bool cg_controller_is_valid(const char *p) {
         const char *t, *s;
 
         if (!p)
                 return false;
 
-        if (allow_named) {
-                s = startswith(p, "name=");
-                if (s)
-                        p = s;
-        }
+        s = startswith(p, "name=");
+        if (s)
+                p = s;
 
         if (*p == 0 || *p == '_')
                 return false;
diff --git a/src/shared/cgroup-util.h b/src/basic/cgroup-util.h
index cbf7201370..fd72e9e5c5 100644
--- a/src/shared/cgroup-util.h
+++ b/src/basic/cgroup-util.h
@@ -122,7 +122,7 @@ int cg_path_decode_unit(const char *cgroup, char **unit);
 char *cg_escape(const char *p);
 char *cg_unescape(const char *p) _pure_;
 
-bool cg_controller_is_valid(const char *p, bool allow_named);
+bool cg_controller_is_valid(const char *p);
 
 int cg_slice_to_path(const char *unit, char **ret);
 
diff --git a/src/shared/clock-util.c b/src/basic/clock-util.c
index e4e03df1e4..e4e03df1e4 100644
--- a/src/shared/clock-util.c
+++ b/src/basic/clock-util.c
diff --git a/src/shared/clock-util.h b/src/basic/clock-util.h
index 8c2d235430..8c2d235430 100644
--- a/src/shared/clock-util.h
+++ b/src/basic/clock-util.h
diff --git a/src/shared/conf-files.c b/src/basic/conf-files.c
index da8745b284..da8745b284 100644
--- a/src/shared/conf-files.c
+++ b/src/basic/conf-files.c
diff --git a/src/shared/conf-files.h b/src/basic/conf-files.h
index 3169a907f1..3169a907f1 100644
--- a/src/shared/conf-files.h
+++ b/src/basic/conf-files.h
diff --git a/src/shared/copy.c b/src/basic/copy.c
index 1282cb88be..1282cb88be 100644
--- a/src/shared/copy.c
+++ b/src/basic/copy.c
diff --git a/src/shared/copy.h b/src/basic/copy.h
index 8de0cfba32..8de0cfba32 100644
--- a/src/shared/copy.h
+++ b/src/basic/copy.h
diff --git a/src/shared/def.h b/src/basic/def.h
index a3d9fcf388..011c7c667e 100644
--- a/src/shared/def.h
+++ b/src/basic/def.h
@@ -35,7 +35,7 @@
  * the watchdog pings will keep the loop busy. */
 #define DEFAULT_EXIT_USEC (30*USEC_PER_SEC)
 
-#define SYSTEMD_CGROUP_CONTROLLER "name=systemd"
+#define SYSTEMD_CGROUP_CONTROLLER "systemd"
 
 #define SIGNALS_CRASH_HANDLER SIGSEGV,SIGILL,SIGFPE,SIGBUS,SIGQUIT,SIGABRT
 #define SIGNALS_IGNORE SIGPIPE
diff --git a/src/shared/device-nodes.c b/src/basic/device-nodes.c
index 9d5af72d27..9d5af72d27 100644
--- a/src/shared/device-nodes.c
+++ b/src/basic/device-nodes.c
diff --git a/src/shared/device-nodes.h b/src/basic/device-nodes.h
index 04ba4897e5..04ba4897e5 100644
--- a/src/shared/device-nodes.h
+++ b/src/basic/device-nodes.h
diff --git a/src/shared/env-util.c b/src/basic/env-util.c
index ac7bbdc711..ac7bbdc711 100644
--- a/src/shared/env-util.c
+++ b/src/basic/env-util.c
diff --git a/src/shared/env-util.h b/src/basic/env-util.h
index 803aa61cad..803aa61cad 100644
--- a/src/shared/env-util.h
+++ b/src/basic/env-util.h
diff --git a/src/shared/errno-list.c b/src/basic/errno-list.c
index 34d1331486..34d1331486 100644
--- a/src/shared/errno-list.c
+++ b/src/basic/errno-list.c
diff --git a/src/shared/errno-list.h b/src/basic/errno-list.h
index ba533294e6..ba533294e6 100644
--- a/src/shared/errno-list.h
+++ b/src/basic/errno-list.h
diff --git a/src/shared/ether-addr-util.h b/src/basic/ether-addr-util.h
index 7033138788..7033138788 100644
--- a/src/shared/ether-addr-util.h
+++ b/src/basic/ether-addr-util.h
diff --git a/src/shared/exit-status.c b/src/basic/exit-status.c
index c09efdd2cb..c09efdd2cb 100644
--- a/src/shared/exit-status.c
+++ b/src/basic/exit-status.c
diff --git a/src/shared/exit-status.h b/src/basic/exit-status.h
index 7259cd1d18..7259cd1d18 100644
--- a/src/shared/exit-status.h
+++ b/src/basic/exit-status.h
diff --git a/src/shared/fdset.c b/src/basic/fdset.c
index 6101b628ec..6101b628ec 100644
--- a/src/shared/fdset.c
+++ b/src/basic/fdset.c
diff --git a/src/shared/fdset.h b/src/basic/fdset.h
index 340438d7c4..340438d7c4 100644
--- a/src/shared/fdset.h
+++ b/src/basic/fdset.h
diff --git a/src/shared/fileio-label.c b/src/basic/fileio-label.c
index bec988ca78..bec988ca78 100644
--- a/src/shared/fileio-label.c
+++ b/src/basic/fileio-label.c
diff --git a/src/shared/fileio-label.h b/src/basic/fileio-label.h
index 25fa351be2..25fa351be2 100644
--- a/src/shared/fileio-label.h
+++ b/src/basic/fileio-label.h
diff --git a/src/shared/fileio.c b/src/basic/fileio.c
index ff6b1a7ed7..ff6b1a7ed7 100644
--- a/src/shared/fileio.c
+++ b/src/basic/fileio.c
diff --git a/src/shared/fileio.h b/src/basic/fileio.h
index 5ae51c1e28..5ae51c1e28 100644
--- a/src/shared/fileio.h
+++ b/src/basic/fileio.h
diff --git a/src/shared/gunicode.c b/src/basic/gunicode.c
index d89a2f3ed9..d89a2f3ed9 100644
--- a/src/shared/gunicode.c
+++ b/src/basic/gunicode.c
diff --git a/src/shared/gunicode.h b/src/basic/gunicode.h
index e70818fdd7..e70818fdd7 100644
--- a/src/shared/gunicode.h
+++ b/src/basic/gunicode.h
diff --git a/src/shared/hashmap.c b/src/basic/hashmap.c
index 20d599d04b..20d599d04b 100644
--- a/src/shared/hashmap.c
+++ b/src/basic/hashmap.c
diff --git a/src/shared/hashmap.h b/src/basic/hashmap.h
index a03ee5812a..a03ee5812a 100644
--- a/src/shared/hashmap.h
+++ b/src/basic/hashmap.h
diff --git a/src/shared/hostname-util.c b/src/basic/hostname-util.c
index e336f269fa..e336f269fa 100644
--- a/src/shared/hostname-util.c
+++ b/src/basic/hostname-util.c
diff --git a/src/shared/hostname-util.h b/src/basic/hostname-util.h
index 0c4763cf5a..0c4763cf5a 100644
--- a/src/shared/hostname-util.h
+++ b/src/basic/hostname-util.h
diff --git a/src/shared/in-addr-util.c b/src/basic/in-addr-util.c
index d88864b598..d88864b598 100644
--- a/src/shared/in-addr-util.c
+++ b/src/basic/in-addr-util.c
diff --git a/src/shared/in-addr-util.h b/src/basic/in-addr-util.h
index 51af08868c..51af08868c 100644
--- a/src/shared/in-addr-util.h
+++ b/src/basic/in-addr-util.h
diff --git a/src/shared/ioprio.h b/src/basic/ioprio.h
index e5c71d0043..e5c71d0043 100644
--- a/src/shared/ioprio.h
+++ b/src/basic/ioprio.h
diff --git a/src/shared/json.c b/src/basic/json.c
index be40a0d203..be40a0d203 100644
--- a/src/shared/json.c
+++ b/src/basic/json.c
diff --git a/src/shared/json.h b/src/basic/json.h
index e0b4d810b5..e0b4d810b5 100644
--- a/src/shared/json.h
+++ b/src/basic/json.h
diff --git a/src/shared/label.c b/src/basic/label.c
index 82f10b21bd..82f10b21bd 100644
--- a/src/shared/label.c
+++ b/src/basic/label.c
diff --git a/src/shared/label.h b/src/basic/label.h
index 8070bcb021..8070bcb021 100644
--- a/src/shared/label.h
+++ b/src/basic/label.h
diff --git a/src/shared/linux/Makefile b/src/basic/linux/Makefile
index d0b0e8e008..d0b0e8e008 120000
--- a/src/shared/linux/Makefile
+++ b/src/basic/linux/Makefile
diff --git a/src/shared/list.h b/src/basic/list.h
index 2939216adb..2939216adb 100644
--- a/src/shared/list.h
+++ b/src/basic/list.h
diff --git a/src/shared/locale-util.c b/src/basic/locale-util.c
index 61db9a8125..61db9a8125 100644
--- a/src/shared/locale-util.c
+++ b/src/basic/locale-util.c
diff --git a/src/shared/locale-util.h b/src/basic/locale-util.h
index e48aa3d9af..e48aa3d9af 100644
--- a/src/shared/locale-util.h
+++ b/src/basic/locale-util.h
diff --git a/src/shared/lockfile-util.c b/src/basic/lockfile-util.c
index 05e16d1caa..05e16d1caa 100644
--- a/src/shared/lockfile-util.c
+++ b/src/basic/lockfile-util.c
diff --git a/src/shared/lockfile-util.h b/src/basic/lockfile-util.h
index 38d47094bd..38d47094bd 100644
--- a/src/shared/lockfile-util.h
+++ b/src/basic/lockfile-util.h
diff --git a/src/shared/log.c b/src/basic/log.c
index b96afc4de4..b96afc4de4 100644
--- a/src/shared/log.c
+++ b/src/basic/log.c
diff --git a/src/shared/log.h b/src/basic/log.h
index 569762d083..569762d083 100644
--- a/src/shared/log.h
+++ b/src/basic/log.h
diff --git a/src/shared/login-shared.c b/src/basic/login-util.c
index 64650a9134..e25437f0f4 100644
--- a/src/shared/login-shared.c
+++ b/src/basic/login-util.c
@@ -19,7 +19,7 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
-#include "login-shared.h"
+#include "login-util.h"
 #include "def.h"
 
 bool session_id_valid(const char *id) {
diff --git a/src/shared/login-shared.h b/src/basic/login-util.h
index a79f20c1b1..a79f20c1b1 100644
--- a/src/shared/login-shared.h
+++ b/src/basic/login-util.h
diff --git a/src/shared/macro.h b/src/basic/macro.h
index 7ae1ed80b6..cc1c9e73c0 100644
--- a/src/shared/macro.h
+++ b/src/basic/macro.h
@@ -467,4 +467,7 @@ do {                                                                    \
         }                                                       \
         struct __useless_struct_to_allow_trailing_semicolon__
 
+#define CMSG_FOREACH(cmsg, mh)                                          \
+        for ((cmsg) = CMSG_FIRSTHDR(mh); (cmsg); (cmsg) = CMSG_NXTHDR((mh), (cmsg)))
+
 #include "log.h"
diff --git a/src/shared/memfd-util.c b/src/basic/memfd-util.c
index e99a738e1f..e99a738e1f 100644
--- a/src/shared/memfd-util.c
+++ b/src/basic/memfd-util.c
diff --git a/src/shared/memfd-util.h b/src/basic/memfd-util.h
index 3ed551fb37..3ed551fb37 100644
--- a/src/shared/memfd-util.h
+++ b/src/basic/memfd-util.h
diff --git a/src/shared/mempool.c b/src/basic/mempool.c
index d5d98d8829..d5d98d8829 100644
--- a/src/shared/mempool.c
+++ b/src/basic/mempool.c
diff --git a/src/shared/mempool.h b/src/basic/mempool.h
index 42f473bee1..42f473bee1 100644
--- a/src/shared/mempool.h
+++ b/src/basic/mempool.h
diff --git a/src/shared/missing.h b/src/basic/missing.h
index be7f6186fc..be7f6186fc 100644
--- a/src/shared/missing.h
+++ b/src/basic/missing.h
diff --git a/src/shared/mkdir-label.c b/src/basic/mkdir-label.c
index 76bbc1edda..76bbc1edda 100644
--- a/src/shared/mkdir-label.c
+++ b/src/basic/mkdir-label.c
diff --git a/src/shared/mkdir.c b/src/basic/mkdir.c
index 7ee4546988..7ee4546988 100644
--- a/src/shared/mkdir.c
+++ b/src/basic/mkdir.c
diff --git a/src/shared/mkdir.h b/src/basic/mkdir.h
index 2392d1fd1b..2392d1fd1b 100644
--- a/src/shared/mkdir.h
+++ b/src/basic/mkdir.h
diff --git a/src/shared/ordered-set.h b/src/basic/ordered-set.h
index 766a1f2e83..766a1f2e83 100644
--- a/src/shared/ordered-set.h
+++ b/src/basic/ordered-set.h
diff --git a/src/shared/path-util.c b/src/basic/path-util.c
index 537705446a..537705446a 100644
--- a/src/shared/path-util.c
+++ b/src/basic/path-util.c
diff --git a/src/shared/path-util.h b/src/basic/path-util.h
index 1eac89c51b..1eac89c51b 100644
--- a/src/shared/path-util.h
+++ b/src/basic/path-util.h
diff --git a/src/shared/prioq.c b/src/basic/prioq.c
index b89888be0e..b89888be0e 100644
--- a/src/shared/prioq.c
+++ b/src/basic/prioq.c
diff --git a/src/shared/prioq.h b/src/basic/prioq.h
index 1c044b135c..1c044b135c 100644
--- a/src/shared/prioq.h
+++ b/src/basic/prioq.h
diff --git a/src/shared/process-util.c b/src/basic/process-util.c
index cfc876567d..cfc876567d 100644
--- a/src/shared/process-util.c
+++ b/src/basic/process-util.c
diff --git a/src/shared/process-util.h b/src/basic/process-util.h
index 07431d043b..07431d043b 100644
--- a/src/shared/process-util.h
+++ b/src/basic/process-util.h
diff --git a/src/shared/random-util.c b/src/basic/random-util.c
index b230044f50..b230044f50 100644
--- a/src/shared/random-util.c
+++ b/src/basic/random-util.c
diff --git a/src/shared/random-util.h b/src/basic/random-util.h
index f7862c8c8b..f7862c8c8b 100644
--- a/src/shared/random-util.h
+++ b/src/basic/random-util.h
diff --git a/src/shared/ratelimit.c b/src/basic/ratelimit.c
index 81fc9c19ff..81fc9c19ff 100644
--- a/src/shared/ratelimit.c
+++ b/src/basic/ratelimit.c
diff --git a/src/shared/ratelimit.h b/src/basic/ratelimit.h
index 58efca7df1..58efca7df1 100644
--- a/src/shared/ratelimit.h
+++ b/src/basic/ratelimit.h
diff --git a/src/shared/refcnt.h b/src/basic/refcnt.h
index 0502c20a2e..0502c20a2e 100644
--- a/src/shared/refcnt.h
+++ b/src/basic/refcnt.h
diff --git a/src/shared/replace-var.c b/src/basic/replace-var.c
index 478fc43a38..478fc43a38 100644
--- a/src/shared/replace-var.c
+++ b/src/basic/replace-var.c
diff --git a/src/shared/replace-var.h b/src/basic/replace-var.h
index 7eaee93a3e..7eaee93a3e 100644
--- a/src/shared/replace-var.h
+++ b/src/basic/replace-var.h
diff --git a/src/shared/ring.c b/src/basic/ring.c
index 6814918464..6814918464 100644
--- a/src/shared/ring.c
+++ b/src/basic/ring.c
diff --git a/src/shared/ring.h b/src/basic/ring.h
index a7c44d1b56..a7c44d1b56 100644
--- a/src/shared/ring.h
+++ b/src/basic/ring.h
diff --git a/src/shared/rm-rf.c b/src/basic/rm-rf.c
index bafd483be2..bafd483be2 100644
--- a/src/shared/rm-rf.c
+++ b/src/basic/rm-rf.c
diff --git a/src/shared/rm-rf.h b/src/basic/rm-rf.h
index 96579eb182..96579eb182 100644
--- a/src/shared/rm-rf.h
+++ b/src/basic/rm-rf.h
diff --git a/src/shared/securebits.h b/src/basic/securebits.h
index 98fbe0d433..98fbe0d433 100644
--- a/src/shared/securebits.h
+++ b/src/basic/securebits.h
diff --git a/src/shared/selinux-util.c b/src/basic/selinux-util.c
index 7c58985cd2..7c58985cd2 100644
--- a/src/shared/selinux-util.c
+++ b/src/basic/selinux-util.c
diff --git a/src/shared/selinux-util.h b/src/basic/selinux-util.h
index 8467185291..8467185291 100644
--- a/src/shared/selinux-util.h
+++ b/src/basic/selinux-util.h
diff --git a/src/shared/set.h b/src/basic/set.h
index 4dffecd39d..4dffecd39d 100644
--- a/src/shared/set.h
+++ b/src/basic/set.h
diff --git a/src/shared/sigbus.c b/src/basic/sigbus.c
index 0108603fe8..0108603fe8 100644
--- a/src/shared/sigbus.c
+++ b/src/basic/sigbus.c
diff --git a/src/shared/sigbus.h b/src/basic/sigbus.h
index 23edc6d9cb..23edc6d9cb 100644
--- a/src/shared/sigbus.h
+++ b/src/basic/sigbus.h
diff --git a/src/shared/signal-util.c b/src/basic/signal-util.c
index 84cf42b285..84cf42b285 100644
--- a/src/shared/signal-util.c
+++ b/src/basic/signal-util.c
diff --git a/src/shared/signal-util.h b/src/basic/signal-util.h
index 9dc8a28726..9dc8a28726 100644
--- a/src/shared/signal-util.h
+++ b/src/basic/signal-util.h
diff --git a/src/shared/siphash24.c b/src/basic/siphash24.c
index f68bd283a1..f68bd283a1 100644
--- a/src/shared/siphash24.c
+++ b/src/basic/siphash24.c
diff --git a/src/shared/siphash24.h b/src/basic/siphash24.h
index 62e1168a79..62e1168a79 100644
--- a/src/shared/siphash24.h
+++ b/src/basic/siphash24.h
diff --git a/src/shared/smack-util.c b/src/basic/smack-util.c
index 2e24b1ea99..2e24b1ea99 100644
--- a/src/shared/smack-util.c
+++ b/src/basic/smack-util.c
diff --git a/src/shared/smack-util.h b/src/basic/smack-util.h
index 50f55b1f4b..50f55b1f4b 100644
--- a/src/shared/smack-util.h
+++ b/src/basic/smack-util.h
diff --git a/src/shared/socket-label.c b/src/basic/socket-label.c
index cbe3ff216e..cbe3ff216e 100644
--- a/src/shared/socket-label.c
+++ b/src/basic/socket-label.c
diff --git a/src/shared/socket-util.c b/src/basic/socket-util.c
index e8bb10dc9b..e8bb10dc9b 100644
--- a/src/shared/socket-util.c
+++ b/src/basic/socket-util.c
diff --git a/src/shared/socket-util.h b/src/basic/socket-util.h
index 538cf59174..538cf59174 100644
--- a/src/shared/socket-util.h
+++ b/src/basic/socket-util.h
diff --git a/src/shared/sparse-endian.h b/src/basic/sparse-endian.h
index c913fda8c5..c913fda8c5 100644
--- a/src/shared/sparse-endian.h
+++ b/src/basic/sparse-endian.h
diff --git a/src/shared/special.h b/src/basic/special.h
index e51310eb6d..e51310eb6d 100644
--- a/src/shared/special.h
+++ b/src/basic/special.h
diff --git a/src/shared/strbuf.c b/src/basic/strbuf.c
index 01a076c2ba..01a076c2ba 100644
--- a/src/shared/strbuf.c
+++ b/src/basic/strbuf.c
diff --git a/src/shared/strbuf.h b/src/basic/strbuf.h
index fbc4e5f2a1..fbc4e5f2a1 100644
--- a/src/shared/strbuf.h
+++ b/src/basic/strbuf.h
diff --git a/src/shared/strv.c b/src/basic/strv.c
index d44a72fc48..d44a72fc48 100644
--- a/src/shared/strv.c
+++ b/src/basic/strv.c
diff --git a/src/shared/strv.h b/src/basic/strv.h
index 22f8f98fda..22f8f98fda 100644
--- a/src/shared/strv.h
+++ b/src/basic/strv.h
diff --git a/src/shared/strxcpyx.c b/src/basic/strxcpyx.c
index 6542c0abf5..6542c0abf5 100644
--- a/src/shared/strxcpyx.c
+++ b/src/basic/strxcpyx.c
diff --git a/src/shared/strxcpyx.h b/src/basic/strxcpyx.h
index ccc7e52f37..ccc7e52f37 100644
--- a/src/shared/strxcpyx.h
+++ b/src/basic/strxcpyx.h
diff --git a/src/shared/terminal-util.c b/src/basic/terminal-util.c
index 042b88f222..042b88f222 100644
--- a/src/shared/terminal-util.c
+++ b/src/basic/terminal-util.c
diff --git a/src/shared/terminal-util.h b/src/basic/terminal-util.h
index 188714f228..188714f228 100644
--- a/src/shared/terminal-util.h
+++ b/src/basic/terminal-util.h
diff --git a/src/shared/time-util.c b/src/basic/time-util.c
index 12f1b193be..12f1b193be 100644
--- a/src/shared/time-util.c
+++ b/src/basic/time-util.c
diff --git a/src/shared/time-util.h b/src/basic/time-util.h
index 7a64d454a0..7a64d454a0 100644
--- a/src/shared/time-util.h
+++ b/src/basic/time-util.h
diff --git a/src/shared/unaligned.h b/src/basic/unaligned.h
index d6181dd9a9..d6181dd9a9 100644
--- a/src/shared/unaligned.h
+++ b/src/basic/unaligned.h
diff --git a/src/shared/unit-name.c b/src/basic/unit-name.c
index bf52463d81..bf52463d81 100644
--- a/src/shared/unit-name.c
+++ b/src/basic/unit-name.c
diff --git a/src/shared/unit-name.h b/src/basic/unit-name.h
index b2043d0870..b2043d0870 100644
--- a/src/shared/unit-name.h
+++ b/src/basic/unit-name.h
diff --git a/src/shared/utf8.c b/src/basic/utf8.c
index 800884ffee..800884ffee 100644
--- a/src/shared/utf8.c
+++ b/src/basic/utf8.c
diff --git a/src/shared/utf8.h b/src/basic/utf8.h
index e745649f06..e745649f06 100644
--- a/src/shared/utf8.h
+++ b/src/basic/utf8.h
diff --git a/src/shared/util.c b/src/basic/util.c
index a20e7bb2ef..6f6906f877 100644
--- a/src/shared/util.c
+++ b/src/basic/util.c
@@ -5520,7 +5520,7 @@ int openpt_in_namespace(pid_t pid, int flags) {
         if (recvmsg(pair[0], &mh, MSG_NOSIGNAL|MSG_CMSG_CLOEXEC) < 0)
                 return -errno;
 
-        for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg))
+        CMSG_FOREACH(cmsg, &mh)
                 if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
                         int *fds;
                         unsigned n_fds;
@@ -5908,7 +5908,7 @@ void cmsg_close_all(struct msghdr *mh) {
 
         assert(mh);
 
-        for (cmsg = CMSG_FIRSTHDR(mh); cmsg; cmsg = CMSG_NXTHDR(mh, cmsg))
+        CMSG_FOREACH(cmsg, mh)
                 if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS)
                         close_many((int*) CMSG_DATA(cmsg), (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int));
 }
diff --git a/src/shared/util.h b/src/basic/util.h
index 467ae234a0..467ae234a0 100644
--- a/src/shared/util.h
+++ b/src/basic/util.h
diff --git a/src/shared/verbs.c b/src/basic/verbs.c
index c7beccc2dc..c7beccc2dc 100644
--- a/src/shared/verbs.c
+++ b/src/basic/verbs.c
diff --git a/src/shared/verbs.h b/src/basic/verbs.h
index d59e4d59b8..d59e4d59b8 100644
--- a/src/shared/verbs.h
+++ b/src/basic/verbs.h
diff --git a/src/shared/virt.c b/src/basic/virt.c
index 1299a75ed5..1299a75ed5 100644
--- a/src/shared/virt.c
+++ b/src/basic/virt.c
diff --git a/src/shared/virt.h b/src/basic/virt.h
index 7194ab2bf7..7194ab2bf7 100644
--- a/src/shared/virt.h
+++ b/src/basic/virt.h
diff --git a/src/shared/xml.c b/src/basic/xml.c
index 15c629b188..15c629b188 100644
--- a/src/shared/xml.c
+++ b/src/basic/xml.c
diff --git a/src/shared/xml.h b/src/basic/xml.h
index b256b0ba10..b256b0ba10 100644
--- a/src/shared/xml.h
+++ b/src/basic/xml.h
diff --git a/src/cgtop/cgtop.c b/src/cgtop/cgtop.c
index a390cf3256..d630e35882 100644
--- a/src/cgtop/cgtop.c
+++ b/src/cgtop/cgtop.c
@@ -60,8 +60,9 @@ typedef struct Group {
 } Group;
 
 static unsigned arg_depth = 3;
-static unsigned arg_iterations = 0;
+static unsigned arg_iterations = (unsigned)-1;
 static bool arg_batch = false;
+static bool arg_raw = false;
 static usec_t arg_delay = 1*USEC_PER_SEC;
 
 static enum {
@@ -96,6 +97,16 @@ static void group_hashmap_free(Hashmap *h) {
         hashmap_free(h);
 }
 
+static const char *maybe_format_bytes(char *buf, size_t l, bool is_valid, off_t t) {
+        if (!is_valid)
+                return "-";
+        if (arg_raw) {
+                snprintf(buf, l, "%jd", t);
+                return buf;
+        }
+        return format_bytes(buf, l, t);
+}
+
 static int process(const char *controller, const char *path, Hashmap *a, Hashmap *b, unsigned iteration) {
         Group *g;
         int r;
@@ -270,11 +281,10 @@ static int process(const char *controller, const char *path, Hashmap *a, Hashmap
                         yr = rd - g->io_input;
                         yw = wr - g->io_output;
 
-                        if (yr > 0 || yw > 0) {
+                        if (g->io_input > 0 || g->io_output > 0) {
                                 g->io_input_bps = (yr * 1000000000ULL) / x;
                                 g->io_output_bps = (yw * 1000000000ULL) / x;
                                 g->io_valid = true;
-
                         }
                 }
 
@@ -532,18 +542,9 @@ static int display(Hashmap *a) {
                 } else
                         printf(" %*s", maxtcpu, format_timespan(buffer, sizeof(buffer), (nsec_t) (g->cpu_usage / NSEC_PER_USEC), 0));
 
-                if (g->memory_valid)
-                        printf(" %8s", format_bytes(buffer, sizeof(buffer), g->memory));
-                else
-                        fputs("        -", stdout);
-
-                if (g->io_valid) {
-                        printf(" %8s",
-                               format_bytes(buffer, sizeof(buffer), g->io_input_bps));
-                        printf(" %8s",
-                               format_bytes(buffer, sizeof(buffer), g->io_output_bps));
-                } else
-                        fputs("        -        -", stdout);
+                printf(" %8s", maybe_format_bytes(buffer, sizeof(buffer), g->memory_valid, g->memory));
+                printf(" %8s", maybe_format_bytes(buffer, sizeof(buffer), g->io_valid, g->io_input_bps));
+                printf(" %8s", maybe_format_bytes(buffer, sizeof(buffer), g->io_valid, g->io_output_bps));
 
                 putchar('\n');
         }
@@ -561,6 +562,7 @@ static void help(void) {
                "  -c                  Order by CPU load\n"
                "  -m                  Order by memory load\n"
                "  -i                  Order by IO load\n"
+               "  -r --raw            Provide raw (not human-readable) numbers\n"
                "     --cpu[=TYPE]     Show CPU usage as time or percentage (default)\n"
                "  -d --delay=DELAY    Delay between updates\n"
                "  -n --iterations=N   Run for N iterations before exiting\n"
@@ -583,6 +585,7 @@ static int parse_argv(int argc, char *argv[]) {
                 { "delay",      required_argument, NULL, 'd'         },
                 { "iterations", required_argument, NULL, 'n'         },
                 { "batch",      no_argument,       NULL, 'b'         },
+                { "raw",        no_argument,       NULL, 'r'         },
                 { "depth",      required_argument, NULL, ARG_DEPTH   },
                 { "cpu",        optional_argument, NULL, ARG_CPU_TYPE},
                 {}
@@ -594,7 +597,7 @@ static int parse_argv(int argc, char *argv[]) {
         assert(argc >= 1);
         assert(argv);
 
-        while ((c = getopt_long(argc, argv, "hptcmin:bd:", options, NULL)) >= 0)
+        while ((c = getopt_long(argc, argv, "hptcmin:brd:", options, NULL)) >= 0)
 
                 switch (c) {
 
@@ -649,6 +652,10 @@ static int parse_argv(int argc, char *argv[]) {
                         arg_batch = true;
                         break;
 
+                case 'r':
+                        arg_raw = true;
+                        break;
+
                 case 'p':
                         arg_order = ORDER_PATH;
                         break;
@@ -707,8 +714,8 @@ int main(int argc, char *argv[]) {
 
         signal(SIGWINCH, columns_lines_cache_reset);
 
-        if (!on_tty())
-                arg_iterations = 1;
+        if (arg_iterations == (unsigned)-1)
+                arg_iterations = on_tty() ? 0 : 1;
 
         while (!quit) {
                 Hashmap *c;
@@ -741,6 +748,10 @@ int main(int argc, char *argv[]) {
                 if (arg_iterations && iteration >= arg_iterations)
                         break;
 
+                if (!on_tty()) /* non-TTY: Empty newline as delimiter between polls */
+                        fputs("\n", stdout);
+                fflush(stdout);
+
                 if (arg_batch) {
                         usleep(last_refresh + arg_delay - t);
                 } else {
@@ -754,8 +765,10 @@ int main(int argc, char *argv[]) {
                         }
                 }
 
-                fputs("\r \r", stdout);
-                fflush(stdout);
+                if (on_tty()) { /* TTY: Clear any user keystroke */
+                        fputs("\r \r", stdout);
+                        fflush(stdout);
+                }
 
                 if (arg_batch)
                         continue;
diff --git a/src/core/kmod-setup.c b/src/core/kmod-setup.c
index cf543c81a3..f5584b6b14 100644
--- a/src/core/kmod-setup.c
+++ b/src/core/kmod-setup.c
@@ -117,9 +117,12 @@ int kmod_setup(void) {
                         log_info("Inserted module '%s'", kmod_module_get_name(mod));
                 else if (r == KMOD_PROBE_APPLY_BLACKLIST)
                         log_info("Module '%s' is blacklisted", kmod_module_get_name(mod));
-                else
-                        log_full((kmod_table[i].warn_if_unavailable || (r < 0 && r != -ENOENT)) ? LOG_ERR : LOG_DEBUG,
-                                 "Failed to insert module '%s'", kmod_module_get_name(mod));
+                else {
+                        bool print_warning = kmod_table[i].warn_if_unavailable || (r < 0 && r != -ENOSYS);
+
+                        log_full_errno(print_warning ? LOG_WARNING : LOG_DEBUG, r,
+                                       "Failed to insert module '%s': %m", kmod_module_get_name(mod));
+                }
 
                 kmod_module_unref(mod);
         }
diff --git a/src/core/loopback-setup.c b/src/core/loopback-setup.c
index 63b15c1200..938f3ab068 100644
--- a/src/core/loopback-setup.c
+++ b/src/core/loopback-setup.c
@@ -70,7 +70,7 @@ int loopback_setup(void) {
         _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
         int r;
 
-        r = sd_rtnl_open(&rtnl, 0);
+        r = sd_rtnl_open(&rtnl);
         if (r < 0)
                 return r;
 
diff --git a/src/core/manager.c b/src/core/manager.c
index 564fb5d579..eb80dd1b46 100644
--- a/src/core/manager.c
+++ b/src/core/manager.c
@@ -1546,7 +1546,7 @@ static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t
                         return -errno;
                 }
 
-                for (cmsg = CMSG_FIRSTHDR(&msghdr); cmsg; cmsg = CMSG_NXTHDR(&msghdr, cmsg)) {
+                CMSG_FOREACH(cmsg, &msghdr) {
                         if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
 
                                 fd_array = (int*) CMSG_DATA(cmsg);
diff --git a/src/core/namespace.c b/src/core/namespace.c
index 01a817bf23..045321e1d4 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -696,12 +696,11 @@ int setup_netns(int netns_storage_socket[2]) {
         } else {
                 /* Yay, found something, so let's join the namespace */
 
-                for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg)) {
+                CMSG_FOREACH(cmsg, &mh)
                         if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
                                 assert(cmsg->cmsg_len == CMSG_LEN(sizeof(int)));
                                 netns = *(int*) CMSG_DATA(cmsg);
                         }
-                }
 
                 if (setns(netns, CLONE_NEWNET) < 0) {
                         r = -errno;
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
index decd42f95a..e9a9a020de 100644
--- a/src/core/selinux-access.c
+++ b/src/core/selinux-access.c
@@ -82,11 +82,19 @@ static int audit_callback(
 
 static int callback_type_to_priority(int type) {
         switch(type) {
-        case SELINUX_ERROR:   return LOG_ERR;
-        case SELINUX_WARNING: return LOG_WARNING;
-        case SELINUX_INFO:    return LOG_INFO;
+
+        case SELINUX_ERROR:
+                return LOG_ERR;
+
+        case SELINUX_WARNING:
+                return LOG_WARNING;
+
+        case SELINUX_INFO:
+                return LOG_INFO;
+
         case SELINUX_AVC:
-        default:              return LOG_NOTICE;
+        default:
+                return LOG_NOTICE;
         }
 }
 
@@ -281,11 +289,13 @@ finish:
 #endif
 }
 
-int mac_selinux_unit_access_check_strv(char **units,
-                                sd_bus_message *message,
-                                Manager *m,
-                                const char *permission,
-                                sd_bus_error *error) {
+int mac_selinux_unit_access_check_strv(
+                char **units,
+                sd_bus_message *message,
+                Manager *m,
+                const char *permission,
+                sd_bus_error *error) {
+
 #ifdef HAVE_SELINUX
         char **i;
         Unit *u;
diff --git a/src/core/service.c b/src/core/service.c
index c7e65772ea..71252e29e2 100644
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -2008,6 +2008,7 @@ static int service_serialize(Unit *u, FILE *f, FDSet *fds) {
                 unit_serialize_item_format(u, f, "main-pid", PID_FMT, s->main_pid);
 
         unit_serialize_item(u, f, "main-pid-known", yes_no(s->main_pid_known));
+        unit_serialize_item(u, f, "bus-name-good", yes_no(s->bus_name_good));
 
         if (s->status_text) {
                 _cleanup_free_ char *c = NULL;
@@ -2131,6 +2132,14 @@ static int service_deserialize_item(Unit *u, const char *key, const char *value,
                         log_unit_debug(u, "Failed to parse main-pid-known value: %s", value);
                 else
                         s->main_pid_known = b;
+        } else if (streq(key, "bus-name-good")) {
+                int b;
+
+                b = parse_boolean(value);
+                if (b < 0)
+                        log_unit_debug(u, "Failed to parse bus-name-good value: %s", value);
+                else
+                        s->bus_name_good = b;
         } else if (streq(key, "status-text")) {
                 char *t;
 
diff --git a/src/core/umount.c b/src/core/umount.c
index bee267a5ad..d59b5d0ffb 100644
--- a/src/core/umount.c
+++ b/src/core/umount.c
@@ -385,7 +385,7 @@ static int mount_points_list_umount(MountPoint **head, bool *changed, bool log_e
                          * alias read-only we hence should be
                          * relatively safe regarding keeping the fs we
                          * can otherwise not see dirty. */
-                        mount(NULL, m->path, NULL, MS_REMOUNT|MS_RDONLY, NULL);
+                        (void) mount(NULL, m->path, NULL, MS_REMOUNT|MS_RDONLY, NULL);
                 }
 
                 /* Skip / and /usr since we cannot unmount that
diff --git a/src/core/unit.c b/src/core/unit.c
index e380276d49..7bb2afc9f2 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -2596,6 +2596,7 @@ int unit_serialize(Unit *u, FILE *f, FDSet *fds, bool serialize_jobs) {
 
         if (u->cgroup_path)
                 unit_serialize_item(u, f, "cgroup", u->cgroup_path);
+        unit_serialize_item(u, f, "cgroup-realized", yes_no(u->cgroup_realized));
 
         if (serialize_jobs) {
                 if (u->job) {
@@ -2806,6 +2807,16 @@ int unit_deserialize(Unit *u, FILE *f, FDSet *fds) {
                                 log_unit_debug_errno(u, r, "Failed to set cgroup path %s, ignoring: %m", v);
 
                         continue;
+                } else if (streq(l, "cgroup-realized")) {
+                        int b;
+
+                        b = parse_boolean(v);
+                        if (b < 0)
+                                log_unit_debug(u, "Failed to parse cgroup-realized bool %s, ignoring.", v);
+                        else
+                                u->cgroup_realized = b;
+
+                        continue;
                 }
 
                 if (unit_can_serialize(u)) {
diff --git a/src/import/importd.c b/src/import/importd.c
index e2df44ad26..05a619ac0c 100644
--- a/src/import/importd.c
+++ b/src/import/importd.c
@@ -599,7 +599,7 @@ static int manager_on_notify(sd_event_source *s, int fd, uint32_t revents, void
 
         cmsg_close_all(&msghdr);
 
-        for (cmsg = CMSG_FIRSTHDR(&msghdr); cmsg; cmsg = CMSG_NXTHDR(&msghdr, cmsg)) {
+        CMSG_FOREACH(cmsg, &msghdr) {
                 if (cmsg->cmsg_level == SOL_SOCKET &&
                            cmsg->cmsg_type == SCM_CREDENTIALS &&
                            cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred))) {
diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
index 3353024f4e..d0d670f36e 100644
--- a/src/journal/journald-server.c
+++ b/src/journal/journald-server.c
@@ -1104,6 +1104,42 @@ finish:
 
 int server_process_datagram(sd_event_source *es, int fd, uint32_t revents, void *userdata) {
         Server *s = userdata;
+        struct ucred *ucred = NULL;
+        struct timeval *tv = NULL;
+        struct cmsghdr *cmsg;
+        char *label = NULL;
+        size_t label_len = 0, m;
+        struct iovec iovec;
+        ssize_t n;
+        int *fds = NULL, v = 0;
+        unsigned n_fds = 0;
+
+        union {
+                struct cmsghdr cmsghdr;
+
+                /* We use NAME_MAX space for the SELinux label
+                 * here. The kernel currently enforces no
+                 * limit, but according to suggestions from
+                 * the SELinux people this will change and it
+                 * will probably be identical to NAME_MAX. For
+                 * now we use that, but this should be updated
+                 * one day when the final limit is known. */
+                uint8_t buf[CMSG_SPACE(sizeof(struct ucred)) +
+                            CMSG_SPACE(sizeof(struct timeval)) +
+                            CMSG_SPACE(sizeof(int)) + /* fd */
+                            CMSG_SPACE(NAME_MAX)]; /* selinux label */
+        } control = {};
+
+        union sockaddr_union sa = {};
+
+        struct msghdr msghdr = {
+                .msg_iov = &iovec,
+                .msg_iovlen = 1,
+                .msg_control = &control,
+                .msg_controllen = sizeof(control),
+                .msg_name = &sa,
+                .msg_namelen = sizeof(sa),
+        };
 
         assert(s);
         assert(fd == s->native_fd || fd == s->syslog_fd || fd == s->audit_fd);
@@ -1113,119 +1149,79 @@ int server_process_datagram(sd_event_source *es, int fd, uint32_t revents, void
                 return -EIO;
         }
 
-        for (;;) {
-                struct ucred *ucred = NULL;
-                struct timeval *tv = NULL;
-                struct cmsghdr *cmsg;
-                char *label = NULL;
-                size_t label_len = 0;
-                struct iovec iovec;
-
-                union {
-                        struct cmsghdr cmsghdr;
-
-                        /* We use NAME_MAX space for the SELinux label
-                         * here. The kernel currently enforces no
-                         * limit, but according to suggestions from
-                         * the SELinux people this will change and it
-                         * will probably be identical to NAME_MAX. For
-                         * now we use that, but this should be updated
-                         * one day when the final limit is known. */
-                        uint8_t buf[CMSG_SPACE(sizeof(struct ucred)) +
-                                    CMSG_SPACE(sizeof(struct timeval)) +
-                                    CMSG_SPACE(sizeof(int)) + /* fd */
-                                    CMSG_SPACE(NAME_MAX)]; /* selinux label */
-                } control = {};
-                union sockaddr_union sa = {};
-                struct msghdr msghdr = {
-                        .msg_iov = &iovec,
-                        .msg_iovlen = 1,
-                        .msg_control = &control,
-                        .msg_controllen = sizeof(control),
-                        .msg_name = &sa,
-                        .msg_namelen = sizeof(sa),
-                };
-
-                ssize_t n;
-                int *fds = NULL;
-                unsigned n_fds = 0;
-                int v = 0;
-                size_t m;
-
-                /* Try to get the right size, if we can. (Not all
-                 * sockets support SIOCINQ, hence we just try, but
-                 * don't rely on it. */
-                (void) ioctl(fd, SIOCINQ, &v);
-
-                /* Fix it up, if it is too small. We use the same fixed value as auditd here. Awful! */
-                m = PAGE_ALIGN(MAX3((size_t) v + 1,
-                                    (size_t) LINE_MAX,
-                                    ALIGN(sizeof(struct nlmsghdr)) + ALIGN((size_t) MAX_AUDIT_MESSAGE_LENGTH)) + 1);
-
-                if (!GREEDY_REALLOC(s->buffer, s->buffer_size, m))
-                        return log_oom();
-
-                iovec.iov_base = s->buffer;
-                iovec.iov_len = s->buffer_size - 1; /* Leave room for trailing NUL we add later */
-
-                n = recvmsg(fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
-                if (n < 0) {
-                        if (errno == EINTR || errno == EAGAIN)
-                                return 0;
-
-                        log_error_errno(errno, "recvmsg() failed: %m");
-                        return -errno;
-                }
+        /* Try to get the right size, if we can. (Not all
+         * sockets support SIOCINQ, hence we just try, but
+         * don't rely on it. */
+        (void) ioctl(fd, SIOCINQ, &v);
 
-                for (cmsg = CMSG_FIRSTHDR(&msghdr); cmsg; cmsg = CMSG_NXTHDR(&msghdr, cmsg)) {
-
-                        if (cmsg->cmsg_level == SOL_SOCKET &&
-                            cmsg->cmsg_type == SCM_CREDENTIALS &&
-                            cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred)))
-                                ucred = (struct ucred*) CMSG_DATA(cmsg);
-                        else if (cmsg->cmsg_level == SOL_SOCKET &&
-                                 cmsg->cmsg_type == SCM_SECURITY) {
-                                label = (char*) CMSG_DATA(cmsg);
-                                label_len = cmsg->cmsg_len - CMSG_LEN(0);
-                        } else if (cmsg->cmsg_level == SOL_SOCKET &&
-                                   cmsg->cmsg_type == SO_TIMESTAMP &&
-                                   cmsg->cmsg_len == CMSG_LEN(sizeof(struct timeval)))
-                                tv = (struct timeval*) CMSG_DATA(cmsg);
-                        else if (cmsg->cmsg_level == SOL_SOCKET &&
-                                 cmsg->cmsg_type == SCM_RIGHTS) {
-                                fds = (int*) CMSG_DATA(cmsg);
-                                n_fds = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int);
-                        }
-                }
+        /* Fix it up, if it is too small. We use the same fixed value as auditd here. Awful! */
+        m = PAGE_ALIGN(MAX3((size_t) v + 1,
+                            (size_t) LINE_MAX,
+                            ALIGN(sizeof(struct nlmsghdr)) + ALIGN((size_t) MAX_AUDIT_MESSAGE_LENGTH)) + 1);
 
-                /* And a trailing NUL, just in case */
-                s->buffer[n] = 0;
+        if (!GREEDY_REALLOC(s->buffer, s->buffer_size, m))
+                return log_oom();
 
-                if (fd == s->syslog_fd) {
-                        if (n > 0 && n_fds == 0)
-                                server_process_syslog_message(s, strstrip(s->buffer), ucred, tv, label, label_len);
-                        else if (n_fds > 0)
-                                log_warning("Got file descriptors via syslog socket. Ignoring.");
+        iovec.iov_base = s->buffer;
+        iovec.iov_len = s->buffer_size - 1; /* Leave room for trailing NUL we add later */
 
-                } else if (fd == s->native_fd) {
-                        if (n > 0 && n_fds == 0)
-                                server_process_native_message(s, s->buffer, n, ucred, tv, label, label_len);
-                        else if (n == 0 && n_fds == 1)
-                                server_process_native_file(s, fds[0], ucred, tv, label, label_len);
-                        else if (n_fds > 0)
-                                log_warning("Got too many file descriptors via native socket. Ignoring.");
+        n = recvmsg(fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
+        if (n < 0) {
+                if (errno == EINTR || errno == EAGAIN)
+                        return 0;
 
-                } else {
-                        assert(fd == s->audit_fd);
+                return log_error_errno(errno, "recvmsg() failed: %m");
+        }
 
-                        if (n > 0 && n_fds == 0)
-                                server_process_audit_message(s, s->buffer, n, ucred, &sa, msghdr.msg_namelen);
-                        else if (n_fds > 0)
-                                log_warning("Got file descriptors via audit socket. Ignoring.");
+        CMSG_FOREACH(cmsg, &msghdr) {
+
+                if (cmsg->cmsg_level == SOL_SOCKET &&
+                    cmsg->cmsg_type == SCM_CREDENTIALS &&
+                    cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred)))
+                        ucred = (struct ucred*) CMSG_DATA(cmsg);
+                else if (cmsg->cmsg_level == SOL_SOCKET &&
+                         cmsg->cmsg_type == SCM_SECURITY) {
+                        label = (char*) CMSG_DATA(cmsg);
+                        label_len = cmsg->cmsg_len - CMSG_LEN(0);
+                } else if (cmsg->cmsg_level == SOL_SOCKET &&
+                           cmsg->cmsg_type == SO_TIMESTAMP &&
+                           cmsg->cmsg_len == CMSG_LEN(sizeof(struct timeval)))
+                        tv = (struct timeval*) CMSG_DATA(cmsg);
+                else if (cmsg->cmsg_level == SOL_SOCKET &&
+                         cmsg->cmsg_type == SCM_RIGHTS) {
+                        fds = (int*) CMSG_DATA(cmsg);
+                        n_fds = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int);
                 }
+        }
+
+        /* And a trailing NUL, just in case */
+        s->buffer[n] = 0;
+
+        if (fd == s->syslog_fd) {
+                if (n > 0 && n_fds == 0)
+                        server_process_syslog_message(s, strstrip(s->buffer), ucred, tv, label, label_len);
+                else if (n_fds > 0)
+                        log_warning("Got file descriptors via syslog socket. Ignoring.");
+
+        } else if (fd == s->native_fd) {
+                if (n > 0 && n_fds == 0)
+                        server_process_native_message(s, s->buffer, n, ucred, tv, label, label_len);
+                else if (n == 0 && n_fds == 1)
+                        server_process_native_file(s, fds[0], ucred, tv, label, label_len);
+                else if (n_fds > 0)
+                        log_warning("Got too many file descriptors via native socket. Ignoring.");
 
-                close_many(fds, n_fds);
+        } else {
+                assert(fd == s->audit_fd);
+
+                if (n > 0 && n_fds == 0)
+                        server_process_audit_message(s, s->buffer, n, ucred, &sa, msghdr.msg_namelen);
+                else if (n_fds > 0)
+                        log_warning("Got file descriptors via audit socket. Ignoring.");
         }
+
+        close_many(fds, n_fds);
+        return 0;
 }
 
 static int dispatch_sigusr1(sd_event_source *es, const struct signalfd_siginfo *si, void *userdata) {
diff --git a/src/journal/journald-syslog.c b/src/journal/journald-syslog.c
index 90b7530946..ffba451955 100644
--- a/src/journal/journald-syslog.c
+++ b/src/journal/journald-syslog.c
@@ -234,7 +234,8 @@ size_t syslog_parse_identifier(const char **buf, char **identifier, char **pid)
         if (t)
                 *identifier = t;
 
-        e += strspn(p + e, WHITESPACE);
+        if (strchr(WHITESPACE, p[e]))
+                e++;
         *buf = p + e;
         return e;
 }
diff --git a/src/libsystemd-network/sd-dhcp-client.c b/src/libsystemd-network/sd-dhcp-client.c
index 0193e42d65..6853038b67 100644
--- a/src/libsystemd-network/sd-dhcp-client.c
+++ b/src/libsystemd-network/sd-dhcp-client.c
@@ -1588,7 +1588,7 @@ static int client_receive_message_raw(sd_event_source *s, int fd,
         } else if ((size_t)len < sizeof(DHCPPacket))
                 return 0;
 
-        for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
+        CMSG_FOREACH(cmsg, &msg) {
                 if (cmsg->cmsg_level == SOL_PACKET &&
                     cmsg->cmsg_type == PACKET_AUXDATA &&
                     cmsg->cmsg_len == CMSG_LEN(sizeof(struct tpacket_auxdata))) {
diff --git a/src/libsystemd-network/sd-dhcp-lease.c b/src/libsystemd-network/sd-dhcp-lease.c
index 8a4220621b..d8bc76edda 100644
--- a/src/libsystemd-network/sd-dhcp-lease.c
+++ b/src/libsystemd-network/sd-dhcp-lease.c
@@ -32,6 +32,7 @@
 #include "dhcp-lease-internal.h"
 #include "sd-dhcp-lease.h"
 #include "network-internal.h"
+#include "dns-domain.h"
 
 int sd_dhcp_lease_get_address(sd_dhcp_lease *lease, struct in_addr *addr) {
         assert_return(lease, -EINVAL);
@@ -504,9 +505,18 @@ int dhcp_lease_parse_options(uint8_t code, uint8_t len, const uint8_t *option,
                 if (e)
                         *e = 0;
 
-                if (!hostname_is_valid(domainname) || is_localhost(domainname))
+                if (is_localhost(domainname))
                         break;
 
+                r = dns_name_is_valid(domainname);
+                if (r <= 0) {
+                        if (r < 0)
+                                log_error_errno(r, "Failed to validate domain name: %s: %m", domainname);
+                        if (r == 0)
+                                log_warning("Domain name is not valid, ignoring: %s", domainname);
+                        break;
+                }
+
                 free(lease->domainname);
                 lease->domainname = domainname;
                 domainname = NULL;
diff --git a/src/libsystemd-network/sd-dhcp-server.c b/src/libsystemd-network/sd-dhcp-server.c
index a0a2320efa..cc5e032344 100644
--- a/src/libsystemd-network/sd-dhcp-server.c
+++ b/src/libsystemd-network/sd-dhcp-server.c
@@ -902,7 +902,7 @@ static int server_receive_message(sd_event_source *s, int fd,
         else if ((size_t)len < sizeof(DHCPMessage))
                 return 0;
 
-        for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
+        CMSG_FOREACH(cmsg, &msg) {
                 if (cmsg->cmsg_level == IPPROTO_IP &&
                     cmsg->cmsg_type == IP_PKTINFO &&
                     cmsg->cmsg_len == CMSG_LEN(sizeof(struct in_pktinfo))) {
diff --git a/src/libsystemd-network/test-pppoe.c b/src/libsystemd-network/test-pppoe.c
index 9c8d6f7779..cc51197295 100644
--- a/src/libsystemd-network/test-pppoe.c
+++ b/src/libsystemd-network/test-pppoe.c
@@ -94,7 +94,7 @@ static int test_pppoe_server(sd_event *e) {
 
         assert_se(r >= 0);
 
-        assert_se(sd_rtnl_open(&rtnl, 0) >= 0);
+        assert_se(sd_rtnl_open(&rtnl) >= 0);
         assert_se(sd_rtnl_attach_event(rtnl, e, 0) >= 0);
 
         assert_se(sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0) >= 0);
diff --git a/src/libsystemd-terminal/grdev-drm.c b/src/libsystemd-terminal/grdev-drm.c
index 4cee95f469..30c1a726eb 100644
--- a/src/libsystemd-terminal/grdev-drm.c
+++ b/src/libsystemd-terminal/grdev-drm.c
@@ -30,7 +30,7 @@
 #include <unistd.h>
 
 /* Yuck! DRM headers need system headers included first.. but we have to
- * include it before shared/missing.h to avoid redefining ioctl bits */
+ * include it before util/missing.h to avoid redefining ioctl bits */
 #include <drm.h>
 #include <drm_fourcc.h>
 #include <drm_mode.h>
diff --git a/src/libsystemd-terminal/grdev.c b/src/libsystemd-terminal/grdev.c
index c386e65982..71f0bd31e7 100644
--- a/src/libsystemd-terminal/grdev.c
+++ b/src/libsystemd-terminal/grdev.c
@@ -25,7 +25,7 @@
 #include "sd-bus.h"
 #include "sd-event.h"
 #include "hashmap.h"
-#include "login-shared.h"
+#include "login-util.h"
 #include "macro.h"
 #include "util.h"
 #include "grdev.h"
diff --git a/src/libsystemd-terminal/idev.c b/src/libsystemd-terminal/idev.c
index b187934977..b92a393b69 100644
--- a/src/libsystemd-terminal/idev.c
+++ b/src/libsystemd-terminal/idev.c
@@ -25,7 +25,7 @@
 #include "sd-bus.h"
 #include "sd-event.h"
 #include "hashmap.h"
-#include "login-shared.h"
+#include "login-util.h"
 #include "macro.h"
 #include "util.h"
 #include "idev.h"
diff --git a/src/libsystemd/sd-bus/bus-bloom.c b/src/libsystemd/sd-bus/bus-bloom.c
index 3556774074..91fab90cb0 100644
--- a/src/libsystemd/sd-bus/bus-bloom.c
+++ b/src/libsystemd/sd-bus/bus-bloom.c
@@ -116,11 +116,19 @@ void bloom_add_prefixes(uint64_t filter[], size_t size, unsigned k, const char *
         p = stpcpy(stpcpy(c, a), ":");
         strcpy(p, b);
 
+        bloom_add_data(filter, size, k, c, n);
+
         for (;;) {
                 char *e;
 
                 e = strrchr(p, sep);
-                if (!e || e == p)
+                if (!e)
+                        break;
+
+                *(e + 1) = 0;
+                bloom_add_data(filter, size, k, c, e - c + 1);
+
+                if (e == p)
                         break;
 
                 *e = 0;
diff --git a/src/libsystemd/sd-bus/bus-container.c b/src/libsystemd/sd-bus/bus-container.c
index f157c25bba..fa7a207448 100644
--- a/src/libsystemd/sd-bus/bus-container.c
+++ b/src/libsystemd/sd-bus/bus-container.c
@@ -222,7 +222,7 @@ int bus_container_connect_kernel(sd_bus *b) {
         if (recvmsg(pair[0], &mh, MSG_NOSIGNAL|MSG_CMSG_CLOEXEC) < 0)
                 return -errno;
 
-        for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg))
+        CMSG_FOREACH(cmsg, &mh)
                 if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
                         int *fds;
                         unsigned n_fds;
diff --git a/src/libsystemd/sd-bus/bus-control.c b/src/libsystemd/sd-bus/bus-control.c
index 1103903358..7a59702cb2 100644
--- a/src/libsystemd/sd-bus/bus-control.c
+++ b/src/libsystemd/sd-bus/bus-control.c
@@ -1291,10 +1291,8 @@ int bus_add_match_internal_kernel(
                         break;
 
                 case BUS_MATCH_PATH_NAMESPACE:
-                        if (!streq(c->value_str, "/")) {
-                                bloom_add_pair(bloom, bus->bloom_size, bus->bloom_n_hash, "path-slash-prefix", c->value_str);
-                                using_bloom = true;
-                        }
+                        bloom_add_pair(bloom, bus->bloom_size, bus->bloom_n_hash, "path-slash-prefix", c->value_str);
+                        using_bloom = true;
                         break;
 
                 case BUS_MATCH_ARG...BUS_MATCH_ARG_LAST: {
@@ -1310,11 +1308,18 @@ int bus_add_match_internal_kernel(
                 }
 
                 case BUS_MATCH_ARG_PATH...BUS_MATCH_ARG_PATH_LAST: {
-                        char buf[sizeof("arg")-1 + 2 + sizeof("-slash-prefix")];
-
-                        xsprintf(buf, "arg%i-slash-prefix", c->type - BUS_MATCH_ARG_PATH);
-                        bloom_add_pair(bloom, bus->bloom_size, bus->bloom_n_hash, buf, c->value_str);
-                        using_bloom = true;
+                        /*
+                         * XXX: DBus spec defines arg[0..63]path= matching to be
+                         * a two-way glob. That is, if either string is a prefix
+                         * of the other, it matches.
+                         * This is really hard to realize in bloom-filters, as
+                         * we would have to create a bloom-match for each prefix
+                         * of @c->value_str. This is excessive, hence we just
+                         * ignore all those matches and accept everything from
+                         * the kernel. People should really avoid those matches.
+                         * If they're used in real-life some day, we will have
+                         * to properly support multiple-matches here.
+                         */
                         break;
                 }
 
diff --git a/src/libsystemd/sd-bus/bus-internal.c b/src/libsystemd/sd-bus/bus-internal.c
index 91b288cd25..fea796cd30 100644
--- a/src/libsystemd/sd-bus/bus-internal.c
+++ b/src/libsystemd/sd-bus/bus-internal.c
@@ -19,6 +19,7 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
+#include "bus-message.h"
 #include "bus-internal.h"
 
 bool object_path_is_valid(const char *p) {
@@ -211,6 +212,17 @@ bool member_name_is_valid(const char *p) {
         return true;
 }
 
+/*
+ * Complex pattern match
+ * This checks whether @a is a 'complex-prefix' of @b, or @b is a
+ * 'complex-prefix' of @a, based on strings that consist of labels with @c as
+ * spearator. This function returns true if:
+ *   - both strings are equal
+ *   - either is a prefix of the other and ends with @c
+ * The second rule makes sure that either string needs to be fully included in
+ * the other, and the string which is considered the prefix needs to end with a
+ * separator.
+ */
 static bool complex_pattern_check(char c, const char *a, const char *b) {
         bool separator = false;
 
@@ -222,9 +234,7 @@ static bool complex_pattern_check(char c, const char *a, const char *b) {
 
         for (;;) {
                 if (*a != *b)
-                        return (separator && (*a == 0 || *b == 0)) ||
-                                (*a == 0 && *b == c && b[1] == 0) ||
-                                (*b == 0 && *a == c && a[1] == 0);
+                        return (separator && (*a == 0 || *b == 0));
 
                 if (*a == 0)
                         return true;
@@ -243,7 +253,18 @@ bool path_complex_pattern(const char *pattern, const char *value) {
         return complex_pattern_check('/', pattern, value);
 }
 
+/*
+ * Simple pattern match
+ * This checks whether @a is a 'simple-prefix' of @b, based on strings that
+ * consist of labels with @c as separator. This function returns true, if:
+ *   - if @a and @b are equal
+ *   - if @a is a prefix of @b, and the first following character in @b (or the
+ *     last character in @a) is @c
+ * The second rule basically makes sure that if @a is a prefix of @b, then @b
+ * must follow with a new label separated by @c. It cannot extend the label.
+ */
 static bool simple_pattern_check(char c, const char *a, const char *b) {
+        bool separator = false;
 
         if (!a && !b)
                 return true;
@@ -253,11 +274,13 @@ static bool simple_pattern_check(char c, const char *a, const char *b) {
 
         for (;;) {
                 if (*a != *b)
-                        return *a == 0 && *b == c;
+                        return *a == 0 && (*b == c || separator);
 
                 if (*a == 0)
                         return true;
 
+                separator = *a == c;
+
                 a++, b++;
         }
 }
@@ -323,3 +346,28 @@ char *bus_address_escape(const char *v) {
         *b = 0;
         return r;
 }
+
+int bus_maybe_reply_error(sd_bus_message *m, int r, sd_bus_error *error) {
+        assert(m);
+
+        if (r < 0) {
+                if (m->header->type == SD_BUS_MESSAGE_METHOD_CALL)
+                        sd_bus_reply_method_errno(m, r, error);
+
+        } else if (sd_bus_error_is_set(error)) {
+                if (m->header->type == SD_BUS_MESSAGE_METHOD_CALL)
+                        sd_bus_reply_method_error(m, error);
+        } else
+                return r;
+
+        log_debug("Failed to process message [type=%s sender=%s path=%s interface=%s member=%s signature=%s]: %s",
+                  bus_message_type_to_string(m->header->type),
+                  strna(m->sender),
+                  strna(m->path),
+                  strna(m->interface),
+                  strna(m->member),
+                  strna(m->root_container.signature),
+                  bus_error_message(error, r));
+
+        return 1;
+}
diff --git a/src/libsystemd/sd-bus/bus-internal.h b/src/libsystemd/sd-bus/bus-internal.h
index 2ee0eabc02..88c058889a 100644
--- a/src/libsystemd/sd-bus/bus-internal.h
+++ b/src/libsystemd/sd-bus/bus-internal.h
@@ -390,3 +390,5 @@ int bus_set_address_system_machine(sd_bus *b, const char *machine);
 int bus_remove_match_by_string(sd_bus *bus, const char *match, sd_bus_message_handler_t callback, void *userdata);
 
 int bus_get_root_path(sd_bus *bus);
+
+int bus_maybe_reply_error(sd_bus_message *m, int r, sd_bus_error *error);
diff --git a/src/libsystemd/sd-bus/bus-socket.c b/src/libsystemd/sd-bus/bus-socket.c
index 9f3756f0c2..322d57ddbb 100644
--- a/src/libsystemd/sd-bus/bus-socket.c
+++ b/src/libsystemd/sd-bus/bus-socket.c
@@ -502,7 +502,6 @@ static int bus_socket_read_auth(sd_bus *b) {
                 struct cmsghdr cmsghdr;
                 uint8_t buf[CMSG_SPACE(sizeof(int) * BUS_FDS_MAX)];
         } control;
-        struct cmsghdr *cmsg;
         bool handle_cmsg = false;
 
         assert(b);
@@ -552,8 +551,10 @@ static int bus_socket_read_auth(sd_bus *b) {
 
         b->rbuffer_size += k;
 
-        if (handle_cmsg)
-                for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg))
+        if (handle_cmsg) {
+                struct cmsghdr *cmsg;
+
+                CMSG_FOREACH(cmsg, &mh)
                         if (cmsg->cmsg_level == SOL_SOCKET &&
                             cmsg->cmsg_type == SCM_RIGHTS) {
                                 int j;
@@ -567,6 +568,7 @@ static int bus_socket_read_auth(sd_bus *b) {
                         } else
                                 log_debug("Got unexpected auxiliary data with level=%d and type=%d",
                                           cmsg->cmsg_level, cmsg->cmsg_type);
+        }
 
         r = bus_socket_auth_verify(b);
         if (r != 0)
@@ -916,7 +918,6 @@ int bus_socket_read_message(sd_bus *bus) {
                 struct cmsghdr cmsghdr;
                 uint8_t buf[CMSG_SPACE(sizeof(int) * BUS_FDS_MAX)];
         } control;
-        struct cmsghdr *cmsg;
         bool handle_cmsg = false;
 
         assert(bus);
@@ -961,8 +962,10 @@ int bus_socket_read_message(sd_bus *bus) {
 
         bus->rbuffer_size += k;
 
-        if (handle_cmsg)
-                for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg))
+        if (handle_cmsg) {
+                struct cmsghdr *cmsg;
+
+                CMSG_FOREACH(cmsg, &mh)
                         if (cmsg->cmsg_level == SOL_SOCKET &&
                             cmsg->cmsg_type == SCM_RIGHTS) {
                                 int n, *f;
@@ -990,6 +993,7 @@ int bus_socket_read_message(sd_bus *bus) {
                         } else
                                 log_debug("Got unexpected auxiliary data with level=%d and type=%d",
                                           cmsg->cmsg_level, cmsg->cmsg_type);
+        }
 
         r = bus_socket_read_message_need(bus, &need);
         if (r < 0)
diff --git a/src/libsystemd/sd-bus/test-bus-kernel-bloom.c b/src/libsystemd/sd-bus/test-bus-kernel-bloom.c
index b11c43bd7b..90eb1f2a33 100644
--- a/src/libsystemd/sd-bus/test-bus-kernel-bloom.c
+++ b/src/libsystemd/sd-bus/test-bus-kernel-bloom.c
@@ -26,6 +26,14 @@
 #include "bus-kernel.h"
 #include "bus-util.h"
 
+static int test_match(sd_bus_message *m, void *userdata, sd_bus_error *ret_error) {
+        int *found = userdata;
+
+        *found = 1;
+
+        return 0;
+}
+
 static void test_one(
                 const char *path,
                 const char *interface,
@@ -39,7 +47,7 @@ static void test_one(
         _cleanup_free_ char *name = NULL, *bus_name = NULL, *address = NULL;
         _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
         sd_bus *a, *b;
-        int r;
+        int r, found = 0;
 
         assert_se(asprintf(&name, "deine-mutter-%u", (unsigned) getpid()) >= 0);
 
@@ -71,7 +79,7 @@ static void test_one(
         assert_se(r >= 0);
 
         log_debug("match");
-        r = sd_bus_add_match(b, NULL, match, NULL, NULL);
+        r = sd_bus_add_match(b, NULL, match, test_match, &found);
         assert_se(r >= 0);
 
         log_debug("signal");
@@ -83,7 +91,7 @@ static void test_one(
         assert_se(r >= 0);
 
         r = sd_bus_process(b, &m);
-        assert_se(r >= 0 && (good == !!m));
+        assert_se(r >= 0 && good == !!found);
 
         sd_bus_unref(a);
         sd_bus_unref(b);
@@ -115,6 +123,17 @@ int main(int argc, char *argv[]) {
         test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "foobar", "path_namespace='/foo'", true);
         test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "foobar", "path_namespace='/'", true);
         test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "foobar", "path_namespace='/quux'", false);
+        test_one("/", "waldo.com", "Piep", false, "foobar", "path_namespace='/'", true);
+
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "foobar", "path='/foo/bar/waldo/'", false);
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "foobar", "path='/foo/'", false);
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "foobar", "path_namespace='/foo/bar/waldo/'", false);
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "foobar", "path_namespace='/foo/'", true);
+
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "/foo/bar/waldo", "arg0path='/foo/'", true);
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "/foo", "arg0path='/foo'", true);
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "/foo", "arg0path='/foo/bar/waldo'", false);
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "/foo/", "arg0path='/foo/bar/waldo'", true);
 
         return 0;
 }
diff --git a/src/libsystemd/sd-bus/test-bus-signature.c b/src/libsystemd/sd-bus/test-bus-signature.c
index 4165c9273a..17c6188ca0 100644
--- a/src/libsystemd/sd-bus/test-bus-signature.c
+++ b/src/libsystemd/sd-bus/test-bus-signature.c
@@ -95,23 +95,28 @@ int main(int argc, char *argv[]) {
         assert_se(!namespace_complex_pattern("foo.", ""));
 
         assert_se(path_complex_pattern("", ""));
-        assert_se(path_complex_pattern("", "/"));
-        assert_se(path_complex_pattern("/", ""));
+        assert_se(!path_complex_pattern("", "/"));
+        assert_se(!path_complex_pattern("/", ""));
         assert_se(path_complex_pattern("/", "/"));
         assert_se(path_complex_pattern("/foobar/", "/"));
-        assert_se(path_complex_pattern("/foobar/", "/foobar"));
+        assert_se(!path_complex_pattern("/foobar/", "/foobar"));
         assert_se(path_complex_pattern("/foobar", "/foobar"));
-        assert_se(path_complex_pattern("/foobar", "/foobar/"));
+        assert_se(!path_complex_pattern("/foobar", "/foobar/"));
         assert_se(!path_complex_pattern("/foobar", "/foobar/waldo"));
         assert_se(path_complex_pattern("/foobar/", "/foobar/waldo"));
+        assert_se(path_complex_pattern("/foobar/waldo", "/foobar/"));
+
+        assert_se(path_simple_pattern("/foo/", "/foo/bar/waldo"));
 
         assert_se(namespace_simple_pattern("", ""));
+        assert_se(namespace_simple_pattern("", ".foobar"));
         assert_se(namespace_simple_pattern("foobar", "foobar"));
         assert_se(namespace_simple_pattern("foobar.waldo", "foobar.waldo"));
         assert_se(namespace_simple_pattern("foobar", "foobar.waldo"));
         assert_se(!namespace_simple_pattern("foobar.waldo", "foobar"));
         assert_se(!namespace_simple_pattern("", "foo"));
         assert_se(!namespace_simple_pattern("foo", ""));
+        assert_se(namespace_simple_pattern("foo.", "foo.bar.waldo"));
 
         assert_se(streq(object_path_startswith("/foo/bar", "/foo"), "bar"));
         assert_se(streq(object_path_startswith("/foo", "/foo"), ""));
diff --git a/src/libsystemd/sd-login/sd-login.c b/src/libsystemd/sd-login/sd-login.c
index ed8aa0952a..e3885ecba6 100644
--- a/src/libsystemd/sd-login/sd-login.c
+++ b/src/libsystemd/sd-login/sd-login.c
@@ -30,7 +30,7 @@
 #include "macro.h"
 #include "strv.h"
 #include "fileio.h"
-#include "login-shared.h"
+#include "login-util.h"
 #include "formats-util.h"
 #include "sd-login.h"
 
diff --git a/src/libsystemd/sd-network/sd-network.c b/src/libsystemd/sd-network/sd-network.c
index db1f6997cb..b63fdf8fcb 100644
--- a/src/libsystemd/sd-network/sd-network.c
+++ b/src/libsystemd/sd-network/sd-network.c
@@ -297,8 +297,31 @@ static inline sd_network_monitor* FD_TO_MONITOR(int fd) {
         return (sd_network_monitor*) (unsigned long) (fd + 1);
 }
 
+static int monitor_add_inotify_watch(int fd) {
+        int k;
+
+        k = inotify_add_watch(fd, "/run/systemd/netif/links/", IN_MOVED_TO|IN_DELETE);
+        if (k >= 0)
+                return 0;
+        else if (errno != ENOENT)
+                return -errno;
+
+        k = inotify_add_watch(fd, "/run/systemd/netif/", IN_CREATE|IN_ISDIR);
+        if (k >= 0)
+                return 0;
+        else if (errno != ENOENT)
+                return -errno;
+
+        k = inotify_add_watch(fd, "/run/systemd/", IN_CREATE|IN_ISDIR);
+        if (k < 0)
+                return -errno;
+
+        return 0;
+}
+
 _public_ int sd_network_monitor_new(sd_network_monitor **m, const char *category) {
-        int fd, k;
+        _cleanup_close_ int fd = -1;
+        int k;
         bool good = false;
 
         assert_return(m, -EINVAL);
@@ -308,40 +331,64 @@ _public_ int sd_network_monitor_new(sd_network_monitor **m, const char *category
                 return -errno;
 
         if (!category || streq(category, "links")) {
-                k = inotify_add_watch(fd, "/run/systemd/netif/links/", IN_MOVED_TO|IN_DELETE);
-                if (k < 0) {
-                        safe_close(fd);
-                        return -errno;
-                }
+                k = monitor_add_inotify_watch(fd);
+                if (k < 0)
+                        return k;
 
                 good = true;
         }
 
-        if (!good) {
-                close_nointr(fd);
+        if (!good)
                 return -EINVAL;
-        }
 
         *m = FD_TO_MONITOR(fd);
+        fd = -1;
+
         return 0;
 }
 
 _public_ sd_network_monitor* sd_network_monitor_unref(sd_network_monitor *m) {
         int fd;
 
-        assert_return(m, NULL);
-
-        fd = MONITOR_TO_FD(m);
-        close_nointr(fd);
+        if (m) {
+                fd = MONITOR_TO_FD(m);
+                close_nointr(fd);
+        }
 
         return NULL;
 }
 
 _public_ int sd_network_monitor_flush(sd_network_monitor *m) {
+        union inotify_event_buffer buffer;
+        struct inotify_event *e;
+        ssize_t l;
+        int fd, k;
 
         assert_return(m, -EINVAL);
 
-        return flush_fd(MONITOR_TO_FD(m));
+        fd = MONITOR_TO_FD(m);
+
+        l = read(fd, &buffer, sizeof(buffer));
+        if (l < 0) {
+                if (errno == EAGAIN || errno == EINTR)
+                        return 0;
+
+                return -errno;
+        }
+
+        FOREACH_INOTIFY_EVENT(e, buffer, l) {
+                if (e->mask & IN_ISDIR) {
+                        k = monitor_add_inotify_watch(fd);
+                        if (k < 0)
+                                return k;
+
+                        k = inotify_rm_watch(fd, e->wd);
+                        if (k < 0)
+                                return -errno;
+                }
+        }
+
+        return 0;
 }
 
 _public_ int sd_network_monitor_get_fd(sd_network_monitor *m) {
diff --git a/src/libsystemd/sd-rtnl/local-addresses.c b/src/libsystemd/sd-rtnl/local-addresses.c
index 31bfa06066..f05cbf1f47 100644
--- a/src/libsystemd/sd-rtnl/local-addresses.c
+++ b/src/libsystemd/sd-rtnl/local-addresses.c
@@ -66,7 +66,7 @@ int local_addresses(sd_rtnl *context, int ifindex, int af, struct local_address
         if (context)
                 rtnl = sd_rtnl_ref(context);
         else {
-                r = sd_rtnl_open(&rtnl, 0);
+                r = sd_rtnl_open(&rtnl);
                 if (r < 0)
                         return r;
         }
@@ -177,7 +177,7 @@ int local_gateways(sd_rtnl *context, int ifindex, int af, struct local_address *
         if (context)
                 rtnl = sd_rtnl_ref(context);
         else {
-                r = sd_rtnl_open(&rtnl, 0);
+                r = sd_rtnl_open(&rtnl);
                 if (r < 0)
                         return r;
         }
diff --git a/src/libsystemd/sd-rtnl/rtnl-message.c b/src/libsystemd/sd-rtnl/rtnl-message.c
index bab2a4ff08..79e67f6953 100644
--- a/src/libsystemd/sd-rtnl/rtnl-message.c
+++ b/src/libsystemd/sd-rtnl/rtnl-message.c
@@ -24,6 +24,7 @@
 #include <unistd.h>
 
 #include "util.h"
+#include "socket-util.h"
 #include "formats-util.h"
 #include "refcnt.h"
 #include "missing.h"
@@ -1415,17 +1416,18 @@ int socket_write_message(sd_rtnl *nl, sd_rtnl_message *m) {
 }
 
 static int socket_recv_message(int fd, struct iovec *iov, uint32_t *_group, bool peek) {
-        uint8_t cred_buffer[CMSG_SPACE(sizeof(struct ucred)) +
-                            CMSG_SPACE(sizeof(struct nl_pktinfo))];
+        union sockaddr_union sender;
+        uint8_t cmsg_buffer[CMSG_SPACE(sizeof(struct nl_pktinfo))];
         struct msghdr msg = {
                 .msg_iov = iov,
                 .msg_iovlen = 1,
-                .msg_control = cred_buffer,
-                .msg_controllen = sizeof(cred_buffer),
+                .msg_name = &sender,
+                .msg_namelen = sizeof(sender),
+                .msg_control = cmsg_buffer,
+                .msg_controllen = sizeof(cmsg_buffer),
         };
         struct cmsghdr *cmsg;
         uint32_t group = 0;
-        bool auth = false;
         int r;
 
         assert(fd >= 0);
@@ -1442,29 +1444,10 @@ static int socket_recv_message(int fd, struct iovec *iov, uint32_t *_group, bool
                 return (errno == EAGAIN || errno == EINTR) ? 0 : -errno;
         }
 
-        for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
-                if (cmsg->cmsg_level == SOL_SOCKET &&
-                    cmsg->cmsg_type == SCM_CREDENTIALS &&
-                    cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred))) {
-                        struct ucred *ucred = (void *)CMSG_DATA(cmsg);
-
-                        /* from the kernel */
-                        if (ucred->pid == 0)
-                                auth = true;
-                        else
-                                log_debug("rtnl: ignoring message from PID "PID_FMT, ucred->pid);
-                } else if (cmsg->cmsg_level == SOL_NETLINK &&
-                           cmsg->cmsg_type == NETLINK_PKTINFO &&
-                           cmsg->cmsg_len == CMSG_LEN(sizeof(struct nl_pktinfo))) {
-                        struct nl_pktinfo *pktinfo = (void *)CMSG_DATA(cmsg);
-
-                        /* multi-cast group */
-                        group = pktinfo->group;
-                }
-        }
-
-        if (!auth) {
+        if (sender.nl.nl_pid != 0) {
                 /* not from the kernel, ignore */
+                log_debug("rtnl: ignoring message from portid %"PRIu32, sender.nl.nl_pid);
+
                 if (peek) {
                         /* drop the message */
                         r = recvmsg(fd, &msg, 0);
@@ -1475,6 +1458,17 @@ static int socket_recv_message(int fd, struct iovec *iov, uint32_t *_group, bool
                 return 0;
         }
 
+        CMSG_FOREACH(cmsg, &msg) {
+                if (cmsg->cmsg_level == SOL_NETLINK &&
+                    cmsg->cmsg_type == NETLINK_PKTINFO &&
+                    cmsg->cmsg_len == CMSG_LEN(sizeof(struct nl_pktinfo))) {
+                        struct nl_pktinfo *pktinfo = (void *)CMSG_DATA(cmsg);
+
+                        /* multi-cast group */
+                        group = pktinfo->group;
+                }
+        }
+
         if (_group)
                 *_group = group;
 
diff --git a/src/libsystemd/sd-rtnl/rtnl-util.c b/src/libsystemd/sd-rtnl/rtnl-util.c
index 9ddf074c24..c2b1a5c65d 100644
--- a/src/libsystemd/sd-rtnl/rtnl-util.c
+++ b/src/libsystemd/sd-rtnl/rtnl-util.c
@@ -34,7 +34,7 @@ int rtnl_set_link_name(sd_rtnl **rtnl, int ifindex, const char *name) {
         assert(name);
 
         if (!*rtnl) {
-                r = sd_rtnl_open(rtnl, 0);
+                r = sd_rtnl_open(rtnl);
                 if (r < 0)
                         return r;
         }
@@ -66,7 +66,7 @@ int rtnl_set_link_properties(sd_rtnl **rtnl, int ifindex, const char *alias,
                 return 0;
 
         if (!*rtnl) {
-                r = sd_rtnl_open(rtnl, 0);
+                r = sd_rtnl_open(rtnl);
                 if (r < 0)
                         return r;
         }
diff --git a/src/libsystemd/sd-rtnl/sd-rtnl.c b/src/libsystemd/sd-rtnl/sd-rtnl.c
index 40dea1252f..5bafc282c0 100644
--- a/src/libsystemd/sd-rtnl/sd-rtnl.c
+++ b/src/libsystemd/sd-rtnl/sd-rtnl.c
@@ -106,25 +106,7 @@ static bool rtnl_pid_changed(sd_rtnl *rtnl) {
         return rtnl->original_pid != getpid();
 }
 
-static int rtnl_compute_groups_ap(uint32_t *_groups, unsigned n_groups, va_list ap) {
-        uint32_t groups = 0;
-        unsigned i;
-
-        for (i = 0; i < n_groups; i++) {
-                unsigned group;
-
-                group = va_arg(ap, unsigned);
-                assert_return(group < 32, -EINVAL);
-
-                groups |= group ? (1 << (group - 1)) : 0;
-        }
-
-        *_groups = groups;
-
-        return 0;
-}
-
-static int rtnl_open_fd_ap(sd_rtnl **ret, int fd, unsigned n_groups, va_list ap) {
+int sd_rtnl_open_fd(sd_rtnl **ret, int fd) {
         _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
         socklen_t addrlen;
         int r, one = 1;
@@ -136,18 +118,10 @@ static int rtnl_open_fd_ap(sd_rtnl **ret, int fd, unsigned n_groups, va_list ap)
         if (r < 0)
                 return r;
 
-        r = setsockopt(fd, SOL_SOCKET, SO_PASSCRED, &one, sizeof(one));
-        if (r < 0)
-                return -errno;
-
         r = setsockopt(fd, SOL_NETLINK, NETLINK_PKTINFO, &one, sizeof(one));
         if (r < 0)
                 return -errno;
 
-        r = rtnl_compute_groups_ap(&rtnl->sockaddr.nl.nl_groups, n_groups, ap);
-        if (r < 0)
-                return r;
-
         addrlen = sizeof(rtnl->sockaddr);
 
         r = bind(fd, &rtnl->sockaddr.sa, addrlen);
@@ -167,33 +141,33 @@ static int rtnl_open_fd_ap(sd_rtnl **ret, int fd, unsigned n_groups, va_list ap)
         return 0;
 }
 
-int sd_rtnl_open_fd(sd_rtnl **ret, int fd, unsigned n_groups, ...) {
-        va_list ap;
+int sd_rtnl_open(sd_rtnl **ret) {
+        _cleanup_close_ int fd = -1;
         int r;
 
-        va_start(ap, n_groups);
-        r = rtnl_open_fd_ap(ret, fd, n_groups, ap);
-        va_end(ap);
-
-        return r;
-}
-
-int sd_rtnl_open(sd_rtnl **ret, unsigned n_groups, ...) {
-        va_list ap;
-        int fd, r;
-
         fd = socket(PF_NETLINK, SOCK_RAW|SOCK_CLOEXEC|SOCK_NONBLOCK, NETLINK_ROUTE);
         if (fd < 0)
                 return -errno;
 
-        va_start(ap, n_groups);
-        r = rtnl_open_fd_ap(ret, fd, n_groups, ap);
-        va_end(ap);
-
-        if (r < 0) {
-                safe_close(fd);
+        r = sd_rtnl_open_fd(ret, fd);
+        if (r < 0)
                 return r;
-        }
+
+        fd = -1;
+
+        return 0;
+}
+
+static int rtnl_join_broadcast_group(sd_rtnl *rtnl, unsigned group) {
+        int r;
+
+        assert(rtnl);
+        assert(rtnl->fd >= 0);
+        assert(group > 0);
+
+        r = setsockopt(rtnl->fd, SOL_NETLINK, NETLINK_ADD_MEMBERSHIP, &group, sizeof(group));
+        if (r < 0)
+                return -errno;
 
         return 0;
 }
@@ -1005,14 +979,12 @@ int sd_rtnl_add_match(sd_rtnl *rtnl,
                       uint16_t type,
                       sd_rtnl_message_handler_t callback,
                       void *userdata) {
-        struct match_callback *c;
+        _cleanup_free_ struct match_callback *c = NULL;
+        int r;
 
         assert_return(rtnl, -EINVAL);
         assert_return(callback, -EINVAL);
         assert_return(!rtnl_pid_changed(rtnl), -ECHILD);
-        assert_return(rtnl_message_type_is_link(type) ||
-                      rtnl_message_type_is_addr(type) ||
-                      rtnl_message_type_is_route(type), -EOPNOTSUPP);
 
         c = new0(struct match_callback, 1);
         if (!c)
@@ -1022,8 +994,36 @@ int sd_rtnl_add_match(sd_rtnl *rtnl,
         c->type = type;
         c->userdata = userdata;
 
+        switch (type) {
+                case RTM_NEWLINK:
+                case RTM_SETLINK:
+                case RTM_GETLINK:
+                case RTM_DELLINK:
+                        r = rtnl_join_broadcast_group(rtnl, RTNLGRP_LINK);
+                        if (r < 0)
+                                return r;
+
+                        break;
+                case RTM_NEWADDR:
+                case RTM_GETADDR:
+                case RTM_DELADDR:
+                        r = rtnl_join_broadcast_group(rtnl, RTNLGRP_IPV4_IFADDR);
+                        if (r < 0)
+                                return r;
+
+                        r = rtnl_join_broadcast_group(rtnl, RTNLGRP_IPV6_IFADDR);
+                        if (r < 0)
+                                return r;
+
+                        break;
+                default:
+                        return -EOPNOTSUPP;
+        }
+
         LIST_PREPEND(match_callbacks, rtnl->match_callbacks, c);
 
+        c = NULL;
+
         return 0;
 }
 
@@ -1037,6 +1037,13 @@ int sd_rtnl_remove_match(sd_rtnl *rtnl,
         assert_return(callback, -EINVAL);
         assert_return(!rtnl_pid_changed(rtnl), -ECHILD);
 
+        /* we should unsubscribe from the broadcast groups at this point, but it is not so
+           trivial for a few reasons: the refcounting is a bit of a mess and not obvious
+           how it will look like after we add genetlink support, and it is also not possible
+           to query what broadcast groups were subscribed to when we inherit the socket to get
+           the initial refcount. The latter could indeed be done for the first 32 broadcast
+           groups (which incidentally is all we currently support in .socket units anyway),
+           but we better not rely on only ever using 32 groups. */
         LIST_FOREACH(match_callbacks, c, rtnl->match_callbacks)
                 if (c->callback == callback && c->type == type && c->userdata == userdata) {
                         LIST_REMOVE(match_callbacks, rtnl->match_callbacks, c);
diff --git a/src/libsystemd/sd-rtnl/test-rtnl.c b/src/libsystemd/sd-rtnl/test-rtnl.c
index 47cce64816..94b1cb7c72 100644
--- a/src/libsystemd/sd-rtnl/test-rtnl.c
+++ b/src/libsystemd/sd-rtnl/test-rtnl.c
@@ -184,8 +184,8 @@ static void test_route(void) {
 static void test_multiple(void) {
         sd_rtnl *rtnl1, *rtnl2;
 
-        assert_se(sd_rtnl_open(&rtnl1, 0) >= 0);
-        assert_se(sd_rtnl_open(&rtnl2, 0) >= 0);
+        assert_se(sd_rtnl_open(&rtnl1) >= 0);
+        assert_se(sd_rtnl_open(&rtnl2) >= 0);
 
         rtnl1 = sd_rtnl_unref(rtnl1);
         rtnl2 = sd_rtnl_unref(rtnl2);
@@ -216,7 +216,7 @@ static void test_event_loop(int ifindex) {
         ifname = strdup("lo2");
         assert_se(ifname);
 
-        assert_se(sd_rtnl_open(&rtnl, 0) >= 0);
+        assert_se(sd_rtnl_open(&rtnl) >= 0);
         assert_se(sd_rtnl_message_new_link(rtnl, &m, RTM_GETLINK, ifindex) >= 0);
 
         assert_se(sd_rtnl_call_async(rtnl, m, &link_handler, ifname, 0, NULL) >= 0);
@@ -256,7 +256,7 @@ static void test_async(int ifindex) {
         ifname = strdup("lo");
         assert_se(ifname);
 
-        assert_se(sd_rtnl_open(&rtnl, 0) >= 0);
+        assert_se(sd_rtnl_open(&rtnl) >= 0);
 
         assert_se(sd_rtnl_message_new_link(rtnl, &m, RTM_GETLINK, ifindex) >= 0);
 
@@ -273,7 +273,7 @@ static void test_pipe(int ifindex) {
         _cleanup_rtnl_message_unref_ sd_rtnl_message *m1 = NULL, *m2 = NULL;
         int counter = 0;
 
-        assert_se(sd_rtnl_open(&rtnl, 0) >= 0);
+        assert_se(sd_rtnl_open(&rtnl) >= 0);
 
         assert_se(sd_rtnl_message_new_link(rtnl, &m1, RTM_GETLINK, ifindex) >= 0);
         assert_se(sd_rtnl_message_new_link(rtnl, &m2, RTM_GETLINK, ifindex) >= 0);
@@ -330,7 +330,7 @@ static void test_container(void) {
 static void test_match(void) {
         _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
 
-        assert_se(sd_rtnl_open(&rtnl, 0) >= 0);
+        assert_se(sd_rtnl_open(&rtnl) >= 0);
 
         assert_se(sd_rtnl_add_match(rtnl, RTM_NEWLINK, &link_handler, NULL) >= 0);
         assert_se(sd_rtnl_add_match(rtnl, RTM_NEWLINK, &link_handler, NULL) >= 0);
@@ -395,7 +395,7 @@ int main(void) {
 
         test_container();
 
-        assert_se(sd_rtnl_open(&rtnl, 0) >= 0);
+        assert_se(sd_rtnl_open(&rtnl) >= 0);
         assert_se(rtnl);
 
         if_loopback = (int) if_nametoindex("lo");
diff --git a/src/login/logind-session.h b/src/login/logind-session.h
index 7a329b94ad..4bf739a44d 100644
--- a/src/login/logind-session.h
+++ b/src/login/logind-session.h
@@ -26,7 +26,7 @@ typedef enum KillWho KillWho;
 
 #include "list.h"
 #include "logind-user.h"
-#include "login-shared.h"
+#include "login-util.h"
 
 typedef enum SessionState {
         SESSION_OPENING,  /* Session scope is being created */
diff --git a/src/login/test-login-shared.c b/src/login/test-login-shared.c
index d29d7e7921..4c4275d124 100644
--- a/src/login/test-login-shared.c
+++ b/src/login/test-login-shared.c
@@ -20,7 +20,7 @@
 ***/
 
 #include "macro.h"
-#include "login-shared.h"
+#include "login-util.h"
 
 static void test_session_id_valid(void) {
         assert_se(session_id_valid("c1"));
diff --git a/src/network/networkctl.c b/src/network/networkctl.c
index 68925debe6..8e20f70aae 100644
--- a/src/network/networkctl.c
+++ b/src/network/networkctl.c
@@ -199,7 +199,7 @@ static int list_links(int argc, char *argv[], void *userdata) {
 
         pager_open_if_enabled();
 
-        r = sd_rtnl_open(&rtnl, 0);
+        r = sd_rtnl_open(&rtnl);
         if (r < 0)
                 return log_error_errno(r, "Failed to connect to netlink: %m");
 
@@ -670,7 +670,7 @@ static int link_status(int argc, char *argv[], void *userdata) {
         char **name;
         int r;
 
-        r = sd_rtnl_open(&rtnl, 0);
+        r = sd_rtnl_open(&rtnl);
         if (r < 0)
                 return log_error_errno(r, "Failed to connect to netlink: %m");
 
@@ -910,7 +910,7 @@ static int link_lldp_status(int argc, char *argv[], void *userdata) {
 
         pager_open_if_enabled();
 
-        r = sd_rtnl_open(&rtnl, 0);
+        r = sd_rtnl_open(&rtnl);
         if (r < 0)
                 return log_error_errno(r, "Failed to connect to netlink: %m");
 
diff --git a/src/network/networkd-link.c b/src/network/networkd-link.c
index 7841f69dab..b1947886b7 100644
--- a/src/network/networkd-link.c
+++ b/src/network/networkd-link.c
@@ -1477,6 +1477,9 @@ static int link_set_ipv4_forward(Link *link) {
         const char *p = NULL;
         int r;
 
+        if (link->network->ip_forward == _ADDRESS_FAMILY_BOOLEAN_INVALID)
+                return 0;
+
         p = strjoina("/proc/sys/net/ipv4/conf/", link->ifname, "/forwarding");
         r = write_string_file_no_create(p, one_zero(link_ipv4_forward_enabled(link)));
         if (r < 0)
@@ -1493,6 +1496,9 @@ static int link_set_ipv6_forward(Link *link) {
         if (!socket_ipv6_is_supported())
                 return 0;
 
+        if (link->network->ip_forward == _ADDRESS_FAMILY_BOOLEAN_INVALID)
+                return 0;
+
         p = strjoina("/proc/sys/net/ipv6/conf/", link->ifname, "/forwarding");
         r = write_string_file_no_create(p, one_zero(link_ipv6_forward_enabled(link)));
         if (r < 0)
diff --git a/src/network/networkd-manager.c b/src/network/networkd-manager.c
index db737ad484..9936a8e7cd 100644
--- a/src/network/networkd-manager.c
+++ b/src/network/networkd-manager.c
@@ -385,9 +385,9 @@ static int manager_connect_rtnl(Manager *m) {
 
         fd = systemd_netlink_fd();
         if (fd < 0)
-                r = sd_rtnl_open(&m->rtnl, 3, RTNLGRP_LINK, RTNLGRP_IPV4_IFADDR, RTNLGRP_IPV6_IFADDR);
+                r = sd_rtnl_open(&m->rtnl);
         else
-                r = sd_rtnl_open_fd(&m->rtnl, fd, 0);
+                r = sd_rtnl_open_fd(&m->rtnl, fd);
         if (r < 0)
                 return r;
 
diff --git a/src/network/networkd-netdev-bond.c b/src/network/networkd-netdev-bond.c
index 9919955f51..d7f9bb4f8e 100644
--- a/src/network/networkd-netdev-bond.c
+++ b/src/network/networkd-netdev-bond.c
@@ -242,7 +242,7 @@ static int netdev_bond_fill_message_create(NetDev *netdev, Link *link, sd_rtnl_m
         }
 
         if (b->ad_select != _NETDEV_BOND_AD_SELECT_INVALID &&
-            b->mode == BOND_MODE_8023AD) {
+            b->mode == NETDEV_BOND_MODE_802_3AD) {
                 r = sd_rtnl_message_append_u8(m, IFLA_BOND_AD_SELECT, b->ad_select);
                 if (r < 0)
                         return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_AD_SELECT attribute: %m");
@@ -279,7 +279,8 @@ static int netdev_bond_fill_message_create(NetDev *netdev, Link *link, sd_rtnl_m
                         return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_RESEND_IGMP attribute: %m");
         }
 
-        if (b->packets_per_slave <= PACKETS_PER_SLAVE_MAX) {
+        if (b->packets_per_slave <= PACKETS_PER_SLAVE_MAX &&
+            b->mode == NETDEV_BOND_MODE_BALANCE_RR) {
                 r = sd_rtnl_message_append_u32(m, IFLA_BOND_PACKETS_PER_SLAVE, b->packets_per_slave);
                 if (r < 0)
                         return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_PACKETS_PER_SLAVE attribute: %m");
diff --git a/src/network/networkd-netdev-ipvlan.c b/src/network/networkd-netdev-ipvlan.c
index 5189000c1f..f1c8e0ccdb 100644
--- a/src/network/networkd-netdev-ipvlan.c
+++ b/src/network/networkd-netdev-ipvlan.c
@@ -42,13 +42,9 @@ static int netdev_ipvlan_fill_message_create(NetDev *netdev, Link *link, sd_rtnl
         assert(netdev->ifname);
 
         if (m->mode != _NETDEV_IPVLAN_MODE_INVALID) {
-        r = sd_rtnl_message_append_u16(req, IFLA_IPVLAN_MODE, m->mode);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_IPVLAN_MODE attribute: %s",
-                                 strerror(-r));
-                        return r;
-                }
+                r = sd_rtnl_message_append_u16(req, IFLA_IPVLAN_MODE, m->mode);
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPVLAN_MODE attribute: %m");
         }
 
         return 0;
diff --git a/src/network/networkd-netdev-macvlan.c b/src/network/networkd-netdev-macvlan.c
index 5f41f1c865..a8bf6e6bb7 100644
--- a/src/network/networkd-netdev-macvlan.c
+++ b/src/network/networkd-netdev-macvlan.c
@@ -44,13 +44,9 @@ static int netdev_macvlan_fill_message_create(NetDev *netdev, Link *link, sd_rtn
         assert(netdev->ifname);
 
         if (m->mode != _NETDEV_MACVLAN_MODE_INVALID) {
-        r = sd_rtnl_message_append_u32(req, IFLA_MACVLAN_MODE, m->mode);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_MACVLAN_MODE attribute: %s",
-                                 strerror(-r));
-                        return r;
-                }
+                r = sd_rtnl_message_append_u32(req, IFLA_MACVLAN_MODE, m->mode);
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_MACVLAN_MODE attribute: %m");
         }
 
         return 0;
diff --git a/src/network/networkd-network-gperf.gperf b/src/network/networkd-network-gperf.gperf
index 8abf5bcf2e..b05bc949f2 100644
--- a/src/network/networkd-network-gperf.gperf
+++ b/src/network/networkd-network-gperf.gperf
@@ -15,69 +15,69 @@ struct ConfigPerfItem;
 %struct-type
 %includes
 %%
-Match.MACAddress,            config_parse_hwaddr,                0,                             offsetof(Network, match_mac)
-Match.Path,                  config_parse_strv,                  0,                             offsetof(Network, match_path)
-Match.Driver,                config_parse_strv,                  0,                             offsetof(Network, match_driver)
-Match.Type,                  config_parse_strv,                  0,                             offsetof(Network, match_type)
-Match.Name,                  config_parse_ifnames,               0,                             offsetof(Network, match_name)
-Match.Host,                  config_parse_net_condition,         CONDITION_HOST,                offsetof(Network, match_host)
-Match.Virtualization,        config_parse_net_condition,         CONDITION_VIRTUALIZATION,      offsetof(Network, match_virt)
-Match.KernelCommandLine,     config_parse_net_condition,         CONDITION_KERNEL_COMMAND_LINE, offsetof(Network, match_kernel)
-Match.Architecture,          config_parse_net_condition,         CONDITION_ARCHITECTURE,        offsetof(Network, match_arch)
-Link.MACAddress,             config_parse_hwaddr,                0,                             offsetof(Network, mac)
-Link.MTUBytes,               config_parse_iec_size,              0,                             offsetof(Network, mtu)
-Network.Description,         config_parse_string,                0,                             offsetof(Network, description)
-Network.Bridge,              config_parse_netdev,                0,                             offsetof(Network, bridge)
-Network.Bond,                config_parse_netdev,                0,                             offsetof(Network, bond)
-Network.VLAN,                config_parse_netdev,                0,                             0
-Network.MACVLAN,             config_parse_netdev,                0,                             0
-Network.IPVLAN,              config_parse_netdev,                0,                             0
-Network.VXLAN,               config_parse_netdev,                0,                             0
-Network.Tunnel,              config_parse_tunnel,                0,                             0
-Network.DHCP,                config_parse_dhcp,                  0,                             offsetof(Network, dhcp)
-Network.DHCPServer,          config_parse_bool,                  0,                             offsetof(Network, dhcp_server)
-Network.LinkLocalAddressing, config_parse_address_family_boolean,0,                             offsetof(Network, link_local)
-Network.IPv4LLRoute,         config_parse_bool,                  0,                             offsetof(Network, ipv4ll_route)
-Network.IPv6Token,           config_parse_ipv6token,             0,                             offsetof(Network, ipv6_token)
-Network.LLDP,                config_parse_bool,                  0,                             offsetof(Network, lldp)
-Network.Address,             config_parse_address,               0,                             0
-Network.Gateway,             config_parse_gateway,               0,                             0
-Network.Domains,             config_parse_domains,               0,                             offsetof(Network, domains)
-Network.DNS,                 config_parse_strv,                  0,                             offsetof(Network, dns)
-Network.LLMNR,               config_parse_llmnr,                 0,                             offsetof(Network, llmnr)
-Network.NTP,                 config_parse_strv,                  0,                             offsetof(Network, ntp)
-Network.IPForward,           config_parse_address_family_boolean,0,                             offsetof(Network, ip_forward)
-Network.IPMasquerade,        config_parse_bool,                  0,                             offsetof(Network, ip_masquerade)
-Network.BindCarrier,         config_parse_strv,                  0,                             offsetof(Network, bind_carrier)
-Address.Address,             config_parse_address,               0,                             0
-Address.Peer,                config_parse_address,               0,                             0
-Address.Broadcast,           config_parse_broadcast,             0,                             0
-Address.Label,               config_parse_label,                 0,                             0
-Route.Gateway,               config_parse_gateway,               0,                             0
-Route.Destination,           config_parse_destination,           0,                             0
-Route.Source,                config_parse_destination,           0,                             0
-Route.Metric,                config_parse_route_priority,        0,                             0
-Route.Scope,                 config_parse_route_scope,           0,                             0
-DHCP.ClientIdentifier,       config_parse_dhcp_client_identifier,0,                             offsetof(Network, dhcp_client_identifier)
-DHCP.UseDNS,                 config_parse_bool,                  0,                             offsetof(Network, dhcp_dns)
-DHCP.UseNTP,                 config_parse_bool,                  0,                             offsetof(Network, dhcp_ntp)
-DHCP.UseMTU,                 config_parse_bool,                  0,                             offsetof(Network, dhcp_mtu)
-DHCP.UseHostname,            config_parse_bool,                  0,                             offsetof(Network, dhcp_hostname)
-DHCP.UseDomains,             config_parse_bool,                  0,                             offsetof(Network, dhcp_domains)
-DHCP.UseRoutes,              config_parse_bool,                  0,                             offsetof(Network, dhcp_routes)
-DHCP.SendHostname,           config_parse_bool,                  0,                             offsetof(Network, dhcp_sendhost)
-DHCP.RequestBroadcast,       config_parse_bool,                  0,                             offsetof(Network, dhcp_broadcast)
-DHCP.CriticalConnection,     config_parse_bool,                  0,                             offsetof(Network, dhcp_critical)
-DHCP.VendorClassIdentifier,  config_parse_string,                0,                             offsetof(Network, dhcp_vendor_class_identifier)
-DHCP.RouteMetric,            config_parse_unsigned,              0,                             offsetof(Network, dhcp_route_metric)
-Bridge.Cost,                 config_parse_unsigned,              0,                             offsetof(Network, cost)
-BridgeFDB.MACAddress,        config_parse_fdb_hwaddr,            0,                             0
-BridgeFDB.VLANId,            config_parse_fdb_vlan_id,           0,                             0
+Match.MACAddress,            config_parse_hwaddr,                            0,                             offsetof(Network, match_mac)
+Match.Path,                  config_parse_strv,                              0,                             offsetof(Network, match_path)
+Match.Driver,                config_parse_strv,                              0,                             offsetof(Network, match_driver)
+Match.Type,                  config_parse_strv,                              0,                             offsetof(Network, match_type)
+Match.Name,                  config_parse_ifnames,                           0,                             offsetof(Network, match_name)
+Match.Host,                  config_parse_net_condition,                     CONDITION_HOST,                offsetof(Network, match_host)
+Match.Virtualization,        config_parse_net_condition,                     CONDITION_VIRTUALIZATION,      offsetof(Network, match_virt)
+Match.KernelCommandLine,     config_parse_net_condition,                     CONDITION_KERNEL_COMMAND_LINE, offsetof(Network, match_kernel)
+Match.Architecture,          config_parse_net_condition,                     CONDITION_ARCHITECTURE,        offsetof(Network, match_arch)
+Link.MACAddress,             config_parse_hwaddr,                            0,                             offsetof(Network, mac)
+Link.MTUBytes,               config_parse_iec_size,                          0,                             offsetof(Network, mtu)
+Network.Description,         config_parse_string,                            0,                             offsetof(Network, description)
+Network.Bridge,              config_parse_netdev,                            0,                             offsetof(Network, bridge)
+Network.Bond,                config_parse_netdev,                            0,                             offsetof(Network, bond)
+Network.VLAN,                config_parse_netdev,                            0,                             0
+Network.MACVLAN,             config_parse_netdev,                            0,                             0
+Network.IPVLAN,              config_parse_netdev,                            0,                             0
+Network.VXLAN,               config_parse_netdev,                            0,                             0
+Network.Tunnel,              config_parse_tunnel,                            0,                             0
+Network.DHCP,                config_parse_dhcp,                              0,                             offsetof(Network, dhcp)
+Network.DHCPServer,          config_parse_bool,                              0,                             offsetof(Network, dhcp_server)
+Network.LinkLocalAddressing, config_parse_address_family_boolean,            0,                             offsetof(Network, link_local)
+Network.IPv4LLRoute,         config_parse_bool,                              0,                             offsetof(Network, ipv4ll_route)
+Network.IPv6Token,           config_parse_ipv6token,                         0,                             offsetof(Network, ipv6_token)
+Network.LLDP,                config_parse_bool,                              0,                             offsetof(Network, lldp)
+Network.Address,             config_parse_address,                           0,                             0
+Network.Gateway,             config_parse_gateway,                           0,                             0
+Network.Domains,             config_parse_domains,                           0,                             offsetof(Network, domains)
+Network.DNS,                 config_parse_strv,                              0,                             offsetof(Network, dns)
+Network.LLMNR,               config_parse_llmnr,                             0,                             offsetof(Network, llmnr)
+Network.NTP,                 config_parse_strv,                              0,                             offsetof(Network, ntp)
+Network.IPForward,           config_parse_address_family_boolean_with_kernel,0,                             offsetof(Network, ip_forward)
+Network.IPMasquerade,        config_parse_bool,                              0,                             offsetof(Network, ip_masquerade)
+Network.BindCarrier,         config_parse_strv,                              0,                             offsetof(Network, bind_carrier)
+Address.Address,             config_parse_address,                           0,                             0
+Address.Peer,                config_parse_address,                           0,                             0
+Address.Broadcast,           config_parse_broadcast,                         0,                             0
+Address.Label,               config_parse_label,                             0,                             0
+Route.Gateway,               config_parse_gateway,                           0,                             0
+Route.Destination,           config_parse_destination,                       0,                             0
+Route.Source,                config_parse_destination,                       0,                             0
+Route.Metric,                config_parse_route_priority,                    0,                             0
+Route.Scope,                 config_parse_route_scope,                       0,                             0
+DHCP.ClientIdentifier,       config_parse_dhcp_client_identifier,            0,                             offsetof(Network, dhcp_client_identifier)
+DHCP.UseDNS,                 config_parse_bool,                              0,                             offsetof(Network, dhcp_dns)
+DHCP.UseNTP,                 config_parse_bool,                              0,                             offsetof(Network, dhcp_ntp)
+DHCP.UseMTU,                 config_parse_bool,                              0,                             offsetof(Network, dhcp_mtu)
+DHCP.UseHostname,            config_parse_bool,                              0,                             offsetof(Network, dhcp_hostname)
+DHCP.UseDomains,             config_parse_bool,                              0,                             offsetof(Network, dhcp_domains)
+DHCP.UseRoutes,              config_parse_bool,                              0,                             offsetof(Network, dhcp_routes)
+DHCP.SendHostname,           config_parse_bool,                              0,                             offsetof(Network, dhcp_sendhost)
+DHCP.RequestBroadcast,       config_parse_bool,                              0,                             offsetof(Network, dhcp_broadcast)
+DHCP.CriticalConnection,     config_parse_bool,                              0,                             offsetof(Network, dhcp_critical)
+DHCP.VendorClassIdentifier,  config_parse_string,                            0,                             offsetof(Network, dhcp_vendor_class_identifier)
+DHCP.RouteMetric,            config_parse_unsigned,                          0,                             offsetof(Network, dhcp_route_metric)
+Bridge.Cost,                 config_parse_unsigned,                          0,                             offsetof(Network, cost)
+BridgeFDB.MACAddress,        config_parse_fdb_hwaddr,                        0,                             0
+BridgeFDB.VLANId,            config_parse_fdb_vlan_id,                       0,                             0
 /* backwards compatibility: do not add new entries to this section */
-Network.IPv4LL,              config_parse_ipv4ll,                0,                             offsetof(Network, link_local)
-DHCPv4.UseDNS,               config_parse_bool,                  0,                             offsetof(Network, dhcp_dns)
-DHCPv4.UseMTU,               config_parse_bool,                  0,                             offsetof(Network, dhcp_mtu)
-DHCPv4.UseHostname,          config_parse_bool,                  0,                             offsetof(Network, dhcp_hostname)
-DHCP.UseDomainName,          config_parse_bool,                  0,                             offsetof(Network, dhcp_domains)
-DHCPv4.UseDomainName,        config_parse_bool,                  0,                             offsetof(Network, dhcp_domains)
-DHCPv4.CriticalConnection,   config_parse_bool,                  0,                             offsetof(Network, dhcp_critical)
+Network.IPv4LL,              config_parse_ipv4ll,                            0,                             offsetof(Network, link_local)
+DHCPv4.UseDNS,               config_parse_bool,                              0,                             offsetof(Network, dhcp_dns)
+DHCPv4.UseMTU,               config_parse_bool,                              0,                             offsetof(Network, dhcp_mtu)
+DHCPv4.UseHostname,          config_parse_bool,                              0,                             offsetof(Network, dhcp_hostname)
+DHCP.UseDomainName,          config_parse_bool,                              0,                             offsetof(Network, dhcp_domains)
+DHCPv4.UseDomainName,        config_parse_bool,                              0,                             offsetof(Network, dhcp_domains)
+DHCPv4.CriticalConnection,   config_parse_bool,                              0,                             offsetof(Network, dhcp_critical)
diff --git a/src/network/networkd-network.c b/src/network/networkd-network.c
index 5947084106..ec95c8661e 100644
--- a/src/network/networkd-network.c
+++ b/src/network/networkd-network.c
@@ -30,6 +30,7 @@
 #include "networkd-netdev.h"
 #include "networkd-link.h"
 #include "network-internal.h"
+#include "dns-domain.h"
 
 static int network_load_one(Manager *manager, const char *filename) {
         _cleanup_network_free_ Network *network = NULL;
@@ -466,11 +467,16 @@ int config_parse_domains(const char *unit,
         STRV_FOREACH(domain, *domains) {
                 if (is_localhost(*domain))
                         log_syntax(unit, LOG_ERR, filename, line, EINVAL, "'localhost' domain names may not be configured, ignoring assignment: %s", *domain);
-                else if (!hostname_is_valid(*domain)) {
-                        if (!streq(*domain, "*"))
-                                log_syntax(unit, LOG_ERR, filename, line, EINVAL, "domain name is not valid, ignoring assignment: %s", *domain);
-                } else
-                        continue;
+                else {
+                        r = dns_name_is_valid(*domain);
+                        if (r <= 0 && !streq(*domain, "*")) {
+                                if (r < 0)
+                                        log_error_errno(r, "Failed to validate domain name: %s: %m", *domain);
+                                if (r == 0)
+                                        log_warning("Domain name is not valid, ignoring assignment: %s", *domain);
+                        } else
+                                continue;
+                }
 
                 strv_remove(*domains, *domain);
 
@@ -711,3 +717,37 @@ int config_parse_ipv6token(
 
         return 0;
 }
+
+int config_parse_address_family_boolean_with_kernel(
+                const char* unit,
+                const char *filename,
+                unsigned line,
+                const char *section,
+                unsigned section_line,
+                const char *lvalue,
+                int ltype,
+                const char *rvalue,
+                void *data,
+                void *userdata) {
+
+        AddressFamilyBoolean *fwd = data, s;
+
+        assert(filename);
+        assert(lvalue);
+        assert(rvalue);
+        assert(data);
+
+        s = address_family_boolean_from_string(rvalue);
+        if (s < 0) {
+                if (streq(rvalue, "kernel"))
+                        s = _ADDRESS_FAMILY_BOOLEAN_INVALID;
+                else {
+                        log_syntax(unit, LOG_ERR, filename, line, s, "Failed to parse IPForwarding option, ignoring: %s", rvalue);
+                        return 0;
+                }
+        }
+
+        *fwd = s;
+
+        return 0;
+}
diff --git a/src/network/networkd-wait-online-manager.c b/src/network/networkd-wait-online-manager.c
index 1c997a50a4..39f3845633 100644
--- a/src/network/networkd-wait-online-manager.c
+++ b/src/network/networkd-wait-online-manager.c
@@ -177,7 +177,7 @@ static int manager_rtnl_listen(Manager *m) {
         assert(m);
 
         /* First, subscribe to interfaces coming and going */
-        r = sd_rtnl_open(&m->rtnl, 3, RTNLGRP_LINK, RTNLGRP_IPV4_IFADDR, RTNLGRP_IPV6_IFADDR);
+        r = sd_rtnl_open(&m->rtnl);
         if (r < 0)
                 return r;
 
diff --git a/src/network/networkd.h b/src/network/networkd.h
index 4b13d4aed1..2c191a780c 100644
--- a/src/network/networkd.h
+++ b/src/network/networkd.h
@@ -448,6 +448,9 @@ AddressFamilyBoolean address_family_boolean_from_string(const char *s) _const_;
 
 int config_parse_address_family_boolean(const char *unit, const char *filename, unsigned line, const char *section, unsigned section_line, const char *lvalue, int ltype, const char *rvalue, void *data, void *userdata);
 
+/* IPForwarding parser */
+int config_parse_address_family_boolean_with_kernel(const char *unit, const char *filename, unsigned line, const char *section, unsigned section_line, const char *lvalue, int ltype, const char *rvalue, void *data, void *userdata);
+
 /* Operational State */
 
 const char* link_operstate_to_string(LinkOperationalState s) _const_;
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 251af4a67c..6a21ed5471 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -2062,7 +2062,7 @@ static int watch_rtnl(sd_event *event, int recv_fd, union in_addr_union *exposed
         assert(cmsg->cmsg_len == CMSG_LEN(sizeof(int)));
         memcpy(&fd, CMSG_DATA(cmsg), sizeof(int));
 
-        r = sd_rtnl_open_fd(&rtnl, fd, 1, RTNLGRP_IPV4_IFADDR);
+        r = sd_rtnl_open_fd(&rtnl, fd);
         if (r < 0) {
                 safe_close(fd);
                 return log_error_errno(r, "Failed to create rtnl object: %m");
@@ -2574,7 +2574,7 @@ static int setup_veth(pid_t pid, char iface_name[IFNAMSIZ], int *ifi) {
         if (r < 0)
                 return log_error_errno(r, "Failed to generate predictable MAC address for host side: %m");
 
-        r = sd_rtnl_open(&rtnl, 0);
+        r = sd_rtnl_open(&rtnl);
         if (r < 0)
                 return log_error_errno(r, "Failed to connect to netlink: %m");
 
@@ -2659,7 +2659,7 @@ static int setup_bridge(const char veth_name[], int *ifi) {
 
         *ifi = bridge;
 
-        r = sd_rtnl_open(&rtnl, 0);
+        r = sd_rtnl_open(&rtnl);
         if (r < 0)
                 return log_error_errno(r, "Failed to connect to netlink: %m");
 
@@ -2720,7 +2720,7 @@ static int move_network_interfaces(pid_t pid) {
         if (strv_isempty(arg_network_interfaces))
                 return 0;
 
-        r = sd_rtnl_open(&rtnl, 0);
+        r = sd_rtnl_open(&rtnl);
         if (r < 0)
                 return log_error_errno(r, "Failed to connect to netlink: %m");
 
@@ -2767,7 +2767,7 @@ static int setup_macvlan(pid_t pid) {
         if (strv_isempty(arg_network_macvlan))
                 return 0;
 
-        r = sd_rtnl_open(&rtnl, 0);
+        r = sd_rtnl_open(&rtnl);
         if (r < 0)
                 return log_error_errno(r, "Failed to connect to netlink: %m");
 
@@ -2857,7 +2857,7 @@ static int setup_ipvlan(pid_t pid) {
         if (strv_isempty(arg_network_ipvlan))
                 return 0;
 
-        r = sd_rtnl_open(&rtnl, 0);
+        r = sd_rtnl_open(&rtnl);
         if (r < 0)
                 return log_error_errno(r, "Failed to connect to netlink: %m");
 
diff --git a/src/resolve/resolved-bus.c b/src/resolve/resolved-bus.c
index 171141e3a4..6db12511f9 100644
--- a/src/resolve/resolved-bus.c
+++ b/src/resolve/resolved-bus.c
@@ -22,7 +22,7 @@
 #include "bus-common-errors.h"
 #include "bus-util.h"
 
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 #include "resolved-bus.h"
 #include "resolved-def.h"
 
diff --git a/src/resolve/resolved-dns-answer.c b/src/resolve/resolved-dns-answer.c
index e08eb667cc..f77b98e505 100644
--- a/src/resolve/resolved-dns-answer.c
+++ b/src/resolve/resolved-dns-answer.c
@@ -20,7 +20,7 @@
 ***/
 
 #include "resolved-dns-answer.h"
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 
 DnsAnswer *dns_answer_new(unsigned n) {
         DnsAnswer *a;
diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
index 21756f566f..bb74b1828e 100644
--- a/src/resolve/resolved-dns-packet.c
+++ b/src/resolve/resolved-dns-packet.c
@@ -23,7 +23,7 @@
 #include "util.h"
 #include "strv.h"
 #include "unaligned.h"
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 #include "resolved-dns-packet.h"
 
 int dns_packet_new(DnsPacket **ret, DnsProtocol protocol, size_t mtu) {
diff --git a/src/resolve/resolved-dns-question.c b/src/resolve/resolved-dns-question.c
index 45bcbbf23a..4d71f5e3d4 100644
--- a/src/resolve/resolved-dns-question.c
+++ b/src/resolve/resolved-dns-question.c
@@ -20,7 +20,7 @@
 ***/
 
 #include "resolved-dns-question.h"
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 
 DnsQuestion *dns_question_new(unsigned n) {
         DnsQuestion *q;
diff --git a/src/resolve/resolved-dns-rr.c b/src/resolve/resolved-dns-rr.c
index 78d9e4a412..c1818eef9c 100644
--- a/src/resolve/resolved-dns-rr.c
+++ b/src/resolve/resolved-dns-rr.c
@@ -23,7 +23,7 @@
 
 #include "strv.h"
 
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 #include "resolved-dns-rr.h"
 #include "resolved-dns-packet.h"
 #include "dns-type.h"
diff --git a/src/resolve/resolved-dns-scope.c b/src/resolve/resolved-dns-scope.c
index 7369cbf50f..c25ac2216d 100644
--- a/src/resolve/resolved-dns-scope.c
+++ b/src/resolve/resolved-dns-scope.c
@@ -27,7 +27,7 @@
 #include "af-list.h"
 #include "random-util.h"
 #include "hostname-util.h"
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 #include "resolved-dns-scope.h"
 
 #define MULTICAST_RATELIMIT_INTERVAL_USEC (1*USEC_PER_SEC)
diff --git a/src/resolve/resolved-dns-stream.c b/src/resolve/resolved-dns-stream.c
index 4c0b557bad..7f47e7223a 100644
--- a/src/resolve/resolved-dns-stream.c
+++ b/src/resolve/resolved-dns-stream.c
@@ -113,7 +113,8 @@ static int dns_stream_identify(DnsStream *s) {
 
         mh.msg_control = &control;
         mh.msg_controllen = sl;
-        for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg)) {
+
+        CMSG_FOREACH(cmsg, &mh) {
 
                 if (cmsg->cmsg_level == IPPROTO_IPV6) {
                         assert(s->peer.sa.sa_family == AF_INET6);
diff --git a/src/resolve/resolved-dns-zone.c b/src/resolve/resolved-dns-zone.c
index a4c9b7d7af..32d771a954 100644
--- a/src/resolve/resolved-dns-zone.c
+++ b/src/resolve/resolved-dns-zone.c
@@ -22,7 +22,7 @@
 #include "list.h"
 
 #include "resolved-dns-zone.h"
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 #include "resolved-dns-packet.h"
 
 /* Never allow more than 1K entries */
diff --git a/src/resolve/resolved-manager.c b/src/resolve/resolved-manager.c
index 52695376f0..aa78885ac3 100644
--- a/src/resolve/resolved-manager.c
+++ b/src/resolve/resolved-manager.c
@@ -34,7 +34,7 @@
 #include "random-util.h"
 #include "hostname-util.h"
 
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 #include "resolved-conf.h"
 #include "resolved-bus.h"
 #include "resolved-manager.h"
@@ -195,7 +195,7 @@ static int manager_rtnl_listen(Manager *m) {
         assert(m);
 
         /* First, subscribe to interfaces coming and going */
-        r = sd_rtnl_open(&m->rtnl, 3, RTNLGRP_LINK, RTNLGRP_IPV4_IFADDR, RTNLGRP_IPV6_IFADDR);
+        r = sd_rtnl_open(&m->rtnl);
         if (r < 0)
                 return r;
 
@@ -920,7 +920,7 @@ int manager_recv(Manager *m, int fd, DnsProtocol protocol, DnsPacket **ret) {
         } else
                 return -EAFNOSUPPORT;
 
-        for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg)) {
+        CMSG_FOREACH(cmsg, &mh) {
 
                 if (cmsg->cmsg_level == IPPROTO_IPV6) {
                         assert(p->family == AF_INET6);
diff --git a/src/run/run.c b/src/run/run.c
index 5b9f31c4aa..f18f77b55a 100644
--- a/src/run/run.c
+++ b/src/run/run.c
@@ -68,7 +68,7 @@ static void help(void) {
         printf("%s [OPTIONS...] {COMMAND} [ARGS...]\n\n"
                "Run the specified command in a transient scope or service or timer\n"
                "unit. If timer option is specified and unit is exist which is\n"
-               "specified with --unit option then command can be ommited.\n\n"
+               "specified with --unit option then command can be omitted.\n\n"
                "  -h --help                       Show this help\n"
                "     --version                    Show package version\n"
                "     --user                       Run as user unit\n"
diff --git a/src/libsystemd/sd-bus/bus-util.c b/src/shared/bus-util.c
index 99937799b3..8fcc289957 100644
--- a/src/libsystemd/sd-bus/bus-util.c
+++ b/src/shared/bus-util.c
@@ -1330,31 +1330,6 @@ int bus_parse_unit_info(sd_bus_message *message, UnitInfo *u) {
                         &u->job_path);
 }
 
-int bus_maybe_reply_error(sd_bus_message *m, int r, sd_bus_error *error) {
-        assert(m);
-
-        if (r < 0) {
-                if (m->header->type == SD_BUS_MESSAGE_METHOD_CALL)
-                        sd_bus_reply_method_errno(m, r, error);
-
-        } else if (sd_bus_error_is_set(error)) {
-                if (m->header->type == SD_BUS_MESSAGE_METHOD_CALL)
-                        sd_bus_reply_method_error(m, error);
-        } else
-                return r;
-
-        log_debug("Failed to process message [type=%s sender=%s path=%s interface=%s member=%s signature=%s]: %s",
-                  bus_message_type_to_string(m->header->type),
-                  strna(m->sender),
-                  strna(m->path),
-                  strna(m->interface),
-                  strna(m->member),
-                  strna(m->root_container.signature),
-                  bus_error_message(error, r));
-
-        return 1;
-}
-
 int bus_append_unit_property_assignment(sd_bus_message *m, const char *assignment) {
         const char *eq, *field;
         int r;
diff --git a/src/libsystemd/sd-bus/bus-util.h b/src/shared/bus-util.h
index 999a372cdd..d8dba584d6 100644
--- a/src/libsystemd/sd-bus/bus-util.h
+++ b/src/shared/bus-util.h
@@ -188,8 +188,6 @@ DEFINE_TRIVIAL_CLEANUP_FUNC(sd_bus_track*, sd_bus_track_unref);
         SD_BUS_PROPERTY(name, "t", bus_property_get_usec, (offset) + offsetof(struct dual_timestamp, realtime), (flags)), \
         SD_BUS_PROPERTY(name "Monotonic", "t", bus_property_get_usec, (offset) + offsetof(struct dual_timestamp, monotonic), (flags))
 
-int bus_maybe_reply_error(sd_bus_message *m, int r, sd_bus_error *error);
-
 int bus_append_unit_property_assignment(sd_bus_message *m, const char *assignment);
 
 typedef struct BusWaitForJobs BusWaitForJobs;
diff --git a/src/resolve/resolved-dns-domain.c b/src/shared/dns-domain.c
index e1eb3ddfe5..20a44ce4e1 100644
--- a/src/resolve/resolved-dns-domain.c
+++ b/src/shared/dns-domain.c
@@ -24,7 +24,7 @@
 #include <stringprep.h>
 #endif
 
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 
 int dns_label_unescape(const char **name, char *dest, size_t sz) {
         const char *n;
diff --git a/src/resolve/resolved-dns-domain.h b/src/shared/dns-domain.h
index 516d244f7a..00caf5d700 100644
--- a/src/resolve/resolved-dns-domain.h
+++ b/src/shared/dns-domain.h
@@ -35,6 +35,15 @@ int dns_label_apply_idna(const char *encoded, size_t encoded_size, char *decoded
 int dns_label_undo_idna(const char *encoded, size_t encoded_size, char *decoded, size_t decoded_max);
 
 int dns_name_normalize(const char *s, char **_ret);
+static inline int dns_name_is_valid(const char *s) {
+        int r;
+        r = dns_name_normalize(s, NULL);
+        if (r == -EINVAL)
+                return 0;
+        if (r < 0)
+                return r;
+        return 1;
+}
 
 unsigned long dns_name_hash_func(const void *s, const uint8_t hash_key[HASH_KEY_SIZE]);
 int dns_name_compare_func(const void *a, const void *b);
diff --git a/src/systemd/sd-rtnl.h b/src/systemd/sd-rtnl.h
index be318e58a8..b05690cb1c 100644
--- a/src/systemd/sd-rtnl.h
+++ b/src/systemd/sd-rtnl.h
@@ -42,8 +42,8 @@ typedef int (*sd_rtnl_message_handler_t)(sd_rtnl *rtnl, sd_rtnl_message *m, void
 
 /* bus */
 int sd_rtnl_new_from_netlink(sd_rtnl **nl, int fd);
-int sd_rtnl_open(sd_rtnl **nl, unsigned n_groups, ...);
-int sd_rtnl_open_fd(sd_rtnl **nl, int fd, unsigned n_groups, ...);
+int sd_rtnl_open(sd_rtnl **nl);
+int sd_rtnl_open_fd(sd_rtnl **nl, int fd);
 int sd_rtnl_inc_rcvbuf(const sd_rtnl *const rtnl, const int size);
 
 sd_rtnl *sd_rtnl_ref(sd_rtnl *nl);
@@ -57,7 +57,6 @@ int sd_rtnl_call_async_cancel(sd_rtnl *nl, uint32_t serial);
 int sd_rtnl_call(sd_rtnl *nl, sd_rtnl_message *message, uint64_t timeout,
                  sd_rtnl_message **reply);
 
-
 int sd_rtnl_get_events(sd_rtnl *nl);
 int sd_rtnl_get_timeout(sd_rtnl *nl, uint64_t *timeout);
 int sd_rtnl_process(sd_rtnl *nl, sd_rtnl_message **ret);
diff --git a/src/test/test-cgroup-util.c b/src/test/test-cgroup-util.c
index 4a89f64518..ecc9d70bf4 100644
--- a/src/test/test-cgroup-util.c
+++ b/src/test/test-cgroup-util.c
@@ -244,16 +244,16 @@ static void test_escape(void) {
 }
 
 static void test_controller_is_valid(void) {
-        assert_se(cg_controller_is_valid("foobar", false));
-        assert_se(cg_controller_is_valid("foo_bar", false));
-        assert_se(cg_controller_is_valid("name=foo", true));
-        assert_se(!cg_controller_is_valid("", false));
-        assert_se(!cg_controller_is_valid("name=", true));
-        assert_se(!cg_controller_is_valid("=", false));
-        assert_se(!cg_controller_is_valid("cpu,cpuacct", false));
-        assert_se(!cg_controller_is_valid("_", false));
-        assert_se(!cg_controller_is_valid("_foobar", false));
-        assert_se(!cg_controller_is_valid("tatü", false));
+        assert_se(cg_controller_is_valid("foobar"));
+        assert_se(cg_controller_is_valid("foo_bar"));
+        assert_se(cg_controller_is_valid("name=foo"));
+        assert_se(!cg_controller_is_valid(""));
+        assert_se(!cg_controller_is_valid("name="));
+        assert_se(!cg_controller_is_valid("="));
+        assert_se(!cg_controller_is_valid("cpu,cpuacct"));
+        assert_se(!cg_controller_is_valid("_"));
+        assert_se(!cg_controller_is_valid("_foobar"));
+        assert_se(!cg_controller_is_valid("tatü"));
 }
 
 static void test_slice_to_path_one(const char *unit, const char *path, int error) {
diff --git a/src/resolve/test-dns-domain.c b/src/test/test-dns-domain.c
index c3208abc78..527cdd3b54 100644
--- a/src/resolve/test-dns-domain.c
+++ b/src/test/test-dns-domain.c
@@ -20,7 +20,7 @@
  ***/
 
 #include "macro.h"
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 
 static void test_dns_label_unescape_one(const char *what, const char *expect, size_t buffer_sz, int ret) {
         char buffer[buffer_sz];
diff --git a/src/test/test-rtnl-manual.c b/src/test/test-rtnl-manual.c
index c406454f77..9fc860d6a5 100644
--- a/src/test/test-rtnl-manual.c
+++ b/src/test/test-rtnl-manual.c
@@ -136,7 +136,7 @@ int main(int argc, char *argv[]) {
         sd_rtnl *rtnl;
         int r;
 
-        assert_se(sd_rtnl_open(&rtnl, 0) >= 0);
+        assert_se(sd_rtnl_open(&rtnl) >= 0);
         assert_se(rtnl);
 
         r = test_tunnel_configure(rtnl);
diff --git a/src/timesync/timesyncd-manager.c b/src/timesync/timesyncd-manager.c
index 88e9cf98ed..40e0fd31fe 100644
--- a/src/timesync/timesyncd-manager.c
+++ b/src/timesync/timesyncd-manager.c
@@ -528,7 +528,7 @@ static int manager_receive_response(sd_event_source *source, int fd, uint32_t re
         }
 
         recv_time = NULL;
-        for (cmsg = CMSG_FIRSTHDR(&msghdr); cmsg; cmsg = CMSG_NXTHDR(&msghdr, cmsg)) {
+        CMSG_FOREACH(cmsg, &msghdr) {
                 if (cmsg->cmsg_level != SOL_SOCKET)
                         continue;
 
diff --git a/src/udev/udevd.c b/src/udev/udevd.c
index 26aae89990..2affb5944a 100644
--- a/src/udev/udevd.c
+++ b/src/udev/udevd.c
@@ -875,7 +875,7 @@ static int on_worker(sd_event_source *s, int fd, uint32_t revents, void *userdat
                         continue;
                 }
 
-                for (cmsg = CMSG_FIRSTHDR(&msghdr); cmsg; cmsg = CMSG_NXTHDR(&msghdr, cmsg)) {
+                CMSG_FOREACH(cmsg, &msghdr) {
                         if (cmsg->cmsg_level == SOL_SOCKET &&
                             cmsg->cmsg_type == SCM_CREDENTIALS &&
                             cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred)))