merge: branch 'bg/n-acd-rh1507864'

Rework the IPv4 duplicate address detection to use code from n-acd [1].

[1] https://github.com/nettools/n-acd

https://bugzilla.redhat.com/show_bug.cgi?id=1507864

92 files changed, 5993 insertions, 694 deletions

diff --git a/.gitignore b/.gitignore
index 15284f5267..febc17298a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -243,7 +243,7 @@ test-*.trs
 
 /src/NetworkManager
 /src/NetworkManager.ver
-/src/devices/tests/test-arping
+/src/devices/tests/test-acd
 /src/devices/tests/test-lldp
 /src/devices/wifi/tests/test-general
 /src/dhcp/nm-dhcp-helper
@@ -314,3 +314,4 @@ test-*.trs
 /libnm-core/tests/test-setting-dcb
 /src/settings/plugins/ifnet
 /src/tests/test-resolvconf-capture
+/src/devices/tests/test-arping
diff --git a/Makefile.am b/Makefile.am
index 61b89bd9f8..b488c37e80 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1210,6 +1210,28 @@ noinst_LTLIBRARIES += \
 
 ###############################################################################
 
+shared_libcsiphash_la_CPPFLAGS = $(src_cppflags)
+shared_libcsiphash_la_SOURCES = \
+	shared/c-siphash/src/c-siphash.c \
+	shared/c-siphash/src/c-siphash.h
+
+shared_libnacd_la_CFLAGS = -std=gnu99
+shared_libnacd_la_CPPFLAGS = \
+	$(src_cppflags) \
+	-I $(srcdir)/shared/c-list/src \
+	-I $(srcdir)/shared/c-siphash/src
+shared_libnacd_la_SOURCES = \
+	shared/n-acd/src/n-acd.c \
+	shared/n-acd/src/n-acd.h
+
+noinst_LTLIBRARIES += \
+	shared/libcsiphash.la \
+	shared/libnacd.la
+
+EXTRA_DIST += shared/c-list/src/c-list.h
+
+###############################################################################
+
 src_libsystemd_nm_la_cppflags = \
 	-I$(srcdir)/shared \
 	-I$(builddir)/shared \
@@ -1475,8 +1497,8 @@ src_libNetworkManager_la_SOURCES = \
 	src/devices/nm-device.h \
 	src/devices/nm-lldp-listener.c \
 	src/devices/nm-lldp-listener.h \
-	src/devices/nm-arping-manager.c \
-	src/devices/nm-arping-manager.h \
+	src/devices/nm-acd-manager.c \
+	src/devices/nm-acd-manager.h \
 	src/devices/nm-device-ethernet-utils.c \
 	src/devices/nm-device-ethernet-utils.h \
 	src/devices/nm-device-factory.c \
@@ -1636,6 +1658,8 @@ src_libNetworkManager_la_SOURCES = \
 src_libNetworkManager_la_LIBADD = \
 	src/libNetworkManagerBase.la \
 	src/libsystemd-nm.la \
+	shared/libcsiphash.la \
+	shared/libnacd.la \
 	$(GLIB_LIBS) \
 	$(LIBUDEV_LIBS) \
 	$(SYSTEMD_LOGIN_LIBS) \
@@ -2975,20 +2999,20 @@ src_devices_tests_ldflags = \
 
 check_programs += \
 	src/devices/tests/test-lldp \
-	src/devices/tests/test-arping
+	src/devices/tests/test-acd
 
 src_devices_tests_test_lldp_CPPFLAGS = $(src_tests_cppflags)
 src_devices_tests_test_lldp_LDFLAGS = $(src_devices_tests_ldflags)
 src_devices_tests_test_lldp_LDADD = \
 	src/libNetworkManagerTest.la
 
-src_devices_tests_test_arping_CPPFLAGS = $(src_tests_cppflags)
-src_devices_tests_test_arping_LDFLAGS = $(src_devices_tests_ldflags)
-src_devices_tests_test_arping_LDADD = \
+src_devices_tests_test_acd_CPPFLAGS = $(src_tests_cppflags)
+src_devices_tests_test_acd_LDFLAGS = $(src_devices_tests_ldflags)
+src_devices_tests_test_acd_LDADD = \
 	src/libNetworkManagerTest.la
 
 $(src_devices_tests_test_lldp_OBJECTS): $(libnm_core_lib_h_pub_mkenums)
-$(src_devices_tests_test_arping_OBJECTS): $(libnm_core_lib_h_pub_mkenums)
+$(src_devices_tests_test_acd_OBJECTS): $(libnm_core_lib_h_pub_mkenums)
 
 EXTRA_DIST += \
 	src/devices/tests/meson.build
@@ -4654,7 +4678,6 @@ EXTRA_DIST += \
 	shared/nm-dispatcher-api.h \
 	shared/nm-test-libnm-utils.h \
 	shared/nm-test-utils-impl.c \
-	shared/nm-utils/c-list.h \
 	shared/nm-utils/c-list-util.c \
 	shared/nm-utils/c-list-util.h \
 	shared/nm-utils/gsystem-local-alloc.h \
diff --git a/clients/common/settings-docs.h.in b/clients/common/settings-docs.h.in
index 8279fadd26..622f7d49f3 100644
--- a/clients/common/settings-docs.h.in
+++ b/clients/common/settings-docs.h.in
@@ -210,7 +210,7 @@
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_TOS N_("The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.")
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_TTL N_("The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_ADDRESSES N_("Array of IP addresses.")
-#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DAD_TIMEOUT N_("Timeout in milliseconds used to check for the presence of duplicate IP addresses on the network.  If an address conflict is detected, the activation will fail.  A zero value means that no duplicate address detection is performed, -1 means the default value (either configuration ipvx.dad-timeout override or 3 seconds).  A value greater than zero is a timeout in milliseconds.")
+#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DAD_TIMEOUT N_("Timeout in milliseconds used to check for the presence of duplicate IP addresses on the network.  If an address conflict is detected, the activation will fail.  A zero value means that no duplicate address detection is performed, -1 means the default value (either configuration ipvx.dad-timeout override or zero).  A value greater than zero is a timeout in milliseconds. The property is currently implemented only for IPv4.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DHCP_CLIENT_ID N_("A string sent to the DHCP server to identify the local machine which the DHCP server may use to customize the DHCP lease and options. When the property is a hex string ('aa:bb:cc') it is interpreted as a binary client ID, in which case the first byte is assumed to be the 'type' field as per RFC 2132 section 9.14 and the remaining bytes may be an hardware address (e.g. '01:xx:xx:xx:xx:xx:xx' where 1 is the Ethernet ARP type and the rest is a MAC address). If the property is not a hex string it is considered as a non-hardware-address client ID and the 'type' field is set to 0. The special values \"mac\" and \"perm-mac\" are supported, which use the current or permanent MAC address of the device to generate a client identifier with type ethernet type (01). Currently, these options only work for ethernet type of links. The special value \"stable\" is supported to generate a type 0 client identifier based on the stable-id (see connection.stable-id). If unset, a globally configured default is used. If still unset, the client-id from the last lease is reused.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DHCP_FQDN N_("If the \"dhcp-send-hostname\" property is TRUE, then the specified FQDN will be sent to the DHCP server when acquiring a lease. This property and \"dhcp-hostname\" are mutually exclusive and cannot be set at the same time.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DHCP_HOSTNAME N_("If the \"dhcp-send-hostname\" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease. This property and \"dhcp-fqdn\" are mutually exclusive and cannot be set at the same time.")
@@ -232,7 +232,7 @@
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_ROUTES N_("Array of IP routes.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_ADDR_GEN_MODE N_("Configure method for creating the address for use with RFC4862 IPv6 Stateless Address Autoconfiguration. The permitted values are: NM_SETTING_IP6_CONFIG_ADDR_GEN_MODE_EUI64 (0) or NM_SETTING_IP6_CONFIG_ADDR_GEN_MODE_STABLE_PRIVACY (1). If the property is set to EUI64, the addresses will be generated using the interface tokens derived from hardware address. This makes the host part of the address to stay constant, making it possible to track host's presence when it changes networks. The address changes when the interface hardware is replaced. The value of stable-privacy enables use of cryptographically secure hash of a secret host-specific key along with the connection's stable-id and the network address as specified by RFC7217. This makes it impossible to use the address track host's presence, and makes the address stable when the network interface hardware is replaced. On D-Bus, the absence of an addr-gen-mode setting equals enabling stable-privacy. For keyfile plugin, the absence of the setting on disk means EUI64 so that the property doesn't change on upgrade from older versions. Note that this setting is distinct from the Privacy Extensions as configured by \"ip6-privacy\" property and it does not affect the temporary addresses configured with this option.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_ADDRESSES N_("Array of IP addresses.")
-#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DAD_TIMEOUT N_("Timeout in milliseconds used to check for the presence of duplicate IP addresses on the network.  If an address conflict is detected, the activation will fail.  A zero value means that no duplicate address detection is performed, -1 means the default value (either configuration ipvx.dad-timeout override or 3 seconds).  A value greater than zero is a timeout in milliseconds.")
+#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DAD_TIMEOUT N_("Timeout in milliseconds used to check for the presence of duplicate IP addresses on the network.  If an address conflict is detected, the activation will fail.  A zero value means that no duplicate address detection is performed, -1 means the default value (either configuration ipvx.dad-timeout override or zero).  A value greater than zero is a timeout in milliseconds. The property is currently implemented only for IPv4.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DHCP_HOSTNAME N_("If the \"dhcp-send-hostname\" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease. This property and \"dhcp-fqdn\" are mutually exclusive and cannot be set at the same time.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DHCP_SEND_HOSTNAME N_("If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the \"dhcp-hostname\" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DHCP_TIMEOUT N_("A timeout for a DHCP transaction in seconds.")
diff --git a/libnm-core/nm-setting-ip-config.c b/libnm-core/nm-setting-ip-config.c
index e581aee557..a695051f8a 100644
--- a/libnm-core/nm-setting-ip-config.c
+++ b/libnm-core/nm-setting-ip-config.c
@@ -3201,9 +3201,11 @@ nm_setting_ip_config_class_init (NMSettingIPConfigClass *setting_class)
 	 * addresses on the network.  If an address conflict is detected, the
 	 * activation will fail.  A zero value means that no duplicate address
 	 * detection is performed, -1 means the default value (either configuration
-	 * ipvx.dad-timeout override or 3 seconds).  A value greater than zero is a
+	 * ipvx.dad-timeout override or zero).  A value greater than zero is a
 	 * timeout in milliseconds.
 	 *
+	 * The property is currently implemented only for IPv4.
+	 *
 	 * Since: 1.2
 	 **/
 	g_object_class_install_property
diff --git a/libnm-core/nm-setting-ip4-config.c b/libnm-core/nm-setting-ip4-config.c
index 518e3f56fe..8eadd0f708 100644
--- a/libnm-core/nm-setting-ip4-config.c
+++ b/libnm-core/nm-setting-ip4-config.c
@@ -748,11 +748,12 @@ nm_setting_ip4_config_class_init (NMSettingIP4ConfigClass *ip4_class)
 
 	/* ---ifcfg-rh---
 	 * property: dad-timeout
-	 * variable: ARPING_WAIT
-	 * default: missing variable means global default (config override or 3)
-	 * description: Timeout (in seconds) for performing DAD before configuring
-	 * IPv4 addresses. 0 turns off the DAD completely, -1 means default value.
-	 * example: ARPING_WAIT=2
+	 * variable: ACD_TIMEOUT, ARPING_WAIT
+	 * default: missing variable means global default (config override or zero)
+	 * description: Timeout (in milliseconds for ACD_TIMEOUT or in seconds
+	 *   for ARPING_WAIT) for address conflict detection before configuring
+	 *   IPv4 addresses. 0 turns off the ACD completely, -1 means default value.
+	 * example: ACD_TIMEOUT=2000 or ARPING_WAIT=2
 	 * ---end---
 	 */
 
diff --git a/libnm/nm-manager.c b/libnm/nm-manager.c
index 52b2e13510..2b9e0d9695 100644
--- a/libnm/nm-manager.c
+++ b/libnm/nm-manager.c
@@ -35,7 +35,7 @@
 #include "nm-active-connection.h"
 #include "nm-vpn-connection.h"
 #include "nm-dbus-helpers.h"
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 
 #include "introspection/org.freedesktop.NetworkManager.h"
 
diff --git a/libnm/nm-object.c b/libnm/nm-object.c
index fc7a82af98..605da4927e 100644
--- a/libnm/nm-object.c
+++ b/libnm/nm-object.c
@@ -33,7 +33,7 @@
 #include "nm-dbus-helpers.h"
 #include "nm-client.h"
 #include "nm-core-internal.h"
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 
 static gboolean debug = FALSE;
 #define dbgmsg(f,...) if (G_UNLIKELY (debug)) { g_message (f, ## __VA_ARGS__ ); }
diff --git a/shared/c-list/.cherryci/ci-test b/shared/c-list/.cherryci/ci-test
new file mode 100755
index 0000000000..8ce5f5f70e
--- /dev/null
+++ b/shared/c-list/.cherryci/ci-test
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -e
+
+rm -Rf "./ci-build"
+mkdir "./ci-build"
+cd "./ci-build"
+
+${CHERRY_LIB_MESONSETUP} . "${CHERRY_LIB_SRCDIR}"
+${CHERRY_LIB_NINJABUILD}
+${CHERRY_LIB_MESONTEST}
+(( ! CHERRY_LIB_VALGRIND )) || ${CHERRY_LIB_MESONTEST} "--wrapper=${CHERRY_LIB_VALGRINDWRAP}"
diff --git a/shared/c-list/.editorconfig b/shared/c-list/.editorconfig
new file mode 100644
index 0000000000..b10bb4f3f8
--- /dev/null
+++ b/shared/c-list/.editorconfig
@@ -0,0 +1,11 @@
+root = true
+
+[*]
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+charset = utf-8
+
+[*.{c,h}]
+indent_style = space
+indent_size = 8
diff --git a/shared/c-list/.travis.yml b/shared/c-list/.travis.yml
new file mode 100644
index 0000000000..8b5e4b4bef
--- /dev/null
+++ b/shared/c-list/.travis.yml
@@ -0,0 +1,21 @@
+os: linux
+dist: trusty
+language: c
+
+services:
+  - docker
+
+install:
+  - curl -O -L "https://raw.githubusercontent.com/cherry-pick/cherry-images/v1/scripts/vmrun"
+  - curl -O -L "https://raw.githubusercontent.com/cherry-pick/cherry-ci/v1/scripts/cherryci"
+  - chmod +x "./vmrun" "./cherryci"
+
+jobs:
+  include:
+    - stage: test
+      script:
+        - ./vmrun -- ../src/cherryci -d ../src/.cherryci -s c-util -m
+    - script:
+        - ./vmrun -T armv7hl -- ../src/cherryci -d ../src/.cherryci -s c-util
+    - script:
+        - ./vmrun -T i686 -- ../src/cherryci -d ../src/.cherryci -s c-util
diff --git a/shared/c-list/AUTHORS b/shared/c-list/AUTHORS
new file mode 100644
index 0000000000..7fdb8af0dd
--- /dev/null
+++ b/shared/c-list/AUTHORS
@@ -0,0 +1,38 @@
+LICENSE:
+        This project is dual-licensed under both the Apache License, Version
+        2.0, and the GNU Lesser General Public License, Version 2.1+.
+
+LICENSE-APACHE:
+        Licensed under the Apache License, Version 2.0 (the "License");
+        you may not use this file except in compliance with the License.
+        You may obtain a copy of the License at
+
+                http://www.apache.org/licenses/LICENSE-2.0
+
+        Unless required by applicable law or agreed to in writing, software
+        distributed under the License is distributed on an "AS IS" BASIS,
+        WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+        See the License for the specific language governing permissions and
+        limitations under the License.
+
+LICENSE-LGPL
+        This program is free software; you can redistribute it and/or modify it
+        under the terms of the GNU Lesser General Public License as published
+        by the Free Software Foundation; either version 2.1 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful, but
+        WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+        Lesser General Public License for more details.
+
+        You should have received a copy of the GNU Lesser General Public License
+        along with this program; If not, see <http://www.gnu.org/licenses/>.
+
+COPYRIGHT: (ordered alphabetically)
+        Copyright (C) 2015-2018 Red Hat, Inc.
+
+AUTHORS: (ordered alphabetically)
+        David Herrmann <dh.herrmann@gmail.com>
+        Thomas Haller <thaller@redhat.com>
+        Tom Gundersen <teg@jklm.no>
diff --git a/shared/c-list/AUTHORS-LGPL b/shared/c-list/AUTHORS-LGPL
new file mode 100644
index 0000000000..4362b49151
--- /dev/null
+++ b/shared/c-list/AUTHORS-LGPL
@@ -0,0 +1,502 @@
+                  GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the Lesser GPL.  It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+  This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it.  You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+  When we speak of free software, we are referring to freedom of use,
+not price.  Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+  To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights.  These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+  For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you.  You must make sure that they, too, receive or can get the source
+code.  If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it.  And you must show them these terms so they know their rights.
+
+  We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+  To protect each distributor, we want to make it very clear that
+there is no warranty for the free library.  Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+  Finally, software patents pose a constant threat to the existence of
+any free program.  We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder.  Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+  Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License.  This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License.  We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+  When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library.  The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom.  The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+  We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License.  It also provides other free software developers Less
+of an advantage over competing non-free programs.  These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries.  However, the Lesser license provides advantages in certain
+special circumstances.
+
+  For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard.  To achieve this, non-free programs must be
+allowed to use the library.  A more frequent case is that a free
+library does the same job as widely used non-free libraries.  In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+  In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software.  For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+  Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.  Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library".  The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+  A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+  The "Library", below, refers to any such software library or work
+which has been distributed under these terms.  A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language.  (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+  "Source code" for a work means the preferred form of the work for
+making modifications to it.  For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+  Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it).  Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+  1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+  You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+  2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) The modified work must itself be a software library.
+
+    b) You must cause the files modified to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    c) You must cause the whole of the work to be licensed at no
+    charge to all third parties under the terms of this License.
+
+    d) If a facility in the modified Library refers to a function or a
+    table of data to be supplied by an application program that uses
+    the facility, other than as an argument passed when the facility
+    is invoked, then you must make a good faith effort to ensure that,
+    in the event an application does not supply such function or
+    table, the facility still operates, and performs whatever part of
+    its purpose remains meaningful.
+
+    (For example, a function in a library to compute square roots has
+    a purpose that is entirely well-defined independent of the
+    application.  Therefore, Subsection 2d requires that any
+    application-supplied function or table used by this function must
+    be optional: if the application does not supply it, the square
+    root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library.  To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License.  (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.)  Do not make any other change in
+these notices.
+
+  Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+  This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+  4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+  If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library".  Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+  However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library".  The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+  When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library.  The
+threshold for this to be true is not precisely defined by law.
+
+  If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work.  (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+  Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+  6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+  You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License.  You must supply a copy of this License.  If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License.  Also, you must do one
+of these things:
+
+    a) Accompany the work with the complete corresponding
+    machine-readable source code for the Library including whatever
+    changes were used in the work (which must be distributed under
+    Sections 1 and 2 above); and, if the work is an executable linked
+    with the Library, with the complete machine-readable "work that
+    uses the Library", as object code and/or source code, so that the
+    user can modify the Library and then relink to produce a modified
+    executable containing the modified Library.  (It is understood
+    that the user who changes the contents of definitions files in the
+    Library will not necessarily be able to recompile the application
+    to use the modified definitions.)
+
+    b) Use a suitable shared library mechanism for linking with the
+    Library.  A suitable mechanism is one that (1) uses at run time a
+    copy of the library already present on the user's computer system,
+    rather than copying library functions into the executable, and (2)
+    will operate properly with a modified version of the library, if
+    the user installs one, as long as the modified version is
+    interface-compatible with the version that the work was made with.
+
+    c) Accompany the work with a written offer, valid for at
+    least three years, to give the same user the materials
+    specified in Subsection 6a, above, for a charge no more
+    than the cost of performing this distribution.
+
+    d) If distribution of the work is made by offering access to copy
+    from a designated place, offer equivalent access to copy the above
+    specified materials from the same place.
+
+    e) Verify that the user has already received a copy of these
+    materials or that you have already sent this user a copy.
+
+  For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it.  However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+  It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system.  Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+  7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+    a) Accompany the combined library with a copy of the same work
+    based on the Library, uncombined with any other library
+    facilities.  This must be distributed under the terms of the
+    Sections above.
+
+    b) Give prominent notice with the combined library of the fact
+    that part of it is a work based on the Library, and explaining
+    where to find the accompanying uncombined form of the same work.
+
+  8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License.  Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License.  However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+  9. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Library or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+  10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties with
+this License.
+
+  11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded.  In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+  13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation.  If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+  14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission.  For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this.  Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+                            NO WARRANTY
+
+  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+           How to Apply These Terms to Your New Libraries
+
+  If you develop a new library, and you want it to be of the greatest
+possible use to the public, we recommend making it free software that
+everyone can redistribute and change.  You can do so by permitting
+redistribution under these terms (or, alternatively, under the terms of the
+ordinary General Public License).
+
+  To apply these terms, attach the following notices to the library.  It is
+safest to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the library's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+Also add information on how to contact you by electronic and paper mail.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the library, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the
+  library `Frob' (a library for tweaking knobs) written by James Random Hacker.
+
+  <signature of Ty Coon>, 1 April 1990
+  Ty Coon, President of Vice
+
+That's all there is to it!
diff --git a/shared/c-list/LICENSE b/shared/c-list/LICENSE
new file mode 100644
index 0000000000..5d501a7284
--- /dev/null
+++ b/shared/c-list/LICENSE
@@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "{}"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright {yyyy} {name of copyright owner}
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/shared/c-list/NEWS b/shared/c-list/NEWS
new file mode 100644
index 0000000000..923713bea2
--- /dev/null
+++ b/shared/c-list/NEWS
@@ -0,0 +1,66 @@
+c-list - Circular Intrusive Double Linked List Collection in ISO-C11
+
+CHANGES WITH 3:
+
+        * API break: The c_list_loop_*() symbols were removed, since we saw
+                     little use for them. No user was known at the time, so
+                     all projects should build with the new API version
+                     unchanged.
+                     Since c-list does not distribute any compiled code, there
+                     is no ABI issue with this change.
+
+        * Two new symbols c_list_length() and c_list_contains(). They are meant
+          for debugging purposes, to easily verify list integrity. Since they
+          run in O(n) time, they are not recommended for any other use than
+          debugging.
+
+        * New symbol c_list_init() is provided as alternative to the verbose
+          C_LIST_INIT assignment.
+
+        * The c-list API is extended to work well with `const CList` objects.
+          That is, any read-only accessor function allows constant objects as
+          input now.
+          Note that this does not propagate into other members linked in the
+          list. Using `const` for CList members is of little practical use.
+          However, it might be of use for its embedding objects, so we now
+          allow it in the CList API as well.
+
+        * The c_list_splice() call now clears the source list, rather than
+          returning with stale pointers. Technically, this is also an API
+          break, but unlikely to affect any existing code.
+
+        Contributions from: David Herrmann, Thomas Haller
+
+        - Berlin, 2017-08-13
+
+CHANGES WITH 2:
+
+        * Adjust project-name in build-system to reflect the actual project. The
+          previous releases incorrectly claimed to be c-rbtree in the build
+          system.
+
+        * Add c_list_swap() that swaps two lists given their head pointers.
+
+        * Add c_list_splice() that moves a list.
+
+        * Add LGPL2.1+ as license so c-list can be imported into GPL2 projects.
+          It is now officially dual-licensed.
+
+        * As usual a bunch of fixes, additional tests, and documentation
+          updates.
+
+        Contributions from: David Herrmann, Tom Gundersen
+
+        - Lund, 2017-05-03
+
+CHANGES WITH 1:
+
+        * Initial release of c-list.
+
+        * This project provides an implementation of a circular double linked
+          list in standard ISO-C11. License is ASL-2.0 and the build system
+          used is `Meson'.
+
+        Contributions from: David Herrmann, Tom Gundersen
+
+        - Berlin, 2017-03-03
diff --git a/shared/c-list/README b/shared/c-list/README
new file mode 100644
index 0000000000..27fb90ffcc
--- /dev/null
+++ b/shared/c-list/README
@@ -0,0 +1,48 @@
+c-list - Circular Intrusive Double Linked List Collection in ISO-C11
+
+ABOUT:
+        The c-list project implements an intrusive collection based on circular
+        double linked lists in ISO-C11. It aims for minimal API constraints,
+        leaving maximum control over the data-structures to the API consumer.
+
+DETAILS:
+        https://c-util.github.io/c-list
+
+BUG REPORTS:
+        https://github.com/c-util/c-list/issues
+
+GIT:
+        git@github.com:c-util/c-list.git
+        https://github.com/c-util/c-list.git
+
+GITWEB:
+        https://github.com/c-util/c-list
+
+LICENSE:
+        Apache Software License 2.0
+        Lesser General Public License 2.1+
+        See AUTHORS for details.
+
+REQUIREMENTS:
+        The requirements for c-list are:
+
+            libc (e.g., glibc >= 2.16)
+
+        At build-time, the following software is required:
+
+            meson >= 0.41
+            pkg-config >= 0.29
+
+INSTALL:
+        The meson build-system is used for c-list. Contact upstream
+        documentation for detailed help. In most situations the following
+        commands are sufficient to build and install c-list from source:
+
+            $ mkdir build
+            $ cd build
+            $ meson setup ..
+            $ ninja
+            $ meson test
+            # ninja install
+
+        No custom configuration options are available.
diff --git a/shared/c-list/meson.build b/shared/c-list/meson.build
new file mode 100644
index 0000000000..8b41bce181
--- /dev/null
+++ b/shared/c-list/meson.build
@@ -0,0 +1,14 @@
+project(
+        'c-list',
+        'c',
+        version: '3',
+        license: 'Apache',
+        default_options: [
+                'c_std=c11',
+        ],
+)
+
+add_project_arguments('-D_GNU_SOURCE', language: 'c')
+mod_pkgconfig = import('pkgconfig')
+
+subdir('src')
diff --git a/shared/nm-utils/c-list.h b/shared/c-list/src/c-list.h
index a3c4053b66..ff434d8df6 100644
--- a/shared/nm-utils/c-list.h
+++ b/shared/c-list/src/c-list.h
@@ -1,7 +1,7 @@
 #pragma once
 
 /*
- * Circular Double Linked List Implementation in Standard ISO-C11
+ * Circular Intrusive Double Linked List Collection in ISO-C11
  *
  * This implements a generic circular double linked list. List entries must
  * embed the CList object, which provides pointers to the next and previous
@@ -225,71 +225,6 @@ static inline void c_list_splice(CList *target, CList *source) {
 }
 
 /**
- * c_list_for_each() - loop over all list entries
- * @_iter:              iterator to use
- * @_list:              list to loop over
- *
- * This is a macro to use as for-loop to iterate an entire list. It is meant as
- * convenience macro. Feel free to code your own loop iterator.
- */
-#define c_list_for_each(_iter, _list)                                           \
-        for (_iter = (_list)->next;                                             \
-             (_iter) != (_list);                                                \
-             _iter = (_iter)->next)
-
-
-/**
- * c_list_for_each_safe() - loop over all list entries, safe for removal
- * @_iter:              iterator to use
- * @_safe:              used to store pointer to next element
- * @_list:              list to loop over
- *
- * This is a macro to use as for-loop to iterate an entire list, safe against
- * removal of the current element. It is meant as convenience macro. Feel free
- * to code your own loop iterator.
- *
- * Note that this fetches the next element prior to executing the loop body.
- * This makes it safe against removal of the current entry, but it will go
- * havoc if you remove other list entries. You better not modify anything but
- * the current list entry.
- */
-#define c_list_for_each_safe(_iter, _safe, _list)                               \
-        for (_iter = (_list)->next, _safe = (_iter)->next;                      \
-             (_iter) != (_list);                                                \
-             _iter = (_safe), _safe = (_safe)->next)
-
-/**
- * c_list_for_each_entry() - loop over all list entries
- * @_iter:              iterator to use
- * @_list:              list to loop over
- * @_m:                 member name of CList object in list type
- *
- * This combines c_list_for_each() with c_list_entry(), making it easy to
- * iterate over a list of a specific type.
- */
-#define c_list_for_each_entry(_iter, _list, _m)                                 \
-        for (_iter = c_list_entry((_list)->next, __typeof__(*_iter), _m);       \
-             &(_iter)->_m != (_list);                                           \
-             _iter = c_list_entry((_iter)->_m.next, __typeof__(*_iter), _m))
-
-/**
- * c_list_for_each_entry_safe() - loop over all list entries, safe for removal
- * @_iter:              iterator to use
- * @_safe:              used to store pointer to next element
- * @_list:              list to loop over
- * @_m:                 member name of CList object in list type
- *
- * This combines c_list_for_each_safe() with c_list_entry(), making it easy to
- * iterate over a list of a specific type.
- */
-#define c_list_for_each_entry_safe(_iter, _safe, _list, _m)                     \
-        for (_iter = c_list_entry((_list)->next, __typeof__(*_iter), _m),       \
-             _safe = c_list_entry((_iter)->_m.next, __typeof__(*_iter), _m);    \
-             &(_iter)->_m != (_list);                                           \
-             _iter = (_safe),                                                   \
-             _safe = c_list_entry((_safe)->_m.next, __typeof__(*_iter), _m))    \
-
-/**
  * c_list_first() - return pointer to first element, or NULL if empty
  * @list:               list to operate on, or NULL
  *
@@ -342,6 +277,96 @@ static inline CList *c_list_last(CList *list) {
         c_list_entry(c_list_last(_list), _t, _m)
 
 /**
+ * c_list_for_each*() - iterators
+ *
+ * The c_list_for_each*() macros provide simple for-loop wrappers to iterate
+ * a linked list. They come in a set of flavours:
+ *
+ *   - "entry": This combines c_list_entry() with the loop iterator, so the
+ *              iterator always has the type of the surrounding object, rather
+ *              than CList.
+ *
+ *   - "safe": The loop iterator always keeps track of the next element to
+ *             visit. This means, you can safely modify the current element,
+ *             while retaining loop-integrity.
+ *             You still must not touch any other entry of the list. Otherwise,
+ *             the loop-iterator will be corrupted.
+ *
+ *   - "continue": Rather than starting the iteration at the front of the list,
+ *                 use the current value of the iterator as starting position.
+ *                 Note that the first loop iteration will be the following
+ *                 element, not the given element.
+ *
+ *   - "unlink": This unlinks the current element from the list before the loop
+ *               code is run. Note that this only does a partial unlink, since
+ *               it assumes the entire list will be unlinked. You must not
+ *               break out of the loop, or the list will be in an inconsistent
+ *               state.
+ */
+
+#define c_list_for_each(_iter, _list)                                           \
+        for (_iter = (_list)->next;                                             \
+             (_iter) != (_list);                                                \
+             _iter = (_iter)->next)
+
+#define c_list_for_each_entry(_iter, _list, _m)                                 \
+        for (_iter = c_list_entry((_list)->next, __typeof__(*_iter), _m);       \
+             &(_iter)->_m != (_list);                                           \
+             _iter = c_list_entry((_iter)->_m.next, __typeof__(*_iter), _m))
+
+#define c_list_for_each_safe(_iter, _safe, _list)                               \
+        for (_iter = (_list)->next, _safe = (_iter)->next;                      \
+             (_iter) != (_list);                                                \
+             _iter = (_safe), _safe = (_safe)->next)
+
+#define c_list_for_each_entry_safe(_iter, _safe, _list, _m)                     \
+        for (_iter = c_list_entry((_list)->next, __typeof__(*_iter), _m),       \
+             _safe = c_list_entry((_iter)->_m.next, __typeof__(*_iter), _m);    \
+             &(_iter)->_m != (_list);                                           \
+             _iter = (_safe),                                                   \
+             _safe = c_list_entry((_safe)->_m.next, __typeof__(*_iter), _m))    \
+
+#define c_list_for_each_continue(_iter, _list)                                  \
+        for (_iter = (_iter) ? (_iter)->next : (_list)->next;                   \
+             (_iter) != (_list);                                                \
+             _iter = (_iter)->next)
+
+#define c_list_for_each_entry_continue(_iter, _list, _m)                        \
+        for (_iter = c_list_entry((_iter) ? (_iter)->_m.next : (_list)->next,   \
+                                  __typeof__(*_iter),                           \
+                                  _m);                                          \
+             &(_iter)->_m != (_list);                                           \
+             _iter = c_list_entry((_iter)->_m.next, __typeof__(*_iter), _m))
+
+#define c_list_for_each_safe_continue(_iter, _safe, _list)                      \
+        for (_iter = (_iter) ? (_iter)->next : (_list)->next,                   \
+             _safe = (_iter)->next;                                             \
+             (_iter) != (_list);                                                \
+             _iter = (_safe), _safe = (_safe)->next)
+
+#define c_list_for_each_entry_safe_continue(_iter, _safe, _list, _m)            \
+        for (_iter = c_list_entry((_iter) ? (_iter)->_m.next : (_list)->next,   \
+                                  __typeof__(*_iter),                           \
+                                  _m),                                          \
+             _safe = c_list_entry((_iter)->_m.next, __typeof__(*_iter), _m);    \
+             &(_iter)->_m != (_list);                                           \
+             _iter = (_safe),                                                   \
+             _safe = c_list_entry((_safe)->_m.next, __typeof__(*_iter), _m))    \
+
+#define c_list_for_each_safe_unlink(_iter, _safe, _list)                        \
+        for (_iter = (_list)->next, _safe = (_iter)->next;                      \
+             ((*_iter = (CList)C_LIST_INIT(*_iter)), (_iter) != (_list));       \
+             _iter = (_safe), _safe = (_safe)->next)
+
+#define c_list_for_each_entry_safe_unlink(_iter, _safe, _list, _m)              \
+        for (_iter = c_list_entry((_list)->next, __typeof__(*_iter), _m),       \
+             _safe = c_list_entry((_iter)->_m.next, __typeof__(*_iter), _m);    \
+             (((_iter)->_m = (CList)C_LIST_INIT((_iter)->_m)),                  \
+              &(_iter)->_m != (_list));                                         \
+             _iter = (_safe),                                                   \
+             _safe = c_list_entry((_safe)->_m.next, __typeof__(*_iter), _m))    \
+
+/**
  * c_list_length() - return number of linked entries, excluding the head
  * @list:               list to operate on
  *
diff --git a/shared/c-list/src/meson.build b/shared/c-list/src/meson.build
new file mode 100644
index 0000000000..a77d9a8210
--- /dev/null
+++ b/shared/c-list/src/meson.build
@@ -0,0 +1,34 @@
+#
+# target: libclist.so
+# (No .so is built so far, since we are header-only. This might change in the
+#  future, if we add more complex list helpers.)
+#
+
+libclist_dep = declare_dependency(
+        include_directories: include_directories('.'),
+        version: meson.project_version(),
+)
+
+if not meson.is_subproject()
+        install_headers('c-list.h')
+
+        mod_pkgconfig.generate(
+                version: meson.project_version(),
+                name: 'libclist',
+                filebase: 'libclist',
+                description: 'Circular Intrusive Double Linked List Collection in ISO-C11',
+        )
+endif
+
+#
+# target: test-*
+#
+
+test_api = executable('test-api', ['test-api.c'], dependencies: libclist_dep)
+test('API Symbol Visibility', test_api)
+
+test_basic = executable('test-basic', ['test-basic.c'], dependencies: libclist_dep)
+test('Basic API Behavior', test_basic)
+
+test_embed = executable('test-embed', ['test-embed.c'], dependencies: libclist_dep)
+test('Embedded List Nodes', test_embed)
diff --git a/shared/c-list/src/test-api.c b/shared/c-list/src/test-api.c
new file mode 100644
index 0000000000..6ee0fbc6c1
--- /dev/null
+++ b/shared/c-list/src/test-api.c
@@ -0,0 +1,108 @@
+/*
+ * Tests for Public API
+ * This test, unlikely the others, is linked against the real, distributed,
+ * shared library. Its sole purpose is to test for symbol availability.
+ */
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "c-list.h"
+
+typedef struct {
+        int id;
+        CList link;
+} Node;
+
+static void test_api(void) {
+        CList *list_iter, *list_safe, list = C_LIST_INIT(list);
+        Node *node_iter, *node_safe, node = { .id = 0, .link = C_LIST_INIT(node.link) };
+
+        assert(!c_list_entry(NULL, Node, link));
+        assert(c_list_entry(&node.link, Node, link) == &node);
+        assert(!c_list_is_linked(&node.link));
+        assert(c_list_is_empty(&list));
+        assert(c_list_length(&list) == 0);
+        assert(c_list_contains(&list, &list));
+        assert(!c_list_contains(&list, &node.link));
+
+        /* basic link / unlink calls */
+
+        c_list_link_before(&list, &node.link);
+        assert(c_list_is_linked(&node.link));
+        assert(!c_list_is_empty(&list));
+        assert(c_list_length(&list) == 1);
+        assert(c_list_contains(&list, &list));
+        assert(c_list_contains(&list, &node.link));
+
+        c_list_unlink_stale(&node.link);
+        assert(c_list_is_linked(&node.link));
+        assert(c_list_is_empty(&list));
+        assert(c_list_length(&list) == 0);
+
+        c_list_link_after(&list, &node.link);
+        assert(c_list_is_linked(&node.link));
+        assert(!c_list_is_empty(&list));
+
+        c_list_unlink(&node.link);
+        assert(!c_list_is_linked(&node.link));
+        assert(c_list_is_empty(&list));
+
+        /* link / unlink aliases */
+
+        c_list_link_front(&list, &node.link);
+        assert(c_list_is_linked(&node.link));
+
+        c_list_unlink(&node.link);
+        assert(!c_list_is_linked(&node.link));
+
+        c_list_link_tail(&list, &node.link);
+        assert(c_list_is_linked(&node.link));
+
+        c_list_unlink(&node.link);
+        assert(!c_list_is_linked(&node.link));
+
+        /* swap / splice list operators */
+
+        c_list_swap(&list, &list);
+        assert(c_list_is_empty(&list));
+
+        c_list_splice(&list, &list);
+        assert(c_list_is_empty(&list));
+
+        /* loop macros */
+
+        c_list_for_each(list_iter, &list)
+                assert(list_iter != &list);
+        c_list_for_each_entry(node_iter, &list, link)
+                assert(&node_iter->link != &list);
+        c_list_for_each_safe(list_iter, list_safe, &list)
+                assert(list_iter != &list);
+        c_list_for_each_entry_safe(node_iter, node_safe, &list, link)
+                assert(&node_iter->link != &list);
+        c_list_for_each_continue(list_iter, &list)
+                assert(list_iter != &list);
+        c_list_for_each_entry_continue(node_iter, &list, link)
+                assert(&node_iter->link != &list);
+        c_list_for_each_safe_continue(list_iter, list_safe, &list)
+                assert(list_iter != &list);
+        c_list_for_each_entry_safe_continue(node_iter, node_safe, &list, link)
+                assert(&node_iter->link != &list);
+        c_list_for_each_safe_unlink(list_iter, list_safe, &list)
+                assert(list_iter != &list);
+        c_list_for_each_entry_safe_unlink(node_iter, node_safe, &list, link)
+                assert(&node_iter->link != &list);
+
+        /* list accessors */
+
+        assert(!c_list_first(&list));
+        assert(!c_list_last(&list));
+        assert(!c_list_first_entry(&list, Node, link));
+        assert(!c_list_last_entry(&list, Node, link));
+}
+
+int main(int argc, char **argv) {
+        test_api();
+        return 0;
+}
diff --git a/shared/c-list/src/test-basic.c b/shared/c-list/src/test-basic.c
new file mode 100644
index 0000000000..d8e9fec72a
--- /dev/null
+++ b/shared/c-list/src/test-basic.c
@@ -0,0 +1,165 @@
+/*
+ * Tests for basic functionality
+ * This contains basic, deterministic tests for list behavior, API
+ * functionality, and usage.
+ */
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "c-list.h"
+
+static void test_iterators(void) {
+        CList *iter, *safe, a, b, list = C_LIST_INIT(list);
+        unsigned int i;
+
+        assert(!c_list_first(&list));
+        assert(!c_list_last(&list));
+
+        /* link @a and verify iterators see just it */
+
+        c_list_link_tail(&list, &a);
+        assert(c_list_is_linked(&a));
+        assert(c_list_first(&list) == &a);
+        assert(c_list_last(&list) == &a);
+
+        i = 0;
+        c_list_for_each(iter, &list) {
+                assert(iter == &a);
+                ++i;
+        }
+        assert(i == 1);
+
+        i = 0;
+        iter = NULL;
+        c_list_for_each_continue(iter, &list) {
+                assert(iter == &a);
+                ++i;
+        }
+        assert(i == 1);
+
+        i = 0;
+        iter = &a;
+        c_list_for_each_continue(iter, &list)
+                ++i;
+        assert(i == 0);
+
+        /* link @b as well and verify iterators again */
+
+        c_list_link_tail(&list, &b);
+        assert(c_list_is_linked(&a));
+        assert(c_list_is_linked(&b));
+
+        i = 0;
+        c_list_for_each(iter, &list) {
+                assert((i == 0 && iter == &a) ||
+                       (i == 1 && iter == &b));
+                ++i;
+        }
+        assert(i == 2);
+
+        i = 0;
+        iter = NULL;
+        c_list_for_each_continue(iter, &list) {
+                assert((i == 0 && iter == &a) ||
+                       (i == 1 && iter == &b));
+                ++i;
+        }
+        assert(i == 2);
+
+        i = 0;
+        iter = &a;
+        c_list_for_each_continue(iter, &list) {
+                assert(iter == &b);
+                ++i;
+        }
+        assert(i == 1);
+
+        i = 0;
+        iter = &b;
+        c_list_for_each_continue(iter, &list)
+                ++i;
+        assert(i == 0);
+
+        /* verify safe-iterator while removing elements */
+
+        i = 0;
+        c_list_for_each_safe(iter, safe, &list) {
+                assert(iter == &a || iter == &b);
+                c_list_unlink_stale(iter);
+                ++i;
+        }
+        assert(i == 2);
+
+        assert(c_list_is_empty(&list));
+
+        /* link both and verify *_unlink() iterators */
+
+        c_list_link_tail(&list, &a);
+        c_list_link_tail(&list, &b);
+
+        i = 0;
+        c_list_for_each_safe_unlink(iter, safe, &list) {
+                assert(iter == &a || iter == &b);
+                assert(!c_list_is_linked(iter));
+                ++i;
+        }
+        assert(i == 2);
+
+        assert(c_list_is_empty(&list));
+}
+
+static void test_swap(void) {
+        CList list1 = (CList)C_LIST_INIT(list1);
+        CList list2 = (CList)C_LIST_INIT(list2);
+        CList list;
+
+        c_list_swap(&list1, &list2);
+
+        assert(list1.prev == list1.next && list1.prev == &list1);
+        assert(list2.prev == list2.next && list2.prev == &list2);
+
+        c_list_link_tail(&list1, &list);
+
+        assert(c_list_first(&list1) == &list);
+        assert(c_list_last(&list1) == &list);
+        assert(list.next = &list1);
+        assert(list.prev = &list1);
+
+        c_list_swap(&list1, &list2);
+
+        assert(c_list_first(&list2) == &list);
+        assert(c_list_last(&list2) == &list);
+        assert(list.next = &list2);
+        assert(list.prev = &list2);
+
+        assert(list1.prev == list1.next && list1.prev == &list1);
+}
+
+static void test_splice(void) {
+        CList target = (CList)C_LIST_INIT(target);
+        CList source = (CList)C_LIST_INIT(source);
+        CList e1, e2;
+
+        c_list_link_tail(&source, &e1);
+
+        c_list_splice(&target, &source);
+        assert(c_list_first(&target) == &e1);
+        assert(c_list_last(&target) == &e1);
+
+        source = (CList)C_LIST_INIT(source);
+
+        c_list_link_tail(&source, &e2);
+
+        c_list_splice(&target, &source);
+        assert(c_list_first(&target) == &e1);
+        assert(c_list_last(&target) == &e2);
+}
+
+int main(int argc, char **argv) {
+        test_iterators();
+        test_swap();
+        test_splice();
+        return 0;
+}
diff --git a/shared/c-list/src/test-embed.c b/shared/c-list/src/test-embed.c
new file mode 100644
index 0000000000..d30b1cd7fa
--- /dev/null
+++ b/shared/c-list/src/test-embed.c
@@ -0,0 +1,108 @@
+/*
+ * Tests for embedded CList members
+ */
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "c-list.h"
+
+typedef struct Entry Entry;
+
+struct Entry {
+        short foo;
+        CList link;
+        short bar;
+};
+
+static void test_entry(void) {
+        CList list = C_LIST_INIT(list);
+        Entry e1 = { .foo = 1 * 7, .bar = 1 * 11 };
+        Entry e2 = { .foo = 2 * 7, .bar = 2 * 11 };
+        Entry e3 = { .foo = 3 * 7, .bar = 3 * 11 };
+        Entry e4 = { .foo = 4 * 7, .bar = 4 * 11 };
+        Entry *e, *safe;
+        size_t i;
+
+        /* verify c_list_entry() works as expected (even with NULL) */
+
+        assert(!c_list_entry(NULL, Entry, link));
+        assert(&e1 == c_list_entry(&e1.link, Entry, link));
+
+        /* verify @list is empty */
+
+        assert(!c_list_first_entry(&list, Entry, link));
+        assert(!c_list_last_entry(&list, Entry, link));
+
+        /* link 2 entries and verify list state */
+
+        c_list_link_tail(&list, &e1.link);
+        c_list_link_tail(&list, &e2.link);
+
+        assert(c_list_first_entry(&list, Entry, link)->foo == 1 * 7);
+        assert(c_list_first_entry(&list, Entry, link)->bar == 1 * 11);
+        assert(c_list_last_entry(&list, Entry, link)->foo == 2 * 7);
+        assert(c_list_last_entry(&list, Entry, link)->bar == 2 * 11);
+
+        i = 0;
+        c_list_for_each_entry(e, &list, link) {
+                assert(i != 0 || e == &e1);
+                assert(i != 1 || e == &e2);
+                assert(i < 2);
+                ++i;
+        }
+        assert(i == 2);
+
+        /* link 2 more entries */
+
+        c_list_link_tail(&list, &e3.link);
+        c_list_link_tail(&list, &e4.link);
+
+        assert(c_list_first_entry(&list, Entry, link)->foo == 1 * 7);
+        assert(c_list_first_entry(&list, Entry, link)->bar == 1 * 11);
+        assert(c_list_last_entry(&list, Entry, link)->foo == 4 * 7);
+        assert(c_list_last_entry(&list, Entry, link)->bar == 4 * 11);
+
+        i = 0;
+        c_list_for_each_entry(e, &list, link) {
+                assert(i != 0 || e == &e1);
+                assert(i != 1 || e == &e2);
+                assert(i != 2 || e == &e3);
+                assert(i != 3 || e == &e4);
+                assert(i < 4);
+                ++i;
+        }
+        assert(i == 4);
+
+        assert(!c_list_is_empty(&list));
+        assert(c_list_is_linked(&e1.link));
+        assert(c_list_is_linked(&e2.link));
+        assert(c_list_is_linked(&e3.link));
+        assert(c_list_is_linked(&e4.link));
+
+        /* remove via safe iterator */
+
+        i = 0;
+        c_list_for_each_entry_safe(e, safe, &list, link) {
+                assert(i != 0 || e == &e1);
+                assert(i != 1 || e == &e2);
+                assert(i != 2 || e == &e3);
+                assert(i != 3 || e == &e4);
+                assert(i < 4);
+                ++i;
+                c_list_unlink(&e->link);
+        }
+        assert(i == 4);
+
+        assert(c_list_is_empty(&list));
+        assert(!c_list_is_linked(&e1.link));
+        assert(!c_list_is_linked(&e2.link));
+        assert(!c_list_is_linked(&e3.link));
+        assert(!c_list_is_linked(&e4.link));
+}
+
+int main(int argc, char **argv) {
+        test_entry();
+        return 0;
+}
diff --git a/shared/c-siphash/.cherryci/ci-test b/shared/c-siphash/.cherryci/ci-test
new file mode 100755
index 0000000000..8ce5f5f70e
--- /dev/null
+++ b/shared/c-siphash/.cherryci/ci-test
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -e
+
+rm -Rf "./ci-build"
+mkdir "./ci-build"
+cd "./ci-build"
+
+${CHERRY_LIB_MESONSETUP} . "${CHERRY_LIB_SRCDIR}"
+${CHERRY_LIB_NINJABUILD}
+${CHERRY_LIB_MESONTEST}
+(( ! CHERRY_LIB_VALGRIND )) || ${CHERRY_LIB_MESONTEST} "--wrapper=${CHERRY_LIB_VALGRINDWRAP}"
diff --git a/shared/c-siphash/.editorconfig b/shared/c-siphash/.editorconfig
new file mode 100644
index 0000000000..b10bb4f3f8
--- /dev/null
+++ b/shared/c-siphash/.editorconfig
@@ -0,0 +1,11 @@
+root = true
+
+[*]
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+charset = utf-8
+
+[*.{c,h}]
+indent_style = space
+indent_size = 8
diff --git a/shared/c-siphash/.travis.yml b/shared/c-siphash/.travis.yml
new file mode 100644
index 0000000000..fafb392fdc
--- /dev/null
+++ b/shared/c-siphash/.travis.yml
@@ -0,0 +1,17 @@
+services:
+  - docker
+
+before_install:
+  - curl -O -L "https://raw.githubusercontent.com/cherry-pick/cherry-images/v1/scripts/vmrun"
+  - curl -O -L "https://raw.githubusercontent.com/cherry-pick/cherry-ci/v1/scripts/cherryci"
+  - chmod +x "./vmrun" "./cherryci"
+
+jobs:
+  include:
+    - stage: test
+      script:
+        - ./vmrun -- ../src/cherryci -d ../src/.cherryci -s c-util -m
+    - script:
+        - ./vmrun -T armv7hl -- ../src/cherryci -d ../src/.cherryci -s c-util -m
+    - script:
+        - ./vmrun -T i686 -- ../src/cherryci -d ../src/.cherryci -s c-util -m
diff --git a/shared/c-siphash/AUTHORS b/shared/c-siphash/AUTHORS
new file mode 100644
index 0000000000..980d602337
--- /dev/null
+++ b/shared/c-siphash/AUTHORS
@@ -0,0 +1,37 @@
+LICENSE:
+        This project is dual-licensed under both the Apache License, Version
+        2.0, and the GNU Lesser General Public License, Version 2.1+.
+
+AUTHORS-ASL:
+        Licensed under the Apache License, Version 2.0 (the "License");
+        you may not use this file except in compliance with the License.
+        You may obtain a copy of the License at
+
+                http://www.apache.org/licenses/LICENSE-2.0
+
+        Unless required by applicable law or agreed to in writing, software
+        distributed under the License is distributed on an "AS IS" BASIS,
+        WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+        See the License for the specific language governing permissions and
+        limitations under the License.
+
+AUTHORS-LGPL:
+        This program is free software; you can redistribute it and/or modify it
+        under the terms of the GNU Lesser General Public License as published
+        by the Free Software Foundation; either version 2.1 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful, but
+        WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+        Lesser General Public License for more details.
+
+        You should have received a copy of the GNU Lesser General Public License
+        along with this program; If not, see <http://www.gnu.org/licenses/>.
+
+COPYRIGHT: (ordered alphabetically)
+        Copyright (C) 2015-2018 Red Hat, Inc.
+
+AUTHORS: (ordered alphabetically)
+        David Herrmann <dh.herrmann@gmail.com>
+        Tom Gundersen <teg@jklm.no>
diff --git a/shared/c-siphash/AUTHORS-ASL b/shared/c-siphash/AUTHORS-ASL
new file mode 100644
index 0000000000..5d501a7284
--- /dev/null
+++ b/shared/c-siphash/AUTHORS-ASL
@@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "{}"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright {yyyy} {name of copyright owner}
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/shared/c-siphash/AUTHORS-LGPL b/shared/c-siphash/AUTHORS-LGPL
new file mode 100644
index 0000000000..4362b49151
--- /dev/null
+++ b/shared/c-siphash/AUTHORS-LGPL
@@ -0,0 +1,502 @@
+                  GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the Lesser GPL.  It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+  This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it.  You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+  When we speak of free software, we are referring to freedom of use,
+not price.  Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+  To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights.  These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+  For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you.  You must make sure that they, too, receive or can get the source
+code.  If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it.  And you must show them these terms so they know their rights.
+
+  We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+  To protect each distributor, we want to make it very clear that
+there is no warranty for the free library.  Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+  Finally, software patents pose a constant threat to the existence of
+any free program.  We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder.  Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+  Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License.  This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License.  We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+  When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library.  The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom.  The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+  We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License.  It also provides other free software developers Less
+of an advantage over competing non-free programs.  These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries.  However, the Lesser license provides advantages in certain
+special circumstances.
+
+  For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard.  To achieve this, non-free programs must be
+allowed to use the library.  A more frequent case is that a free
+library does the same job as widely used non-free libraries.  In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+  In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software.  For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+  Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.  Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library".  The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+  A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+  The "Library", below, refers to any such software library or work
+which has been distributed under these terms.  A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language.  (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+  "Source code" for a work means the preferred form of the work for
+making modifications to it.  For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+  Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it).  Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+  1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+  You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+  2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) The modified work must itself be a software library.
+
+    b) You must cause the files modified to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    c) You must cause the whole of the work to be licensed at no
+    charge to all third parties under the terms of this License.
+
+    d) If a facility in the modified Library refers to a function or a
+    table of data to be supplied by an application program that uses
+    the facility, other than as an argument passed when the facility
+    is invoked, then you must make a good faith effort to ensure that,
+    in the event an application does not supply such function or
+    table, the facility still operates, and performs whatever part of
+    its purpose remains meaningful.
+
+    (For example, a function in a library to compute square roots has
+    a purpose that is entirely well-defined independent of the
+    application.  Therefore, Subsection 2d requires that any
+    application-supplied function or table used by this function must
+    be optional: if the application does not supply it, the square
+    root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library.  To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License.  (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.)  Do not make any other change in
+these notices.
+
+  Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+  This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+  4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+  If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library".  Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+  However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library".  The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+  When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library.  The
+threshold for this to be true is not precisely defined by law.
+
+  If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work.  (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+  Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+  6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+  You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License.  You must supply a copy of this License.  If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License.  Also, you must do one
+of these things:
+
+    a) Accompany the work with the complete corresponding
+    machine-readable source code for the Library including whatever
+    changes were used in the work (which must be distributed under
+    Sections 1 and 2 above); and, if the work is an executable linked
+    with the Library, with the complete machine-readable "work that
+    uses the Library", as object code and/or source code, so that the
+    user can modify the Library and then relink to produce a modified
+    executable containing the modified Library.  (It is understood
+    that the user who changes the contents of definitions files in the
+    Library will not necessarily be able to recompile the application
+    to use the modified definitions.)
+
+    b) Use a suitable shared library mechanism for linking with the
+    Library.  A suitable mechanism is one that (1) uses at run time a
+    copy of the library already present on the user's computer system,
+    rather than copying library functions into the executable, and (2)
+    will operate properly with a modified version of the library, if
+    the user installs one, as long as the modified version is
+    interface-compatible with the version that the work was made with.
+
+    c) Accompany the work with a written offer, valid for at
+    least three years, to give the same user the materials
+    specified in Subsection 6a, above, for a charge no more
+    than the cost of performing this distribution.
+
+    d) If distribution of the work is made by offering access to copy
+    from a designated place, offer equivalent access to copy the above
+    specified materials from the same place.
+
+    e) Verify that the user has already received a copy of these
+    materials or that you have already sent this user a copy.
+
+  For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it.  However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+  It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system.  Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+  7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+    a) Accompany the combined library with a copy of the same work
+    based on the Library, uncombined with any other library
+    facilities.  This must be distributed under the terms of the
+    Sections above.
+
+    b) Give prominent notice with the combined library of the fact
+    that part of it is a work based on the Library, and explaining
+    where to find the accompanying uncombined form of the same work.
+
+  8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License.  Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License.  However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+  9. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Library or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+  10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties with
+this License.
+
+  11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded.  In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+  13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation.  If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+  14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission.  For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this.  Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+                            NO WARRANTY
+
+  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+           How to Apply These Terms to Your New Libraries
+
+  If you develop a new library, and you want it to be of the greatest
+possible use to the public, we recommend making it free software that
+everyone can redistribute and change.  You can do so by permitting
+redistribution under these terms (or, alternatively, under the terms of the
+ordinary General Public License).
+
+  To apply these terms, attach the following notices to the library.  It is
+safest to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the library's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+Also add information on how to contact you by electronic and paper mail.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the library, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the
+  library `Frob' (a library for tweaking knobs) written by James Random Hacker.
+
+  <signature of Ty Coon>, 1 April 1990
+  Ty Coon, President of Vice
+
+That's all there is to it!
diff --git a/shared/c-siphash/LICENSE b/shared/c-siphash/LICENSE
new file mode 100644
index 0000000000..5d501a7284
--- /dev/null
+++ b/shared/c-siphash/LICENSE
@@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "{}"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright {yyyy} {name of copyright owner}
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/shared/c-siphash/README b/shared/c-siphash/README
new file mode 100644
index 0000000000..9a9556b030
--- /dev/null
+++ b/shared/c-siphash/README
@@ -0,0 +1,51 @@
+c-siphash - Streaming-capable SipHash Implementation
+
+ABOUT:
+        The c-siphash project is a standalone implementation of SipHash in
+        Standard ISO-C11. It provides a streaming-capable API to compute data
+        hashes according to the SipHash algorithm.
+
+        For API documentation, see the c-siphash.h header file, as well as the
+        docbook comments for each function.
+
+DETAILS:
+        https://c-util.github.io/c-siphash
+
+BUG REPORTS:
+        https://github.com/c-util/c-siphash/issues
+
+GIT:
+        git@github.com:c-util/c-siphash.git
+        https://github.com/c-util/c-siphash.git
+
+GITWEB:
+        https://github.com/c-util/c-siphash
+
+LICENSE:
+        Apache Software License 2.0
+        Lesser General Public License 2.1+
+        See AUTHORS for details.
+
+REQUIREMENTS:
+        The requirements for c-siphash are:
+
+            libc (e.g., glibc >= 2.16)
+
+        At build-time, the following software is required:
+
+            meson >= 0.41
+            pkg-config >= 0.29
+
+INSTALL:
+        The meson build-system is used for c-siphash. Contact upstream
+        documentation for detailed help. In most situations the following
+        commands are sufficient to build and install c-siphash from source:
+
+            $ mkdir build
+            $ cd build
+            $ meson setup ..
+            $ ninja
+            $ meson test
+            # ninja install
+
+        No custom configuration options are available.
diff --git a/shared/c-siphash/meson.build b/shared/c-siphash/meson.build
new file mode 100644
index 0000000000..46f1c0154d
--- /dev/null
+++ b/shared/c-siphash/meson.build
@@ -0,0 +1,14 @@
+project(
+        'c-siphash',
+        'c',
+        version: '1',
+        license: 'Apache',
+        default_options: [
+                'c_std=c11'
+        ]
+)
+
+add_project_arguments('-D_GNU_SOURCE', language: 'c')
+mod_pkgconfig = import('pkgconfig')
+
+subdir('src')
diff --git a/shared/c-siphash/src/c-siphash.c b/shared/c-siphash/src/c-siphash.c
new file mode 100644
index 0000000000..76b25b8682
--- /dev/null
+++ b/shared/c-siphash/src/c-siphash.c
@@ -0,0 +1,246 @@
+/*
+ * SipHash Implementation
+ *
+ * For highlevel documentation of the API see the header file and the docbook
+ * comments. This implementation is based on the reference implementation of
+ * SipHash, written by Jean-Philippe Aumasson and Daniel J. Bernstein, and
+ * released to the Public Domain.
+ *
+ * So far, only SipHash24 is implemented, since there was no need for other
+ * parameters. However, adjusted c_siphash_append_X() and
+ * C_siphash_finalize_Y() can be easily provided, if required.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+#include "c-siphash.h"
+
+#define _public_ __attribute__((__visibility__("default")))
+
+static inline uint64_t c_siphash_read_le64(const uint8_t bytes[8]) {
+        return  ((uint64_t) bytes[0]) |
+               (((uint64_t) bytes[1]) <<  8) |
+               (((uint64_t) bytes[2]) << 16) |
+               (((uint64_t) bytes[3]) << 24) |
+               (((uint64_t) bytes[4]) << 32) |
+               (((uint64_t) bytes[5]) << 40) |
+               (((uint64_t) bytes[6]) << 48) |
+               (((uint64_t) bytes[7]) << 56);
+}
+
+static inline uint64_t c_siphash_rotate_left(uint64_t x, uint8_t b) {
+        return (x << b) | (x >> (64 - b));
+}
+
+static inline void c_siphash_sipround(CSipHash *state) {
+        state->v0 += state->v1;
+        state->v1 = c_siphash_rotate_left(state->v1, 13);
+        state->v1 ^= state->v0;
+        state->v0 = c_siphash_rotate_left(state->v0, 32);
+        state->v2 += state->v3;
+        state->v3 = c_siphash_rotate_left(state->v3, 16);
+        state->v3 ^= state->v2;
+        state->v0 += state->v3;
+        state->v3 = c_siphash_rotate_left(state->v3, 21);
+        state->v3 ^= state->v0;
+        state->v2 += state->v1;
+        state->v1 = c_siphash_rotate_left(state->v1, 17);
+        state->v1 ^= state->v2;
+        state->v2 = c_siphash_rotate_left(state->v2, 32);
+}
+
+/**
+ * c_siphash_init() - initialize siphash context
+ * @state:              context object
+ * @seed:               128bit seed
+ *
+ * This initializes the siphash state context. Once initialized, it can be used
+ * to hash arbitary input. To feed data into it, use c_siphash_append(). To get
+ * the final hash, use c_siphash_finalize().
+ *
+ * Note that the siphash context does not allocate state. There is no need to
+ * deserialize it before releasing its backing memory.
+ *
+ * The hashes generated by this context change depending on the seed. Every
+ * user is highly inclined to provide their unique seed. If no stable hashes
+ * are needed, a random seed will do fine.
+ *
+ * Right now, only SipHash24 is supported. Other SipHash parameters can be
+ * easily added if required.
+ */
+_public_ void c_siphash_init(CSipHash *state, const uint8_t seed[16]) {
+        uint64_t k0, k1;
+
+        k0 = c_siphash_read_le64(seed);
+        k1 = c_siphash_read_le64(seed + 8);
+
+        *state = (CSipHash) {
+                /*
+                 * Default seed is taken from the reference implementation
+                 * of SipHash24 ("somepseudorandomlygeneratedbytes"). Callers
+                 * are still recommended to provide proper seeds themselves.
+                 */
+                .v0 = 0x736f6d6570736575ULL ^ k0,
+                .v1 = 0x646f72616e646f6dULL ^ k1,
+                .v2 = 0x6c7967656e657261ULL ^ k0,
+                .v3 = 0x7465646279746573ULL ^ k1,
+                .padding = 0,
+                .n_bytes = 0,
+        };
+}
+
+/**
+ * c_siphash_append() - hash stream of data
+ * @state:              context object
+ * @bytes:              array of input bytes
+ * @n_bytes:            number of input bytes
+ *
+ * This feeds an array of bytes into the SipHash state machine. This is a
+ * streaming-capable API. That is, the resulting hash is the same, regardless
+ * of the way you chunk the input.
+ * This function simply feeds the given bytes into the SipHash state machine.
+ * It does not produce a final hash. You can call this function many times to
+ * append more data. To retrieve the final hash, call c_siphash_finalize().
+ *
+ * Note that this implementation works best when used with chunk-sizes of
+ * multiples of 64bit (8-bytes). This is not a requirement, though.
+ */
+_public_ void c_siphash_append(CSipHash *state, const uint8_t *bytes, size_t n_bytes) {
+        const uint8_t *end = bytes + n_bytes;
+        size_t left = state->n_bytes & 7;
+        uint64_t m;
+
+        state->n_bytes += n_bytes;
+
+        /*
+         * SipHash operates on 64bit chunks. If the previous blob was not a
+         * multiple of 64bit in length, we must operate on single bytes.
+         */
+        if (left > 0) {
+                for ( ; bytes < end && left < 8; ++bytes, ++left)
+                        state->padding |= ((uint64_t) *bytes) << (left * 8);
+
+                if (bytes == end && left < 8)
+                        return;
+
+                state->v3 ^= state->padding;
+                c_siphash_sipround(state);
+                c_siphash_sipround(state);
+                state->v0 ^= state->padding;
+
+                state->padding = 0;
+        }
+
+        end -= (state->n_bytes % sizeof(uint64_t));
+
+        /*
+         * We are now guaranteed to be at a 64bit state boudary. Hence, we can
+         * operate in 64bit chunks on all input. This is much faster than the
+         * one-byte-at-a-time loop.
+         */
+        for ( ; bytes < end; bytes += 8) {
+                m = c_siphash_read_le64(bytes);
+
+                state->v3 ^= m;
+                c_siphash_sipround(state);
+                c_siphash_sipround(state);
+                state->v0 ^= m;
+        }
+
+        /*
+         * Now that we hashed as much 64bit chunks as possible, we need to
+         * remember the remaining trailing bytes. Keep them in @padding so the
+         * next round (or the finalizer) get access to them.
+         */
+        left = state->n_bytes & 7;
+        switch (left) {
+                case 7:
+                        state->padding |= ((uint64_t) bytes[6]) << 48;
+                        /* fallthrough */
+                case 6:
+                        state->padding |= ((uint64_t) bytes[5]) << 40;
+                        /* fallthrough */
+                case 5:
+                        state->padding |= ((uint64_t) bytes[4]) << 32;
+                        /* fallthrough */
+                case 4:
+                        state->padding |= ((uint64_t) bytes[3]) << 24;
+                        /* fallthrough */
+                case 3:
+                        state->padding |= ((uint64_t) bytes[2]) << 16;
+                        /* fallthrough */
+                case 2:
+                        state->padding |= ((uint64_t) bytes[1]) <<  8;
+                        /* fallthrough */
+                case 1:
+                        state->padding |= ((uint64_t) bytes[0]);
+                        /* fallthrough */
+                case 0:
+                        break;
+        }
+}
+
+/**
+ * c_siphash_finalize() - finalize hash
+ * @state:              context object
+ *
+ * This produces the final SipHash24 hash value for the given SipHash state.
+ * That is, it produces a hash value corresponding to the SipHash24 hash value
+ * of the concatenated byte-array passed into @state via c_siphash_append().
+ *
+ * Note that @state has an invalid state after this function returns. To reuse
+ * it for another hash, you must call c_siphash_init() again. If you don't need
+ * the object, anymore, you can release it any time. There is no need to
+ * destroy the object explicitly.
+ *
+ * Return: 64bit hash value
+ */
+_public_ uint64_t c_siphash_finalize(CSipHash *state) {
+        uint64_t b;
+
+        b = state->padding | (((uint64_t) state->n_bytes) << 56);
+
+        state->v3 ^= b;
+        c_siphash_sipround(state);
+        c_siphash_sipround(state);
+        state->v0 ^= b;
+
+        state->v2 ^= 0xff;
+
+        c_siphash_sipround(state);
+        c_siphash_sipround(state);
+        c_siphash_sipround(state);
+        c_siphash_sipround(state);
+
+        return state->v0 ^ state->v1 ^ state->v2  ^ state->v3;
+}
+
+/**
+ * c_siphash_hash() - hash data blob
+ * @seed:               128bit seed
+ * @bytes:              byte array to hash
+ * @n_bytes:            number of bytes to hash
+ *
+ * This produces the SipHash24 hash value for the input @bytes / @n_bytes,
+ * using the seed provided as @seed.
+ *
+ * This is functionally equivalent to:
+ *
+ *         CSipHash state;
+ *         c_siphash_init(&state, seed);
+ *         c_siphash_apend(&state, bytes, n_bytes);
+ *         return c_siphash_finalize(&state);
+ *
+ * Unlike the streaming API, this is a one-shot call suitable for any data that
+ * is available in-memory at the same time.
+ *
+ * Return: 64bit hash value
+ */
+_public_ uint64_t c_siphash_hash(const uint8_t seed[16], const uint8_t *bytes, size_t n_bytes) {
+        CSipHash state;
+
+        c_siphash_init(&state, seed);
+        c_siphash_append(&state, bytes, n_bytes);
+
+        return c_siphash_finalize(&state);
+}
diff --git a/shared/c-siphash/src/c-siphash.h b/shared/c-siphash/src/c-siphash.h
new file mode 100644
index 0000000000..c0cfc1e084
--- /dev/null
+++ b/shared/c-siphash/src/c-siphash.h
@@ -0,0 +1,60 @@
+#pragma once
+
+/**
+ * Streaming-capable SipHash Implementation
+ *
+ * This library provides a SipHash API, that is fully implemented in ISO-C11
+ * and has no external dependencies. The library performs no memory allocation,
+ * and provides a streaming API where data to be hashed can be appended
+ * piecemeal.
+ *
+ * A streaming-capable hash state is represented by the "CSipHash" structure,
+ * which should be initialized with a unique seed before use. If streaming
+ * capabilities are not required, c_siphash_hash() provides a simple one-shot
+ * API.
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stddef.h>
+#include <stdint.h>
+
+typedef struct CSipHash CSipHash;
+
+/**
+ * struct CSipHash - SipHash state object
+ * @v0-@v3:             internal state
+ * @padding:            pending bytes that were not a multiple of 8
+ * @n_bytes:            number of hashed bytes
+ *
+ * The state of an inflight hash is represenetd by a CSipHash object. Before
+ * hashing, it must be initialized with c_siphash_init(), providing a unique
+ * random hash seed. Data is hashed by appending it to the state object, using
+ * c_siphash_append(). Finally, the hash is read out by calling
+ * c_siphash_finalize().
+ *
+ * This state object has no allocated resources. It is safe to release its
+ * backing memory without any further action.
+ */
+struct CSipHash {
+        uint64_t v0;
+        uint64_t v1;
+        uint64_t v2;
+        uint64_t v3;
+        uint64_t padding;
+        size_t n_bytes;
+};
+
+#define C_SIPHASH_NULL {}
+
+void c_siphash_init(CSipHash *state, const uint8_t seed[16]);
+void c_siphash_append(CSipHash *state, const uint8_t *bytes, size_t n_bytes);
+uint64_t c_siphash_finalize(CSipHash *state);
+
+uint64_t c_siphash_hash(const uint8_t seed[16], const uint8_t *bytes, size_t n_bytes);
+
+#ifdef __cplusplus
+}
+#endif
diff --git a/shared/c-siphash/src/libcsiphash.sym b/shared/c-siphash/src/libcsiphash.sym
new file mode 100644
index 0000000000..5ab16d6115
--- /dev/null
+++ b/shared/c-siphash/src/libcsiphash.sym
@@ -0,0 +1,9 @@
+LIBCSIPHASH_1 {
+global:
+        c_siphash_init;
+        c_siphash_append;
+        c_siphash_finalize;
+        c_siphash_hash;
+local:
+       *;
+};
diff --git a/shared/c-siphash/src/meson.build b/shared/c-siphash/src/meson.build
new file mode 100644
index 0000000000..2ecb018919
--- /dev/null
+++ b/shared/c-siphash/src/meson.build
@@ -0,0 +1,57 @@
+#
+# target: libcsiphash.so
+#
+
+libcsiphash_symfile = join_paths(meson.current_source_dir(), 'libcsiphash.sym')
+
+libcsiphash_private = static_library(
+        'csiphash-private',
+        [
+                'c-siphash.c',
+        ],
+        c_args: [
+                '-fvisibility=hidden',
+                '-fno-common',
+        ],
+        pic: true,
+)
+
+libcsiphash_shared = shared_library(
+        'csiphash',
+        objects: libcsiphash_private.extract_all_objects(),
+        install: not meson.is_subproject(),
+        soversion: 0,
+        link_depends: libcsiphash_symfile,
+        link_args: [
+                '-Wl,--no-undefined',
+                '-Wl,--version-script=@0@'.format(libcsiphash_symfile),
+        ],
+)
+
+libcsiphash_dep = declare_dependency(
+        include_directories: include_directories('.'),
+        link_with: libcsiphash_private,
+        version: meson.project_version()
+)
+
+if not meson.is_subproject()
+        install_headers('c-siphash.h')
+
+        mod_pkgconfig.generate(
+                libraries: libcsiphash_shared,
+                version: meson.project_version(),
+                name: 'libcsiphash',
+                filebase: 'libcsiphash',
+                description: 'Streaming-capable SipHash Implementation',
+        )
+endif
+
+#
+# target: test-*
+#
+
+test_api = executable('test-api', ['test-api.c'], link_with: libcsiphash_shared)
+test('API Symbol Visibility', test_api)
+
+test_basic = executable('test-basic', ['test-basic.c'], link_with: libcsiphash_private)
+test('Basic API Behavior', test_basic)
diff --git a/shared/c-siphash/src/test-api.c b/shared/c-siphash/src/test-api.c
new file mode 100644
index 0000000000..4ee4f8203b
--- /dev/null
+++ b/shared/c-siphash/src/test-api.c
@@ -0,0 +1,32 @@
+/*
+ * Tests for Public API
+ * This test, unlikely the others, is linked against the real, distributed,
+ * shared library. Its sole purpose is to test for symbol availability.
+ */
+
+#undef NDEBUG
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "c-siphash.h"
+
+static void test_api(void) {
+        CSipHash state = C_SIPHASH_NULL;
+        uint8_t seed[] = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f' };
+        uint64_t hash1, hash2;
+
+        c_siphash_init(&state, seed);
+        c_siphash_append(&state, NULL, 0);
+        hash1 = c_siphash_finalize(&state);
+        assert(hash1 == 12552310112479190712ULL);
+
+        hash2 = c_siphash_hash(seed, NULL, 0);
+        assert(hash1 == hash2);
+}
+
+int main(int argc, char **argv) {
+        test_api();
+        return 0;
+}
diff --git a/shared/c-siphash/src/test-basic.c b/shared/c-siphash/src/test-basic.c
new file mode 100644
index 0000000000..a006180f67
--- /dev/null
+++ b/shared/c-siphash/src/test-basic.c
@@ -0,0 +1,120 @@
+/*
+ * Tests for Basic Hash Operations
+ * This test does some basic hash operations and verifies their correctness. It
+ * breaks up the data to be hashed in various ways to make sure it is stable.
+ */
+
+#undef NDEBUG
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "c-siphash.h"
+
+/* See https://131002.net/siphash/siphash.pdf, Appendix A. */
+static void do_reference_test(const uint8_t *in, size_t len, const uint8_t *key) {
+        CSipHash state = {};
+        uint64_t out;
+        unsigned i, j;
+
+        /* verify the internal state as given in the above paper */
+        c_siphash_init(&state, key);
+        assert(state.v0 == 0x7469686173716475);
+        assert(state.v1 == 0x6b617f6d656e6665);
+        assert(state.v2 == 0x6b7f62616d677361);
+        assert(state.v3 == 0x7b6b696e727e6c7b);
+        c_siphash_append(&state, in, len);
+        assert(state.v0 == 0x4a017198de0a59e0);
+        assert(state.v1 == 0x0d52f6f62a4f59a4);
+        assert(state.v2 == 0x634cb3577b01fd3d);
+        assert(state.v3 == 0xa5224d6f55c7d9c8);
+        out = c_siphash_finalize(&state);
+        assert(out == 0xa129ca6149be45e5);
+        assert(state.v0 == 0xf6bcd53893fecff1);
+        assert(state.v1 == 0x54b9964c7ea0d937);
+        assert(state.v2 == 0x1b38329c099bb55a);
+        assert(state.v3 == 0x1814bb89ad7be679);
+
+        /* verify that decomposing the input in three chunks gives the
+           same result */
+        for (i = 0; i < len; i++) {
+                for (j = i; j < len; j++) {
+                        c_siphash_init(&state, key);
+                        c_siphash_append(&state, in, i);
+                        c_siphash_append(&state, &in[i], j - i);
+                        c_siphash_append(&state, &in[j], len - j);
+                        out = c_siphash_finalize(&state);
+                        assert(out == 0xa129ca6149be45e5);
+                }
+        }
+
+        /* verify c_siphash_hash() produces the same result */
+        assert(out == c_siphash_hash(key, in, len));
+}
+
+static void test_reference(void) {
+
+        const uint8_t in[15]  = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+                                  0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e };
+        const uint8_t key[16] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+                                  0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f};
+        uint8_t in_buf[20];
+
+        /* Test with same input but different alignments. */
+        memcpy(in_buf, in, sizeof(in));
+        do_reference_test(in_buf, sizeof(in), key);
+        memcpy(in_buf + 1, in, sizeof(in));
+        do_reference_test(in_buf + 1, sizeof(in), key);
+        memcpy(in_buf + 2, in, sizeof(in));
+        do_reference_test(in_buf + 2, sizeof(in), key);
+        memcpy(in_buf + 4, in, sizeof(in));
+        do_reference_test(in_buf + 4, sizeof(in), key);
+}
+
+static void test_short_hashes(void) {
+        const uint8_t one[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+                                0x09, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16 };
+        const uint8_t  key[16] = { 0x22, 0x24, 0x41, 0x22, 0x55, 0x77, 0x88, 0x07,
+                                   0x23, 0x09, 0x23, 0x14, 0x0c, 0x33, 0x0e, 0x0f};
+        uint8_t two[sizeof one] = {};
+
+        CSipHash state1 = {}, state2 = {};
+        unsigned i, j;
+
+        c_siphash_init(&state1, key);
+        c_siphash_init(&state2, key);
+
+        /* hashing 1, 2, 3, 4, 5, ..., 16 bytes, with the byte after the buffer different */
+        for (i = 1; i <= sizeof one; i++) {
+                c_siphash_append(&state1, one, i);
+
+                two[i-1] = one[i-1];
+                c_siphash_append(&state2, two, i);
+
+                assert(memcmp(&state1, &state2, sizeof state1) == 0);
+        }
+
+        /* hashing n and 1, n and 2, n and 3, ..., n-1 and 1, n-2 and 2, ... */
+        for (i = sizeof one; i > 0; i--) {
+                memset(two, 0, sizeof(two));
+
+                for (j = 1; j <= sizeof one; j++) {
+                        c_siphash_append(&state1, one, i);
+                        c_siphash_append(&state1, one, j);
+
+                        c_siphash_append(&state2, one, i);
+                        two[j-1] = one[j-1];
+                        c_siphash_append(&state2, two, j);
+
+                        assert(memcmp(&state1, &state2, sizeof state1) == 0);
+                }
+        }
+}
+
+int main(int argc, char *argv[]) {
+        test_reference();
+        test_short_hashes();
+
+        return 0;
+}
diff --git a/shared/meson.build b/shared/meson.build
index 2d0281b93f..a812b5882a 100644
--- a/shared/meson.build
+++ b/shared/meson.build
@@ -1,3 +1,28 @@
+shared_c_list_dep = declare_dependency(
+    include_directories: include_directories('c-list/src')
+)
+
+shared_c_siphash = static_library(
+    'c-siphash',
+    sources: ['c-siphash/src/c-siphash.c']
+)
+
+shared_c_siphash_dep = declare_dependency(
+    include_directories: include_directories('c-siphash/src'),
+    link_with: shared_c_siphash
+)
+
+shared_n_acd = static_library(
+    'n-acd',
+    sources: ['n-acd/src/n-acd.c'],
+    dependencies: [ shared_c_siphash_dep, shared_c_list_dep ]
+)
+
+shared_n_acd_dep = declare_dependency(
+    include_directories: include_directories('.'),
+    link_with: shared_n_acd,
+)
+
 shared_inc = include_directories('.')
 
 version_conf = configuration_data()
diff --git a/shared/n-acd/.editorconfig b/shared/n-acd/.editorconfig
new file mode 100644
index 0000000000..b41176962d
--- /dev/null
+++ b/shared/n-acd/.editorconfig
@@ -0,0 +1,16 @@
+# http://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
+# Unix-style newlines with a newline ending every file, utf-8 charset
+[*]
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+charset = utf-8
+
+# match config files, set indent to spaces with width of eight
+[*.{c,h}]
+indent_style = space
+indent_size = 8
diff --git a/shared/n-acd/.gitmodules b/shared/n-acd/.gitmodules
new file mode 100644
index 0000000000..ec8b866d2f
--- /dev/null
+++ b/shared/n-acd/.gitmodules
@@ -0,0 +1,6 @@
+[submodule "subprojects/c-list"]
+	path = subprojects/c-list
+	url = https://github.com/c-util/c-list.git
+[submodule "subprojects/c-siphash"]
+	path = subprojects/c-siphash
+	url = https://github.com/c-util/c-siphash.git
diff --git a/shared/n-acd/.travis.yml b/shared/n-acd/.travis.yml
new file mode 100644
index 0000000000..ed0bcf38c4
--- /dev/null
+++ b/shared/n-acd/.travis.yml
@@ -0,0 +1,18 @@
+dist: trusty
+sudo: required
+os: linux
+language: c
+compiler:
+  - gcc
+  - clang
+
+install:
+  - curl -L "https://github.com/ninja-build/ninja/releases/download/v1.7.2/ninja-linux.zip" -o "ninja-linux.zip"
+  - sudo unzip "ninja-linux.zip" -d "/usr/local/bin"
+  - sudo chmod 755 "/usr/local/bin/ninja"
+  - pip3 install meson
+
+script:
+  - meson "build"
+  - ninja -C "build"
+  - sudo MESON_TESTTHREADS=64 ninja -C "build" test
diff --git a/shared/n-acd/COPYING b/shared/n-acd/COPYING
new file mode 100644
index 0000000000..81c0566b88
--- /dev/null
+++ b/shared/n-acd/COPYING
@@ -0,0 +1,19 @@
+LICENSE:
+        Licensed under the Apache License, Version 2.0 (the "License");
+        you may not use this file except in compliance with the License.
+        You may obtain a copy of the License at
+
+                http://www.apache.org/licenses/LICENSE-2.0
+
+        Unless required by applicable law or agreed to in writing, software
+        distributed under the License is distributed on an "AS IS" BASIS,
+        WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+        See the License for the specific language governing permissions and
+        limitations under the License.
+
+COPYRIGHT: (ordered alphabetically)
+        Copyright (C) 2015-2017 Red Hat, Inc.
+
+AUTHORS: (ordered alphabetically)
+        David Herrmann <dh.herrmann@gmail.com>
+        Tom Gundersen <teg@jklm.no>
diff --git a/shared/n-acd/LICENSE b/shared/n-acd/LICENSE
new file mode 100644
index 0000000000..5d501a7284
--- /dev/null
+++ b/shared/n-acd/LICENSE
@@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "{}"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright {yyyy} {name of copyright owner}
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/shared/n-acd/README b/shared/n-acd/README
new file mode 100644
index 0000000000..4077cba05e
--- /dev/null
+++ b/shared/n-acd/README
@@ -0,0 +1,50 @@
+n-acd - IPv4 Address Conflict Detection
+
+ABOUT:
+        The n-acd project implements the IPv4 Address Conflict Detection
+        standard as defined in RFC-5227. The state machine is implemented in a
+        shared library and provides a stable ISO-C11 API. The implementation is
+        linux-only and relies heavily on the API behavior of recent linux
+        kernel releases.
+
+DETAILS:
+        https://github.com/nettools/n-acd/wiki
+
+BUG REPORTS:
+        https://github.com/nettools/n-acd/issues
+
+GIT:
+        git@github.com:nettools/n-acd.git
+        https://github.com/nettools/n-acd.git
+
+GITWEB:
+        https://github.com/nettools/n-acd
+
+LICENSE:
+        Apache Software License 2.0 (LICENSE)
+        See COPYING for details.
+
+REQUIREMENTS:
+        The requirements for n-acd are:
+
+            Linux kernel >= 3.0
+            libc (e.g., glibc >= 2.16)
+
+        At build-time, the following software is required:
+
+            meson >= 0.41
+            pkg-config >= 0.29
+
+INSTALL:
+        The meson build-system is used for n-acd. Contact upstream
+        documentation for detailed help. In most situations the following
+        commands are sufficient to build and install n-acd from source:
+
+            $ mkdir build
+            $ cd build
+            $ meson setup . ..
+            $ ninja
+            $ ninja test
+            # ninja install
+
+        No custom configuration options are available.
diff --git a/shared/n-acd/meson.build b/shared/n-acd/meson.build
new file mode 100644
index 0000000000..da923c288d
--- /dev/null
+++ b/shared/n-acd/meson.build
@@ -0,0 +1,19 @@
+project('n-acd',
+        'c',
+        version: '1',
+        license: 'Apache',
+        default_options: [
+                'buildtype=release',
+                'c_std=c11',
+        ])
+
+add_project_arguments('-D_GNU_SOURCE', language: 'c')
+mod_pkgconfig = import('pkgconfig')
+
+sub_clist = subproject('c-list')
+sub_csiphash = subproject('c-siphash')
+
+dep_clist = sub_clist.get_variable('libclist_dep')
+dep_csiphash = sub_csiphash.get_variable('libcsiphash_dep')
+
+subdir('src')
diff --git a/shared/n-acd/src/libnacd.sym b/shared/n-acd/src/libnacd.sym
new file mode 100644
index 0000000000..c9bd487533
--- /dev/null
+++ b/shared/n-acd/src/libnacd.sym
@@ -0,0 +1,13 @@
+LIBNACD_1 {
+global:
+        n_acd_new;
+        n_acd_free;
+        n_acd_get_fd;
+        n_acd_dispatch;
+        n_acd_pop_event;
+        n_acd_start;
+        n_acd_stop;
+        n_acd_announce;
+local:
+       *;
+};
diff --git a/shared/n-acd/src/meson.build b/shared/n-acd/src/meson.build
new file mode 100644
index 0000000000..ba09d1323b
--- /dev/null
+++ b/shared/n-acd/src/meson.build
@@ -0,0 +1,76 @@
+#
+# target: libnacd.so
+# We build both, a static and a shared library. We want our tests to get access
+# to internals, so we link them statically.
+#
+
+libnacd_private = static_library('nacd-private',
+                                 ['n-acd.c'],
+                                 c_args: [
+                                        '-fvisibility=hidden',
+                                        '-fno-common'
+                                 ],
+                                 dependencies: [
+                                        dep_clist,
+                                        dep_csiphash,
+                                 ],
+                                 pic: true)
+install_headers('n-acd.h')
+libnacd_symfile = join_paths(meson.current_source_dir(), 'libnacd.sym')
+libnacd_shared = shared_library('nacd',
+                                dependencies: dep_csiphash,
+                                objects: libnacd_private.extract_all_objects(),
+                                install: true,
+                                soversion: 0,
+                                link_depends: libnacd_symfile,
+                                link_args: [
+                                        '-Wl,--no-undefined',
+                                        '-Wl,--version-script=@0@'.format(libnacd_symfile)
+                                ])
+mod_pkgconfig.generate(libraries: libnacd_shared,
+                       version: meson.project_version(),
+                       name: 'libnacd',
+                       filebase: 'libnacd',
+                       description: 'IPv4 Address Conflict Detection')
+
+#
+# target: test-api
+# The test-api program explicitly links against the shared library, since it
+# tests for symbol visibility.
+#
+
+test_api = executable('test-api',
+                      ['test-api.c'],
+                      link_with: libnacd_shared)
+test('API Symbol Visibility', test_api)
+
+#
+# target: test-*
+# All other tests are listed here. They link against the static library, so
+# they can access internals for verification.
+#
+
+test_basic = executable('test-basic',
+                        ['test-basic.c'],
+                        link_with: libnacd_private)
+test('Basic API Behavior', test_basic)
+
+test_loopback = executable('test-loopback',
+                           ['test-loopback.c'],
+                           link_with: libnacd_private)
+test('Echo Suppression via Loopback', test_loopback)
+
+test_twice = executable('test-twice',
+                        ['test-twice.c'],
+                        link_with: libnacd_private)
+test('Two ACD in Parallel', test_twice)
+
+test_unplug = executable('test-unplug',
+                         ['test-unplug.c'],
+                         link_with: libnacd_private)
+test('Async Interface Hotplug', test_unplug)
+
+test_unused = executable('test-unsed',
+                         ['test-unused.c'],
+                         link_with: libnacd_private)
+test('Unconflicted ACD', test_unused)
diff --git a/shared/n-acd/src/n-acd.c b/shared/n-acd/src/n-acd.c
new file mode 100644
index 0000000000..492bfde4ff
--- /dev/null
+++ b/shared/n-acd/src/n-acd.c
@@ -0,0 +1,1247 @@
+/*
+ * IPv4 Address Conflict Detection
+ *
+ * This implements the main n-acd API. It is built around an epoll-fd to
+ * encapsulate a timerfd+socket. The n-acd context has quite straightforward
+ * lifetime rules. The parameters must be set when the engine is started, and
+ * they can only be changed by stopping and restartding the engine. The engine
+ * is started on demand and stopped when no longer needed.
+ * During the entire lifetime the context can be dispatched. That is, the
+ * dispatcher does not have to be aware of the context state. After each call
+ * to dispatch(), the caller must pop all pending events until -EAGAIN is
+ * returned.
+ *
+ * If a conflict is detected, the ACD engine reports to the caller and stops
+ * the engine. The caller can now modify parameters and restart the engine, if
+ * required.
+ */
+
+#include <assert.h>
+#include <c-list.h>
+#include <c-siphash.h>
+#include <endian.h>
+#include <errno.h>
+#include <limits.h>
+#include <linux/filter.h>
+#include <linux/if_ether.h>
+#include <linux/if_packet.h>
+#include <net/ethernet.h>
+#include <netinet/if_ether.h>
+#include <netinet/in.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/auxv.h>
+#include <sys/epoll.h>
+#include <sys/socket.h>
+#include <sys/timerfd.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include "n-acd.h"
+
+#define _public_ __attribute__((__visibility__("default")))
+
+/*
+ * These parameters and timing intervals specified in RFC-5227. The original
+ * values are:
+ *
+ *     PROBE_NUM                                3
+ *     PROBE_WAIT                               1s
+ *     PROBE_MIN                                1s
+ *     PROBE_MAX                                3s
+ *     ANNOUNCE_NUM                             3
+ *     ANNOUNCE_WAIT                            2s
+ *     ANNOUNCE_INTERVAL                        2s
+ *     MAX_CONFLICTS                            10
+ *     RATE_LIMIT_INTERVAL                      60s
+ *     DEFEND_INTERVAL                          10s
+ *
+ * If we assume a best-case and worst-case scenario for non-conflicted runs, we
+ * end up with a runtime between 4s and 9s to finish the probe. Then it still
+ * takes a fixed 4s to finish the announcements.
+ *
+ * RFC 5227 section 1.1:
+ *     [...] (Note that the values listed here are fixed constants; they are
+ *     not intended to be modifiable by implementers, operators, or end users.
+ *     These constants are given symbolic names here to facilitate the writing
+ *     of future standards that may want to reference this document with
+ *     different values for these named constants; however, at the present time
+ *     no such future standards exist.) [...]
+ *
+ * Unfortunately, no-one ever stepped up to write a "future standard" to revise
+ * the timings. A 9s timeout for successful link setups is not acceptable today.
+ * Hence, we will just go forward and ignore the proposed values. On both
+ * wired and wireless local links round-trip latencies of below 3ms are common,
+ * while latencies above 10ms are rarely seen. We require the caller to set a
+ * timeout multiplier, where 1 corresponds to a total probe time of 0.5 ms and
+ * 1.0 ms. On modern networks a multiplier of about 100 should be a reasonable
+ * default. To comply with the RFC select a multiplier of 9000.
+ */
+#define N_ACD_RFC_PROBE_NUM                     (3)
+#define N_ACD_RFC_PROBE_WAIT_USEC               (UINT64_C(111)) /* 111us */
+#define N_ACD_RFC_PROBE_MIN_USEC                (UINT64_C(111)) /* 111us */
+#define N_ACD_RFC_PROBE_MAX_USEC                (UINT64_C(333)) /* 333us */
+#define N_ACD_RFC_ANNOUNCE_NUM                  (3)
+#define N_ACD_RFC_ANNOUNCE_WAIT_USEC            (UINT64_C(222)) /* 222us */
+#define N_ACD_RFC_ANNOUNCE_INTERVAL_USEC        (UINT64_C(222)) /* 222us */
+#define N_ACD_RFC_MAX_CONFLICTS                 (10)
+#define N_ACD_RFC_RATE_LIMIT_INTERVAL_USEC      (UINT64_C(60000000)) /* 60s */
+#define N_ACD_RFC_DEFEND_INTERVAL_USEC          (UINT64_C(10000000)) /* 10s */
+
+/*
+ * Fake ENETDOWN error-code. We use this as replacement for known EFOOBAR error
+ * codes. It is explicitly chosen to be outside the known error-code range.
+ * Whenever we are deep down in a call-stack and notice a ENETDOWN error, we
+ * return this instead. It is caught by the top-level dispatcher and then
+ * properly handled.
+ * This avoids gracefully handling ENETDOWN in call-stacks, but then continuing
+ * with some work in the callers without noticing the soft failure.
+ */
+#define N_ACD_E_DOWN (INT_MAX)
+
+#define TIME_INFINITY ((uint64_t) -1)
+
+enum {
+        N_ACD_EPOLL_TIMER,
+        N_ACD_EPOLL_SOCKET,
+};
+
+enum {
+        N_ACD_STATE_INIT,
+        N_ACD_STATE_PROBING,
+        N_ACD_STATE_CONFIGURING,
+        N_ACD_STATE_ANNOUNCING,
+};
+
+typedef struct NAcdEventNode {
+        NAcdEvent event;
+        uint8_t sender[ETH_ALEN];
+        CList link;
+} NAcdEventNode;
+
+struct NAcd {
+        /* context */
+        unsigned int seed;
+        int fd_epoll;
+        int fd_timer;
+
+        /* configuration */
+        NAcdConfig config;
+        uint8_t mac[ETH_ALEN];
+        uint64_t timeout_multiplier;
+
+        /* runtime */
+        int fd_socket;
+        unsigned int state;
+        unsigned int n_iteration;
+        unsigned int n_conflicts;
+        unsigned int defend;
+        uint64_t last_defend;
+        uint64_t last_conflict;
+
+        /* pending events */
+        CList events;
+        NAcdEventNode *current;
+};
+
+static int n_acd_errno(void) {
+        /*
+         * Compilers continuously warn about uninitialized variables since they
+         * cannot deduce that `return -errno;` will always be negative. This
+         * small wrapper makes sure compilers figure that out. Use it as
+         * replacement for `errno` read access. Yes, it generates worse code,
+         * but only marginally and only affects slow-paths.
+         */
+        return abs(errno) ? : EIO;
+}
+
+static int n_acd_event_node_new(NAcdEventNode **nodep, unsigned int event) {
+        NAcdEventNode *node;
+
+        node = calloc(1, sizeof(*node));
+        if (!node)
+                return -ENOMEM;
+
+        node->event.event = event;
+        node->link = (CList)C_LIST_INIT(node->link);
+
+        *nodep = node;
+
+        return 0;
+}
+
+static NAcdEventNode *n_acd_event_node_free(NAcdEventNode *node) {
+        if (!node)
+                return NULL;
+
+        c_list_unlink(&node->link);
+        free(node);
+
+        return NULL;
+}
+
+static int n_acd_get_random(unsigned int *random) {
+        uint8_t hash_seed[] = { 0x3a, 0x0c, 0xa6, 0xdd, 0x44, 0xef, 0x5f, 0x7a, 0x5e, 0xd7, 0x25, 0x37, 0xbf, 0x4e, 0x80, 0xa1 };
+        CSipHash hash = C_SIPHASH_NULL;
+        struct timespec ts;
+        const uint8_t *p;
+        int r;
+
+        /*
+         * We need random jitter for all timeouts when handling ARP probes. Use
+         * AT_RANDOM to get a seed for rand_r(3p), if available (should always
+         * be available on linux). See the time-out scheduler for details.
+         * Additionally, we include the current time in the seed. This avoids
+         * using the same jitter in case you run multiple ACD engines in the
+         * same process. Lastly, the seed is hashed with SipHash24 to avoid
+         * exposing the value of AT_RANDOM on the network.
+         */
+        c_siphash_init(&hash, hash_seed);
+
+        p = (const uint8_t *)getauxval(AT_RANDOM);
+        if (p)
+                c_siphash_append(&hash, p, 16);
+
+        r = clock_gettime(CLOCK_BOOTTIME, &ts);
+        if (r < 0)
+                return -n_acd_errno();
+
+        c_siphash_append(&hash, (const uint8_t *)&ts.tv_sec, sizeof(ts.tv_sec));
+        c_siphash_append(&hash, (const uint8_t *)&ts.tv_nsec, sizeof(ts.tv_nsec));
+
+        *random = c_siphash_finalize(&hash);
+        return 0;
+}
+
+static void n_acd_reset(NAcd *acd) {
+        acd->state = N_ACD_STATE_INIT;
+        acd->defend = N_ACD_DEFEND_NEVER;
+        acd->n_iteration = 0;
+        acd->last_defend = 0;
+        timerfd_settime(acd->fd_timer, 0, &(struct itimerspec){}, NULL);
+
+        if (acd->fd_socket >= 0) {
+                assert(acd->fd_epoll >= 0);
+                epoll_ctl(acd->fd_epoll, EPOLL_CTL_DEL, acd->fd_socket, NULL);
+                close(acd->fd_socket);
+                acd->fd_socket = -1;
+        }
+}
+
+/**
+ * n_acd_new() - create a new ACD context
+ * @acdp:       output argument for context
+ *
+ * Create a new ACD context and return it in @acdp.
+ *
+ * Return: 0 on success, or a negative error code on failure.
+ */
+_public_ int n_acd_new(NAcd **acdp) {
+        NAcd *acd;
+        int r;
+
+        acd = calloc(1, sizeof(*acd));
+        if (!acd)
+                return -ENOMEM;
+
+        acd->fd_epoll = -1;
+        acd->fd_timer = -1;
+        acd->fd_socket = -1;
+        acd->state = N_ACD_STATE_INIT;
+        acd->defend = N_ACD_DEFEND_NEVER;
+        acd->events = (CList)C_LIST_INIT(acd->events);
+        acd->last_conflict = TIME_INFINITY;
+
+        r = n_acd_get_random(&acd->seed);
+        if (r < 0)
+                return r;
+
+        acd->fd_epoll = epoll_create1(EPOLL_CLOEXEC);
+        if (acd->fd_epoll < 0) {
+                r = -n_acd_errno();
+                goto error;
+        }
+
+        acd->fd_timer = timerfd_create(CLOCK_BOOTTIME, TFD_CLOEXEC | TFD_NONBLOCK);
+        if (acd->fd_timer < 0 && errno == EINVAL) {
+                /*
+		 * Fall back to CLOCK_MONOTONIC when CLOCK_BOOTTIME is
+		 * not available (kernel < 3.15).
+                 */
+                acd->fd_timer = timerfd_create(CLOCK_MONOTONIC, TFD_CLOEXEC | TFD_NONBLOCK);
+        }
+        if (acd->fd_timer < 0) {
+                r = -n_acd_errno();
+                goto error;
+        }
+
+        r = epoll_ctl(acd->fd_epoll, EPOLL_CTL_ADD, acd->fd_timer,
+                      &(struct epoll_event){
+                              .events = EPOLLIN,
+                              .data.u32 = N_ACD_EPOLL_TIMER,
+                      });
+        if (r < 0) {
+                r = -n_acd_errno();
+                goto error;
+        }
+
+        *acdp = acd;
+        return 0;
+
+error:
+        n_acd_free(acd);
+        return r;
+}
+
+/**
+ * n_acd_free() - free an ACD context
+ *
+ * Frees all resources held by the context. This may be called at any time,
+ * but doing so invalidates all data owned by the context.
+ *
+ * Return: NULL.
+ */
+_public_ NAcd *n_acd_free(NAcd *acd) {
+        NAcdEventNode *node;
+
+        if (!acd)
+                return NULL;
+
+        n_acd_reset(acd);
+
+        acd->current = n_acd_event_node_free(acd->current);
+
+        while ((node = c_list_first_entry(&acd->events, NAcdEventNode, link)))
+                n_acd_event_node_free(node);
+
+        assert(acd->fd_socket < 0);
+
+        if (acd->fd_timer >= 0) {
+                assert(acd->fd_epoll >= 0);
+                epoll_ctl(acd->fd_epoll, EPOLL_CTL_DEL, acd->fd_timer, NULL);
+                close(acd->fd_timer);
+                acd->fd_timer = -1;
+        }
+
+        if (acd->fd_epoll >= 0) {
+                close(acd->fd_epoll);
+                acd->fd_epoll = -1;
+        }
+
+        free(acd);
+
+        return NULL;
+}
+
+/**
+ * n_acd_get_fd() - get pollable file descriptor
+ * @acd:        ACD context
+ * @fdp:        output argument for file descriptor
+ *
+ * Returns a file descriptor in @fdp. This filedescriptor can be polled by
+ * the caller to indicate when the ACD context can be dispatched.
+ */
+_public_ void n_acd_get_fd(NAcd *acd, int *fdp) {
+        *fdp = acd->fd_epoll;
+}
+
+static int n_acd_push_event(NAcd *acd, unsigned int event, uint16_t *operation, uint8_t (*sender)[6], uint8_t (*target)[4]) {
+        NAcdEventNode *node;
+        int r;
+
+        r = n_acd_event_node_new(&node, event);
+        if (r < 0)
+                return r;
+
+        switch (event) {
+        case N_ACD_EVENT_USED:
+                node->event.used.operation = be16toh(*operation);
+                memcpy(node->sender, sender, sizeof(node->sender));
+                node->event.used.sender = node->sender;
+                node->event.used.n_sender = sizeof(node->sender);
+                memcpy(&node->event.used.target, target, sizeof(node->event.used.target));
+                break;
+        case N_ACD_EVENT_CONFLICT:
+                node->event.conflict.operation = be16toh(*operation);
+                memcpy(node->sender, sender, sizeof(node->sender));
+                node->event.used.sender = node->sender;
+                node->event.used.n_sender = sizeof(node->sender);
+                memcpy(&node->event.conflict.target, target, sizeof(node->event.conflict.target));
+                break;
+        case N_ACD_EVENT_DEFENDED:
+                node->event.defended.operation = be16toh(*operation);
+                memcpy(node->sender, sender, sizeof(node->sender));
+                node->event.used.sender = node->sender;
+                node->event.used.n_sender = sizeof(node->sender);
+                memcpy(&node->event.defended.target, target, sizeof(node->event.defended.target));
+                break;
+        case N_ACD_EVENT_READY:
+        case N_ACD_EVENT_DOWN:
+                break;
+        default:
+                assert(0);
+        }
+
+        c_list_link_tail(&acd->events, &node->link);
+
+        return 0;
+}
+
+static int n_acd_now(uint64_t *nowp) {
+        struct timespec ts;
+        int r;
+
+        r = clock_gettime(CLOCK_BOOTTIME, &ts);
+        if (r < 0)
+                return -n_acd_errno();
+
+        *nowp = ts.tv_sec * UINT64_C(1000000) + ts.tv_nsec / UINT64_C(1000);
+        return 0;
+}
+
+static int n_acd_schedule(NAcd *acd, uint64_t u_timeout, unsigned int u_jitter) {
+        uint64_t u_next = u_timeout;
+        int r;
+
+        /*
+         * ACD specifies jitter values to reduce packet storms on the local
+         * link. This call accepts the maximum relative jitter value in
+         * microseconds as @u_jitter. We then use rand_r(3p) to get a
+         * pseudo-random jitter on top of the real timeout given as @u_timeout.
+         * Note that rand_r() is fine for this. Before you try to improve the
+         * RNG, you better spend some time securing ARP.
+         */
+        if (u_jitter)
+                u_next += rand_r(&acd->seed) % u_jitter;
+
+        /*
+         * Setting .it_value to 0 in timerfd_settime() disarms the timer. Avoid
+         * this and always schedule at least 1us. Otherwise, we'd have to
+         * recursively call into the time-out handler, which we really want to
+         * avoid. No reason to optimize performance here.
+         */
+        if (!u_next)
+                u_next = 1;
+
+        r = timerfd_settime(acd->fd_timer, 0,
+                            &(struct itimerspec){ .it_value = {
+                                    .tv_sec = u_next / UINT64_C(1000000),
+                                    .tv_nsec = u_next % UINT64_C(1000000) * UINT64_C(1000),
+                            } }, NULL);
+        if (r < 0)
+                return -n_acd_errno();
+
+        return 0;
+}
+
+static int n_acd_send(NAcd *acd, const struct in_addr *spa) {
+        struct sockaddr_ll address = {
+                .sll_family = AF_PACKET,
+                .sll_protocol = htobe16(ETH_P_ARP),
+                .sll_ifindex = acd->config.ifindex,
+                .sll_halen = ETH_ALEN,
+                .sll_addr = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
+        };
+        struct ether_arp arp = {
+                .ea_hdr.ar_hrd = htobe16(ARPHRD_ETHER),
+                .ea_hdr.ar_pro = htobe16(ETHERTYPE_IP),
+                .ea_hdr.ar_hln = sizeof(acd->mac),
+                .ea_hdr.ar_pln = sizeof(uint32_t),
+                .ea_hdr.ar_op = htobe16(ARPOP_REQUEST),
+        };
+        ssize_t l;
+
+        memcpy(arp.arp_sha, acd->mac, sizeof(acd->mac));
+        memcpy(arp.arp_tpa, &acd->config.ip.s_addr, sizeof(uint32_t));
+
+        if (spa)
+                memcpy(arp.arp_spa, &spa->s_addr, sizeof(spa->s_addr));
+
+        l = sendto(acd->fd_socket, &arp, sizeof(arp), MSG_NOSIGNAL, (struct sockaddr *)&address, sizeof(address));
+        if (l == (ssize_t)sizeof(arp)) {
+                /* Packet was properly sent. */
+                return 0;
+        } else if (l >= 0) {
+                /*
+                 * Ugh. The packet was truncated. This should not happen, but
+                 * lets just pretend the packet was dropped.
+                 */
+                return 0;
+        } else if (errno == EAGAIN || errno == ENOBUFS) {
+                /*
+                 * In case the output buffer is full, the packet is silently
+                 * dropped. This is just as if the physical layer happened to
+                 * drop the packet. We are not on a reliable medium, so no
+                 * reason to pretend we are.
+                 */
+                return 0;
+        } else if (errno == ENETDOWN || errno == ENXIO) {
+                /*
+                 * We get ENETDOWN if the network-device goes down or is
+                 * removed. ENXIO might happen on async send-operations if the
+                 * network-device was unplugged and thus the kernel is no
+                 * longer aware of it.
+                 * In any case, we do not allow proceeding with this socket. We
+                 * stop the engine and notify the user gracefully.
+                 */
+                return -N_ACD_E_DOWN;
+        }
+
+        return -n_acd_errno();
+}
+
+static void n_acd_remember_conflict(NAcd *acd, uint64_t now) {
+        if (++acd->n_conflicts >= N_ACD_RFC_MAX_CONFLICTS) {
+                acd->n_conflicts = N_ACD_RFC_MAX_CONFLICTS;
+                acd->last_conflict = now;
+        }
+}
+
+static int n_acd_handle_timeout(NAcd *acd) {
+        int r;
+
+        switch (acd->state) {
+        case N_ACD_STATE_PROBING:
+                /*
+                 * We are still PROBING. We send 3 probes with a random timeout
+                 * scheduled between each. If, after a fixed timeout, we did
+                 * not receive any conflict we consider the probing successful.
+                 */
+                if (acd->n_iteration >= N_ACD_RFC_PROBE_NUM) {
+                        /*
+                         * All 3 probes succeeded and we waited enough to
+                         * consider this address usable by now. Do not announce
+                         * the address, yet. We must first give the caller a
+                         * chance to configure the address (so they can answer
+                         * ARP requests), before announcing it. But our
+                         * callbacks are not necessarily synchronous (we want
+                         * to allow IPC there), so just notify the caller and
+                         * wait for further instructions, thus effectively
+                         * increasing the probe-wait.
+                         */
+                        r = n_acd_push_event(acd, N_ACD_EVENT_READY, NULL, NULL, NULL);
+                        if (r)
+                                return r;
+
+                        acd->state = N_ACD_STATE_CONFIGURING;
+                } else {
+                        /*
+                         * We have not sent all 3 probes, yet. A timer fired,
+                         * so we are ready to send the next probe. If this is
+                         * the third probe, schedule a timer for ANNOUNCE_WAIT
+                         * to give other peers a chance to answer. If this is
+                         * not the third probe, wait between PROBE_MIN and
+                         * PROBE_MAX for the next probe.
+                         */
+
+                        r = n_acd_send(acd, NULL);
+                        if (r < 0)
+                                return r;
+
+                        if (++acd->n_iteration >= N_ACD_RFC_PROBE_NUM)
+                                r = n_acd_schedule(acd, acd->timeout_multiplier * N_ACD_RFC_ANNOUNCE_WAIT_USEC, 0);
+                        else
+                                r = n_acd_schedule(acd, acd->timeout_multiplier * N_ACD_RFC_PROBE_MIN_USEC,
+                                                   acd->timeout_multiplier * (N_ACD_RFC_PROBE_MAX_USEC - N_ACD_RFC_PROBE_MIN_USEC));
+                        if (r < 0)
+                                return r;
+                }
+
+                break;
+
+        case N_ACD_STATE_ANNOUNCING:
+                /*
+                 * We are ANNOUNCING, meaning the caller configured the address
+                 * on the interface and is actively using it. We send 3
+                 * announcements out, in a short interval, and then just
+                 * perform passive conflict detection.
+                 * Note that once all 3 announcements are sent, we no longer
+                 * schedule a timer, so this part should not trigger, anymore.
+                 */
+
+                r = n_acd_send(acd, &acd->config.ip);
+                if (r < 0)
+                        return r;
+
+                if (++acd->n_iteration < N_ACD_RFC_ANNOUNCE_NUM) {
+                        r = n_acd_schedule(acd, acd->timeout_multiplier * N_ACD_RFC_ANNOUNCE_INTERVAL_USEC, 0);
+                        if (r < 0)
+                                return r;
+                }
+
+                break;
+
+        case N_ACD_STATE_INIT:
+        case N_ACD_STATE_CONFIGURING:
+        default:
+                /*
+                 * There are no timeouts in these states. If we trigger one,
+                 * something is fishy. Let the caller deal with this.
+                 */
+                return -EIO;
+        }
+
+        return 0;
+}
+
+static int n_acd_handle_packet(NAcd *acd, struct ether_arp *packet) {
+        bool hard_conflict;
+        uint64_t now;
+        int r;
+
+        /*
+         * Via BPF we discard any non-conflict packets. There are only 2 types
+         * that can pass: A conflict on the Sender Protocol Address, or a
+         * conflict on the Target Protocol Address.
+         *
+         * The former we call a hard-conflict. It implies that the sender uses
+         * the address already. We must always catch this and in some way react
+         * to it. Any kind, REQUEST or REPLY must be caught (though it is
+         * unlikely that we ever catch REPLIES since they tend to be unicasts).
+         *
+         * However, in case the Target Protocol Address matches, we just know
+         * that somebody is looking for the address. Hence, we must also check
+         * that the packet is an ARP-Probe (Sender Protocol Address is 0). If
+         * it is, it means someone else does ACD on our address. We call this a
+         * soft conflict.
+         */
+        if (!memcmp(packet->arp_spa, (uint8_t[4]){ }, sizeof(packet->arp_spa)) &&
+            !memcmp(packet->arp_tpa, &acd->config.ip.s_addr, sizeof(packet->arp_tpa)) &&
+            packet->ea_hdr.ar_op == htobe16(ARPOP_REQUEST)) {
+                hard_conflict = false;
+        } else if (!memcmp(packet->arp_spa, &acd->config.ip.s_addr, sizeof(packet->arp_spa))) {
+                hard_conflict = true;
+        } else {
+                /*
+                 * Ignore anything that is specific enough to match the BPF
+                 * filter, but is none of the conflicts described above.
+                 */
+                return 0;
+        }
+
+        r = n_acd_now(&now);
+        if (r < 0)
+                return r;
+
+        switch (acd->state) {
+        case N_ACD_STATE_PROBING:
+                /*
+                 * Regardless whether this is a hard or soft conflict, we must
+                 * treat this as a probe failure. That is, notify the caller of
+                 * the conflict and wait for further instructions. We do not
+                 * react to this, until the caller tells us what to do. But we
+                 * immediately stop the engine, since there is no point in
+                 * continuing the probing.
+                 */
+                n_acd_remember_conflict(acd, now);
+                n_acd_reset(acd);
+                r = n_acd_push_event(acd, N_ACD_EVENT_USED, &packet->ea_hdr.ar_op, &packet->arp_sha, &packet->arp_tpa);
+                if (r)
+                        return r;
+
+                break;
+
+        case N_ACD_STATE_CONFIGURING:
+                /*
+                 * We are waiting for the caller to configure the interface and
+                 * start ANNOUNCING. In this state, we cannot defend the address
+                 * as that would indicate that it is ready to be used, and we
+                 * cannot signal CONFLICT or USED as the caller may already have
+                 * started to use the address (and may have configured the engine
+                 * to always defend it, which means they should be able to rely on
+                 * never losing it after READY). Simply drop the event, and rely
+                 * on the anticipated ANNOUNCE to trigger it again.
+                 */
+
+                break;
+
+        case N_ACD_STATE_ANNOUNCING:
+                /*
+                 * We were already instructed to announce the address, which
+                 * means the address is configured and in use. Hence, the
+                 * caller is responsible to serve regular ARP queries. Meaning,
+                 * we can ignore any soft conflicts (other peers doing ACD).
+                 *
+                 * But if we see a hard-conflict, we either defend the address
+                 * according to the caller's instructions, or we report the
+                 * conflict and bail out.
+                 */
+
+                if (!hard_conflict)
+                        break;
+
+                if (acd->defend == N_ACD_DEFEND_NEVER) {
+                        n_acd_remember_conflict(acd, now);
+                        n_acd_reset(acd);
+                        r = n_acd_push_event(acd, N_ACD_EVENT_CONFLICT, &packet->ea_hdr.ar_op, &packet->arp_sha, &packet->arp_tpa);
+                        if (r)
+                                return r;
+                } else {
+                        if (now > acd->last_defend + N_ACD_RFC_DEFEND_INTERVAL_USEC) {
+                                r = n_acd_send(acd, &acd->config.ip);
+                                if (r < 0)
+                                        return r;
+
+                                acd->last_defend = now;
+                                r = n_acd_push_event(acd, N_ACD_EVENT_DEFENDED, &packet->ea_hdr.ar_op, &packet->arp_sha, &packet->arp_tpa);
+                                if (r)
+                                        return r;
+                        } else if (acd->defend == N_ACD_DEFEND_ONCE) {
+                                n_acd_remember_conflict(acd, now);
+                                n_acd_reset(acd);
+                                r = n_acd_push_event(acd, N_ACD_EVENT_CONFLICT, &packet->ea_hdr.ar_op, &packet->arp_sha, &packet->arp_tpa);
+                                if (r)
+                                        return r;
+                        } else {
+                                r = n_acd_push_event(acd, N_ACD_EVENT_DEFENDED, &packet->ea_hdr.ar_op, &packet->arp_sha, &packet->arp_tpa);
+                                if (r)
+                                        return r;
+                        }
+                }
+
+                break;
+
+        case N_ACD_STATE_INIT:
+        default:
+                /*
+                 * The socket should not be dispatched in those states, since
+                 * it is neither allocated nor added to epoll. Fail hard if we
+                 * trigger this somehow.
+                 */
+                return -EIO;
+        }
+
+        return 0;
+}
+
+static int n_acd_dispatch_timer(NAcd *acd, struct epoll_event *event) {
+        uint64_t v;
+        int r;
+
+        if (event->events & (EPOLLHUP | EPOLLERR)) {
+                /*
+                 * There is no way to handle either gracefully. If we ignored
+                 * them, we would busy-loop, so lets rather forward the error
+                 * to the caller.
+                 */
+                return -EIO;
+        }
+
+        if (event->events & EPOLLIN) {
+                for (unsigned int i = 0; i < 128; ++i) {
+                        r = read(acd->fd_timer, &v, sizeof(v));
+                        if (r == sizeof(v)) {
+                                /*
+                                 * We successfully read a timer-value. Handle it and
+                                 * return. We do NOT fall-through to EPOLLHUP handling,
+                                 * as we always must drain buffers first.
+                                 */
+                                return n_acd_handle_timeout(acd);
+                        } else if (r >= 0) {
+                                /*
+                                 * Kernel guarantees 8-byte reads; fail hard if it
+                                 * suddenly starts doing weird shit. No clue what to do
+                                 * with those values, anyway.
+                                 */
+                                return -EIO;
+                        } else if (errno == EAGAIN) {
+                                /*
+                                 * No more pending events.
+                                 */
+                                return 0;
+                        } else {
+                                /*
+                                 * Something failed. We use CLOCK_BOOTTIME, so
+                                 * ECANCELED cannot happen. Hence, there is no error
+                                 * that we could gracefully handle. Fail hard and let
+                                 * the caller deal with it.
+                                 */
+                                return -n_acd_errno();
+                        }
+                }
+
+                return N_ACD_E_PREEMPTED;
+        }
+
+        return 0;
+}
+
+static int n_acd_dispatch_socket(NAcd *acd, struct epoll_event *event) {
+        struct ether_arp packet;
+        ssize_t l;
+
+        for (unsigned int i = 0; i < 128; ++i) {
+                /*
+                 * Regardless whether EPOLLIN is set in @event->events, we always
+                 * invoke recv(2). This is a safety-net for sockets, which always fetch
+                 * queued errors on all syscalls. That means, if anything failed on the
+                 * socket, we will be notified via recv(2). This simplifies the code
+                 * and avoid magic EPOLLIN/ERR/HUP juggling.
+                 *
+                 * Note that we must use recv(2) over read(2), since the latter cannot
+                 * deal with empty packets properly.
+                 *
+                 * We explicitly skip passing MSG_TRUNC here. We *WANT*
+                 * overlong packets to be retrieved and truncated. Ethernet
+                 * frames might not have byte-granular lengths. Real hardware
+                 * does add trailing padding/garbage, so we must discard this
+                 * here.
+                 */
+                l = recv(acd->fd_socket, &packet, sizeof(packet), 0);
+                if (l == (ssize_t)sizeof(packet)) {
+                        /*
+                         * We read a full ARP packet. We never fall-through to EPOLLHUP
+                         * handling, as we always must drain buffers first.
+                         */
+                        return n_acd_handle_packet(acd, &packet);
+                } else if (l >= 0) {
+                        /*
+                         * The BPF filter discards short packets, so error out
+                         * if something slips through for any reason. Don't silently
+                         * ignore it, since we explicitly want to know if something
+                         * went fishy.
+                         */
+                        return -EIO;
+                } else if (errno == ENETDOWN || errno == ENXIO) {
+                        /*
+                         * We get ENETDOWN if the network-device goes down or is
+                         * removed. ENXIO might happen on async send-operations if the
+                         * network-device was unplugged and thus the kernel is no
+                         * longer aware of it.
+                         * In any case, we do not allow proceeding with this socket. We
+                         * stop the engine and notify the user gracefully.
+                         */
+                        return -N_ACD_E_DOWN;
+                } else if (errno == EAGAIN) {
+                        /*
+                         * We cannot read data from the socket (we got EAGAIN). As a safety net
+                         * check for EPOLLHUP/ERR. Those cannot be disabled with epoll, so we
+                         * must make sure to not busy-loop by ignoring them. Note that we know
+                         * recv(2) on sockets to return an error if either of these epoll-flags
+                         * is set. Hence, if we did not handle it above, we have no other way
+                         * but treating those flags as fatal errors and returning them to the
+                         * caller.
+                         */
+                        if (event->events & (EPOLLHUP | EPOLLERR))
+                                return -EIO;
+
+                        return 0;
+                } else {
+                        /*
+                         * Cannot dispatch the packet. This might be due to OOM, HUP,
+                         * or something else. We cannot handle it gracefully so forward
+                         * to the caller.
+                         */
+                        return -n_acd_errno();
+                }
+        }
+
+        return N_ACD_E_PREEMPTED;
+}
+
+/**
+ * n_acd_dispatch() - dispatch ACD context
+ * @acd:        ACD context
+ *
+ * Return: 0 on successful dispatch of all pending events, N_ACD_E_PREEMPT in
+ *         case there are more still more events to be dispatched, or a
+ *         negative error code on failure.
+ */
+_public_ int n_acd_dispatch(NAcd *acd) {
+        struct epoll_event events[2];
+        int n, i, r = 0;
+        bool preempted = false;
+
+        n = epoll_wait(acd->fd_epoll, events, sizeof(events) / sizeof(*events), 0);
+        if (n < 0) {
+                return -n_acd_errno();
+        }
+
+        for (i = 0; i < n; ++i) {
+                switch (events[i].data.u32) {
+                case N_ACD_EPOLL_TIMER:
+                        r = n_acd_dispatch_timer(acd, events + i);
+                        break;
+                case N_ACD_EPOLL_SOCKET:
+                        r = n_acd_dispatch_socket(acd, events + i);
+                        break;
+                default:
+                        r = 0;
+                        break;
+                }
+
+                if (r == N_ACD_E_PREEMPTED)
+                        preempted = true;
+                else if (r != 0)
+                        break;
+        }
+
+        if (r == -N_ACD_E_DOWN) {
+                /*
+                 * N_ACD_E_DOWN is synthesized whenever we notice
+                 * ENETDOWN-related errors on the network interface. This
+                 * allows bailing out of deep call-paths and then handling the
+                 * error gracefully here.
+                 */
+                n_acd_reset(acd);
+                r = n_acd_push_event(acd, N_ACD_EVENT_DOWN, NULL, NULL, NULL);
+                if (r)
+                        return r;
+
+                return 0;
+        }
+
+        if (preempted)
+                return N_ACD_E_PREEMPTED;
+        else
+                return r;
+}
+
+/**
+ * n_acd_pop_event() - get the next pending event
+ * @acd:        ACD context
+ * @eventp:     output argument for the event
+ *
+ * Returns a pointer to the next pending event. The event is still owend by
+ * the context, and is only valid until the next call to n_acd_pop_event()
+ * or until the context is freed.
+ *
+ * The possible events are:
+ *  * N_ACD_EVENT_READY:    The configured IP address was probed successfully
+ *                          and is ready to be used. Once configured on the
+ *                          interface, the caller must call n_acd_announce()
+ *                          to announce and start defending the address.
+ *                          No further events may be received before
+ *                          n_acd_announce() has been called.
+ *  * N_ACD_EVENT_USED:     Someone is already using the IP address being
+ *                          probed. The engine was stopped, and the caller
+ *                          may restart it to try again.
+ *  * N_ACD_EVENT_DEFENDED: A conflict was detected for the announced IP
+ *                          address, and the engine attempted to defend it.
+ *                          This is purely informational, and no action is
+ *                          required by the caller.
+ *  * N_ACD_EVENT_CONFLICT: A conflict was detected for the announced IP
+ *                          address, and the engine was not able to defend
+ *                          it (according to the configured policy). The
+ *                          engine has stoppde, the caller must stop using
+ *                          the address immediately, and may restart the
+ *                          engine to retry.
+ *  * N_ACD_EVENT_DOWN:     A network error was detected. The engine was
+ *                          stopped and it is the responsibility of the
+ *                          caller to restart it once the network may be
+ *                          functional again.
+ *
+ * Returns: 0 on success, N_ACD_E_STOPPED if there are no more events and
+ *          the engine has been stopped, N_ACD_E_DONE if there are no more
+ *          events, but the engine is still running, or a negative error
+ *          code on failure.
+ */
+_public_ int n_acd_pop_event(NAcd *acd, NAcdEvent **eventp) {
+        acd->current = n_acd_event_node_free(acd->current);
+
+        if (c_list_is_empty(&acd->events)) {
+                if (acd->state == N_ACD_STATE_INIT)
+                        return N_ACD_E_STOPPED;
+                else
+                        return N_ACD_E_DONE;
+        }
+
+        acd->current = c_list_first_entry(&acd->events, NAcdEventNode, link);
+        c_list_unlink(&acd->current->link);
+
+        if (eventp)
+                *eventp = &acd->current->event;
+
+        return 0;
+}
+
+static int n_acd_bind_socket(NAcd *acd, int s) {
+        /*
+         * Due to strict aliasing, we cannot get uint32_t/uint16_t pointers to
+         * acd->config.mac, so provide a union accessor.
+         */
+        const union {
+                uint8_t u8[6];
+                uint16_t u16[3];
+                uint32_t u32[1];
+        } mac = {
+                .u8 = {
+                        acd->mac[0],
+                        acd->mac[1],
+                        acd->mac[2],
+                        acd->mac[3],
+                        acd->mac[4],
+                        acd->mac[5],
+                },
+        };
+        struct sock_filter filter[] = {
+                /*
+                 * Basic ARP header validation. Make sure the packet-length,
+                 * wire type, protocol type, and address lengths are correct.
+                 */
+                BPF_STMT(BPF_LD + BPF_W + BPF_LEN, 0),                                                          /* A <- packet length */
+                BPF_JUMP(BPF_JMP + BPF_JGE + BPF_K, sizeof(struct ether_arp), 1, 0),                            /* #packet >= #arp-packet ? */
+                BPF_STMT(BPF_RET + BPF_K, 0),                                                                   /* ignore */
+                BPF_STMT(BPF_LD + BPF_H + BPF_ABS, offsetof(struct ether_arp, ea_hdr.ar_hrd)),                  /* A <- header */
+                BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ARPHRD_ETHER, 1, 0),                                        /* header == ethernet ? */
+                BPF_STMT(BPF_RET + BPF_K, 0),                                                                   /* ignore */
+                BPF_STMT(BPF_LD + BPF_H + BPF_ABS, offsetof(struct ether_arp, ea_hdr.ar_pro)),                  /* A <- protocol */
+                BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ETHERTYPE_IP, 1, 0),                                        /* protocol == IP ? */
+                BPF_STMT(BPF_RET + BPF_K, 0),                                                                   /* ignore */
+                BPF_STMT(BPF_LD + BPF_B + BPF_ABS, offsetof(struct ether_arp, ea_hdr.ar_hln)),                  /* A <- hardware address length */
+                BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, sizeof(struct ether_addr), 1, 0),                           /* length == sizeof(ether_addr)? */
+                BPF_STMT(BPF_RET + BPF_K, 0),                                                                   /* ignore */
+                BPF_STMT(BPF_LD + BPF_B + BPF_ABS, offsetof(struct ether_arp, ea_hdr.ar_pln)),                  /* A <- protocol address length */
+                BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, sizeof(struct in_addr), 1, 0),                              /* length == sizeof(in_addr) ? */
+                BPF_STMT(BPF_RET + BPF_K, 0),                                                                   /* ignore */
+                BPF_STMT(BPF_LD + BPF_H + BPF_ABS, offsetof(struct ether_arp, ea_hdr.ar_op)),                   /* A <- operation */
+                BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ARPOP_REQUEST, 2, 0),                                       /* protocol == request ? */
+                BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ARPOP_REPLY, 1, 0),                                         /* protocol == reply ? */
+                BPF_STMT(BPF_RET + BPF_K, 0),                                                                   /* ignore */
+
+                /*
+                 * Sender hardware address must be different from ours. Note
+                 * that BPF runs in big-endian mode, but assumes immediates are
+                 * given in native-endian. This might look weird on 6-byte mac
+                 * addresses, but is needed to revert the BPF magic.
+                 */
+                BPF_STMT(BPF_LD + BPF_IMM, be32toh(mac.u32[0])),                                                /* A <- 4 bytes of client's MAC */
+                BPF_STMT(BPF_MISC + BPF_TAX, 0),                                                                /* X <- A */
+                BPF_STMT(BPF_LD + BPF_W + BPF_ABS, offsetof(struct ether_arp, arp_sha)),                        /* A <- 4 bytes of SHA */
+                BPF_STMT(BPF_ALU + BPF_XOR + BPF_X, 0),                                                         /* A xor X */
+                BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 0, 0, 6),                                                   /* A == 0 ? */
+                BPF_STMT(BPF_LD + BPF_IMM, be16toh(mac.u16[2])),                                                /* A <- remainder of client's MAC */
+                BPF_STMT(BPF_MISC + BPF_TAX, 0),                                                                /* X <- A */
+                BPF_STMT(BPF_LD + BPF_H + BPF_ABS, offsetof(struct ether_arp, arp_sha) + 4),                    /* A <- remainder of SHA */
+                BPF_STMT(BPF_ALU + BPF_XOR + BPF_X, 0),                                                         /* A xor X */
+                BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 0, 0, 1),                                                   /* A == 0 ? */
+                BPF_STMT(BPF_RET + BPF_K, 0),                                                                   /* ignore */
+
+                /*
+                 * Sender protocol address or target protocol address must be
+                 * equal to the one we care about. Again, immediates must be
+                 * given in native-endian.
+                 */
+                BPF_STMT(BPF_LD + BPF_IMM, be32toh(acd->config.ip.s_addr)),                                     /* A <- clients IP */
+                BPF_STMT(BPF_MISC + BPF_TAX, 0),                                                                /* X <- A */
+                BPF_STMT(BPF_LD + BPF_W + BPF_ABS, offsetof(struct ether_arp, arp_spa)),                        /* A <- SPA */
+                BPF_STMT(BPF_ALU + BPF_XOR + BPF_X, 0),                                                         /* X xor A */
+                BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 0, 0, 1),                                                   /* A == 0 ? */
+                BPF_STMT(BPF_RET + BPF_K, 65535),                                                               /* return all */
+                BPF_STMT(BPF_LD + BPF_IMM, be32toh(acd->config.ip.s_addr)),                                     /* A <- clients IP */
+                BPF_STMT(BPF_MISC + BPF_TAX, 0),                                                                /* X <- A */
+                BPF_STMT(BPF_LD + BPF_W + BPF_ABS, offsetof(struct ether_arp, arp_tpa)),                        /* A <- TPA */
+                BPF_STMT(BPF_ALU + BPF_XOR + BPF_X, 0),                                                         /* X xor A */
+                BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 0, 0, 1),                                                   /* A == 0 ? */
+                BPF_STMT(BPF_RET + BPF_K, 65535),                                                               /* return all */
+                BPF_STMT(BPF_RET + BPF_K, 0),                                                                   /* ignore */
+        };
+        const struct sock_fprog fprog = {
+                .len = sizeof(filter) / sizeof(*filter),
+                .filter = filter,
+        };
+        const struct sockaddr_ll address = {
+                .sll_family = AF_PACKET,
+                .sll_protocol = htobe16(ETH_P_ARP),
+                .sll_ifindex = acd->config.ifindex,
+                .sll_halen = ETH_ALEN,
+                .sll_addr = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
+        };
+        int r;
+
+        /*
+         * Install a packet filter that matches on the ARP header and
+         * addresses, to reduce the number of wake-ups to a minimum.
+         */
+        r = setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER, &fprog, sizeof(fprog));
+        if (r < 0)
+                return -n_acd_errno();
+
+        /*
+         * Bind the packet-socket to ETH_P_ARP and the specified network
+         * interface.
+         */
+        r = bind(s, (struct sockaddr *)&address, sizeof(address));
+        if (r < 0)
+                return -n_acd_errno();
+
+        return 0;
+}
+
+static int n_acd_setup_socket(NAcd *acd) {
+        int r, s;
+
+        s = socket(PF_PACKET, SOCK_DGRAM | SOCK_CLOEXEC | SOCK_NONBLOCK, 0);
+        if (s < 0)
+                return -n_acd_errno();
+
+        r = n_acd_bind_socket(acd, s);
+        if (r < 0)
+                goto error;
+
+        r = epoll_ctl(acd->fd_epoll, EPOLL_CTL_ADD, s,
+                      &(struct epoll_event){
+                              .events = EPOLLIN,
+                              .data.u32 = N_ACD_EPOLL_SOCKET,
+                      });
+        if (r < 0) {
+                r = -n_acd_errno();
+                goto error;
+        }
+
+        acd->fd_socket = s;
+        return 0;
+
+error:
+        close(s);
+        return r;
+}
+
+/**
+ * n_acd_start() - start the ACD engine
+ * @acd:        ACD context
+ * @config:     description of interface and desired IP address
+ *
+ * Start probing the given address on the given interface.
+ *
+ * The engine must not already be running, and there must not be
+ * any pending events.
+ *
+ * Returns: 0 on success, N_ACD_E_INVALID_ARGUMENT in case the configuration
+ *          was invalid, N_ACD_E_BUSY if the engine is running or there are
+ *          pending events, or a negative error code on failure.
+ */
+_public_ int n_acd_start(NAcd *acd, NAcdConfig *config) {
+        uint64_t now, delay;
+        int r;
+
+        if (config->ifindex <= 0 ||
+            config->transport != N_ACD_TRANSPORT_ETHERNET ||
+            config->n_mac != ETH_ALEN ||
+            !memcmp(config->mac, (uint8_t[ETH_ALEN]){ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, ETH_ALEN) ||
+            !config->ip.s_addr)
+                return N_ACD_E_INVALID_ARGUMENT;
+
+        if (acd->state != N_ACD_STATE_INIT || !c_list_is_empty(&acd->events))
+                return N_ACD_E_BUSY;
+
+        acd->config = *config;
+        memcpy(acd->mac, config->mac, config->n_mac);
+        acd->config.mac = acd->mac;
+        acd->timeout_multiplier = config->timeout_msec;
+
+        r = n_acd_setup_socket(acd);
+        if (r < 0)
+                goto error;
+
+        if (acd->timeout_multiplier) {
+                delay = 0;
+                acd->n_iteration = 0;
+
+                if (acd->last_conflict != TIME_INFINITY) {
+                        r = n_acd_now(&now);
+                        if (r < 0)
+                                goto error;
+
+                        if (now < acd->last_conflict + N_ACD_RFC_RATE_LIMIT_INTERVAL_USEC)
+                                delay = acd->last_conflict + N_ACD_RFC_RATE_LIMIT_INTERVAL_USEC - now;
+                }
+
+                r = n_acd_schedule(acd, delay, acd->timeout_multiplier * N_ACD_RFC_PROBE_WAIT_USEC);
+                if (r < 0)
+                        goto error;
+        } else {
+                /*
+                 * A zero timeout means we drop the probing alltogether, and behave as if
+                 * the last probe succeeded immediately.
+                 */
+                acd->n_iteration = N_ACD_RFC_PROBE_NUM;
+
+                r = n_acd_schedule(acd, 0, 0);
+                if (r < 0)
+                        goto error;
+        }
+
+        acd->state = N_ACD_STATE_PROBING;
+        acd->defend = N_ACD_DEFEND_NEVER;
+        acd->last_defend = 0;
+        return 0;
+
+error:
+        n_acd_reset(acd);
+        return r;
+}
+
+/**
+ * n_acd_stop() - stop the ACD engine
+ * @acd:        ACD context
+ *
+ * Stop the engine. No new events may be triggered, but pending events are not
+ * flushed. Before calling n_acd_start() again all pending events must be popped.
+ *
+ * Return: 0 on success, negative error code on failure.
+ */
+_public_ int n_acd_stop(NAcd *acd) {
+        n_acd_reset(acd);
+        return 0;
+}
+
+/**
+ * n_acd_announce() - announce the configured IP address
+ * @acd:        ACD context
+ * @defend:     defence policy
+ *
+ * Announce the IP address on the local link, and start defending it according
+ * to the given policy, which mut be one of N_ACD_DEFEND_ONCE,
+ * N_ACD_DEFEND_NEVER, or N_ACD_DEFEND_ALWAYS.
+ *
+ * This must be called after the engine in response to an N_ACD_EVENT_READY
+ * event, and only after the given address has been configured on the given
+ * interface.
+ *
+ * Return: 0 on success, N_ACD_E_INVALID_ARGUMENT in case the defence policy
+ *         is invalid, N_ACD_E_BUSY if this is not in response to a
+ *         N_ACD_EVENT_READY event, or a negative error code on failure.
+ */
+_public_ int n_acd_announce(NAcd *acd, unsigned int defend) {
+        uint64_t now;
+        int r;
+
+        if (defend >= _N_ACD_DEFEND_N)
+                return N_ACD_E_INVALID_ARGUMENT;
+        if (acd->state != N_ACD_STATE_CONFIGURING)
+                return N_ACD_E_BUSY;
+
+        /*
+         * Sending announcements means we finished probing and use the address
+         * now. We therefore reset the conflict counter in case we adhered to
+         * the rate-limit. Since probing is properly delayed, a well-behaving
+         * client will always reset the conflict counter here. However, if you
+         * force-use an address regardless of conflicts, then this will not
+         * trigger and the conflict counter stays untouched.
+         */
+        if (acd->last_conflict != TIME_INFINITY) {
+                r = n_acd_now(&now);
+                if (r < 0)
+                        return r;
+
+                if (now >= acd->last_conflict + N_ACD_RFC_RATE_LIMIT_INTERVAL_USEC)
+                        acd->n_conflicts = 0;
+        }
+
+        /*
+         * Instead of sending the first announcement here, we schedule an idle
+         * timer. This avoids possibly recursing into the user callback. We
+         * should never trigger callbacks from arbitrary stacks, but always
+         * restrict them to the dispatcher.
+         */
+        r = n_acd_schedule(acd, 0, 0);
+        if (r < 0)
+                return r;
+
+        acd->state = N_ACD_STATE_ANNOUNCING;
+        acd->defend = defend;
+        acd->n_iteration = 0;
+        return 0;
+}
diff --git a/shared/n-acd/src/n-acd.h b/shared/n-acd/src/n-acd.h
new file mode 100644
index 0000000000..eb12a53eec
--- /dev/null
+++ b/shared/n-acd/src/n-acd.h
@@ -0,0 +1,94 @@
+#pragma once
+
+/*
+ * IPv4 Address Conflict Detection
+ *
+ * This is the public header of the n-acd library, implementing IPv4 Address
+ * Conflict Detection as described in RFC-5227. This header defines the public
+ * API and all entry points of n-acd.
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <netinet/in.h>
+#include <stdbool.h>
+
+enum {
+        _N_ACD_E_SUCCESS,
+
+        N_ACD_E_DONE,
+        N_ACD_E_STOPPED,
+        N_ACD_E_PREEMPTED,
+
+        N_ACD_E_INVALID_ARGUMENT,
+        N_ACD_E_BUSY,
+};
+
+typedef struct NAcd NAcd;
+
+typedef struct NAcdConfig {
+        int ifindex;
+        unsigned int transport;
+        const uint8_t *mac;
+        size_t n_mac;
+        struct in_addr ip;
+        uint64_t timeout_msec;
+} NAcdConfig;
+
+typedef struct NAcdEvent {
+        unsigned int event;
+        union {
+                struct {
+                } ready, down;
+                struct {
+                        uint16_t operation;
+                        uint8_t *sender;
+                        size_t n_sender;
+                        struct in_addr target;
+                } used, defended, conflict;
+        };
+} NAcdEvent;
+
+enum {
+        N_ACD_TRANSPORT_ETHERNET,
+        _N_ACD_TRANSPORT_N,
+};
+
+enum {
+        N_ACD_EVENT_READY,
+        N_ACD_EVENT_USED,
+        N_ACD_EVENT_DEFENDED,
+        N_ACD_EVENT_CONFLICT,
+        N_ACD_EVENT_DOWN,
+        _N_ACD_EVENT_N,
+};
+
+enum {
+        N_ACD_DEFEND_NEVER,
+        N_ACD_DEFEND_ONCE,
+        N_ACD_DEFEND_ALWAYS,
+        _N_ACD_DEFEND_N,
+};
+
+int n_acd_new(NAcd **acdp);
+NAcd *n_acd_free(NAcd *acd);
+
+void n_acd_get_fd(NAcd *acd, int *fdp);
+
+int n_acd_dispatch(NAcd *acd);
+int n_acd_pop_event(NAcd *acd, NAcdEvent **eventp);
+int n_acd_announce(NAcd *acd, unsigned int defend);
+
+int n_acd_start(NAcd *acd, NAcdConfig *config);
+int n_acd_stop(NAcd *acd);
+
+static inline void n_acd_freep(NAcd **acd) {
+        if (*acd)
+                n_acd_free(*acd);
+}
+
+#ifdef __cplusplus
+}
+#endif
diff --git a/shared/n-acd/src/test-api.c b/shared/n-acd/src/test-api.c
new file mode 100644
index 0000000000..697181abaa
--- /dev/null
+++ b/shared/n-acd/src/test-api.c
@@ -0,0 +1,84 @@
+/*
+ * Tests for n-acd API
+ * This verifies the visibility and availability of the public API of the
+ * n-acd library.
+ */
+
+#include <stdlib.h>
+#include "test.h"
+
+static void test_api_constants(void) {
+        assert(N_ACD_DEFEND_NEVER != _N_ACD_DEFEND_N);
+        assert(N_ACD_DEFEND_ONCE != _N_ACD_DEFEND_N);
+        assert(N_ACD_DEFEND_ALWAYS != _N_ACD_DEFEND_N);
+
+        assert(N_ACD_EVENT_READY != _N_ACD_EVENT_N);
+        assert(N_ACD_EVENT_USED != _N_ACD_EVENT_N);
+        assert(N_ACD_EVENT_DEFENDED != _N_ACD_EVENT_N);
+        assert(N_ACD_EVENT_CONFLICT != _N_ACD_EVENT_N);
+        assert(N_ACD_EVENT_DOWN != _N_ACD_EVENT_N);
+}
+
+static void test_api_management(void) {
+        NAcd *acd = NULL;
+        int r;
+
+        /* new/free/freep */
+
+        n_acd_freep(&acd);
+
+        r = n_acd_new(&acd);
+        assert(!r);
+
+        n_acd_free(acd);
+}
+
+static void test_api_runtime(void) {
+        NAcdConfig config = {
+                .ifindex = 1,
+                .transport = N_ACD_TRANSPORT_ETHERNET,
+                .mac = (uint8_t[]){ 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54 },
+                .n_mac = ETH_ALEN,
+                .ip = { htobe32((127 << 24) | (1 << 0)) },
+                .timeout_msec = 100,
+        };
+        NAcd *acd;
+        int r;
+
+        /* get_fd/dispatch/pop_event/start/stop/announce */
+
+        r = n_acd_new(&acd);
+        assert(!r);
+
+        n_acd_get_fd(acd, &r);
+        assert(r >= 0);
+        r = n_acd_dispatch(acd);
+        assert(!r);
+        r = n_acd_pop_event(acd, NULL);
+        assert(r == N_ACD_E_STOPPED);
+        r = n_acd_start(acd, &config);
+        assert(!r);
+        r = n_acd_start(acd, &config);
+        assert(r == N_ACD_E_BUSY);
+        r = n_acd_pop_event(acd, NULL);
+        assert(r == N_ACD_E_DONE);
+        r = n_acd_stop(acd);
+        assert(!r);
+        r = n_acd_announce(acd, N_ACD_DEFEND_NEVER);
+        assert(r == N_ACD_E_BUSY);
+
+        n_acd_free(acd);
+}
+
+int main(int argc, char **argv) {
+        int r;
+
+        r = test_setup();
+        if (r)
+                return r;
+
+        test_api_constants();
+        test_api_management();
+        test_api_runtime();
+        return 0;
+}
diff --git a/shared/n-acd/src/test-basic.c b/shared/n-acd/src/test-basic.c
new file mode 100644
index 0000000000..fa85cb0549
--- /dev/null
+++ b/shared/n-acd/src/test-basic.c
@@ -0,0 +1,13 @@
+/*
+ * Basic Tests
+ */
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "n-acd.h"
+
+int main(int argc, char **argv) {
+        return 0;
+}
diff --git a/shared/n-acd/src/test-loopback.c b/shared/n-acd/src/test-loopback.c
new file mode 100644
index 0000000000..98195c93a5
--- /dev/null
+++ b/shared/n-acd/src/test-loopback.c
@@ -0,0 +1,66 @@
+/*
+ * Test on loopback device
+ * This runs the ACD engine on the loopback device, effectively testing the BPF
+ * filter of ACD to discard its own packets. This might happen on
+ * non-spanning-tree networks, or on networks that echo packets.
+ */
+
+#include <stdlib.h>
+#include "test.h"
+
+static void test_loopback(int ifindex, uint8_t *mac, size_t n_mac) {
+        NAcdConfig config = {
+                .ifindex = ifindex,
+                .transport = N_ACD_TRANSPORT_ETHERNET,
+                .mac = mac,
+                .n_mac = n_mac,
+                .ip = { htobe32((192 << 24) | (168 << 16) | (1 << 0)) },
+                .timeout_msec = 100,
+        };
+        struct pollfd pfds;
+        NAcd *acd;
+        int r, fd;
+
+        r = n_acd_new(&acd);
+        assert(!r);
+
+        n_acd_get_fd(acd, &fd);
+        r = n_acd_start(acd, &config);
+        assert(!r);
+
+        for (;;) {
+                NAcdEvent *event;
+                pfds = (struct pollfd){ .fd = fd, .events = POLLIN };
+                r = poll(&pfds, 1, -1);
+                assert(r >= 0);
+
+                r = n_acd_dispatch(acd);
+                assert(!r);
+
+                r = n_acd_pop_event(acd, &event);
+                if (!r) {
+                        assert(event->event == N_ACD_EVENT_READY);
+                        break;
+                } else {
+                        assert(r == N_ACD_E_DONE);
+                }
+        }
+
+        n_acd_free(acd);
+}
+
+int main(int argc, char **argv) {
+        struct ether_addr mac;
+        int r, ifindex;
+
+        r = test_setup();
+        if (r)
+                return r;
+
+        r = system("ip link set lo up");
+        assert(r == 0);
+        test_if_query("lo", &ifindex, &mac);
+        test_loopback(ifindex, mac.ether_addr_octet, sizeof(mac.ether_addr_octet));
+
+        return 0;
+}
diff --git a/shared/n-acd/src/test-twice.c b/shared/n-acd/src/test-twice.c
new file mode 100644
index 0000000000..157e8a2b96
--- /dev/null
+++ b/shared/n-acd/src/test-twice.c
@@ -0,0 +1,97 @@
+/*
+ * Test with unused address twice in parallel
+ * This runs the ACD engine with an unused address on a veth pair, but it runs
+ * it on both ends. We expect the PROBE to fail on at least one of the devices.
+ */
+
+#include <stdlib.h>
+#include "test.h"
+
+static void test_unused(int ifindex1, uint8_t *mac1, size_t n_mac1, int ifindex2, uint8_t *mac2, size_t n_mac2) {
+        NAcdConfig config1 = {
+                .ifindex = ifindex1,
+                .transport = N_ACD_TRANSPORT_ETHERNET,
+                .mac = mac1,
+                .n_mac = n_mac1,
+                .ip = { htobe32((192 << 24) | (168 << 16) | (1 << 0)) },
+                .timeout_msec = 100,
+        };
+        NAcdConfig config2 = {
+                .ifindex = ifindex2,
+                .transport = N_ACD_TRANSPORT_ETHERNET,
+                .mac = mac2,
+                .n_mac = n_mac2,
+                .ip = { htobe32((192 << 24) | (168 << 16) | (1 << 0)) },
+                .timeout_msec = 100,
+        };
+        struct pollfd pfds[2];
+        NAcd *acd1, *acd2;
+        int r, fd1, fd2, state1, state2;
+
+        r = n_acd_new(&acd1);
+        assert(!r);
+        r = n_acd_new(&acd2);
+        assert(!r);
+
+        n_acd_get_fd(acd1, &fd1);
+        n_acd_get_fd(acd2, &fd2);
+
+        r = n_acd_start(acd1, &config1);
+        assert(!r);
+        r = n_acd_start(acd2, &config2);
+        assert(!r);
+
+        for (state1 = state2 = -1; state1 == -1 || state2 == -1; ) {
+                NAcdEvent *event;
+                pfds[0] = (struct pollfd){ .fd = fd1, .events = (state1 == -1) ? POLLIN : 0 };
+                pfds[1] = (struct pollfd){ .fd = fd2, .events = (state2 == -1) ? POLLIN : 0 };
+
+                r = poll(pfds, sizeof(pfds) / sizeof(*pfds), -1);
+                assert(r >= 0);
+
+                if (state1 == -1) {
+                        r = n_acd_dispatch(acd1);
+                        assert(!r);
+
+                        r = n_acd_pop_event(acd1, &event);
+                        if (!r) {
+                                assert(event->event == N_ACD_EVENT_READY || event->event == N_ACD_EVENT_USED);
+                                state1 = !!(event->event == N_ACD_EVENT_READY);
+                        } else {
+                                assert(r == N_ACD_E_DONE);
+                        }
+                }
+
+                if (state2 == -1) {
+                        r = n_acd_dispatch(acd2);
+                        assert(!r);
+
+                        r = n_acd_pop_event(acd2, &event);
+                        if (!r) {
+                                assert(event->event == N_ACD_EVENT_READY || event->event == N_ACD_EVENT_USED);
+                                state2 = !!(event->event == N_ACD_EVENT_READY);
+                        } else {
+                                assert(r == N_ACD_E_DONE);
+                        }
+                }
+        }
+
+        n_acd_free(acd1);
+        n_acd_free(acd2);
+
+        assert(!state1 || !state2);
+}
+
+int main(int argc, char **argv) {
+        struct ether_addr mac1, mac2;
+        int r, ifindex1, ifindex2;
+
+        r = test_setup();
+        if (r)
+                return r;
+
+        test_veth_new(&ifindex1, &mac1, &ifindex2, &mac2);
+        test_unused(ifindex1, mac1.ether_addr_octet, sizeof(mac2.ether_addr_octet), ifindex2, mac2.ether_addr_octet, sizeof(mac2.ether_addr_octet));
+
+        return 0;
+}
diff --git a/shared/n-acd/src/test-unplug.c b/shared/n-acd/src/test-unplug.c
new file mode 100644
index 0000000000..dd457417ab
--- /dev/null
+++ b/shared/n-acd/src/test-unplug.c
@@ -0,0 +1,84 @@
+/*
+ * Unplug device during test run
+ * Run the ACD engine with an address that is not used by anyone else on the
+ * link, but DOWN or UNPLUG the device while running.
+ */
+
+#include <stdlib.h>
+#include "test.h"
+
+static void test_unplug_down(int ifindex, uint8_t *mac, size_t n_mac, unsigned int run) {
+        NAcdConfig config = {
+                .ifindex = ifindex,
+                .transport = N_ACD_TRANSPORT_ETHERNET,
+                .mac = mac,
+                .n_mac = n_mac,
+                .ip = { htobe32((192 << 24) | (168 << 16) | (1 << 0)) },
+                .timeout_msec = 100,
+        };
+        struct pollfd pfds;
+        NAcd *acd;
+        int r, fd;
+
+        if (!run--)
+                test_veth_cmd(ifindex, "down");
+
+        r = n_acd_new(&acd);
+        assert(!r);
+
+        if (!run--)
+                test_veth_cmd(ifindex, "down");
+
+        n_acd_get_fd(acd, &fd);
+        r = n_acd_start(acd, &config);
+        assert(!r);
+
+        if (!run--)
+                test_veth_cmd(ifindex, "down");
+
+        for (;;) {
+                NAcdEvent *event;
+                pfds = (struct pollfd){ .fd = fd, .events = POLLIN };
+                r = poll(&pfds, 1, -1);
+                assert(r >= 0);
+
+                if (!run--)
+                        test_veth_cmd(ifindex, "down");
+
+                r = n_acd_dispatch(acd);
+                assert(!r);
+
+                r = n_acd_pop_event(acd, &event);
+                if (!r) {
+                        if (event->event == N_ACD_EVENT_DOWN) {
+                                break;
+                        } else {
+                                assert(event->event == N_ACD_EVENT_READY);
+                                test_veth_cmd(ifindex, "down");
+                        }
+                } else {
+                        assert(r == N_ACD_E_DONE);
+                }
+        }
+
+        n_acd_free(acd);
+}
+
+int main(int argc, char **argv) {
+        struct ether_addr mac;
+        unsigned int i;
+        int r, ifindex;
+
+        r = test_setup();
+        if (r)
+                return r;
+
+        test_veth_new(&ifindex, &mac, NULL, NULL);
+
+        for (i = 0; i < 5; ++i) {
+                test_unplug_down(ifindex, mac.ether_addr_octet, sizeof(mac.ether_addr_octet), i);
+                test_veth_cmd(ifindex, "up");
+        }
+
+        return 0;
+}
diff --git a/shared/n-acd/src/test-unused.c b/shared/n-acd/src/test-unused.c
new file mode 100644
index 0000000000..af1da59c63
--- /dev/null
+++ b/shared/n-acd/src/test-unused.c
@@ -0,0 +1,63 @@
+/*
+ * Test with unused address
+ * Run the ACD engine with an address that is not used by anyone else on the
+ * link. This should just pass through, with a short, random timeout.
+ */
+
+#include <stdlib.h>
+#include "test.h"
+
+static void test_unused(int ifindex, const uint8_t *mac, size_t n_mac) {
+        NAcdConfig config = {
+                .ifindex = ifindex,
+                .transport = N_ACD_TRANSPORT_ETHERNET,
+                .mac = mac,
+                .n_mac = n_mac,
+                .ip = { htobe32((192 << 24) | (168 << 16) | (1 << 0)) },
+                .timeout_msec = 100,
+        };
+        struct pollfd pfds;
+        NAcd *acd;
+        int r, fd;
+
+        r = n_acd_new(&acd);
+        assert(!r);
+
+        n_acd_get_fd(acd, &fd);
+        r = n_acd_start(acd, &config);
+        assert(!r);
+
+        for (;;) {
+                NAcdEvent *event;
+                pfds = (struct pollfd){ .fd = fd, .events = POLLIN };
+                r = poll(&pfds, 1, -1);
+                assert(r >= 0);
+
+                r = n_acd_dispatch(acd);
+                assert(!r);
+
+                r = n_acd_pop_event(acd, &event);
+                if (!r) {
+                        assert(event->event == N_ACD_EVENT_READY);
+                        break;
+                } else {
+                        assert(r == N_ACD_E_DONE);
+                }
+        }
+
+        n_acd_free(acd);
+}
+
+int main(int argc, char **argv) {
+        struct ether_addr mac;
+        int r, ifindex;
+
+        r = test_setup();
+        if (r)
+                return r;
+
+        test_veth_new(&ifindex, &mac, NULL, NULL);
+        test_unused(ifindex, mac.ether_addr_octet, sizeof(mac.ether_addr_octet));
+
+        return 0;
+}
diff --git a/shared/n-acd/src/test.h b/shared/n-acd/src/test.h
new file mode 100644
index 0000000000..92315858ba
--- /dev/null
+++ b/shared/n-acd/src/test.h
@@ -0,0 +1,97 @@
+#pragma once
+
+/*
+ * Test Helpers
+ * Bunch of helpers to setup the environment for networking tests. This
+ * includes net-namespace setups, veth setups, and more.
+ */
+
+#include <assert.h>
+#include <endian.h>
+#include <errno.h>
+#include <net/ethernet.h>
+#include <net/if.h>
+#include <netinet/in.h>
+#include <poll.h>
+#include <sched.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <unistd.h>
+#include "n-acd.h"
+
+static inline void test_if_query(const char *name, int *indexp, struct ether_addr *macp) {
+        struct ifreq ifr = {};
+        size_t l;
+        int r, s;
+
+        l = strlen(name);
+        assert(l <= IF_NAMESIZE);
+
+        if (indexp) {
+                *indexp = if_nametoindex(name);
+                assert(*indexp > 0);
+        }
+
+        if (macp) {
+                s = socket(AF_INET, SOCK_DGRAM, 0);
+                assert(s >= 0);
+
+                strncpy(ifr.ifr_name, name, l);
+                r = ioctl(s, SIOCGIFHWADDR, &ifr);
+                assert(r >= 0);
+
+                memcpy(macp->ether_addr_octet, ifr.ifr_hwaddr.sa_data, ETH_ALEN);
+
+                close(s);
+        }
+}
+
+static inline void test_veth_cmd(int ifindex, const char *cmd) {
+        char *p, name[IF_NAMESIZE + 1] = {};
+        int r;
+
+        p = if_indextoname(ifindex, name);
+        assert(p);
+
+        r = asprintf(&p, "ip link set %s %s", name, cmd);
+        assert(r >= 0);
+
+        /* Again: Ewwww... */
+        r = system(p);
+        assert(r == 0);
+
+        free(p);
+}
+
+static inline void test_veth_new(int *parent_indexp,
+                                 struct ether_addr *parent_macp,
+                                 int *child_indexp,
+                                 struct ether_addr *child_macp) {
+        int r;
+
+        /* Eww... but it works. */
+        r = system("ip link add type veth");
+        assert(r == 0);
+        r = system("ip link set veth0 up");
+        assert(r == 0);
+        r = system("ip link set veth1 up");
+        assert(r == 0);
+
+        test_if_query("veth0", parent_indexp, parent_macp);
+        test_if_query("veth1", child_indexp, child_macp);
+}
+
+static inline int test_setup(void) {
+        int r;
+
+        r = unshare(CLONE_NEWNET);
+        if (r < 0) {
+                assert(errno == EPERM);
+                return 77;
+        }
+
+        return 0;
+}
diff --git a/shared/n-acd/subprojects/c-list b/shared/n-acd/subprojects/c-list
new file mode 160000
+Subproject 72c59181d677a3f50b201d51f190b1bff02d427
diff --git a/shared/n-acd/subprojects/c-siphash b/shared/n-acd/subprojects/c-siphash
new file mode 160000
+Subproject e01ab640dcf72dfa6928c94a261bf78cd943d9c
diff --git a/shared/nm-utils/c-list-util.h b/shared/nm-utils/c-list-util.h
index 199583cffc..e87f1c1989 100644
--- a/shared/nm-utils/c-list-util.h
+++ b/shared/nm-utils/c-list-util.h
@@ -22,7 +22,7 @@
 #ifndef __C_LIST_UTIL_H__
 #define __C_LIST_UTIL_H__
 
-#include "c-list.h"
+#include "c-list/src/c-list.h"
 
 /*****************************************************************************/
 
diff --git a/shared/nm-utils/nm-c-list.h b/shared/nm-utils/nm-c-list.h
index 5e0bf102cc..b43d144197 100644
--- a/shared/nm-utils/nm-c-list.h
+++ b/shared/nm-utils/nm-c-list.h
@@ -22,7 +22,7 @@
 #ifndef __NM_C_LIST_H__
 #define __NM_C_LIST_H__
 
-#include "c-list.h"
+#include "c-list/src/c-list.h"
 
 /*****************************************************************************/
 
diff --git a/shared/nm-utils/nm-test-utils.h b/shared/nm-utils/nm-test-utils.h
index f44f49d835..cc33a1aef5 100644
--- a/shared/nm-utils/nm-test-utils.h
+++ b/shared/nm-utils/nm-test-utils.h
@@ -933,7 +933,7 @@ _nmtst_main_loop_run_timeout (gpointer user_data)
 }
 
 static inline gboolean
-nmtst_main_loop_run (GMainLoop *loop, int timeout_ms)
+nmtst_main_loop_run (GMainLoop *loop, guint timeout_ms)
 {
 	GSource *source = NULL;
 	guint id = 0;
@@ -949,6 +949,9 @@ nmtst_main_loop_run (GMainLoop *loop, int timeout_ms)
 
 	g_main_loop_run (loop);
 
+	if (source && loopx)
+		g_source_destroy (source);
+
 	/* if the timeout was reached, return FALSE. */
 	return loopx != NULL;
 }
diff --git a/src/devices/bluetooth/nm-bluez5-manager.c b/src/devices/bluetooth/nm-bluez5-manager.c
index de3f407275..5d3bd23a9e 100644
--- a/src/devices/bluetooth/nm-bluez5-manager.c
+++ b/src/devices/bluetooth/nm-bluez5-manager.c
@@ -30,7 +30,7 @@
 
 #include "nm-core-internal.h"
 
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 #include "nm-bluez-device.h"
 #include "nm-bluez-common.h"
 #include "devices/nm-device-bridge.h"
diff --git a/src/devices/nm-acd-manager.c b/src/devices/nm-acd-manager.c
new file mode 100644
index 0000000000..3feb9de7b1
--- /dev/null
+++ b/src/devices/nm-acd-manager.c
@@ -0,0 +1,490 @@
+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
+/* NetworkManager -- Network link manager
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * Copyright (C) 2015-2018 Red Hat, Inc.
+ */
+
+#include "nm-default.h"
+
+#include "nm-acd-manager.h"
+
+#include <netinet/in.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+
+#include "platform/nm-platform.h"
+#include "nm-utils.h"
+#include "NetworkManagerUtils.h"
+#include "n-acd/src/n-acd.h"
+
+/*****************************************************************************/
+
+typedef enum {
+	STATE_INIT,
+	STATE_PROBING,
+	STATE_PROBE_DONE,
+	STATE_ANNOUNCING,
+} State;
+
+typedef struct {
+	in_addr_t address;
+	gboolean duplicate;
+	NMAcdManager *manager;
+	NAcd *acd;
+	GIOChannel *channel;
+	guint event_id;
+} AddressInfo;
+
+enum {
+	PROBE_TERMINATED,
+	LAST_SIGNAL,
+};
+
+static guint signals[LAST_SIGNAL] = { 0 };
+
+typedef struct {
+	int            ifindex;
+	guint8         hwaddr[ETH_ALEN];
+	State          state;
+	GHashTable    *addresses;
+	guint          completed;
+} NMAcdManagerPrivate;
+
+struct _NMAcdManager {
+	GObject parent;
+	NMAcdManagerPrivate _priv;
+};
+
+struct _NMAcdManagerClass {
+	GObjectClass parent;
+};
+
+G_DEFINE_TYPE (NMAcdManager, nm_acd_manager, G_TYPE_OBJECT)
+
+#define NM_ACD_MANAGER_GET_PRIVATE(self) _NM_GET_PRIVATE (self, NMAcdManager, NM_IS_ACD_MANAGER)
+
+/*****************************************************************************/
+
+#define _NMLOG_DOMAIN         LOGD_IP4
+#define _NMLOG_PREFIX_NAME    "acd"
+#define _NMLOG(level, ...) \
+    G_STMT_START { \
+        char _sbuf[64]; \
+        int _ifindex = (self) ? NM_ACD_MANAGER_GET_PRIVATE (self)->ifindex : 0; \
+        \
+        nm_log ((level), _NMLOG_DOMAIN, \
+                nm_platform_link_get_name (NM_PLATFORM_GET, _ifindex), \
+                NULL, \
+                "%s%s: " _NM_UTILS_MACRO_FIRST (__VA_ARGS__), \
+                _NMLOG_PREFIX_NAME, \
+                self ? nm_sprintf_buf (_sbuf, "[%p,%d]", self, _ifindex) : "" \
+                _NM_UTILS_MACRO_REST (__VA_ARGS__)); \
+    } G_STMT_END
+
+/*****************************************************************************/
+
+static const char *
+_acd_event_to_string (unsigned int event)
+{
+	switch (event) {
+	case N_ACD_EVENT_READY:
+		return "ready";
+	case N_ACD_EVENT_USED:
+		return "used";
+	case N_ACD_EVENT_DEFENDED:
+		return "defended";
+	case N_ACD_EVENT_CONFLICT:
+		return "conflict";
+	case N_ACD_EVENT_DOWN:
+		return "down";
+	}
+	return NULL;
+}
+
+#define acd_event_to_string(event) NM_UTILS_LOOKUP_STR (_acd_event_to_string, event)
+
+static const char *
+_acd_error_to_string (int error)
+{
+	if (error < 0)
+		return strerror(-error);
+
+	switch (error) {
+	case _N_ACD_E_SUCCESS:
+		return "success";
+	case N_ACD_E_DONE:
+		return "no more events (engine running)";
+	case N_ACD_E_STOPPED:
+		return "no more events (engine stopped)";
+	case N_ACD_E_PREEMPTED:
+		return "preempted";
+	case N_ACD_E_INVALID_ARGUMENT:
+		return "invalid argument";
+	case N_ACD_E_BUSY:
+		return "busy";
+	}
+	return NULL;
+}
+
+#define acd_error_to_string(error) NM_UTILS_LOOKUP_STR (_acd_error_to_string, error)
+
+/*****************************************************************************/
+
+/**
+ * nm_acd_manager_add_address:
+ * @self: a #NMAcdManager
+ * @address: an IP address
+ *
+ * Add @address to the list of IP addresses to probe.
+
+ * Returns: %TRUE on success, %FALSE if the address was already in the list
+ */
+gboolean
+nm_acd_manager_add_address (NMAcdManager *self, in_addr_t address)
+{
+	NMAcdManagerPrivate *priv;
+	AddressInfo *info;
+
+	g_return_val_if_fail (NM_IS_ACD_MANAGER (self), FALSE);
+	priv = NM_ACD_MANAGER_GET_PRIVATE (self);
+	g_return_val_if_fail (priv->state == STATE_INIT, FALSE);
+
+	if (g_hash_table_lookup (priv->addresses, GUINT_TO_POINTER (address)))
+		return FALSE;
+
+	info = g_slice_new0 (AddressInfo);
+	info->address = address;
+	info->manager = self;
+
+	g_hash_table_insert (priv->addresses, GUINT_TO_POINTER (address), info);
+
+	return TRUE;
+}
+
+static gboolean
+acd_event (GIOChannel *source, GIOCondition condition, gpointer data)
+{
+	AddressInfo *info = data;
+	NMAcdManager *self = info->manager;
+	NMAcdManagerPrivate *priv = NM_ACD_MANAGER_GET_PRIVATE (self);
+	NAcdEvent *event;
+	char address_str[INET_ADDRSTRLEN];
+	gs_free char *hwaddr_str = NULL;
+	int r;
+
+	if (   n_acd_dispatch (info->acd)
+	    || n_acd_pop_event (info->acd, &event))
+		return G_SOURCE_CONTINUE;
+
+	switch (event->event) {
+	case N_ACD_EVENT_READY:
+		info->duplicate = FALSE;
+		if (priv->state == STATE_ANNOUNCING) {
+			r = n_acd_announce (info->acd, N_ACD_DEFEND_ONCE);
+			if (r) {
+				_LOGW ("couldn't announce address %s on interface '%s': %s",
+				       nm_utils_inet4_ntop (info->address, address_str),
+				       nm_platform_link_get_name (NM_PLATFORM_GET, priv->ifindex),
+				       acd_error_to_string (r));
+			} else {
+				_LOGD ("announcing address %s",
+				       nm_utils_inet4_ntop (info->address, address_str));
+			}
+		}
+		break;
+	case N_ACD_EVENT_USED:
+		info->duplicate = TRUE;
+		break;
+	case N_ACD_EVENT_DEFENDED:
+		_LOGD ("defended address %s from host %s",
+		       nm_utils_inet4_ntop (info->address, address_str),
+		       (hwaddr_str = nm_utils_hwaddr_ntoa (event->defended.sender,
+		                                           event->defended.n_sender)));
+		break;
+	case N_ACD_EVENT_CONFLICT:
+		_LOGW ("conflict for address %s detected with host %s on interface '%s'",
+		       nm_utils_inet4_ntop (info->address, address_str),
+		       (hwaddr_str = nm_utils_hwaddr_ntoa (event->defended.sender,
+		                                           event->defended.n_sender)),
+		       nm_platform_link_get_name (NM_PLATFORM_GET, priv->ifindex));
+		break;
+	default:
+		_LOGD ("event '%s' for address %s",
+		       acd_event_to_string (event->event),
+		       nm_utils_inet4_ntop (info->address, address_str));
+		return G_SOURCE_CONTINUE;
+	}
+
+	if (   priv->state == STATE_PROBING
+	    && ++priv->completed == g_hash_table_size (priv->addresses)) {
+		priv->state = STATE_PROBE_DONE;
+		g_signal_emit (self, signals[PROBE_TERMINATED], 0);
+	}
+
+	return G_SOURCE_CONTINUE;
+}
+
+static gboolean
+acd_probe_start (NMAcdManager *self,
+                 AddressInfo *info,
+                 guint64 timeout)
+{
+	NMAcdManagerPrivate *priv = NM_ACD_MANAGER_GET_PRIVATE (self);
+	NAcdConfig *config;
+	int r, fd;
+
+	r = n_acd_new (&info->acd);
+	if (r) {
+		_LOGW ("could not create ACD for %s on interface '%s': %s",
+		       nm_utils_inet4_ntop (info->address, NULL),
+		       nm_platform_link_get_name (NM_PLATFORM_GET, priv->ifindex),
+		       acd_error_to_string (r));
+		return FALSE;
+	}
+
+	n_acd_get_fd (info->acd, &fd);
+	info->channel = g_io_channel_unix_new (fd);
+	info->event_id = g_io_add_watch (info->channel, G_IO_IN, acd_event, info);
+
+	config = &(NAcdConfig) {
+		.ifindex = priv->ifindex,
+		.mac = priv->hwaddr,
+		.n_mac = ETH_ALEN,
+		.ip = info->address,
+		.timeout_msec = timeout,
+		.transport = N_ACD_TRANSPORT_ETHERNET,
+	};
+
+	r = n_acd_start (info->acd, config);
+	if (r) {
+		_LOGW ("could not start probe for %s on interface '%s': %s",
+		       nm_utils_inet4_ntop (info->address, NULL),
+		       nm_platform_link_get_name (NM_PLATFORM_GET, priv->ifindex),
+		       acd_error_to_string (r));
+		return FALSE;
+	}
+
+	_LOGD ("start probe for %s", nm_utils_inet4_ntop (info->address, NULL));
+
+	return TRUE;
+}
+
+/**
+ * nm_acd_manager_start_probe:
+ * @self: a #NMAcdManager
+ * @timeout: maximum probe duration in milliseconds
+ * @error: location to store error, or %NULL
+ *
+ * Start probing IP addresses for duplicates; when the probe terminates a
+ * PROBE_TERMINATED signal is emitted.
+ *
+ * Returns: %TRUE if at least one probe could be started, %FALSE otherwise
+ */
+gboolean
+nm_acd_manager_start_probe (NMAcdManager *self, guint timeout)
+{
+	NMAcdManagerPrivate *priv;
+	GHashTableIter iter;
+	AddressInfo *info;
+	gs_free char *timeout_str = NULL;
+	gboolean success = FALSE;
+
+	g_return_val_if_fail (NM_IS_ACD_MANAGER (self), FALSE);
+	priv = NM_ACD_MANAGER_GET_PRIVATE (self);
+	g_return_val_if_fail (priv->state == STATE_INIT, FALSE);
+
+	priv->completed = 0;
+
+	g_hash_table_iter_init (&iter, priv->addresses);
+	while (g_hash_table_iter_next (&iter, NULL, (gpointer *) &info))
+		success |= acd_probe_start (self, info, timeout);
+
+	if (success)
+		priv->state = STATE_PROBING;
+
+	return success;
+}
+
+/**
+ * nm_acd_manager_reset:
+ * @self: a #NMAcdManager
+ *
+ * Stop any operation in progress and reset @self to the initial state.
+ */
+void
+nm_acd_manager_reset (NMAcdManager *self)
+{
+	NMAcdManagerPrivate *priv;
+
+	g_return_if_fail (NM_IS_ACD_MANAGER (self));
+	priv = NM_ACD_MANAGER_GET_PRIVATE (self);
+
+	g_hash_table_remove_all (priv->addresses);
+
+	priv->state = STATE_INIT;
+}
+
+/**
+ * nm_acd_manager_destroy:
+ * @self: the #NMAcdManager
+ *
+ * Calls nm_acd_manager_reset() and unrefs @self.
+ */
+void
+nm_acd_manager_destroy (NMAcdManager *self)
+{
+	g_return_if_fail (NM_IS_ACD_MANAGER (self));
+
+	nm_acd_manager_reset (self);
+	g_object_unref (self);
+}
+
+/**
+ * nm_acd_manager_check_address:
+ * @self: a #NMAcdManager
+ * @address: an IP address
+ *
+ * Check if an IP address is duplicate. @address must have been added with
+ * nm_acd_manager_add_address().
+ *
+ * Returns: %TRUE if the address is not duplicate, %FALSE otherwise
+ */
+gboolean
+nm_acd_manager_check_address (NMAcdManager *self, in_addr_t address)
+{
+	NMAcdManagerPrivate *priv;
+	AddressInfo *info;
+
+	g_return_val_if_fail (NM_IS_ACD_MANAGER (self), FALSE);
+	priv = NM_ACD_MANAGER_GET_PRIVATE (self);
+	g_return_val_if_fail (   priv->state == STATE_INIT
+	                      || priv->state == STATE_PROBE_DONE, FALSE);
+
+	info = g_hash_table_lookup (priv->addresses, GUINT_TO_POINTER (address));
+	g_return_val_if_fail (info, FALSE);
+
+	return !info->duplicate;
+}
+
+/**
+ * nm_acd_manager_announce_addresses:
+ * @self: a #NMAcdManager
+ *
+ * Start announcing addresses.
+ */
+void
+nm_acd_manager_announce_addresses (NMAcdManager *self)
+{
+	NMAcdManagerPrivate *priv = NM_ACD_MANAGER_GET_PRIVATE (self);
+	GHashTableIter iter;
+	AddressInfo *info;
+	int r;
+
+	if (priv->state == STATE_INIT) {
+		/* n-acd can't announce without probing, therefore let's
+		 * start a fake probe with zero timeout and then perform
+		 * the announce. */
+		priv->state = STATE_ANNOUNCING;
+		g_hash_table_iter_init (&iter, priv->addresses);
+		while (g_hash_table_iter_next (&iter, NULL, (gpointer *) &info)) {
+			if (!acd_probe_start (self, info, 0)) {
+				_LOGW ("couldn't announce address %s on interface '%s'",
+				       nm_utils_inet4_ntop (info->address, NULL),
+				       nm_platform_link_get_name (NM_PLATFORM_GET, priv->ifindex));
+			}
+		}
+	} else if (priv->state == STATE_PROBE_DONE) {
+		priv->state = STATE_ANNOUNCING;
+		g_hash_table_iter_init (&iter, priv->addresses);
+		while (g_hash_table_iter_next (&iter, NULL, (gpointer *) &info)) {
+			if (info->duplicate)
+				continue;
+			r = n_acd_announce (info->acd, N_ACD_DEFEND_ONCE);
+			if (r) {
+				_LOGW ("couldn't announce address %s on interface '%s': %s",
+				       nm_utils_inet4_ntop (info->address, NULL),
+				       nm_platform_link_get_name (NM_PLATFORM_GET, priv->ifindex),
+				       acd_error_to_string (r));
+			} else
+				_LOGD ("announcing address %s", nm_utils_inet4_ntop (info->address, NULL));
+		}
+	} else
+		nm_assert_not_reached ();
+}
+
+static void
+destroy_address_info (gpointer data)
+{
+	AddressInfo *info = (AddressInfo *) data;
+
+	g_clear_pointer (&info->channel, g_io_channel_unref);
+	g_clear_pointer (&info->acd, n_acd_free);
+	nm_clear_g_source (&info->event_id);
+
+	g_slice_free (AddressInfo, info);
+}
+
+/*****************************************************************************/
+
+static void
+nm_acd_manager_init (NMAcdManager *self)
+{
+	NMAcdManagerPrivate *priv = NM_ACD_MANAGER_GET_PRIVATE (self);
+
+	priv->addresses = g_hash_table_new_full (nm_direct_hash, NULL,
+	                                         NULL, destroy_address_info);
+	priv->state = STATE_INIT;
+}
+
+NMAcdManager *
+nm_acd_manager_new (int ifindex, const guint8 *hwaddr, size_t hwaddr_len)
+{
+	NMAcdManager *self;
+	NMAcdManagerPrivate *priv;
+
+	g_return_val_if_fail (hwaddr, NULL);
+	g_return_val_if_fail (hwaddr_len == ETH_ALEN, NULL);
+
+	self = g_object_new (NM_TYPE_ACD_MANAGER, NULL);
+	priv = NM_ACD_MANAGER_GET_PRIVATE (self);
+	priv->ifindex = ifindex;
+	memcpy (priv->hwaddr, hwaddr, ETH_ALEN);
+
+	return self;
+}
+
+static void
+dispose (GObject *object)
+{
+	NMAcdManager *self = NM_ACD_MANAGER (object);
+	NMAcdManagerPrivate *priv = NM_ACD_MANAGER_GET_PRIVATE (self);
+
+	g_clear_pointer (&priv->addresses, g_hash_table_destroy);
+
+	G_OBJECT_CLASS (nm_acd_manager_parent_class)->dispose (object);
+}
+
+static void
+nm_acd_manager_class_init (NMAcdManagerClass *klass)
+{
+	GObjectClass *object_class = G_OBJECT_CLASS (klass);
+
+	object_class->dispose = dispose;
+
+	signals[PROBE_TERMINATED] =
+	    g_signal_new (NM_ACD_MANAGER_PROBE_TERMINATED,
+	                  G_OBJECT_CLASS_TYPE (object_class),
+	                  G_SIGNAL_RUN_FIRST,
+	                  0, NULL, NULL, NULL,
+	                  G_TYPE_NONE, 0);
+}
diff --git a/src/devices/nm-acd-manager.h b/src/devices/nm-acd-manager.h
new file mode 100644
index 0000000000..eeede5da7f
--- /dev/null
+++ b/src/devices/nm-acd-manager.h
@@ -0,0 +1,43 @@
+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
+/* NetworkManager -- Network link manager
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * Copyright (C) 2015-2018 Red Hat, Inc.
+ */
+
+#ifndef __NM_ACD_MANAGER__
+#define __NM_ACD_MANAGER__
+
+#include <netinet/in.h>
+
+#define NM_TYPE_ACD_MANAGER            (nm_acd_manager_get_type ())
+#define NM_ACD_MANAGER(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), NM_TYPE_ACD_MANAGER, NMAcdManager))
+#define NM_ACD_MANAGER_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass),  NM_TYPE_ACD_MANAGER, NMAcdManagerClass))
+#define NM_IS_ACD_MANAGER(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), NM_TYPE_ACD_MANAGER))
+#define NM_IS_ACD_MANAGER_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass),  NM_TYPE_ACD_MANAGER))
+#define NM_ACD_MANAGER_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj),  NM_TYPE_ACD_MANAGER, NMAcdManagerClass))
+
+#define NM_ACD_MANAGER_PROBE_TERMINATED  "probe-terminated"
+
+typedef struct _NMAcdManagerClass NMAcdManagerClass;
+
+GType nm_acd_manager_get_type (void);
+
+NMAcdManager *nm_acd_manager_new (int ifindex, const guint8 *hwaddr, size_t hwaddr_len);
+void nm_acd_manager_destroy (NMAcdManager *self);
+gboolean nm_acd_manager_add_address (NMAcdManager *self, in_addr_t address);
+gboolean nm_acd_manager_start_probe (NMAcdManager *self, guint timeout);
+gboolean nm_acd_manager_check_address (NMAcdManager *self, in_addr_t address);
+void nm_acd_manager_announce_addresses (NMAcdManager *self);
+void nm_acd_manager_reset (NMAcdManager *self);
+
+#endif /* __NM_ACD_MANAGER__ */
diff --git a/src/devices/nm-arping-manager.c b/src/devices/nm-arping-manager.c
deleted file mode 100644
index eb5b0574e1..0000000000
--- a/src/devices/nm-arping-manager.c
+++ /dev/null
@@ -1,474 +0,0 @@
-/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
-/* NetworkManager -- Network link manager
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * Copyright (C) 2015 Red Hat, Inc.
- */
-
-#include "nm-default.h"
-
-#include "nm-arping-manager.h"
-
-#include <netinet/in.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-
-#include "platform/nm-platform.h"
-#include "nm-utils.h"
-#include "NetworkManagerUtils.h"
-
-/*****************************************************************************/
-
-typedef enum {
-	STATE_INIT,
-	STATE_PROBING,
-	STATE_PROBE_DONE,
-	STATE_ANNOUNCING,
-} State;
-
-typedef struct {
-	in_addr_t address;
-	GPid pid;
-	guint watch;
-	gboolean duplicate;
-	NMArpingManager *manager;
-} AddressInfo;
-
-/*****************************************************************************/
-
-enum {
-	PROBE_TERMINATED,
-	LAST_SIGNAL,
-};
-
-static guint signals[LAST_SIGNAL] = { 0 };
-
-typedef struct {
-	int            ifindex;
-	State          state;
-	GHashTable    *addresses;
-	guint          completed;
-	guint          timer;
-	guint          round2_id;
-} NMArpingManagerPrivate;
-
-struct _NMArpingManager {
-	GObject parent;
-	NMArpingManagerPrivate _priv;
-};
-
-struct _NMArpingManagerClass {
-	GObjectClass parent;
-};
-
-G_DEFINE_TYPE (NMArpingManager, nm_arping_manager, G_TYPE_OBJECT)
-
-#define NM_ARPING_MANAGER_GET_PRIVATE(self) _NM_GET_PRIVATE (self, NMArpingManager, NM_IS_ARPING_MANAGER)
-
-/*****************************************************************************/
-
-#define _NMLOG_DOMAIN         LOGD_IP4
-#define _NMLOG_PREFIX_NAME    "arping"
-#define _NMLOG(level, ...) \
-    G_STMT_START { \
-        char _sbuf[64]; \
-        int _ifindex = (self) ? NM_ARPING_MANAGER_GET_PRIVATE (self)->ifindex : 0; \
-        \
-        nm_log ((level), _NMLOG_DOMAIN, \
-                nm_platform_link_get_name (NM_PLATFORM_GET, _ifindex), \
-                NULL, \
-                "%s%s: " _NM_UTILS_MACRO_FIRST (__VA_ARGS__), \
-                _NMLOG_PREFIX_NAME, \
-                self ? nm_sprintf_buf (_sbuf, "[%p,%d]", self, _ifindex) : "" \
-                _NM_UTILS_MACRO_REST (__VA_ARGS__)); \
-    } G_STMT_END
-
-/*****************************************************************************/
-
-/**
- * nm_arping_manager_add_address:
- * @self: a #NMArpingManager
- * @address: an IP address
- *
- * Add @address to the list of IP addresses to probe.
-
- * Returns: %TRUE on success, %FALSE if the address was already in the list
- */
-gboolean
-nm_arping_manager_add_address (NMArpingManager *self, in_addr_t address)
-{
-	NMArpingManagerPrivate *priv;
-	AddressInfo *info;
-
-	g_return_val_if_fail (NM_IS_ARPING_MANAGER (self), FALSE);
-	priv = NM_ARPING_MANAGER_GET_PRIVATE (self);
-	g_return_val_if_fail (priv->state == STATE_INIT, FALSE);
-
-	if (g_hash_table_lookup (priv->addresses, GUINT_TO_POINTER (address))) {
-		_LOGD ("address already exists");
-		return FALSE;
-	}
-
-	info = g_slice_new0 (AddressInfo);
-	info->address = address;
-	info->manager = self;
-
-	g_hash_table_insert (priv->addresses, GUINT_TO_POINTER (address), info);
-
-	return TRUE;
-}
-
-static void
-arping_watch_cb (GPid pid, gint status, gpointer user_data)
-{
-	AddressInfo *info = user_data;
-	NMArpingManager *self = info->manager;
-	NMArpingManagerPrivate *priv = NM_ARPING_MANAGER_GET_PRIVATE (self);
-	const char *addr;
-
-	info->pid = 0;
-	info->watch = 0;
-	addr = nm_utils_inet4_ntop (info->address, NULL);
-
-	if (WIFEXITED (status)) {
-		if (WEXITSTATUS (status) != 0) {
-			_LOGD ("%s already used in the %s network",
-			       addr, nm_platform_link_get_name (NM_PLATFORM_GET, priv->ifindex));
-			info->duplicate = TRUE;
-		} else
-			_LOGD ("DAD succeeded for %s", addr);
-	} else {
-		_LOGD ("stopped unexpectedly with status %d for %s", status, addr);
-	}
-
-	if (++priv->completed == g_hash_table_size (priv->addresses)) {
-		priv->state = STATE_PROBE_DONE;
-		nm_clear_g_source (&priv->timer);
-		g_signal_emit (self, signals[PROBE_TERMINATED], 0);
-	}
-}
-
-static gboolean
-arping_timeout_cb (gpointer user_data)
-{
-	NMArpingManager *self = user_data;
-	NMArpingManagerPrivate *priv = NM_ARPING_MANAGER_GET_PRIVATE (self);
-	GHashTableIter iter;
-	AddressInfo *info;
-
-	priv->timer = 0;
-
-	g_hash_table_iter_init (&iter, priv->addresses);
-	while (g_hash_table_iter_next (&iter, NULL, (gpointer *) &info)) {
-		nm_clear_g_source (&info->watch);
-		if (info->pid) {
-			_LOGD ("DAD timed out for %s",
-			       nm_utils_inet4_ntop (info->address, NULL));
-			nm_utils_kill_child_async (info->pid, SIGTERM, LOGD_IP4,
-			                           "arping", 1000, NULL, NULL);
-			info->pid = 0;
-		}
-	}
-
-	priv->state = STATE_PROBE_DONE;
-	g_signal_emit (self, signals[PROBE_TERMINATED], 0);
-
-	return G_SOURCE_REMOVE;
-}
-
-/**
- * nm_arping_manager_start_probe:
- * @self: a #NMArpingManager
- * @timeout: maximum probe duration in milliseconds
- * @error: location to store error, or %NULL
- *
- * Start probing IP addresses for duplicates; when the probe terminates a
- * PROBE_TERMINATED signal is emitted.
- *
- * Returns: %TRUE if at least one probe could be started, %FALSE otherwise
- */
-gboolean
-nm_arping_manager_start_probe (NMArpingManager *self, guint timeout, GError **error)
-{
-	const char *argv[] = { NULL, "-D", "-q", "-I", NULL, "-c", NULL, "-w", NULL, NULL, NULL };
-	NMArpingManagerPrivate *priv;
-	GHashTableIter iter;
-	AddressInfo *info;
-	gs_free char *timeout_str = NULL;
-	gboolean success = FALSE;
-
-	g_return_val_if_fail (NM_IS_ARPING_MANAGER (self), FALSE);
-	g_return_val_if_fail (!error || !*error, FALSE);
-	g_return_val_if_fail (timeout, FALSE);
-
-	priv = NM_ARPING_MANAGER_GET_PRIVATE (self);
-	g_return_val_if_fail (priv->state == STATE_INIT, FALSE);
-
-	argv[4] = nm_platform_link_get_name (NM_PLATFORM_GET, priv->ifindex);
-	if (!argv[4]) {
-		/* The device was probably just removed. */
-		g_set_error (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_FAILED,
-		             "can't find a name for ifindex %d", priv->ifindex);
-		return FALSE;
-	}
-
-	priv->completed = 0;
-
-	argv[0] = nm_utils_find_helper ("arping", NULL, NULL);
-	if (!argv[0]) {
-		g_set_error_literal (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_FAILED,
-		                     "arping could not be found");
-		return FALSE;
-	}
-
-	timeout_str = g_strdup_printf ("%u", timeout / 1000 + 2);
-	argv[6] = timeout_str;
-	argv[8] = timeout_str;
-
-	g_hash_table_iter_init (&iter, priv->addresses);
-
-	while (g_hash_table_iter_next (&iter, NULL, (gpointer *) &info)) {
-		gs_free char *tmp_str = NULL;
-
-		argv[9] = nm_utils_inet4_ntop (info->address, NULL);
-		_LOGD ("run %s", (tmp_str = g_strjoinv (" ", (char **) argv)));
-
-		if (g_spawn_async (NULL, (char **) argv, NULL,
-		                   G_SPAWN_STDOUT_TO_DEV_NULL |
-		                   G_SPAWN_STDERR_TO_DEV_NULL |
-		                   G_SPAWN_DO_NOT_REAP_CHILD,
-		                   NULL, NULL, &info->pid, NULL)) {
-			info->watch = g_child_watch_add (info->pid, arping_watch_cb, info);
-			success = TRUE;
-		}
-	}
-
-	if (success) {
-		priv->timer = g_timeout_add (timeout, arping_timeout_cb, self);
-		priv->state = STATE_PROBING;
-	} else {
-		g_set_error_literal (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_FAILED,
-		                     "could not spawn arping process");
-	}
-
-	return success;
-}
-
-/**
- * nm_arping_manager_reset:
- * @self: a #NMArpingManager
- *
- * Stop any operation in progress and reset @self to the initial state.
- */
-void
-nm_arping_manager_reset (NMArpingManager *self)
-{
-	NMArpingManagerPrivate *priv;
-
-	g_return_if_fail (NM_IS_ARPING_MANAGER (self));
-	priv = NM_ARPING_MANAGER_GET_PRIVATE (self);
-
-	nm_clear_g_source (&priv->timer);
-	nm_clear_g_source (&priv->round2_id);
-	g_hash_table_remove_all (priv->addresses);
-
-	priv->state = STATE_INIT;
-}
-
-/**
- * nm_arping_manager_destroy:
- * @self: the #NMArpingManager
- *
- * Calls nm_arping_manager_reset() and unrefs @self.
- */
-void
-nm_arping_manager_destroy (NMArpingManager *self)
-{
-	g_return_if_fail (NM_IS_ARPING_MANAGER (self));
-
-	nm_arping_manager_reset (self);
-	g_object_unref (self);
-}
-
-/**
- * nm_arping_manager_check_address:
- * @self: a #NMArpingManager
- * @address: an IP address
- *
- * Check if an IP address is duplicate. @address must have been added with
- * nm_arping_manager_add_address().
- *
- * Returns: %TRUE if the address is not duplicate, %FALSE otherwise
- */
-gboolean
-nm_arping_manager_check_address (NMArpingManager *self, in_addr_t address)
-{
-	NMArpingManagerPrivate *priv;
-	AddressInfo *info;
-
-	g_return_val_if_fail (NM_IS_ARPING_MANAGER (self), FALSE);
-	priv = NM_ARPING_MANAGER_GET_PRIVATE (self);
-	g_return_val_if_fail (   priv->state == STATE_INIT
-	                      || priv->state == STATE_PROBE_DONE, FALSE);
-
-	info = g_hash_table_lookup (priv->addresses, GUINT_TO_POINTER (address));
-	g_return_val_if_fail (info, FALSE);
-
-	return !info->duplicate;
-}
-
-static void
-send_announcements (NMArpingManager *self, const char *mode_arg)
-{
-	NMArpingManagerPrivate *priv = NM_ARPING_MANAGER_GET_PRIVATE (self);
-	const char *argv[] = { NULL, mode_arg, "-q", "-I", NULL, "-c", "1", NULL, NULL };
-	int ip_arg = G_N_ELEMENTS (argv) - 2;
-	GError *error = NULL;
-	GHashTableIter iter;
-	AddressInfo *info;
-
-	argv[4] = nm_platform_link_get_name (NM_PLATFORM_GET, priv->ifindex);
-	if (!argv[4]) {
-		/* The device was probably just removed. */
-		_LOGW ("can't find a name for ifindex %d", priv->ifindex);
-		return;
-	}
-
-	argv[0] = nm_utils_find_helper ("arping", NULL, NULL);
-	if (!argv[0]) {
-		_LOGW ("arping could not be found; no ARPs will be sent");
-		return;
-	}
-
-	g_hash_table_iter_init (&iter, priv->addresses);
-
-	while (g_hash_table_iter_next (&iter, NULL, (gpointer *) &info)) {
-		gs_free char *tmp_str = NULL;
-		gboolean success;
-
-		if (info->duplicate)
-			continue;
-
-		argv[ip_arg] = nm_utils_inet4_ntop (info->address, NULL);
-		_LOGD ("run %s", (tmp_str = g_strjoinv (" ", (char **) argv)));
-
-		success = g_spawn_async (NULL, (char **) argv, NULL,
-		                         G_SPAWN_STDOUT_TO_DEV_NULL |
-		                         G_SPAWN_STDERR_TO_DEV_NULL,
-		                         NULL, NULL, NULL, &error);
-		if (!success) {
-			_LOGW ("could not send ARP for address %s: %s", argv[ip_arg],
-			       error->message);
-			g_clear_error (&error);
-		}
-	}
-}
-
-static gboolean
-arp_announce_round2 (gpointer self)
-{
-	NMArpingManagerPrivate *priv = NM_ARPING_MANAGER_GET_PRIVATE ((NMArpingManager *) self);
-
-	priv->round2_id = 0;
-	send_announcements (self, "-U");
-	priv->state = STATE_INIT;
-	g_hash_table_remove_all (priv->addresses);
-
-	return G_SOURCE_REMOVE;
-}
-
-/**
- * nm_arping_manager_announce_addresses:
- * @self: a #NMArpingManager
- *
- * Start announcing addresses.
- */
-void
-nm_arping_manager_announce_addresses (NMArpingManager *self)
-{
-	NMArpingManagerPrivate *priv = NM_ARPING_MANAGER_GET_PRIVATE (self);
-
-	g_return_if_fail (   priv->state == STATE_INIT
-	                  || priv->state == STATE_PROBE_DONE);
-
-	send_announcements (self, "-A");
-	nm_clear_g_source (&priv->round2_id);
-	priv->round2_id = g_timeout_add_seconds (2, arp_announce_round2, self);
-	priv->state = STATE_ANNOUNCING;
-}
-
-static void
-destroy_address_info (gpointer data)
-{
-	AddressInfo *info = (AddressInfo *) data;
-
-	nm_clear_g_source (&info->watch);
-
-	if (info->pid) {
-		nm_utils_kill_child_async (info->pid, SIGTERM, LOGD_IP4, "arping",
-		                           1000, NULL, NULL);
-	}
-
-	g_slice_free (AddressInfo, info);
-}
-
-/*****************************************************************************/
-
-static void
-nm_arping_manager_init (NMArpingManager *self)
-{
-	NMArpingManagerPrivate *priv = NM_ARPING_MANAGER_GET_PRIVATE (self);
-
-	priv->addresses = g_hash_table_new_full (nm_direct_hash, NULL,
-	                                         NULL, destroy_address_info);
-	priv->state = STATE_INIT;
-}
-
-NMArpingManager *
-nm_arping_manager_new (int ifindex)
-{
-	NMArpingManager *self;
-	NMArpingManagerPrivate *priv;
-
-	self = g_object_new (NM_TYPE_ARPING_MANAGER, NULL);
-	priv = NM_ARPING_MANAGER_GET_PRIVATE (self);
-	priv->ifindex = ifindex;
-	return self;
-}
-
-static void
-dispose (GObject *object)
-{
-	NMArpingManager *self = NM_ARPING_MANAGER (object);
-	NMArpingManagerPrivate *priv = NM_ARPING_MANAGER_GET_PRIVATE (self);
-
-	nm_clear_g_source (&priv->timer);
-	nm_clear_g_source (&priv->round2_id);
-	g_clear_pointer (&priv->addresses, g_hash_table_destroy);
-
-	G_OBJECT_CLASS (nm_arping_manager_parent_class)->dispose (object);
-}
-
-static void
-nm_arping_manager_class_init (NMArpingManagerClass *klass)
-{
-	GObjectClass *object_class = G_OBJECT_CLASS (klass);
-
-	object_class->dispose = dispose;
-
-	signals[PROBE_TERMINATED] =
-	    g_signal_new (NM_ARPING_MANAGER_PROBE_TERMINATED,
-	                  G_OBJECT_CLASS_TYPE (object_class),
-	                  G_SIGNAL_RUN_FIRST,
-	                  0, NULL, NULL, NULL,
-	                  G_TYPE_NONE, 0);
-}
diff --git a/src/devices/nm-arping-manager.h b/src/devices/nm-arping-manager.h
deleted file mode 100644
index c8a86af030..0000000000
--- a/src/devices/nm-arping-manager.h
+++ /dev/null
@@ -1,43 +0,0 @@
-/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
-/* NetworkManager -- Network link manager
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * Copyright (C) 2015 Red Hat, Inc.
- */
-
-#ifndef __NM_ARPING_MANAGER__
-#define __NM_ARPING_MANAGER__
-
-#include <netinet/in.h>
-
-#define NM_TYPE_ARPING_MANAGER            (nm_arping_manager_get_type ())
-#define NM_ARPING_MANAGER(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), NM_TYPE_ARPING_MANAGER, NMArpingManager))
-#define NM_ARPING_MANAGER_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass),  NM_TYPE_ARPING_MANAGER, NMArpingManagerClass))
-#define NM_IS_ARPING_MANAGER(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), NM_TYPE_ARPING_MANAGER))
-#define NM_IS_ARPING_MANAGER_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass),  NM_TYPE_ARPING_MANAGER))
-#define NM_ARPING_MANAGER_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj),  NM_TYPE_ARPING_MANAGER, NMArpingManagerClass))
-
-#define NM_ARPING_MANAGER_PROBE_TERMINATED  "probe-terminated"
-
-typedef struct _NMArpingManagerClass NMArpingManagerClass;
-
-GType nm_arping_manager_get_type (void);
-
-NMArpingManager *nm_arping_manager_new (int ifindex);
-void nm_arping_manager_destroy (NMArpingManager *self);
-gboolean nm_arping_manager_add_address (NMArpingManager *self, in_addr_t address);
-gboolean nm_arping_manager_start_probe (NMArpingManager *self, guint timeout, GError **error);
-gboolean nm_arping_manager_check_address (NMArpingManager *self, in_addr_t address);
-void nm_arping_manager_announce_addresses (NMArpingManager *self);
-void nm_arping_manager_reset (NMArpingManager *self);
-
-#endif /* __NM_ARPING_MANAGER__ */
diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
index 13443ebb5f..e86e19709f 100644
--- a/src/devices/nm-device.c
+++ b/src/devices/nm-device.c
@@ -66,13 +66,13 @@
 #include "nm-netns.h"
 #include "nm-dispatcher.h"
 #include "nm-config.h"
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 #include "dns/nm-dns-manager.h"
+#include "nm-acd-manager.h"
 #include "nm-core-internal.h"
 #include "systemd/nm-sd.h"
 #include "nm-lldp-listener.h"
 #include "nm-audit-manager.h"
-#include "nm-arping-manager.h"
 #include "nm-connectivity.h"
 #include "nm-dbus-interface.h"
 #include "nm-device-vlan.h"
@@ -129,13 +129,13 @@ typedef struct {
 	int ifindex;
 } DeleteOnDeactivateData;
 
-typedef void (*ArpingCallback) (NMDevice *, NMIP4Config **, gboolean);
+typedef void (*AcdCallback) (NMDevice *, NMIP4Config **, gboolean);
 
 typedef struct {
-	ArpingCallback callback;
+	AcdCallback callback;
 	NMDevice *device;
 	NMIP4Config **configs;
-} ArpingData;
+} AcdData;
 
 typedef enum {
 	HW_ADDR_TYPE_UNSET = 0,
@@ -485,8 +485,8 @@ typedef struct _NMDevicePrivate {
 	/* IPv4 DAD stuff */
 	struct {
 		GSList *          dad_list;
-		NMArpingManager * announcing;
-	} arping;
+		NMAcdManager * announcing;
+	} acd;
 
 	union {
 		const IpState   ip6_state;
@@ -6043,16 +6043,16 @@ get_ipv4_dad_timeout (NMDevice *self)
 }
 
 static void
-arping_data_destroy (gpointer ptr, GClosure *closure)
+acd_data_destroy (gpointer ptr, GClosure *closure)
 {
-	ArpingData *data = ptr;
+	AcdData *data = ptr;
 	int i;
 
 	if (data) {
 		for (i = 0; data->configs && data->configs[i]; i++)
 			g_object_unref (data->configs[i]);
 		g_free (data->configs);
-		g_slice_free (ArpingData, data);
+		g_slice_free (AcdData, data);
 	}
 }
 
@@ -6072,7 +6072,7 @@ ipv4_manual_method_apply (NMDevice *self, NMIP4Config **configs, gboolean succes
 }
 
 static void
-arping_manager_probe_terminated (NMArpingManager *arping_manager, ArpingData *data)
+acd_manager_probe_terminated (NMAcdManager *acd_manager, AcdData *data)
 {
 	NMDevice *self;
 	NMDevicePrivate *priv;
@@ -6087,7 +6087,7 @@ arping_manager_probe_terminated (NMArpingManager *arping_manager, ArpingData *da
 
 	for (i = 0; data->configs && data->configs[i]; i++) {
 		nm_ip_config_iter_ip4_address_for_each (&ipconf_iter, data->configs[i], &address) {
-			result = nm_arping_manager_check_address (arping_manager, address->address);
+			result = nm_acd_manager_check_address (acd_manager, address->address);
 			success &= result;
 
 			_NMLOG (result ? LOGL_DEBUG : LOGL_WARN,
@@ -6100,8 +6100,8 @@ arping_manager_probe_terminated (NMArpingManager *arping_manager, ArpingData *da
 
 	data->callback (self, data->configs, success);
 
-	priv->arping.dad_list = g_slist_remove (priv->arping.dad_list, arping_manager);
-	nm_arping_manager_destroy (arping_manager);
+	priv->acd.dad_list = g_slist_remove (priv->acd.dad_list, acd_manager);
+	nm_acd_manager_destroy (acd_manager);
 }
 
 /**
@@ -6115,17 +6115,17 @@ arping_manager_probe_terminated (NMArpingManager *arping_manager, ArpingData *da
  * be started. @configs will be unreferenced after @cb has been called.
  */
 static void
-ipv4_dad_start (NMDevice *self, NMIP4Config **configs, ArpingCallback cb)
+ipv4_dad_start (NMDevice *self, NMIP4Config **configs, AcdCallback cb)
 {
 	NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE (self);
-	NMArpingManager *arping_manager;
+	NMAcdManager *acd_manager;
 	const NMPlatformIP4Address *address;
 	NMDedupMultiIter ipconf_iter;
-	ArpingData *data;
+	AcdData *data;
 	guint timeout;
 	gboolean ret, addr_found;
 	const guint8 *hwaddr_arr;
-	GError *error = NULL;
+	size_t length;
 	guint i;
 
 	g_return_if_fail (NM_IS_DEVICE (self));
@@ -6142,11 +6142,12 @@ ipv4_dad_start (NMDevice *self, NMIP4Config **configs, ArpingCallback cb)
 	timeout = get_ipv4_dad_timeout (self);
 	hwaddr_arr = nm_platform_link_get_address (nm_device_get_platform (self),
 	                                           nm_device_get_ip_ifindex (self),
-	                                           NULL);
+	                                           &length);
 
 	if (   !timeout
 	    || !hwaddr_arr
 	    || !addr_found
+	    || length != ETH_ALEN
 	    || nm_device_sys_iface_state_is_external_or_assume (self)) {
 
 		/* DAD not needed, signal success */
@@ -6159,36 +6160,36 @@ ipv4_dad_start (NMDevice *self, NMIP4Config **configs, ArpingCallback cb)
 		return;
 	}
 
-	/* don't take additional references of @arping_manager that outlive @self.
+	/* don't take additional references of @acd_manager that outlive @self.
 	 * Otherwise, the callback can be invoked on a dangling pointer as we don't
 	 * disconnect the handler. */
-	arping_manager = nm_arping_manager_new (nm_device_get_ip_ifindex (self));
-	priv->arping.dad_list = g_slist_append (priv->arping.dad_list, arping_manager);
+	acd_manager = nm_acd_manager_new (nm_device_get_ip_ifindex (self), hwaddr_arr, length);
+	priv->acd.dad_list = g_slist_append (priv->acd.dad_list, acd_manager);
 
-	data = g_slice_new0 (ArpingData);
+	data = g_slice_new0 (AcdData);
 	data->configs = configs;
 	data->callback = cb;
 	data->device = self;
 
 	for (i = 0; configs[i]; i++) {
 		nm_ip_config_iter_ip4_address_for_each (&ipconf_iter, configs[i], &address)
-			nm_arping_manager_add_address (arping_manager, address->address);
+			nm_acd_manager_add_address (acd_manager, address->address);
 	}
 
-	g_signal_connect_data (arping_manager, NM_ARPING_MANAGER_PROBE_TERMINATED,
-	                       G_CALLBACK (arping_manager_probe_terminated), data,
-	                       arping_data_destroy, 0);
+	g_signal_connect_data (acd_manager, NM_ACD_MANAGER_PROBE_TERMINATED,
+	                       G_CALLBACK (acd_manager_probe_terminated), data,
+	                       acd_data_destroy, 0);
 
-	ret = nm_arping_manager_start_probe (arping_manager, timeout, &error);
+	ret = nm_acd_manager_start_probe (acd_manager, timeout);
 
 	if (!ret) {
-		_LOGW (LOGD_DEVICE, "arping probe failed: %s", error->message);
+		_LOGW (LOGD_DEVICE, "acd probe failed");
 
 		/* DAD could not be started, signal success */
 		cb (self, configs, TRUE);
 
-		priv->arping.dad_list = g_slist_remove (priv->arping.dad_list, arping_manager);
-		nm_arping_manager_destroy (arping_manager);
+		priv->acd.dad_list = g_slist_remove (priv->acd.dad_list, acd_manager);
+		nm_acd_manager_destroy (acd_manager);
 	}
 }
 
@@ -9231,9 +9232,9 @@ arp_cleanup (NMDevice *self)
 {
 	NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE (self);
 
-	if (priv->arping.announcing) {
-		nm_arping_manager_destroy (priv->arping.announcing);
-		priv->arping.announcing = NULL;
+	if (priv->acd.announcing) {
+		nm_acd_manager_destroy (priv->acd.announcing);
+		priv->acd.announcing = NULL;
 	}
 }
 
@@ -9253,7 +9254,7 @@ arp_announce (NMDevice *self)
 	                                        nm_device_get_ip_ifindex (self),
 	                                        &hw_addr_len);
 
-	if (!hw_addr_len || !hw_addr)
+	if (!hw_addr || hw_addr_len != ETH_ALEN)
 		return;
 
 	/* We only care about manually-configured addresses; DHCP- and autoip-configured
@@ -9269,19 +9270,19 @@ arp_announce (NMDevice *self)
 	if (num == 0)
 		return;
 
-	priv->arping.announcing = nm_arping_manager_new (nm_device_get_ip_ifindex (self));
+	priv->acd.announcing = nm_acd_manager_new (nm_device_get_ip_ifindex (self), hw_addr, hw_addr_len);
 
 	for (i = 0; i < num; i++) {
 		NMIPAddress *ip = nm_setting_ip_config_get_address (s_ip4, i);
 		in_addr_t addr;
 
 		if (inet_pton (AF_INET, nm_ip_address_get_address (ip), &addr) == 1)
-			nm_arping_manager_add_address (priv->arping.announcing, addr);
+			nm_acd_manager_add_address (priv->acd.announcing, addr);
 		else
 			g_warn_if_reached ();
 	}
 
-	nm_arping_manager_announce_addresses (priv->arping.announcing);
+	nm_acd_manager_announce_addresses (priv->acd.announcing);
 }
 
 static void
@@ -14906,8 +14907,8 @@ dispose (GObject *object)
 	g_signal_handlers_disconnect_by_func (platform, G_CALLBACK (device_ipx_changed), self);
 	g_signal_handlers_disconnect_by_func (platform, G_CALLBACK (link_changed_cb), self);
 
-	g_slist_free_full (priv->arping.dad_list, (GDestroyNotify) nm_arping_manager_destroy);
-	priv->arping.dad_list = NULL;
+	g_slist_free_full (priv->acd.dad_list, (GDestroyNotify) nm_acd_manager_destroy);
+	priv->acd.dad_list = NULL;
 
 	arp_cleanup (self);
 
diff --git a/src/devices/tests/meson.build b/src/devices/tests/meson.build
index 64afc278d6..02c61ced1d 100644
--- a/src/devices/tests/meson.build
+++ b/src/devices/tests/meson.build
@@ -1,5 +1,5 @@
 test_units = [
-  'test-arping',
+  'test-acd',
   'test-lldp'
 ]
 
diff --git a/src/devices/tests/test-arping.c b/src/devices/tests/test-acd.c
index f053754523..8a2852a2d7 100644
--- a/src/devices/tests/test-arping.c
+++ b/src/devices/tests/test-acd.c
@@ -20,7 +20,7 @@
 
 #include "nm-default.h"
 
-#include "devices/nm-arping-manager.h"
+#include "devices/nm-acd-manager.h"
 #include "platform/tests/test-common.h"
 
 #define IFACE_VETH0 "nm-test-veth0"
@@ -34,6 +34,10 @@
 typedef struct {
 	int ifindex0;
 	int ifindex1;
+	const guint8 *hwaddr0;
+	const guint8 *hwaddr1;
+	size_t hwaddr0_len;
+	size_t hwaddr1_len;
 } test_fixture;
 
 static void
@@ -45,6 +49,9 @@ fixture_setup (test_fixture *fixture, gconstpointer user_data)
 
 	g_assert (nm_platform_link_set_up (NM_PLATFORM_GET, fixture->ifindex0, NULL));
 	g_assert (nm_platform_link_set_up (NM_PLATFORM_GET, fixture->ifindex1, NULL));
+
+	fixture->hwaddr0 = nm_platform_link_get_address (NM_PLATFORM_GET, fixture->ifindex0, &fixture->hwaddr0_len);
+	fixture->hwaddr1 = nm_platform_link_get_address (NM_PLATFORM_GET, fixture->ifindex1, &fixture->hwaddr1_len);
 }
 
 typedef struct {
@@ -54,26 +61,21 @@ typedef struct {
 } TestInfo;
 
 static void
-arping_manager_probe_terminated (NMArpingManager *arping_manager, GMainLoop *loop)
+acd_manager_probe_terminated (NMAcdManager *acd_manager, GMainLoop *loop)
 {
 	g_main_loop_quit (loop);
 }
 
 static void
-test_arping_common (test_fixture *fixture, TestInfo *info)
+test_acd_common (test_fixture *fixture, TestInfo *info)
 {
-	gs_unref_object NMArpingManager *manager = NULL;
+	gs_unref_object NMAcdManager *manager = NULL;
 	GMainLoop *loop;
 	int i;
 	const guint WAIT_TIME_OPTIMISTIC = 50;
 	guint wait_time;
 	gulong signal_id;
 
-	if (!nm_utils_find_helper ("arping", NULL, NULL)) {
-		g_test_skip ("arping binary is missing");
-		return;
-	}
-
 	/* first, try with a short waittime. We hope that this is long enough
 	 * to successfully complete the test. Only if that's not the case, we
 	 * assume the computer is currently busy (high load) and we retry with
@@ -81,11 +83,11 @@ test_arping_common (test_fixture *fixture, TestInfo *info)
 	wait_time = WAIT_TIME_OPTIMISTIC;
 again:
 
-	manager = nm_arping_manager_new (fixture->ifindex0);
+	manager = nm_acd_manager_new (fixture->ifindex0, fixture->hwaddr0, fixture->hwaddr0_len);
 	g_assert (manager != NULL);
 
 	for (i = 0; info->addresses[i]; i++)
-		g_assert (nm_arping_manager_add_address (manager, info->addresses[i]));
+		g_assert (nm_acd_manager_add_address (manager, info->addresses[i]));
 
 	for (i = 0; info->peer_addresses[i]; i++) {
 		nmtstp_ip4_address_add (NULL, FALSE, fixture->ifindex1, info->peer_addresses[i],
@@ -93,9 +95,9 @@ again:
 	}
 
 	loop = g_main_loop_new (NULL, FALSE);
-	signal_id = g_signal_connect (manager, NM_ARPING_MANAGER_PROBE_TERMINATED,
-	                              G_CALLBACK (arping_manager_probe_terminated), loop);
-	g_assert (nm_arping_manager_start_probe (manager, wait_time, NULL));
+	signal_id = g_signal_connect (manager, NM_ACD_MANAGER_PROBE_TERMINATED,
+	                              G_CALLBACK (acd_manager_probe_terminated), loop);
+	g_assert (nm_acd_manager_start_probe (manager, wait_time));
 	g_assert (nmtst_main_loop_run (loop, 2000));
 	g_signal_handler_disconnect (manager, signal_id);
 	g_main_loop_unref (loop);
@@ -103,7 +105,7 @@ again:
 	for (i = 0; info->addresses[i]; i++) {
 		gboolean val;
 
-		val = nm_arping_manager_check_address (manager, info->addresses[i]);
+		val = nm_acd_manager_check_address (manager, info->addresses[i]);
 		if (val == info->expected_result[i])
 			continue;
 
@@ -122,23 +124,41 @@ again:
 }
 
 static void
-test_arping_1 (test_fixture *fixture, gconstpointer user_data)
+test_acd_probe_1 (test_fixture *fixture, gconstpointer user_data)
 {
 	TestInfo info = { .addresses       = { ADDR1, ADDR2, ADDR3 },
 	                  .peer_addresses  = { ADDR4 },
 	                  .expected_result = { TRUE, TRUE, TRUE } };
 
-	test_arping_common (fixture, &info);
+	test_acd_common (fixture, &info);
 }
 
 static void
-test_arping_2 (test_fixture *fixture, gconstpointer user_data)
+test_acd_probe_2 (test_fixture *fixture, gconstpointer user_data)
 {
 	TestInfo info = { .addresses       = { ADDR1, ADDR2, ADDR3, ADDR4 },
 	                  .peer_addresses  = { ADDR3, ADDR2 },
 	                  .expected_result = { TRUE, FALSE, FALSE, TRUE } };
 
-	test_arping_common (fixture, &info);
+	test_acd_common (fixture, &info);
+}
+
+static void
+test_acd_announce (test_fixture *fixture, gconstpointer user_data)
+{
+	gs_unref_object NMAcdManager *manager = NULL;
+	GMainLoop *loop;
+
+	manager = nm_acd_manager_new (fixture->ifindex0, fixture->hwaddr0, fixture->hwaddr0_len);
+	g_assert (manager != NULL);
+
+	g_assert (nm_acd_manager_add_address (manager, ADDR1));
+	g_assert (nm_acd_manager_add_address (manager, ADDR2));
+
+	loop = g_main_loop_new (NULL, FALSE);
+	nm_acd_manager_announce_addresses (manager);
+	g_assert (!nmtst_main_loop_run (loop, 200));
+	g_main_loop_unref (loop);
 }
 
 static void
@@ -159,6 +179,7 @@ _nmtstp_init_tests (int *argc, char ***argv)
 void
 _nmtstp_setup_tests (void)
 {
-	g_test_add ("/arping/1", test_fixture, NULL, fixture_setup, test_arping_1, fixture_teardown);
-	g_test_add ("/arping/2", test_fixture, NULL, fixture_setup, test_arping_2, fixture_teardown);
+	g_test_add ("/acd/probe/1", test_fixture, NULL, fixture_setup, test_acd_probe_1, fixture_teardown);
+	g_test_add ("/acd/probe/2", test_fixture, NULL, fixture_setup, test_acd_probe_2, fixture_teardown);
+	g_test_add ("/acd/announce", test_fixture, NULL, fixture_setup, test_acd_announce, fixture_teardown);
 }
diff --git a/src/meson.build b/src/meson.build
index 0b7c100875..591c9c79c1 100644
--- a/src/meson.build
+++ b/src/meson.build
@@ -91,7 +91,7 @@ libnetwork_manager_base = static_library(
 )
 
 sources = files(
-  'devices/nm-arping-manager.c',
+  'devices/nm-acd-manager.c',
   'devices/nm-device-bond.c',
   'devices/nm-device-bridge.c',
   'devices/nm-device.c',
@@ -174,7 +174,8 @@ deps = [
   #        this dependency might be needed
   #libnmdbus_dep,
   libudev_dep,
-  nm_core_dep
+  nm_core_dep,
+  shared_n_acd_dep
 ]
 
 if enable_concheck
diff --git a/src/nm-act-request.c b/src/nm-act-request.c
index e069fb3a30..0ac20b852f 100644
--- a/src/nm-act-request.c
+++ b/src/nm-act-request.c
@@ -28,7 +28,7 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 
 #include "nm-setting-wireless-security.h"
 #include "nm-setting-8021x.h"
diff --git a/src/nm-active-connection.h b/src/nm-active-connection.h
index 45a5ac427a..c3d08b6479 100644
--- a/src/nm-active-connection.h
+++ b/src/nm-active-connection.h
@@ -21,7 +21,7 @@
 #ifndef __NETWORKMANAGER_ACTIVE_CONNECTION_H__
 #define __NETWORKMANAGER_ACTIVE_CONNECTION_H__
 
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 #include "nm-connection.h"
 #include "nm-dbus-object.h"
 
diff --git a/src/nm-auth-manager.c b/src/nm-auth-manager.c
index 411f92263b..ca1a2f18f5 100644
--- a/src/nm-auth-manager.c
+++ b/src/nm-auth-manager.c
@@ -22,7 +22,7 @@
 
 #include "nm-auth-manager.h"
 
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 #include "nm-errors.h"
 #include "nm-core-internal.h"
 #include "NetworkManagerUtils.h"
diff --git a/src/nm-checkpoint-manager.c b/src/nm-checkpoint-manager.c
index e55d632b91..8ba19db9f1 100644
--- a/src/nm-checkpoint-manager.c
+++ b/src/nm-checkpoint-manager.c
@@ -28,7 +28,7 @@
 #include "devices/nm-device.h"
 #include "nm-manager.h"
 #include "nm-utils.h"
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 
 /*****************************************************************************/
 
diff --git a/src/nm-connectivity.c b/src/nm-connectivity.c
index d46b7d2859..389e72ad7c 100644
--- a/src/nm-connectivity.c
+++ b/src/nm-connectivity.c
@@ -30,7 +30,7 @@
 #include <curl/curl.h>
 #endif
 
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 #include "nm-config.h"
 #include "NetworkManagerUtils.h"
 
diff --git a/src/nm-dbus-manager.c b/src/nm-dbus-manager.c
index 522383dba7..3e3691296f 100644
--- a/src/nm-dbus-manager.c
+++ b/src/nm-dbus-manager.c
@@ -29,7 +29,7 @@
 #include <errno.h>
 #include <string.h>
 
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 #include "nm-dbus-interface.h"
 #include "nm-core-internal.h"
 #include "nm-dbus-compat.h"
diff --git a/src/nm-dbus-object.h b/src/nm-dbus-object.h
index 947ea6c7dd..43613630bb 100644
--- a/src/nm-dbus-object.h
+++ b/src/nm-dbus-object.h
@@ -23,7 +23,7 @@
 
 /*****************************************************************************/
 
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 #include "nm-dbus-utils.h"
 
 /*****************************************************************************/
diff --git a/src/nm-firewall-manager.c b/src/nm-firewall-manager.c
index 216d5fc81c..134a46f7ec 100644
--- a/src/nm-firewall-manager.c
+++ b/src/nm-firewall-manager.c
@@ -25,7 +25,7 @@
 #include <string.h>
 
 #include "NetworkManagerUtils.h"
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 
 /*****************************************************************************/
 
diff --git a/src/nm-manager.h b/src/nm-manager.h
index 9e94e97064..5444453203 100644
--- a/src/nm-manager.h
+++ b/src/nm-manager.h
@@ -23,7 +23,7 @@
 #define __NETWORKMANAGER_MANAGER_H__
 
 #include "settings/nm-settings-connection.h"
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 #include "nm-dbus-manager.h"
 
 #define NM_TYPE_MANAGER            (nm_manager_get_type ())
diff --git a/src/nm-pacrunner-manager.c b/src/nm-pacrunner-manager.c
index 393b429ca1..caae8b203f 100644
--- a/src/nm-pacrunner-manager.c
+++ b/src/nm-pacrunner-manager.c
@@ -27,7 +27,7 @@
 #include "nm-proxy-config.h"
 #include "nm-ip4-config.h"
 #include "nm-ip6-config.h"
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 
 #define PACRUNNER_DBUS_SERVICE "org.pacrunner"
 #define PACRUNNER_DBUS_INTERFACE "org.pacrunner.Manager"
diff --git a/src/nm-types.h b/src/nm-types.h
index e48a6e2a18..e1991c2809 100644
--- a/src/nm-types.h
+++ b/src/nm-types.h
@@ -34,10 +34,10 @@ typedef struct _NMAuditManager       NMAuditManager;
 typedef struct _NMVpnConnection      NMVpnConnection;
 typedef struct _NMActRequest         NMActRequest;
 typedef struct _NMAuthSubject        NMAuthSubject;
-typedef struct _NMDBusManager         NMDBusManager;
+typedef struct _NMDBusManager        NMDBusManager;
 typedef struct _NMConfig             NMConfig;
 typedef struct _NMConfigData         NMConfigData;
-typedef struct _NMArpingManager      NMArpingManager;
+typedef struct _NMAcdManager         NMAcdManager;
 typedef struct _NMConnectivity       NMConnectivity;
 typedef struct _NMDevice             NMDevice;
 typedef struct _NMDhcp4Config        NMDhcp4Config;
diff --git a/src/settings/nm-agent-manager.c b/src/settings/nm-agent-manager.c
index 00aa3a0865..453136e4e7 100644
--- a/src/settings/nm-agent-manager.c
+++ b/src/settings/nm-agent-manager.c
@@ -36,7 +36,7 @@
 #include "nm-simple-connection.h"
 #include "NetworkManagerUtils.h"
 #include "nm-core-internal.h"
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 
 /*****************************************************************************/
 
diff --git a/src/settings/nm-secret-agent.c b/src/settings/nm-secret-agent.c
index 1f6f15a905..af6d7017bd 100644
--- a/src/settings/nm-secret-agent.c
+++ b/src/settings/nm-secret-agent.c
@@ -31,7 +31,7 @@
 #include "nm-auth-subject.h"
 #include "nm-simple-connection.h"
 #include "NetworkManagerUtils.h"
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 
 /*****************************************************************************/
 
diff --git a/src/settings/nm-settings-connection.c b/src/settings/nm-settings-connection.c
index a71de91531..0b998372d7 100644
--- a/src/settings/nm-settings-connection.c
+++ b/src/settings/nm-settings-connection.c
@@ -25,7 +25,7 @@
 
 #include <string.h>
 
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 
 #include "nm-common-macros.h"
 #include "nm-config.h"
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
index 51a72d7e15..110a77eec6 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
@@ -1555,10 +1555,14 @@ make_ip4_setting (shvarFile *ifcfg,
 		}
 	}
 
-	timeout = svGetValueInt64 (ifcfg, "ARPING_WAIT", 10, -1,
-	                           NM_SETTING_IP_CONFIG_DAD_TIMEOUT_MAX / 1000, -1);
-	g_object_set (s_ip4, NM_SETTING_IP_CONFIG_DAD_TIMEOUT,
-	              (gint) (timeout <= 0 ? timeout : timeout * 1000), NULL);
+	timeout = svGetValueInt64 (ifcfg, "ACD_TIMEOUT", 10, -1, NM_SETTING_IP_CONFIG_DAD_TIMEOUT_MAX, -2);
+	if (timeout == -2) {
+		timeout = svGetValueInt64 (ifcfg, "ARPING_WAIT", 10, -1,
+		                           NM_SETTING_IP_CONFIG_DAD_TIMEOUT_MAX / 1000, -1);
+		if (timeout > 0)
+			timeout *= 1000;
+	}
+	g_object_set (s_ip4, NM_SETTING_IP_CONFIG_DAD_TIMEOUT, (gint) timeout, NULL);
 
 	return g_steal_pointer (&s_ip4);
 }
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
index 3c97a43e6f..8584772e8e 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
@@ -2417,12 +2417,15 @@ write_ip4_setting (NMConnection *connection,
 	NM_SET_OUT (out_route_content, write_route_file (s_ip4));
 
 	timeout = nm_setting_ip_config_get_dad_timeout (s_ip4);
-	if (timeout < 0)
+	if (timeout < 0) {
+		svUnsetValue (ifcfg, "ACD_TIMEOUT");
 		svUnsetValue (ifcfg, "ARPING_WAIT");
-	else if (timeout == 0)
+	} else if (timeout == 0) {
+		svSetValueStr (ifcfg, "ACD_TIMEOUT", "0");
 		svSetValueStr (ifcfg, "ARPING_WAIT", "0");
-	else {
-		/* Round the value up to next integer */
+	} else {
+		svSetValueInt64 (ifcfg, "ACD_TIMEOUT", timeout);
+		/* Round the value up to next integer for initscripts */
 		svSetValueInt64 (ifcfg, "ARPING_WAIT", (timeout - 1) / 1000 + 1);
 	}
 
diff --git a/src/settings/plugins/ifcfg-rh/shvar.c b/src/settings/plugins/ifcfg-rh/shvar.c
index c0dad6ab27..9120b870eb 100644
--- a/src/settings/plugins/ifcfg-rh/shvar.c
+++ b/src/settings/plugins/ifcfg-rh/shvar.c
@@ -39,7 +39,7 @@
 #include "nm-core-internal.h"
 #include "nm-core-utils.h"
 #include "nm-utils/nm-enum-utils.h"
-#include "nm-utils/c-list.h"
+#include "c-list/src/c-list.h"
 
 /*****************************************************************************/
 
diff --git a/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_Wired_Static_Routes.cexpected b/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_Wired_Static_Routes.cexpected
index c0e47c48d8..cd8fc96f5a 100644
--- a/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_Wired_Static_Routes.cexpected
+++ b/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_Wired_Static_Routes.cexpected
@@ -14,6 +14,8 @@ DNS2=4.2.2.2
 DOMAIN="foobar.com lab.foobar.com"
 DEFROUTE=yes
 IPV4_FAILURE_FATAL=no
+ACD_TIMEOUT=400
+ARPING_WAIT=1
 IPV6INIT=no
 NAME="Test Write Wired Static Routes"
 UUID=${UUID}
diff --git a/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-1 b/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-1
index 1bc3d5241c..db09afdb9f 100644
--- a/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-1
+++ b/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-1
@@ -10,3 +10,5 @@ PREFIX1=16
 IPADDR2=3.3.3.3
 PREFIX2=8
 GATEWAY=1.1.1.1
+ACD_TIMEOUT=2000
+ARPING_WAIT=1
diff --git a/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-2 b/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-2
index d7273e3600..6972e279d4 100644
--- a/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-2
+++ b/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-2
@@ -9,3 +9,5 @@ IPADDR2=9.8.7.6
 PREFIX2=16
 IPADDR3=3.3.3.3
 PREFIX3=8
+ACD_TIMEOUT=2000
+ARPING_WAIT=1
diff --git a/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-3 b/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-3
index f2457bd2a0..d906599411 100644
--- a/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-3
+++ b/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-3
@@ -9,3 +9,5 @@ IPADDR3=9.8.7.6
 PREFIX3=16
 IPADDR4=3.3.3.3
 PREFIX4=8
+ACD_TIMEOUT=2000
+ARPING_WAIT=1
diff --git a/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-4 b/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-4
index e6b77141f6..935267f72a 100644
--- a/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-4
+++ b/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-test-wired-ipv4-manual-4
@@ -9,3 +9,5 @@ IPADDR1=9.8.7.6
 PREFIX1=16
 IPADDR2=3.3.3.3
 PREFIX2=8
+ACD_TIMEOUT=2000
+ARPING_WAIT=1
diff --git a/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c b/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
index 60acde294a..5ba42bbe56 100644
--- a/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
+++ b/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
@@ -1473,6 +1473,7 @@ test_read_wired_ipv4_manual (gconstpointer data)
 	s_ip4 = nm_connection_get_setting_ip4_config (connection);
 	g_assert (s_ip4);
 	g_assert_cmpstr (nm_setting_ip_config_get_method (s_ip4), ==, NM_SETTING_IP4_CONFIG_METHOD_MANUAL);
+	g_assert_cmpint (nm_setting_ip_config_get_dad_timeout (s_ip4), ==, 2000);
 
 	/* IP addresses */
 	g_assert_cmpint (nm_setting_ip_config_get_num_addresses (s_ip4), ==, 3);
@@ -4764,6 +4765,7 @@ test_write_wired_static_routes (void)
 	g_object_set (s_ip4,
 	              NM_SETTING_IP_CONFIG_METHOD, NM_SETTING_IP4_CONFIG_METHOD_MANUAL,
 	              NM_SETTING_IP_CONFIG_GATEWAY, "1.1.1.1",
+	              NM_SETTING_IP_CONFIG_DAD_TIMEOUT, 400,
 	              NULL);
 
 	addr = nm_ip_address_new (AF_INET, "1.1.1.3", 24, &error);