Merge remote-tracking branch 'origin/master' into gcc-9

83 files changed, 1210 insertions, 319 deletions

diff --git a/pkgs/tools/networking/6tunnel/default.nix b/pkgs/tools/networking/6tunnel/default.nix
new file mode 100644
index 00000000000..bf0e8ba3316
--- /dev/null
+++ b/pkgs/tools/networking/6tunnel/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, lib, fetchFromGitHub, autoreconfHook }:
+
+stdenv.mkDerivation rec {
+  pname = "6tunnel";
+  version = "0.13";
+
+  src = fetchFromGitHub {
+    owner = "wojtekka";
+    repo = pname;
+    rev = version;
+    sha256 = "0zsx9d6xz5w8zvrqsm8r625gpbqqhjzvjdzc3z8yix668yg8ff8h";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  meta = with lib; {
+    description = "Tunnelling for application that don't speak IPv6";
+    homepage = "https://github.com/wojtekka/6tunnel";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ filalex77 ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/networking/aircrack-ng/default.nix b/pkgs/tools/networking/aircrack-ng/default.nix
index f367d2817cd..9d948eaf822 100644
--- a/pkgs/tools/networking/aircrack-ng/default.nix
+++ b/pkgs/tools/networking/aircrack-ng/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, libpcap, openssl, zlib, wirelesstools
 , iw, ethtool, pciutils, libnl, pkgconfig, makeWrapper
-, autoreconfHook }:
+, autoreconfHook, usbutils }:
 
 stdenv.mkDerivation rec {
   name = "aircrack-ng-1.5.2";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     wrapProgram $out/bin/airmon-ng --prefix PATH : ${stdenv.lib.makeBinPath [
-      ethtool iw pciutils
+      ethtool iw pciutils usbutils
     ]}
   '';
 
diff --git a/pkgs/tools/networking/argus/default.nix b/pkgs/tools/networking/argus/default.nix
index 72c0a78a447..bb9abccc933 100644
--- a/pkgs/tools/networking/argus/default.nix
+++ b/pkgs/tools/networking/argus/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, libpcap, bison, flex, cyrus_sasl, tcp_wrappers,
-  pkgconfig, procps, which, wget, lsof, net_snmp, perl }:
+  pkgconfig, procps, which, wget, lsof, net-snmp, perl }:
 
 stdenv.mkDerivation rec {
   pname = "argus";
@@ -10,9 +10,9 @@ stdenv.mkDerivation rec {
     sha256 = "1zzf688dbbcb5z2r9v1p28rddns6znzx35nc05ygza6lp7aknkna";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libpcap bison cyrus_sasl tcp_wrappers flex ];
-  propagatedBuildInputs = [ procps which wget lsof net_snmp ];
+  nativeBuildInputs = [ pkgconfig bison flex ];
+  buildInputs = [ libpcap cyrus_sasl tcp_wrappers ];
+  propagatedBuildInputs = [ procps which wget lsof net-snmp ];
 
   patchPhase = ''
      substituteInPlace events/argus-extip.pl \
@@ -23,8 +23,8 @@ stdenv.mkDerivation rec {
     substituteInPlace events/argus-vmstat.sh \
       --replace vm_stat ${procps}/bin/vmstat
     substituteInPlace events/argus-snmp.sh \
-      --replace /usr/bin/snmpget ${net_snmp}/bin/snmpget \
-      --replace /usr/bin/snmpwalk ${net_snmp}/bin/snmpwalk
+      --replace /usr/bin/snmpget ${stdenv.lib.getBin net-snmp}/bin/snmpget \
+      --replace /usr/bin/snmpwalk ${stdenv.lib.getBin net-snmp}/bin/snmpwalk
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/aria2/default.nix b/pkgs/tools/networking/aria2/default.nix
index e086105e19e..0b4d77881b4 100644
--- a/pkgs/tools/networking/aria2/default.nix
+++ b/pkgs/tools/networking/aria2/default.nix
@@ -6,23 +6,15 @@
 
 stdenv.mkDerivation rec {
   pname = "aria2";
-  version = "1.34.0";
+  version = "1.35.0";
 
   src = fetchFromGitHub {
     owner = "aria2";
     repo = "aria2";
     rev = "release-${version}";
-    sha256 = "0hwqnjyszasr6049vr5mn48slb48v5kw39cbpbxa68ggmhj9bw6m";
+    sha256 = "195r3711ly3drf9jkygwdc2m7q99hiqlfrig3ip1127b837gzsf9";
   };
 
-  patches = [
-    # Remove with 1.35.0.
-    (fetchpatch {
-      url = https://github.com/aria2/aria2/commit/e8e04d6f22a507e8374651d3d2343cd9fb986993.patch;
-      sha256 = "1v27nqbsdjgg3ga4n0v9daq21m3cmdpy7d08kp32200pzag87f4y";
-    })
-  ];
-
   nativeBuildInputs = [ pkgconfig autoreconfHook sphinx ];
 
   buildInputs = [ openssl c-ares libxml2 sqlite zlib libssh2 ] ++
@@ -44,6 +36,6 @@ stdenv.mkDerivation rec {
     description = "A lightweight, multi-protocol, multi-source, command-line download utility";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ koral ];
+    maintainers = with maintainers; [ filalex77 koral ];
   };
 }
diff --git a/pkgs/tools/networking/babeld/default.nix b/pkgs/tools/networking/babeld/default.nix
index 2ff127f3e68..5fccd9c0ebc 100644
--- a/pkgs/tools/networking/babeld/default.nix
+++ b/pkgs/tools/networking/babeld/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     homepage = http://www.pps.univ-paris-diderot.fr/~jch/software/babel/;
     description = "Loop-avoiding distance-vector routing protocol";
     license = stdenv.lib.licenses.mit;
-    maintainers = with stdenv.lib.maintainers; [ fuuzetsu fpletz ];
+    maintainers = with stdenv.lib.maintainers; [ fpletz ];
     platforms = with stdenv.lib.platforms; linux;
   };
 }
diff --git a/pkgs/tools/networking/bgpdump/default.nix b/pkgs/tools/networking/bgpdump/default.nix
index 2f74ac713d7..3c84de29bf1 100644
--- a/pkgs/tools/networking/bgpdump/default.nix
+++ b/pkgs/tools/networking/bgpdump/default.nix
@@ -1,18 +1,19 @@
-{ stdenv, fetchzip, autoreconfHook, zlib, bzip2 }:
+{ stdenv, fetchurl, autoreconfHook, zlib, bzip2 }:
 
-stdenv.mkDerivation {
-  name = "bgpdump-2017-09-29";
+stdenv.mkDerivation rec {
+  pname = "bgpdump";
+  version = "1.6.0";
 
-  src = fetchzip {
-    url = "https://bitbucket.org/ripencc/bgpdump/get/94a0e724b335.zip";
-    sha256 = "09g9vz2zc4nyzl669w1j7fxw21ifja6dxbp0xbqh6n7w3gpx2g88";
+  src = fetchurl {
+    url = "https://ris.ripe.net/source/bgpdump/libbgpdump-1.6.0.tgz";
+    sha256 = "144369gj35mf63nz4idqwsvgsirw7fybm8kkk07yymrjp8jr3aqk";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ zlib bzip2 ];
 
   meta = {
-    homepage = https://bitbucket.org/ripencc/bgpdump/wiki/Home;
+    homepage = https://bitbucket.org/ripencc/bgpdump/;
     description = ''Analyze dump files produced by Zebra/Quagga or MRT'';
     license = stdenv.lib.licenses.hpnd;
     maintainers = with stdenv.lib.maintainers; [ lewo ];
diff --git a/pkgs/tools/networking/cadaver/default.nix b/pkgs/tools/networking/cadaver/default.nix
index 75a05108b8b..95012208129 100644
--- a/pkgs/tools/networking/cadaver/default.nix
+++ b/pkgs/tools/networking/cadaver/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, openssl }:
+{ stdenv, fetchurl, fetchpatch, openssl, readline }:
 
 stdenv.mkDerivation rec {
   name = "cadaver-0.23.3";
@@ -16,9 +16,9 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  configureFlags = [ "--with-ssl" ];
+  configureFlags = [ "--with-ssl" "--with-readline" ];
 
-  buildInputs = [ openssl ];
+  buildInputs = [ openssl readline ];
 
   meta = with stdenv.lib; {
     description = "A command-line WebDAV client";
diff --git a/pkgs/tools/networking/chrony/allow-clock_adjtime.patch b/pkgs/tools/networking/chrony/allow-clock_adjtime.patch
new file mode 100644
index 00000000000..2fa3baca722
--- /dev/null
+++ b/pkgs/tools/networking/chrony/allow-clock_adjtime.patch
@@ -0,0 +1,26 @@
+From 0cf506c92967c84f9ed83ba9e1be946a7fda6425 Mon Sep 17 00:00:00 2001
+From: Miroslav Lichvar <mlichvar@redhat.com>
+Date: Mon, 2 Dec 2019 12:47:13 +0100
+Subject: sys_linux: allow clock_adjtime in seccomp filter
+
+The adjtimex() function in glibc was switched to the clock_adjtime
+system call.
+
+diff --git a/sys_linux.c b/sys_linux.c
+index 63eb8f1..fcf89c2 100644
+--- a/sys_linux.c
++++ b/sys_linux.c
+@@ -478,8 +478,8 @@ SYS_Linux_EnableSystemCallFilter(int level)
+ {
+   const int syscalls[] = {
+     /* Clock */
+-    SCMP_SYS(adjtimex), SCMP_SYS(clock_gettime), SCMP_SYS(gettimeofday),
+-    SCMP_SYS(settimeofday), SCMP_SYS(time),
++    SCMP_SYS(adjtimex), SCMP_SYS(clock_adjtime), SCMP_SYS(clock_gettime),
++    SCMP_SYS(gettimeofday), SCMP_SYS(settimeofday), SCMP_SYS(time),
+     /* Process */
+     SCMP_SYS(clone), SCMP_SYS(exit), SCMP_SYS(exit_group), SCMP_SYS(getpid),
+     SCMP_SYS(getrlimit), SCMP_SYS(rt_sigaction), SCMP_SYS(rt_sigreturn),
+-- 
+cgit v0.10.2
+
diff --git a/pkgs/tools/networking/chrony/default.nix b/pkgs/tools/networking/chrony/default.nix
index 69c4f897c93..c0c3281431f 100644
--- a/pkgs/tools/networking/chrony/default.nix
+++ b/pkgs/tools/networking/chrony/default.nix
@@ -12,6 +12,11 @@ stdenv.mkDerivation rec {
     sha256 = "1d9r2dhslll4kzdmxrj0qfgwq1b30d4l3s5cwr8yr93029dpj0jf";
   };
 
+  patches = [
+    ./allow-clock_adjtime.patch
+    ./fix-seccomp-build.patch
+  ];
+
   postPatch = ''
     patchShebangs test
   '';
diff --git a/pkgs/tools/networking/chrony/fix-seccomp-build.patch b/pkgs/tools/networking/chrony/fix-seccomp-build.patch
new file mode 100644
index 00000000000..6888e7efeb7
--- /dev/null
+++ b/pkgs/tools/networking/chrony/fix-seccomp-build.patch
@@ -0,0 +1,13 @@
+diff --git a/sys_linux.c b/sys_linux.c
+index 898dc7a7f75..fcd334ecf03 100644
+--- a/sys_linux.c
++++ b/sys_linux.c
+@@ -503,7 +503,7 @@ SYS_Linux_EnableSystemCallFilter(int level)
+     SCMP_SYS(socketcall),
+     /* General I/O */
+     SCMP_SYS(_newselect), SCMP_SYS(close), SCMP_SYS(open), SCMP_SYS(openat), SCMP_SYS(pipe),
+-    SCMP_SYS(pipe2), SCMP_SYS(poll), SCMP_SYS(ppoll), SCMP_SYS(pselect6), SCMP_SYS(read),
++    SCMP_SYS(pipe2), SCMP_SYS(poll), SCMP_SYS(pselect6), SCMP_SYS(read),
+     SCMP_SYS(futex), SCMP_SYS(select), SCMP_SYS(set_robust_list), SCMP_SYS(write),
+     /* Miscellaneous */
+     SCMP_SYS(getrandom), SCMP_SYS(sysinfo), SCMP_SYS(uname),
diff --git a/pkgs/tools/networking/circus/default.nix b/pkgs/tools/networking/circus/default.nix
new file mode 100644
index 00000000000..10edc92a995
--- /dev/null
+++ b/pkgs/tools/networking/circus/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, python3Packages }:
+
+let
+  inherit (python3Packages) buildPythonApplication fetchPypi iowait psutil pyzmq tornado_4 mock;
+in
+
+buildPythonApplication rec {
+  pname = "circus";
+  version = "0.15.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "d1603cf4c4f620ce6593d3d2a67fad25bf0242183ea24110d8bb1c8079c55d1b";
+  };
+
+  postPatch = ''
+    # relax version restrictions to fix build
+    substituteInPlace setup.py \
+      --replace "pyzmq>=13.1.0,<17.0" "pyzmq>13.1.0"
+  '';
+
+  checkInputs = [ mock ];
+
+  doCheck = false; # weird error
+
+  propagatedBuildInputs = [ iowait psutil pyzmq tornado_4 ];
+
+  meta = with stdenv.lib; {
+    description = "A process and socket manager";
+    homepage = "https://github.circus.com/circus-tent/circus";
+    license = licenses.asl20;
+  };
+}
diff --git a/pkgs/tools/networking/cloud-custodian/default.nix b/pkgs/tools/networking/cloud-custodian/default.nix
new file mode 100644
index 00000000000..a57d9f13d78
--- /dev/null
+++ b/pkgs/tools/networking/cloud-custodian/default.nix
@@ -0,0 +1,48 @@
+{ lib, buildPythonApplication, fetchPypi
+, argcomplete
+, boto3
+, botocore
+, certifi
+, dateutil
+, jsonpatch
+, jsonschema
+, pyyaml
+, tabulate
+, urllib3
+}:
+
+buildPythonApplication rec {
+  pname = "cloud-custodian";
+  version = "0.8.45.1";
+
+  src = fetchPypi {
+    pname = "c7n";
+    inherit version;
+    sha256 = "0c199gdmpm83xfghrbzp02xliyxiygsnx2fvb35j9qpf37wzzp3z";
+  };
+
+  propagatedBuildInputs = [
+    argcomplete
+    boto3
+    botocore
+    certifi
+    dateutil
+    jsonpatch
+    jsonschema
+    pyyaml
+    tabulate
+    urllib3
+  ];
+
+  # Requires tox, many packages, and network access
+  checkPhase = ''
+    $out/bin/custodian --help
+  '';
+
+  meta = with lib; {
+    description = "Rules engine for cloud security, cost optimization, and governance";
+    homepage = "https://cloudcustodian.io";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ bhipple ];
+  };
+}
diff --git a/pkgs/tools/networking/connman/connman-notify/default.nix b/pkgs/tools/networking/connman/connman-notify/default.nix
index 0cb32ca415f..d17729c691d 100644
--- a/pkgs/tools/networking/connman/connman-notify/default.nix
+++ b/pkgs/tools/networking/connman/connman-notify/default.nix
@@ -1,38 +1,34 @@
-{ stdenv, fetchFromGitHub, pythonPackages, makeWrapper }:
+{ stdenv, fetchFromGitLab, python3Packages, glib, gobject-introspection, wrapGAppsHook }:
 
-stdenv.mkDerivation {
+python3Packages.buildPythonApplication {
   pname = "connman-notify";
-  version = "2014-06-23";
+  version = "2019-10-05";
 
-  src = fetchFromGitHub {
+  src = fetchFromGitLab {
     owner = "wavexx";
     repo = "connman-notify";
-    rev = "0ed9b5e4a0e1f03c83c4589cabf410cac66cd11d";
-    sha256 = "0lhk417fdg3qxs1marpqp277bdxhwnbyrld9xj224bfk5v7xi4bg";
+    rev = "24b10a51721b54d932f4cd61ef2756423768c015";
+    sha256 = "1k5b5y6114yna2cm0cq82xilicran63hrhlklgv7k3p89057xh8j";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  format = "other";
 
-  buildInputs = [
-    pythonPackages.python
-    pythonPackages.dbus-python
-    pythonPackages.pygobject2
-    pythonPackages.pygtk
-    pythonPackages.notify
-  ];
+  nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
+
+  buildInputs = [ glib ];
+
+  pythonPath = with python3Packages; [ dbus-python pygobject3 ];
+
+  strictDeps = false;
 
   installPhase = ''
-    mkdir -p $out/bin
-    cp -vai connman-notify $out/bin/
+    install -D -t $out/bin connman-notify
+    install -D -t $out/share/doc README.rst
   '';
 
-  preFixup = ''
-    wrapProgram $out/bin/connman-notify --prefix PYTHONPATH : "$PYTHONPATH"
-  '';  
-
   meta = with stdenv.lib; {
     description = "Desktop notification integration for connman";
-    homepage = https://github.com/wavexx/connman-notify;
+    homepage = https://gitlab.com/wavexx/connman-notify;
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = [ maintainers.romildo ];
diff --git a/pkgs/tools/networking/croc/default.nix b/pkgs/tools/networking/croc/default.nix
index b23b5a17e1f..fee1e9ee3ac 100644
--- a/pkgs/tools/networking/croc/default.nix
+++ b/pkgs/tools/networking/croc/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "croc";
-  version = "6.2.0";
+  version = "6.4.8";
 
   goPackagePath = "github.com/schollz/croc";
 
@@ -10,17 +10,17 @@ buildGoModule rec {
     owner = "schollz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0pav0l7akzqgwj7yqkgbpl96kndlb41kg1vmb3g6xp7ykmbdsbbc";
+    sha256 = "03wm7agjwky9ma321x6as76rg053cagmni9ygwls82jjs2pvv0bv";
   };
 
-  modSha256 = "02w4p877nvv7dril7l9nmj8xf3fnghxnj8kglxkv541vabvlpq03";
+  modSha256 = "011pcmfih8lg8l7hwdsq51p5brnhsddzv7mvsaw5sfv8nq9p8zc2";
   subPackages = [ "." ];
 
   meta = with stdenv.lib; {
     description = "Easily and securely send things from one computer to another";
     homepage = https://github.com/schollz/croc;
     license = licenses.mit;
-    maintainers = with maintainers; [ hugoreeves ];
+    maintainers = with maintainers; [ hugoreeves equirosa ];
 
     longDescription = ''
       Croc is a command line tool written in Go that allows any two computers to
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 817f3ccf19b..051271e9788 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -5,6 +5,7 @@
 , zlibSupport ? true, zlib ? null
 , sslSupport ? zlibSupport, openssl ? null
 , gnutlsSupport ? false, gnutls ? null
+, wolfsslSupport ? false, wolfssl ? null
 , scpSupport ? zlibSupport && !stdenv.isSunOS && !stdenv.isCygwin, libssh2 ? null
 , gssSupport ? !stdenv.hostPlatform.isWindows, libkrb5 ? null
 , c-aresSupport ? false, c-ares ? null
@@ -17,21 +18,24 @@ assert ldapSupport -> openldap != null;
 assert zlibSupport -> zlib != null;
 assert sslSupport -> openssl != null;
 assert !(gnutlsSupport && sslSupport);
+assert !(gnutlsSupport && wolfsslSupport);
+assert !(sslSupport && wolfsslSupport);
 assert gnutlsSupport -> gnutls != null;
+assert wolfsslSupport -> wolfssl != null;
 assert scpSupport -> libssh2 != null;
 assert c-aresSupport -> c-ares != null;
 assert brotliSupport -> brotli != null;
 assert gssSupport -> libkrb5 != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.66.0";
+  name = "curl-7.67.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${name}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] name}/${name}.tar.bz2"
     ];
-    sha256 = "0hd1wwplw357hn876s4n2gk7dpmd1gfw5d2c3yi21i1m09726636";
+    sha256 = "0v2qb1c82m3qzkiyglsg1745qi791i9pl1jgnks8nm0sh9b6jpyx";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
@@ -53,6 +57,7 @@ stdenv.mkDerivation rec {
     optional c-aresSupport c-ares ++
     optional sslSupport openssl ++
     optional gnutlsSupport gnutls ++
+    optional wolfsslSupport wolfssl ++
     optional scpSupport libssh2 ++
     optional brotliSupport brotli;
 
@@ -67,7 +72,8 @@ stdenv.mkDerivation rec {
       # to nss-cacert from the default profile.
       "--without-ca-bundle"
       "--without-ca-path"
-      "--with-ca-fallback"
+      # The build fails when using wolfssl with --with-ca-fallback
+      ( if wolfsslSupport then "--without-ca-fallback" else "--with-ca-fallback")
       "--disable-manual"
       ( if sslSupport then "--with-ssl=${openssl.dev}" else "--without-ssl" )
       ( if gnutlsSupport then "--with-gnutls=${gnutls.dev}" else "--without-gnutls" )
@@ -77,6 +83,7 @@ stdenv.mkDerivation rec {
       ( if idnSupport then "--with-libidn=${libidn.dev}" else "--without-libidn" )
       ( if brotliSupport then "--with-brotli" else "--without-brotli" )
     ]
+    ++ stdenv.lib.optional wolfsslSupport "--with-wolfssl=${wolfssl.dev}"
     ++ stdenv.lib.optional c-aresSupport "--enable-ares=${c-ares}"
     ++ stdenv.lib.optional gssSupport "--with-gssapi=${libkrb5.dev}"
        # For the 'urandom', maybe it should be a cross-system option
diff --git a/pkgs/tools/networking/curlie/default.nix b/pkgs/tools/networking/curlie/default.nix
index 2073c0b8497..fa1471aa620 100644
--- a/pkgs/tools/networking/curlie/default.nix
+++ b/pkgs/tools/networking/curlie/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "curlie";
-  version = "1.2.0";
+  version = "1.3.1";
 
   src= fetchFromGitHub {
     owner = "rs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0jgwd1amwjpmfgg08j9m9i15rpxijhmld9najzqb2gf8c1n5d8cf";
+    sha256 = "09v8alrbw6qva3q3bcqxnyjm7svagfxqvhdff7cqf5pbmkxnhln9";
   };
 
   modSha256 = "18nwq99vv3nbdwfilfn8v64mn58jviwybi93li0lcg7779nxab3d";
diff --git a/pkgs/tools/networking/dd-agent/datadog-agent.nix b/pkgs/tools/networking/dd-agent/datadog-agent.nix
index a83274188c0..2253daa2d11 100644
--- a/pkgs/tools/networking/dd-agent/datadog-agent.nix
+++ b/pkgs/tools/networking/dd-agent/datadog-agent.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, buildGoPackage, makeWrapper, pythonPackages, pkgconfig, systemd, hostname }:
+{ lib, stdenv, fetchFromGitHub, buildGoPackage, makeWrapper, pythonPackages, pkgconfig, systemd, hostname, extraTags ? [] }:
 
 let
   # keep this in sync with github.com/DataDog/agent-payload dependency
@@ -42,7 +42,7 @@ in buildGoPackage rec {
       "-r ${python}/lib"
     ];
   in ''
-    buildFlagsArray=( "-tags" "ec2 systemd cpython process log" "-ldflags" "${ldFlags}")
+    buildFlagsArray=( "-tags" "ec2 systemd cpython process log secrets ${lib.concatStringsSep " " extraTags}" "-ldflags" "${ldFlags}")
   '';
 
   # DataDog use paths relative to the agent binary, so fix these.
diff --git a/pkgs/tools/networking/dhcpcd/default.nix b/pkgs/tools/networking/dhcpcd/default.nix
index 0827f2eac7b..d63c63ab1d2 100644
--- a/pkgs/tools/networking/dhcpcd/default.nix
+++ b/pkgs/tools/networking/dhcpcd/default.nix
@@ -4,11 +4,11 @@ stdenv.mkDerivation rec {
   # when updating this to >=7, check, see previous reverts:
   # nix-build -A nixos.tests.networking.scripted.macvlan.x86_64-linux nixos/release-combined.nix
   pname = "dhcpcd";
-  version = "8.0.6";
+  version = "8.1.2";
 
   src = fetchurl {
     url = "mirror://roy/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0kxxpb79j564m6bjvjb9gsn0yzs13c0arfgsycm51gw3xnch3db6";
+    sha256 = "1b9mihp1mf2vng92fgks764a6pwf2gx7ccw6knja79c42nmyglyb";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
new file mode 100644
index 00000000000..6554dd465d4
--- /dev/null
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchFromGitHub, buildGoModule }:
+
+buildGoModule rec {
+  pname = "dnsproxy";
+  version = "0.20.0";
+
+  src = fetchFromGitHub {
+    owner = "AdguardTeam";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0yd3d90ssdzpbsdq068dvsi0r1z2rlv3wpbmpkhfgpxmwrvdanrq";
+  };
+
+  modSha256 = "0cqwkmhajp3py3b5aj3qz9480qy2ws0vy1gk21bxjm56wqxl2gf0";
+
+  meta = with stdenv.lib; {
+    description = "Simple DNS proxy with DoH, DoT, and DNSCrypt support";
+    homepage = "https://github.com/AdguardTeam/dnsproxy";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ contrun ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/networking/ferm/default.nix b/pkgs/tools/networking/ferm/default.nix
index 2cf111e8ccf..6f1660484e7 100644
--- a/pkgs/tools/networking/ferm/default.nix
+++ b/pkgs/tools/networking/ferm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper, perl, ebtables, ipset, iptables }:
+{ stdenv, fetchurl, makeWrapper, perl, ebtables, ipset, iptables, nixosTests }:
 
 stdenv.mkDerivation rec {
   version = "2.4.1";
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru.tests.ferm = nixosTests.ferm;
+
   meta = {
     homepage = http://ferm.foo-projects.org/;
     description = "Tool to maintain complex firewalls";
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
new file mode 100644
index 00000000000..87932cd02bd
--- /dev/null
+++ b/pkgs/tools/networking/frp/default.nix
@@ -0,0 +1,31 @@
+{ buildGoModule, lib, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "frp";
+  version = "0.30.0";
+
+  src = fetchFromGitHub {
+    owner = "fatedier";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "15q2lfwqyicgllhh5fn3a8g3iw9m42cd0izb99a24hn57pd9cr0n";
+  };
+
+  modSha256 = "1zbl0gfc99pbzdacxhfa1k3y6i7v13sb441wpbp9aygxhvwqrms9";
+
+  subPackages = [ "cmd/frpc" "cmd/frps" ];
+
+  meta = with lib; {
+    description = "Fast reverse proxy";
+    longDescription = ''
+      frp is a fast reverse proxy to help you expose a local server behind a
+      NAT or firewall to the Internet. As of now, it supports TCP and UDP, as
+      well as HTTP and HTTPS protocols, where requests can be forwarded to
+      internal services by domain name. frp also has a P2P connect mode.
+    '';
+    homepage = "https://github.com/fatedier/frp";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ filalex77 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/networking/gmrender-resurrect/default.nix b/pkgs/tools/networking/gmrender-resurrect/default.nix
index be1ca9f265d..d942dce6a19 100644
--- a/pkgs/tools/networking/gmrender-resurrect/default.nix
+++ b/pkgs/tools/networking/gmrender-resurrect/default.nix
@@ -1,38 +1,38 @@
-{ stdenv, fetchFromGitHub, autoconf, automake, pkgconfig, makeWrapper
-, gstreamer, gst-plugins-base, gst-plugins-good, gst-plugins-bad, gst-plugins-ugly, gst-libav, libupnp }:
-
-let version = "4f221e6b85abf85957b547436e982d7a501a1718"; in
-
-stdenv.mkDerivation {
-  pname = "gmrender-resurrect";
-  inherit version;
-
-  src = fetchFromGitHub {
-    owner = "hzeller";
-    repo = "gmrender-resurrect";
-    rev = version;
-    sha256 = "1dmdhyz27bh74qmvncfd3kw7zqwnd05bhxcfjjav98z5qrxdygj4";
-  };
-
-  preConfigurePhases = "autoconfPhase";
-
-  autoconfPhase = "./autogen.sh";
-
-  buildInputs = [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav libupnp ];
-  nativeBuildInputs = [ autoconf automake pkgconfig makeWrapper ];
-
-  postInstall = ''
-    for prog in "$out/bin/"*; do
-        wrapProgram "$prog" --suffix GST_PLUGIN_SYSTEM_PATH : "${gst-plugins-base}/lib/gstreamer-1.0:${gst-plugins-good}/lib/gstreamer-1.0:${gst-plugins-bad}/lib/gstreamer-1.0:${gst-plugins-ugly}/lib/gstreamer-1.0:${gst-libav}/lib/gstreamer-1.0"
-    done
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Resource efficient UPnP/DLNA renderer, optimal for Raspberry Pi, CuBox or a general MediaServer";
-    homepage = https://github.com/hzeller/gmrender-resurrect;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    broken = true;
-    maintainers = [ maintainers.koral ];
-  };
-}
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, makeWrapper, gstreamer
+, gst-plugins-base, gst-plugins-good, gst-plugins-bad, gst-plugins-ugly, gst-libav, libupnp }:
+
+let
+  version = "0.0.8";
+
+  makePluginPath = plugins: builtins.concatStringsSep ":" (map (p: p + "/lib/gstreamer-1.0") plugins);
+
+  pluginPath = makePluginPath [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav ];
+in
+  stdenv.mkDerivation {
+    pname = "gmrender-resurrect";
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "hzeller";
+      repo = "gmrender-resurrect";
+      rev = "v${version}";
+      sha256 = "14i5jrry6qiap5l2x2jqj7arymllajl3wgnk29ccvr8d45zp4jn1";
+    };
+
+    buildInputs = [ gstreamer libupnp ];
+    nativeBuildInputs = [ autoreconfHook pkgconfig makeWrapper ];
+
+    postInstall = ''
+      for prog in "$out/bin/"*; do
+          wrapProgram "$prog" --suffix GST_PLUGIN_SYSTEM_PATH_1_0 : "${pluginPath}"
+      done
+    '';
+
+    meta = with stdenv.lib; {
+      description = "Resource efficient UPnP/DLNA renderer, optimal for Raspberry Pi, CuBox or a general MediaServer";
+      homepage = https://github.com/hzeller/gmrender-resurrect;
+      license = licenses.gpl2;
+      platforms = platforms.linux;
+      maintainers = with maintainers; [ koral ashkitten ];
+    };
+  }
diff --git a/pkgs/tools/networking/gnirehtet/default.nix b/pkgs/tools/networking/gnirehtet/default.nix
index 37d2eea825f..06faa064025 100644
--- a/pkgs/tools/networking/gnirehtet/default.nix
+++ b/pkgs/tools/networking/gnirehtet/default.nix
@@ -1,12 +1,12 @@
 {stdenv, rustPlatform, fetchFromGitHub, fetchzip, androidenv, substituteAll}:
 let
-version = "2.3";
+version = "2.4";
 apk = stdenv.mkDerivation {
   pname = "gnirehtet.apk";
   inherit version;
   src = fetchzip {
     url = "https://github.com/Genymobile/gnirehtet/releases/download/v${version}/gnirehtet-rust-linux64-v${version}.zip";
-    sha256 = "08pgmpbz82cd8ndr2syiv25l5xk1gvh9gzji4pgva5gw269bjmpz";
+    sha256 = "13gsh5982v961j86j5y71pgas94g2d1v1fgnbslbqw4h69fbf48g";
   };
   installPhase = ''
     mkdir $out
@@ -22,10 +22,10 @@ rustPlatform.buildRustPackage {
       owner = "Genymobile";
       repo = "gnirehtet";
       rev = "v${version}";
-      sha256 = "118ig42qzr2xyra7r8zfxq38xidaxfc98ja9836jwnn9fgbigczr";
+      sha256 = "1c99d6zpjxa8xlrg0n1825am20d2pjiicfcjwv8iay9ylfdnvygl";
   };
   sourceRoot = "source/relay-rust";
-  cargoSha256 = "1500lfwbfnc0k2hn7r1n629fq11zfqm3fg13dddmhchq4i3sqkfb";
+  cargoSha256 = "1l1cirhmfkpa466vksynlhwggsfiahws7cpsxydrc414l415l283";
 
   patchFlags = [ "-p2" ];
   patches = [
diff --git a/pkgs/tools/networking/haproxy/default.nix b/pkgs/tools/networking/haproxy/default.nix
index d8711d516dc..95457b01205 100644
--- a/pkgs/tools/networking/haproxy/default.nix
+++ b/pkgs/tools/networking/haproxy/default.nix
@@ -1,7 +1,9 @@
 { useLua ? !stdenv.isDarwin
 , usePcre ? true
-, stdenv, fetchurl
-, openssl, zlib, lua5_3 ? null, pcre ? null
+, withPrometheusExporter ? true
+, stdenv, lib, fetchurl
+, openssl, zlib
+, lua5_3 ? null, pcre ? null, systemd ? null
 }:
 
 assert useLua -> lua5_3 != null;
@@ -9,39 +11,47 @@ assert usePcre -> pcre != null;
 
 stdenv.mkDerivation rec {
   pname = "haproxy";
-  version = "1.9.8";
+  version = "2.0.10";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${stdenv.lib.versions.majorMinor version}/src/${pname}-${version}.tar.gz";
-    sha256 = "1via9k84ycrdr8qh4qchcbqgpv0gynm3ra23nwsvqwfqvc0376id";
+    sha256 = "1sm42q9l159pdmjs5dg544z10dn6x073caljkqh0p4syshysnf0x";
   };
 
   buildInputs = [ openssl zlib ]
-    ++ stdenv.lib.optional useLua lua5_3
-    ++ stdenv.lib.optional usePcre pcre;
+    ++ lib.optional useLua lua5_3
+    ++ lib.optional usePcre pcre
+    ++ lib.optional stdenv.isLinux systemd;
 
   # TODO: make it work on bsd as well
   makeFlags = [
     "PREFIX=\${out}"
     ("TARGET=" + (if stdenv.isSunOS  then "solaris"
-             else if stdenv.isLinux  then "linux2628"
+             else if stdenv.isLinux  then "linux-glibc"
              else if stdenv.isDarwin then "osx"
              else "generic"))
   ];
+
   buildFlags = [
     "USE_OPENSSL=yes"
     "USE_ZLIB=yes"
-  ] ++ stdenv.lib.optionals usePcre [
+  ] ++ lib.optionals usePcre [
     "USE_PCRE=yes"
     "USE_PCRE_JIT=yes"
-  ] ++ stdenv.lib.optionals useLua [
+  ] ++ lib.optionals useLua [
     "USE_LUA=yes"
     "LUA_LIB=${lua5_3}/lib"
     "LUA_INC=${lua5_3}/include"
-  ] ++ stdenv.lib.optional stdenv.isDarwin "CC=cc"
-    ++ stdenv.lib.optional stdenv.isLinux "USE_GETADDRINFO=1";
+  ] ++ lib.optionals stdenv.isLinux [
+    "USE_SYSTEMD=yes"
+    "USE_GETADDRINFO=1"
+  ] ++ lib.optionals withPrometheusExporter [
+    "EXTRA_OBJS=contrib/prometheus-exporter/service-prometheus.o"
+  ] ++ lib.optional stdenv.isDarwin "CC=cc";
+
+  enableParallelBuilding = true;
 
-  meta = {
+  meta = with lib; {
     description = "Reliable, high performance TCP/HTTP load balancer";
     longDescription = ''
       HAProxy is a free, very fast and reliable solution offering high
@@ -51,9 +61,9 @@ stdenv.mkDerivation rec {
       tens of thousands of connections is clearly realistic with todays
       hardware.
     '';
-    homepage = http://haproxy.1wt.eu;
-    maintainers = with stdenv.lib.maintainers; [ fuzzy-id ];
-    platforms = with stdenv.lib.platforms; linux ++ darwin;
-    license = stdenv.lib.licenses.gpl2;
+    homepage = "https://haproxy.org";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ fuzzy-id ];
+    platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/tools/networking/http-prompt/default.nix b/pkgs/tools/networking/http-prompt/default.nix
index 049fb7a1a6e..9ed2f000f32 100644
--- a/pkgs/tools/networking/http-prompt/default.nix
+++ b/pkgs/tools/networking/http-prompt/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchFromGitHub, pythonPackages, httpie }:
+{ stdenv, fetchFromGitHub, python3Packages, httpie }:
 
-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "http-prompt";
   version = "1.0.0";
 
@@ -11,11 +11,11 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "0kngz2izcqjphbrdkg489p0xmf65xjc8ki1a2szcc8sgwc7z74xy";
   };
 
-  propagatedBuildInputs = with pythonPackages; [
+  propagatedBuildInputs = with python3Packages; [
     click
     httpie
     parsimonious
-    prompt_toolkit
+    (python.pkgs.callPackage ../../../development/python-modules/prompt_toolkit/1.nix {})
     pygments
     six
   ];
@@ -30,6 +30,5 @@ pythonPackages.buildPythonApplication rec {
     license = licenses.mit;
     maintainers = with maintainers; [ matthiasbeyer ];
     platforms = platforms.linux ++ platforms.darwin;
-    broken = true;
   };
 }
diff --git a/pkgs/tools/networking/i2pd/default.nix b/pkgs/tools/networking/i2pd/default.nix
index 10e821fa152..971d8e69686 100644
--- a/pkgs/tools/networking/i2pd/default.nix
+++ b/pkgs/tools/networking/i2pd/default.nix
@@ -9,13 +9,13 @@ assert upnpSupport -> miniupnpc != null;
 
 stdenv.mkDerivation rec {
   pname = "i2pd";
-  version = "2.28.0";
+  version = "2.29.0";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = pname;
     rev = version;
-    sha256 = "0pkqm5h3zvpbspj0xdc8j4yb1j2kc9gkw77mihc9g3rqifr7jvsv";
+    sha256 = "1issg3aidwikk4g12sa8q81zzp0hd0g8wdy2dx4899z8yrscl300";
   };
 
   buildInputs = with stdenv.lib; [ boost zlib openssl ]
diff --git a/pkgs/tools/networking/ifstat-legacy/default.nix b/pkgs/tools/networking/ifstat-legacy/default.nix
index 756e77f1157..72aaaa1e170 100644
--- a/pkgs/tools/networking/ifstat-legacy/default.nix
+++ b/pkgs/tools/networking/ifstat-legacy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoreconfHook, net_snmp }:
+{ stdenv, fetchurl, autoreconfHook, net-snmp }:
 
 stdenv.mkDerivation rec {
   pname = "ifstat-legacy";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "01zmv6vk5kh5xmd563xws8a1qnxjb6b6kv59yzz9r3rrghxhd6c5";
   };
 
-  buildInputs = [ net_snmp ];
+  buildInputs = [ net-snmp ];
 
   nativeBuildInputs = [ autoreconfHook ];
 
diff --git a/pkgs/tools/networking/iperf/3.nix b/pkgs/tools/networking/iperf/3.nix
index 4e2c27e2d40..c59eb09f4c5 100644
--- a/pkgs/tools/networking/iperf/3.nix
+++ b/pkgs/tools/networking/iperf/3.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     homepage = http://software.es.net/iperf/;
     description = "Tool to measure IP bandwidth using UDP or TCP";
     platforms = platforms.unix;
-    license = "as-is";
+    license = licenses.bsd3;
     maintainers = with maintainers; [ fpletz ];
   };
 }
diff --git a/pkgs/tools/networking/keepalived/default.nix b/pkgs/tools/networking/keepalived/default.nix
index 9ae981e0369..87748211425 100644
--- a/pkgs/tools/networking/keepalived/default.nix
+++ b/pkgs/tools/networking/keepalived/default.nix
@@ -1,24 +1,28 @@
-{ stdenv, fetchFromGitHub, libnfnetlink, libnl, net_snmp, openssl, pkgconfig }:
+{ stdenv, fetchFromGitHub, nixosTests
+, libnfnetlink, libnl, net-snmp, openssl
+, pkgconfig, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "keepalived";
-  version = "1.4.2";
+  version = "2.0.19";
 
   src = fetchFromGitHub {
     owner = "acassen";
     repo = "keepalived";
     rev = "v${version}";
-    sha256 = "154yxs6kwpi9yc4pa45ba3z3bfwzgmmmja5nk3d9mxq6w6s1swcy";
+    sha256 = "05jgr0f04z69x3zf3b9z04wczl15fnh69bs6j0yw55fij1k9nj4d";
   };
 
   buildInputs = [
     libnfnetlink
     libnl
-    net_snmp
+    net-snmp
     openssl
   ];
 
-  nativeBuildInputs = [ pkgconfig ];
+  passthru.tests.keepalived = nixosTests.keepalived;
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
 
   configureFlags = [
     "--enable-sha1"
diff --git a/pkgs/tools/networking/lftp/default.nix b/pkgs/tools/networking/lftp/default.nix
index 13bdbe17ff8..9a982e53825 100644
--- a/pkgs/tools/networking/lftp/default.nix
+++ b/pkgs/tools/networking/lftp/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lftp";
-  version = "4.8.4";
+  version = "4.9.0";
 
   src = fetchurl {
     urls = [
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
       "https://ftp.st.ryukoku.ac.jp/pub/network/ftp/lftp/${pname}-${version}.tar.xz"
       "https://lftp.yar.ru/ftp/${pname}-${version}.tar.xz"
       ];
-    sha256 = "0qks22357xv9y6ripmf5j2n5svh8j5z0yniphfk89sjwkqg2gg2f";
+    sha256 = "0km267h57mlrd7gnn9gf40znvb3irwfc0qaql8kii8v936g6afqb";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/networking/libreswan/default.nix b/pkgs/tools/networking/libreswan/default.nix
index dd0137a1463..e48f2d7aa5b 100644
--- a/pkgs/tools/networking/libreswan/default.nix
+++ b/pkgs/tools/networking/libreswan/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper,
   pkgconfig, systemd, gmp, unbound, bison, flex, pam, libevent, libcap_ng, curl, nspr,
   bash, iproute, iptables, procps, coreutils, gnused, gawk, nss, which, python,
-  docs ? false, xmlto
+  docs ? false, xmlto, libselinux, ldns
   }:
 
 let
   optional = stdenv.lib.optional;
-  version = "3.18";
+  version = "3.29";
   name = "libreswan-${version}";
   binPath = stdenv.lib.makeBinPath [
     bash iproute iptables procps coreutils gnused gawk nss.tools which python
@@ -14,6 +14,7 @@ let
 in
 
 assert docs -> xmlto != null;
+assert stdenv.isLinux -> libselinux != null;
 
 stdenv.mkDerivation {
   inherit name;
@@ -21,7 +22,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://download.libreswan.org/${name}.tar.gz";
-    sha256 = "0zginnakxw7m79zrdvfdvliaiyg78zgqfqkks9z5d1rjj5w13xig";
+    sha256 = "0gmbb1m5in5dvnbk1n31r8myrdankzvi6yk9gcqbcwijyih423nn";
   };
 
   # These flags were added to compile v3.18. Try to lift them when updating.
@@ -35,15 +36,21 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ makeWrapper pkgconfig ];
   buildInputs = [ bash iproute iptables systemd coreutils gnused gawk gmp unbound bison flex pam libevent
-                  libcap_ng curl nspr nss python ]
-                ++ optional docs xmlto;
+                  libcap_ng curl nspr nss python ldns ]
+                ++ optional docs xmlto
+                ++ optional stdenv.isLinux libselinux;
 
   prePatch = ''
     # Correct bash path
     sed -i -e 's|/bin/bash|/usr/bin/env bash|' mk/config.mk
 
-    # Fix systemd unit directory, and prevent the makefile from trying to reload the systemd daemon
-    sed -i -e 's|UNITDIR=.*$|UNITDIR=$\{out}/etc/systemd/system/|' -e 's|systemctl --system daemon-reload|true|' initsystems/systemd/Makefile
+    # Fix systemd unit directory, and prevent the makefile from trying to reload the
+    # systemd daemon or create tmpfiles
+    sed -i -e 's|UNITDIR=.*$|UNITDIR=$\{out}/etc/systemd/system/|g' \
+      -e 's|TMPFILESDIR=.*$|TMPFILESDIR=$\{out}/tmpfiles.d/|g' \
+      -e 's|systemctl|true|g' \
+      -e 's|systemd-tmpfiles|true|g' \
+      initsystems/systemd/Makefile
 
     # Fix the ipsec program from crushing the PATH
     sed -i -e 's|\(PATH=".*"\):.*$|\1:$PATH|' programs/ipsec/ipsec.in
@@ -52,8 +59,6 @@ stdenv.mkDerivation {
     sed -i -e 's|#!/usr/bin/python|#!/usr/bin/env python|' -e 's/^\(\W*\)installstartcheck()/\1sscmd = "ss"\n\0/' programs/verify/verify.in
   '';
 
-  patches = [ ./libreswan-3.18-glibc-2.26.patch ];
-
   # Set appropriate paths for build
   preBuild = "export INC_USRLOCAL=\${out}";
 
diff --git a/pkgs/tools/networking/libreswan/libreswan-3.18-glibc-2.26.patch b/pkgs/tools/networking/libreswan/libreswan-3.18-glibc-2.26.patch
deleted file mode 100644
index 33c44f617a0..00000000000
--- a/pkgs/tools/networking/libreswan/libreswan-3.18-glibc-2.26.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-diff --git a/lib/libswan/id.c b/lib/libswan/id.c
-index 8f06275..efb0394 100644
---- a/lib/libswan/id.c
-+++ b/lib/libswan/id.c
-@@ -22,6 +22,7 @@
- #include <sys/socket.h>
- #include <netinet/in.h>
- #include <arpa/inet.h>
-+#include <limits.h>
- #include <unistd.h>
- #ifndef HOST_NAME_MAX	/* POSIX 1003.1-2001 says <unistd.h> defines this */
- #define HOST_NAME_MAX 255	/* upper bound, according to SUSv2 */
-diff --git a/linux/include/libreswan.h b/linux/include/libreswan.h
-index c5efc6a..b0af4d7 100644
---- a/linux/include/libreswan.h
-+++ b/linux/include/libreswan.h
-@@ -211,6 +211,7 @@ static inline deltatime_t monotimediff(monotime_t a, monotime_t b) {
- #include <assert.h>
- #define user_assert(foo) assert(foo)
- #include <stdio.h>
-+#include <stdint.h>
- 
- #  define uint8_t u_int8_t
- #  define uint16_t u_int16_t
-diff --git a/programs/pluto/rcv_whack.c b/programs/pluto/rcv_whack.c
-index 588c66c..4fc6289 100644
---- a/programs/pluto/rcv_whack.c
-+++ b/programs/pluto/rcv_whack.c
-@@ -24,6 +24,7 @@
- #include <stddef.h>
- #include <stdlib.h>
- #include <string.h>
-+#include <limits.h>
- #include <unistd.h>
- #ifndef HOST_NAME_MAX           /* POSIX 1003.1-2001 says <unistd.h> defines this */
- # define HOST_NAME_MAX  255     /* upper bound, according to SUSv2 */
diff --git a/pkgs/tools/networking/lldpd/default.nix b/pkgs/tools/networking/lldpd/default.nix
index b8ba1357f5f..23dbb60767e 100644
--- a/pkgs/tools/networking/lldpd/default.nix
+++ b/pkgs/tools/networking/lldpd/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, pkgconfig, removeReferencesTo
-, libevent, readline, net_snmp, openssl
+, libevent, readline, net-snmp, openssl
 }:
 
 stdenv.mkDerivation rec {
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ pkgconfig removeReferencesTo ];
-  buildInputs = [ libevent readline net_snmp openssl ];
+  buildInputs = [ libevent readline net-snmp openssl ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/networking/mailutils/default.nix b/pkgs/tools/networking/mailutils/default.nix
index 40eeed7f050..dcf377ca0c0 100644
--- a/pkgs/tools/networking/mailutils/default.nix
+++ b/pkgs/tools/networking/mailutils/default.nix
@@ -1,15 +1,15 @@
 { stdenv, fetchurl, fetchpatch, autoreconfHook, dejagnu, gettext, pkgconfig
 , gdbm, pam, readline, ncurses, gnutls, guile, texinfo, gnum4, sasl, fribidi, nettools
-, python, gss, libmysqlclient, system-sendmail }:
+, python3, gss, libmysqlclient, system-sendmail }:
 
 stdenv.mkDerivation rec {
   name = "${project}-${version}";
   project = "mailutils";
-  version = "3.2";
+  version = "3.8";
 
   src = fetchurl {
     url = "mirror://gnu/${project}/${name}.tar.xz";
-    sha256 = "0zh7xn8yvnw9zkc7gi5290i34viwxp1rn0g1q9nyvmckkvk59lwn";
+    sha256 = "1wkn9ch664477r4d8jk9153w5msljsbj99907k7zgzpmywbs6ba7";
   };
 
   postPatch = ''
@@ -29,17 +29,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     gdbm pam readline ncurses gnutls guile texinfo gnum4 sasl fribidi nettools
-    gss libmysqlclient python
+    gss libmysqlclient python3
   ];
 
   patches = [
-    (fetchpatch {
-      url = "https://git.savannah.gnu.org/cgit/mailutils.git/patch/?id=afbb33cf9ff";
-      excludes = [ "NEWS" ];
-      sha256 = "0yzkfx3j1zkkb43fhchjqphw4xznbclj39bjzjggv32gppy6d1db";
-    })
     ./fix-build-mb-len-max.patch
-    ./fix-test-ali-awk.patch
     ./path-to-cat.patch
   ];
 
diff --git a/pkgs/tools/networking/mailutils/fix-test-ali-awk.patch b/pkgs/tools/networking/mailutils/fix-test-ali-awk.patch
deleted file mode 100644
index 3d301d530de..00000000000
--- a/pkgs/tools/networking/mailutils/fix-test-ali-awk.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/mh/tests/ali.at b/mh/tests/ali.at
-index 28c0e5451..c76cf9363 100644
---- a/mh/tests/ali.at
-+++ b/mh/tests/ali.at
-@@ -85,9 +85,9 @@ ali -a ./mh_aliases korzen | tr -d ' '
- [expout])
- 
- MH_CHECK([ali: group id],[ali05 ali-group-id ali-gid],[
--cat /etc/passwd | awk -F : '/^#/ { next } $4==0 { print $1 }' > expout
-+cat /etc/passwd | awk -F : '/^#/ { next } $4==0 { print $1; exit }' > expout
- test -s expout || AT_SKIP_TEST
--name=`awk -F : '/^#/ { next } $3==0 { print $1 }' /etc/group < /dev/null`
-+name=`awk -F : '/^#/ { next } $3==0 { print $1; exit }' /etc/group < /dev/null`
- test -z "$name" && AT_SKIP_TEST
- 
- echo "korzen: +$name" > mh_aliases
diff --git a/pkgs/tools/networking/mitmproxy/default.nix b/pkgs/tools/networking/mitmproxy/default.nix
index a9758e5fd47..53369baa01c 100644
--- a/pkgs/tools/networking/mitmproxy/default.nix
+++ b/pkgs/tools/networking/mitmproxy/default.nix
@@ -52,10 +52,12 @@ buildPythonPackage rec {
 
   doCheck = (!stdenv.isDarwin);
 
+  # examples.complex.xss_scanner doesn't import correctly with pytest5
   checkPhase = ''
     export HOME=$(mktemp -d)
     export LC_CTYPE=en_US.UTF-8
-    pytest -k 'not test_find_unclaimed_URLs and not test_tcp'
+    pytest --ignore test/examples \
+      -k 'not test_find_unclaimed_URLs and not test_tcp'
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/networking/mmsd/default.nix b/pkgs/tools/networking/mmsd/default.nix
new file mode 100644
index 00000000000..fee347dd201
--- /dev/null
+++ b/pkgs/tools/networking/mmsd/default.nix
@@ -0,0 +1,38 @@
+{ stdenv
+, fetchgit
+, autoreconfHook
+, pkgconfig
+, glib
+, dbus
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mmsd";
+  version = "unstable-2019-07-15";
+
+  src = fetchgit {
+    url = "git://git.kernel.org/pub/scm/network/ofono/mmsd.git";
+    rev = "f4b8b32477a411180be1823fdc460b4f7e1e3c9c";
+    sha256 = "0hcnpyhsi7b5m825dhnwbp65yi0961wi8mipzdvaw5nc693xv15b";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkgconfig
+  ];
+
+  buildInputs = [
+    glib
+    dbus
+  ];
+
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    description = "Multimedia Messaging Service Daemon";
+    homepage = "https://01.org/ofono";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ jtojnar ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/networking/modem-manager/default.nix b/pkgs/tools/networking/modem-manager/default.nix
index d921e841c5b..221e873387f 100644
--- a/pkgs/tools/networking/modem-manager/default.nix
+++ b/pkgs/tools/networking/modem-manager/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "modem-manager";
-  version = "1.10.4";
+  version = "1.10.6";
 
   package = "ModemManager";
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${package}/${package}-${version}.tar.xz";
-    sha256 = "0w6wdj9dh7zwhzl68775h1ni6zcgvss524dp17kph50zpas6nmgs";
+    sha256 = "15n9sd6ymxvw7hidc9pw81j89acwi5cjfhj220a68mi1h8vsfb1w";
   };
 
   nativeBuildInputs = [ vala gobject-introspection gettext pkgconfig ];
diff --git a/pkgs/tools/networking/mtr/default.nix b/pkgs/tools/networking/mtr/default.nix
index 217f3b7d7cc..18850fab330 100644
--- a/pkgs/tools/networking/mtr/default.nix
+++ b/pkgs/tools/networking/mtr/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, autoreconfHook, pkgconfig
+{ stdenv, lib, fetchFromGitHub, fetchpatch, autoreconfHook, pkgconfig
 , libcap, ncurses
 , withGtk ? false, gtk2 ? null }:
 
@@ -14,6 +14,14 @@ stdenv.mkDerivation rec {
     rev    = "v${version}";
     sha256 = "0n0zr9k61w7a9psnzgp7xnc7ll1ic2xzcvqsbbbyndg3v9rff6bw";
   };
+  
+  patches = [
+    # https://github.com/traviscross/mtr/pull/315
+    (fetchpatch {
+      url = https://github.com/traviscross/mtr/pull/315.patch?full_index=1;
+      sha256 = "18qcsj9058snc2qhq6v6gdbqhz021gi5fgw9h7vfczv45gf0qasa";
+    })
+  ];
 
   # we need this before autoreconfHook does its thing
   postPatch = ''
diff --git a/pkgs/tools/networking/mu/default.nix b/pkgs/tools/networking/mu/default.nix
index ad49c5e6c32..6c2a42e3a24 100644
--- a/pkgs/tools/networking/mu/default.nix
+++ b/pkgs/tools/networking/mu/default.nix
@@ -1,17 +1,17 @@
 { stdenv, fetchFromGitHub, sqlite, pkgconfig, autoreconfHook, pmccabe
 , xapian, glib, gmime3, texinfo , emacs, guile
-, gtk3, webkitgtk24x-gtk3, libsoup, icu
+, gtk3, webkitgtk, libsoup, icu
 , withMug ? false }:
 
 stdenv.mkDerivation rec {
   pname = "mu";
-  version = "1.3.5";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner  = "djcb";
     repo   = "mu";
     rev    = version;
-    sha256 = "1g7rhgp405v7q9xx44k6jn3py4v73a9qjwhai6l459wdywdz1n3n";
+    sha256 = "0yhjlj0z23jw3cf2wfnl98y8q6gikvmhkb8vdm87bd7jw0bdnrfz";
   };
 
   # test-utils coredumps so don't run those
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     sqlite xapian glib gmime3 texinfo emacs guile libsoup icu
-  ] ++ stdenv.lib.optionals withMug [ gtk3 webkitgtk24x-gtk3 ];
+  ] ++ stdenv.lib.optionals withMug [ gtk3 webkitgtk ];
 
   nativeBuildInputs = [ pkgconfig autoreconfHook pmccabe ];
 
diff --git a/pkgs/tools/networking/nebula/default.nix b/pkgs/tools/networking/nebula/default.nix
new file mode 100644
index 00000000000..7f9d194e44a
--- /dev/null
+++ b/pkgs/tools/networking/nebula/default.nix
@@ -0,0 +1,43 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "nebula";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "slackhq";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0j7fna352z8kzx6n0hck7rp122c0v44j9syz0v30vq47xq2pwj5c";
+  };
+
+  modSha256 = "130h0gc5z0w5inpc99y6mismwg3nyzk3bqdq5v9yclkxlhkbcp6d";
+
+  subPackages = [ "cmd/nebula" "cmd/nebula-cert" ];
+
+  buildFlagsArray = [ "-ldflags='-X main.Build=${version}'" ];
+
+  meta = with lib; {
+    description = "A scalable overlay networking tool with a focus on performance, simplicity and security";
+    longDescription = ''
+      Nebula is a scalable overlay networking tool with a focus on performance,
+      simplicity and security. It lets you seamlessly connect computers
+      anywhere in the world. Nebula is portable, and runs on Linux, OSX, and
+      Windows. (Also: keep this quiet, but we have an early prototype running
+      on iOS). It can be used to connect a small number of computers, but is
+      also able to connect tens of thousands of computers.
+
+      Nebula incorporates a number of existing concepts like encryption,
+      security groups, certificates, and tunneling, and each of those
+      individual pieces existed before Nebula in various forms. What makes
+      Nebula different to existing offerings is that it brings all of these
+      ideas together, resulting in a sum that is greater than its individual
+      parts.
+    '';
+    homepage = "https://github.com/slackhq/nebula";
+    license = licenses.mit;
+    maintainers = with maintainers; [ filalex77 ];
+    platforms = platforms.all;
+  };
+
+}
diff --git a/pkgs/tools/networking/network-manager/applet.nix b/pkgs/tools/networking/network-manager/applet.nix
index 947ede5372a..69b454ea72e 100644
--- a/pkgs/tools/networking/network-manager/applet.nix
+++ b/pkgs/tools/networking/network-manager/applet.nix
@@ -2,7 +2,7 @@
 , libnotify, libsecret, polkit, isocodes, modemmanager, libxml2, docbook_xsl, docbook_xml_dtd_43
 , mobile-broadband-provider-info, glib-networking, gsettings-desktop-schemas
 , libgudev, jansson, wrapGAppsHook, gobject-introspection, python3, gtk3
-, libappindicator-gtk3, withGnome ? false, gcr, glib }:
+, libappindicator-gtk3, withGnome ? true, gcr, glib }:
 
 let
   pname = "network-manager-applet";
diff --git a/pkgs/tools/networking/network-manager/default.nix b/pkgs/tools/networking/network-manager/default.nix
index e18b5970370..e762ac73844 100644
--- a/pkgs/tools/networking/network-manager/default.nix
+++ b/pkgs/tools/networking/network-manager/default.nix
@@ -10,11 +10,11 @@ let
   pythonForDocs = python3.withPackages (pkgs: with pkgs; [ pygobject3 ]);
 in stdenv.mkDerivation rec {
   pname = "network-manager";
-  version = "1.20.4";
+  version = "1.20.8";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${stdenv.lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    sha256 = "0k4i6m8acp48vl6l13267wv6kfkmzfjq2mraaa5m9n82wyvkimx3";
+    sha256 = "1ijpnx25wy5bcvp4mc49va942q56d0pncpj4jpknpdzwilmf455d";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
@@ -104,7 +104,7 @@ in stdenv.mkDerivation rec {
     homepage = https://wiki.gnome.org/Projects/NetworkManager;
     description = "Network configuration and management tool";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ phreedom domenkozar obadz ];
+    maintainers = with maintainers; [ phreedom domenkozar obadz worldofpeace ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/networking/network-manager/fortisslvpn/default.nix b/pkgs/tools/networking/network-manager/fortisslvpn/default.nix
index 53d6ab2fbcf..94a4c4b362a 100644
--- a/pkgs/tools/networking/network-manager/fortisslvpn/default.nix
+++ b/pkgs/tools/networking/network-manager/fortisslvpn/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, substituteAll, openfortivpn, intltool, pkgconfig, file, gtk3,
-networkmanager, ppp, libsecret, withGnome ? true, gnome3, fetchpatch }:
+networkmanager, ppp, libsecret, withGnome ? true, gnome3, fetchpatch, networkmanagerapplet }:
 
 let
   pname = "NetworkManager-fortisslvpn";
@@ -25,7 +25,7 @@ in stdenv.mkDerivation {
   ];
 
   buildInputs = [ openfortivpn networkmanager ppp ]
-    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret gnome3.networkmanagerapplet ];
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret networkmanagerapplet ];
 
   nativeBuildInputs = [ intltool pkgconfig file ];
 
diff --git a/pkgs/tools/networking/network-manager/iodine/default.nix b/pkgs/tools/networking/network-manager/iodine/default.nix
index 966827a07da..1b41a176723 100644
--- a/pkgs/tools/networking/network-manager/iodine/default.nix
+++ b/pkgs/tools/networking/network-manager/iodine/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, substituteAll, iodine, intltool, pkgconfig, networkmanager, libsecret, gtk3
-, withGnome ? true, gnome3, fetchpatch }:
+, withGnome ? true, gnome3, fetchpatch, networkmanagerapplet }:
 
 let
   pname = "NetworkManager-iodine";
@@ -25,7 +25,7 @@ in stdenv.mkDerivation {
   ];
 
   buildInputs = [ iodine networkmanager ]
-    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret gnome3.networkmanagerapplet ];
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret networkmanagerapplet ];
 
   nativeBuildInputs = [ intltool pkgconfig ];
 
diff --git a/pkgs/tools/networking/network-manager/openconnect/default.nix b/pkgs/tools/networking/network-manager/openconnect/default.nix
index 7db0e59beab..3c1a8d11042 100644
--- a/pkgs/tools/networking/network-manager/openconnect/default.nix
+++ b/pkgs/tools/networking/network-manager/openconnect/default.nix
@@ -1,14 +1,31 @@
-{ stdenv, fetchurl, substituteAll, openconnect, intltool, pkgconfig, autoreconfHook, networkmanager, gcr, libsecret, file
-, gtk3, withGnome ? true, gnome3, kmod, fetchpatch }:
+{ stdenv
+, fetchurl
+, substituteAll
+, glib
+, libxml2
+, openconnect
+, intltool
+, pkgconfig
+, autoreconfHook
+, networkmanager
+, gcr
+, libsecret
+, file
+, gtk3
+, withGnome ? true
+, gnome3
+, kmod
+, fetchpatch
+}:
 
 let
-  pname   = "NetworkManager-openconnect";
+  pname = "NetworkManager-openconnect";
   version = "1.2.6";
 in stdenv.mkDerivation {
-  name    = "${pname}${if withGnome then "-gnome" else ""}-${version}";
+  name = "${pname}${if withGnome then "-gnome" else ""}-${version}";
 
   src = fetchurl {
-    url    = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0nlp290nkawc4wqm978n4vhzg3xdqi8kpjjx19l855vab41rh44m";
   };
 
@@ -17,6 +34,7 @@ in stdenv.mkDerivation {
       src = ./fix-paths.patch;
       inherit kmod openconnect;
     })
+
     # Don't use etc/dbus-1/system.d
     (fetchpatch {
       url = "https://gitlab.gnome.org/GNOME/NetworkManager-openconnect/merge_requests/9.patch";
@@ -24,10 +42,22 @@ in stdenv.mkDerivation {
     })
   ];
 
-  buildInputs = [ openconnect networkmanager ]
-    ++ stdenv.lib.optionals withGnome [ gtk3 gcr libsecret ];
+  buildInputs = [
+    glib
+    libxml2
+    openconnect
+    networkmanager
+  ] ++ stdenv.lib.optionals withGnome [
+    gtk3
+    gcr
+    libsecret
+  ];
 
-  nativeBuildInputs = [ intltool pkgconfig file ];
+  nativeBuildInputs = [
+    intltool
+    pkgconfig
+    file
+  ];
 
   configureFlags = [
     "--with-gnome=${if withGnome then "yes" else "no"}"
@@ -43,7 +73,7 @@ in stdenv.mkDerivation {
   };
 
   meta = with stdenv.lib; {
-    description = "NetworkManager's OpenConnect plugin";
+    description = "NetworkManager’s OpenConnect plugin";
     inherit (networkmanager.meta) maintainers platforms;
     license = licenses.gpl2Plus;
   };
diff --git a/pkgs/tools/networking/network-manager/openvpn/default.nix b/pkgs/tools/networking/network-manager/openvpn/default.nix
index bedc7875fb7..2762b12a364 100644
--- a/pkgs/tools/networking/network-manager/openvpn/default.nix
+++ b/pkgs/tools/networking/network-manager/openvpn/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, substituteAll, openvpn, intltool, libxml2, pkgconfig, file, networkmanager, libsecret
-, gtk3, withGnome ? true, gnome3, kmod, fetchpatch }:
+, gtk3, withGnome ? true, gnome3, kmod, fetchpatch, networkmanagerapplet }:
 
 let
   pname = "NetworkManager-openvpn";
@@ -25,7 +25,7 @@ in stdenv.mkDerivation {
   ];
 
   buildInputs = [ openvpn networkmanager ]
-    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret gnome3.networkmanagerapplet ];
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret networkmanagerapplet ];
 
   nativeBuildInputs = [ intltool pkgconfig file libxml2 ];
 
diff --git a/pkgs/tools/networking/network-manager/strongswan.nix b/pkgs/tools/networking/network-manager/strongswan.nix
index 448fef4226a..8d16f71c4af 100644
--- a/pkgs/tools/networking/network-manager/strongswan.nix
+++ b/pkgs/tools/networking/network-manager/strongswan.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, intltool, pkgconfig, networkmanager, strongswanNM
-, gtk3, gnome3, libsecret }:
+, gtk3, gnome3, libsecret, networkmanagerapplet }:
 
 stdenv.mkDerivation rec {
   pname = "NetworkManager-strongswan";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "015xcj42pd84apa0j0n9r3fhldp42mj72dqvl2xf4r9gwg5nhfrl";
   };
 
-  buildInputs = [ networkmanager strongswanNM libsecret gtk3 gnome3.networkmanagerapplet ];
+  buildInputs = [ networkmanager strongswanNM libsecret gtk3 networkmanagerapplet ];
 
   nativeBuildInputs = [ intltool pkgconfig ];
 
diff --git a/pkgs/tools/networking/network-manager/vpnc/default.nix b/pkgs/tools/networking/network-manager/vpnc/default.nix
index af5b19eb5db..66392325574 100644
--- a/pkgs/tools/networking/network-manager/vpnc/default.nix
+++ b/pkgs/tools/networking/network-manager/vpnc/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, substituteAll, vpnc, intltool, pkgconfig, networkmanager, libsecret
-, gtk3, withGnome ? true, gnome3, kmod, file, fetchpatch }:
+, gtk3, withGnome ? true, gnome3, kmod, file, fetchpatch, networkmanagerapplet }:
 let
   pname = "NetworkManager-vpnc";
   version = "1.2.6";
@@ -24,7 +24,7 @@ in stdenv.mkDerivation {
   ];
 
   buildInputs = [ vpnc networkmanager ]
-    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret gnome3.networkmanagerapplet ];
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret networkmanagerapplet ];
 
   nativeBuildInputs = [ intltool pkgconfig file ];
 
diff --git a/pkgs/tools/networking/nfstrace/default.nix b/pkgs/tools/networking/nfstrace/default.nix
new file mode 100644
index 00000000000..50654da54e4
--- /dev/null
+++ b/pkgs/tools/networking/nfstrace/default.nix
@@ -0,0 +1,37 @@
+{ cmake, fetchFromGitHub, fetchpatch, json_c, libpcap, ncurses, stdenv }:
+
+stdenv.mkDerivation rec {
+  pname = "nfstrace";
+  version = "0.4.3.2";
+
+  src = fetchFromGitHub {
+    owner = "epam";
+    repo = "nfstrace";
+    rev = "${version}";
+    sha256 = "1djsyn7i3xp969rnmsdaf5vwjiik9wylxxrc5nm7by00i76c1vsg";
+  };
+
+  patches = [
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian/nfstrace/raw/debian/0.4.3.1-3/debian/patches/reproducible_build.patch";
+      sha256 = "0fd96r8xi142kjwibqkd46s6jwsg5kfc5v28bqsj9rdlc2aqmay5";
+    })
+  ];
+
+  buildInputs = [ json_c libpcap ncurses ];
+  nativeBuildInputs = [ cmake ];
+
+  # To build with GCC 8+ it needs:
+  CXXFLAGS = [ "-Wno-class-memaccess" "-Wno-ignored-qualifiers" ];
+  # CMake can't find json_c without:
+  NIX_CFLAGS_COMPILE = [ "-I${json_c.dev}/include/json-c" ];
+
+  doCheck = false; # requires network access
+
+  meta = with stdenv.lib; {
+    homepage = "http://epam.github.io/nfstrace/";
+    description = "NFS and CIFS tracing/monitoring/capturing/analyzing tool";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/networking/ocserv/default.nix b/pkgs/tools/networking/ocserv/default.nix
index e695c460422..55d3b6ff81c 100644
--- a/pkgs/tools/networking/ocserv/default.nix
+++ b/pkgs/tools/networking/ocserv/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ocserv";
-  version = "0.12.4";
+  version = "0.12.5";
 
   src = fetchFromGitLab {
     owner = "openconnect";
     repo = "ocserv";
     rev = "ocserv_${stdenv.lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "0lybz93ah6n5b82ywshhmsmf65im8rk6gkxnzxfbxpqxra79j517";
+    sha256 = "01md7r7myaxp614bm2bmbpraxjjjhs0zr5h6k3az3y3ix0r7zi69";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/tools/networking/offlineimap/default.nix b/pkgs/tools/networking/offlineimap/default.nix
index a14f8187b7d..f0e0bb805de 100644
--- a/pkgs/tools/networking/offlineimap/default.nix
+++ b/pkgs/tools/networking/offlineimap/default.nix
@@ -23,7 +23,7 @@ python2Packages.buildPythonApplication rec {
   doCheck = false;
 
   nativeBuildInputs = [ asciidoc libxml2 libxslt docbook_xsl ];
-  propagatedBuildInputs = with python2Packages; [ six kerberos rfc6555 ];
+  propagatedBuildInputs = with python2Packages; [ six kerberos rfc6555 pysocks ];
 
   postInstall = ''
     make -C docs man
diff --git a/pkgs/tools/networking/ofono/default.nix b/pkgs/tools/networking/ofono/default.nix
index 27f4b9562b3..5cae8a61203 100644
--- a/pkgs/tools/networking/ofono/default.nix
+++ b/pkgs/tools/networking/ofono/default.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ofono";
-  version = "1.30";
+  version = "1.31";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "git://git.kernel.org/pub/scm/network/ofono/ofono.git";
     rev = version;
-    sha256 = "1qzysmzpgbh6zc3x9xh931wxcazka9wwx727c2k66z9gal2n6n66";
+    sha256 = "033y3vggjxn1c7mw75j452idp7arrdv51axs727f7l3c5lnxqdjy";
   };
 
   patches = [
diff --git a/pkgs/tools/networking/openapi-generator-cli/default.nix b/pkgs/tools/networking/openapi-generator-cli/default.nix
index df4ac83191d..1cb8e02130f 100644
--- a/pkgs/tools/networking/openapi-generator-cli/default.nix
+++ b/pkgs/tools/networking/openapi-generator-cli/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, jre, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  version = "4.1.3";
+  version = "4.2.2";
   pname = "openapi-generator-cli";
 
   jarfilename = "${pname}-${version}.jar";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://central.maven.org/maven2/org/openapitools/${pname}/${version}/${jarfilename}";
-    sha256 = "0bqdjparv12wscq4qhm9xnryyfmdnn3w77hrhnsy8mlvxk2vnk13";
+    sha256 = "1pafv432ll3pp52580pbnk0gnrm6byl5fkrf1rarhxfkpkr82yif";
   };
 
   phases = [ "installPhase" ];
diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index 7244653e493..a926ef1e1dd 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -1,8 +1,14 @@
-{ stdenv, fetchurl, pkgconfig, vpnc, openssl ? null, gnutls ? null, gmp, libxml2, stoken, zlib } :
+{ stdenv, fetchurl, pkgconfig, openssl ? null, gnutls ? null, gmp, libxml2, stoken, zlib, fetchgit, darwin } :
 
 assert (openssl != null) == (gnutls == null);
 
-stdenv.mkDerivation rec {
+let vpnc = fetchgit {
+  url = "git://git.infradead.org/users/dwmw2/vpnc-scripts.git";
+  rev = "c84fb8e5a523a647a01a1229a9104db934e19f00";
+  sha256 = "01xdclx0y3x66mpbdr77n4ilapwzjz475h32q88ml9gnq6phjxrs";
+};
+
+in stdenv.mkDerivation rec {
   pname = "openconnect";
   version = "8.05";
 
@@ -14,21 +20,22 @@ stdenv.mkDerivation rec {
   };
 
   outputs = [ "out" "dev" ];
-
+  
   configureFlags = [
-    "--with-vpnc-script=${vpnc}/etc/vpnc/vpnc-script"
+    "--with-vpnc-script=${vpnc}/vpnc-script"
     "--disable-nls"
     "--without-openssl-version-check"
   ];
 
+  buildInputs = [ openssl gnutls gmp libxml2 stoken zlib ]
+    ++ stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.PCSC;
   nativeBuildInputs = [ pkgconfig ];
-  propagatedBuildInputs = [ vpnc openssl gnutls gmp libxml2 stoken zlib ];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "VPN Client for Cisco's AnyConnect SSL VPN";
     homepage = http://www.infradead.org/openconnect/;
-    license = stdenv.lib.licenses.lgpl21;
-    maintainers = with stdenv.lib.maintainers; [ pradeepchhetri ];
-    platforms = stdenv.lib.platforms.linux;
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ pradeepchhetri tricktron ];
+    platforms = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
   };
 }
diff --git a/pkgs/tools/networking/openfortivpn/default.nix b/pkgs/tools/networking/openfortivpn/default.nix
index 2672996a095..d1a73f1c148 100644
--- a/pkgs/tools/networking/openfortivpn/default.nix
+++ b/pkgs/tools/networking/openfortivpn/default.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 let repo = "openfortivpn";
-    version = "1.10.0";
+    version = "1.11.0";
 
 in stdenv.mkDerivation {
   name = "${repo}-${version}";
@@ -12,7 +12,7 @@ in stdenv.mkDerivation {
     owner = "adrienverge";
     inherit repo;
     rev = "v${version}";
-    sha256 = "1d9mp03dxz9j6pwd3d5z2pa7i1sqx5psshli1inqs0cq8zjmbzrw";
+    sha256 = "03ljyam0027w412vmi4gc0bp9c2xfmcspi676qck8cvvzg4gf736";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/tools/networking/openvpn/update-systemd-resolved.nix b/pkgs/tools/networking/openvpn/update-systemd-resolved.nix
new file mode 100644
index 00000000000..ddb3cc8e377
--- /dev/null
+++ b/pkgs/tools/networking/openvpn/update-systemd-resolved.nix
@@ -0,0 +1,34 @@
+{ lib, stdenv, fetchFromGitHub
+, makeWrapper
+, iproute, systemd, coreutils, utillinux }:
+
+stdenv.mkDerivation rec {
+  pname = "update-systemd-resolved";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "jonathanio";
+    repo = "update-systemd-resolved";
+    rev = "v${version}";
+    sha256 = "19zhbpyms57yb70hi0ws5sbkpk2yqp9nnix3f86r36h1g93m70lm";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildFlags = [
+    "PREFIX=${placeholder "out"}/libexec/openvpn"
+  ];
+
+  installPhase = ''
+    wrapProgram $out/libexec/openvpn/update-systemd-resolved \
+      --prefix PATH : ${lib.makeBinPath [ iproute systemd coreutils utillinux ]}
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Helper script for OpenVPN to directly update the DNS settings of a link through systemd-resolved via DBus";
+    homepage = https://github.com/jonathanio/update-systemd-resolved;
+    maintainers = with maintainers; [ eadwu ];
+    license = licenses.gpl3;
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/networking/p2p/amule/default.nix b/pkgs/tools/networking/p2p/amule/default.nix
index 2330a97d77d..264c6fd4e16 100644
--- a/pkgs/tools/networking/p2p/amule/default.nix
+++ b/pkgs/tools/networking/p2p/amule/default.nix
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
       applications.
     '';
 
-    homepage = "https://amule.org/";
+    homepage = "https://github.com/amule-project/amule";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ phreedom ];
     platforms = platforms.unix;
diff --git a/pkgs/tools/networking/pirate-get/default.nix b/pkgs/tools/networking/pirate-get/default.nix
index 5d410685c0d..b92d255b719 100644
--- a/pkgs/tools/networking/pirate-get/default.nix
+++ b/pkgs/tools/networking/pirate-get/default.nix
@@ -4,13 +4,13 @@ with python3Packages;
 
 buildPythonApplication rec {
   pname = "pirate-get";
-  version = "0.3.3";
+  version = "0.3.4";
 
   doCheck = false;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1zwfgfiszkca44wlx5p2243hmf8594n7bnfva5if1f69dic6w7mi";
+    sha256 = "0f82yf3bl9jaywagv4vvwypm57z1x8a8qqn0xhz9np3949df4ysm";
   };
 
   propagatedBuildInputs = [ colorama veryprettytable beautifulsoup4 pyperclip ];
diff --git a/pkgs/tools/networking/pmacct/default.nix b/pkgs/tools/networking/pmacct/default.nix
new file mode 100644
index 00000000000..5d0c5cccded
--- /dev/null
+++ b/pkgs/tools/networking/pmacct/default.nix
@@ -0,0 +1,62 @@
+{ stdenv
+, fetchFromGitHub
+, pkgconfig
+, autoreconfHook
+, libtool
+, libpcap
+
+# Optional Dependencies
+, zlib ? null
+, withJansson ? true, jansson ? null
+, withNflog ? true, libnetfilter_log ? null
+, withSQLite ? true, sqlite ? null
+, withPgSQL ? true, postgresql ? null
+, withMysql ? true, libmysqlclient ? null }:
+
+assert withJansson -> jansson != null;
+assert withNflog -> libnetfilter_log != null;
+assert withSQLite -> sqlite != null;
+assert withPgSQL -> postgresql != null;
+assert withMysql -> libmysqlclient != null;
+
+let inherit (stdenv.lib) optional; in
+
+stdenv.mkDerivation rec {
+  version = "1.7.3";
+  pname = "pmacct";
+
+  src = fetchFromGitHub {
+    owner = "pmacct";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0j5qmkya67q7jvaddcj00blmaac37bkir1zb3m1xmm95gm5lf2p5";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkgconfig libtool ];
+  buildInputs = [ libpcap ]
+    ++ optional withJansson jansson
+    ++ optional withNflog libnetfilter_log
+    ++ optional withSQLite sqlite
+    ++ optional withPgSQL postgresql
+    ++ optional withMysql [ libmysqlclient zlib ];
+
+  configureFlags = [
+    "--with-pcap-includes=${libpcap}/include"
+  ] ++ optional withJansson "--enable-jansson"
+    ++ optional withNflog "--enable-nflog"
+    ++ optional withSQLite "--enable-sqlite3"
+    ++ optional withPgSQL "--enable-pgsql"
+    ++ optional withMysql "--enable-mysql";
+
+  meta = with stdenv.lib; {
+    description = "pmacct is a small set of multi-purpose passive network monitoring tools";
+    longDescription = ''
+      pmacct is a small set of multi-purpose passive network monitoring tools
+      [NetFlow IPFIX sFlow libpcap BGP BMP RPKI IGP Streaming Telemetry]
+    '';
+    homepage = "http://www.pmacct.net/";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ "0x4A6F" ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/networking/shadowsocks-libev/default.nix b/pkgs/tools/networking/shadowsocks-libev/default.nix
index 254e5d3e5d3..b6051ef26b0 100644
--- a/pkgs/tools/networking/shadowsocks-libev/default.nix
+++ b/pkgs/tools/networking/shadowsocks-libev/default.nix
@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "shadowsocks-libev";
-  version = "3.3.1";
+  version = "3.3.3";
 
   # Git tag includes CMake build files which are much more convenient.
   src = fetchFromGitHub {
     owner = "shadowsocks";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "0l15mbwlzx446rn5cix9f1726by62807bhnxkzknd41j7r937vyv";
+    sha256 = "1i2431imbn4bhwmwyz63g5mh1g5ikhsiwv6mzcdc2kx34zjpibrj";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/tools/networking/slirp4netns/default.nix b/pkgs/tools/networking/slirp4netns/default.nix
index b64cf5cdd9b..f9add47dd3f 100644
--- a/pkgs/tools/networking/slirp4netns/default.nix
+++ b/pkgs/tools/networking/slirp4netns/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, glib }:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, glib, libcap, libseccomp }:
 
 stdenv.mkDerivation rec {
   pname = "slirp4netns";
-  version = "0.3.0";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "rootless-containers";
     repo = "slirp4netns";
     rev = "v${version}";
-    sha256 = "079m44l4l0p1c2sbkpzsy6zpv94glwmrc72ip2djcscnaq4b1763";
+    sha256 = "0g7apfw33wkxxj7qwvlnnhv7qy13s1gkbmvns8612c0yfv9jrsvq";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
 
-  buildInputs = [ glib ];
+  buildInputs = [ libcap libseccomp glib ];
 
   enableParallelBuilding = true;
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     homepage = https://github.com/rootless-containers/slirp4netns;
     description = "User-mode networking for unprivileged network namespaces";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ orivej ];
+    maintainers = with maintainers; [ orivej saschagrunert ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/networking/sshoogr/default.nix b/pkgs/tools/networking/sshoogr/default.nix
new file mode 100644
index 00000000000..764b34fc5a5
--- /dev/null
+++ b/pkgs/tools/networking/sshoogr/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchzip, jdk, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  pname = "sshoogr";
+  version = "0.9.26";
+
+  src = fetchzip {
+    url = "https://repo1.maven.org/maven2/com/aestasit/infrastructure/${pname}/${pname}/${version}/${pname}-${version}.zip";
+    sha256 = "134qlx90y82g1rfxhyn12z9r2imm1l3fz09hrrn3pgcdcq5jz2s1";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    rm bin/sshoogr.bat
+    cp -r . $out
+    wrapProgram $out/bin/sshoogr \
+      --prefix JAVA_HOME : ${jdk}
+  '';
+
+  meta = with stdenv.lib; {
+    description = ''
+      A Groovy-based DSL for working with remote SSH servers
+    '';
+    longDescription = ''
+      The sshoogr (pronounced [ʃʊgə]) is a Groovy-based DSL library for working
+      with remote servers through SSH. The DSL allows: connecting, executing 
+      remote commands, copying files and directories, creating tunnels in a 
+      simple and concise way.
+    '';
+    homepage = "https://github.com/aestasit/sshoogr";
+    license = licenses.asl20;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ moaxcp ];
+  };
+} 
diff --git a/pkgs/tools/networking/sshping/default.nix b/pkgs/tools/networking/sshping/default.nix
new file mode 100644
index 00000000000..20f0eaa7e47
--- /dev/null
+++ b/pkgs/tools/networking/sshping/default.nix
@@ -0,0 +1,31 @@
+{stdenv, fetchFromGitHub, libssh}:
+
+stdenv.mkDerivation rec {
+  pname = "sshping";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    owner = "spook";
+    repo = "sshping";
+    rev = "v${version}";
+    sha256 = "0p1fvpgrsy44yvj44xp9k9nf6z1fh0sqcjvy75pcb9f5icgms815";
+  };
+
+  buildInputs = [ libssh ];
+
+  buildPhase = ''
+      g++ -Wall -I ext/ -o bin/sshping src/sshping.cxx -lssh
+    '';
+
+  installPhase = ''
+      install -Dm755 bin/sshping $out/bin/sshping
+    '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/spook/sshping";
+    description = "Measure character-echo latency and bandwidth for an interactive ssh session";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ jqueiroz ];
+  };
+}
diff --git a/pkgs/tools/networking/sslsplit/default.nix b/pkgs/tools/networking/sslsplit/default.nix
new file mode 100644
index 00000000000..bf23d06551d
--- /dev/null
+++ b/pkgs/tools/networking/sslsplit/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, openssl, libevent, libpcap, libnet, zlib }:
+
+stdenv.mkDerivation rec {
+  pname = "sslsplit";
+  version = "0.5.5";
+
+  src = fetchFromGitHub {
+    owner = "droe";
+    repo = pname;
+    rev = version;
+    sha256 = "1p43z9ln5rbc76v0j1k3r4nhvfw71hq8jzsallb54z9hvwfvqp3l";
+  };
+
+  buildInputs = [ openssl libevent libpcap libnet zlib ];
+
+  makeFlags = [
+    "PREFIX=$(out)"
+    "OPENSSL_BASE=${openssl.dev}"
+    "LIBEVENT_BASE=${libevent.dev}"
+    "LIBPCAP_BASE=${libpcap}"
+    "LIBNET_BASE=${libnet}"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Transparent SSL/TLS interception";
+    homepage = "https://www.roe.ch/SSLsplit";
+    platforms = platforms.all;
+    maintainers = with maintainers; [ contrun ];
+    license = with licenses; [ bsd2 mit unlicense free ];
+  };
+}
diff --git a/pkgs/tools/networking/stunnel/default.nix b/pkgs/tools/networking/stunnel/default.nix
index 792e6f68294..b9278dd7c0d 100644
--- a/pkgs/tools/networking/stunnel/default.nix
+++ b/pkgs/tools/networking/stunnel/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "stunnel";
-  version = "5.55";
+  version = "5.56";
 
   src = fetchurl {
     url    = "https://www.stunnel.org/downloads/${pname}-${version}.tar.gz";
-    sha256 = "0qjc0wkjf6bqz29fvwwsn9hnjhm6alsm10jcwx4jad2q3ks6kplh";
+    sha256 = "08kb4gi9fzqngrczykvba6xhaxhq9m4wmdbhxvgrva5rasrvz13k";
     # please use the contents of "https://www.stunnel.org/downloads/${name}.tar.gz.sha256",
     # not the output of `nix-prefetch-url`
   };
diff --git a/pkgs/tools/networking/subfinder/default.nix b/pkgs/tools/networking/subfinder/default.nix
index 65b88a34fb0..cd5f2bf18cb 100644
--- a/pkgs/tools/networking/subfinder/default.nix
+++ b/pkgs/tools/networking/subfinder/default.nix
@@ -1,16 +1,16 @@
 { stdenv, buildGoPackage, fetchFromGitHub }:
 
-buildGoPackage {
-  pname = "subfinder-git";
-  version = "2018-07-15";
+buildGoPackage rec {
+  pname = "subfinder";
+  version = "2.2.4";
 
-  goPackagePath = "github.com/subfinder/subfinder";
+  goPackagePath = "github.com/projectdiscovery/subfinder";
 
   src = fetchFromGitHub {
-    owner = "subfinder";
-    repo = "subfinder";
-    rev = "26596affed961c535676395f443acc5af95ac9e6";
-    sha256 = "0m842jyrwlg4kaja1m3kca07jf20fxva0frg66b13zpsm8hdp10q";
+    owner = "projectdiscovery";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "00ni835zvgrj8gmmmpjdszrcijyd6apig8rpb4g2z3g016b6gwar";
   };
 
   goDeps = ./deps.nix;
@@ -22,8 +22,8 @@ buildGoPackage {
       subdomains for websites. Designed as a passive framework to be
       useful for bug bounties and safe for penetration testing.
     '';
-    homepage = https://github.com/subfinder/subfinder;
+    homepage = "https://github.com/projectdiscovery/subfinder";
     license = licenses.mit;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ fpletz filalex77 ];
   };
 }
diff --git a/pkgs/tools/networking/subfinder/deps.nix b/pkgs/tools/networking/subfinder/deps.nix
index 34095c81428..16427eddcf6 100644
--- a/pkgs/tools/networking/subfinder/deps.nix
+++ b/pkgs/tools/networking/subfinder/deps.nix
@@ -1,12 +1,48 @@
 # file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
 [
   {
-    goPackagePath  = "github.com/bogdanovich/dns_resolver";
+    goPackagePath  = "github.com/davecgh/go-spew";
     fetch = {
       type = "git";
-      url = "https://github.com/bogdanovich/dns_resolver";
-      rev =  "a8e42bc6a5b6c9a93be01ca204be7e17f7ba4cd2";
-      sha256 = "0l1hgxxqafappw0y18sbkkk2vijclvf1b8x73b0nhi4r74wyib49";
+      url = "https://github.com/davecgh/go-spew";
+      rev =  "8991bc29aa16c548c550c7ff78260e27b9ab7c73";
+      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
+    };
+  }
+  {
+    goPackagePath  = "github.com/json-iterator/go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/json-iterator/go";
+      rev =  "03217c3e97663914aec3faafde50d081f197a0a2";
+      sha256 = "1kbp9fj6fxfql0ir59zb6v68l4bpwlmk76xm8vaikw1hp6y9bcss";
+    };
+  }
+  {
+    goPackagePath  = "github.com/konsorten/go-windows-terminal-sequences";
+    fetch = {
+      type = "git";
+      url = "https://github.com/konsorten/go-windows-terminal-sequences";
+      rev =  "f55edac94c9bbba5d6182a4be46d86a2c9b5b50e";
+      sha256 = "09mn209ika7ciy87xf2x31dq5fnqw39jidgaljvmqxwk7ff1hnx7";
+    };
+  }
+  {
+    goPackagePath  = "github.com/logrusorgru/aurora";
+    fetch = {
+      type = "git";
+      url = "https://github.com/logrusorgru/aurora";
+      rev =  "21d75270181e0436fee7bd58b991c212cf309068";
+      sha256 = "0vc9qdl6jzq7vazfqgz628gcgsvir56bdi2bkhl54pi92cz9cw0p";
+    };
+  }
+  {
+    goPackagePath  = "github.com/m-mizutani/urlscan-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/m-mizutani/urlscan-go";
+      rev =  "21d37c8d3d34d514f2ef49db9b59cc94f335e9c3";
+      sha256 = "1hpymd4ncp78hgpksnw8k27rp0lh832x1pyk3bhj5dm6xmh79g4c";
     };
   }
   {
@@ -14,17 +50,71 @@
     fetch = {
       type = "git";
       url = "https://github.com/miekg/dns";
-      rev =  "3e6e47bc11bc7f93f9e2f1c7bd6481ba4802808b";
-      sha256 = "1vmsnv6r799z5lz5g9l2dh065m9003yfjb18w8n6c053hp8jvrfm";
+      rev =  "1e224ff5dead8366ed6fcdcb832794be42e73f0e";
+      sha256 = "1iv9jznakz8f5swiir0z4zilr9ypavnsc0g4zi1r0vad6npy7zfl";
+    };
+  }
+  {
+    goPackagePath  = "github.com/modern-go/concurrent";
+    fetch = {
+      type = "git";
+      url = "https://github.com/modern-go/concurrent";
+      rev =  "bacd9c7ef1dd9b15be4a9909b8ac7a4e313eec94";
+      sha256 = "0s0fxccsyb8icjmiym5k7prcqx36hvgdwl588y0491gi18k5i4zs";
     };
   }
   {
-    goPackagePath  = "github.com/subfinder/urlx";
+    goPackagePath  = "github.com/modern-go/reflect2";
     fetch = {
       type = "git";
-      url = "https://github.com/subfinder/urlx";
-      rev =  "8e731c8be06edbae81cab15937cd3c291c2a7680";
-      sha256 = "11vrx1c0mq1h6lwpsvibd3386wy4kirzmmm8ibrlx2gj0h6pkkcb";
+      url = "https://github.com/modern-go/reflect2";
+      rev =  "4b7aa43c6742a2c18fdef89dd197aaae7dac7ccd";
+      sha256 = "1721y3yr3dpx5dx5ashf063qczk2awy5zjir1jvp1h5hn7qz4i49";
+    };
+  }
+  {
+    goPackagePath  = "github.com/pkg/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pkg/errors";
+      rev =  "ba968bfe8b2f7e042a574c888954fccecfa385b4";
+      sha256 = "0g5qcb4d4fd96midz0zdk8b9kz8xkzwfa8kr1cliqbg8sxsy5vd1";
+    };
+  }
+  {
+    goPackagePath  = "github.com/pmezard/go-difflib";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pmezard/go-difflib";
+      rev =  "792786c7400a136282c1664665ae0a8db921c6c2";
+      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
+    };
+  }
+  {
+    goPackagePath  = "github.com/rs/xid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/rs/xid";
+      rev =  "15d26544def341f036c5f8dca987a4cbe575032c";
+      sha256 = "1vgw1dikqw273awcci6pzifs7shkl5ah4l88j1zjbnpgbiwzlx9j";
+    };
+  }
+  {
+    goPackagePath  = "github.com/sirupsen/logrus";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sirupsen/logrus";
+      rev =  "839c75faf7f98a33d445d181f3018b5c3409a45e";
+      sha256 = "087k2lxrr9p9dh68yw71d05h5g9p5v26zbwd6j7lghinjfaw334x";
+    };
+  }
+  {
+    goPackagePath  = "github.com/stretchr/testify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/testify";
+      rev =  "221dbe5ed46703ee255b1da0dec05086f5035f62";
+      sha256 = "187i5g88sxfy4vxpm7dw1gwv29pa2qaq475lxrdh5livh69wqfjb";
     };
   }
   {
@@ -32,8 +122,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/crypto";
-      rev =  "a49355c7e3f8fe157a85be2f77e6e269a0f89602";
-      sha256 = "020q1laxjx5kcmnqy4wmdb63zhb0lyq6wpy40axhswzg2nd21s44";
+      rev =  "86a70503ff7e82ffc18c7b0de83db35da4791e6a";
+      sha256 = "0w7ih86lmll9gs2j0z3nmmy148i2yism9z53yp58zwa6d5pjahfn";
     };
   }
   {
@@ -41,8 +131,35 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/net";
-      rev =  "d0887baf81f4598189d4e12a37c6da86f0bba4d0";
-      sha256 = "00dmz9a5d3myyb0256b33vf1bk8wv1khhh88kcvbmqsfd6x1n6p5";
+      rev =  "5ee1b9f4859acd2e99987ef94ec7a58427c53bef";
+      sha256 = "0jvzqv6phv64rw4pj86x3j9kp5yx9p34fd38r46rb9464h69ba29";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev =  "ce4227a45e2eb77e5c847278dcc6a626742e2945";
+      sha256 = "1s43wvqfml6ml5ks7iv2bis9d664g77mq86v7mfmjhn56x856g35";
+    };
+  }
+  {
+    goPackagePath  = "gopkg.in/yaml.v2";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-yaml/yaml";
+      rev =  "1f64d6156d11335c3f22d9330b0ad14fc1e789ce";
+      sha256 = "0k5xcwkd3wmcx54isk7ck9cwp8fapfhyqdz3f13kxp77cxqizazj";
+    };
+  }
+  {
+    goPackagePath  = "gopkg.in/yaml.v3";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-yaml/yaml";
+      rev =  "4206685974f28e3178b35fa198a59899aa4dee3a";
+      sha256 = "1ff5fd8x45cay9100ds63hxd32s7czsrric0ql6a1jrxczsgqk1g";
     };
   }
 ]
diff --git a/pkgs/tools/networking/surfraw/default.nix b/pkgs/tools/networking/surfraw/default.nix
index d69221d9d50..eac73765300 100644
--- a/pkgs/tools/networking/surfraw/default.nix
+++ b/pkgs/tools/networking/surfraw/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   name = "surfraw-2.3.0";
 
   src = fetchurl {
-    url = "http://surfraw.alioth.debian.org/dist/surfraw-2.3.0.tar.gz";
+    url = "https://gitlab.com/surfraw/Surfraw/uploads/2de827b2786ef2fe43b6f07913ca7b7f/surfraw-2.3.0.tar.gz";
     sha256 = "099nbif0x5cbcf18snc58nx1a3q7z0v9br9p2jiq9pcc7ic2015d";
   };
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Provides a fast unix command line interface to a variety of popular WWW search engines and other artifacts of power";
-    homepage = http://surfraw.alioth.debian.org;
+    homepage = https://gitlab.com/surfraw/Surfraw;
     maintainers = [];
     platforms = stdenv.lib.platforms.linux;
     license = stdenv.lib.licenses.publicDomain;
diff --git a/pkgs/tools/networking/tdns-cli/default.nix b/pkgs/tools/networking/tdns-cli/default.nix
new file mode 100644
index 00000000000..473ee8ace34
--- /dev/null
+++ b/pkgs/tools/networking/tdns-cli/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  name = "tdns-cli";
+  version = "0.0.5";
+  
+  src = fetchFromGitHub {
+    owner = "rotty";
+    repo = name;
+    rev = "v${version}";
+    sha256 = "0nn036in5j1h0vxkwif0lf7fn900zy4f4kxlzy6qdx3jakgmxvwh";
+  };
+
+  cargoSha256 = "0h41ws3jcxb90mhnznckfkfv0mpx6ykga7087bipbaw2fqhr7izd";
+
+  meta = with stdenv.lib; {
+    description = "DNS tool that aims to replace dig and nsupdate";
+    homepage = "https://github.com/rotty/tdns-cli";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ astro ];
+  };
+}
diff --git a/pkgs/tools/networking/tinyfecvpn/default.nix b/pkgs/tools/networking/tinyfecvpn/default.nix
new file mode 100644
index 00000000000..aab937c994e
--- /dev/null
+++ b/pkgs/tools/networking/tinyfecvpn/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, fetchFromGitHub, pkgconfig }:
+
+stdenv.mkDerivation rec {
+  pname = "tinyfecvpn";
+  version = "20180820.0";
+
+  src = fetchFromGitHub {
+    owner = "wangyu-";
+    repo = pname;
+    rev = version;
+    sha256 = "1mbb9kzvy24na375dz0rlf5k93gan1vahamc9wzkn34mcx8i97cs";
+    fetchSubmodules = true;
+  };
+
+  enableParallelBuilding = true;
+  nativeBuildInputs = [ pkgconfig ];
+
+  patchPhase = ''
+    runHook prePatch
+    find . -type f -name "makefile" -exec sed "s/ -static/ -g/g" -i \{\} \;
+    runHook postPatch
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 tinyvpn $out/bin/tinyvpn
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/wangyu-/tinyfecVPN";
+    description = "A VPN Designed for Lossy Links, with Build-in Forward Error Correction(FEC) Support";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ petabyteboy ];
+  };
+}
diff --git a/pkgs/tools/networking/tridactyl-native/default.nix b/pkgs/tools/networking/tridactyl-native/default.nix
index 665d988f48e..44daa23cd92 100644
--- a/pkgs/tools/networking/tridactyl-native/default.nix
+++ b/pkgs/tools/networking/tridactyl-native/default.nix
@@ -7,13 +7,13 @@ stdenv.mkDerivation rec {
   pname = "tridactyl-native";
   # this is actually the version of tridactyl itself; the native messenger will
   # probably not change with every tridactyl version
-  version = "1.17.0";
+  version = "1.17.1";
 
   src = fetchFromGitHub {
     owner = "tridactyl";
     repo = "tridactyl";
     rev = version;
-    sha256 = "0dpd4jdym644rqm9h83lb8cwfccnwrnqm1g91nl913pj4k5x4hqr";
+    sha256 = "197vh3k9nh58djl6ph0lznkdb2schqlksxxr93xjkk4xsc7k6j1g";
   };
   sourceRoot = "source/native";
 
diff --git a/pkgs/tools/networking/twa/default.nix b/pkgs/tools/networking/twa/default.nix
index fe75b35eea2..b15b6dcba31 100644
--- a/pkgs/tools/networking/twa/default.nix
+++ b/pkgs/tools/networking/twa/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , gawk
 , host
+, jq
 , lib
 , makeWrapper
 , ncurses
@@ -12,18 +13,25 @@
 
 stdenv.mkDerivation rec {
   pname = "twa";
-  version = "1.8.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "trailofbits";
     repo = "twa";
     rev = version;
-    sha256 = "1xq35xyz5536nwrwmlp1wqa7q9jgh90ly7vdy3a5rvxnksx0b2l5";
+    sha256 = "1ab3bcyhfach9y15w8ffvqqan2qk8h62n6z8nqbgygi7n1mf6jzx";
   };
 
   dontBuild = true;
 
-  buildInputs = [ makeWrapper bash gawk curl netcat host.dnsutils ];
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [ bash
+                  curl
+                  gawk
+                  host.dnsutils
+                  jq
+                  netcat ];
 
   installPhase = ''
     install -Dm 0755 twa "$out/bin/twa"
@@ -32,7 +40,11 @@ stdenv.mkDerivation rec {
     install -Dm 0644 README.md "$out/share/doc/twa/README.md"
 
     wrapProgram "$out/bin/twa" \
-      --prefix PATH : ${stdenv.lib.makeBinPath [ curl netcat ncurses host.dnsutils ]}
+      --prefix PATH : ${stdenv.lib.makeBinPath [ curl
+                                                 host.dnsutils
+                                                 jq
+                                                 ncurses
+                                                 netcat ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/uget/default.nix b/pkgs/tools/networking/uget/default.nix
index 78dcb00eb78..b2da1384557 100644
--- a/pkgs/tools/networking/uget/default.nix
+++ b/pkgs/tools/networking/uget/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, intltool, openssl, curl, libnotify,
-  libappindicator-gtk3, gst_all_1, gtk3, gnome3, wrapGAppsHook, aria2 ? null
+  libappindicator-gtk3, gst_all_1, gtk3, dconf, wrapGAppsHook, aria2 ? null
 }:
 
 stdenv.mkDerivation rec {
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     libnotify
     libappindicator-gtk3
     gtk3
-    (stdenv.lib.getLib gnome3.dconf)
+    (stdenv.lib.getLib dconf)
   ]
   ++ (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-good ])
   ++ (stdenv.lib.optional (aria2 != null) aria2);
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index e83e5268629..18d9defdd94 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unbound";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchurl {
     url = "https://unbound.net/downloads/${pname}-${version}.tar.gz";
-    sha256 = "1c2bjm13x8bkw0ds1mhn9ivd2gzmfrb0x5y76bkz09a04bxjagix";
+    sha256 = "0myv8l886gmlh9nh4j3q5549idxnl51hf9cw20yxfqbwd47l13ca";
   };
 
   # https://github.com/NLnetLabs/unbound/pull/90
@@ -34,6 +34,10 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "configfile=\${out}/etc/unbound/unbound.conf" ];
 
+  postInstall = ''
+    make unbound-event-install
+  '';
+
   preFixup = stdenv.lib.optionalString (stdenv.isLinux && !stdenv.hostPlatform.isMusl) # XXX: revisit
     # Build libunbound again, but only against nettle instead of openssl.
     # This avoids gnutls.out -> unbound.lib -> openssl.out.
diff --git a/pkgs/tools/networking/v2ray/default.nix b/pkgs/tools/networking/v2ray/default.nix
new file mode 100644
index 00000000000..78f17934a78
--- /dev/null
+++ b/pkgs/tools/networking/v2ray/default.nix
@@ -0,0 +1,36 @@
+{ callPackage, fetchFromGitHub, fetchurl
+, assetOverrides ? {}
+, ... } @ args:
+
+callPackage ./generic.nix (rec {
+  version = "4.21.3";
+
+  src = fetchFromGitHub {
+    owner = "v2ray";
+    repo = "v2ray-core";
+    rev = "v${version}";
+    sha256 = "0z45nrjnalrvpprq7g4zrjbrdkc3d3lhs4ci8hb8m69f92asiwbs";
+  };
+
+  assets = {
+    # MIT licensed
+    "geoip.dat" = let
+      geoipRev = "20190516.1";
+      geoipSha256 = "14h4rq7rlcl1397pwpylfgwpk3fiscpzqb04c4wd5lxkfvk5f02r";
+    in fetchurl {
+      url = "https://github.com/v2ray/geoip/releases/download/${geoipRev}/geoip.dat";
+      sha256 = geoipSha256;
+    };
+
+    # MIT licensed
+    "geosite.dat" = let
+      geositeRev = "20191121.1";
+      geositeSha256 = "0ijmvy43pvm69w38djf114j8swni7wfq5ry9wdpv9dj0rzb59m74";
+    in fetchurl {
+      url = "https://github.com/v2ray/domain-list-community/releases/download/${geositeRev}/dlc.dat";
+      sha256 = geositeSha256;
+    };
+
+  } // assetOverrides;
+
+} // args)
diff --git a/pkgs/tools/networking/v2ray/generic.nix b/pkgs/tools/networking/v2ray/generic.nix
new file mode 100644
index 00000000000..bf6e6cd55ae
--- /dev/null
+++ b/pkgs/tools/networking/v2ray/generic.nix
@@ -0,0 +1,50 @@
+{ lib, linkFarm, buildGoModule, runCommand, makeWrapper
+
+# Version specific args
+, version, src, assets
+, ... }:
+
+let
+  assetsDrv = linkFarm "v2ray-assets" (lib.mapAttrsToList (name: path: {
+    inherit name path;
+  }) assets);
+
+  core = buildGoModule rec {
+    pname = "v2ray-core";
+    inherit version src;
+
+    modSha256 = "11gsncy3449a7y6w6pr7acqabyj2q2a1q52f8fcl5cdz1vjbmmxi";
+
+    buildPhase = ''
+      runHook preBuild
+
+      go build -o v2ray v2ray.com/core/main
+      go build -o v2ctl v2ray.com/core/infra/control/main
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      install -Dm755 v2ray v2ctl -t $out/bin
+    '';
+  };
+
+in runCommand "v2ray-${version}" {
+  inherit version;
+
+  buildInputs = [ assetsDrv core ];
+  nativeBuildInputs = [ makeWrapper ];
+
+  meta = {
+    homepage = "https://www.v2ray.com/en/index.html";
+    description = "A platform for building proxies to bypass network restrictions";
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [ servalcatty ];
+  };
+
+} ''
+  for file in ${core}/bin/*; do
+    makeWrapper "$file" "$out/bin/$(basename "$file")" \
+      --set-default V2RAY_LOCATION_ASSET ${assetsDrv}
+  done
+''
diff --git a/pkgs/tools/networking/v2ray/update.sh b/pkgs/tools/networking/v2ray/update.sh
new file mode 100755
index 00000000000..38ad77e98f8
--- /dev/null
+++ b/pkgs/tools/networking/v2ray/update.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq
+set -eo pipefail
+
+version_nix=$(dirname "$0")/default.nix
+deps_nix=$(dirname "$0")/deps.nix
+
+old_core_rev="v$(sed -En 's/.*\bversion = "(.*?)".*/\1/p' "$version_nix")"
+old_geoip_rev=$(sed -En 's/.*\bgeoipRev = "(.*?)".*/\1/p' "$version_nix")
+old_geosite_rev=$(sed -En 's/.*\bgeositeRev = "(.*?)".*/\1/p' "$version_nix")
+echo "Current version:" >&2
+echo "core: $old_core_rev, geoip: $old_geoip_rev, geosite: $old_geosite_rev" >&2
+
+function fetch_latest_rev {
+    curl "https://api.github.com/repos/v2ray/$1/releases" |
+        jq '.[0].tag_name' --raw-output
+}
+
+core_rev=$(fetch_latest_rev 'v2ray-core')
+geoip_rev=$(fetch_latest_rev 'geoip')
+geosite_rev=$(fetch_latest_rev 'domain-list-community')
+echo "Latest version:" >&2
+echo "core: $core_rev, geoip: $geoip_rev, geosite: $geosite_rev" >&2
+
+if [[ $core_rev != $old_core_rev ]]; then
+    echo "Prefetching core..." >&2
+    { read hash; read store_path; } < <(
+        nix-prefetch-url --unpack --print-path "https://github.com/v2ray/v2ray-core/archive/$core_rev.zip"
+    )
+
+    sed --in-place \
+        -e "s/\bversion = \".*\"/version = \"$(echo "$core_rev" | tail -c+2)\"/" \
+        -e "s/\bsha256 = \".*\"/sha256 = \"$hash\"/" \
+        "$version_nix"
+fi
+
+if [[ $geoip_rev != $old_geoip_rev ]]; then
+    echo "Prefetching geoip..." >&2
+    hash=$(nix-prefetch-url "https://github.com/v2ray/geoip/releases/download/$geoip_rev/geoip.dat")
+    sed --in-place \
+        -e "s/\bgeoipRev = \".*\"/geoipRev = \"$geoip_rev\"/" \
+        -e "s/\bgeoipSha256 = \".*\"/geoipSha256 = \"$hash\"/" \
+        "$version_nix"
+fi
+
+if [[ $geosite_rev != $old_geosite_rev ]]; then
+    echo "Prefetching geosite..." >&2
+    hash=$(nix-prefetch-url "https://github.com/v2ray/domain-list-community/releases/download/$geosite_rev/dlc.dat")
+    sed --in-place \
+        -e "s/\bgeositeRev = \".*\"/geositeRev = \"$geosite_rev\"/" \
+        -e "s/\bgeositeSha256 = \".*\"/geositeSha256 = \"$hash\"/" \
+        "$version_nix"
+fi
diff --git a/pkgs/tools/networking/whois/default.nix b/pkgs/tools/networking/whois/default.nix
index b0564ad7c74..e079f9a881e 100644
--- a/pkgs/tools/networking/whois/default.nix
+++ b/pkgs/tools/networking/whois/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, perl, gettext, pkgconfig, libidn2, libiconv }:
 
 stdenv.mkDerivation rec {
-  version = "5.5.2";
+  version = "5.5.3";
   pname = "whois";
 
   src = fetchFromGitHub {
     owner = "rfc1036";
     repo = "whois";
     rev = "v${version}";
-    sha256 = "0587xvw0ifjrwxgisw0nfx7qykmkly1knfdghrpph9vicpzwsidw";
+    sha256 = "099yvqng085f69k815961jnwk50nzmiknvhl1wwmji2hl36r160g";
   };
 
   nativeBuildInputs = [ perl gettext pkgconfig ];
diff --git a/pkgs/tools/networking/wifite2/default.nix b/pkgs/tools/networking/wifite2/default.nix
new file mode 100644
index 00000000000..2333408f078
--- /dev/null
+++ b/pkgs/tools/networking/wifite2/default.nix
@@ -0,0 +1,40 @@
+{ stdenv, lib, fetchFromGitHub, python3, aircrack-ng, wireshark-cli, reaverwps-t6x, cowpatty, hashcat, hcxtools, which }:
+
+python3.pkgs.buildPythonApplication rec {
+  version = "2.2.5";
+  pname = "wifite2";
+
+  src = fetchFromGitHub {
+    owner = "derv82";
+    repo = "wifite2";
+    rev = version;
+    sha256 = "1hfy90wf2bjg0z8rbs8cfhhvz78pzg2c6nj0zksal42mb6b5cjdp";
+  };
+
+  propagatedBuildInputs = [
+    aircrack-ng
+    wireshark-cli
+    reaverwps-t6x
+    cowpatty
+    hashcat
+    hcxtools
+    which
+  ];
+
+  postFixup = let
+    sitePackagesDir = "$out/lib/python3.${lib.versions.minor python3.version}/site-packages";
+  in ''
+    mv ${sitePackagesDir}/wifite/__main__.py ${sitePackagesDir}/wifite/wifite.py
+  '';
+
+  # which is not found
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/derv82/wifite2";
+    description = "Rewrite of the popular wireless network auditor, wifite";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ lassulus ];
+  };
+}
diff --git a/pkgs/tools/networking/wireguard-tools/default.nix b/pkgs/tools/networking/wireguard-tools/default.nix
index ad449429f99..8133e2a5a54 100644
--- a/pkgs/tools/networking/wireguard-tools/default.nix
+++ b/pkgs/tools/networking/wireguard-tools/default.nix
@@ -1,6 +1,7 @@
 {
   stdenv, fetchzip,
 
+  iptables ? null,
   iproute ? null,
   libmnl ? null,
   makeWrapper ? null,
@@ -13,11 +14,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "wireguard-tools";
-  version = "0.0.20191012";
+  version = "0.0.20191219";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${version}.tar.xz";
-    sha256 = "0nwcx7m5cpp4h1bclswiqq1jzj08xzpxmq5s4rcfqmrp59cmwgrs";
+    sha256 = "1qxpjvj3927xdly022rp2sndbifmr0c2y6ik77v43k95ch94716d";
   };
 
   sourceRoot = "source/src/tools";
@@ -38,7 +39,7 @@ stdenv.mkDerivation rec {
       --replace /usr/bin $out/bin
   '' + optionalString stdenv.isLinux ''
     for f in $out/bin/*; do
-      wrapProgram $f --prefix PATH : ${makeBinPath [procps iproute openresolv]}
+      wrapProgram $f --prefix PATH : ${makeBinPath [procps iproute iptables openresolv]}
     done
   '' + optionalString stdenv.isDarwin ''
     for f in $out/bin/*; do
diff --git a/pkgs/tools/networking/yggdrasil/default.nix b/pkgs/tools/networking/yggdrasil/default.nix
index f6fff42efdf..ca10adae0e4 100644
--- a/pkgs/tools/networking/yggdrasil/default.nix
+++ b/pkgs/tools/networking/yggdrasil/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "yggdrasil";
-  version = "0.3.11";
+  version = "0.3.12";
 
   src = fetchFromGitHub {
     owner = "yggdrasil-network";
     repo = "yggdrasil-go";
     rev = "v${version}";
-    sha256 = "0cz9axphqvpqwy591ws9by7khpdw96iwf9vmhif3i52ghp8hpfd1";
+    sha256 = "03ywxamjcnhcr20vm9pn3rq3hqq49i6rfdvx44czzr30h8xp8dhw";
   };
 
   modSha256 = "1vqk0jyqc1qcryi247r5pbvfjw3m48l028fb2mrq1xqqfkjqrr85";
diff --git a/pkgs/tools/networking/ytcc/default.nix b/pkgs/tools/networking/ytcc/default.nix
index d489d84d1cc..4675dac5f47 100644
--- a/pkgs/tools/networking/ytcc/default.nix
+++ b/pkgs/tools/networking/ytcc/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "ytcc";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "woefe";
     repo = "ytcc";
     rev = "v${version}";
-    sha256 = "080p145j5pg8db88kb0y3x1pfc3v4aj3w68pdihlmi68dhjdr7i7";
+    sha256 = "0a4gxdan3aivbpkxw9cv1bgl7rfrwdii12d096dx06zlymb27gqs";
   };
 
   nativeBuildInputs = [ gettext ];