New upstream version 1.29.90 upstream/1.29.90

13 files changed, 8400 insertions, 0 deletions

diff --git a/src/core/supplicant/nm-supplicant-config.c b/src/core/supplicant/nm-supplicant-config.c
new file mode 100644
index 00000000..eab494b0
--- /dev/null
+++ b/src/core/supplicant/nm-supplicant-config.c
@@ -0,0 +1,1698 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2006 - 2012 Red Hat, Inc.
+ * Copyright (C) 2007 - 2008 Novell, Inc.
+ */
+
+#include "src/core/nm-default-daemon.h"
+
+#include "nm-supplicant-config.h"
+
+#include <stdlib.h>
+
+#include "nm-glib-aux/nm-str-buf.h"
+#include "nm-core-internal.h"
+#include "nm-supplicant-settings-verify.h"
+#include "nm-setting.h"
+#include "nm-libnm-core-intern/nm-auth-subject.h"
+#include "NetworkManagerUtils.h"
+#include "nm-utils.h"
+#include "nm-setting-ip4-config.h"
+
+typedef struct {
+    char *         value;
+    guint32        len;
+    NMSupplOptType type;
+} ConfigOption;
+
+/*****************************************************************************/
+
+typedef struct {
+    GHashTable *   config;
+    GHashTable *   blobs;
+    NMSupplCapMask capabilities;
+    guint32        ap_scan;
+    bool           fast_required : 1;
+    bool           dispose_has_run : 1;
+    bool           ap_isolation : 1;
+} NMSupplicantConfigPrivate;
+
+struct _NMSupplicantConfig {
+    GObject                   parent;
+    NMSupplicantConfigPrivate _priv;
+};
+
+struct _NMSupplicantConfigClass {
+    GObjectClass parent;
+};
+
+G_DEFINE_TYPE(NMSupplicantConfig, nm_supplicant_config, G_TYPE_OBJECT)
+
+#define NM_SUPPLICANT_CONFIG_GET_PRIVATE(self) \
+    _NM_GET_PRIVATE(self, NMSupplicantConfig, NM_IS_SUPPLICANT_CONFIG)
+
+/*****************************************************************************/
+
+static gboolean
+_get_capability(NMSupplicantConfigPrivate *priv, NMSupplCapType type)
+{
+    return NM_SUPPL_CAP_MASK_GET(priv->capabilities, type) == NM_TERNARY_TRUE;
+}
+
+NMSupplicantConfig *
+nm_supplicant_config_new(NMSupplCapMask capabilities)
+{
+    NMSupplicantConfigPrivate *priv;
+    NMSupplicantConfig *       self;
+
+    self = g_object_new(NM_TYPE_SUPPLICANT_CONFIG, NULL);
+    priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+
+    priv->capabilities = capabilities;
+
+    return self;
+}
+
+static void
+config_option_free(ConfigOption *opt)
+{
+    g_free(opt->value);
+    g_slice_free(ConfigOption, opt);
+}
+
+static void
+nm_supplicant_config_init(NMSupplicantConfig *self)
+{
+    NMSupplicantConfigPrivate *priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+
+    priv->config = g_hash_table_new_full(nm_str_hash,
+                                         g_str_equal,
+                                         g_free,
+                                         (GDestroyNotify) config_option_free);
+
+    priv->ap_scan         = 1;
+    priv->dispose_has_run = FALSE;
+}
+
+static gboolean
+nm_supplicant_config_add_option_with_type(NMSupplicantConfig *self,
+                                          const char *        key,
+                                          const char *        value,
+                                          gint32              len,
+                                          NMSupplOptType      opt_type,
+                                          const char *        display_value,
+                                          GError **           error)
+{
+    NMSupplicantConfigPrivate *priv;
+    ConfigOption *             old_opt;
+    ConfigOption *             opt;
+    NMSupplOptType             type;
+
+    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
+    g_return_val_if_fail(key != NULL, FALSE);
+    g_return_val_if_fail(value != NULL, FALSE);
+    nm_assert(!error || !*error);
+
+    priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+
+    if (len < 0)
+        len = strlen(value);
+
+    if (opt_type != NM_SUPPL_OPT_TYPE_INVALID)
+        type = opt_type;
+    else {
+        type = nm_supplicant_settings_verify_setting(key, value, len);
+        if (type == NM_SUPPL_OPT_TYPE_INVALID) {
+            gs_free char *str_free = NULL;
+            const char *  str;
+
+            str = nm_utils_buf_utf8safe_escape(value,
+                                               len,
+                                               NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL,
+                                               &str_free);
+
+            str = nm_strquote_a(255, str);
+
+            g_set_error(error,
+                        NM_SUPPLICANT_ERROR,
+                        NM_SUPPLICANT_ERROR_CONFIG,
+                        "key '%s' and/or value %s invalid",
+                        key,
+                        display_value ?: str);
+            return FALSE;
+        }
+    }
+
+    old_opt = (ConfigOption *) g_hash_table_lookup(priv->config, key);
+    if (old_opt) {
+        g_set_error(error,
+                    NM_SUPPLICANT_ERROR,
+                    NM_SUPPLICANT_ERROR_CONFIG,
+                    "key '%s' already configured",
+                    key);
+        return FALSE;
+    }
+
+    opt        = g_slice_new0(ConfigOption);
+    opt->value = g_malloc(len + 1);
+    memcpy(opt->value, value, len);
+    opt->value[len] = '\0';
+
+    opt->len  = len;
+    opt->type = type;
+
+    {
+        char buf[255];
+        memset(&buf[0], 0, sizeof(buf));
+        memcpy(&buf[0], opt->value, opt->len > 254 ? 254 : opt->len);
+        nm_log_info(LOGD_SUPPLICANT,
+                    "Config: added '%s' value '%s'",
+                    key,
+                    display_value ?: &buf[0]);
+    }
+
+    g_hash_table_insert(priv->config, g_strdup(key), opt);
+
+    return TRUE;
+}
+
+static gboolean
+nm_supplicant_config_add_option(NMSupplicantConfig *self,
+                                const char *        key,
+                                const char *        value,
+                                gint32              len,
+                                const char *        display_value,
+                                GError **           error)
+{
+    return nm_supplicant_config_add_option_with_type(self,
+                                                     key,
+                                                     value,
+                                                     len,
+                                                     NM_SUPPL_OPT_TYPE_INVALID,
+                                                     display_value,
+                                                     error);
+}
+
+static gboolean
+nm_supplicant_config_add_blob(NMSupplicantConfig *self,
+                              const char *        key,
+                              GBytes *            value,
+                              const char *        blobid,
+                              GError **           error)
+{
+    NMSupplicantConfigPrivate *priv;
+    ConfigOption *             old_opt;
+    ConfigOption *             opt;
+    NMSupplOptType             type;
+    const guint8 *             data;
+    gsize                      data_len;
+
+    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
+    g_return_val_if_fail(key != NULL, FALSE);
+    g_return_val_if_fail(value != NULL, FALSE);
+    g_return_val_if_fail(blobid != NULL, FALSE);
+
+    data = g_bytes_get_data(value, &data_len);
+    g_return_val_if_fail(data_len > 0, FALSE);
+
+    priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+
+    type = nm_supplicant_settings_verify_setting(key, (const char *) data, data_len);
+    if (type == NM_SUPPL_OPT_TYPE_INVALID) {
+        g_set_error(error,
+                    NM_SUPPLICANT_ERROR,
+                    NM_SUPPLICANT_ERROR_CONFIG,
+                    "key '%s' and/or its contained value is invalid",
+                    key);
+        return FALSE;
+    }
+
+    old_opt = (ConfigOption *) g_hash_table_lookup(priv->config, key);
+    if (old_opt) {
+        g_set_error(error,
+                    NM_SUPPLICANT_ERROR,
+                    NM_SUPPLICANT_ERROR_CONFIG,
+                    "key '%s' already configured",
+                    key);
+        return FALSE;
+    }
+
+    opt        = g_slice_new0(ConfigOption);
+    opt->value = g_strdup_printf("blob://%s", blobid);
+    opt->len   = strlen(opt->value);
+    opt->type  = type;
+
+    nm_log_info(LOGD_SUPPLICANT, "Config: added '%s' value '%s'", key, opt->value);
+
+    g_hash_table_insert(priv->config, g_strdup(key), opt);
+    if (!priv->blobs) {
+        priv->blobs =
+            g_hash_table_new_full(nm_str_hash, g_str_equal, g_free, (GDestroyNotify) g_bytes_unref);
+    }
+    g_hash_table_insert(priv->blobs, g_strdup(blobid), g_bytes_ref(value));
+
+    return TRUE;
+}
+
+static gboolean
+nm_supplicant_config_add_blob_for_connection(NMSupplicantConfig *self,
+                                             GBytes *            field,
+                                             const char *        name,
+                                             const char *        con_uid,
+                                             GError **           error)
+{
+    if (field && g_bytes_get_size(field)) {
+        gs_free char *uid = NULL;
+        char *        p;
+
+        uid = g_strdup_printf("%s-%s", con_uid, name);
+        for (p = uid; *p; p++) {
+            if (*p == '/')
+                *p = '-';
+        }
+        if (!nm_supplicant_config_add_blob(self, name, field, uid, error))
+            return FALSE;
+    }
+    return TRUE;
+}
+
+static void
+nm_supplicant_config_finalize(GObject *object)
+{
+    NMSupplicantConfigPrivate *priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(object);
+
+    g_hash_table_destroy(priv->config);
+    nm_clear_pointer(&priv->blobs, g_hash_table_destroy);
+
+    G_OBJECT_CLASS(nm_supplicant_config_parent_class)->finalize(object);
+}
+
+static void
+nm_supplicant_config_class_init(NMSupplicantConfigClass *klass)
+{
+    GObjectClass *object_class = G_OBJECT_CLASS(klass);
+
+    object_class->finalize = nm_supplicant_config_finalize;
+}
+
+guint32
+nm_supplicant_config_get_ap_scan(NMSupplicantConfig *self)
+{
+    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), 1);
+
+    return NM_SUPPLICANT_CONFIG_GET_PRIVATE(self)->ap_scan;
+}
+
+gboolean
+nm_supplicant_config_fast_required(NMSupplicantConfig *self)
+{
+    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
+
+    return NM_SUPPLICANT_CONFIG_GET_PRIVATE(self)->fast_required;
+}
+
+GVariant *
+nm_supplicant_config_to_variant(NMSupplicantConfig *self)
+{
+    NMSupplicantConfigPrivate *priv;
+    GVariantBuilder            builder;
+    GHashTableIter             iter;
+    ConfigOption *             option;
+    const char *               key;
+
+    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), NULL);
+
+    priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+
+    g_variant_builder_init(&builder, G_VARIANT_TYPE_VARDICT);
+
+    g_hash_table_iter_init(&iter, priv->config);
+    while (g_hash_table_iter_next(&iter, (gpointer) &key, (gpointer) &option)) {
+        switch (option->type) {
+        case NM_SUPPL_OPT_TYPE_INT:
+            g_variant_builder_add(&builder, "{sv}", key, g_variant_new_int32(atoi(option->value)));
+            break;
+        case NM_SUPPL_OPT_TYPE_BYTES:
+        case NM_SUPPL_OPT_TYPE_UTF8:
+            g_variant_builder_add(
+                &builder,
+                "{sv}",
+                key,
+                g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, option->value, option->len, 1));
+            break;
+        case NM_SUPPL_OPT_TYPE_KEYWORD:
+        case NM_SUPPL_OPT_TYPE_STRING:
+            g_variant_builder_add(&builder, "{sv}", key, g_variant_new_string(option->value));
+            break;
+        default:
+            break;
+        }
+    }
+
+    return g_variant_builder_end(&builder);
+}
+
+GHashTable *
+nm_supplicant_config_get_blobs(NMSupplicantConfig *self)
+{
+    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), NULL);
+
+    return NM_SUPPLICANT_CONFIG_GET_PRIVATE(self)->blobs;
+}
+
+static const char *
+wifi_freqs_to_string(gboolean bg_band)
+{
+    static const char *str_2ghz = NULL;
+    static const char *str_5ghz = NULL;
+    const char **      f_p;
+    const char *       f;
+
+    f_p = bg_band ? &str_2ghz : &str_5ghz;
+
+again:
+    f = g_atomic_pointer_get(f_p);
+
+    if (G_UNLIKELY(!f)) {
+        nm_auto_str_buf NMStrBuf strbuf = NM_STR_BUF_INIT(400, FALSE);
+        const guint *            freqs;
+        int                      i;
+
+        freqs = bg_band ? nm_utils_wifi_2ghz_freqs() : nm_utils_wifi_5ghz_freqs();
+        for (i = 0; freqs[i]; i++) {
+            if (i > 0)
+                nm_str_buf_append_c(&strbuf, ' ');
+            nm_str_buf_append_printf(&strbuf, "%u", freqs[i]);
+        }
+
+        f = g_strdup(nm_str_buf_get_str(&strbuf));
+
+        if (!g_atomic_pointer_compare_and_exchange(f_p, NULL, f)) {
+            g_free((char *) f);
+            goto again;
+        }
+    }
+
+    return f;
+}
+
+gboolean
+nm_supplicant_config_add_setting_macsec(NMSupplicantConfig *self,
+                                        NMSettingMacsec *   setting,
+                                        GError **           error)
+{
+    const char *value;
+    char        buf[32];
+    int         port;
+
+    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
+    g_return_val_if_fail(setting != NULL, FALSE);
+    g_return_val_if_fail(!error || !*error, FALSE);
+
+    if (!nm_supplicant_config_add_option(self, "macsec_policy", "1", -1, NULL, error))
+        return FALSE;
+
+    value = nm_setting_macsec_get_encrypt(setting) ? "0" : "1";
+    if (!nm_supplicant_config_add_option(self, "macsec_integ_only", value, -1, NULL, error))
+        return FALSE;
+
+    port = nm_setting_macsec_get_port(setting);
+    if (port > 0 && port < 65534) {
+        snprintf(buf, sizeof(buf), "%d", port);
+        if (!nm_supplicant_config_add_option(self, "macsec_port", buf, -1, NULL, error))
+            return FALSE;
+    }
+
+    if (nm_setting_macsec_get_mode(setting) == NM_SETTING_MACSEC_MODE_PSK) {
+        guint8 buffer_cak[NM_SETTING_MACSEC_MKA_CAK_LENGTH / 2];
+        guint8 buffer_ckn[NM_SETTING_MACSEC_MKA_CKN_LENGTH / 2];
+
+        if (!nm_supplicant_config_add_option(self, "key_mgmt", "NONE", -1, NULL, error))
+            return FALSE;
+
+        value = nm_setting_macsec_get_mka_cak(setting);
+        if (!value || !nm_utils_hexstr2bin_buf(value, FALSE, FALSE, NULL, buffer_cak)) {
+            g_set_error_literal(error,
+                                NM_SUPPLICANT_ERROR,
+                                NM_SUPPLICANT_ERROR_CONFIG,
+                                value ? "invalid MKA CAK" : "missing MKA CAK");
+            return FALSE;
+        }
+        if (!nm_supplicant_config_add_option(self,
+                                             "mka_cak",
+                                             (char *) buffer_cak,
+                                             sizeof(buffer_cak),
+                                             "<hidden>",
+                                             error))
+            return FALSE;
+
+        value = nm_setting_macsec_get_mka_ckn(setting);
+        if (!value || !nm_utils_hexstr2bin_buf(value, FALSE, FALSE, NULL, buffer_ckn)) {
+            g_set_error_literal(error,
+                                NM_SUPPLICANT_ERROR,
+                                NM_SUPPLICANT_ERROR_CONFIG,
+                                value ? "invalid MKA CKN" : "missing MKA CKN");
+            return FALSE;
+        }
+        if (!nm_supplicant_config_add_option(self,
+                                             "mka_ckn",
+                                             (char *) buffer_ckn,
+                                             sizeof(buffer_ckn),
+                                             value,
+                                             error))
+            return FALSE;
+    }
+
+    return TRUE;
+}
+
+gboolean
+nm_supplicant_config_add_setting_wireless(NMSupplicantConfig *self,
+                                          NMSettingWireless * setting,
+                                          guint32             fixed_freq,
+                                          GError **           error)
+{
+    NMSupplicantConfigPrivate *priv;
+    gboolean                   is_adhoc, is_ap, is_mesh;
+    const char *               mode, *band;
+    guint32                    channel;
+    GBytes *                   ssid;
+    const char *               bssid;
+
+    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
+    g_return_val_if_fail(setting != NULL, FALSE);
+    g_return_val_if_fail(!error || !*error, FALSE);
+
+    priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+
+    mode     = nm_setting_wireless_get_mode(setting);
+    is_adhoc = nm_streq0(mode, "adhoc");
+    is_ap    = nm_streq0(mode, "ap");
+    is_mesh  = nm_streq0(mode, "mesh");
+    if (is_adhoc || is_ap)
+        priv->ap_scan = 2;
+    else
+        priv->ap_scan = 1;
+
+    ssid = nm_setting_wireless_get_ssid(setting);
+    if (!nm_supplicant_config_add_option(self,
+                                         "ssid",
+                                         (char *) g_bytes_get_data(ssid, NULL),
+                                         g_bytes_get_size(ssid),
+                                         NULL,
+                                         error))
+        return FALSE;
+
+    if (is_adhoc) {
+        if (!nm_supplicant_config_add_option(self, "mode", "1", -1, NULL, error))
+            return FALSE;
+    }
+
+    if (is_ap) {
+        if (!nm_supplicant_config_add_option(self, "mode", "2", -1, NULL, error))
+            return FALSE;
+
+        if (nm_setting_wireless_get_hidden(setting)
+            && !nm_supplicant_config_add_option(self,
+                                                "ignore_broadcast_ssid",
+                                                "1",
+                                                -1,
+                                                NULL,
+                                                error))
+            return FALSE;
+    }
+
+    if (is_mesh) {
+        if (!nm_supplicant_config_add_option(self, "mode", "5", -1, NULL, error))
+            return FALSE;
+    }
+
+    if ((is_adhoc || is_ap || is_mesh) && fixed_freq) {
+        gs_free char *str_freq = NULL;
+
+        str_freq = g_strdup_printf("%u", fixed_freq);
+        if (!nm_supplicant_config_add_option(self, "frequency", str_freq, -1, NULL, error))
+            return FALSE;
+    }
+
+    /* Except for Ad-Hoc, Hotspot and Mesh, request that the driver probe for the
+     * specific SSID we want to associate with.
+     */
+    if (!(is_adhoc || is_ap || is_mesh)) {
+        if (!nm_supplicant_config_add_option(self, "scan_ssid", "1", -1, NULL, error))
+            return FALSE;
+    }
+
+    bssid = nm_setting_wireless_get_bssid(setting);
+    if (bssid) {
+        if (!nm_supplicant_config_add_option(self, "bssid", bssid, strlen(bssid), NULL, error))
+            return FALSE;
+    }
+
+    band    = nm_setting_wireless_get_band(setting);
+    channel = nm_setting_wireless_get_channel(setting);
+    if (band) {
+        if (channel) {
+            guint32       freq;
+            gs_free char *str_freq = NULL;
+
+            freq     = nm_utils_wifi_channel_to_freq(channel, band);
+            str_freq = g_strdup_printf("%u", freq);
+            if (!nm_supplicant_config_add_option(self, "freq_list", str_freq, -1, NULL, error))
+                return FALSE;
+        } else {
+            const char *freqs = NULL;
+
+            if (nm_streq(band, "a"))
+                freqs = wifi_freqs_to_string(FALSE);
+            else if (nm_streq(band, "bg"))
+                freqs = wifi_freqs_to_string(TRUE);
+
+            if (freqs
+                && !nm_supplicant_config_add_option(self,
+                                                    "freq_list",
+                                                    freqs,
+                                                    strlen(freqs),
+                                                    NULL,
+                                                    error))
+                return FALSE;
+        }
+    }
+
+    return TRUE;
+}
+
+gboolean
+nm_supplicant_config_add_bgscan(NMSupplicantConfig *self, NMConnection *connection, GError **error)
+{
+    NMSettingWireless *        s_wifi;
+    NMSettingWirelessSecurity *s_wsec;
+    const char *               bgscan;
+
+    s_wifi = nm_connection_get_setting_wireless(connection);
+    g_assert(s_wifi);
+
+    /* Don't scan when a shared connection (either AP or Ad-Hoc) is active;
+     * it will disrupt connected clients.
+     */
+    if (NM_IN_STRSET(nm_setting_wireless_get_mode(s_wifi),
+                     NM_SETTING_WIRELESS_MODE_AP,
+                     NM_SETTING_WIRELESS_MODE_ADHOC))
+        return TRUE;
+
+    /* Don't scan when the connection is locked to a specific AP, since
+     * intra-ESS roaming (which requires periodic scanning) isn't being
+     * used due to the specific AP lock. (bgo #513820)
+     */
+    if (nm_setting_wireless_get_bssid(s_wifi))
+        return TRUE;
+
+    /* Default to a very long bgscan interval when signal is OK on the assumption
+     * that either (a) there aren't multiple APs and we don't need roaming, or
+     * (b) since EAP/802.1x isn't used and thus there are fewer steps to fail
+     * during a roam, we can wait longer before scanning for roam candidates.
+     */
+    bgscan = "simple:30:-70:86400";
+
+    /* If using WPA Enterprise, Dynamic WEP or we have seen more than one AP use
+     * a shorter bgscan interval on the assumption that this is a multi-AP ESS
+     * in which we want more reliable roaming between APs. Thus trigger scans
+     * when the signal is still somewhat OK so we have an up-to-date roam
+     * candidate list when the signal gets bad.
+     */
+    if (nm_setting_wireless_get_num_seen_bssids(s_wifi) > 1
+        || ((s_wsec = nm_connection_get_setting_wireless_security(connection))
+            && NM_IN_STRSET(nm_setting_wireless_security_get_key_mgmt(s_wsec),
+                            "ieee8021x",
+                            "wpa-eap",
+                            "wpa-eap-suite-b-192")))
+        bgscan = "simple:30:-65:300";
+
+    return nm_supplicant_config_add_option(self, "bgscan", bgscan, -1, FALSE, error);
+}
+
+static gboolean
+add_string_val(NMSupplicantConfig *self,
+               const char *        field,
+               const char *        name,
+               gboolean            ucase,
+               const char *        display_value,
+               GError **           error)
+{
+    if (field) {
+        gs_free char *value = NULL;
+
+        if (ucase) {
+            value = g_ascii_strup(field, -1);
+            field = value;
+        }
+        return nm_supplicant_config_add_option(self,
+                                               name,
+                                               field,
+                                               strlen(field),
+                                               display_value,
+                                               error);
+    }
+    return TRUE;
+}
+
+#define ADD_STRING_LIST_VAL(self,                                                         \
+                            setting,                                                      \
+                            setting_name,                                                 \
+                            field,                                                        \
+                            field_plural,                                                 \
+                            name,                                                         \
+                            separator,                                                    \
+                            ucase,                                                        \
+                            display_value,                                                \
+                            error)                                                        \
+    ({                                                                                    \
+        typeof(*(setting)) *_setting = (setting);                                         \
+        gboolean            _success = TRUE;                                              \
+                                                                                          \
+        if (nm_setting_##setting_name##_get_num_##field_plural(_setting)) {               \
+            const char _separator = (separator);                                          \
+            GString *  _str       = g_string_new(NULL);                                   \
+            guint      _k, _n;                                                            \
+                                                                                          \
+            _n = nm_setting_##setting_name##_get_num_##field_plural(_setting);            \
+            for (_k = 0; _k < _n; _k++) {                                                 \
+                const char *item = nm_setting_##setting_name##_get_##field(_setting, _k); \
+                                                                                          \
+                if (!_str->len) {                                                         \
+                    g_string_append(_str, item);                                          \
+                } else {                                                                  \
+                    g_string_append_c(_str, _separator);                                  \
+                    g_string_append(_str, item);                                          \
+                }                                                                         \
+            }                                                                             \
+            if ((ucase))                                                                  \
+                g_string_ascii_up(_str);                                                  \
+            if (_str->len) {                                                              \
+                if (!nm_supplicant_config_add_option((self),                              \
+                                                     (name),                              \
+                                                     _str->str,                           \
+                                                     -1,                                  \
+                                                     (display_value),                     \
+                                                     (error)))                            \
+                    _success = FALSE;                                                     \
+            }                                                                             \
+            g_string_free(_str, TRUE);                                                    \
+        }                                                                                 \
+        _success;                                                                         \
+    })
+
+static void
+wep128_passphrase_hash(const char *input, gsize input_len, guint8 *digest /* 13 bytes */)
+{
+    nm_auto_free_checksum GChecksum *sum = NULL;
+    guint8                           md5[NM_UTILS_CHECKSUM_LENGTH_MD5];
+    guint8                           data[64];
+    int                              i;
+
+    nm_assert(input);
+    nm_assert(input_len);
+    nm_assert(digest);
+
+    /* Get at least 64 bytes by repeating the passphrase into the buffer */
+    for (i = 0; i < sizeof(data); i++)
+        data[i] = input[i % input_len];
+
+    sum = g_checksum_new(G_CHECKSUM_MD5);
+    g_checksum_update(sum, data, sizeof(data));
+    nm_utils_checksum_get_digest(sum, md5);
+
+    /* WEP104 keys are 13 bytes in length (26 hex characters) */
+    memcpy(digest, md5, 13);
+}
+
+static gboolean
+add_wep_key(NMSupplicantConfig *self,
+            const char *        key,
+            const char *        name,
+            NMWepKeyType        wep_type,
+            GError **           error)
+{
+    gsize key_len;
+
+    if (!key || (key_len = strlen(key)) == 0)
+        return TRUE;
+
+    if (wep_type == NM_WEP_KEY_TYPE_UNKNOWN) {
+        if (nm_utils_wep_key_valid(key, NM_WEP_KEY_TYPE_KEY))
+            wep_type = NM_WEP_KEY_TYPE_KEY;
+        else if (nm_utils_wep_key_valid(key, NM_WEP_KEY_TYPE_PASSPHRASE))
+            wep_type = NM_WEP_KEY_TYPE_PASSPHRASE;
+    }
+
+    if ((wep_type == NM_WEP_KEY_TYPE_UNKNOWN) || (wep_type == NM_WEP_KEY_TYPE_KEY)) {
+        if ((key_len == 10) || (key_len == 26)) {
+            guint8 buffer[26 / 2];
+
+            if (!nm_utils_hexstr2bin_full(key,
+                                          FALSE,
+                                          FALSE,
+                                          FALSE,
+                                          NULL,
+                                          key_len / 2,
+                                          buffer,
+                                          sizeof(buffer),
+                                          NULL)) {
+                g_set_error(error,
+                            NM_SUPPLICANT_ERROR,
+                            NM_SUPPLICANT_ERROR_CONFIG,
+                            "cannot add wep-key %s to supplicant config because key is not hex",
+                            name);
+                return FALSE;
+            }
+            if (!nm_supplicant_config_add_option(self,
+                                                 name,
+                                                 (char *) buffer,
+                                                 key_len / 2,
+                                                 "<hidden>",
+                                                 error))
+                return FALSE;
+        } else if ((key_len == 5) || (key_len == 13)) {
+            if (!nm_supplicant_config_add_option(self, name, key, key_len, "<hidden>", error))
+                return FALSE;
+        } else {
+            g_set_error(
+                error,
+                NM_SUPPLICANT_ERROR,
+                NM_SUPPLICANT_ERROR_CONFIG,
+                "Cannot add wep-key %s to supplicant config because key-length %u is invalid",
+                name,
+                (guint) key_len);
+            return FALSE;
+        }
+    } else if (wep_type == NM_WEP_KEY_TYPE_PASSPHRASE) {
+        guint8 digest[13];
+
+        wep128_passphrase_hash(key, key_len, digest);
+        if (!nm_supplicant_config_add_option(self,
+                                             name,
+                                             (const char *) digest,
+                                             sizeof(digest),
+                                             "<hidden>",
+                                             error))
+            return FALSE;
+    }
+
+    return TRUE;
+}
+
+gboolean
+nm_supplicant_config_add_setting_wireless_security(NMSupplicantConfig *          self,
+                                                   NMSettingWirelessSecurity *   setting,
+                                                   NMSetting8021x *              setting_8021x,
+                                                   const char *                  con_uuid,
+                                                   guint32                       mtu,
+                                                   NMSettingWirelessSecurityPmf  pmf,
+                                                   NMSettingWirelessSecurityFils fils,
+                                                   GError **                     error)
+{
+    NMSupplicantConfigPrivate *priv             = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+    nm_auto_free_gstring GString *key_mgmt_conf = NULL;
+    const char *                  key_mgmt, *auth_alg;
+    const char *                  psk;
+    gboolean                      set_pmf;
+
+    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
+    g_return_val_if_fail(setting != NULL, FALSE);
+    g_return_val_if_fail(con_uuid != NULL, FALSE);
+    g_return_val_if_fail(!error || !*error, FALSE);
+
+    /* Check if we actually support FILS */
+    if (!_get_capability(priv, NM_SUPPL_CAP_TYPE_FILS)) {
+        if (fils == NM_SETTING_WIRELESS_SECURITY_FILS_REQUIRED) {
+            g_set_error_literal(error,
+                                NM_SUPPLICANT_ERROR,
+                                NM_SUPPLICANT_ERROR_CONFIG,
+                                "Supplicant does not support FILS");
+            return FALSE;
+        } else if (fils == NM_SETTING_WIRELESS_SECURITY_FILS_OPTIONAL)
+            fils = NM_SETTING_WIRELESS_SECURITY_FILS_DISABLE;
+    }
+
+    key_mgmt      = nm_setting_wireless_security_get_key_mgmt(setting);
+    key_mgmt_conf = g_string_new(key_mgmt);
+    if (nm_streq(key_mgmt, "wpa-psk")) {
+        if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF))
+            g_string_append(key_mgmt_conf, " wpa-psk-sha256");
+        if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT))
+            g_string_append(key_mgmt_conf, " ft-psk");
+    } else if (nm_streq(key_mgmt, "wpa-eap")) {
+        if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF)) {
+            g_string_append(key_mgmt_conf, " wpa-eap-sha256");
+
+            if (_get_capability(priv, NM_SUPPL_CAP_TYPE_SUITEB192)
+                && pmf == NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED)
+                g_string_append(key_mgmt_conf, " wpa-eap-suite-b-192");
+        }
+        if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT))
+            g_string_append(key_mgmt_conf, " ft-eap");
+        if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT)
+            && _get_capability(priv, NM_SUPPL_CAP_TYPE_SHA384))
+            g_string_append(key_mgmt_conf, " ft-eap-sha384");
+        switch (fils) {
+        case NM_SETTING_WIRELESS_SECURITY_FILS_REQUIRED:
+            g_string_truncate(key_mgmt_conf, 0);
+            if (!_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF))
+                g_string_assign(key_mgmt_conf, "fils-sha256 fils-sha384");
+            /* fall-through */
+        case NM_SETTING_WIRELESS_SECURITY_FILS_OPTIONAL:
+            if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF))
+                g_string_append(key_mgmt_conf, " fils-sha256 fils-sha384");
+            if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF)
+                && _get_capability(priv, NM_SUPPL_CAP_TYPE_FT))
+                g_string_append(key_mgmt_conf, " ft-fils-sha256");
+            if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF)
+                && _get_capability(priv, NM_SUPPL_CAP_TYPE_FT)
+                && _get_capability(priv, NM_SUPPL_CAP_TYPE_SHA384))
+                g_string_append(key_mgmt_conf, " ft-fils-sha384");
+            break;
+        default:
+            break;
+        }
+    } else if (nm_streq(key_mgmt, "sae")) {
+        if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT))
+            g_string_append(key_mgmt_conf, " ft-sae");
+    } else if (nm_streq(key_mgmt, "wpa-eap-suite-b-192")) {
+        pmf = NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED;
+        if (!nm_supplicant_config_add_option(self, "pairwise", "GCMP-256", -1, NULL, error)
+            || !nm_supplicant_config_add_option(self, "group", "GCMP-256", -1, NULL, error))
+            return FALSE;
+    }
+
+    if (!add_string_val(self, key_mgmt_conf->str, "key_mgmt", TRUE, NULL, error))
+        return FALSE;
+
+    auth_alg = nm_setting_wireless_security_get_auth_alg(setting);
+    if (!add_string_val(self, auth_alg, "auth_alg", TRUE, NULL, error))
+        return FALSE;
+
+    psk = nm_setting_wireless_security_get_psk(setting);
+    if (psk) {
+        size_t psk_len = strlen(psk);
+
+        if (psk_len >= 8 && psk_len <= 63) {
+            /* Use NM_SUPPL_OPT_TYPE_STRING here so that it gets pushed to the
+             * supplicant as a string, and therefore gets quoted,
+             * and therefore the supplicant will interpret it as a
+             * passphrase and not a hex key.
+             */
+            if (!nm_supplicant_config_add_option_with_type(self,
+                                                           "psk",
+                                                           psk,
+                                                           -1,
+                                                           NM_SUPPL_OPT_TYPE_STRING,
+                                                           "<hidden>",
+                                                           error))
+                return FALSE;
+        } else if (nm_streq(key_mgmt, "sae")) {
+            /* If the SAE password doesn't comply with WPA-PSK limitation,
+             * we need to call it "sae_password" instead of "psk".
+             */
+            if (!nm_supplicant_config_add_option_with_type(self,
+                                                           "sae_password",
+                                                           psk,
+                                                           -1,
+                                                           NM_SUPPL_OPT_TYPE_STRING,
+                                                           "<hidden>",
+                                                           error))
+                return FALSE;
+        } else if (psk_len == 64) {
+            guint8 buffer[32];
+
+            /* Hex PSK */
+            if (!nm_utils_hexstr2bin_buf(psk, FALSE, FALSE, NULL, buffer)) {
+                g_set_error(error,
+                            NM_SUPPLICANT_ERROR,
+                            NM_SUPPLICANT_ERROR_CONFIG,
+                            "Cannot add psk to supplicant config due to invalid hex");
+                return FALSE;
+            }
+            if (!nm_supplicant_config_add_option(self,
+                                                 "psk",
+                                                 (char *) buffer,
+                                                 sizeof(buffer),
+                                                 "<hidden>",
+                                                 error))
+                return FALSE;
+        } else {
+            g_set_error(error,
+                        NM_SUPPLICANT_ERROR,
+                        NM_SUPPLICANT_ERROR_CONFIG,
+                        "Cannot add psk to supplicant config due to invalid PSK length %u (not "
+                        "between 8 and 63 characters)",
+                        (guint) psk_len);
+            return FALSE;
+        }
+    }
+
+    /* Don't try to enable PMF on non-WPA/SAE/OWE networks */
+    if (!NM_IN_STRSET(key_mgmt, "wpa-eap", "wpa-eap-suite-b-192", "wpa-psk", "sae", "owe"))
+        pmf = NM_SETTING_WIRELESS_SECURITY_PMF_DISABLE;
+
+    /* Check if we actually support PMF */
+    set_pmf = TRUE;
+    if (!_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF)) {
+        if (pmf == NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED) {
+            g_set_error_literal(error,
+                                NM_SUPPLICANT_ERROR,
+                                NM_SUPPLICANT_ERROR_CONFIG,
+                                "Supplicant does not support PMF");
+            return FALSE;
+        }
+        set_pmf = FALSE;
+    }
+
+    /* Only WPA-specific things when using WPA */
+    if (NM_IN_STRSET(key_mgmt, "wpa-psk", "wpa-eap", "sae", "owe")) {
+        if (!ADD_STRING_LIST_VAL(self,
+                                 setting,
+                                 wireless_security,
+                                 proto,
+                                 protos,
+                                 "proto",
+                                 ' ',
+                                 TRUE,
+                                 NULL,
+                                 error))
+            return FALSE;
+        if (!ADD_STRING_LIST_VAL(self,
+                                 setting,
+                                 wireless_security,
+                                 pairwise,
+                                 pairwise,
+                                 "pairwise",
+                                 ' ',
+                                 TRUE,
+                                 NULL,
+                                 error))
+            return FALSE;
+        if (!ADD_STRING_LIST_VAL(self,
+                                 setting,
+                                 wireless_security,
+                                 group,
+                                 groups,
+                                 "group",
+                                 ' ',
+                                 TRUE,
+                                 NULL,
+                                 error))
+            return FALSE;
+
+        if (set_pmf
+            && NM_IN_SET(pmf,
+                         NM_SETTING_WIRELESS_SECURITY_PMF_DISABLE,
+                         NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED)) {
+            if (!nm_supplicant_config_add_option(
+                    self,
+                    "ieee80211w",
+                    pmf == NM_SETTING_WIRELESS_SECURITY_PMF_DISABLE ? "0" : "2",
+                    -1,
+                    NULL,
+                    error))
+                return FALSE;
+        }
+    }
+
+    /* WEP keys if required */
+    if (nm_streq(key_mgmt, "none")) {
+        NMWepKeyType wep_type = nm_setting_wireless_security_get_wep_key_type(setting);
+        const char * wep0     = nm_setting_wireless_security_get_wep_key(setting, 0);
+        const char * wep1     = nm_setting_wireless_security_get_wep_key(setting, 1);
+        const char * wep2     = nm_setting_wireless_security_get_wep_key(setting, 2);
+        const char * wep3     = nm_setting_wireless_security_get_wep_key(setting, 3);
+
+        if (!add_wep_key(self, wep0, "wep_key0", wep_type, error))
+            return FALSE;
+        if (!add_wep_key(self, wep1, "wep_key1", wep_type, error))
+            return FALSE;
+        if (!add_wep_key(self, wep2, "wep_key2", wep_type, error))
+            return FALSE;
+        if (!add_wep_key(self, wep3, "wep_key3", wep_type, error))
+            return FALSE;
+
+        if (wep0 || wep1 || wep2 || wep3) {
+            gs_free char *value = NULL;
+
+            value = g_strdup_printf("%d", nm_setting_wireless_security_get_wep_tx_keyidx(setting));
+            if (!nm_supplicant_config_add_option(self, "wep_tx_keyidx", value, -1, NULL, error))
+                return FALSE;
+        }
+    }
+
+    if (nm_streq0(auth_alg, "leap")) {
+        /* LEAP */
+        if (nm_streq(key_mgmt, "ieee8021x")) {
+            const char *tmp;
+
+            tmp = nm_setting_wireless_security_get_leap_username(setting);
+            if (!add_string_val(self, tmp, "identity", FALSE, NULL, error))
+                return FALSE;
+
+            tmp = nm_setting_wireless_security_get_leap_password(setting);
+            if (!add_string_val(self, tmp, "password", FALSE, "<hidden>", error))
+                return FALSE;
+
+            if (!add_string_val(self, "leap", "eap", TRUE, NULL, error))
+                return FALSE;
+        } else {
+            g_set_error(error,
+                        NM_SUPPLICANT_ERROR,
+                        NM_SUPPLICANT_ERROR_CONFIG,
+                        "Invalid key-mgmt \"%s\" for leap",
+                        key_mgmt);
+            return FALSE;
+        }
+    } else {
+        /* 802.1x for Dynamic WEP and WPA-Enterprise */
+        if (NM_IN_STRSET(key_mgmt, "ieee8021x", "wpa-eap", "wpa-eap-suite-b-192")) {
+            if (!setting_8021x) {
+                g_set_error(error,
+                            NM_SUPPLICANT_ERROR,
+                            NM_SUPPLICANT_ERROR_CONFIG,
+                            "Cannot set key-mgmt %s with missing 8021x setting",
+                            key_mgmt);
+                return FALSE;
+            }
+            if (!nm_supplicant_config_add_setting_8021x(self,
+                                                        setting_8021x,
+                                                        con_uuid,
+                                                        mtu,
+                                                        FALSE,
+                                                        error))
+                return FALSE;
+        }
+
+        if (NM_IN_STRSET(key_mgmt, "wpa-eap", "wpa-eap-suite-b-192")) {
+            /* When using WPA-Enterprise, we want to use Proactive Key Caching (also
+             * called Opportunistic Key Caching) to avoid full EAP exchanges when
+             * roaming between access points in the same mobility group.
+             */
+            if (!nm_supplicant_config_add_option(self,
+                                                 "proactive_key_caching",
+                                                 "1",
+                                                 -1,
+                                                 NULL,
+                                                 error))
+                return FALSE;
+        }
+    }
+
+    return TRUE;
+}
+
+static gboolean
+add_pkcs11_uri_with_pin(NMSupplicantConfig *       self,
+                        const char *               name,
+                        const char *               uri,
+                        const char *               pin,
+                        const NMSettingSecretFlags pin_flags,
+                        GError **                  error)
+{
+    gs_strfreev char **split     = NULL;
+    gs_free char *     tmp       = NULL;
+    gs_free char *     tmp_log   = NULL;
+    gs_free char *     pin_qattr = NULL;
+    char *             escaped   = NULL;
+
+    if (uri == NULL)
+        return TRUE;
+
+    /* We ignore the attributes -- RFC 7512 suggests that some of them
+     * might be unsafe and we want to be on the safe side. Also, we're
+     * installing our attributes, so this makes things a bit easier for us. */
+    split = g_strsplit(uri, "&", 2);
+    if (split[1])
+        nm_log_info(LOGD_SUPPLICANT, "URI attributes ignored");
+
+    /* Fill in the PIN if required. */
+    if (pin) {
+        escaped   = g_uri_escape_string(pin, NULL, TRUE);
+        pin_qattr = g_strdup_printf("pin-value=%s", escaped);
+        g_free(escaped);
+    } else if (!(pin_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED)) {
+        /* Include an empty PIN to indicate the login is still needed.
+         * Probably a token that has a PIN path and the actual PIN will
+         * be entered using a protected path. */
+        pin_qattr = g_strdup("pin-value=");
+    }
+
+    tmp = g_strdup_printf("%s%s%s", split[0], (pin_qattr ? "?" : ""), (pin_qattr ?: ""));
+
+    tmp_log = g_strdup_printf("%s%s%s",
+                              split[0],
+                              (pin_qattr ? "?" : ""),
+                              (pin_qattr ? "pin-value=<hidden>" : ""));
+
+    return add_string_val(self, tmp, name, FALSE, tmp_log, error);
+}
+
+gboolean
+nm_supplicant_config_add_setting_8021x(NMSupplicantConfig *self,
+                                       NMSetting8021x *    setting,
+                                       const char *        con_uuid,
+                                       guint32             mtu,
+                                       gboolean            wired,
+                                       GError **           error)
+{
+    NMSupplicantConfigPrivate *priv;
+    char *                     tmp;
+    const char *               peapver, *value, *path;
+    gboolean                   added;
+    GString *                  phase1, *phase2;
+    GBytes *                   bytes;
+    gboolean                   fast = FALSE;
+    guint32                    i, num_eap;
+    gboolean                   fast_provisoning_allowed = FALSE;
+    const char *               ca_path_override = NULL, *ca_cert_override = NULL;
+    guint32                    frag, hdrs;
+    gs_free char *             frag_str = NULL;
+    NMSetting8021xAuthFlags    phase1_auth_flags;
+    nm_auto_free_gstring GString *eap_str = NULL;
+
+    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
+    g_return_val_if_fail(setting != NULL, FALSE);
+    g_return_val_if_fail(con_uuid != NULL, FALSE);
+
+    priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+
+    value = nm_setting_802_1x_get_password(setting);
+    if (value) {
+        if (!add_string_val(self, value, "password", FALSE, "<hidden>", error))
+            return FALSE;
+    } else {
+        bytes = nm_setting_802_1x_get_password_raw(setting);
+        if (bytes) {
+            if (!nm_supplicant_config_add_option(self,
+                                                 "password",
+                                                 (const char *) g_bytes_get_data(bytes, NULL),
+                                                 g_bytes_get_size(bytes),
+                                                 "<hidden>",
+                                                 error))
+                return FALSE;
+        }
+    }
+    value = nm_setting_802_1x_get_pin(setting);
+    if (!add_string_val(self, value, "pin", FALSE, "<hidden>", error))
+        return FALSE;
+
+    if (wired) {
+        if (!add_string_val(self, "IEEE8021X", "key_mgmt", FALSE, NULL, error))
+            return FALSE;
+        /* Wired 802.1x must always use eapol_flags=0 */
+        if (!add_string_val(self, "0", "eapol_flags", FALSE, NULL, error))
+            return FALSE;
+        priv->ap_scan = 0;
+    }
+
+    /* Build the "eap" option string while we check for EAP methods needing
+     * special handling: PEAP + GTC, FAST, external */
+    eap_str = g_string_new(NULL);
+    num_eap = nm_setting_802_1x_get_num_eap_methods(setting);
+    for (i = 0; i < num_eap; i++) {
+        const char *method = nm_setting_802_1x_get_eap_method(setting, i);
+
+        if (nm_streq(method, "fast")) {
+            fast                = TRUE;
+            priv->fast_required = TRUE;
+        }
+
+        if (nm_streq(method, "external")) {
+            if (num_eap == 1) {
+                g_set_error(error,
+                            NM_SUPPLICANT_ERROR,
+                            NM_SUPPLICANT_ERROR_CONFIG,
+                            "Connection settings managed externally to NM, connection"
+                            " cannot be used with wpa_supplicant");
+                return FALSE;
+            }
+            continue;
+        }
+
+        if (eap_str->len)
+            g_string_append_c(eap_str, ' ');
+        g_string_append(eap_str, method);
+    }
+
+    g_string_ascii_up(eap_str);
+    if (eap_str->len
+        && !nm_supplicant_config_add_option(self, "eap", eap_str->str, -1, NULL, error))
+        return FALSE;
+
+    /* Adjust the fragment size according to MTU, but do not set it higher than 1280-14
+     * for better compatibility */
+    hdrs = 14; /* EAPOL + EAP-TLS */
+    frag = 1280 - hdrs;
+    if (mtu > hdrs)
+        frag = CLAMP(mtu - hdrs, 100, frag);
+    frag_str = g_strdup_printf("%u", frag);
+
+    if (!nm_supplicant_config_add_option(self, "fragment_size", frag_str, -1, NULL, error))
+        return FALSE;
+
+    phase1  = g_string_new(NULL);
+    peapver = nm_setting_802_1x_get_phase1_peapver(setting);
+    if (peapver) {
+        if (nm_streq(peapver, "0"))
+            g_string_append(phase1, "peapver=0");
+        else if (nm_streq(peapver, "1"))
+            g_string_append(phase1, "peapver=1");
+    }
+
+    if (nm_setting_802_1x_get_phase1_peaplabel(setting)) {
+        if (phase1->len)
+            g_string_append_c(phase1, ' ');
+        g_string_append_printf(phase1,
+                               "peaplabel=%s",
+                               nm_setting_802_1x_get_phase1_peaplabel(setting));
+    }
+
+    value = nm_setting_802_1x_get_phase1_fast_provisioning(setting);
+    if (value) {
+        if (phase1->len)
+            g_string_append_c(phase1, ' ');
+        g_string_append_printf(phase1, "fast_provisioning=%s", value);
+
+        if (!nm_streq(value, "0"))
+            fast_provisoning_allowed = TRUE;
+    }
+
+    phase1_auth_flags = nm_setting_802_1x_get_phase1_auth_flags(setting);
+    if (NM_FLAGS_HAS(phase1_auth_flags, NM_SETTING_802_1X_AUTH_FLAGS_TLS_1_0_DISABLE))
+        g_string_append_printf(phase1, "%stls_disable_tlsv1_0=1", (phase1->len ? " " : ""));
+    if (NM_FLAGS_HAS(phase1_auth_flags, NM_SETTING_802_1X_AUTH_FLAGS_TLS_1_1_DISABLE))
+        g_string_append_printf(phase1, "%stls_disable_tlsv1_1=1", (phase1->len ? " " : ""));
+    if (NM_FLAGS_HAS(phase1_auth_flags, NM_SETTING_802_1X_AUTH_FLAGS_TLS_1_2_DISABLE))
+        g_string_append_printf(phase1, "%stls_disable_tlsv1_2=1", (phase1->len ? " " : ""));
+
+    if (phase1->len) {
+        if (!add_string_val(self, phase1->str, "phase1", FALSE, NULL, error)) {
+            g_string_free(phase1, TRUE);
+            return FALSE;
+        }
+    }
+    g_string_free(phase1, TRUE);
+
+    phase2 = g_string_new(NULL);
+    if (nm_setting_802_1x_get_phase2_auth(setting) && !fast_provisoning_allowed) {
+        tmp = g_ascii_strup(nm_setting_802_1x_get_phase2_auth(setting), -1);
+        g_string_append_printf(phase2, "auth=%s", tmp);
+        g_free(tmp);
+    }
+
+    if (nm_setting_802_1x_get_phase2_autheap(setting)) {
+        if (phase2->len)
+            g_string_append_c(phase2, ' ');
+        tmp = g_ascii_strup(nm_setting_802_1x_get_phase2_autheap(setting), -1);
+        g_string_append_printf(phase2, "autheap=%s", tmp);
+        g_free(tmp);
+    }
+
+    if (phase2->len) {
+        if (!add_string_val(self, phase2->str, "phase2", FALSE, NULL, error)) {
+            g_string_free(phase2, TRUE);
+            return FALSE;
+        }
+    }
+    g_string_free(phase2, TRUE);
+
+    /* PAC file */
+    path = nm_setting_802_1x_get_pac_file(setting);
+    if (path) {
+        if (!add_string_val(self, path, "pac_file", FALSE, NULL, error))
+            return FALSE;
+    } else {
+        /* PAC file is not specified.
+         * If provisioning is allowed, use an blob format.
+         */
+        if (fast_provisoning_allowed) {
+            gs_free char *blob_name = NULL;
+
+            blob_name = g_strdup_printf("blob://pac-blob-%s", con_uuid);
+            if (!add_string_val(self, blob_name, "pac_file", FALSE, NULL, error))
+                return FALSE;
+        } else {
+            /* This is only error for EAP-FAST; don't disturb other methods. */
+            if (fast) {
+                g_set_error(error,
+                            NM_SUPPLICANT_ERROR,
+                            NM_SUPPLICANT_ERROR_CONFIG,
+                            "EAP-FAST error: no PAC file provided and "
+                            "automatic PAC provisioning is disabled");
+                return FALSE;
+            }
+        }
+    }
+
+    /* If user wants to use system CA certs, either populate ca_path (if the path
+     * is a directory) or ca_cert (the path is a file name) */
+    if (nm_setting_802_1x_get_system_ca_certs(setting)) {
+        if (g_file_test(SYSTEM_CA_PATH, G_FILE_TEST_IS_DIR))
+            ca_path_override = SYSTEM_CA_PATH;
+        else
+            ca_cert_override = SYSTEM_CA_PATH;
+    }
+
+    /* CA path */
+    path = nm_setting_802_1x_get_ca_path(setting);
+    path = ca_path_override ?: path;
+    if (path) {
+        if (!add_string_val(self, path, "ca_path", FALSE, NULL, error))
+            return FALSE;
+    }
+
+    /* Phase2 CA path */
+    path = nm_setting_802_1x_get_phase2_ca_path(setting);
+    path = ca_path_override ?: path;
+    if (path) {
+        if (!add_string_val(self, path, "ca_path2", FALSE, NULL, error))
+            return FALSE;
+    }
+
+    /* CA certificate */
+    if (ca_cert_override) {
+        if (!add_string_val(self, ca_cert_override, "ca_cert", FALSE, NULL, error))
+            return FALSE;
+    } else {
+        switch (nm_setting_802_1x_get_ca_cert_scheme(setting)) {
+        case NM_SETTING_802_1X_CK_SCHEME_BLOB:
+            bytes = nm_setting_802_1x_get_ca_cert_blob(setting);
+            if (!nm_supplicant_config_add_blob_for_connection(self,
+                                                              bytes,
+                                                              "ca_cert",
+                                                              con_uuid,
+                                                              error))
+                return FALSE;
+            break;
+        case NM_SETTING_802_1X_CK_SCHEME_PATH:
+            path = nm_setting_802_1x_get_ca_cert_path(setting);
+            if (!add_string_val(self, path, "ca_cert", FALSE, NULL, error))
+                return FALSE;
+            break;
+        case NM_SETTING_802_1X_CK_SCHEME_PKCS11:
+            if (!add_pkcs11_uri_with_pin(self,
+                                         "ca_cert",
+                                         nm_setting_802_1x_get_ca_cert_uri(setting),
+                                         nm_setting_802_1x_get_ca_cert_password(setting),
+                                         nm_setting_802_1x_get_ca_cert_password_flags(setting),
+                                         error)) {
+                return FALSE;
+            }
+            break;
+        default:
+            break;
+        }
+    }
+
+    /* Phase 2 CA certificate */
+    if (ca_cert_override) {
+        if (!add_string_val(self, ca_cert_override, "ca_cert2", FALSE, NULL, error))
+            return FALSE;
+    } else {
+        switch (nm_setting_802_1x_get_phase2_ca_cert_scheme(setting)) {
+        case NM_SETTING_802_1X_CK_SCHEME_BLOB:
+            bytes = nm_setting_802_1x_get_phase2_ca_cert_blob(setting);
+            if (!nm_supplicant_config_add_blob_for_connection(self,
+                                                              bytes,
+                                                              "ca_cert2",
+                                                              con_uuid,
+                                                              error))
+                return FALSE;
+            break;
+        case NM_SETTING_802_1X_CK_SCHEME_PATH:
+            path = nm_setting_802_1x_get_phase2_ca_cert_path(setting);
+            if (!add_string_val(self, path, "ca_cert2", FALSE, NULL, error))
+                return FALSE;
+            break;
+        case NM_SETTING_802_1X_CK_SCHEME_PKCS11:
+            if (!add_pkcs11_uri_with_pin(
+                    self,
+                    "ca_cert2",
+                    nm_setting_802_1x_get_phase2_ca_cert_uri(setting),
+                    nm_setting_802_1x_get_phase2_ca_cert_password(setting),
+                    nm_setting_802_1x_get_phase2_ca_cert_password_flags(setting),
+                    error)) {
+                return FALSE;
+            }
+            break;
+        default:
+            break;
+        }
+    }
+
+    /* Subject match */
+    value = nm_setting_802_1x_get_subject_match(setting);
+    if (!add_string_val(self, value, "subject_match", FALSE, NULL, error))
+        return FALSE;
+    value = nm_setting_802_1x_get_phase2_subject_match(setting);
+    if (!add_string_val(self, value, "subject_match2", FALSE, NULL, error))
+        return FALSE;
+
+    /* altSubjectName match */
+    if (!ADD_STRING_LIST_VAL(self,
+                             setting,
+                             802_1x,
+                             altsubject_match,
+                             altsubject_matches,
+                             "altsubject_match",
+                             ';',
+                             FALSE,
+                             NULL,
+                             error))
+        return FALSE;
+    if (!ADD_STRING_LIST_VAL(self,
+                             setting,
+                             802_1x,
+                             phase2_altsubject_match,
+                             phase2_altsubject_matches,
+                             "altsubject_match2",
+                             ';',
+                             FALSE,
+                             NULL,
+                             error))
+        return FALSE;
+
+    /* Domain suffix match */
+    value = nm_setting_802_1x_get_domain_suffix_match(setting);
+    if (!add_string_val(self, value, "domain_suffix_match", FALSE, NULL, error))
+        return FALSE;
+    value = nm_setting_802_1x_get_phase2_domain_suffix_match(setting);
+    if (!add_string_val(self, value, "domain_suffix_match2", FALSE, NULL, error))
+        return FALSE;
+
+    /* domain match */
+    value = nm_setting_802_1x_get_domain_match(setting);
+    if (!add_string_val(self, value, "domain_match", FALSE, NULL, error))
+        return FALSE;
+    value = nm_setting_802_1x_get_phase2_domain_match(setting);
+    if (!add_string_val(self, value, "domain_match2", FALSE, NULL, error))
+        return FALSE;
+
+    /* Private key */
+    added = FALSE;
+    switch (nm_setting_802_1x_get_private_key_scheme(setting)) {
+    case NM_SETTING_802_1X_CK_SCHEME_BLOB:
+        bytes = nm_setting_802_1x_get_private_key_blob(setting);
+        if (!nm_supplicant_config_add_blob_for_connection(self,
+                                                          bytes,
+                                                          "private_key",
+                                                          con_uuid,
+                                                          error))
+            return FALSE;
+        added = TRUE;
+        break;
+    case NM_SETTING_802_1X_CK_SCHEME_PATH:
+        path = nm_setting_802_1x_get_private_key_path(setting);
+        if (!add_string_val(self, path, "private_key", FALSE, NULL, error))
+            return FALSE;
+        added = TRUE;
+        break;
+    case NM_SETTING_802_1X_CK_SCHEME_PKCS11:
+        if (!add_pkcs11_uri_with_pin(self,
+                                     "private_key",
+                                     nm_setting_802_1x_get_private_key_uri(setting),
+                                     nm_setting_802_1x_get_private_key_password(setting),
+                                     nm_setting_802_1x_get_private_key_password_flags(setting),
+                                     error)) {
+            return FALSE;
+        }
+        added = TRUE;
+        break;
+    default:
+        break;
+    }
+
+    if (added) {
+        NMSetting8021xCKFormat format;
+        NMSetting8021xCKScheme scheme;
+
+        format = nm_setting_802_1x_get_private_key_format(setting);
+        scheme = nm_setting_802_1x_get_private_key_scheme(setting);
+
+        if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH
+            || format == NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
+            /* Only add the private key password for PKCS#12 blobs and
+             * all path schemes, since in both of these cases the private key
+             * isn't decrypted at all.
+             */
+            value = nm_setting_802_1x_get_private_key_password(setting);
+            if (!add_string_val(self, value, "private_key_passwd", FALSE, "<hidden>", error))
+                return FALSE;
+        }
+
+        if (format != NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
+            /* Only add the client cert if the private key is not PKCS#12, as
+             * wpa_supplicant configuration directs us to do.
+             */
+            switch (nm_setting_802_1x_get_client_cert_scheme(setting)) {
+            case NM_SETTING_802_1X_CK_SCHEME_BLOB:
+                bytes = nm_setting_802_1x_get_client_cert_blob(setting);
+                if (!nm_supplicant_config_add_blob_for_connection(self,
+                                                                  bytes,
+                                                                  "client_cert",
+                                                                  con_uuid,
+                                                                  error))
+                    return FALSE;
+                break;
+            case NM_SETTING_802_1X_CK_SCHEME_PATH:
+                path = nm_setting_802_1x_get_client_cert_path(setting);
+                if (!add_string_val(self, path, "client_cert", FALSE, NULL, error))
+                    return FALSE;
+                break;
+            case NM_SETTING_802_1X_CK_SCHEME_PKCS11:
+                if (!add_pkcs11_uri_with_pin(
+                        self,
+                        "client_cert",
+                        nm_setting_802_1x_get_client_cert_uri(setting),
+                        nm_setting_802_1x_get_client_cert_password(setting),
+                        nm_setting_802_1x_get_client_cert_password_flags(setting),
+                        error)) {
+                    return FALSE;
+                }
+                break;
+            default:
+                break;
+            }
+        }
+    }
+
+    /* Phase 2 private key */
+    added = FALSE;
+    switch (nm_setting_802_1x_get_phase2_private_key_scheme(setting)) {
+    case NM_SETTING_802_1X_CK_SCHEME_BLOB:
+        bytes = nm_setting_802_1x_get_phase2_private_key_blob(setting);
+        if (!nm_supplicant_config_add_blob_for_connection(self,
+                                                          bytes,
+                                                          "private_key2",
+                                                          con_uuid,
+                                                          error))
+            return FALSE;
+        added = TRUE;
+        break;
+    case NM_SETTING_802_1X_CK_SCHEME_PATH:
+        path = nm_setting_802_1x_get_phase2_private_key_path(setting);
+        if (!add_string_val(self, path, "private_key2", FALSE, NULL, error))
+            return FALSE;
+        added = TRUE;
+        break;
+    case NM_SETTING_802_1X_CK_SCHEME_PKCS11:
+        if (!add_pkcs11_uri_with_pin(
+                self,
+                "private_key2",
+                nm_setting_802_1x_get_phase2_private_key_uri(setting),
+                nm_setting_802_1x_get_phase2_private_key_password(setting),
+                nm_setting_802_1x_get_phase2_private_key_password_flags(setting),
+                error)) {
+            return FALSE;
+        }
+        added = TRUE;
+        break;
+    default:
+        break;
+    }
+
+    if (added) {
+        NMSetting8021xCKFormat format;
+        NMSetting8021xCKScheme scheme;
+
+        format = nm_setting_802_1x_get_phase2_private_key_format(setting);
+        scheme = nm_setting_802_1x_get_phase2_private_key_scheme(setting);
+
+        if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH
+            || format == NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
+            /* Only add the private key password for PKCS#12 blobs and
+             * all path schemes, since in both of these cases the private key
+             * isn't decrypted at all.
+             */
+            value = nm_setting_802_1x_get_phase2_private_key_password(setting);
+            if (!add_string_val(self, value, "private_key2_passwd", FALSE, "<hidden>", error))
+                return FALSE;
+        }
+
+        if (format != NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
+            /* Only add the client cert if the private key is not PKCS#12, as
+             * wpa_supplicant configuration directs us to do.
+             */
+            switch (nm_setting_802_1x_get_phase2_client_cert_scheme(setting)) {
+            case NM_SETTING_802_1X_CK_SCHEME_BLOB:
+                bytes = nm_setting_802_1x_get_phase2_client_cert_blob(setting);
+                if (!nm_supplicant_config_add_blob_for_connection(self,
+                                                                  bytes,
+                                                                  "client_cert2",
+                                                                  con_uuid,
+                                                                  error))
+                    return FALSE;
+                break;
+            case NM_SETTING_802_1X_CK_SCHEME_PATH:
+                path = nm_setting_802_1x_get_phase2_client_cert_path(setting);
+                if (!add_string_val(self, path, "client_cert2", FALSE, NULL, error))
+                    return FALSE;
+                break;
+            case NM_SETTING_802_1X_CK_SCHEME_PKCS11:
+                if (!add_pkcs11_uri_with_pin(
+                        self,
+                        "client_cert2",
+                        nm_setting_802_1x_get_phase2_client_cert_uri(setting),
+                        nm_setting_802_1x_get_phase2_client_cert_password(setting),
+                        nm_setting_802_1x_get_phase2_client_cert_password_flags(setting),
+                        error)) {
+                    return FALSE;
+                }
+                break;
+            default:
+                break;
+            }
+        }
+    }
+
+    value = nm_setting_802_1x_get_identity(setting);
+    if (!add_string_val(self, value, "identity", FALSE, NULL, error))
+        return FALSE;
+    value = nm_setting_802_1x_get_anonymous_identity(setting);
+    if (!add_string_val(self, value, "anonymous_identity", FALSE, NULL, error))
+        return FALSE;
+
+    return TRUE;
+}
+
+gboolean
+nm_supplicant_config_add_no_security(NMSupplicantConfig *self, GError **error)
+{
+    return nm_supplicant_config_add_option(self, "key_mgmt", "NONE", -1, NULL, error);
+}
+
+gboolean
+nm_supplicant_config_get_ap_isolation(NMSupplicantConfig *self)
+{
+    return self->_priv.ap_isolation;
+}
+
+void
+nm_supplicant_config_set_ap_isolation(NMSupplicantConfig *self, gboolean ap_isolation)
+{
+    self->_priv.ap_isolation = ap_isolation;
+}
diff --git a/src/core/supplicant/nm-supplicant-config.h b/src/core/supplicant/nm-supplicant-config.h
new file mode 100644
index 00000000..b5619362
--- /dev/null
+++ b/src/core/supplicant/nm-supplicant-config.h
@@ -0,0 +1,77 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2006 - 2012 Red Hat, Inc.
+ * Copyright (C) 2007 - 2008 Novell, Inc.
+ */
+
+#ifndef __NETWORKMANAGER_SUPPLICANT_CONFIG_H__
+#define __NETWORKMANAGER_SUPPLICANT_CONFIG_H__
+
+#include "nm-setting-macsec.h"
+#include "nm-setting-wireless.h"
+#include "nm-setting-wireless-security.h"
+#include "nm-setting-8021x.h"
+
+#include "nm-supplicant-types.h"
+
+#define NM_TYPE_SUPPLICANT_CONFIG (nm_supplicant_config_get_type())
+#define NM_SUPPLICANT_CONFIG(obj) \
+    (G_TYPE_CHECK_INSTANCE_CAST((obj), NM_TYPE_SUPPLICANT_CONFIG, NMSupplicantConfig))
+#define NM_SUPPLICANT_CONFIG_CLASS(klass) \
+    (G_TYPE_CHECK_CLASS_CAST((klass), NM_TYPE_SUPPLICANT_CONFIG, NMSupplicantConfigClass))
+#define NM_IS_SUPPLICANT_CONFIG(obj) (G_TYPE_CHECK_INSTANCE_TYPE((obj), NM_TYPE_SUPPLICANT_CONFIG))
+#define NM_IS_SUPPLICANT_CONFIG_CLASS(klass) \
+    (G_TYPE_CHECK_CLASS_TYPE((klass), NM_TYPE_SUPPLICANT_CONFIG))
+#define NM_SUPPLICANT_CONFIG_GET_CLASS(obj) \
+    (G_TYPE_INSTANCE_GET_CLASS((obj), NM_TYPE_SUPPLICANT_CONFIG, NMSupplicantConfigClass))
+
+typedef struct _NMSupplicantConfigClass NMSupplicantConfigClass;
+
+GType nm_supplicant_config_get_type(void);
+
+NMSupplicantConfig *nm_supplicant_config_new(NMSupplCapMask capabilities);
+
+guint32 nm_supplicant_config_get_ap_scan(NMSupplicantConfig *self);
+
+gboolean nm_supplicant_config_fast_required(NMSupplicantConfig *self);
+
+GVariant *nm_supplicant_config_to_variant(NMSupplicantConfig *self);
+
+GHashTable *nm_supplicant_config_get_blobs(NMSupplicantConfig *self);
+
+gboolean nm_supplicant_config_add_setting_wireless(NMSupplicantConfig *self,
+                                                   NMSettingWireless * setting,
+                                                   guint32             fixed_freq,
+                                                   GError **           error);
+
+gboolean
+nm_supplicant_config_add_bgscan(NMSupplicantConfig *self, NMConnection *connection, GError **error);
+
+gboolean nm_supplicant_config_add_setting_wireless_security(NMSupplicantConfig *       self,
+                                                            NMSettingWirelessSecurity *setting,
+                                                            NMSetting8021x *setting_8021x,
+                                                            const char *    con_uuid,
+                                                            guint32         mtu,
+                                                            NMSettingWirelessSecurityPmf  pmf,
+                                                            NMSettingWirelessSecurityFils fils,
+                                                            GError **                     error);
+
+gboolean nm_supplicant_config_add_no_security(NMSupplicantConfig *self, GError **error);
+
+gboolean nm_supplicant_config_add_setting_8021x(NMSupplicantConfig *self,
+                                                NMSetting8021x *    setting,
+                                                const char *        con_uuid,
+                                                guint32             mtu,
+                                                gboolean            wired,
+                                                GError **           error);
+
+gboolean nm_supplicant_config_add_setting_macsec(NMSupplicantConfig *self,
+                                                 NMSettingMacsec *   setting,
+                                                 GError **           error);
+
+gboolean nm_supplicant_config_enable_pmf_akm(NMSupplicantConfig *self, GError **error);
+
+void     nm_supplicant_config_set_ap_isolation(NMSupplicantConfig *self, gboolean ap_isolation);
+gboolean nm_supplicant_config_get_ap_isolation(NMSupplicantConfig *self);
+
+#endif /* __NETWORKMANAGER_SUPPLICANT_CONFIG_H__ */
diff --git a/src/core/supplicant/nm-supplicant-interface.c b/src/core/supplicant/nm-supplicant-interface.c
new file mode 100644
index 00000000..6d9c604f
--- /dev/null
+++ b/src/core/supplicant/nm-supplicant-interface.c
@@ -0,0 +1,3522 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2006 - 2017 Red Hat, Inc.
+ * Copyright (C) 2006 - 2008 Novell, Inc.
+ */
+
+#include "src/core/nm-default-daemon.h"
+
+#include "nm-supplicant-interface.h"
+
+#include <stdio.h>
+#include <linux/if_ether.h>
+
+#include "NetworkManagerUtils.h"
+#include "nm-core-internal.h"
+#include "nm-glib-aux/nm-c-list.h"
+#include "nm-glib-aux/nm-ref-string.h"
+#include "nm-std-aux/nm-dbus-compat.h"
+#include "nm-supplicant-config.h"
+#include "nm-supplicant-manager.h"
+#include "shared/nm-glib-aux/nm-dbus-aux.h"
+
+#define DBUS_TIMEOUT_MSEC 20000
+
+/*****************************************************************************/
+
+typedef struct {
+    NMSupplicantInterface *self;
+    char *                 type;
+    char *                 bssid;
+    char *                 pin;
+    guint                  signal_id;
+    GCancellable *         cancellable;
+    bool                   needs_cancelling : 1;
+    bool                   is_cancelling : 1;
+} WpsData;
+
+struct _AddNetworkData;
+
+typedef struct {
+    NMSupplicantInterface *      self;
+    NMSupplicantConfig *         cfg;
+    GCancellable *               cancellable;
+    NMSupplicantInterfaceAssocCb callback;
+    gpointer                     user_data;
+    guint                        fail_on_idle_id;
+    guint                        blobs_left;
+    guint                        calls_left;
+    struct _AddNetworkData *     add_network_data;
+} AssocData;
+
+typedef struct _AddNetworkData {
+    /* the assoc_data at the time when doing the call. */
+    AssocData *  assoc_data;
+    NMRefString *name_owner;
+    NMRefString *object_path;
+    GObject *    shutdown_wait_obj;
+} AddNetworkData;
+
+enum {
+    STATE,           /* change in the interface's state */
+    BSS_CHANGED,     /* a new BSS appeared, was updated, or was removed. */
+    PEER_CHANGED,    /* a new Peer appeared, was updated, or was removed */
+    WPS_CREDENTIALS, /* WPS credentials received */
+    GROUP_STARTED,   /* a new Group (interface) was created */
+    GROUP_FINISHED,  /* a Group (interface) has been finished */
+    LAST_SIGNAL
+};
+
+static guint signals[LAST_SIGNAL] = {0};
+
+NM_GOBJECT_PROPERTIES_DEFINE(NMSupplicantInterface,
+                             PROP_SUPPLICANT_MANAGER,
+                             PROP_DBUS_OBJECT_PATH,
+                             PROP_IFINDEX,
+                             PROP_P2P_GROUP_JOINED,
+                             PROP_P2P_GROUP_PATH,
+                             PROP_P2P_GROUP_OWNER,
+                             PROP_SCANNING,
+                             PROP_CURRENT_BSS,
+                             PROP_DRIVER,
+                             PROP_P2P_AVAILABLE,
+                             PROP_AUTH_STATE, );
+
+typedef struct _NMSupplicantInterfacePrivate {
+    NMSupplicantManager *supplicant_manager;
+
+    GDBusConnection *dbus_connection;
+    NMRefString *    name_owner;
+    NMRefString *    object_path;
+
+    char *ifname;
+
+    GCancellable *main_cancellable;
+
+    NMRefString *p2p_group_path;
+
+    GCancellable *p2p_group_properties_cancellable;
+
+    WpsData *wps_data;
+
+    AssocData *assoc_data;
+
+    char *net_path;
+
+    char *driver;
+
+    GHashTable *bss_idx;
+    CList       bss_lst_head;
+    CList       bss_initializing_lst_head;
+
+    NMRefString *current_bss;
+
+    GHashTable *peer_idx;
+    CList       peer_lst_head;
+    CList       peer_initializing_lst_head;
+
+    gint64 last_scan_msec;
+
+    NMSupplicantAuthState auth_state;
+
+    NMSupplicantDriver requested_driver;
+    NMSupplCapMask     global_capabilities;
+    NMSupplCapMask     iface_capabilities;
+
+    guint properties_changed_id;
+    guint signal_id;
+    guint bss_properties_changed_id;
+    guint peer_properties_changed_id;
+    guint p2p_group_properties_changed_id;
+
+    int ifindex;
+
+    int starting_pending_count;
+
+    guint32 max_scan_ssids;
+
+    gint32 disconnect_reason;
+
+    NMSupplicantInterfaceState state;
+    NMSupplicantInterfaceState supp_state;
+
+    bool scanning_property : 1;
+    bool scanning_cached : 1;
+
+    bool p2p_capable_property : 1;
+    bool p2p_capable_cached : 1;
+
+    bool p2p_group_owner_property : 1;
+    bool p2p_group_owner_cached : 1;
+
+    bool p2p_group_joined_cached : 1;
+
+    bool is_ready_main : 1;
+    bool is_ready_p2p_device : 1;
+
+    bool prop_scan_active : 1;
+    bool prop_scan_ssid : 1;
+
+    bool ap_isolate_supported : 1;
+    bool ap_isolate_needs_reset : 1;
+} NMSupplicantInterfacePrivate;
+
+struct _NMSupplicantInterfaceClass {
+    GObjectClass parent;
+};
+
+G_DEFINE_TYPE(NMSupplicantInterface, nm_supplicant_interface, G_TYPE_OBJECT)
+
+#define NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self) \
+    _NM_GET_PRIVATE_PTR(self, NMSupplicantInterface, NM_IS_SUPPLICANT_INTERFACE)
+
+/*****************************************************************************/
+
+static const char *
+_log_pretty_object_path(NMSupplicantInterfacePrivate *priv)
+{
+    const char *s;
+
+    nm_assert(priv);
+    nm_assert(NM_IS_REF_STRING(priv->object_path));
+
+    s = priv->object_path->str;
+    if (NM_STR_HAS_PREFIX(s, "/fi/w1/wpa_supplicant1/Interfaces/")) {
+        s += NM_STRLEN("/fi/w1/wpa_supplicant1/Interfaces/");
+        if (s[0] && s[0] != '/')
+            return s;
+    }
+    return priv->object_path->str;
+}
+
+#define _NMLOG_DOMAIN      LOGD_SUPPLICANT
+#define _NMLOG_PREFIX_NAME "sup-iface"
+#define _NMLOG(level, ...)                                                      \
+    G_STMT_START                                                                \
+    {                                                                           \
+        NMSupplicantInterface *       _self = (self);                           \
+        NMSupplicantInterfacePrivate *_priv =                                   \
+            _self ? NM_SUPPLICANT_INTERFACE_GET_PRIVATE(_self) : NULL;          \
+        char        _sbuf[255];                                                 \
+        const char *_ifname = _priv ? _priv->ifname : NULL;                     \
+                                                                                \
+        nm_log((level),                                                         \
+               _NMLOG_DOMAIN,                                                   \
+               _ifname,                                                         \
+               NULL,                                                            \
+               "%s%s: " _NM_UTILS_MACRO_FIRST(__VA_ARGS__),                     \
+               _NMLOG_PREFIX_NAME,                                              \
+               (_self ? nm_sprintf_buf(_sbuf,                                   \
+                                       "[" NM_HASH_OBFUSCATE_PTR_FMT ",%s,%s]", \
+                                       NM_HASH_OBFUSCATE_PTR(_self),            \
+                                       _log_pretty_object_path(_priv),          \
+                                       _ifname ?: "???")                        \
+                      : "") _NM_UTILS_MACRO_REST(__VA_ARGS__));                 \
+    }                                                                           \
+    G_STMT_END
+
+/*****************************************************************************/
+
+static void _starting_check_ready(NMSupplicantInterface *self);
+
+static void assoc_return(NMSupplicantInterface *self, GError *error, const char *message);
+
+/*****************************************************************************/
+
+NM_UTILS_LOOKUP_STR_DEFINE(
+    nm_supplicant_interface_state_to_string,
+    NMSupplicantInterfaceState,
+    NM_UTILS_LOOKUP_DEFAULT_WARN("internal-unknown"),
+    NM_UTILS_LOOKUP_STR_ITEM(NM_SUPPLICANT_INTERFACE_STATE_INVALID, "internal-invalid"),
+    NM_UTILS_LOOKUP_STR_ITEM(NM_SUPPLICANT_INTERFACE_STATE_STARTING, "internal-starting"),
+
+    NM_UTILS_LOOKUP_STR_ITEM(NM_SUPPLICANT_INTERFACE_STATE_4WAY_HANDSHAKE, "4way_handshake"),
+    NM_UTILS_LOOKUP_STR_ITEM(NM_SUPPLICANT_INTERFACE_STATE_ASSOCIATED, "associated"),
+    NM_UTILS_LOOKUP_STR_ITEM(NM_SUPPLICANT_INTERFACE_STATE_ASSOCIATING, "associating"),
+    NM_UTILS_LOOKUP_STR_ITEM(NM_SUPPLICANT_INTERFACE_STATE_AUTHENTICATING, "authenticating"),
+    NM_UTILS_LOOKUP_STR_ITEM(NM_SUPPLICANT_INTERFACE_STATE_COMPLETED, "completed"),
+    NM_UTILS_LOOKUP_STR_ITEM(NM_SUPPLICANT_INTERFACE_STATE_DISCONNECTED, "disconnected"),
+    NM_UTILS_LOOKUP_STR_ITEM(NM_SUPPLICANT_INTERFACE_STATE_GROUP_HANDSHAKE, "group_handshake"),
+    NM_UTILS_LOOKUP_STR_ITEM(NM_SUPPLICANT_INTERFACE_STATE_INACTIVE, "inactive"),
+    NM_UTILS_LOOKUP_STR_ITEM(NM_SUPPLICANT_INTERFACE_STATE_DISABLED, "interface_disabled"),
+    NM_UTILS_LOOKUP_STR_ITEM(NM_SUPPLICANT_INTERFACE_STATE_SCANNING, "scanning"),
+
+    NM_UTILS_LOOKUP_STR_ITEM(NM_SUPPLICANT_INTERFACE_STATE_DOWN, "internal-down"), );
+
+static NM_UTILS_STRING_TABLE_LOOKUP_DEFINE(
+    wpas_state_string_to_enum,
+    NMSupplicantInterfaceState,
+    { nm_assert(name); },
+    { return NM_SUPPLICANT_INTERFACE_STATE_INVALID; },
+    {"4way_handshake", NM_SUPPLICANT_INTERFACE_STATE_4WAY_HANDSHAKE},
+    {"associated", NM_SUPPLICANT_INTERFACE_STATE_ASSOCIATED},
+    {"associating", NM_SUPPLICANT_INTERFACE_STATE_ASSOCIATING},
+    {"authenticating", NM_SUPPLICANT_INTERFACE_STATE_AUTHENTICATING},
+    {"completed", NM_SUPPLICANT_INTERFACE_STATE_COMPLETED},
+    {"disconnected", NM_SUPPLICANT_INTERFACE_STATE_DISCONNECTED},
+    {"group_handshake", NM_SUPPLICANT_INTERFACE_STATE_GROUP_HANDSHAKE},
+    {"inactive", NM_SUPPLICANT_INTERFACE_STATE_INACTIVE},
+    {"interface_disabled", NM_SUPPLICANT_INTERFACE_STATE_DISABLED},
+    {"scanning", NM_SUPPLICANT_INTERFACE_STATE_SCANNING}, );
+
+/*****************************************************************************/
+
+static NM80211ApSecurityFlags
+security_from_vardict(GVariant *security)
+{
+    NM80211ApSecurityFlags flags = NM_802_11_AP_SEC_NONE;
+    const char **          array;
+    const char *           tmp;
+
+    nm_assert(g_variant_is_of_type(security, G_VARIANT_TYPE_VARDICT));
+
+    if (g_variant_lookup(security, "KeyMgmt", "^a&s", &array)) {
+        if (g_strv_contains(array, "wpa-psk") || g_strv_contains(array, "wpa-ft-psk"))
+            flags |= NM_802_11_AP_SEC_KEY_MGMT_PSK;
+        if (g_strv_contains(array, "wpa-eap") || g_strv_contains(array, "wpa-ft-eap")
+            || g_strv_contains(array, "wpa-fils-sha256")
+            || g_strv_contains(array, "wpa-fils-sha384"))
+            flags |= NM_802_11_AP_SEC_KEY_MGMT_802_1X;
+        if (g_strv_contains(array, "sae"))
+            flags |= NM_802_11_AP_SEC_KEY_MGMT_SAE;
+        if (g_strv_contains(array, "owe"))
+            flags |= NM_802_11_AP_SEC_KEY_MGMT_OWE;
+        if (g_strv_contains(array, "wpa-eap-suite-b-192"))
+            flags |= NM_802_11_AP_SEC_KEY_MGMT_EAP_SUITE_B_192;
+        g_free(array);
+    }
+
+    if (g_variant_lookup(security, "Pairwise", "^a&s", &array)) {
+        if (g_strv_contains(array, "tkip"))
+            flags |= NM_802_11_AP_SEC_PAIR_TKIP;
+        if (g_strv_contains(array, "ccmp"))
+            flags |= NM_802_11_AP_SEC_PAIR_CCMP;
+        g_free(array);
+    }
+
+    if (g_variant_lookup(security, "Group", "&s", &tmp)) {
+        if (nm_streq(tmp, "wep40"))
+            flags |= NM_802_11_AP_SEC_GROUP_WEP40;
+        else if (nm_streq(tmp, "wep104"))
+            flags |= NM_802_11_AP_SEC_GROUP_WEP104;
+        else if (nm_streq(tmp, "tkip"))
+            flags |= NM_802_11_AP_SEC_GROUP_TKIP;
+        else if (nm_streq(tmp, "ccmp"))
+            flags |= NM_802_11_AP_SEC_GROUP_CCMP;
+    }
+
+    return flags;
+}
+
+/*****************************************************************************/
+
+/* Various conditions prevent _starting_check_ready() from completing. For example,
+ * bss_initializing_lst_head, peer_initializing_lst_head and p2p_group_properties_cancellable.
+ * At some places, these conditions might toggle, and it would seems we would have
+ * to call _starting_check_ready() at that point, to ensure we don't miss a state
+ * change that we are ready. However, these places are deep in the call stack and
+ * not suitable to perform this state change. Instead, the callers *MUST* have
+ * added their own starting_pending_count to delay _starting_check_ready().
+ *
+ * Assert that is the case. */
+#define nm_assert_starting_has_pending_count(v) nm_assert((v) > 0)
+
+/*****************************************************************************/
+
+static void
+_dbus_connection_call(NMSupplicantInterface *self,
+                      const char *           interface_name,
+                      const char *           method_name,
+                      GVariant *             parameters,
+                      const GVariantType *   reply_type,
+                      GDBusCallFlags         flags,
+                      int                    timeout_msec,
+                      GCancellable *         cancellable,
+                      GAsyncReadyCallback    callback,
+                      gpointer               user_data)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    g_dbus_connection_call(priv->dbus_connection,
+                           priv->name_owner->str,
+                           priv->object_path->str,
+                           interface_name,
+                           method_name,
+                           parameters,
+                           reply_type,
+                           flags,
+                           timeout_msec,
+                           cancellable,
+                           callback,
+                           user_data);
+}
+
+static void
+_dbus_connection_call_simple_cb(GObject *source, GAsyncResult *result, gpointer user_data)
+{
+    NMSupplicantInterface *self;
+    gs_unref_variant GVariant *res = NULL;
+    gs_free_error GError *error    = NULL;
+    const char *          log_reason;
+    gs_free char *        remote_error = NULL;
+
+    nm_utils_user_data_unpack(user_data, &self, &log_reason);
+
+    res = g_dbus_connection_call_finish(G_DBUS_CONNECTION(source), result, &error);
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    if (res) {
+        _LOGT("call-%s: success", log_reason);
+        return;
+    }
+
+    remote_error = g_dbus_error_get_remote_error(error);
+    if (!nm_streq0(remote_error, "fi.w1.wpa_supplicant1.NotConnected")) {
+        g_dbus_error_strip_remote_error(error);
+        _LOGW("call-%s: failed with %s", log_reason, error->message);
+        return;
+    }
+
+    _LOGT("call-%s: failed with %s", log_reason, error->message);
+}
+
+static void
+_dbus_connection_call_simple(NMSupplicantInterface *self,
+                             const char *           interface_name,
+                             const char *           method_name,
+                             GVariant *             parameters,
+                             const GVariantType *   reply_type,
+                             const char *           log_reason)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    _dbus_connection_call(self,
+                          interface_name,
+                          method_name,
+                          parameters,
+                          reply_type,
+                          G_DBUS_CALL_FLAGS_NONE,
+                          DBUS_TIMEOUT_MSEC,
+                          priv->main_cancellable,
+                          _dbus_connection_call_simple_cb,
+                          nm_utils_user_data_pack(self, log_reason));
+}
+
+/*****************************************************************************/
+
+static void
+_emit_signal_state(NMSupplicantInterface *    self,
+                   NMSupplicantInterfaceState new_state,
+                   NMSupplicantInterfaceState old_state,
+                   gint32                     disconnect_reason)
+{
+    g_signal_emit(self,
+                  signals[STATE],
+                  0,
+                  (int) new_state,
+                  (int) old_state,
+                  (int) disconnect_reason);
+}
+
+/*****************************************************************************/
+
+static void
+_remove_network(NMSupplicantInterface *self)
+{
+    NMSupplicantInterfacePrivate *priv     = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    gs_free char *                net_path = NULL;
+
+    if (!priv->net_path)
+        return;
+
+    net_path = g_steal_pointer(&priv->net_path);
+    _dbus_connection_call_simple(self,
+                                 NM_WPAS_DBUS_IFACE_INTERFACE,
+                                 "RemoveNetwork",
+                                 g_variant_new("(o)", net_path),
+                                 G_VARIANT_TYPE("()"),
+                                 "remove-network");
+
+    if (priv->ap_isolate_supported && priv->ap_isolate_needs_reset) {
+        _dbus_connection_call_simple(self,
+                                     DBUS_INTERFACE_PROPERTIES,
+                                     "Set",
+                                     g_variant_new("(ssv)",
+                                                   NM_WPAS_DBUS_IFACE_INTERFACE,
+                                                   "ApIsolate",
+                                                   g_variant_new_string("0")),
+                                     G_VARIANT_TYPE("()"),
+                                     "reset-ap-isolation");
+    }
+    priv->ap_isolate_needs_reset = FALSE;
+}
+
+/*****************************************************************************/
+
+static void
+_notify_maybe_scanning(NMSupplicantInterface *self)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    gboolean                      scanning;
+
+    scanning = nm_supplicant_interface_state_is_operational(priv->state) && priv->scanning_property;
+
+    if (priv->scanning_cached == scanning)
+        return;
+
+    if (!scanning && !c_list_is_empty(&priv->bss_initializing_lst_head)) {
+        /* we would change state to indicate we no longer scan. However,
+         * we still have BSS instances to be initialized. Delay the
+         * state change further. */
+        return;
+    }
+
+    _LOGT("scanning: %s", scanning ? "yes" : "no");
+
+    if (!scanning)
+        priv->last_scan_msec = nm_utils_get_monotonic_timestamp_msec();
+    else {
+        /* while we are scanning, we set the timestamp to -1. */
+        priv->last_scan_msec = -1;
+    }
+    priv->scanning_cached = scanning;
+    _notify(self, PROP_SCANNING);
+}
+
+static void
+_notify_maybe_p2p_available(NMSupplicantInterface *self)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    gboolean                      value;
+
+    value = priv->is_ready_p2p_device && priv->p2p_capable_property;
+
+    if (priv->p2p_capable_cached == value)
+        return;
+
+    priv->p2p_capable_cached = value;
+    _notify(self, PROP_P2P_AVAILABLE);
+}
+
+static void
+_notify_maybe_p2p_group(NMSupplicantInterface *self)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    gboolean                      value_joined;
+    gboolean                      value_owner;
+    gboolean                      joined_changed;
+    gboolean                      owner_changed;
+
+    value_joined = priv->p2p_group_path && !priv->p2p_group_properties_cancellable;
+    value_owner  = value_joined && priv->p2p_group_owner_property;
+
+    if ((joined_changed = (priv->p2p_group_joined_cached != value_joined)))
+        priv->p2p_group_joined_cached = value_joined;
+
+    if ((owner_changed = (priv->p2p_group_owner_cached != value_owner)))
+        priv->p2p_group_owner_cached = value_owner;
+
+    if (joined_changed)
+        _notify(self, PROP_P2P_GROUP_JOINED);
+    if (owner_changed)
+        _notify(self, PROP_P2P_GROUP_OWNER);
+}
+
+/*****************************************************************************/
+
+static void
+_bss_info_destroy(NMSupplicantBssInfo *bss_info)
+{
+    c_list_unlink_stale(&bss_info->_bss_lst);
+    nm_clear_g_cancellable(&bss_info->_init_cancellable);
+    g_bytes_unref(bss_info->ssid);
+    nm_ref_string_unref(bss_info->bss_path);
+    nm_g_slice_free(bss_info);
+}
+
+static void
+_bss_info_changed_emit(NMSupplicantInterface *self,
+                       NMSupplicantBssInfo *  bss_info,
+                       gboolean               is_present)
+{
+    _LOGT("BSS %s %s", bss_info->bss_path->str, is_present ? "updated" : "deleted");
+    g_signal_emit(self, signals[BSS_CHANGED], 0, bss_info, is_present);
+}
+
+static void
+_bss_info_properties_changed(NMSupplicantInterface *self,
+                             NMSupplicantBssInfo *  bss_info,
+                             GVariant *             properties,
+                             gboolean               initial)
+{
+    gboolean       v_b;
+    GVariant *     v_v;
+    const char *   v_s;
+    gint16         v_i16;
+    guint16        v_u16;
+    guint32        v_u32;
+    NM80211ApFlags p_ap_flags;
+    NM80211Mode    p_mode;
+    guint8         p_signal_percent;
+    const guint8 * arr_data;
+    gsize          arr_len;
+    guint32        p_max_rate;
+    gboolean       p_max_rate_has;
+    gint64         now_msec = 0;
+
+    if (nm_g_variant_lookup(properties, "Age", "u", &v_u32)) {
+        bss_info->last_seen_msec =
+            nm_utils_get_monotonic_timestamp_msec_cached(&now_msec) - (((gint64) v_u32) * 1000);
+    } else if (initial) {
+        /* Unknown Age. Assume we just received it. */
+        bss_info->last_seen_msec = nm_utils_get_monotonic_timestamp_msec_cached(&now_msec);
+    }
+
+    p_ap_flags = bss_info->ap_flags;
+    if (nm_g_variant_lookup(properties, "Privacy", "b", &v_b))
+        p_ap_flags = NM_FLAGS_ASSIGN(p_ap_flags, NM_802_11_AP_FLAGS_PRIVACY, v_b);
+    else {
+        nm_assert(!initial || !NM_FLAGS_HAS(p_ap_flags, NM_802_11_AP_FLAGS_PRIVACY));
+    }
+    v_v = nm_g_variant_lookup_value(properties, "WPS", G_VARIANT_TYPE_VARDICT);
+    if (v_v || initial) {
+        NM80211ApFlags f = NM_802_11_AP_FLAGS_NONE;
+
+        if (v_v) {
+            if (g_variant_lookup(v_v, "Type", "&s", &v_s)) {
+                f = NM_802_11_AP_FLAGS_WPS;
+                if (nm_streq(v_s, "pcb"))
+                    f |= NM_802_11_AP_FLAGS_WPS_PBC;
+                else if (nm_streq(v_s, "pin"))
+                    f |= NM_802_11_AP_FLAGS_WPS_PIN;
+            }
+            g_variant_unref(v_v);
+        }
+        p_ap_flags = NM_FLAGS_ASSIGN_MASK(p_ap_flags,
+                                          NM_802_11_AP_FLAGS_WPS | NM_802_11_AP_FLAGS_WPS_PBC
+                                              | NM_802_11_AP_FLAGS_WPS_PIN,
+                                          f);
+    }
+    if (bss_info->ap_flags != p_ap_flags) {
+        bss_info->ap_flags = p_ap_flags;
+        nm_assert(bss_info->ap_flags == p_ap_flags);
+    }
+
+    if (nm_g_variant_lookup(properties, "Mode", "&s", &v_s)) {
+        if (nm_streq(v_s, "infrastructure"))
+            p_mode = NM_802_11_MODE_INFRA;
+        else if (nm_streq(v_s, "ad-hoc"))
+            p_mode = NM_802_11_MODE_ADHOC;
+        else if (nm_streq(v_s, "mesh"))
+            p_mode = NM_802_11_MODE_MESH;
+        else
+            p_mode = NM_802_11_MODE_UNKNOWN;
+    } else if (initial)
+        p_mode = NM_802_11_MODE_UNKNOWN;
+    else
+        p_mode = bss_info->mode;
+    if (bss_info->mode != p_mode) {
+        bss_info->mode = p_mode;
+        nm_assert(bss_info->mode == p_mode);
+    }
+
+    if (nm_g_variant_lookup(properties, "Signal", "n", &v_i16))
+        p_signal_percent = nm_wifi_utils_level_to_quality(v_i16);
+    else if (initial)
+        p_signal_percent = 0;
+    else
+        p_signal_percent = bss_info->signal_percent;
+    bss_info->signal_percent = p_signal_percent;
+
+    if (nm_g_variant_lookup(properties, "Frequency", "q", &v_u16))
+        bss_info->frequency = v_u16;
+
+    v_v = nm_g_variant_lookup_value(properties, "SSID", G_VARIANT_TYPE_BYTESTRING);
+    if (v_v) {
+        arr_data = g_variant_get_fixed_array(v_v, &arr_len, 1);
+        arr_len  = MIN(32, arr_len);
+
+        /* Stupid ieee80211 layer uses <hidden> */
+        if (arr_data && arr_len
+            && !(NM_IN_SET(arr_len, 8, 9) && memcmp(arr_data, "<hidden>", arr_len) == 0)
+            && !nm_utils_is_empty_ssid(arr_data, arr_len)) {
+            /* good */
+        } else
+            arr_len = 0;
+
+        if (!nm_utils_gbytes_equal_mem(bss_info->ssid, arr_data, arr_len)) {
+            _nm_unused gs_unref_bytes GBytes *old_free = g_steal_pointer(&bss_info->ssid);
+
+            bss_info->ssid = (arr_len == 0) ? NULL : g_bytes_new(arr_data, arr_len);
+        }
+
+        g_variant_unref(v_v);
+    } else {
+        nm_assert(!initial || !bss_info->ssid);
+    }
+
+    v_v = nm_g_variant_lookup_value(properties, "BSSID", G_VARIANT_TYPE_BYTESTRING);
+    if (v_v) {
+        arr_data = g_variant_get_fixed_array(v_v, &arr_len, 1);
+        if (arr_len == ETH_ALEN && memcmp(arr_data, &nm_ether_addr_zero, ETH_ALEN) != 0
+            && memcmp(arr_data, (char[ETH_ALEN]){0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}, ETH_ALEN)
+                   != 0) {
+            /* pass */
+        } else
+            arr_len = 0;
+
+        if (arr_len != 0) {
+            nm_assert(arr_len == sizeof(bss_info->bssid));
+            bss_info->bssid_valid = TRUE;
+            memcpy(&bss_info->bssid, arr_data, sizeof(bss_info->bssid));
+        } else if (bss_info->bssid_valid) {
+            bss_info->bssid_valid = FALSE;
+            memset(&bss_info->bssid, 0, sizeof(bss_info->bssid));
+        }
+        g_variant_unref(v_v);
+    } else {
+        nm_assert(!initial || !bss_info->bssid_valid);
+    }
+    nm_assert((!!bss_info->bssid_valid)
+              == (!nm_utils_memeqzero(&bss_info->bssid, sizeof(bss_info->bssid))));
+
+    p_max_rate_has = FALSE;
+    p_max_rate     = 0;
+    v_v            = nm_g_variant_lookup_value(properties, "Rates", G_VARIANT_TYPE("au"));
+    if (v_v) {
+        const guint32 *rates = g_variant_get_fixed_array(v_v, &arr_len, sizeof(guint32));
+        gsize          i;
+
+        for (i = 0; i < arr_len; i++)
+            p_max_rate = NM_MAX(p_max_rate, rates[i]);
+        p_max_rate_has = TRUE;
+        g_variant_unref(v_v);
+    }
+
+    v_v = nm_g_variant_lookup_value(properties, "WPA", G_VARIANT_TYPE_VARDICT);
+    if (v_v) {
+        bss_info->wpa_flags = security_from_vardict(v_v);
+        g_variant_unref(v_v);
+    }
+
+    v_v = nm_g_variant_lookup_value(properties, "RSN", G_VARIANT_TYPE_VARDICT);
+    if (v_v) {
+        bss_info->rsn_flags = security_from_vardict(v_v);
+        g_variant_unref(v_v);
+    }
+
+    v_v = nm_g_variant_lookup_value(properties, "IEs", G_VARIANT_TYPE_BYTESTRING);
+    if (v_v) {
+        gboolean p_owe_transition_mode;
+        gboolean p_metered;
+        guint32  rate;
+
+        arr_data = g_variant_get_fixed_array(v_v, &arr_len, 1);
+        nm_wifi_utils_parse_ies(arr_data, arr_len, &rate, &p_metered, &p_owe_transition_mode);
+        p_max_rate     = NM_MAX(p_max_rate, rate);
+        p_max_rate_has = TRUE;
+        g_variant_unref(v_v);
+
+        if (p_owe_transition_mode)
+            bss_info->rsn_flags |= NM_802_11_AP_SEC_KEY_MGMT_OWE_TM;
+        else
+            bss_info->rsn_flags &= ~NM_802_11_AP_SEC_KEY_MGMT_OWE_TM;
+
+        bss_info->metered = p_metered;
+    }
+
+    if (p_max_rate_has)
+        bss_info->max_rate = p_max_rate / 1000u;
+
+    _bss_info_changed_emit(self, bss_info, TRUE);
+}
+
+static void
+_bss_info_get_all_cb(GVariant *result, GError *error, gpointer user_data)
+{
+    NMSupplicantBssInfo *         bss_info;
+    NMSupplicantInterface *       self;
+    NMSupplicantInterfacePrivate *priv;
+    gs_unref_variant GVariant *properties = NULL;
+
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    bss_info = user_data;
+    self     = bss_info->_self;
+    priv     = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    g_clear_object(&bss_info->_init_cancellable);
+    nm_c_list_move_tail(&priv->bss_lst_head, &bss_info->_bss_lst);
+
+    if (result)
+        g_variant_get(result, "(@a{sv})", &properties);
+
+    _bss_info_properties_changed(self, bss_info, properties, TRUE);
+
+    _starting_check_ready(self);
+
+    _notify_maybe_scanning(self);
+}
+
+static void
+_bss_info_add(NMSupplicantInterface *self, const char *object_path)
+{
+    NMSupplicantInterfacePrivate *priv       = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    nm_auto_ref_string NMRefString *bss_path = NULL;
+    NMSupplicantBssInfo *           bss_info;
+
+    bss_path = nm_ref_string_new(nm_dbus_path_not_empty(object_path));
+    if (!bss_path)
+        return;
+
+    bss_info = g_hash_table_lookup(priv->bss_idx, &bss_path);
+    if (bss_info) {
+        bss_info->_bss_dirty = FALSE;
+        return;
+    }
+
+    bss_info  = g_slice_new(NMSupplicantBssInfo);
+    *bss_info = (NMSupplicantBssInfo){
+        ._self             = self,
+        .bss_path          = g_steal_pointer(&bss_path),
+        ._init_cancellable = g_cancellable_new(),
+    };
+    c_list_link_tail(&priv->bss_initializing_lst_head, &bss_info->_bss_lst);
+    g_hash_table_add(priv->bss_idx, bss_info);
+
+    nm_dbus_connection_call_get_all(priv->dbus_connection,
+                                    priv->name_owner->str,
+                                    bss_info->bss_path->str,
+                                    NM_WPAS_DBUS_IFACE_BSS,
+                                    5000,
+                                    bss_info->_init_cancellable,
+                                    _bss_info_get_all_cb,
+                                    bss_info);
+}
+
+static gboolean
+_bss_info_remove(NMSupplicantInterface *self, NMRefString **p_bss_path)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    NMSupplicantBssInfo *         bss_info;
+    gpointer                      unused_but_required;
+
+    if (!g_hash_table_steal_extended(priv->bss_idx,
+                                     p_bss_path,
+                                     (gpointer *) &bss_info,
+                                     &unused_but_required))
+        return FALSE;
+
+    c_list_unlink(&bss_info->_bss_lst);
+    if (!bss_info->_init_cancellable)
+        _bss_info_changed_emit(self, bss_info, FALSE);
+    _bss_info_destroy(bss_info);
+
+    nm_assert_starting_has_pending_count(priv->starting_pending_count);
+
+    return TRUE;
+}
+
+/*****************************************************************************/
+
+static void
+_peer_info_destroy(NMSupplicantPeerInfo *peer_info)
+{
+    c_list_unlink(&peer_info->_peer_lst);
+    nm_clear_g_cancellable(&peer_info->_init_cancellable);
+
+    g_free(peer_info->device_name);
+    g_free(peer_info->manufacturer);
+    g_free(peer_info->model);
+    g_free(peer_info->model_number);
+    g_free(peer_info->serial);
+    g_free(peer_info->groups);
+    g_bytes_unref(peer_info->ies);
+
+    nm_ref_string_unref(peer_info->peer_path);
+
+    nm_g_slice_free(peer_info);
+}
+
+static void
+_peer_info_changed_emit(NMSupplicantInterface *self,
+                        NMSupplicantPeerInfo * peer_info,
+                        gboolean               is_present)
+{
+    g_signal_emit(self, signals[PEER_CHANGED], 0, peer_info, is_present);
+}
+
+static void
+_peer_info_properties_changed(NMSupplicantInterface *self,
+                              NMSupplicantPeerInfo * peer_info,
+                              GVariant *             properties,
+                              gboolean               initial)
+{
+    GVariant *    v_v;
+    const char *  v_s;
+    const char ** v_strv;
+    gint32        v_i32;
+    const guint8 *arr_data;
+    gsize         arr_len;
+
+    peer_info->last_seen_msec = nm_utils_get_monotonic_timestamp_msec();
+
+    if (nm_g_variant_lookup(properties, "level", "i", &v_i32))
+        peer_info->signal_percent = nm_wifi_utils_level_to_quality(v_i32);
+
+    if (nm_g_variant_lookup(properties, "DeviceName", "&s", &v_s))
+        nm_utils_strdup_reset(&peer_info->device_name, v_s);
+
+    if (nm_g_variant_lookup(properties, "Manufacturer", "&s", &v_s))
+        nm_utils_strdup_reset(&peer_info->manufacturer, v_s);
+
+    if (nm_g_variant_lookup(properties, "Model", "&s", &v_s))
+        nm_utils_strdup_reset(&peer_info->model, v_s);
+
+    if (nm_g_variant_lookup(properties, "ModelNumber", "&s", &v_s))
+        nm_utils_strdup_reset(&peer_info->model_number, v_s);
+
+    if (nm_g_variant_lookup(properties, "Serial", "&s", &v_s))
+        nm_utils_strdup_reset(&peer_info->serial, v_s);
+
+    if (nm_g_variant_lookup(properties, "Groups", "^a&o", &v_strv)) {
+        g_free(peer_info->groups);
+        peer_info->groups = nm_utils_strv_dup_packed(v_strv, -1);
+
+        g_free(v_strv);
+    }
+
+    v_v = nm_g_variant_lookup_value(properties, "DeviceAddress", G_VARIANT_TYPE_BYTESTRING);
+    if (v_v) {
+        arr_data = g_variant_get_fixed_array(v_v, &arr_len, 1);
+        if (arr_len == ETH_ALEN && memcmp(arr_data, &nm_ether_addr_zero, ETH_ALEN) != 0
+            && memcmp(arr_data, (char[ETH_ALEN]){0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}, ETH_ALEN)
+                   != 0) {
+            /* pass */
+        } else
+            arr_len = 0;
+
+        if (arr_len != 0) {
+            nm_assert(arr_len == sizeof(peer_info->address));
+            peer_info->address_valid = TRUE;
+            memcpy(peer_info->address, arr_data, sizeof(peer_info->address));
+        } else if (peer_info->address_valid) {
+            peer_info->address_valid = FALSE;
+            memset(peer_info->address, 0, sizeof(peer_info->address));
+        }
+        g_variant_unref(v_v);
+    } else {
+        nm_assert(!initial || !peer_info->address_valid);
+    }
+    nm_assert((peer_info->address_valid
+               && !nm_utils_memeqzero(peer_info->address, sizeof(peer_info->address)))
+              || (!peer_info->address_valid
+                  && nm_utils_memeqzero(peer_info->address, sizeof(peer_info->address))));
+
+    /* The IEs property contains the WFD R1 subelements */
+    v_v = nm_g_variant_lookup_value(properties, "IEs", G_VARIANT_TYPE_BYTESTRING);
+    if (v_v) {
+        arr_data = g_variant_get_fixed_array(v_v, &arr_len, 1);
+        if (!nm_utils_gbytes_equal_mem(peer_info->ies, arr_data, arr_len)) {
+            _nm_unused gs_unref_bytes GBytes *old_free = g_steal_pointer(&peer_info->ies);
+
+            peer_info->ies = g_bytes_new(arr_data, arr_len);
+        } else if (arr_len == 0 && !peer_info->ies)
+            peer_info->ies = g_bytes_new(NULL, 0);
+        g_variant_unref(v_v);
+    }
+
+    _peer_info_changed_emit(self, peer_info, TRUE);
+}
+
+static void
+_peer_info_get_all_cb(GVariant *result, GError *error, gpointer user_data)
+{
+    NMSupplicantPeerInfo *        peer_info;
+    NMSupplicantInterface *       self;
+    NMSupplicantInterfacePrivate *priv;
+    gs_unref_variant GVariant *properties = NULL;
+
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    peer_info = user_data;
+    self      = peer_info->_self;
+    priv      = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    g_clear_object(&peer_info->_init_cancellable);
+    nm_c_list_move_tail(&priv->peer_lst_head, &peer_info->_peer_lst);
+
+    if (result)
+        g_variant_get(result, "(@a{sv})", &properties);
+
+    _peer_info_properties_changed(self, peer_info, properties, TRUE);
+
+    _starting_check_ready(self);
+}
+
+static void
+_peer_info_add(NMSupplicantInterface *self, const char *object_path)
+{
+    NMSupplicantInterfacePrivate *priv        = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    nm_auto_ref_string NMRefString *peer_path = NULL;
+    NMSupplicantPeerInfo *          peer_info;
+
+    peer_path = nm_ref_string_new(nm_dbus_path_not_empty(object_path));
+    if (!peer_path)
+        return;
+
+    peer_info = g_hash_table_lookup(priv->peer_idx, &peer_path);
+
+    if (peer_info) {
+        peer_info->_peer_dirty = FALSE;
+        return;
+    }
+
+    peer_info  = g_slice_new(NMSupplicantPeerInfo);
+    *peer_info = (NMSupplicantPeerInfo){
+        ._self             = self,
+        .peer_path         = g_steal_pointer(&peer_path),
+        ._init_cancellable = g_cancellable_new(),
+    };
+    c_list_link_tail(&priv->peer_initializing_lst_head, &peer_info->_peer_lst);
+    g_hash_table_add(priv->peer_idx, peer_info);
+
+    nm_dbus_connection_call_get_all(priv->dbus_connection,
+                                    priv->name_owner->str,
+                                    peer_info->peer_path->str,
+                                    NM_WPAS_DBUS_IFACE_PEER,
+                                    5000,
+                                    peer_info->_init_cancellable,
+                                    _peer_info_get_all_cb,
+                                    peer_info);
+}
+
+static gboolean
+_peer_info_remove(NMSupplicantInterface *self, NMRefString **p_peer_path)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    NMSupplicantPeerInfo *        peer_info;
+    gpointer                      unused_but_required;
+
+    if (!g_hash_table_steal_extended(priv->peer_idx,
+                                     p_peer_path,
+                                     (gpointer *) &peer_info,
+                                     &unused_but_required))
+        return FALSE;
+
+    c_list_unlink(&peer_info->_peer_lst);
+    if (!peer_info->_init_cancellable)
+        _peer_info_changed_emit(self, peer_info, FALSE);
+    _peer_info_destroy(peer_info);
+
+    nm_assert_starting_has_pending_count(priv->starting_pending_count);
+
+    return TRUE;
+}
+
+/*****************************************************************************/
+
+static void
+set_state_down(NMSupplicantInterface *self,
+               gboolean               force_remove_from_supplicant,
+               const char *           reason)
+{
+    _nm_unused gs_unref_object NMSupplicantInterface *self_keep_alive = g_object_ref(self);
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    NMSupplicantBssInfo *         bss_info;
+    NMSupplicantPeerInfo *        peer_info;
+    NMSupplicantInterfaceState    old_state;
+
+    nm_assert(priv->state != NM_SUPPLICANT_INTERFACE_STATE_DOWN);
+    nm_assert(!c_list_is_empty(&self->supp_lst));
+
+    _LOGD("remove interface \"%s\" on %s (%s)%s",
+          priv->object_path->str,
+          priv->name_owner->str,
+          reason,
+          force_remove_from_supplicant ? " (remove in wpa_supplicant)" : "");
+
+    old_state = priv->state;
+
+    priv->state = NM_SUPPLICANT_INTERFACE_STATE_DOWN;
+
+    _nm_supplicant_manager_unregister_interface(priv->supplicant_manager, self);
+
+    nm_assert(c_list_is_empty(&self->supp_lst));
+
+    if (force_remove_from_supplicant) {
+        _nm_supplicant_manager_dbus_call_remove_interface(priv->supplicant_manager,
+                                                          priv->name_owner->str,
+                                                          priv->object_path->str);
+    }
+
+    _emit_signal_state(self, priv->state, old_state, 0);
+
+    nm_clear_g_dbus_connection_signal(priv->dbus_connection, &priv->properties_changed_id);
+    nm_clear_g_dbus_connection_signal(priv->dbus_connection, &priv->signal_id);
+    nm_clear_g_dbus_connection_signal(priv->dbus_connection, &priv->bss_properties_changed_id);
+    nm_clear_g_dbus_connection_signal(priv->dbus_connection, &priv->peer_properties_changed_id);
+    nm_clear_g_dbus_connection_signal(priv->dbus_connection,
+                                      &priv->p2p_group_properties_changed_id);
+
+    nm_supplicant_interface_cancel_wps(self);
+
+    if (priv->assoc_data) {
+        gs_free_error GError *error = NULL;
+
+        nm_utils_error_set_cancelled(&error, TRUE, "NMSupplicantInterface");
+        assoc_return(self, error, "cancelled because supplicant interface is going down");
+    }
+
+    while (
+        (bss_info =
+             c_list_first_entry(&priv->bss_initializing_lst_head, NMSupplicantBssInfo, _bss_lst))) {
+        g_hash_table_remove(priv->bss_idx, bss_info);
+        _bss_info_destroy(bss_info);
+    }
+    while ((bss_info = c_list_first_entry(&priv->bss_lst_head, NMSupplicantBssInfo, _bss_lst))) {
+        g_hash_table_remove(priv->bss_idx, bss_info);
+        _bss_info_destroy(bss_info);
+    }
+    nm_assert(g_hash_table_size(priv->bss_idx) == 0);
+
+    while ((peer_info = c_list_first_entry(&priv->peer_initializing_lst_head,
+                                           NMSupplicantPeerInfo,
+                                           _peer_lst))) {
+        g_hash_table_remove(priv->peer_idx, peer_info);
+        _peer_info_destroy(peer_info);
+    }
+    while (
+        (peer_info = c_list_first_entry(&priv->peer_lst_head, NMSupplicantPeerInfo, _peer_lst))) {
+        g_hash_table_remove(priv->peer_idx, peer_info);
+        _peer_info_destroy(peer_info);
+    }
+    nm_assert(g_hash_table_size(priv->peer_idx) == 0);
+
+    nm_clear_g_cancellable(&priv->main_cancellable);
+    nm_clear_g_cancellable(&priv->p2p_group_properties_cancellable);
+
+    nm_clear_pointer(&priv->p2p_group_path, nm_ref_string_unref);
+
+    _remove_network(self);
+
+    nm_clear_pointer(&priv->current_bss, nm_ref_string_unref);
+
+    _notify_maybe_scanning(self);
+}
+
+static void
+set_state(NMSupplicantInterface *self, NMSupplicantInterfaceState new_state)
+{
+    NMSupplicantInterfacePrivate *priv      = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    NMSupplicantInterfaceState    old_state = priv->state;
+
+    nm_assert(new_state > NM_SUPPLICANT_INTERFACE_STATE_STARTING);
+    nm_assert(new_state < NM_SUPPLICANT_INTERFACE_STATE_DOWN);
+    nm_assert(nm_supplicant_interface_state_is_operational(new_state));
+
+    nm_assert(priv->state >= NM_SUPPLICANT_INTERFACE_STATE_STARTING);
+    nm_assert(priv->state < NM_SUPPLICANT_INTERFACE_STATE_DOWN);
+
+    if (new_state == priv->state)
+        return;
+
+    _LOGT("state: set state \"%s\" (was \"%s\")",
+          nm_supplicant_interface_state_to_string(new_state),
+          nm_supplicant_interface_state_to_string(priv->state));
+
+    priv->state = new_state;
+
+    _emit_signal_state(
+        self,
+        priv->state,
+        old_state,
+        priv->state != NM_SUPPLICANT_INTERFACE_STATE_DISCONNECTED ? 0u : priv->disconnect_reason);
+}
+
+NMRefString *
+nm_supplicant_interface_get_current_bss(NMSupplicantInterface *self)
+{
+    g_return_val_if_fail(self != NULL, FALSE);
+
+    return NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self)->current_bss;
+}
+
+gboolean
+nm_supplicant_interface_get_scanning(NMSupplicantInterface *self)
+{
+    g_return_val_if_fail(NM_IS_SUPPLICANT_INTERFACE(self), FALSE);
+
+    return NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self)->scanning_cached;
+}
+
+gint64
+nm_supplicant_interface_get_last_scan(NMSupplicantInterface *self)
+{
+    g_return_val_if_fail(NM_IS_SUPPLICANT_INTERFACE(self), FALSE);
+
+    return NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self)->last_scan_msec;
+}
+
+#define MATCH_PROPERTY(p, n, v, t) (!strcmp(p, n) && g_variant_is_of_type(v, t))
+
+static void
+parse_capabilities(NMSupplicantInterface *self, GVariant *capabilities)
+{
+    NMSupplicantInterfacePrivate *priv                 = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    const gboolean                old_prop_scan_active = priv->prop_scan_active;
+    const gboolean                old_prop_scan_ssid   = priv->prop_scan_ssid;
+    const guint32                 old_max_scan_ssids   = priv->max_scan_ssids;
+    gboolean                      have_ft              = FALSE;
+    gint32                        max_scan_ssids;
+    const char **                 array;
+
+    nm_assert(capabilities && g_variant_is_of_type(capabilities, G_VARIANT_TYPE_VARDICT));
+
+    if (g_variant_lookup(capabilities, "KeyMgmt", "^a&s", &array)) {
+        have_ft = g_strv_contains(array, "wpa-ft-psk");
+        g_free(array);
+    }
+
+    priv->iface_capabilities = NM_SUPPL_CAP_MASK_SET(priv->iface_capabilities,
+                                                     NM_SUPPL_CAP_TYPE_FT,
+                                                     have_ft ? NM_TERNARY_TRUE : NM_TERNARY_FALSE);
+
+    if (g_variant_lookup(capabilities, "Modes", "^a&s", &array)) {
+        /* Setting p2p_capable might toggle _prop_p2p_available_get(). However,
+         * we don't need to check for a property changed notification, because
+         * the caller did g_object_freeze_notify() and will perform the check. */
+        priv->p2p_capable_property = g_strv_contains(array, "p2p");
+        g_free(array);
+    }
+
+    if (g_variant_lookup(capabilities, "Scan", "^a&s", &array)) {
+        const char **a;
+
+        priv->prop_scan_active = FALSE;
+        priv->prop_scan_ssid   = FALSE;
+        for (a = array; *a; a++) {
+            if (nm_streq(*a, "active"))
+                priv->prop_scan_active = TRUE;
+            else if (nm_streq(*a, "ssid"))
+                priv->prop_scan_ssid = TRUE;
+        }
+        g_free(array);
+    }
+
+    if (g_variant_lookup(capabilities, "MaxScanSSID", "i", &max_scan_ssids)) {
+        const gint32 WPAS_MAX_SCAN_SSIDS = 16;
+
+        /* Even if supplicant claims that 20 SSIDs are supported, the Scan request
+         * still only accepts WPAS_MAX_SCAN_SSIDS SSIDs. Otherwise, the D-Bus
+         * request will be rejected with "fi.w1.wpa_supplicant1.InvalidArgs"
+         * Body: ('Did not receive correct message arguments.', 'Too many ssids specified. Specify at most four')
+         * */
+        priv->max_scan_ssids = CLAMP(max_scan_ssids, 0, WPAS_MAX_SCAN_SSIDS);
+    }
+
+    if (old_max_scan_ssids != priv->max_scan_ssids || old_prop_scan_active != priv->prop_scan_active
+        || old_prop_scan_ssid != priv->prop_scan_ssid) {
+        _LOGD("supports %u scan SSIDs (scan: %cactive %cssid)",
+              (guint32) priv->max_scan_ssids,
+              priv->prop_scan_active ? '+' : '-',
+              priv->prop_scan_ssid ? '+' : '-');
+    }
+}
+
+static void
+_starting_check_ready(NMSupplicantInterface *self)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    if (priv->state != NM_SUPPLICANT_INTERFACE_STATE_STARTING)
+        return;
+
+    if (priv->starting_pending_count > 0)
+        return;
+
+    if (!c_list_is_empty(&priv->bss_initializing_lst_head))
+        return;
+
+    if (!c_list_is_empty(&priv->peer_initializing_lst_head))
+        return;
+
+    if (priv->p2p_group_properties_cancellable)
+        return;
+
+    nm_assert(priv->state == NM_SUPPLICANT_INTERFACE_STATE_STARTING);
+
+    if (!nm_supplicant_interface_state_is_operational(priv->supp_state)) {
+        _LOGW("Supplicant state is unknown during initialization. Destroy the interface");
+        set_state_down(self, TRUE, "failure to get valid interface state");
+        return;
+    }
+
+    set_state(self, priv->supp_state);
+}
+
+static NMTernary
+_get_capability(NMSupplicantInterfacePrivate *priv, NMSupplCapType type)
+{
+    NMTernary value;
+    NMTernary iface_value;
+
+    switch (type) {
+    case NM_SUPPL_CAP_TYPE_AP:
+        iface_value = NM_SUPPL_CAP_MASK_GET(priv->iface_capabilities, type);
+        value       = NM_SUPPL_CAP_MASK_GET(priv->global_capabilities, type);
+        value       = MAX(iface_value, value);
+        break;
+    case NM_SUPPL_CAP_TYPE_FT:
+        value = NM_SUPPL_CAP_MASK_GET(priv->global_capabilities, type);
+        if (value != NM_TERNARY_FALSE) {
+            iface_value = NM_SUPPL_CAP_MASK_GET(priv->iface_capabilities, type);
+            if (iface_value != NM_TERNARY_DEFAULT)
+                value = iface_value;
+        }
+        break;
+    default:
+        nm_assert(NM_SUPPL_CAP_MASK_GET(priv->iface_capabilities, type) == NM_TERNARY_DEFAULT);
+        value = NM_SUPPL_CAP_MASK_GET(priv->global_capabilities, type);
+        break;
+    }
+    return value;
+}
+
+NMTernary
+nm_supplicant_interface_get_capability(NMSupplicantInterface *self, NMSupplCapType type)
+{
+    return _get_capability(NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self), type);
+}
+
+NMSupplCapMask
+nm_supplicant_interface_get_capabilities(NMSupplicantInterface *self)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    NMSupplCapMask                caps;
+
+    caps = priv->global_capabilities;
+    caps = NM_SUPPL_CAP_MASK_SET(caps,
+                                 NM_SUPPL_CAP_TYPE_AP,
+                                 _get_capability(priv, NM_SUPPL_CAP_TYPE_AP));
+    caps = NM_SUPPL_CAP_MASK_SET(caps,
+                                 NM_SUPPL_CAP_TYPE_FT,
+                                 _get_capability(priv, NM_SUPPL_CAP_TYPE_FT));
+
+    nm_assert(!NM_FLAGS_ANY(priv->iface_capabilities,
+                            ~(NM_SUPPL_CAP_MASK_T_AP_MASK | NM_SUPPL_CAP_MASK_T_FT_MASK)));
+
+#if NM_MORE_ASSERTS > 10
+    {
+        NMSupplCapType type;
+
+        for (type = 0; type < _NM_SUPPL_CAP_TYPE_NUM; type++)
+            nm_assert(NM_SUPPL_CAP_MASK_GET(caps, type) == _get_capability(priv, type));
+    }
+#endif
+
+    return caps;
+}
+
+static void
+set_bridge_cb(GVariant *ret, GError *error, gpointer user_data)
+{
+    NMSupplicantInterface *self;
+    NMLogLevel             level;
+    gs_free const char *   bridge = NULL;
+
+    nm_utils_user_data_unpack(user_data, &self, &bridge);
+
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    /* The supplicant supports writing the bridge property since
+     * version 2.10. Before that version, trying to set the property
+     * results in a InvalidArgs error.  Don't log a warning unless we
+     * are trying to set a non-NULL bridge. */
+    if (!error)
+        level = LOGL_DEBUG;
+    else if (bridge == NULL && g_error_matches(error, G_DBUS_ERROR, G_DBUS_ERROR_INVALID_ARGS)) {
+        level = LOGL_DEBUG;
+    } else
+        level = LOGL_WARN;
+
+    _NMLOG(level,
+           "set bridge %s%s%s result: %s",
+           NM_PRINT_FMT_QUOTE_STRING(bridge),
+           error ? error->message : "success");
+}
+
+void
+nm_supplicant_interface_set_bridge(NMSupplicantInterface *self, const char *bridge)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    _LOGT("set bridge %s%s%s", NM_PRINT_FMT_QUOTE_STRING(bridge));
+
+    nm_dbus_connection_call_set(priv->dbus_connection,
+                                priv->name_owner->str,
+                                priv->object_path->str,
+                                NM_WPAS_DBUS_IFACE_INTERFACE,
+                                "BridgeIfname",
+                                g_variant_new_string(bridge ?: ""),
+                                DBUS_TIMEOUT_MSEC,
+                                priv->main_cancellable,
+                                set_bridge_cb,
+                                nm_utils_user_data_pack(self, g_strdup(bridge)));
+}
+
+void
+nm_supplicant_interface_set_global_capabilities(NMSupplicantInterface *self, NMSupplCapMask value)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    priv->global_capabilities = value;
+}
+
+NMSupplicantAuthState
+nm_supplicant_interface_get_auth_state(NMSupplicantInterface *self)
+{
+    return NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self)->auth_state;
+}
+
+/*****************************************************************************/
+
+static void
+_p2p_group_properties_changed(NMSupplicantInterface *self, GVariant *properties)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    const char *                  s;
+
+    if (!properties)
+        priv->p2p_group_owner_property = FALSE;
+    else if (g_variant_lookup(properties, "Role", "&s", &s))
+        priv->p2p_group_owner_property = nm_streq(s, "GO");
+
+    _notify_maybe_p2p_group(self);
+}
+
+static void
+_p2p_group_properties_changed_cb(GDBusConnection *connection,
+                                 const char *     sender_name,
+                                 const char *     object_path,
+                                 const char *     signal_interface_name,
+                                 const char *     signal_name,
+                                 GVariant *       parameters,
+                                 gpointer         user_data)
+{
+    NMSupplicantInterface *       self            = NM_SUPPLICANT_INTERFACE(user_data);
+    NMSupplicantInterfacePrivate *priv            = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    gs_unref_variant GVariant *changed_properties = NULL;
+
+    if (priv->p2p_group_properties_cancellable)
+        return;
+    if (!g_variant_is_of_type(parameters, G_VARIANT_TYPE("(sa{sv}as)")))
+        return;
+
+    g_variant_get(parameters, "(&s@a{sv}^a&s)", NULL, &changed_properties, NULL);
+
+    _p2p_group_properties_changed(self, changed_properties);
+}
+
+static void
+_p2p_group_properties_get_all_cb(GVariant *result, GError *error, gpointer user_data)
+{
+    NMSupplicantInterface *       self;
+    NMSupplicantInterfacePrivate *priv;
+    gs_unref_variant GVariant *properties = NULL;
+
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    self = NM_SUPPLICANT_INTERFACE(user_data);
+    priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    g_object_freeze_notify(G_OBJECT(self));
+
+    nm_clear_g_cancellable(&priv->p2p_group_properties_cancellable);
+
+    if (result)
+        g_variant_get(result, "(@a{sv})", &properties);
+
+    _p2p_group_properties_changed(self, properties);
+
+    _starting_check_ready(self);
+
+    _notify_maybe_p2p_group(self);
+
+    g_object_thaw_notify(G_OBJECT(self));
+}
+
+static void
+_p2p_group_set_path(NMSupplicantInterface *self, const char *path)
+{
+    NMSupplicantInterfacePrivate *priv         = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    nm_auto_ref_string NMRefString *group_path = NULL;
+
+    group_path = nm_ref_string_new(nm_dbus_path_not_empty(path));
+
+    if (priv->p2p_group_path == group_path)
+        return;
+
+    nm_clear_g_dbus_connection_signal(priv->dbus_connection,
+                                      &priv->p2p_group_properties_changed_id);
+    nm_clear_g_cancellable(&priv->p2p_group_properties_cancellable);
+
+    nm_ref_string_unref(priv->p2p_group_path);
+    priv->p2p_group_path = g_steal_pointer(&group_path);
+
+    if (priv->p2p_group_path) {
+        priv->p2p_group_properties_cancellable = g_cancellable_new();
+        priv->p2p_group_properties_changed_id =
+            nm_dbus_connection_signal_subscribe_properties_changed(priv->dbus_connection,
+                                                                   priv->name_owner->str,
+                                                                   priv->p2p_group_path->str,
+                                                                   NM_WPAS_DBUS_IFACE_GROUP,
+                                                                   _p2p_group_properties_changed_cb,
+                                                                   self,
+                                                                   NULL);
+        nm_dbus_connection_call_get_all(priv->dbus_connection,
+                                        priv->name_owner->str,
+                                        priv->p2p_group_path->str,
+                                        NM_WPAS_DBUS_IFACE_GROUP,
+                                        5000,
+                                        priv->p2p_group_properties_cancellable,
+                                        _p2p_group_properties_get_all_cb,
+                                        self);
+    }
+
+    _notify(self, PROP_P2P_GROUP_PATH);
+    _notify_maybe_p2p_group(self);
+
+    nm_assert_starting_has_pending_count(priv->starting_pending_count);
+}
+
+/*****************************************************************************/
+
+static void
+_wps_data_free(WpsData *wps_data, GDBusConnection *dbus_connection)
+{
+    nm_clear_g_dbus_connection_signal(dbus_connection, &wps_data->signal_id);
+    nm_clear_g_cancellable(&wps_data->cancellable);
+    g_free(wps_data->type);
+    g_free(wps_data->pin);
+    g_free(wps_data->bssid);
+    nm_g_slice_free(wps_data);
+}
+
+static void
+_wps_credentials_changed_cb(GDBusConnection *connection,
+                            const char *     sender_name,
+                            const char *     object_path,
+                            const char *     signal_interface_name,
+                            const char *     signal_name,
+                            GVariant *       parameters,
+                            gpointer         user_data)
+{
+    NMSupplicantInterface *self      = user_data;
+    gs_unref_variant GVariant *props = NULL;
+
+    if (!g_variant_is_of_type(parameters, G_VARIANT_TYPE("(a{sv})")))
+        return;
+
+    g_variant_get(parameters, "(@a{sv})", &props);
+
+    _LOGT("wps: new credentials");
+    g_signal_emit(self, signals[WPS_CREDENTIALS], 0, props);
+}
+
+static void
+_wps_handle_start_cb(GObject *source, GAsyncResult *result, gpointer user_data)
+{
+    NMSupplicantInterface *self;
+    WpsData *              wps_data;
+    gs_unref_variant GVariant *res = NULL;
+    gs_free_error GError *error    = NULL;
+
+    res = g_dbus_connection_call_finish(G_DBUS_CONNECTION(source), result, &error);
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    wps_data = user_data;
+    self     = wps_data->self;
+
+    if (res)
+        _LOGT("wps: started with success");
+    else
+        _LOGW("wps: start failed with %s", error->message);
+
+    g_clear_object(&wps_data->cancellable);
+    nm_clear_g_free(&wps_data->type);
+    nm_clear_g_free(&wps_data->pin);
+    nm_clear_g_free(&wps_data->bssid);
+}
+
+static void
+_wps_handle_set_pc_cb(GVariant *res, GError *error, gpointer user_data)
+{
+    NMSupplicantInterface *       self;
+    NMSupplicantInterfacePrivate *priv;
+    WpsData *                     wps_data;
+    GVariantBuilder               start_args;
+    guint8                        bssid_buf[ETH_ALEN];
+
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    wps_data = user_data;
+    self     = wps_data->self;
+    priv     = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    if (res)
+        _LOGT("wps: ProcessCredentials successfully set, starting...");
+    else
+        _LOGW("wps: ProcessCredentials failed to set (%s), starting...", error->message);
+
+    wps_data->signal_id = g_dbus_connection_signal_subscribe(priv->dbus_connection,
+                                                             priv->name_owner->str,
+                                                             NM_WPAS_DBUS_IFACE_INTERFACE_WPS,
+                                                             "Credentials",
+                                                             priv->object_path->str,
+                                                             NULL,
+                                                             G_DBUS_SIGNAL_FLAGS_NONE,
+                                                             _wps_credentials_changed_cb,
+                                                             self,
+                                                             NULL);
+
+    g_variant_builder_init(&start_args, G_VARIANT_TYPE_VARDICT);
+    g_variant_builder_add(&start_args, "{sv}", "Role", g_variant_new_string("enrollee"));
+    g_variant_builder_add(&start_args, "{sv}", "Type", g_variant_new_string(wps_data->type));
+    if (wps_data->pin)
+        g_variant_builder_add(&start_args, "{sv}", "Pin", g_variant_new_string(wps_data->pin));
+    if (wps_data->bssid) {
+        /* The BSSID is in fact not mandatory. If it is not set the supplicant would
+         * enroll with any BSS in range. */
+        if (!nm_utils_hwaddr_aton(wps_data->bssid, bssid_buf, sizeof(bssid_buf)))
+            nm_assert_not_reached();
+        g_variant_builder_add(
+            &start_args,
+            "{sv}",
+            "Bssid",
+            g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, bssid_buf, ETH_ALEN, sizeof(guint8)));
+    }
+
+    wps_data->needs_cancelling = TRUE;
+    if (!wps_data->cancellable)
+        wps_data->cancellable = g_cancellable_new();
+
+    _dbus_connection_call(self,
+                          NM_WPAS_DBUS_IFACE_INTERFACE_WPS,
+                          "Start",
+                          g_variant_new("(a{sv})", &start_args),
+                          G_VARIANT_TYPE("(a{sv})"),
+                          G_DBUS_CALL_FLAGS_NONE,
+                          5000,
+                          wps_data->cancellable,
+                          _wps_handle_start_cb,
+                          wps_data);
+}
+
+static void
+_wps_call_set_pc(NMSupplicantInterface *self, WpsData *wps_data)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    if (!wps_data->cancellable)
+        wps_data->cancellable = g_cancellable_new();
+
+    nm_dbus_connection_call_set(priv->dbus_connection,
+                                priv->name_owner->str,
+                                priv->object_path->str,
+                                NM_WPAS_DBUS_IFACE_INTERFACE_WPS,
+                                "ProcessCredentials",
+                                g_variant_new_boolean(TRUE),
+                                5000,
+                                wps_data->cancellable,
+                                _wps_handle_set_pc_cb,
+                                wps_data);
+}
+
+static void
+_wps_handle_cancel_cb(GObject *source, GAsyncResult *result, gpointer user_data)
+{
+    GDBusConnection *             dbus_connection = G_DBUS_CONNECTION(source);
+    NMSupplicantInterface *       self;
+    NMSupplicantInterfacePrivate *priv;
+    WpsData *                     wps_data;
+    gs_unref_variant GVariant *res = NULL;
+    gs_free_error GError *error    = NULL;
+
+    res = g_dbus_connection_call_finish(dbus_connection, result, &error);
+    nm_assert(!nm_utils_error_is_cancelled(error));
+
+    wps_data = user_data;
+    self     = wps_data->self;
+
+    if (!self) {
+        _wps_data_free(wps_data, dbus_connection);
+        if (res)
+            _LOGT("wps: cancel completed successfully, after supplicant interface is gone");
+        else
+            _LOGW("wps: cancel failed (%s), after supplicant interface is gone", error->message);
+        return;
+    }
+
+    priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    wps_data->is_cancelling = FALSE;
+
+    if (!wps_data->type) {
+        priv->wps_data = NULL;
+        _wps_data_free(wps_data, dbus_connection);
+        if (res)
+            _LOGT("wps: cancel completed successfully");
+        else
+            _LOGW("wps: cancel failed (%s)", error->message);
+        return;
+    }
+
+    if (res)
+        _LOGT("wps: cancel completed successfully, setting ProcessCredentials now...");
+    else
+        _LOGW("wps: cancel failed (%s), setting ProcessCredentials now...", error->message);
+
+    _wps_call_set_pc(self, wps_data);
+}
+
+static void
+_wps_start(NMSupplicantInterface *self, const char *type, const char *bssid, const char *pin)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    WpsData *                     wps_data;
+
+    if (type)
+        _LOGI("wps: type %s start...", type);
+
+    wps_data = priv->wps_data;
+
+    if (!wps_data) {
+        if (!type)
+            return;
+
+        if (priv->state == NM_SUPPLICANT_INTERFACE_STATE_DOWN) {
+            _LOGD("wps: interface is down. Cannot start with WPS");
+            return;
+        }
+
+        wps_data  = g_slice_new(WpsData);
+        *wps_data = (WpsData){
+            .self  = self,
+            .type  = g_strdup(type),
+            .bssid = g_strdup(bssid),
+            .pin   = g_strdup(pin),
+        };
+        priv->wps_data = wps_data;
+    } else {
+        g_free(wps_data->type);
+        g_free(wps_data->bssid);
+        g_free(wps_data->pin);
+        wps_data->type  = g_strdup(type);
+        wps_data->bssid = g_strdup(bssid);
+        wps_data->pin   = g_strdup(pin);
+    }
+
+    if (wps_data->is_cancelling) {
+        /* we wait for cancellation to complete. */
+        return;
+    }
+
+    if (!type || wps_data->needs_cancelling) {
+        _LOGT("wps: cancel %senrollment...", wps_data->needs_cancelling ? "previous " : "");
+
+        wps_data->is_cancelling    = TRUE;
+        wps_data->needs_cancelling = FALSE;
+        nm_clear_g_cancellable(&wps_data->cancellable);
+        nm_clear_g_dbus_connection_signal(priv->dbus_connection, &wps_data->signal_id);
+
+        _dbus_connection_call(self,
+                              NM_WPAS_DBUS_IFACE_INTERFACE_WPS,
+                              "Cancel",
+                              NULL,
+                              G_VARIANT_TYPE("()"),
+                              G_DBUS_CALL_FLAGS_NONE,
+                              5000,
+                              NULL,
+                              _wps_handle_cancel_cb,
+                              wps_data);
+        return;
+    }
+
+    _LOGT("wps: setting ProcessCredentials...");
+    _wps_call_set_pc(self, wps_data);
+}
+
+void
+nm_supplicant_interface_enroll_wps(NMSupplicantInterface *self,
+                                   const char *           type,
+                                   const char *           bssid,
+                                   const char *           pin)
+{
+    _wps_start(self, type, bssid, pin);
+}
+
+void
+nm_supplicant_interface_cancel_wps(NMSupplicantInterface *self)
+{
+    _wps_start(self, NULL, NULL, NULL);
+}
+
+/*****************************************************************************/
+
+static void
+iface_introspect_cb(GObject *source, GAsyncResult *result, gpointer user_data)
+{
+    NMSupplicantInterface *       self;
+    NMSupplicantInterfacePrivate *priv;
+    gs_unref_variant GVariant *res = NULL;
+    gs_free_error GError *error    = NULL;
+    const char *          data;
+    NMTernary             value;
+
+    res = g_dbus_connection_call_finish(G_DBUS_CONNECTION(source), result, &error);
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    self = NM_SUPPLICANT_INTERFACE(user_data);
+    priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    nm_assert(NM_SUPPL_CAP_MASK_GET(priv->global_capabilities, NM_SUPPL_CAP_TYPE_AP)
+              == NM_TERNARY_DEFAULT);
+
+    value = NM_TERNARY_DEFAULT;
+    if (res) {
+        g_variant_get(res, "(&s)", &data);
+
+        /* The ProbeRequest method only exists if AP mode has been enabled */
+        value = strstr(data, "ProbeRequest") ? NM_TERNARY_TRUE : NM_TERNARY_FALSE;
+    }
+
+    priv->iface_capabilities =
+        NM_SUPPL_CAP_MASK_SET(priv->iface_capabilities, NM_SUPPL_CAP_TYPE_AP, value);
+
+    priv->starting_pending_count--;
+    _starting_check_ready(self);
+}
+
+static void
+_properties_changed_main(NMSupplicantInterface *self, GVariant *properties)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    const char **                 v_strv;
+    const char *                  v_s;
+    gboolean                      v_b;
+    gint32                        v_i32;
+    GVariant *                    v_v;
+    gboolean                      do_log_driver_info    = FALSE;
+    gboolean                      do_set_state          = FALSE;
+    gboolean                      do_notify_current_bss = FALSE;
+
+    nm_assert(properties || g_variant_is_of_type(properties, G_VARIANT_TYPE("a{sv}")));
+
+    v_v = g_variant_lookup_value(properties, "Capabilities", G_VARIANT_TYPE_VARDICT);
+    if (v_v) {
+        parse_capabilities(self, v_v);
+        g_variant_unref(v_v);
+    }
+
+    if (nm_g_variant_lookup(properties, "Scanning", "b", &v_b)) {
+        if (priv->scanning_property != (!!v_b)) {
+            _LOGT("scanning: %s (plain property)", v_b ? "yes" : "no");
+            priv->scanning_property = v_b;
+        }
+    }
+
+    if (nm_g_variant_lookup(properties, "Ifname", "&s", &v_s)) {
+        if (nm_utils_strdup_reset(&priv->ifname, v_s))
+            do_log_driver_info = TRUE;
+    }
+    if (nm_g_variant_lookup(properties, "Driver", "&s", &v_s)) {
+        if (nm_utils_strdup_reset(&priv->driver, v_s))
+            do_log_driver_info = TRUE;
+    }
+
+    if (nm_g_variant_lookup(properties, "DisconnectReason", "i", &v_i32)) {
+        /* Disconnect reason is currently only given for deauthentication events,
+         * not disassociation; currently they are IEEE 802.11 "reason codes",
+         * defined by (IEEE 802.11-2007, 7.3.1.7, Table 7-22).  Any locally caused
+         * deauthentication will be negative, while authentications caused by the
+         * AP will be positive.
+         */
+        priv->disconnect_reason = v_i32;
+    }
+
+    if (nm_g_variant_lookup(properties, "State", "&s", &v_s)) {
+        NMSupplicantInterfaceState state;
+
+        state = wpas_state_string_to_enum(v_s);
+        if (state == NM_SUPPLICANT_INTERFACE_STATE_INVALID)
+            _LOGT("state: ignore unknown supplicant state '%s' (is %s, plain property)",
+                  v_s,
+                  nm_supplicant_interface_state_to_string(priv->supp_state));
+        else if (priv->supp_state != state) {
+            _LOGT("state: %s (was %s, plain property)",
+                  nm_supplicant_interface_state_to_string(state),
+                  nm_supplicant_interface_state_to_string(priv->supp_state));
+            priv->supp_state = state;
+            if (priv->state > NM_SUPPLICANT_INTERFACE_STATE_STARTING) {
+                /* Only transition to actual wpa_supplicant interface states (ie,
+                 * anything > STARTING) after the NMSupplicantInterface has had a
+                 * chance to initialize, which is signalled by entering the STARTING
+                 * state.
+                 */
+                do_set_state = TRUE;
+            }
+        }
+    }
+
+    if (nm_g_variant_lookup(properties, "CurrentBSS", "&o", &v_s)) {
+        v_s = nm_dbus_path_not_empty(v_s);
+        if (!nm_ref_string_equals_str(priv->current_bss, v_s)) {
+            nm_ref_string_unref(priv->current_bss);
+            priv->current_bss     = nm_ref_string_new(v_s);
+            do_notify_current_bss = TRUE;
+        }
+    }
+
+    if (nm_g_variant_lookup(properties, "ApIsolate", "&s", &v_s))
+        priv->ap_isolate_supported = TRUE;
+
+    if (do_log_driver_info) {
+        _LOGD("supplicant interface for ifindex=%d, ifname=%s%s%s, driver=%s%s%s (requested %s)",
+              priv->ifindex,
+              NM_PRINT_FMT_QUOTE_STRING(priv->ifname),
+              NM_PRINT_FMT_QUOTE_STRING(priv->driver),
+              nm_supplicant_driver_to_string(priv->requested_driver));
+    }
+
+    if (nm_g_variant_lookup(properties, "BSSs", "^a&o", &v_strv)) {
+        NMSupplicantBssInfo *bss_info;
+        NMSupplicantBssInfo *bss_info_safe;
+        const char **        iter;
+
+        c_list_for_each_entry (bss_info, &priv->bss_lst_head, _bss_lst)
+            bss_info->_bss_dirty = TRUE;
+        c_list_for_each_entry (bss_info, &priv->bss_initializing_lst_head, _bss_lst)
+            bss_info->_bss_dirty = TRUE;
+
+        for (iter = v_strv; *iter; iter++)
+            _bss_info_add(self, *iter);
+
+        g_free(v_strv);
+
+        c_list_for_each_entry_safe (bss_info,
+                                    bss_info_safe,
+                                    &priv->bss_initializing_lst_head,
+                                    _bss_lst) {
+            if (bss_info->_bss_dirty)
+                _bss_info_remove(self, &bss_info->bss_path);
+        }
+        c_list_for_each_entry_safe (bss_info, bss_info_safe, &priv->bss_lst_head, _bss_lst) {
+            if (bss_info->_bss_dirty)
+                _bss_info_remove(self, &bss_info->bss_path);
+        }
+    }
+
+    if (do_notify_current_bss)
+        _notify(self, PROP_CURRENT_BSS);
+
+    if (do_set_state)
+        set_state(self, priv->supp_state);
+
+    _notify_maybe_scanning(self);
+}
+
+static void
+_properties_changed_p2p_device(NMSupplicantInterface *self, GVariant *properties)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    const char **                 v_strv;
+    const char *                  v_s;
+
+    nm_assert(!properties || g_variant_is_of_type(properties, G_VARIANT_TYPE("a{sv}")));
+
+    if (nm_g_variant_lookup(properties, "Peers", "^a&o", &v_strv)) {
+        NMSupplicantPeerInfo *peer_info;
+        NMSupplicantPeerInfo *peer_info_safe;
+        const char *const *   iter;
+
+        c_list_for_each_entry (peer_info, &priv->peer_lst_head, _peer_lst)
+            peer_info->_peer_dirty = TRUE;
+        c_list_for_each_entry (peer_info, &priv->peer_initializing_lst_head, _peer_lst)
+            peer_info->_peer_dirty = TRUE;
+
+        for (iter = v_strv; *iter; iter++)
+            _peer_info_add(self, *iter);
+
+        g_free(v_strv);
+
+        c_list_for_each_entry_safe (peer_info,
+                                    peer_info_safe,
+                                    &priv->peer_initializing_lst_head,
+                                    _peer_lst) {
+            if (peer_info->_peer_dirty)
+                _peer_info_remove(self, &peer_info->peer_path);
+        }
+        c_list_for_each_entry_safe (peer_info, peer_info_safe, &priv->peer_lst_head, _peer_lst) {
+            if (peer_info->_peer_dirty)
+                _peer_info_remove(self, &peer_info->peer_path);
+        }
+    }
+
+    if (nm_g_variant_lookup(properties, "Group", "&o", &v_s))
+        _p2p_group_set_path(self, v_s);
+}
+
+/*****************************************************************************/
+
+static void
+assoc_return(NMSupplicantInterface *self, GError *error, const char *message)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    AssocData *                   assoc_data;
+
+    assoc_data = g_steal_pointer(&priv->assoc_data);
+    if (!assoc_data)
+        return;
+
+    if (error) {
+        g_dbus_error_strip_remote_error(error);
+        _LOGW("assoc[" NM_HASH_OBFUSCATE_PTR_FMT "]: %s: %s",
+              NM_HASH_OBFUSCATE_PTR(assoc_data),
+              message,
+              error->message);
+    } else {
+        _LOGD("assoc[" NM_HASH_OBFUSCATE_PTR_FMT "]: association request successful",
+              NM_HASH_OBFUSCATE_PTR(assoc_data));
+    }
+
+    if (assoc_data->add_network_data) {
+        /* signal that this request already completed */
+        assoc_data->add_network_data->assoc_data = NULL;
+    }
+
+    nm_clear_g_source(&assoc_data->fail_on_idle_id);
+    nm_clear_g_cancellable(&assoc_data->cancellable);
+
+    if (assoc_data->callback)
+        assoc_data->callback(self, error, assoc_data->user_data);
+
+    g_object_unref(assoc_data->cfg);
+    g_slice_free(AssocData, assoc_data);
+}
+
+void
+nm_supplicant_interface_disconnect(NMSupplicantInterface *self)
+{
+    NMSupplicantInterfacePrivate *priv;
+
+    g_return_if_fail(NM_IS_SUPPLICANT_INTERFACE(self));
+
+    priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    /* Disconnect from the current AP */
+    if ((priv->state >= NM_SUPPLICANT_INTERFACE_STATE_SCANNING)
+        && (priv->state <= NM_SUPPLICANT_INTERFACE_STATE_COMPLETED)) {
+        _dbus_connection_call_simple(self,
+                                     NM_WPAS_DBUS_IFACE_INTERFACE,
+                                     "Disconnect",
+                                     NULL,
+                                     G_VARIANT_TYPE("()"),
+                                     "disconnect");
+    }
+
+    _remove_network(self);
+
+    /* Cancel any WPS enrollment, if any */
+    nm_supplicant_interface_cancel_wps(self);
+
+    /* Cancel all pending calls related to a prior connection attempt */
+    if (priv->assoc_data) {
+        gs_free_error GError *error = NULL;
+
+        nm_utils_error_set_cancelled(&error, FALSE, "NMSupplicantInterface");
+        assoc_return(self, error, "abort due to disconnect");
+    }
+}
+
+static void
+disconnect_cb(GObject *source, GAsyncResult *result, gpointer user_data)
+{
+    gs_unref_object NMSupplicantInterface *self = NULL;
+    gs_unref_variant GVariant *res              = NULL;
+    gs_free_error GError *            error     = NULL;
+    NMSupplicantInterfaceDisconnectCb callback;
+    gpointer                          callback_user_data;
+
+    nm_utils_user_data_unpack(user_data, &self, &callback, &callback_user_data);
+
+    res = g_dbus_connection_call_finish(G_DBUS_CONNECTION(source), result, &error);
+
+    if (!res && !strstr(error->message, "fi.w1.wpa_supplicant1.NotConnected")) {
+        /* an already disconnected interface is not an error*/
+        g_clear_error(&error);
+    }
+
+    callback(self, error, callback_user_data);
+}
+
+void
+nm_supplicant_interface_disconnect_async(NMSupplicantInterface *           self,
+                                         GCancellable *                    cancellable,
+                                         NMSupplicantInterfaceDisconnectCb callback,
+                                         gpointer                          user_data)
+{
+    g_return_if_fail(NM_IS_SUPPLICANT_INTERFACE(self));
+    g_return_if_fail(callback);
+
+    _dbus_connection_call(self,
+                          NM_WPAS_DBUS_IFACE_INTERFACE,
+                          "Disconnect",
+                          NULL,
+                          G_VARIANT_TYPE("()"),
+                          G_DBUS_CALL_FLAGS_NONE,
+                          DBUS_TIMEOUT_MSEC,
+                          cancellable,
+                          disconnect_cb,
+                          nm_utils_user_data_pack(g_object_ref(self), callback, user_data));
+}
+
+static void
+assoc_select_network_cb(GObject *source, GAsyncResult *result, gpointer user_data)
+{
+    NMSupplicantInterface *self;
+    gs_unref_variant GVariant *res = NULL;
+    gs_free_error GError *error    = NULL;
+
+    res = g_dbus_connection_call_finish(G_DBUS_CONNECTION(source), result, &error);
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    self = NM_SUPPLICANT_INTERFACE(user_data);
+    if (error)
+        assoc_return(self, error, "failure to select network config");
+    else
+        assoc_return(self, NULL, NULL);
+}
+
+static void
+assoc_call_select_network(NMSupplicantInterface *self)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    _dbus_connection_call(self,
+                          NM_WPAS_DBUS_IFACE_INTERFACE,
+                          "SelectNetwork",
+                          g_variant_new("(o)", priv->net_path),
+                          G_VARIANT_TYPE("()"),
+                          G_DBUS_CALL_FLAGS_NONE,
+                          DBUS_TIMEOUT_MSEC,
+                          priv->assoc_data->cancellable,
+                          assoc_select_network_cb,
+                          self);
+}
+
+static void
+assoc_add_blob_cb(GObject *source, GAsyncResult *result, gpointer user_data)
+{
+    NMSupplicantInterface *       self;
+    NMSupplicantInterfacePrivate *priv;
+    gs_unref_variant GVariant *res = NULL;
+    gs_free_error GError *error    = NULL;
+
+    res = g_dbus_connection_call_finish(G_DBUS_CONNECTION(source), result, &error);
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    self = NM_SUPPLICANT_INTERFACE(user_data);
+    priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    if (error) {
+        assoc_return(self, error, "failure to set network certificates");
+        return;
+    }
+
+    priv->assoc_data->blobs_left--;
+    _LOGT("assoc[" NM_HASH_OBFUSCATE_PTR_FMT "]: blob added (%u left)",
+          NM_HASH_OBFUSCATE_PTR(priv->assoc_data),
+          priv->assoc_data->blobs_left);
+    if (priv->assoc_data->blobs_left == 0)
+        assoc_call_select_network(self);
+}
+
+static void
+assoc_add_network_cb(GObject *source, GAsyncResult *result, gpointer user_data)
+{
+    AddNetworkData *              add_network_data = user_data;
+    AssocData *                   assoc_data;
+    NMSupplicantInterface *       self;
+    NMSupplicantInterfacePrivate *priv;
+    gs_unref_variant GVariant *res = NULL;
+    gs_free_error GError *error    = NULL;
+    GHashTable *          blobs;
+    GHashTableIter        iter;
+    const char *          blob_name;
+    GBytes *              blob_data;
+    nm_auto_ref_string NMRefString *name_owner  = NULL;
+    nm_auto_ref_string NMRefString *object_path = NULL;
+
+    g_clear_object(&add_network_data->shutdown_wait_obj);
+
+    assoc_data = add_network_data->assoc_data;
+    if (assoc_data)
+        assoc_data->add_network_data = NULL;
+    name_owner  = g_steal_pointer(&add_network_data->name_owner);
+    object_path = g_steal_pointer(&add_network_data->object_path);
+    nm_g_slice_free(add_network_data);
+
+    res = g_dbus_connection_call_finish(G_DBUS_CONNECTION(source), result, &error);
+
+    if (!assoc_data) {
+        if (!error) {
+            const char *net_path;
+
+            /* the assoc-request was already cancelled, but the AddNetwork request succeeded.
+             * Cleanup the created network.
+             *
+             * This cleanup action does not work when NetworkManager is about to exit
+             * and leaves the mainloop. During program shutdown, we may orphan networks. */
+            g_variant_get(res, "(&o)", &net_path);
+            g_dbus_connection_call(G_DBUS_CONNECTION(source),
+                                   name_owner->str,
+                                   object_path->str,
+                                   NM_WPAS_DBUS_IFACE_INTERFACE,
+                                   "RemoveNetwork",
+                                   g_variant_new("(o)", net_path),
+                                   G_VARIANT_TYPE("()"),
+                                   G_DBUS_CALL_FLAGS_NONE,
+                                   DBUS_TIMEOUT_MSEC,
+                                   NULL,
+                                   NULL,
+                                   NULL);
+        }
+        return;
+    }
+
+    self = NM_SUPPLICANT_INTERFACE(assoc_data->self);
+    priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    if (error) {
+        assoc_return(self, error, "failure to add network");
+        return;
+    }
+
+    nm_assert(!priv->net_path);
+    g_variant_get(res, "(o)", &priv->net_path);
+
+    /* Send blobs first; otherwise jump to selecting the network */
+    blobs                        = nm_supplicant_config_get_blobs(priv->assoc_data->cfg);
+    priv->assoc_data->blobs_left = blobs ? g_hash_table_size(blobs) : 0u;
+
+    _LOGT("assoc[" NM_HASH_OBFUSCATE_PTR_FMT "]: network added (%s) (%u blobs left)",
+          NM_HASH_OBFUSCATE_PTR(priv->assoc_data),
+          priv->net_path,
+          priv->assoc_data->blobs_left);
+
+    if (priv->assoc_data->blobs_left == 0) {
+        assoc_call_select_network(self);
+        return;
+    }
+
+    g_hash_table_iter_init(&iter, blobs);
+    while (g_hash_table_iter_next(&iter, (gpointer) &blob_name, (gpointer) &blob_data)) {
+        _dbus_connection_call(
+            self,
+            NM_WPAS_DBUS_IFACE_INTERFACE,
+            "AddBlob",
+            g_variant_new("(s@ay)", blob_name, nm_utils_gbytes_to_variant_ay(blob_data)),
+            G_VARIANT_TYPE("()"),
+            G_DBUS_CALL_FLAGS_NONE,
+            DBUS_TIMEOUT_MSEC,
+            priv->assoc_data->cancellable,
+            assoc_add_blob_cb,
+            self);
+    }
+}
+
+static void
+add_network(NMSupplicantInterface *self)
+{
+    NMSupplicantInterfacePrivate *priv;
+    AddNetworkData *              add_network_data;
+
+    priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    /* the association does not keep @self alive. We want to be able to remove
+     * the network again, even if @self is already gone. Hence, track the data
+     * separately.
+     *
+     * For that we also have a shutdown_wait_obj so that on exit we still wait
+     * to handle the response. */
+    add_network_data  = g_slice_new(AddNetworkData);
+    *add_network_data = (AddNetworkData){
+        .assoc_data        = priv->assoc_data,
+        .name_owner        = nm_ref_string_ref(priv->name_owner),
+        .object_path       = nm_ref_string_ref(priv->object_path),
+        .shutdown_wait_obj = g_object_new(G_TYPE_OBJECT, NULL),
+    };
+    nm_shutdown_wait_obj_register_object(add_network_data->shutdown_wait_obj,
+                                         "supplicant-add-network");
+    priv->assoc_data->add_network_data = add_network_data;
+
+    _dbus_connection_call(
+        self,
+        NM_WPAS_DBUS_IFACE_INTERFACE,
+        "AddNetwork",
+        g_variant_new("(@a{sv})", nm_supplicant_config_to_variant(priv->assoc_data->cfg)),
+        G_VARIANT_TYPE("(o)"),
+        G_DBUS_CALL_FLAGS_NONE,
+        DBUS_TIMEOUT_MSEC,
+        NULL,
+        assoc_add_network_cb,
+        add_network_data);
+}
+
+static void
+assoc_set_ap_isolation(GVariant *ret, GError *error, gpointer user_data)
+{
+    NMSupplicantInterface *       self;
+    NMSupplicantInterfacePrivate *priv;
+    gboolean                      value;
+
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    self = NM_SUPPLICANT_INTERFACE(user_data);
+    priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    if (error) {
+        assoc_return(self, error, "failure to set AP isolation");
+        return;
+    }
+
+    value = nm_supplicant_config_get_ap_isolation(priv->assoc_data->cfg);
+    _LOGT("assoc[" NM_HASH_OBFUSCATE_PTR_FMT "]: interface AP isolation set to %d",
+          NM_HASH_OBFUSCATE_PTR(priv->assoc_data),
+          value);
+
+    priv->ap_isolate_needs_reset = value;
+
+    nm_assert(priv->assoc_data->calls_left > 0);
+    if (--priv->assoc_data->calls_left == 0)
+        add_network(self);
+}
+
+static void
+assoc_set_ap_scan_cb(GVariant *ret, GError *error, gpointer user_data)
+{
+    NMSupplicantInterface *       self;
+    NMSupplicantInterfacePrivate *priv;
+
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    self = NM_SUPPLICANT_INTERFACE(user_data);
+    priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    if (error) {
+        assoc_return(self, error, "failure to set AP scan mode");
+        return;
+    }
+
+    _LOGT("assoc[" NM_HASH_OBFUSCATE_PTR_FMT "]: interface ap_scan set to %d",
+          NM_HASH_OBFUSCATE_PTR(priv->assoc_data),
+          nm_supplicant_config_get_ap_scan(priv->assoc_data->cfg));
+
+    nm_assert(priv->assoc_data->calls_left > 0);
+    if (--priv->assoc_data->calls_left == 0)
+        add_network(self);
+}
+
+static gboolean
+assoc_fail_on_idle_cb(gpointer user_data)
+{
+    NMSupplicantInterface *       self = user_data;
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    gs_free_error GError *error        = NULL;
+
+    priv->assoc_data->fail_on_idle_id = 0;
+    g_set_error(&error,
+                NM_SUPPLICANT_ERROR,
+                NM_SUPPLICANT_ERROR_CONFIG,
+                "EAP-FAST is not supported by the supplicant");
+    assoc_return(self, error, "failure due to missing supplicant support");
+    return G_SOURCE_REMOVE;
+}
+
+/**
+ * nm_supplicant_interface_assoc:
+ * @self: the supplicant interface instance
+ * @cfg: the configuration with the data for the association
+ * @callback: callback invoked when the association completes or fails.
+ * @user_data: data for the callback.
+ *
+ * Calls AddNetwork and SelectNetwork to start associating according to @cfg.
+ *
+ * The callback is invoked exactly once (always) and always asynchronously.
+ * The pending association can be aborted via nm_supplicant_interface_disconnect()
+ * or by destroying @self. In that case, the @callback is invoked synchronously with
+ * an error reason indicating cancellation/disposing (see nm_utils_error_is_cancelled()).
+ */
+void
+nm_supplicant_interface_assoc(NMSupplicantInterface *      self,
+                              NMSupplicantConfig *         cfg,
+                              NMSupplicantInterfaceAssocCb callback,
+                              gpointer                     user_data)
+{
+    NMSupplicantInterfacePrivate *priv;
+    AssocData *                   assoc_data;
+    gboolean                      ap_isolation;
+
+    g_return_if_fail(NM_IS_SUPPLICANT_INTERFACE(self));
+    g_return_if_fail(NM_IS_SUPPLICANT_CONFIG(cfg));
+
+    priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    nm_supplicant_interface_disconnect(self);
+
+    assoc_data  = g_slice_new(AssocData);
+    *assoc_data = (AssocData){
+        .self      = self,
+        .cfg       = g_object_ref(cfg),
+        .callback  = callback,
+        .user_data = user_data,
+    };
+
+    priv->assoc_data = assoc_data;
+
+    _LOGD("assoc[" NM_HASH_OBFUSCATE_PTR_FMT "]: starting association...",
+          NM_HASH_OBFUSCATE_PTR(assoc_data));
+
+    if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FAST) == NM_TERNARY_FALSE
+        && nm_supplicant_config_fast_required(cfg)) {
+        /* Make sure the supplicant supports EAP-FAST before trying to send
+         * it an EAP-FAST configuration.
+         */
+        assoc_data->fail_on_idle_id = g_idle_add(assoc_fail_on_idle_cb, self);
+        return;
+    }
+
+    assoc_data->cancellable = g_cancellable_new();
+    assoc_data->calls_left++;
+    nm_dbus_connection_call_set(
+        priv->dbus_connection,
+        priv->name_owner->str,
+        priv->object_path->str,
+        NM_WPAS_DBUS_IFACE_INTERFACE,
+        "ApScan",
+        g_variant_new_uint32(nm_supplicant_config_get_ap_scan(priv->assoc_data->cfg)),
+        DBUS_TIMEOUT_MSEC,
+        assoc_data->cancellable,
+        assoc_set_ap_scan_cb,
+        self);
+
+    ap_isolation = nm_supplicant_config_get_ap_isolation(priv->assoc_data->cfg);
+    if (!priv->ap_isolate_supported) {
+        if (ap_isolation) {
+            _LOGW("assoc[" NM_HASH_OBFUSCATE_PTR_FMT
+                  "]: requested AP isolation but the supplicant doesn't support it",
+                  NM_HASH_OBFUSCATE_PTR(assoc_data));
+        }
+    } else {
+        assoc_data->calls_left++;
+        /* It would be smarter to change the property only when necessary.
+         * However, wpa_supplicant doesn't send the PropertiesChanged
+         * signal for ApIsolate, and so to know the current value we would
+         * need first a Get call. It seems simpler to just set the value
+         * we want. */
+        nm_dbus_connection_call_set(priv->dbus_connection,
+                                    priv->name_owner->str,
+                                    priv->object_path->str,
+                                    NM_WPAS_DBUS_IFACE_INTERFACE,
+                                    "ApIsolate",
+                                    g_variant_new_string(ap_isolation ? "1" : "0"),
+                                    DBUS_TIMEOUT_MSEC,
+                                    assoc_data->cancellable,
+                                    assoc_set_ap_isolation,
+                                    self);
+    }
+}
+
+/*****************************************************************************/
+
+typedef struct {
+    NMSupplicantInterface *                  self;
+    GCancellable *                           cancellable;
+    NMSupplicantInterfaceRequestScanCallback callback;
+    gpointer                                 user_data;
+} ScanRequestData;
+
+static void
+scan_request_cb(GObject *source, GAsyncResult *result, gpointer user_data)
+{
+    gs_unref_object NMSupplicantInterface *self_keep_alive = NULL;
+    NMSupplicantInterface *                self;
+    gs_unref_variant GVariant *res  = NULL;
+    gs_free_error GError *error     = NULL;
+    ScanRequestData *     data      = user_data;
+    gboolean              cancelled = FALSE;
+
+    res = g_dbus_connection_call_finish(G_DBUS_CONNECTION(source), result, &error);
+    if (nm_utils_error_is_cancelled(error)) {
+        if (!data->callback) {
+            /* the self instance was not kept alive. We also must not touch it. Return. */
+            nm_g_object_unref(data->cancellable);
+            nm_g_slice_free(data);
+            return;
+        }
+        cancelled = TRUE;
+    }
+
+    self = data->self;
+    if (data->callback) {
+        /* the self instance was kept alive. Balance the reference count. */
+        self_keep_alive = self;
+    }
+
+    /* we don't propagate the error/success. That is, because either answer is not
+     * reliable. What is important to us is whether the request completed, and
+     * the current nm_supplicant_interface_get_scanning() state. */
+    if (cancelled)
+        _LOGD("request-scan: request cancelled");
+    else {
+        if (error) {
+            if (_nm_dbus_error_has_name(error, "fi.w1.wpa_supplicant1.Interface.ScanError"))
+                _LOGD("request-scan: could not get scan request result: %s", error->message);
+            else {
+                g_dbus_error_strip_remote_error(error);
+                _LOGW("request-scan: could not get scan request result: %s", error->message);
+            }
+        } else
+            _LOGT("request-scan: request scanning success");
+    }
+
+    if (data->callback)
+        data->callback(self, data->cancellable, data->user_data);
+
+    nm_g_object_unref(data->cancellable);
+    nm_g_slice_free(data);
+}
+
+void
+nm_supplicant_interface_request_scan(NMSupplicantInterface *                  self,
+                                     GBytes *const *                          ssids,
+                                     guint                                    ssids_len,
+                                     GCancellable *                           cancellable,
+                                     NMSupplicantInterfaceRequestScanCallback callback,
+                                     gpointer                                 user_data)
+{
+    NMSupplicantInterfacePrivate *priv;
+    GVariantBuilder               builder;
+    ScanRequestData *             data;
+    guint                         i;
+
+    g_return_if_fail(NM_IS_SUPPLICANT_INTERFACE(self));
+
+    nm_assert((!cancellable && !callback) || (G_IS_CANCELLABLE(cancellable) && callback));
+
+    priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    _LOGT("request-scan: request scanning (%u ssids)...", ssids_len);
+
+    g_variant_builder_init(&builder, G_VARIANT_TYPE_VARDICT);
+    g_variant_builder_add(&builder, "{sv}", "Type", g_variant_new_string("active"));
+    g_variant_builder_add(&builder, "{sv}", "AllowRoam", g_variant_new_boolean(FALSE));
+    if (ssids_len > 0) {
+        GVariantBuilder ssids_builder;
+
+        g_variant_builder_init(&ssids_builder, G_VARIANT_TYPE_BYTESTRING_ARRAY);
+        for (i = 0; i < ssids_len; i++) {
+            nm_assert(ssids[i]);
+            g_variant_builder_add(&ssids_builder, "@ay", nm_utils_gbytes_to_variant_ay(ssids[i]));
+        }
+        g_variant_builder_add(&builder, "{sv}", "SSIDs", g_variant_builder_end(&ssids_builder));
+    }
+
+    data  = g_slice_new(ScanRequestData);
+    *data = (ScanRequestData){
+        .self        = self,
+        .callback    = callback,
+        .user_data   = user_data,
+        .cancellable = nm_g_object_ref(cancellable),
+    };
+
+    if (callback) {
+        /* A callback was provided. This keeps @self alive. The caller
+         * must provide a cancellable as the caller must never leave an asynchronous
+         * operation pending indefinitely. */
+        nm_assert(G_IS_CANCELLABLE(cancellable));
+        g_object_ref(self);
+    } else {
+        /* We don't keep @self alive, and we don't accept a cancellable either. */
+        nm_assert(!cancellable);
+        cancellable = priv->main_cancellable;
+    }
+
+    _dbus_connection_call(self,
+                          NM_WPAS_DBUS_IFACE_INTERFACE,
+                          "Scan",
+                          g_variant_new("(a{sv})", &builder),
+                          G_VARIANT_TYPE("()"),
+                          G_DBUS_CALL_FLAGS_NONE,
+                          DBUS_TIMEOUT_MSEC,
+                          cancellable,
+                          scan_request_cb,
+                          data);
+}
+
+/*****************************************************************************/
+
+NMSupplicantInterfaceState
+nm_supplicant_interface_get_state(NMSupplicantInterface *self)
+{
+    g_return_val_if_fail(NM_IS_SUPPLICANT_INTERFACE(self), NM_SUPPLICANT_INTERFACE_STATE_DOWN);
+
+    return NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self)->state;
+}
+
+void
+_nm_supplicant_interface_set_state_down(NMSupplicantInterface *self,
+                                        gboolean               force_remove_from_supplicant,
+                                        const char *           reason)
+{
+    set_state_down(self, force_remove_from_supplicant, reason);
+}
+
+NMRefString *
+nm_supplicant_interface_get_name_owner(NMSupplicantInterface *self)
+{
+    g_return_val_if_fail(NM_IS_SUPPLICANT_INTERFACE(self), NULL);
+
+    return NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self)->name_owner;
+}
+
+NMRefString *
+nm_supplicant_interface_get_object_path(NMSupplicantInterface *self)
+{
+    g_return_val_if_fail(NM_IS_SUPPLICANT_INTERFACE(self), NULL);
+
+    return NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self)->object_path;
+}
+
+const char *
+nm_supplicant_interface_get_ifname(NMSupplicantInterface *self)
+{
+    g_return_val_if_fail(NM_IS_SUPPLICANT_INTERFACE(self), NULL);
+
+    return NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self)->ifname;
+}
+
+guint
+nm_supplicant_interface_get_max_scan_ssids(NMSupplicantInterface *self)
+{
+    NMSupplicantInterfacePrivate *priv;
+
+    g_return_val_if_fail(NM_IS_SUPPLICANT_INTERFACE(self), 0);
+
+    priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    return priv->prop_scan_active && priv->prop_scan_ssid ? priv->max_scan_ssids : 0u;
+}
+
+/*****************************************************************************/
+
+void
+nm_supplicant_interface_p2p_start_find(NMSupplicantInterface *self, guint timeout)
+{
+    GVariantBuilder builder;
+
+    g_return_if_fail(NM_IS_SUPPLICANT_INTERFACE(self));
+    g_return_if_fail(timeout > 0 && timeout <= 600);
+
+    g_variant_builder_init(&builder, G_VARIANT_TYPE_VARDICT);
+    g_variant_builder_add(&builder, "{sv}", "Timeout", g_variant_new_int32(timeout));
+
+    _dbus_connection_call_simple(self,
+                                 NM_WPAS_DBUS_IFACE_INTERFACE_P2P_DEVICE,
+                                 "Find",
+                                 g_variant_new("(a{sv})", &builder),
+                                 G_VARIANT_TYPE("()"),
+                                 "p2p-find");
+}
+
+void
+nm_supplicant_interface_p2p_stop_find(NMSupplicantInterface *self)
+{
+    g_return_if_fail(NM_IS_SUPPLICANT_INTERFACE(self));
+
+    _dbus_connection_call_simple(self,
+                                 NM_WPAS_DBUS_IFACE_INTERFACE_P2P_DEVICE,
+                                 "StopFind",
+                                 NULL,
+                                 G_VARIANT_TYPE("()"),
+                                 "p2p-stop-find");
+}
+
+/*****************************************************************************/
+
+void
+nm_supplicant_interface_p2p_connect(NMSupplicantInterface *self,
+                                    const char *           peer,
+                                    const char *           wps_method,
+                                    const char *           wps_pin)
+{
+    GVariantBuilder builder;
+
+    g_return_if_fail(NM_IS_SUPPLICANT_INTERFACE(self));
+
+    g_variant_builder_init(&builder, G_VARIANT_TYPE_VARDICT);
+
+    g_variant_builder_add(&builder, "{sv}", "wps_method", g_variant_new_string(wps_method));
+    if (wps_pin)
+        g_variant_builder_add(&builder, "{sv}", "pin", g_variant_new_string(wps_pin));
+    g_variant_builder_add(&builder, "{sv}", "peer", g_variant_new_object_path(peer));
+    g_variant_builder_add(&builder, "{sv}", "join", g_variant_new_boolean(FALSE));
+    g_variant_builder_add(&builder, "{sv}", "persistent", g_variant_new_boolean(FALSE));
+    g_variant_builder_add(&builder, "{sv}", "go_intent", g_variant_new_int32(7));
+
+    _dbus_connection_call_simple(self,
+                                 NM_WPAS_DBUS_IFACE_INTERFACE_P2P_DEVICE,
+                                 "Connect",
+                                 g_variant_new("(a{sv})", &builder),
+                                 G_VARIANT_TYPE("(s)"),
+                                 "p2p-connect");
+}
+
+void
+nm_supplicant_interface_p2p_cancel_connect(NMSupplicantInterface *self)
+{
+    g_return_if_fail(NM_IS_SUPPLICANT_INTERFACE(self));
+
+    _dbus_connection_call_simple(self,
+                                 NM_WPAS_DBUS_IFACE_INTERFACE_P2P_DEVICE,
+                                 "Cancel",
+                                 NULL,
+                                 G_VARIANT_TYPE("()"),
+                                 "p2p-cancel");
+}
+
+void
+nm_supplicant_interface_p2p_disconnect(NMSupplicantInterface *self)
+{
+    g_return_if_fail(NM_IS_SUPPLICANT_INTERFACE(self));
+
+    _dbus_connection_call_simple(self,
+                                 NM_WPAS_DBUS_IFACE_INTERFACE_P2P_DEVICE,
+                                 "Disconnect",
+                                 NULL,
+                                 G_VARIANT_TYPE("()"),
+                                 "p2p-disconnect");
+}
+
+/*****************************************************************************/
+
+static void
+_properties_changed(NMSupplicantInterface *self,
+                    const char *           interface_name,
+                    GVariant *             properties,
+                    gboolean               initial)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    gboolean                      is_main;
+
+    nm_assert(!properties || g_variant_is_of_type(properties, G_VARIANT_TYPE("a{sv}")));
+
+    if (initial)
+        priv->starting_pending_count--;
+
+    if ((initial || priv->is_ready_main) && nm_streq(interface_name, NM_WPAS_DBUS_IFACE_INTERFACE))
+        is_main = TRUE;
+    else if ((initial || priv->is_ready_p2p_device)
+             && nm_streq(interface_name, NM_WPAS_DBUS_IFACE_INTERFACE_P2P_DEVICE)) {
+        nm_assert(_get_capability(priv, NM_SUPPL_CAP_TYPE_P2P) == NM_TERNARY_TRUE);
+        is_main = FALSE;
+    } else
+        return;
+
+    g_object_freeze_notify(G_OBJECT(self));
+
+    priv->starting_pending_count++;
+
+    if (is_main) {
+        priv->is_ready_main = TRUE;
+        _properties_changed_main(self, properties);
+    } else {
+        priv->is_ready_p2p_device = TRUE;
+        _properties_changed_p2p_device(self, properties);
+    }
+
+    priv->starting_pending_count--;
+    _starting_check_ready(self);
+
+    _notify_maybe_scanning(self);
+    _notify_maybe_p2p_available(self);
+
+    g_object_thaw_notify(G_OBJECT(self));
+}
+
+static void
+_properties_changed_cb(GDBusConnection *connection,
+                       const char *     sender_name,
+                       const char *     object_path,
+                       const char *     signal_interface_name,
+                       const char *     signal_name,
+                       GVariant *       parameters,
+                       gpointer         user_data)
+{
+    NMSupplicantInterface *self = NM_SUPPLICANT_INTERFACE(user_data);
+    const char *           interface_name;
+    gs_unref_variant GVariant *changed_properties = NULL;
+
+    if (!g_variant_is_of_type(parameters, G_VARIANT_TYPE("(sa{sv}as)")))
+        return;
+
+    g_variant_get(parameters, "(&s@a{sv}^a&s)", &interface_name, &changed_properties, NULL);
+    _properties_changed(self, interface_name, changed_properties, FALSE);
+}
+
+static void
+_bss_properties_changed_cb(GDBusConnection *connection,
+                           const char *     sender_name,
+                           const char *     object_path,
+                           const char *     signal_interface_name,
+                           const char *     signal_name,
+                           GVariant *       parameters,
+                           gpointer         user_data)
+{
+    NMSupplicantInterface *       self            = NM_SUPPLICANT_INTERFACE(user_data);
+    NMSupplicantInterfacePrivate *priv            = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    nm_auto_ref_string NMRefString *bss_path      = NULL;
+    gs_unref_variant GVariant *changed_properties = NULL;
+    NMSupplicantBssInfo *      bss_info;
+
+    if (!g_variant_is_of_type(parameters, G_VARIANT_TYPE("(sa{sv}as)")))
+        return;
+
+    bss_path = nm_ref_string_new(object_path);
+
+    bss_info = g_hash_table_lookup(priv->bss_idx, &bss_path);
+    if (!bss_info)
+        return;
+    if (bss_info->_init_cancellable)
+        return;
+
+    g_variant_get(parameters, "(&s@a{sv}^a&s)", NULL, &changed_properties, NULL);
+    _bss_info_properties_changed(self, bss_info, changed_properties, FALSE);
+}
+
+static void
+_peer_properties_changed_cb(GDBusConnection *connection,
+                            const char *     sender_name,
+                            const char *     object_path,
+                            const char *     signal_interface_name,
+                            const char *     signal_name,
+                            GVariant *       parameters,
+                            gpointer         user_data)
+{
+    NMSupplicantInterface *       self            = NM_SUPPLICANT_INTERFACE(user_data);
+    NMSupplicantInterfacePrivate *priv            = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    nm_auto_ref_string NMRefString *peer_path     = NULL;
+    gs_unref_variant GVariant *changed_properties = NULL;
+    NMSupplicantPeerInfo *     peer_info;
+
+    if (!g_variant_is_of_type(parameters, G_VARIANT_TYPE("(sa{sv}as)")))
+        return;
+
+    peer_path = nm_ref_string_new(object_path);
+
+    peer_info = g_hash_table_lookup(priv->peer_idx, &peer_path);
+    if (!peer_info)
+        return;
+    if (peer_info->_init_cancellable)
+        return;
+
+    g_variant_get(parameters, "(&s@a{sv}^a&s)", NULL, &changed_properties, NULL);
+    _peer_info_properties_changed(self, peer_info, changed_properties, FALSE);
+}
+
+static void
+_get_all_main_cb(GVariant *result, GError *error, gpointer user_data)
+{
+    gs_unref_variant GVariant *properties = NULL;
+
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    if (result)
+        g_variant_get(result, "(@a{sv})", &properties);
+    _properties_changed(user_data, NM_WPAS_DBUS_IFACE_INTERFACE, properties, TRUE);
+}
+
+static void
+_get_all_p2p_device_cb(GVariant *result, GError *error, gpointer user_data)
+{
+    gs_unref_variant GVariant *properties = NULL;
+
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    if (result)
+        g_variant_get(result, "(@a{sv})", &properties);
+    _properties_changed(user_data, NM_WPAS_DBUS_IFACE_INTERFACE_P2P_DEVICE, properties, TRUE);
+}
+
+static void
+_signal_handle(NMSupplicantInterface *self,
+               const char *           signal_interface_name,
+               const char *           signal_name,
+               GVariant *             parameters)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+    const char *                  path;
+
+    if (nm_streq(signal_interface_name, NM_WPAS_DBUS_IFACE_INTERFACE)) {
+        if (!priv->is_ready_main)
+            return;
+
+        if (nm_streq(signal_name, "BSSAdded")) {
+            if (!g_variant_is_of_type(parameters, G_VARIANT_TYPE("(oa{sv})")))
+                return;
+
+            g_variant_get(parameters, "(&oa{sv})", &path, NULL);
+            _bss_info_add(self, path);
+            return;
+        }
+
+        if (nm_streq(signal_name, "BSSRemoved")) {
+            nm_auto_ref_string NMRefString *bss_path = NULL;
+
+            if (!g_variant_is_of_type(parameters, G_VARIANT_TYPE("(o)")))
+                return;
+
+            g_variant_get(parameters, "(&o)", &path);
+            bss_path = nm_ref_string_new(path);
+            _bss_info_remove(self, &bss_path);
+            return;
+        }
+
+        if (nm_streq(signal_name, "EAP")) {
+            NMSupplicantAuthState auth_state = NM_SUPPLICANT_AUTH_STATE_UNKNOWN;
+            const char *          status;
+            const char *          parameter;
+
+            if (g_variant_is_of_type(parameters, G_VARIANT_TYPE("(ss)")))
+                return;
+
+            g_variant_get(parameters, "(&s&s)", &status, &parameter);
+
+            if (nm_streq(status, "started"))
+                auth_state = NM_SUPPLICANT_AUTH_STATE_STARTED;
+            else if (nm_streq(status, "completion")) {
+                if (nm_streq(parameter, "success"))
+                    auth_state = NM_SUPPLICANT_AUTH_STATE_SUCCESS;
+                else if (nm_streq(parameter, "failure"))
+                    auth_state = NM_SUPPLICANT_AUTH_STATE_FAILURE;
+            }
+
+            /* the state eventually reaches one of started, success or failure
+             * so ignore any other intermediate (unknown) state change. */
+            if (auth_state != NM_SUPPLICANT_AUTH_STATE_UNKNOWN && auth_state != priv->auth_state) {
+                priv->auth_state = auth_state;
+                _notify(self, PROP_AUTH_STATE);
+            }
+            return;
+        }
+
+        return;
+    }
+
+    if (nm_streq(signal_interface_name, NM_WPAS_DBUS_IFACE_INTERFACE_P2P_DEVICE)) {
+        if (!priv->is_ready_p2p_device)
+            return;
+
+        if (nm_streq(signal_name, "DeviceFound")) {
+            if (g_variant_is_of_type(parameters, G_VARIANT_TYPE("(o)"))) {
+                g_variant_get(parameters, "(&o)", &path);
+                _peer_info_add(self, path);
+            }
+            return;
+        }
+
+        if (nm_streq(signal_name, "DeviceLost")) {
+            if (g_variant_is_of_type(parameters, G_VARIANT_TYPE("(o)"))) {
+                nm_auto_ref_string NMRefString *peer_path = NULL;
+
+                g_variant_get(parameters, "(&o)", &path);
+                peer_path = nm_ref_string_new(path);
+                _peer_info_remove(self, &peer_path);
+            }
+            return;
+        }
+
+        if (nm_streq(signal_name, "GroupStarted")) {
+            if (g_variant_is_of_type(parameters, G_VARIANT_TYPE("(a{sv})"))) {
+                gs_unref_variant GVariant *args              = NULL;
+                gs_unref_object NMSupplicantInterface *iface = NULL;
+                const char *                           group_path;
+                const char *                           iface_path;
+
+                g_variant_get(parameters, "(@a{sv})", &args);
+                if (!g_variant_lookup(args, "group_object", "&o", &group_path))
+                    return;
+                if (!g_variant_lookup(args, "interface_object", "&o", &iface_path))
+                    return;
+
+                if (nm_streq(iface_path, priv->object_path->str)) {
+                    _LOGW("P2P: GroupStarted on existing interface");
+                    iface = g_object_ref(self);
+                } else {
+                    iface =
+                        nm_supplicant_manager_create_interface_from_path(priv->supplicant_manager,
+                                                                         iface_path);
+                    if (iface == NULL) {
+                        _LOGW("P2P: Group interface already exists in GroupStarted handler, "
+                              "aborting further processing.");
+                        return;
+                    }
+                }
+
+                /* Signal existence of the (new) interface. */
+                g_signal_emit(self, signals[GROUP_STARTED], 0, iface);
+            }
+            return;
+        }
+
+        if (nm_streq(signal_name, "GroupFinished")) {
+            if (g_variant_is_of_type(parameters, G_VARIANT_TYPE("(a{sv})"))) {
+                gs_unref_variant GVariant *args = NULL;
+                const char *               iface_path;
+
+                g_variant_get(parameters, "(@a{sv})", &args);
+
+                /* TODO: Group finished is called on the management interface!
+                 *       This means the signal consumer will currently need to assume which
+                 *       interface is finishing or it needs to match the object paths.
+                 */
+                if (!g_variant_lookup(args, "interface_object", "&o", &iface_path))
+                    return;
+
+                _LOGD("P2P: GroupFinished signal on interface %s for interface %s",
+                      priv->object_path->str,
+                      iface_path);
+
+                /* Signal group finish interface (on management interface). */
+                g_signal_emit(self, signals[GROUP_FINISHED], 0, iface_path);
+            }
+            return;
+        }
+
+        return;
+    }
+}
+
+static void
+_signal_cb(GDBusConnection *connection,
+           const char *     sender_name,
+           const char *     object_path,
+           const char *     signal_interface_name,
+           const char *     signal_name,
+           GVariant *       parameters,
+           gpointer         user_data)
+{
+    NMSupplicantInterface *       self = user_data;
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    priv->starting_pending_count++;
+    _signal_handle(self, signal_interface_name, signal_name, parameters);
+    priv->starting_pending_count--;
+    _starting_check_ready(self);
+
+    _notify_maybe_scanning(self);
+}
+
+/*****************************************************************************/
+
+gboolean
+nm_supplicant_interface_get_p2p_available(NMSupplicantInterface *self)
+{
+    return NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self)->p2p_capable_cached;
+}
+
+gboolean
+nm_supplicant_interface_get_p2p_group_joined(NMSupplicantInterface *self)
+{
+    return NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self)->p2p_group_joined_cached;
+}
+
+const char *
+nm_supplicant_interface_get_p2p_group_path(NMSupplicantInterface *self)
+{
+    return nm_ref_string_get_str(NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self)->p2p_group_path);
+}
+
+gboolean
+nm_supplicant_interface_get_p2p_group_owner(NMSupplicantInterface *self)
+{
+    return NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self)->p2p_group_owner_cached;
+}
+
+/*****************************************************************************/
+
+static void
+get_property(GObject *object, guint prop_id, GValue *value, GParamSpec *pspec)
+{
+    NMSupplicantInterface *       self = NM_SUPPLICANT_INTERFACE(object);
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    switch (prop_id) {
+    case PROP_SCANNING:
+        g_value_set_boolean(value, nm_supplicant_interface_get_scanning(self));
+        break;
+    case PROP_CURRENT_BSS:
+        g_value_set_string(value,
+                           nm_ref_string_get_str(nm_supplicant_interface_get_current_bss(self)));
+        break;
+    case PROP_P2P_GROUP_JOINED:
+        g_value_set_boolean(value, nm_supplicant_interface_get_p2p_group_joined(self));
+        break;
+    case PROP_P2P_GROUP_PATH:
+        g_value_set_string(value, nm_supplicant_interface_get_p2p_group_path(self));
+        break;
+    case PROP_P2P_GROUP_OWNER:
+        g_value_set_boolean(value, nm_supplicant_interface_get_p2p_group_owner(self));
+        break;
+    case PROP_P2P_AVAILABLE:
+        g_value_set_boolean(value, nm_supplicant_interface_get_p2p_available(self));
+        break;
+    case PROP_AUTH_STATE:
+        g_value_set_uint(value, priv->auth_state);
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
+        break;
+    }
+}
+
+static void
+set_property(GObject *object, guint prop_id, const GValue *value, GParamSpec *pspec)
+{
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(object);
+
+    switch (prop_id) {
+    case PROP_SUPPLICANT_MANAGER:
+        /* construct-only */
+        priv->supplicant_manager = g_object_ref(g_value_get_pointer(value));
+        nm_assert(NM_IS_SUPPLICANT_MANAGER(priv->supplicant_manager));
+
+        priv->dbus_connection =
+            g_object_ref(nm_supplicant_manager_get_dbus_connection(priv->supplicant_manager));
+        nm_assert(G_IS_DBUS_CONNECTION(priv->dbus_connection));
+
+        priv->name_owner =
+            nm_ref_string_ref(nm_supplicant_manager_get_dbus_name_owner(priv->supplicant_manager));
+        nm_assert(NM_IS_REF_STRING(priv->name_owner));
+
+        priv->global_capabilities =
+            nm_supplicant_manager_get_global_capabilities(priv->supplicant_manager);
+        break;
+    case PROP_DBUS_OBJECT_PATH:
+        /* construct-only */
+        priv->object_path = nm_ref_string_ref(g_value_get_pointer(value));
+        nm_assert(NM_IS_REF_STRING(priv->object_path));
+        break;
+    case PROP_IFINDEX:
+        /* construct-only */
+        priv->ifindex = g_value_get_int(value);
+        break;
+    case PROP_DRIVER:
+        /* construct-only */
+        priv->requested_driver = g_value_get_uint(value);
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
+        break;
+    }
+}
+
+/*****************************************************************************/
+
+static void
+nm_supplicant_interface_init(NMSupplicantInterface *self)
+{
+    NMSupplicantInterfacePrivate *priv;
+
+    priv = G_TYPE_INSTANCE_GET_PRIVATE(self,
+                                       NM_TYPE_SUPPLICANT_INTERFACE,
+                                       NMSupplicantInterfacePrivate);
+
+    self->_priv = priv;
+
+    nm_assert(priv->global_capabilities == NM_SUPPL_CAP_MASK_NONE);
+    nm_assert(priv->iface_capabilities == NM_SUPPL_CAP_MASK_NONE);
+
+    priv->state          = NM_SUPPLICANT_INTERFACE_STATE_STARTING;
+    priv->supp_state     = NM_SUPPLICANT_INTERFACE_STATE_INVALID;
+    priv->last_scan_msec = -1;
+
+    c_list_init(&self->supp_lst);
+
+    G_STATIC_ASSERT_EXPR(G_STRUCT_OFFSET(NMSupplicantBssInfo, bss_path) == 0);
+    priv->bss_idx = g_hash_table_new(nm_pdirect_hash, nm_pdirect_equal);
+
+    c_list_init(&priv->bss_lst_head);
+    c_list_init(&priv->bss_initializing_lst_head);
+
+    G_STATIC_ASSERT_EXPR(G_STRUCT_OFFSET(NMSupplicantPeerInfo, peer_path) == 0);
+    priv->peer_idx = g_hash_table_new(nm_pdirect_hash, nm_pdirect_equal);
+
+    c_list_init(&priv->peer_lst_head);
+    c_list_init(&priv->peer_initializing_lst_head);
+
+    priv->main_cancellable = g_cancellable_new();
+}
+
+static void
+constructed(GObject *object)
+{
+    NMSupplicantInterface *       self = NM_SUPPLICANT_INTERFACE(object);
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    G_OBJECT_CLASS(nm_supplicant_interface_parent_class)->constructed(object);
+
+    _LOGD("new supplicant interface %s on %s", priv->object_path->str, priv->name_owner->str);
+
+    priv->properties_changed_id =
+        nm_dbus_connection_signal_subscribe_properties_changed(priv->dbus_connection,
+                                                               priv->name_owner->str,
+                                                               priv->object_path->str,
+                                                               NULL,
+                                                               _properties_changed_cb,
+                                                               self,
+                                                               NULL);
+
+    priv->bss_properties_changed_id =
+        nm_dbus_connection_signal_subscribe_properties_changed(priv->dbus_connection,
+                                                               priv->name_owner->str,
+                                                               NULL,
+                                                               NM_WPAS_DBUS_IFACE_BSS,
+                                                               _bss_properties_changed_cb,
+                                                               self,
+                                                               NULL);
+
+    priv->signal_id = g_dbus_connection_signal_subscribe(priv->dbus_connection,
+                                                         priv->name_owner->str,
+                                                         NULL,
+                                                         NULL,
+                                                         priv->object_path->str,
+                                                         NULL,
+                                                         G_DBUS_SIGNAL_FLAGS_NONE,
+                                                         _signal_cb,
+                                                         self,
+                                                         NULL);
+
+    /* Scan result aging parameters */
+    nm_dbus_connection_call_set(priv->dbus_connection,
+                                priv->name_owner->str,
+                                priv->object_path->str,
+                                NM_WPAS_DBUS_IFACE_INTERFACE,
+                                "BSSExpireAge",
+                                g_variant_new_uint32(250),
+                                DBUS_TIMEOUT_MSEC,
+                                NULL,
+                                NULL,
+                                NULL);
+    nm_dbus_connection_call_set(priv->dbus_connection,
+                                priv->name_owner->str,
+                                priv->object_path->str,
+                                NM_WPAS_DBUS_IFACE_INTERFACE,
+                                "BSSExpireCount",
+                                g_variant_new_uint32(2),
+                                DBUS_TIMEOUT_MSEC,
+                                NULL,
+                                NULL,
+                                NULL);
+
+    if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF) == NM_TERNARY_TRUE) {
+        /* Initialize global PMF setting to 'optional' */
+        nm_dbus_connection_call_set(priv->dbus_connection,
+                                    priv->name_owner->str,
+                                    priv->object_path->str,
+                                    NM_WPAS_DBUS_IFACE_INTERFACE,
+                                    "Pmf",
+                                    g_variant_new_string("1"),
+                                    DBUS_TIMEOUT_MSEC,
+                                    NULL,
+                                    NULL,
+                                    NULL);
+    }
+
+    if (_get_capability(priv, NM_SUPPL_CAP_TYPE_AP) == NM_TERNARY_DEFAULT) {
+        /* If the global supplicant capabilities property is not present, we can
+         * fall back to checking whether the ProbeRequest method is supported.  If
+         * neither of these works we have no way of determining if AP mode is
+         * supported or not.  hostap 1.0 and earlier don't support either of these.
+         */
+        priv->starting_pending_count++;
+        _dbus_connection_call(self,
+                              DBUS_INTERFACE_INTROSPECTABLE,
+                              "Introspect",
+                              NULL,
+                              G_VARIANT_TYPE("(s)"),
+                              G_DBUS_CALL_FLAGS_NONE,
+                              5000,
+                              priv->main_cancellable,
+                              iface_introspect_cb,
+                              self);
+    }
+
+    priv->starting_pending_count++;
+    nm_dbus_connection_call_get_all(priv->dbus_connection,
+                                    priv->name_owner->str,
+                                    priv->object_path->str,
+                                    NM_WPAS_DBUS_IFACE_INTERFACE,
+                                    5000,
+                                    priv->main_cancellable,
+                                    _get_all_main_cb,
+                                    self);
+
+    if (_get_capability(priv, NM_SUPPL_CAP_TYPE_P2P) == NM_TERNARY_TRUE) {
+        priv->peer_properties_changed_id =
+            nm_dbus_connection_signal_subscribe_properties_changed(priv->dbus_connection,
+                                                                   priv->name_owner->str,
+                                                                   NULL,
+                                                                   NM_WPAS_DBUS_IFACE_PEER,
+                                                                   _peer_properties_changed_cb,
+                                                                   self,
+                                                                   NULL);
+
+        priv->starting_pending_count++;
+        nm_dbus_connection_call_get_all(priv->dbus_connection,
+                                        priv->name_owner->str,
+                                        priv->object_path->str,
+                                        NM_WPAS_DBUS_IFACE_INTERFACE_P2P_DEVICE,
+                                        5000,
+                                        priv->main_cancellable,
+                                        _get_all_p2p_device_cb,
+                                        self);
+    }
+}
+
+NMSupplicantInterface *
+nm_supplicant_interface_new(NMSupplicantManager *supplicant_manager,
+                            NMRefString *        object_path,
+                            int                  ifindex,
+                            NMSupplicantDriver   driver)
+{
+    nm_assert(NM_IS_SUPPLICANT_MANAGER(supplicant_manager));
+
+    return g_object_new(NM_TYPE_SUPPLICANT_INTERFACE,
+                        NM_SUPPLICANT_INTERFACE_SUPPLICANT_MANAGER,
+                        supplicant_manager,
+                        NM_SUPPLICANT_INTERFACE_DBUS_OBJECT_PATH,
+                        object_path,
+                        NM_SUPPLICANT_INTERFACE_IFINDEX,
+                        ifindex,
+                        NM_SUPPLICANT_INTERFACE_DRIVER,
+                        (guint) driver,
+                        NULL);
+}
+
+static void
+dispose(GObject *object)
+{
+    NMSupplicantInterface *       self = NM_SUPPLICANT_INTERFACE(object);
+    NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
+
+    if (priv->state != NM_SUPPLICANT_INTERFACE_STATE_DOWN)
+        set_state_down(self, TRUE, "NMSupplicantInterface is disposing");
+
+    nm_assert(c_list_is_empty(&self->supp_lst));
+
+    if (priv->wps_data) {
+        /* we shut down, but an asynchronous Cancel request is pending.
+         * We don't want to cancel it, so mark wps-data that @self is gone.
+         * This way, _wps_handle_cancel_cb() knows it must no longer touch
+         * @self */
+        priv->wps_data->self = NULL;
+        priv->wps_data       = NULL;
+    }
+
+    nm_assert(!priv->assoc_data);
+
+    nm_clear_pointer(&priv->bss_idx, g_hash_table_destroy);
+    nm_clear_pointer(&priv->peer_idx, g_hash_table_destroy);
+
+    nm_clear_pointer(&priv->current_bss, nm_ref_string_unref);
+
+    G_OBJECT_CLASS(nm_supplicant_interface_parent_class)->dispose(object);
+
+    nm_clear_pointer(&priv->object_path, nm_ref_string_unref);
+    nm_clear_pointer(&priv->name_owner, nm_ref_string_unref);
+    g_clear_object(&priv->supplicant_manager);
+    g_clear_object(&priv->dbus_connection);
+    nm_clear_g_free(&priv->ifname);
+    nm_clear_g_free(&priv->driver);
+    nm_assert(!priv->net_path);
+}
+
+static void
+nm_supplicant_interface_class_init(NMSupplicantInterfaceClass *klass)
+{
+    GObjectClass *object_class = G_OBJECT_CLASS(klass);
+
+    g_type_class_add_private(object_class, sizeof(NMSupplicantInterfacePrivate));
+
+    object_class->constructed  = constructed;
+    object_class->dispose      = dispose;
+    object_class->set_property = set_property;
+    object_class->get_property = get_property;
+
+    obj_properties[PROP_SUPPLICANT_MANAGER] =
+        g_param_spec_pointer(NM_SUPPLICANT_INTERFACE_SUPPLICANT_MANAGER,
+                             "",
+                             "",
+                             G_PARAM_WRITABLE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS);
+    obj_properties[PROP_DBUS_OBJECT_PATH] =
+        g_param_spec_pointer(NM_SUPPLICANT_INTERFACE_DBUS_OBJECT_PATH,
+                             "",
+                             "",
+                             G_PARAM_WRITABLE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS);
+    obj_properties[PROP_IFINDEX] =
+        g_param_spec_int(NM_SUPPLICANT_INTERFACE_IFINDEX,
+                         "",
+                         "",
+                         0,
+                         G_MAXINT,
+                         0,
+                         G_PARAM_WRITABLE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS);
+    obj_properties[PROP_DRIVER] =
+        g_param_spec_uint(NM_SUPPLICANT_INTERFACE_DRIVER,
+                          "",
+                          "",
+                          0,
+                          G_MAXUINT,
+                          NM_SUPPLICANT_DRIVER_WIRELESS,
+                          G_PARAM_WRITABLE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS);
+
+    obj_properties[PROP_SCANNING] = g_param_spec_boolean(NM_SUPPLICANT_INTERFACE_SCANNING,
+                                                         "",
+                                                         "",
+                                                         FALSE,
+                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+    obj_properties[PROP_CURRENT_BSS] =
+        g_param_spec_string(NM_SUPPLICANT_INTERFACE_CURRENT_BSS,
+                            "",
+                            "",
+                            NULL,
+                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+    obj_properties[PROP_P2P_GROUP_JOINED] =
+        g_param_spec_boolean(NM_SUPPLICANT_INTERFACE_P2P_GROUP_JOINED,
+                             "",
+                             "",
+                             FALSE,
+                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+    obj_properties[PROP_P2P_GROUP_PATH] =
+        g_param_spec_string(NM_SUPPLICANT_INTERFACE_P2P_GROUP_PATH,
+                            "",
+                            "",
+                            NULL,
+                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+    obj_properties[PROP_P2P_GROUP_OWNER] =
+        g_param_spec_boolean(NM_SUPPLICANT_INTERFACE_P2P_GROUP_OWNER,
+                             "",
+                             "",
+                             FALSE,
+                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+    obj_properties[PROP_P2P_AVAILABLE] =
+        g_param_spec_boolean(NM_SUPPLICANT_INTERFACE_P2P_AVAILABLE,
+                             "",
+                             "",
+                             FALSE,
+                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+    obj_properties[PROP_AUTH_STATE] = g_param_spec_uint(NM_SUPPLICANT_INTERFACE_AUTH_STATE,
+                                                        "",
+                                                        "",
+                                                        NM_SUPPLICANT_AUTH_STATE_UNKNOWN,
+                                                        _NM_SUPPLICANT_AUTH_STATE_NUM - 1,
+                                                        NM_SUPPLICANT_AUTH_STATE_UNKNOWN,
+                                                        G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+
+    g_object_class_install_properties(object_class, _PROPERTY_ENUMS_LAST, obj_properties);
+
+    signals[STATE] = g_signal_new(NM_SUPPLICANT_INTERFACE_STATE,
+                                  G_OBJECT_CLASS_TYPE(object_class),
+                                  G_SIGNAL_RUN_LAST,
+                                  0,
+                                  NULL,
+                                  NULL,
+                                  NULL,
+                                  G_TYPE_NONE,
+                                  3,
+                                  G_TYPE_INT,
+                                  G_TYPE_INT,
+                                  G_TYPE_INT);
+
+    signals[BSS_CHANGED] = g_signal_new(NM_SUPPLICANT_INTERFACE_BSS_CHANGED,
+                                        G_OBJECT_CLASS_TYPE(object_class),
+                                        G_SIGNAL_RUN_LAST,
+                                        0,
+                                        NULL,
+                                        NULL,
+                                        NULL,
+                                        G_TYPE_NONE,
+                                        2,
+                                        G_TYPE_POINTER,
+                                        G_TYPE_BOOLEAN);
+
+    signals[PEER_CHANGED] = g_signal_new(NM_SUPPLICANT_INTERFACE_PEER_CHANGED,
+                                         G_OBJECT_CLASS_TYPE(object_class),
+                                         G_SIGNAL_RUN_LAST,
+                                         0,
+                                         NULL,
+                                         NULL,
+                                         NULL,
+                                         G_TYPE_NONE,
+                                         2,
+                                         G_TYPE_POINTER,
+                                         G_TYPE_BOOLEAN);
+
+    signals[WPS_CREDENTIALS] = g_signal_new(NM_SUPPLICANT_INTERFACE_WPS_CREDENTIALS,
+                                            G_OBJECT_CLASS_TYPE(object_class),
+                                            G_SIGNAL_RUN_LAST,
+                                            0,
+                                            NULL,
+                                            NULL,
+                                            NULL,
+                                            G_TYPE_NONE,
+                                            1,
+                                            G_TYPE_VARIANT);
+
+    signals[GROUP_STARTED] = g_signal_new(NM_SUPPLICANT_INTERFACE_GROUP_STARTED,
+                                          G_OBJECT_CLASS_TYPE(object_class),
+                                          G_SIGNAL_RUN_LAST,
+                                          0,
+                                          NULL,
+                                          NULL,
+                                          NULL,
+                                          G_TYPE_NONE,
+                                          1,
+                                          NM_TYPE_SUPPLICANT_INTERFACE);
+
+    signals[GROUP_FINISHED] = g_signal_new(NM_SUPPLICANT_INTERFACE_GROUP_FINISHED,
+                                           G_OBJECT_CLASS_TYPE(object_class),
+                                           G_SIGNAL_RUN_LAST,
+                                           0,
+                                           NULL,
+                                           NULL,
+                                           NULL,
+                                           G_TYPE_NONE,
+                                           1,
+                                           G_TYPE_STRING);
+}
diff --git a/src/core/supplicant/nm-supplicant-interface.h b/src/core/supplicant/nm-supplicant-interface.h
new file mode 100644
index 00000000..a62eeb62
--- /dev/null
+++ b/src/core/supplicant/nm-supplicant-interface.h
@@ -0,0 +1,195 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2006 - 2017 Red Hat, Inc.
+ * Copyright (C) 2007 - 2008 Novell, Inc.
+ */
+
+#ifndef __NM_SUPPLICANT_INTERFACE_H__
+#define __NM_SUPPLICANT_INTERFACE_H__
+
+#include "nm-supplicant-types.h"
+
+#include "c-list/src/c-list.h"
+
+/*
+ * Supplicant interface states
+ *   A mix of wpa_supplicant interface states and internal states.
+ */
+typedef enum {
+    NM_SUPPLICANT_INTERFACE_STATE_INVALID = 0,
+
+    NM_SUPPLICANT_INTERFACE_STATE_STARTING = 1,
+
+    NM_SUPPLICANT_INTERFACE_STATE_DISABLED,
+    NM_SUPPLICANT_INTERFACE_STATE_DISCONNECTED,
+    NM_SUPPLICANT_INTERFACE_STATE_INACTIVE,
+    NM_SUPPLICANT_INTERFACE_STATE_SCANNING,
+    NM_SUPPLICANT_INTERFACE_STATE_AUTHENTICATING,
+    NM_SUPPLICANT_INTERFACE_STATE_ASSOCIATING,
+    NM_SUPPLICANT_INTERFACE_STATE_ASSOCIATED,
+    NM_SUPPLICANT_INTERFACE_STATE_4WAY_HANDSHAKE,
+    NM_SUPPLICANT_INTERFACE_STATE_GROUP_HANDSHAKE,
+    NM_SUPPLICANT_INTERFACE_STATE_COMPLETED,
+
+    NM_SUPPLICANT_INTERFACE_STATE_DOWN,
+} NMSupplicantInterfaceState;
+
+static inline gboolean
+nm_supplicant_interface_state_is_operational(NMSupplicantInterfaceState state)
+{
+    return state > NM_SUPPLICANT_INTERFACE_STATE_STARTING
+           && state < NM_SUPPLICANT_INTERFACE_STATE_DOWN;
+}
+
+static inline gboolean
+nm_supplicant_interface_state_is_associated(NMSupplicantInterfaceState state)
+{
+    return state >= NM_SUPPLICANT_INTERFACE_STATE_AUTHENTICATING
+           && state <= NM_SUPPLICANT_INTERFACE_STATE_COMPLETED;
+}
+
+typedef enum {
+    NM_SUPPLICANT_AUTH_STATE_UNKNOWN,
+    NM_SUPPLICANT_AUTH_STATE_STARTED,
+    NM_SUPPLICANT_AUTH_STATE_SUCCESS,
+    NM_SUPPLICANT_AUTH_STATE_FAILURE,
+    _NM_SUPPLICANT_AUTH_STATE_NUM,
+} NMSupplicantAuthState;
+
+#define NM_TYPE_SUPPLICANT_INTERFACE (nm_supplicant_interface_get_type())
+#define NM_SUPPLICANT_INTERFACE(obj) \
+    (G_TYPE_CHECK_INSTANCE_CAST((obj), NM_TYPE_SUPPLICANT_INTERFACE, NMSupplicantInterface))
+#define NM_SUPPLICANT_INTERFACE_CLASS(klass) \
+    (G_TYPE_CHECK_CLASS_CAST((klass), NM_TYPE_SUPPLICANT_INTERFACE, NMSupplicantInterfaceClass))
+#define NM_IS_SUPPLICANT_INTERFACE(obj) \
+    (G_TYPE_CHECK_INSTANCE_TYPE((obj), NM_TYPE_SUPPLICANT_INTERFACE))
+#define NM_IS_SUPPLICANT_INTERFACE_CLASS(klass) \
+    (G_TYPE_CHECK_CLASS_TYPE((klass), NM_TYPE_SUPPLICANT_INTERFACE))
+#define NM_SUPPLICANT_INTERFACE_GET_CLASS(obj) \
+    (G_TYPE_INSTANCE_GET_CLASS((obj), NM_TYPE_SUPPLICANT_INTERFACE, NMSupplicantInterfaceClass))
+
+#define NM_SUPPLICANT_INTERFACE_SUPPLICANT_MANAGER "supplicant-manager"
+#define NM_SUPPLICANT_INTERFACE_DBUS_OBJECT_PATH   "dbus-object-path"
+#define NM_SUPPLICANT_INTERFACE_IFINDEX            "ifindex"
+#define NM_SUPPLICANT_INTERFACE_SCANNING           "scanning"
+#define NM_SUPPLICANT_INTERFACE_CURRENT_BSS        "current-bss"
+#define NM_SUPPLICANT_INTERFACE_P2P_GROUP_JOINED   "p2p-group-joined"
+#define NM_SUPPLICANT_INTERFACE_P2P_GROUP_PATH     "p2p-group-path"
+#define NM_SUPPLICANT_INTERFACE_P2P_GROUP_OWNER    "p2p-group-owner"
+#define NM_SUPPLICANT_INTERFACE_DRIVER             "driver"
+#define NM_SUPPLICANT_INTERFACE_P2P_AVAILABLE      "p2p-available"
+#define NM_SUPPLICANT_INTERFACE_AUTH_STATE         "auth-state"
+
+#define NM_SUPPLICANT_INTERFACE_STATE           "state"
+#define NM_SUPPLICANT_INTERFACE_BSS_CHANGED     "bss-changed"
+#define NM_SUPPLICANT_INTERFACE_PEER_CHANGED    "peer-changed"
+#define NM_SUPPLICANT_INTERFACE_WPS_CREDENTIALS "wps-credentials"
+#define NM_SUPPLICANT_INTERFACE_GROUP_STARTED   "group-started"
+#define NM_SUPPLICANT_INTERFACE_GROUP_FINISHED  "group-finished"
+
+typedef struct _NMSupplicantInterfaceClass NMSupplicantInterfaceClass;
+
+struct _NMSupplicantInterfacePrivate;
+
+struct _NMSupplicantInterface {
+    GObject                               parent;
+    CList                                 supp_lst;
+    struct _NMSupplicantInterfacePrivate *_priv;
+};
+
+GType nm_supplicant_interface_get_type(void);
+
+NMSupplicantInterface *nm_supplicant_interface_new(NMSupplicantManager *supplicant_manager,
+                                                   NMRefString *        object_path,
+                                                   int                  ifindex,
+                                                   NMSupplicantDriver   driver);
+
+NMRefString *nm_supplicant_interface_get_name_owner(NMSupplicantInterface *self);
+NMRefString *nm_supplicant_interface_get_object_path(NMSupplicantInterface *iface);
+
+void _nm_supplicant_interface_set_state_down(NMSupplicantInterface *self,
+                                             gboolean               force_remove_from_supplicant,
+                                             const char *           reason);
+
+typedef void (*NMSupplicantInterfaceAssocCb)(NMSupplicantInterface *iface,
+                                             GError *               error,
+                                             gpointer               user_data);
+
+void nm_supplicant_interface_assoc(NMSupplicantInterface *      self,
+                                   NMSupplicantConfig *         cfg,
+                                   NMSupplicantInterfaceAssocCb callback,
+                                   gpointer                     user_data);
+
+void nm_supplicant_interface_disconnect(NMSupplicantInterface *iface);
+
+typedef void (*NMSupplicantInterfaceDisconnectCb)(NMSupplicantInterface *iface,
+                                                  GError *               error,
+                                                  gpointer               user_data);
+
+void nm_supplicant_interface_disconnect_async(NMSupplicantInterface *           self,
+                                              GCancellable *                    cancellable,
+                                              NMSupplicantInterfaceDisconnectCb callback,
+                                              gpointer                          user_data);
+
+typedef void (*NMSupplicantInterfaceRequestScanCallback)(NMSupplicantInterface *self,
+                                                         GCancellable *         cancellable,
+                                                         gpointer               user_data);
+
+void nm_supplicant_interface_request_scan(NMSupplicantInterface *                  self,
+                                          GBytes *const *                          ssids,
+                                          guint                                    ssids_len,
+                                          GCancellable *                           cancellable,
+                                          NMSupplicantInterfaceRequestScanCallback callback,
+                                          gpointer                                 user_data);
+
+NMSupplicantInterfaceState nm_supplicant_interface_get_state(NMSupplicantInterface *self);
+
+const char *nm_supplicant_interface_state_to_string(NMSupplicantInterfaceState state);
+
+gboolean nm_supplicant_interface_get_scanning(NMSupplicantInterface *self);
+
+NMRefString *nm_supplicant_interface_get_current_bss(NMSupplicantInterface *self);
+
+gint64 nm_supplicant_interface_get_last_scan(NMSupplicantInterface *self);
+
+const char *nm_supplicant_interface_get_ifname(NMSupplicantInterface *self);
+
+guint nm_supplicant_interface_get_max_scan_ssids(NMSupplicantInterface *self);
+
+gboolean nm_supplicant_interface_get_p2p_available(NMSupplicantInterface *self);
+
+gboolean nm_supplicant_interface_get_p2p_group_joined(NMSupplicantInterface *self);
+
+const char *nm_supplicant_interface_get_p2p_group_path(NMSupplicantInterface *self);
+
+gboolean nm_supplicant_interface_get_p2p_group_owner(NMSupplicantInterface *self);
+
+void nm_supplicant_interface_p2p_start_find(NMSupplicantInterface *self, guint timeout);
+void nm_supplicant_interface_p2p_stop_find(NMSupplicantInterface *self);
+
+void nm_supplicant_interface_p2p_connect(NMSupplicantInterface *self,
+                                         const char *           peer,
+                                         const char *           wps_method,
+                                         const char *           wps_pin);
+void nm_supplicant_interface_p2p_cancel_connect(NMSupplicantInterface *self);
+void nm_supplicant_interface_p2p_disconnect(NMSupplicantInterface *self);
+
+void nm_supplicant_interface_set_global_capabilities(NMSupplicantInterface *self,
+                                                     NMSupplCapMask         value);
+
+NMTernary nm_supplicant_interface_get_capability(NMSupplicantInterface *self, NMSupplCapType type);
+
+NMSupplCapMask nm_supplicant_interface_get_capabilities(NMSupplicantInterface *self);
+
+void nm_supplicant_interface_enroll_wps(NMSupplicantInterface *self,
+                                        const char *const      type,
+                                        const char *           bssid,
+                                        const char *           pin);
+
+void nm_supplicant_interface_cancel_wps(NMSupplicantInterface *self);
+
+NMSupplicantAuthState nm_supplicant_interface_get_auth_state(NMSupplicantInterface *self);
+
+void nm_supplicant_interface_set_bridge(NMSupplicantInterface *self, const char *bridge);
+
+#endif /* __NM_SUPPLICANT_INTERFACE_H__ */
diff --git a/src/core/supplicant/nm-supplicant-manager.c b/src/core/supplicant/nm-supplicant-manager.c
new file mode 100644
index 00000000..32554187
--- /dev/null
+++ b/src/core/supplicant/nm-supplicant-manager.c
@@ -0,0 +1,1358 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2006 - 2010 Red Hat, Inc.
+ * Copyright (C) 2007 - 2008 Novell, Inc.
+ */
+
+#include "src/core/nm-default-daemon.h"
+
+#include "nm-supplicant-manager.h"
+
+#include "nm-core-internal.h"
+#include "nm-dbus-manager.h"
+#include "nm-glib-aux/nm-dbus-aux.h"
+#include "nm-glib-aux/nm-ref-string.h"
+#include "nm-supplicant-interface.h"
+#include "nm-supplicant-types.h"
+#include "platform/nm-platform.h"
+
+/*****************************************************************************/
+
+#define CREATE_IFACE_TRY_COUNT_MAX 7u
+
+struct _NMSupplMgrCreateIfaceHandle {
+    NMSupplicantManager *                self;
+    CList                                create_iface_lst;
+    GCancellable *                       cancellable;
+    NMSupplicantManagerCreateInterfaceCb callback;
+    gpointer                             callback_user_data;
+    NMShutdownWaitObjHandle *            shutdown_handle;
+    NMRefString *                        name_owner;
+    GError *                             fail_on_idle_error;
+    NMSupplicantDriver                   driver;
+    int                                  ifindex;
+    guint                                fail_on_idle_id;
+    guint                                create_iface_try_count : 5;
+};
+
+enum {
+    AVAILABLE_CHANGED,
+    LAST_SIGNAL,
+};
+
+static guint signals[LAST_SIGNAL] = {0};
+
+typedef struct {
+    GDBusConnection *dbus_connection;
+
+    NMRefString *name_owner;
+
+    GCancellable *get_name_owner_cancellable;
+    GCancellable *get_capabilities_cancellable;
+    GCancellable *poke_name_owner_cancellable;
+
+    GHashTable *supp_ifaces;
+    CList       supp_lst_head;
+
+    CList create_iface_lst_head;
+
+    NMSupplCapMask capabilities;
+
+    guint name_owner_changed_id;
+    guint interface_removed_id;
+    guint poke_name_owner_timeout_id;
+    guint available_reset_id;
+
+    /* see nm_supplicant_manager_get_available(). */
+    NMTernary available : 2;
+
+} NMSupplicantManagerPrivate;
+
+struct _NMSupplicantManager {
+    GObject                    parent;
+    NMSupplicantManagerPrivate _priv;
+};
+
+struct _NMSupplicantManagerClass {
+    GObjectClass parent;
+};
+
+G_DEFINE_TYPE(NMSupplicantManager, nm_supplicant_manager, G_TYPE_OBJECT)
+
+#define NM_SUPPLICANT_MANAGER_GET_PRIVATE(self) \
+    _NM_GET_PRIVATE(self, NMSupplicantManager, NM_IS_SUPPLICANT_MANAGER)
+
+NM_DEFINE_SINGLETON_GETTER(NMSupplicantManager,
+                           nm_supplicant_manager_get,
+                           NM_TYPE_SUPPLICANT_MANAGER);
+
+/*****************************************************************************/
+
+#define _NMLOG_DOMAIN      LOGD_SUPPLICANT
+#define _NMLOG(level, ...) __NMLOG_DEFAULT(level, _NMLOG_DOMAIN, "supplicant", __VA_ARGS__)
+
+/*****************************************************************************/
+
+NM_CACHED_QUARK_FCN("nm-supplicant-error-quark", nm_supplicant_error_quark);
+
+/*****************************************************************************/
+
+static void     _create_iface_proceed_all(NMSupplicantManager *self, GError *error);
+static void     _supp_iface_add(NMSupplicantManager *  self,
+                                NMRefString *          iface_path,
+                                NMSupplicantInterface *supp_iface);
+static void     _supp_iface_remove_one(NMSupplicantManager *  self,
+                                       NMSupplicantInterface *supp_iface,
+                                       gboolean               force_remove_from_supplicant,
+                                       const char *           reason);
+static void     _create_iface_dbus_call_get_interface(NMSupplicantManager *        self,
+                                                      NMSupplMgrCreateIfaceHandle *handle,
+                                                      const char *                 ifname);
+static void     _create_iface_dbus_call_create_interface(NMSupplicantManager *        self,
+                                                         NMSupplMgrCreateIfaceHandle *handle,
+                                                         const char *                 ifname);
+static gboolean _create_iface_fail_on_idle_cb(gpointer user_data);
+
+static gboolean _available_reset_cb(gpointer user_data);
+
+/*****************************************************************************/
+
+NM_UTILS_LOOKUP_STR_DEFINE(nm_supplicant_driver_to_string,
+                           NMSupplicantDriver,
+                           NM_UTILS_LOOKUP_DEFAULT_WARN(NULL),
+                           NM_UTILS_LOOKUP_ITEM(NM_SUPPLICANT_DRIVER_UNKNOWN, "???"),
+                           NM_UTILS_LOOKUP_ITEM(NM_SUPPLICANT_DRIVER_WIRELESS,
+                                                NM_WPAS_DEFAULT_WIFI_DRIVER),
+                           NM_UTILS_LOOKUP_ITEM(NM_SUPPLICANT_DRIVER_WIRED, "wired"),
+                           NM_UTILS_LOOKUP_ITEM(NM_SUPPLICANT_DRIVER_MACSEC, "macsec_linux"), );
+
+/*****************************************************************************/
+
+NMTernary
+nm_supplicant_manager_is_available(NMSupplicantManager *self)
+{
+    g_return_val_if_fail(NM_IS_SUPPLICANT_MANAGER(self), NM_TERNARY_FALSE);
+
+    return NM_SUPPLICANT_MANAGER_GET_PRIVATE(self)->available;
+}
+
+NMRefString *
+nm_supplicant_manager_get_dbus_name_owner(NMSupplicantManager *self)
+{
+    g_return_val_if_fail(NM_IS_SUPPLICANT_MANAGER(self), NULL);
+
+    return NM_SUPPLICANT_MANAGER_GET_PRIVATE(self)->name_owner;
+}
+
+GDBusConnection *
+nm_supplicant_manager_get_dbus_connection(NMSupplicantManager *self)
+{
+    g_return_val_if_fail(NM_IS_SUPPLICANT_MANAGER(self), NULL);
+
+    return NM_SUPPLICANT_MANAGER_GET_PRIVATE(self)->dbus_connection;
+}
+
+NMSupplCapMask
+nm_supplicant_manager_get_global_capabilities(NMSupplicantManager *self)
+{
+    g_return_val_if_fail(NM_IS_SUPPLICANT_MANAGER(self), NM_SUPPL_CAP_MASK_NONE);
+
+    return NM_SUPPLICANT_MANAGER_GET_PRIVATE(self)->capabilities;
+}
+
+/*****************************************************************************/
+
+static void
+_caps_set(NMSupplicantManagerPrivate *priv, NMSupplCapType type, NMTernary value)
+{
+    priv->capabilities = NM_SUPPL_CAP_MASK_SET(priv->capabilities, type, value);
+}
+
+static char
+_caps_to_char(NMSupplicantManagerPrivate *priv, NMSupplCapType type)
+{
+    NMTernary val;
+
+    val = NM_SUPPL_CAP_MASK_GET(priv->capabilities, type);
+    if (val == NM_TERNARY_TRUE)
+        return '+';
+    if (val == NM_TERNARY_FALSE)
+        return '-';
+    return '?';
+}
+
+/*****************************************************************************/
+
+static void
+_dbus_call_remove_interface(GDBusConnection *dbus_connection,
+                            const char *     name_owner,
+                            const char *     iface_path)
+{
+    nm_assert(G_IS_DBUS_CONNECTION(dbus_connection));
+    nm_assert(name_owner);
+    nm_assert(iface_path);
+
+    g_dbus_connection_call(dbus_connection,
+                           name_owner,
+                           NM_WPAS_DBUS_PATH,
+                           NM_WPAS_DBUS_INTERFACE,
+                           "RemoveInterface",
+                           g_variant_new("(o)", iface_path),
+                           G_VARIANT_TYPE("()"),
+                           G_DBUS_CALL_FLAGS_NO_AUTO_START,
+                           10000,
+                           NULL,
+                           NULL,
+                           NULL);
+}
+
+void
+_nm_supplicant_manager_dbus_call_remove_interface(NMSupplicantManager *self,
+                                                  const char *         name_owner,
+                                                  const char *         iface_path)
+{
+    _dbus_call_remove_interface(NM_SUPPLICANT_MANAGER_GET_PRIVATE(self)->dbus_connection,
+                                name_owner,
+                                iface_path);
+}
+
+/*****************************************************************************/
+
+static void
+on_supplicant_wfd_ies_set(GObject *source_object, GAsyncResult *result, gpointer user_data)
+{
+    gs_unref_variant GVariant *res = NULL;
+    gs_free_error GError *error    = NULL;
+
+    res = g_dbus_connection_call_finish(G_DBUS_CONNECTION(source_object), result, &error);
+    if (!res)
+        _LOGD("failed to set WFD IEs on wpa_supplicant: %s", error->message);
+}
+
+/**
+ * nm_supplicant_manager_set_wfd_ies:
+ * @self: the #NMSupplicantManager
+ * @wfd_ies: a #GBytes with the WFD IEs or %NULL
+ *
+ * This function sets the global WFD IEs on wpa_supplicant. Note that
+ * it would make more sense if this was per-device, but wpa_supplicant
+ * simply does not work that way.
+ * */
+void
+nm_supplicant_manager_set_wfd_ies(NMSupplicantManager *self, GBytes *wfd_ies)
+{
+    NMSupplicantManagerPrivate *priv;
+    GVariantBuilder             params;
+
+    g_return_if_fail(NM_IS_SUPPLICANT_MANAGER(self));
+
+    priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+
+    if (!priv->name_owner)
+        return;
+
+    _LOGD("setting WFD IEs for P2P operation on %s", priv->name_owner->str);
+
+    g_variant_builder_init(&params, G_VARIANT_TYPE("(ssv)"));
+
+    g_variant_builder_add(&params, "s", NM_WPAS_DBUS_INTERFACE);
+    g_variant_builder_add(&params, "s", "WFDIEs");
+    g_variant_builder_add_value(&params,
+                                g_variant_new_variant(nm_utils_gbytes_to_variant_ay(wfd_ies)));
+
+    g_dbus_connection_call(priv->dbus_connection,
+                           priv->name_owner->str,
+                           NM_WPAS_DBUS_PATH,
+                           DBUS_INTERFACE_PROPERTIES,
+                           "Set",
+                           g_variant_builder_end(&params),
+                           G_VARIANT_TYPE("()"),
+                           G_DBUS_CALL_FLAGS_NO_AUTO_START,
+                           3000,
+                           NULL,
+                           on_supplicant_wfd_ies_set,
+                           NULL);
+}
+
+/*****************************************************************************/
+
+static gboolean
+_poke_name_owner_timeout_cb(gpointer user_data)
+{
+    NMSupplicantManager *       self        = user_data;
+    NMSupplicantManagerPrivate *priv        = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+    gs_free_error GError *error             = NULL;
+    gboolean              available_changed = FALSE;
+
+    nm_assert(!priv->name_owner);
+
+    priv->poke_name_owner_timeout_id = 0;
+    nm_clear_g_cancellable(&priv->poke_name_owner_cancellable);
+
+    _LOGT("poke service \"%s\" failed for good with timeout%s",
+          NM_WPAS_DBUS_SERVICE,
+          (priv->available == NM_TERNARY_DEFAULT) ? " (set as not available)" : "");
+
+    if (priv->available == NM_TERNARY_DEFAULT) {
+        /* the available flag usually only changes together with the name-owner.
+         * However, if we tries to poke the service but failed to start it (with
+         * timeout), was also set it as (hard) not available. */
+        priv->available = NM_TERNARY_FALSE;
+        nm_clear_g_source(&priv->available_reset_id);
+        priv->available_reset_id = g_timeout_add_seconds(60, _available_reset_cb, self);
+        available_changed        = TRUE;
+    }
+
+    nm_utils_error_set(&error,
+                       NM_UTILS_ERROR_UNKNOWN,
+                       "Failed to D-Bus activate wpa_supplicant service");
+
+    _create_iface_proceed_all(self, error);
+
+    if (available_changed) {
+        /* We delay the emitting of the notification after aborting all
+         * create-iface handles. */
+        g_signal_emit(self, signals[AVAILABLE_CHANGED], 0);
+    }
+
+    return G_SOURCE_REMOVE;
+}
+
+static void
+_poke_name_owner_cb(GObject *source, GAsyncResult *result, gpointer user_data)
+{
+    gs_unref_variant GVariant *res = NULL;
+    gs_free_error GError *error    = NULL;
+
+    res = g_dbus_connection_call_finish(G_DBUS_CONNECTION(source), result, &error);
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    if (!res)
+        _LOGT("poke service \"%s\" failed: %s", NM_WPAS_DBUS_SERVICE, error->message);
+    else
+        _LOGT("poke service \"%s\" succeeded", NM_WPAS_DBUS_SERVICE);
+
+    /* in both cases, we react the same: we wait for the name owner to appear
+     * or hit the timeout. */
+}
+
+static void
+_poke_name_owner(NMSupplicantManager *self)
+{
+    NMSupplicantManagerPrivate *priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+
+    if (priv->poke_name_owner_cancellable)
+        return;
+
+    _LOGT("poke service \"%s\"...", NM_WPAS_DBUS_SERVICE);
+
+    priv->poke_name_owner_cancellable = g_cancellable_new();
+    priv->poke_name_owner_timeout_id  = g_timeout_add(3000, _poke_name_owner_timeout_cb, self);
+    nm_dbus_connection_call_start_service_by_name(priv->dbus_connection,
+                                                  NM_WPAS_DBUS_SERVICE,
+                                                  5000,
+                                                  priv->poke_name_owner_cancellable,
+                                                  _poke_name_owner_cb,
+                                                  self);
+}
+
+/*****************************************************************************/
+
+static void
+_create_iface_complete(NMSupplMgrCreateIfaceHandle *handle,
+                       NMSupplicantInterface *      supp_iface,
+                       GError *                     error)
+{
+    nm_assert(!supp_iface || NM_IS_SUPPLICANT_INTERFACE(supp_iface));
+    nm_assert((!!supp_iface) != (!!error));
+
+    c_list_unlink(&handle->create_iface_lst);
+
+    nm_clear_g_source(&handle->fail_on_idle_id);
+
+    if (handle->callback) {
+        NMSupplicantManagerCreateInterfaceCb callback;
+
+        nm_assert(NM_IS_SUPPLICANT_MANAGER(handle->self));
+
+        callback         = handle->callback;
+        handle->callback = NULL;
+        callback(handle->self, handle, supp_iface, error, handle->callback_user_data);
+    }
+
+    g_clear_error(&handle->fail_on_idle_error);
+
+    g_clear_object(&handle->self);
+
+    if (handle->shutdown_handle) {
+        /* we have a pending CreateInterface request. We keep the handle
+         * instance alive. This is to remove the device again, once the
+         * request completes. */
+        return;
+    }
+
+    nm_clear_g_cancellable(&handle->cancellable);
+    nm_ref_string_unref(handle->name_owner);
+
+    nm_g_slice_free_fcn(handle);
+}
+
+static void
+_create_iface_add(NMSupplicantManager *        self,
+                  NMSupplMgrCreateIfaceHandle *handle,
+                  const char *                 iface_path_str,
+                  gboolean                     created_by_us)
+{
+    NMSupplicantManagerPrivate *priv                  = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+    nm_auto_ref_string NMRefString *iface_path        = NULL;
+    gs_unref_object NMSupplicantInterface *supp_iface = NULL;
+
+    iface_path = nm_ref_string_new(iface_path_str);
+
+    supp_iface = g_hash_table_lookup(priv->supp_ifaces, iface_path);
+    if (supp_iface) {
+        /* Now this is odd... Reuse the same interface. */
+        g_object_ref(supp_iface);
+        _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT
+              "]: interface %s on %s created (already existing)",
+              NM_HASH_OBFUSCATE_PTR(handle),
+              iface_path_str,
+              priv->name_owner->str);
+        _create_iface_complete(handle, supp_iface, NULL);
+        return;
+    }
+
+    _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT "]: interface %s on %s created%s",
+          NM_HASH_OBFUSCATE_PTR(handle),
+          iface_path_str,
+          priv->name_owner->str,
+          created_by_us ? " (created by us)" : "");
+
+    supp_iface = nm_supplicant_interface_new(self, iface_path, handle->ifindex, handle->driver);
+
+    _supp_iface_add(self, iface_path, supp_iface);
+
+    _create_iface_complete(handle, supp_iface, NULL);
+}
+
+static void
+_create_iface_dbus_call_get_interface_cb(GObject *source, GAsyncResult *result, gpointer user_data)
+{
+    GDBusConnection *            dbus_connection = G_DBUS_CONNECTION(source);
+    NMSupplMgrCreateIfaceHandle *handle;
+    NMSupplicantManager *        self;
+    NMSupplicantManagerPrivate * priv;
+    gs_unref_variant GVariant *res = NULL;
+    gs_free_error GError *error    = NULL;
+    const char *          iface_path_str;
+
+    res = g_dbus_connection_call_finish(dbus_connection, result, &error);
+
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    handle = user_data;
+    nm_assert(handle->callback);
+
+    self = handle->self;
+    priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+
+    nm_assert(handle->name_owner == priv->name_owner);
+
+    if (!res) {
+        char ifname[NMP_IFNAMSIZ];
+
+        if (handle->create_iface_try_count < CREATE_IFACE_TRY_COUNT_MAX
+            && _nm_dbus_error_has_name(error, NM_WPAS_ERROR_UNKNOWN_IFACE)
+            && nm_platform_if_indextoname(NM_PLATFORM_GET, handle->ifindex, ifname)) {
+            /* Before, supplicant told us the interface existed. Was there a race?
+             * Try again. */
+            _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT
+                  "]: D-Bus call failed to get interface. Try to create it again (ifname \"%s\")",
+                  NM_HASH_OBFUSCATE_PTR(handle),
+                  ifname);
+            _create_iface_dbus_call_create_interface(self, handle, ifname);
+            return;
+        }
+
+        g_clear_object(&handle->cancellable);
+        _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT "]: D-Bus call to get interface failed: %s",
+              NM_HASH_OBFUSCATE_PTR(handle),
+              error->message);
+        _create_iface_complete(handle, NULL, error);
+        return;
+    }
+
+    g_clear_object(&handle->cancellable);
+
+    g_variant_get(res, "(&o)", &iface_path_str);
+
+    _create_iface_add(self, handle, iface_path_str, FALSE);
+}
+
+static void
+_create_iface_dbus_call_create_interface_cb(GObject *     source,
+                                            GAsyncResult *result,
+                                            gpointer      user_data)
+{
+    GDBusConnection *            dbus_connection = G_DBUS_CONNECTION(source);
+    NMSupplMgrCreateIfaceHandle *handle          = user_data;
+    NMSupplicantManager *        self;
+    NMSupplicantManagerPrivate * priv;
+    gs_unref_variant GVariant *res = NULL;
+    gs_free_error GError *error    = NULL;
+    const char *          iface_path_str;
+    char                  ifname[NMP_IFNAMSIZ];
+
+    res = g_dbus_connection_call_finish(dbus_connection, result, &error);
+
+    nm_shutdown_wait_obj_unregister(g_steal_pointer(&handle->shutdown_handle));
+
+    if (!res) {
+        if (handle->callback && ({
+                nm_assert(handle->self);
+                TRUE;
+            })
+            && _nm_dbus_error_has_name(error, NM_WPAS_ERROR_EXISTS_ERROR)
+            && nm_platform_if_indextoname(NM_PLATFORM_GET, handle->ifindex, ifname)) {
+            self = handle->self;
+            _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT
+                  "]: D-Bus call failed to create interface. Try to get existing interface (ifname "
+                  "\"%s\")",
+                  NM_HASH_OBFUSCATE_PTR(handle),
+                  ifname);
+            _create_iface_dbus_call_get_interface(self, handle, ifname);
+            return;
+        }
+        g_clear_object(&handle->cancellable);
+        _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT "]: D-Bus call failed: %s",
+              NM_HASH_OBFUSCATE_PTR(handle),
+              error->message);
+        _create_iface_complete(handle, NULL, error);
+        return;
+    }
+
+    g_clear_object(&handle->cancellable);
+
+    self = handle->self;
+    priv = self ? NM_SUPPLICANT_MANAGER_GET_PRIVATE(self) : NULL;
+
+    g_variant_get(res, "(&o)", &iface_path_str);
+
+    if (!handle->callback || priv->name_owner != handle->name_owner) {
+        if (!handle->callback) {
+            _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT
+                  "]: request already cancelled but still remove interface %s in %s",
+                  NM_HASH_OBFUSCATE_PTR(handle),
+                  iface_path_str,
+                  handle->name_owner->str);
+            nm_utils_error_set(&error, NM_UTILS_ERROR_UNKNOWN, "Request already cancelled");
+        } else {
+            _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT
+                  "]: name owner changed, still remove interface %s in %s",
+                  NM_HASH_OBFUSCATE_PTR(handle),
+                  iface_path_str,
+                  handle->name_owner->str);
+            nm_utils_error_set(&error,
+                               NM_UTILS_ERROR_UNKNOWN,
+                               "The name owner changed since creating the interface");
+        }
+        _dbus_call_remove_interface(dbus_connection, handle->name_owner->str, iface_path_str);
+        _create_iface_complete(handle, NULL, error);
+        return;
+    }
+
+    _create_iface_add(self, handle, iface_path_str, TRUE);
+}
+
+static void
+_create_iface_dbus_call_get_interface(NMSupplicantManager *        self,
+                                      NMSupplMgrCreateIfaceHandle *handle,
+                                      const char *                 ifname)
+{
+    NMSupplicantManagerPrivate *priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+
+    nm_assert(handle->cancellable);
+    nm_assert(!handle->shutdown_handle);
+
+    g_dbus_connection_call(priv->dbus_connection,
+                           priv->name_owner->str,
+                           NM_WPAS_DBUS_PATH,
+                           NM_WPAS_DBUS_INTERFACE,
+                           "GetInterface",
+                           g_variant_new("(s)", ifname),
+                           G_VARIANT_TYPE("(o)"),
+                           G_DBUS_CALL_FLAGS_NONE,
+                           5000,
+                           handle->cancellable,
+                           _create_iface_dbus_call_get_interface_cb,
+                           handle);
+}
+
+static void
+_create_iface_dbus_call_create_interface(NMSupplicantManager *        self,
+                                         NMSupplMgrCreateIfaceHandle *handle,
+                                         const char *                 ifname)
+{
+    NMSupplicantManagerPrivate *priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+    GVariantBuilder             builder;
+
+    nm_assert(priv->name_owner == handle->name_owner);
+    nm_assert(handle->cancellable);
+    nm_assert(!handle->shutdown_handle);
+    nm_assert(handle->create_iface_try_count <= CREATE_IFACE_TRY_COUNT_MAX);
+
+    g_variant_builder_init(&builder, G_VARIANT_TYPE_VARDICT);
+    g_variant_builder_add(&builder,
+                          "{sv}",
+                          "Driver",
+                          g_variant_new_string(nm_supplicant_driver_to_string(handle->driver)));
+    g_variant_builder_add(&builder, "{sv}", "Ifname", g_variant_new_string(ifname));
+
+    handle->shutdown_handle = nm_shutdown_wait_obj_register_cancellable_full(
+        handle->cancellable,
+        g_strdup_printf("wpas-create-" NM_HASH_OBFUSCATE_PTR_FMT, NM_HASH_OBFUSCATE_PTR(handle)),
+        TRUE);
+    handle->create_iface_try_count++;
+    g_dbus_connection_call(priv->dbus_connection,
+                           handle->name_owner->str,
+                           NM_WPAS_DBUS_PATH,
+                           NM_WPAS_DBUS_INTERFACE,
+                           "CreateInterface",
+                           g_variant_new("(a{sv})", &builder),
+                           G_VARIANT_TYPE("(o)"),
+                           G_DBUS_CALL_FLAGS_NONE,
+                           5000,
+                           handle->cancellable,
+                           _create_iface_dbus_call_create_interface_cb,
+                           handle);
+}
+
+static void
+_create_iface_dbus_start(NMSupplicantManager *self, NMSupplMgrCreateIfaceHandle *handle)
+{
+    NMSupplicantManagerPrivate *priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+    char                        ifname[NMP_IFNAMSIZ];
+
+    nm_assert(priv->name_owner);
+    nm_assert(!handle->cancellable);
+
+    if (!nm_platform_if_indextoname(NM_PLATFORM_GET, handle->ifindex, ifname)) {
+        nm_utils_error_set(&handle->fail_on_idle_error,
+                           NM_UTILS_ERROR_UNKNOWN,
+                           "Cannot find interface %d",
+                           handle->ifindex);
+        _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT
+              "]: creating interface fails to find interface name for ifindex %d",
+              NM_HASH_OBFUSCATE_PTR(handle),
+              handle->ifindex);
+        handle->fail_on_idle_id = g_idle_add(_create_iface_fail_on_idle_cb, handle);
+        return;
+    }
+
+    /* Our handle keeps @self alive. That means, when NetworkManager shall shut
+     * down, it's the responsibility of the callers to cancel the handles,
+     * to initiate coordinated shutdown.
+     *
+     * However, we now issue a CreateInterface call. Even if the handle gets cancelled
+     * (because of shutdown, or because the caller is no longer interested in the
+     * result), we don't want to cancel this request. Instead, we want to get
+     * the interface path and remove it right away.
+     *
+     * That means, the D-Bus call cannot be cancelled (because we always care about
+     * the result). Only the @handle can be cancelled, but parts of the handle will
+     * stick around to complete the task.
+     *
+     * See also handle->shutdown_handle.
+     */
+    handle->name_owner  = nm_ref_string_ref(priv->name_owner);
+    handle->cancellable = g_cancellable_new();
+    _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT "]: creating interface (ifname \"%s\")...",
+          NM_HASH_OBFUSCATE_PTR(handle),
+          ifname);
+    _create_iface_dbus_call_create_interface(self, handle, ifname);
+}
+
+static gboolean
+_create_iface_fail_on_idle_cb(gpointer user_data)
+{
+    NMSupplMgrCreateIfaceHandle *handle = user_data;
+
+    handle->fail_on_idle_id = 0;
+
+    _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT "]: fail with internal error: %s",
+          NM_HASH_OBFUSCATE_PTR(handle),
+          handle->fail_on_idle_error->message);
+
+    _create_iface_complete(handle, NULL, handle->fail_on_idle_error);
+    return G_SOURCE_REMOVE;
+}
+
+NMSupplMgrCreateIfaceHandle *
+nm_supplicant_manager_create_interface(NMSupplicantManager *                self,
+                                       int                                  ifindex,
+                                       NMSupplicantDriver                   driver,
+                                       NMSupplicantManagerCreateInterfaceCb callback,
+                                       gpointer                             user_data)
+{
+    NMSupplicantManagerPrivate * priv;
+    NMSupplMgrCreateIfaceHandle *handle;
+
+    g_return_val_if_fail(NM_IS_SUPPLICANT_MANAGER(self), NULL);
+    g_return_val_if_fail(ifindex > 0, NULL);
+    g_return_val_if_fail(callback, NULL);
+    nm_assert(nm_supplicant_driver_to_string(driver));
+
+    priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+
+    handle  = g_slice_new(NMSupplMgrCreateIfaceHandle);
+    *handle = (NMSupplMgrCreateIfaceHandle){
+        .self               = g_object_ref(self),
+        .callback           = callback,
+        .callback_user_data = user_data,
+        .driver             = driver,
+        .ifindex            = ifindex,
+    };
+    c_list_link_tail(&priv->create_iface_lst_head, &handle->create_iface_lst);
+
+    if (!priv->dbus_connection) {
+        _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT
+              "]: new request interface %d (driver %s). Fail because no D-Bus connection to talk "
+              "to wpa_supplicant...",
+              NM_HASH_OBFUSCATE_PTR(handle),
+              ifindex,
+              nm_supplicant_driver_to_string(driver));
+        nm_utils_error_set(&handle->fail_on_idle_error,
+                           NM_UTILS_ERROR_UNKNOWN,
+                           "No D-Bus connection to talk to wpa_supplicant");
+        handle->fail_on_idle_id = g_idle_add(_create_iface_fail_on_idle_cb, handle);
+        return handle;
+    }
+
+    if (!priv->name_owner) {
+        _LOGT(
+            "create-iface[" NM_HASH_OBFUSCATE_PTR_FMT "]: new request interface %d (driver %s). %s",
+            NM_HASH_OBFUSCATE_PTR(handle),
+            ifindex,
+            nm_supplicant_driver_to_string(driver),
+            priv->poke_name_owner_cancellable ? "Waiting for supplicant..." : "Poke supplicant...");
+        _poke_name_owner(self);
+        return handle;
+    }
+
+    if (priv->get_capabilities_cancellable) {
+        _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT
+              "]: new request interface %d (driver %s). Waiting to fetch capabilities for %s...",
+              NM_HASH_OBFUSCATE_PTR(handle),
+              ifindex,
+              nm_supplicant_driver_to_string(driver),
+              priv->name_owner->str);
+        return handle;
+    }
+
+    _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT
+          "]: new request interface %d (driver %s). create interface on %s...",
+          NM_HASH_OBFUSCATE_PTR(handle),
+          ifindex,
+          nm_supplicant_driver_to_string(driver),
+          priv->name_owner->str);
+
+    _create_iface_dbus_start(self, handle);
+    return handle;
+}
+
+static void
+_create_iface_proceed_all(NMSupplicantManager *self, GError *error)
+{
+    NMSupplicantManagerPrivate * priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+    NMSupplMgrCreateIfaceHandle *handle;
+
+    nm_assert(error || priv->name_owner);
+    nm_assert(error || !priv->get_capabilities_cancellable);
+
+    if (c_list_is_empty(&priv->create_iface_lst_head))
+        return;
+
+    if (error) {
+        CList alt_list;
+
+        /* we move the handles we want to proceed to a alternative list.
+         * That is, because we invoke callbacks to the caller, who might
+         * create another request right away. We don't want to proceed
+         * that one. */
+        c_list_init(&alt_list);
+        c_list_splice(&alt_list, &priv->create_iface_lst_head);
+
+        while ((handle =
+                    c_list_last_entry(&alt_list, NMSupplMgrCreateIfaceHandle, create_iface_lst))) {
+            /* We don't need to keep @self alive. Every handle holds a reference already. */
+            _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT "]: create interface failed: %s",
+                  NM_HASH_OBFUSCATE_PTR(handle),
+                  error->message);
+            _create_iface_complete(handle, NULL, error);
+        }
+        return;
+    }
+
+    /* start all the handles. This does not invoke callbacks, so the list of handles
+     * cannot be modified while we iterate it. */
+    c_list_for_each_entry (handle, &priv->create_iface_lst_head, create_iface_lst) {
+        _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT "]: create interface on %s...",
+              NM_HASH_OBFUSCATE_PTR(handle),
+              priv->name_owner->str);
+        _create_iface_dbus_start(self, handle);
+    }
+}
+
+void
+nm_supplicant_manager_create_interface_cancel(NMSupplMgrCreateIfaceHandle *handle)
+{
+    gs_free_error GError *error = NULL;
+
+    if (!handle)
+        return;
+
+    g_return_if_fail(NM_IS_SUPPLICANT_MANAGER(handle->self));
+    g_return_if_fail(handle->callback);
+    nm_assert(!c_list_is_empty(&handle->create_iface_lst));
+
+    nm_utils_error_set_cancelled(&error, FALSE, NULL);
+    _create_iface_complete(handle, NULL, error);
+}
+
+NMSupplicantInterface *
+nm_supplicant_manager_create_interface_from_path(NMSupplicantManager *self, const char *object_path)
+{
+    NMSupplicantManagerPrivate *priv;
+    NMSupplicantInterface *     supp_iface;
+    nm_auto_ref_string NMRefString *iface_path = NULL;
+
+    g_return_val_if_fail(NM_IS_SUPPLICANT_MANAGER(self), NULL);
+    g_return_val_if_fail(object_path, NULL);
+
+    priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+
+    iface_path = nm_ref_string_new(object_path);
+
+    supp_iface = g_hash_table_lookup(priv->supp_ifaces, iface_path);
+
+    if (supp_iface)
+        return g_object_ref(supp_iface);
+
+    supp_iface = nm_supplicant_interface_new(self, iface_path, 0, NM_SUPPLICANT_DRIVER_UNKNOWN);
+
+    _supp_iface_add(self, iface_path, supp_iface);
+
+    return supp_iface;
+}
+
+/*****************************************************************************/
+
+static void
+_dbus_interface_removed_cb(GDBusConnection *connection,
+                           const char *     sender_name,
+                           const char *     object_path,
+                           const char *     signal_interface_name,
+                           const char *     signal_name,
+                           GVariant *       parameters,
+                           gpointer         user_data)
+{
+    NMSupplicantManager *       self = user_data;
+    NMSupplicantManagerPrivate *priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+    NMSupplicantInterface *     supp_iface;
+    const char *                iface_path_str;
+    nm_auto_ref_string NMRefString *iface_path = NULL;
+
+    nm_assert(nm_streq(sender_name, priv->name_owner->str));
+
+    if (!g_variant_is_of_type(parameters, G_VARIANT_TYPE("(o)")))
+        return;
+
+    g_variant_get(parameters, "(&o)", &iface_path_str);
+
+    iface_path = nm_ref_string_new(iface_path_str);
+
+    supp_iface = g_hash_table_lookup(priv->supp_ifaces, iface_path);
+    if (!supp_iface)
+        return;
+
+    _supp_iface_remove_one(self, supp_iface, FALSE, "InterfaceRemoved signal from wpa_supplicant");
+}
+
+/*****************************************************************************/
+
+static void
+_dbus_get_capabilities_cb(GVariant *res, GError *error, gpointer user_data)
+{
+    NMSupplicantManager *       self;
+    NMSupplicantManagerPrivate *priv;
+
+    if (nm_utils_error_is_cancelled(error))
+        return;
+
+    self = user_data;
+    priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+
+    g_clear_object(&priv->get_capabilities_cancellable);
+
+    /* The supplicant only advertises global capabilities if the following
+     * commit has been applied:
+     *
+     * commit 1634ac0654eba8d458640a115efc0a6cde3bac4d
+     * Author: Dan Williams <dcbw@redhat.com>
+     * Date:   Sat Sep 29 19:06:30 2012 +0300
+     *
+     * dbus: Add global capabilities property
+     */
+    _caps_set(priv, NM_SUPPL_CAP_TYPE_AP, NM_TERNARY_DEFAULT);
+    _caps_set(priv, NM_SUPPL_CAP_TYPE_PMF, NM_TERNARY_DEFAULT);
+    _caps_set(priv, NM_SUPPL_CAP_TYPE_FILS, NM_TERNARY_DEFAULT);
+
+    /* Support for the following is newer than the capabilities property */
+    _caps_set(priv, NM_SUPPL_CAP_TYPE_P2P, NM_TERNARY_FALSE);
+    _caps_set(priv, NM_SUPPL_CAP_TYPE_FT, NM_TERNARY_FALSE);
+    _caps_set(priv, NM_SUPPL_CAP_TYPE_SHA384, NM_TERNARY_FALSE);
+    _caps_set(priv, NM_SUPPL_CAP_TYPE_MESH, NM_TERNARY_FALSE);
+    _caps_set(priv, NM_SUPPL_CAP_TYPE_FAST, NM_TERNARY_FALSE);
+    _caps_set(priv, NM_SUPPL_CAP_TYPE_WFD, NM_TERNARY_FALSE);
+
+    if (res) {
+        nm_auto_free_variant_iter GVariantIter *res_iter = NULL;
+        const char *                            res_key;
+        GVariant *                              res_val;
+
+        g_variant_get(res, "(a{sv})", &res_iter);
+        while (g_variant_iter_loop(res_iter, "{&sv}", &res_key, &res_val)) {
+            if (nm_streq(res_key, "Capabilities")) {
+                if (g_variant_is_of_type(res_val, G_VARIANT_TYPE_STRING_ARRAY)) {
+                    gs_free const char **array = NULL;
+                    const char **        a;
+
+                    array = g_variant_get_strv(res_val, NULL);
+                    _caps_set(priv, NM_SUPPL_CAP_TYPE_AP, NM_TERNARY_FALSE);
+                    _caps_set(priv, NM_SUPPL_CAP_TYPE_PMF, NM_TERNARY_FALSE);
+                    _caps_set(priv, NM_SUPPL_CAP_TYPE_FILS, NM_TERNARY_FALSE);
+                    _caps_set(priv, NM_SUPPL_CAP_TYPE_SUITEB192, NM_TERNARY_FALSE);
+                    if (array) {
+                        for (a = array; *a; a++) {
+                            if (nm_streq(*a, "ap")) {
+                                _caps_set(priv, NM_SUPPL_CAP_TYPE_AP, NM_TERNARY_TRUE);
+                                continue;
+                            }
+                            if (nm_streq(*a, "pmf")) {
+                                _caps_set(priv, NM_SUPPL_CAP_TYPE_PMF, NM_TERNARY_TRUE);
+                                continue;
+                            }
+                            if (nm_streq(*a, "fils")) {
+                                _caps_set(priv, NM_SUPPL_CAP_TYPE_FILS, NM_TERNARY_TRUE);
+                                continue;
+                            }
+                            if (nm_streq(*a, "p2p")) {
+                                _caps_set(priv, NM_SUPPL_CAP_TYPE_P2P, NM_TERNARY_TRUE);
+                                continue;
+                            }
+                            if (nm_streq(*a, "ft")) {
+                                _caps_set(priv, NM_SUPPL_CAP_TYPE_FT, NM_TERNARY_TRUE);
+                                continue;
+                            }
+                            if (nm_streq(*a, "sha384")) {
+                                _caps_set(priv, NM_SUPPL_CAP_TYPE_SHA384, NM_TERNARY_TRUE);
+                                continue;
+                            }
+                            if (nm_streq(*a, "mesh")) {
+                                _caps_set(priv, NM_SUPPL_CAP_TYPE_MESH, NM_TERNARY_TRUE);
+                                continue;
+                            }
+                            if (nm_streq(*a, "suiteb192")) {
+                                _caps_set(priv, NM_SUPPL_CAP_TYPE_SUITEB192, NM_TERNARY_TRUE);
+                                continue;
+                            }
+                        }
+                    }
+                }
+                continue;
+            }
+            if (nm_streq(res_key, "EapMethods")) {
+                if (g_variant_is_of_type(res_val, G_VARIANT_TYPE_STRING_ARRAY)) {
+                    gs_free const char **array = NULL;
+                    const char **        a;
+
+                    array = g_variant_get_strv(res_val, NULL);
+                    if (array) {
+                        for (a = array; *a; a++) {
+                            if (g_ascii_strcasecmp(*a, "FAST") == 0) {
+                                _caps_set(priv, NM_SUPPL_CAP_TYPE_FAST, NM_TERNARY_TRUE);
+                                break;
+                            }
+                        }
+                    }
+                }
+                continue;
+            }
+            if (nm_streq(res_key, "WFDIEs")) {
+                _caps_set(priv, NM_SUPPL_CAP_TYPE_WFD, NM_TERNARY_TRUE);
+                continue;
+            }
+        }
+    }
+
+    _LOGD("supported features:"
+          " AP%c"
+          " PMF%c"
+          " FILS%c"
+          " P2P%c"
+          " FT%c"
+          " SHA384%c"
+          " MESH%c"
+          " FAST%c"
+          " WFD%c"
+          "",
+          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_AP),
+          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_PMF),
+          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_FILS),
+          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_P2P),
+          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_FT),
+          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_SHA384),
+          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_MESH),
+          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_FAST),
+          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_WFD));
+
+    nm_assert(g_hash_table_size(priv->supp_ifaces) == 0);
+    nm_assert(c_list_is_empty(&priv->supp_lst_head));
+
+    _create_iface_proceed_all(self, NULL);
+}
+
+/*****************************************************************************/
+
+void
+_nm_supplicant_manager_unregister_interface(NMSupplicantManager *  self,
+                                            NMSupplicantInterface *supp_iface)
+{
+    NMSupplicantManagerPrivate *priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+
+    nm_assert(NM_IS_SUPPLICANT_INTERFACE(supp_iface));
+    nm_assert(c_list_contains(&NM_SUPPLICANT_MANAGER_GET_PRIVATE(self)->supp_lst_head,
+                              &supp_iface->supp_lst));
+
+    c_list_unlink(&supp_iface->supp_lst);
+    if (!g_hash_table_remove(priv->supp_ifaces,
+                             nm_supplicant_interface_get_object_path(supp_iface)))
+        nm_assert_not_reached();
+}
+
+static void
+_supp_iface_add(NMSupplicantManager *  self,
+                NMRefString *          iface_path,
+                NMSupplicantInterface *supp_iface)
+{
+    NMSupplicantManagerPrivate *priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+
+    c_list_link_tail(&priv->supp_lst_head, &supp_iface->supp_lst);
+    if (!g_hash_table_insert(priv->supp_ifaces, iface_path, supp_iface))
+        nm_assert_not_reached();
+}
+
+static void
+_supp_iface_remove_one(NMSupplicantManager *  self,
+                       NMSupplicantInterface *supp_iface,
+                       gboolean               force_remove_from_supplicant,
+                       const char *           reason)
+{
+#if NM_MORE_ASSERTS
+    _nm_unused gs_unref_object NMSupplicantInterface *supp_iface_keep_alive =
+        g_object_ref(supp_iface);
+#endif
+
+    nm_assert(NM_IS_SUPPLICANT_MANAGER(self));
+    nm_assert(NM_IS_SUPPLICANT_INTERFACE(supp_iface));
+    nm_assert(c_list_contains(&NM_SUPPLICANT_MANAGER_GET_PRIVATE(self)->supp_lst_head,
+                              &supp_iface->supp_lst));
+
+    _nm_supplicant_interface_set_state_down(supp_iface, force_remove_from_supplicant, reason);
+
+    nm_assert(c_list_is_empty(&supp_iface->supp_lst));
+}
+
+static void
+_supp_iface_remove_all(NMSupplicantManager *self,
+                       gboolean             force_remove_from_supplicant,
+                       const char *         reason)
+{
+    NMSupplicantManagerPrivate *priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+    NMSupplicantInterface *     supp_iface;
+
+    while ((supp_iface = c_list_first_entry(&priv->supp_lst_head, NMSupplicantInterface, supp_lst)))
+        _supp_iface_remove_one(self, supp_iface, force_remove_from_supplicant, reason);
+}
+
+/*****************************************************************************/
+
+static gboolean
+_available_reset_cb(gpointer user_data)
+{
+    NMSupplicantManager *       self = user_data;
+    NMSupplicantManagerPrivate *priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+
+    priv->available_reset_id = 0;
+    nm_assert(priv->available == NM_TERNARY_FALSE);
+    priv->available = NM_TERNARY_DEFAULT;
+    g_signal_emit(self, signals[AVAILABLE_CHANGED], 0);
+    return G_SOURCE_REMOVE;
+}
+
+/*****************************************************************************/
+
+static void
+name_owner_changed(NMSupplicantManager *self, const char *name_owner, gboolean first_time)
+{
+    NMSupplicantManagerPrivate *priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+    NMTernary                   available;
+    gboolean                    available_changed = FALSE;
+
+    nm_assert(!priv->get_name_owner_cancellable);
+    nm_assert(!name_owner || name_owner[0]);
+    nm_assert((first_time && !priv->name_owner)
+              || (!first_time && (!!priv->name_owner) != (!!name_owner)));
+
+    if (first_time) {
+        _LOGD("wpa_supplicant name owner %s%s%s (%srunning)",
+              NM_PRINT_FMT_QUOTE_STRING(name_owner),
+              name_owner ? "" : "not ");
+    } else {
+        _LOGD("wpa_supplicant name owner \"%s\" %s (%srunning)",
+              name_owner ?: priv->name_owner->str,
+              name_owner ? "disappeared" : "appeared",
+              name_owner ? "" : "not ");
+    }
+
+    nm_ref_string_unref(priv->name_owner);
+    priv->name_owner = nm_ref_string_new(name_owner);
+
+    nm_clear_g_dbus_connection_signal(priv->dbus_connection, &priv->interface_removed_id);
+
+    if (name_owner) {
+        if (nm_clear_g_source(&priv->poke_name_owner_timeout_id))
+            _LOGT("poke service \"%s\" completed with name owner change", NM_WPAS_DBUS_SERVICE);
+        nm_clear_g_cancellable(&priv->poke_name_owner_cancellable);
+    }
+
+    nm_clear_g_cancellable(&priv->get_capabilities_cancellable);
+
+    priv->capabilities = NM_SUPPL_CAP_MASK_NONE;
+    if (priv->name_owner) {
+        priv->get_capabilities_cancellable = g_cancellable_new();
+        nm_dbus_connection_call_get_all(priv->dbus_connection,
+                                        priv->name_owner->str,
+                                        NM_WPAS_DBUS_PATH,
+                                        NM_WPAS_DBUS_INTERFACE,
+                                        5000,
+                                        priv->get_capabilities_cancellable,
+                                        _dbus_get_capabilities_cb,
+                                        self);
+        priv->interface_removed_id = g_dbus_connection_signal_subscribe(priv->dbus_connection,
+                                                                        priv->name_owner->str,
+                                                                        NM_WPAS_DBUS_INTERFACE,
+                                                                        "InterfaceRemoved",
+                                                                        NULL,
+                                                                        NULL,
+                                                                        G_DBUS_SIGNAL_FLAGS_NONE,
+                                                                        _dbus_interface_removed_cb,
+                                                                        self,
+                                                                        NULL);
+    }
+
+    /* if supplicant is running (has a name owner), we may use it.
+     * If this is the first time, and supplicant is not running, we
+     * may also use it (and assume that we probably could D-Bus activate
+     * it).
+     *
+     * Otherwise, somebody else stopped supplicant. It's no longer useable to
+     * us and we block auto starting it. The user has to start the service...
+     *
+     * Actually, below we reset the hard block after a short timeout. This
+     * causes the caller to notify that supplicant may now by around and
+     * retry to D-Bus activate it. */
+    if (priv->name_owner)
+        available = NM_TERNARY_TRUE;
+    else if (first_time)
+        available = NM_TERNARY_DEFAULT;
+    else
+        available = NM_TERNARY_FALSE;
+
+    if (priv->available != available) {
+        priv->available = available;
+        _LOGD("supplicant is now %savailable",
+              available == FALSE ? "not " : (available == TRUE ? "" : "maybe "));
+        available_changed = TRUE;
+
+        nm_clear_g_source(&priv->available_reset_id);
+        if (available == NM_TERNARY_FALSE) {
+            /* reset the availability from a hard "no" to a "maybe" in a bit. */
+            priv->available_reset_id = g_timeout_add_seconds(60, _available_reset_cb, self);
+        }
+    }
+
+    _supp_iface_remove_all(self, TRUE, "name-owner changed");
+
+    if (!priv->name_owner) {
+        if (priv->poke_name_owner_timeout_id) {
+            /* we are still poking for the service to start. Don't cancel
+             * the pending create requests just yet. */
+        } else {
+            gs_free_error GError *local_error = NULL;
+
+            /* When we loose the name owner, we fail all pending creation requests. */
+            nm_utils_error_set(&local_error, NM_UTILS_ERROR_UNKNOWN, "Name owner lost");
+            _create_iface_proceed_all(self, local_error);
+        }
+    } else {
+        /* We got a name-owner, but we don't do anything. Instead let
+         * _dbus_get_capabilities_cb() complete and kick of the create-iface
+         * handles.
+         *
+         * Note that before the first name-owner change, all create-iface
+         * requests fail right away. So we don't have to handle them here
+         * (by starting to poke the service). */
+    }
+
+    if (available_changed)
+        g_signal_emit(self, signals[AVAILABLE_CHANGED], 0);
+}
+
+static void
+name_owner_changed_cb(GDBusConnection *connection,
+                      const char *     sender_name,
+                      const char *     object_path,
+                      const char *     interface_name,
+                      const char *     signal_name,
+                      GVariant *       parameters,
+                      gpointer         user_data)
+{
+    gs_unref_object NMSupplicantManager *self = g_object_ref(user_data);
+    NMSupplicantManagerPrivate *         priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+    const char *                         name_owner;
+
+    if (!g_variant_is_of_type(parameters, G_VARIANT_TYPE("(sss)")))
+        return;
+
+    if (priv->get_name_owner_cancellable)
+        return;
+
+    g_variant_get(parameters, "(&s&s&s)", NULL, NULL, &name_owner);
+
+    name_owner = nm_str_not_empty(name_owner);
+
+    if (nm_streq0(name_owner, nm_ref_string_get_str(priv->name_owner)))
+        return;
+
+    if (name_owner && priv->name_owner) {
+        /* odd, we directly switch from one name owner to the next. Can't allow that.
+         * First clear the name owner before resetting. */
+        name_owner_changed(self, NULL, FALSE);
+    }
+    name_owner_changed(user_data, name_owner, FALSE);
+}
+
+static void
+get_name_owner_cb(const char *name_owner, GError *error, gpointer user_data)
+{
+    NMSupplicantManager *       self = user_data;
+    NMSupplicantManagerPrivate *priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+
+    if (!name_owner && nm_utils_error_is_cancelled(error))
+        return;
+
+    self = user_data;
+    priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+
+    g_clear_object(&priv->get_name_owner_cancellable);
+
+    name_owner_changed(self, nm_str_not_empty(name_owner), TRUE);
+}
+
+/*****************************************************************************/
+
+static void
+nm_supplicant_manager_init(NMSupplicantManager *self)
+{
+    NMSupplicantManagerPrivate *priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+
+    nm_assert(priv->capabilities == NM_SUPPL_CAP_MASK_NONE);
+    nm_assert(priv->available == NM_TERNARY_FALSE);
+
+    priv->supp_ifaces = g_hash_table_new(nm_direct_hash, NULL);
+    c_list_init(&priv->supp_lst_head);
+    c_list_init(&priv->create_iface_lst_head);
+
+    priv->dbus_connection = nm_g_object_ref(NM_MAIN_DBUS_CONNECTION_GET);
+
+    if (!priv->dbus_connection) {
+        _LOGI("no D-Bus connection to talk to wpa_supplicant");
+        return;
+    }
+
+    priv->name_owner_changed_id =
+        nm_dbus_connection_signal_subscribe_name_owner_changed(priv->dbus_connection,
+                                                               NM_WPAS_DBUS_SERVICE,
+                                                               name_owner_changed_cb,
+                                                               self,
+                                                               NULL);
+    priv->get_name_owner_cancellable = g_cancellable_new();
+    nm_dbus_connection_call_get_name_owner(priv->dbus_connection,
+                                           NM_WPAS_DBUS_SERVICE,
+                                           -1,
+                                           priv->get_name_owner_cancellable,
+                                           get_name_owner_cb,
+                                           self);
+}
+
+static void
+dispose(GObject *object)
+{
+    NMSupplicantManager *       self = (NMSupplicantManager *) object;
+    NMSupplicantManagerPrivate *priv = NM_SUPPLICANT_MANAGER_GET_PRIVATE(self);
+
+    _supp_iface_remove_all(self, TRUE, "NMSupplicantManager is disposing");
+
+    nm_assert(c_list_is_empty(&priv->create_iface_lst_head));
+
+    nm_clear_g_source(&priv->available_reset_id);
+
+    priv->available = NM_TERNARY_FALSE;
+    nm_clear_pointer(&priv->name_owner, nm_ref_string_unref);
+
+    nm_clear_g_source(&priv->poke_name_owner_timeout_id);
+    nm_clear_g_cancellable(&priv->poke_name_owner_cancellable);
+
+    nm_clear_g_dbus_connection_signal(priv->dbus_connection, &priv->interface_removed_id);
+    nm_clear_g_dbus_connection_signal(priv->dbus_connection, &priv->name_owner_changed_id);
+
+    nm_clear_g_cancellable(&priv->get_name_owner_cancellable);
+    nm_clear_g_cancellable(&priv->get_capabilities_cancellable);
+
+    G_OBJECT_CLASS(nm_supplicant_manager_parent_class)->dispose(object);
+
+    g_clear_object(&priv->dbus_connection);
+
+    nm_clear_pointer(&priv->supp_ifaces, g_hash_table_destroy);
+}
+
+static void
+nm_supplicant_manager_class_init(NMSupplicantManagerClass *klass)
+{
+    GObjectClass *object_class = G_OBJECT_CLASS(klass);
+
+    object_class->dispose = dispose;
+
+    signals[AVAILABLE_CHANGED] = g_signal_new(NM_SUPPLICANT_MANAGER_AVAILABLE_CHANGED,
+                                              G_OBJECT_CLASS_TYPE(object_class),
+                                              G_SIGNAL_RUN_LAST,
+                                              0,
+                                              NULL,
+                                              NULL,
+                                              NULL,
+                                              G_TYPE_NONE,
+                                              0);
+}
diff --git a/src/core/supplicant/nm-supplicant-manager.h b/src/core/supplicant/nm-supplicant-manager.h
new file mode 100644
index 00000000..3000d064
--- /dev/null
+++ b/src/core/supplicant/nm-supplicant-manager.h
@@ -0,0 +1,70 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2006 - 2008 Red Hat, Inc.
+ * Copyright (C) 2007 - 2008 Novell, Inc.
+ */
+
+#ifndef __NETWORKMANAGER_SUPPLICANT_MANAGER_H__
+#define __NETWORKMANAGER_SUPPLICANT_MANAGER_H__
+
+#include "nm-supplicant-types.h"
+#include "devices/nm-device.h"
+
+#define NM_TYPE_SUPPLICANT_MANAGER (nm_supplicant_manager_get_type())
+#define NM_SUPPLICANT_MANAGER(obj) \
+    (G_TYPE_CHECK_INSTANCE_CAST((obj), NM_TYPE_SUPPLICANT_MANAGER, NMSupplicantManager))
+#define NM_SUPPLICANT_MANAGER_CLASS(klass) \
+    (G_TYPE_CHECK_CLASS_CAST((klass), NM_TYPE_SUPPLICANT_MANAGER, NMSupplicantManagerClass))
+#define NM_IS_SUPPLICANT_MANAGER(obj) \
+    (G_TYPE_CHECK_INSTANCE_TYPE((obj), NM_TYPE_SUPPLICANT_MANAGER))
+#define NM_IS_SUPPLICANT_MANAGER_CLASS(klass) \
+    (G_TYPE_CHECK_CLASS_TYPE((klass), NM_TYPE_SUPPLICANT_MANAGER))
+#define NM_SUPPLICANT_MANAGER_GET_CLASS(obj) \
+    (G_TYPE_INSTANCE_GET_CLASS((obj), NM_TYPE_SUPPLICANT_MANAGER, NMSupplicantManagerClass))
+
+#define NM_SUPPLICANT_MANAGER_AVAILABLE_CHANGED "available-changed"
+
+typedef struct _NMSupplicantManagerClass NMSupplicantManagerClass;
+
+GType nm_supplicant_manager_get_type(void);
+
+NMSupplicantManager *nm_supplicant_manager_get(void);
+
+NMTernary nm_supplicant_manager_is_available(NMSupplicantManager *self);
+
+GDBusConnection *nm_supplicant_manager_get_dbus_connection(NMSupplicantManager *self);
+NMRefString *    nm_supplicant_manager_get_dbus_name_owner(NMSupplicantManager *self);
+NMSupplCapMask   nm_supplicant_manager_get_global_capabilities(NMSupplicantManager *self);
+
+void nm_supplicant_manager_set_wfd_ies(NMSupplicantManager *self, GBytes *wfd_ies);
+
+typedef struct _NMSupplMgrCreateIfaceHandle NMSupplMgrCreateIfaceHandle;
+
+typedef void (*NMSupplicantManagerCreateInterfaceCb)(NMSupplicantManager *        self,
+                                                     NMSupplMgrCreateIfaceHandle *handle,
+                                                     NMSupplicantInterface *      iface,
+                                                     GError *                     error,
+                                                     gpointer                     user_data);
+
+NMSupplMgrCreateIfaceHandle *
+nm_supplicant_manager_create_interface(NMSupplicantManager *                self,
+                                       int                                  ifindex,
+                                       NMSupplicantDriver                   driver,
+                                       NMSupplicantManagerCreateInterfaceCb callback,
+                                       gpointer                             user_data);
+
+void nm_supplicant_manager_create_interface_cancel(NMSupplMgrCreateIfaceHandle *handle);
+
+NMSupplicantInterface *nm_supplicant_manager_create_interface_from_path(NMSupplicantManager *self,
+                                                                        const char *object_path);
+
+/*****************************************************************************/
+
+void _nm_supplicant_manager_unregister_interface(NMSupplicantManager *  self,
+                                                 NMSupplicantInterface *supp_iface);
+
+void _nm_supplicant_manager_dbus_call_remove_interface(NMSupplicantManager *self,
+                                                       const char *         name_owner,
+                                                       const char *         iface_path);
+
+#endif /* __NETWORKMANAGER_SUPPLICANT_MANAGER_H__ */
diff --git a/src/core/supplicant/nm-supplicant-settings-verify.c b/src/core/supplicant/nm-supplicant-settings-verify.c
new file mode 100644
index 00000000..3f0a33e0
--- /dev/null
+++ b/src/core/supplicant/nm-supplicant-settings-verify.c
@@ -0,0 +1,300 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2006 - 2012 Red Hat, Inc.
+ */
+
+#include "src/core/nm-default-daemon.h"
+
+#include "nm-supplicant-settings-verify.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+
+struct Opt {
+    const char *         key;
+    const char *const *  str_allowed;
+    const NMSupplOptType type;
+    const guint32        int_low;  /* Inclusive */
+    const guint32        int_high; /* Inclusive; max length for strings */
+};
+
+typedef gboolean (*validate_func)(const struct Opt *, const char *, const guint32);
+
+#define OPT_INT(_key, _int_low, _int_high)                                                      \
+    {                                                                                           \
+        .key = _key, .type = NM_SUPPL_OPT_TYPE_INT, .int_high = _int_high, .int_low = _int_low, \
+    }
+#define OPT_BYTES(_key, _int_high)                                           \
+    {                                                                        \
+        .key = _key, .type = NM_SUPPL_OPT_TYPE_BYTES, .int_high = _int_high, \
+    }
+#define OPT_UTF8(_key, _int_high)                                           \
+    {                                                                       \
+        .key = _key, .type = NM_SUPPL_OPT_TYPE_UTF8, .int_high = _int_high, \
+    }
+#define OPT_KEYWORD(_key, _str_allowed)                                              \
+    {                                                                                \
+        .key = _key, .type = NM_SUPPL_OPT_TYPE_KEYWORD, .str_allowed = _str_allowed, \
+    }
+
+static const struct Opt opt_table[] = {
+    OPT_BYTES("altsubject_match", 0),
+    OPT_BYTES("altsubject_match2", 0),
+    OPT_BYTES("anonymous_identity", 0),
+    OPT_KEYWORD("auth_alg", NM_MAKE_STRV("OPEN", "SHARED", "LEAP", )),
+    OPT_BYTES("bgscan", 0),
+    OPT_KEYWORD("bssid", NULL),
+    OPT_BYTES("ca_cert", 65536),
+    OPT_BYTES("ca_cert2", 65536),
+    OPT_BYTES("ca_path", 0),
+    OPT_BYTES("ca_path2", 0),
+    OPT_BYTES("client_cert", 65536),
+    OPT_BYTES("client_cert2", 65536),
+    OPT_BYTES("domain_match", 0),
+    OPT_BYTES("domain_match2", 0),
+    OPT_BYTES("domain_suffix_match", 0),
+    OPT_BYTES("domain_suffix_match2", 0),
+    OPT_KEYWORD("eap",
+                NM_MAKE_STRV("LEAP", "MD5", "TLS", "PEAP", "TTLS", "SIM", "PSK", "FAST", "PWD", )),
+    OPT_INT("eapol_flags", 0, 3),
+    OPT_BYTES("eappsk", 0),
+    OPT_INT("engine", 0, 1),
+    OPT_BYTES("engine_id", 0),
+    OPT_INT("fragment_size", 1, 2000),
+    OPT_KEYWORD("freq_list", NULL),
+    OPT_INT("frequency", 2412, 5825),
+    OPT_KEYWORD("group", NM_MAKE_STRV("CCMP", "TKIP", "WEP104", "WEP40", "GCMP-256", )),
+    OPT_BYTES("identity", 0),
+    OPT_INT("ieee80211w", 0, 2),
+    OPT_INT("ignore_broadcast_ssid", 0, 2),
+    OPT_BYTES("key_id", 0),
+    OPT_KEYWORD("key_mgmt",
+                NM_MAKE_STRV("WPA-PSK",
+                             "WPA-PSK-SHA256",
+                             "FT-PSK",
+                             "WPA-EAP",
+                             "WPA-EAP-SHA256",
+                             "FT-EAP",
+                             "FT-EAP-SHA384",
+                             "FILS-SHA256",
+                             "FILS-SHA384",
+                             "FT-FILS-SHA256",
+                             "FT-FILS-SHA384",
+                             "IEEE8021X",
+                             "SAE",
+                             "WPA-EAP-SUITE-B-192",
+                             "FT-SAE",
+                             "OWE",
+                             "NONE", )),
+    OPT_INT("macsec_integ_only", 0, 1),
+    OPT_INT("macsec_policy", 0, 1),
+    OPT_INT("macsec_port", 1, 65534),
+    OPT_BYTES("mka_cak", 65536),
+    OPT_BYTES("mka_ckn", 65536),
+    OPT_BYTES("nai", 0),
+    OPT_BYTES("pac_file", 0),
+    OPT_KEYWORD("pairwise", NM_MAKE_STRV("CCMP", "TKIP", "GCMP-256", "NONE", )),
+    OPT_UTF8("password", 0),
+    OPT_BYTES("pcsc", 0),
+    OPT_KEYWORD("phase1",
+                NM_MAKE_STRV("peapver=0",
+                             "peapver=1",
+                             "peaplabel=1",
+                             "peap_outer_success=0",
+                             "include_tls_length=1",
+                             "sim_min_num_chal=3",
+                             "fast_provisioning=0",
+                             "fast_provisioning=1",
+                             "fast_provisioning=2",
+                             "fast_provisioning=3",
+                             "tls_disable_tlsv1_0=0",
+                             "tls_disable_tlsv1_0=1",
+                             "tls_disable_tlsv1_1=0",
+                             "tls_disable_tlsv1_1=1",
+                             "tls_disable_tlsv1_2=0",
+                             "tls_disable_tlsv1_2=1", )),
+    OPT_KEYWORD("phase2",
+                NM_MAKE_STRV("auth=PAP",
+                             "auth=CHAP",
+                             "auth=MSCHAP",
+                             "auth=MSCHAPV2",
+                             "auth=GTC",
+                             "auth=OTP",
+                             "auth=MD5",
+                             "auth=TLS",
+                             "autheap=MD5",
+                             "autheap=MSCHAPV2",
+                             "autheap=OTP",
+                             "autheap=GTC",
+                             "autheap=TLS", )),
+    OPT_BYTES("pin", 0),
+    OPT_BYTES("private_key", 65536),
+    OPT_BYTES("private_key2", 65536),
+    OPT_BYTES("private_key2_passwd", 1024),
+    OPT_BYTES("private_key_passwd", 1024),
+    OPT_INT("proactive_key_caching", 0, 1),
+    OPT_KEYWORD("proto", NM_MAKE_STRV("WPA", "RSN", )),
+    OPT_BYTES("psk", 0),
+    OPT_INT("scan_ssid", 0, 1),
+    OPT_BYTES("ssid", 32),
+    OPT_BYTES("subject_match", 0),
+    OPT_BYTES("subject_match2", 0),
+    OPT_BYTES("wep_key0", 0),
+    OPT_BYTES("wep_key1", 0),
+    OPT_BYTES("wep_key2", 0),
+    OPT_BYTES("wep_key3", 0),
+    OPT_INT("wep_tx_keyidx", 0, 3),
+};
+
+static gboolean
+validate_type_int(const struct Opt *opt, const char *value, const guint32 len)
+{
+    gint64 v;
+
+    nm_assert(opt);
+    nm_assert(value);
+
+    v = _nm_utils_ascii_str_to_int64(value, 10, opt->int_low, opt->int_high, G_MININT64);
+    return v != G_MININT64 || errno == 0;
+}
+
+static gboolean
+validate_type_bytes(const struct Opt *opt, const char *value, const guint32 len)
+{
+    guint32 check_len;
+
+    nm_assert(opt);
+    nm_assert(value);
+
+    check_len = opt->int_high ?: 255;
+    if (len > check_len)
+        return FALSE;
+
+    return TRUE;
+}
+
+static gboolean
+validate_type_utf8(const struct Opt *opt, const char *value, const guint32 len)
+{
+    guint32 check_len;
+
+    nm_assert(opt);
+    nm_assert(value);
+
+    check_len = opt->int_high ?: 255;
+    /* Note that we deliberately don't validate the UTF-8, because
+     * some "UTF-8" fields, such as 8021x.password, do not actually
+     * have to be valid UTF-8 */
+    if (g_utf8_strlen(value, len) > check_len)
+        return FALSE;
+
+    return TRUE;
+}
+
+static gboolean
+validate_type_keyword(const struct Opt *opt, const char *value, const guint32 len)
+{
+    gs_free char *value_free = NULL;
+
+    nm_assert(opt);
+    nm_assert(value);
+
+    /* Allow everything */
+    if (!opt->str_allowed)
+        return TRUE;
+
+    value = nm_strndup_a(300, value, len, &value_free);
+
+    /* validate each space-separated word in 'value' */
+
+    while (TRUE) {
+        char *s;
+
+        while (value[0] == ' ')
+            value++;
+
+        if (value[0] == '\0')
+            return TRUE;
+
+        s = strchr(value, ' ');
+        if (s) {
+            s[0] = '\0';
+            s++;
+        }
+
+        if (nm_utils_strv_find_first((char **) opt->str_allowed, -1, value) < 0)
+            return FALSE;
+
+        if (!s)
+            return TRUE;
+
+        value = s;
+    }
+}
+
+NMSupplOptType
+nm_supplicant_settings_verify_setting(const char *key, const char *value, const guint32 len)
+{
+    static const validate_func validate_table[_NM_SUPPL_OPT_TYPE_NUM - 1] = {
+        [NM_SUPPL_OPT_TYPE_INT - 1]     = validate_type_int,
+        [NM_SUPPL_OPT_TYPE_BYTES - 1]   = validate_type_bytes,
+        [NM_SUPPL_OPT_TYPE_UTF8 - 1]    = validate_type_utf8,
+        [NM_SUPPL_OPT_TYPE_KEYWORD - 1] = validate_type_keyword,
+    };
+    const struct Opt *opt;
+    gssize            opt_idx;
+
+    g_return_val_if_fail(key, FALSE);
+    g_return_val_if_fail(value, FALSE);
+
+    if (NM_MORE_ASSERT_ONCE(5)) {
+        gsize i;
+
+        for (i = 0; i < G_N_ELEMENTS(opt_table); i++) {
+            opt = &opt_table[i];
+
+            nm_assert(opt->key);
+            nm_assert(opt->type > NM_SUPPL_OPT_TYPE_INVALID);
+            nm_assert(opt->type < _NM_SUPPL_OPT_TYPE_NUM);
+            if (i > 0)
+                nm_assert(strcmp(opt[-1].key, opt->key) < 0);
+            nm_assert(validate_table[opt->type - 1]);
+
+            nm_assert(!opt->str_allowed || (opt->type == NM_SUPPL_OPT_TYPE_KEYWORD));
+            nm_assert(!opt->str_allowed || NM_PTRARRAY_LEN(opt->str_allowed) > 0);
+
+            nm_assert(opt->int_low == 0 || opt->type == NM_SUPPL_OPT_TYPE_INT);
+
+            nm_assert(opt->int_high == 0
+                      || NM_IN_SET(opt->type,
+                                   NM_SUPPL_OPT_TYPE_INT,
+                                   NM_SUPPL_OPT_TYPE_UTF8,
+                                   NM_SUPPL_OPT_TYPE_BYTES));
+
+            nm_assert(opt->type != NM_SUPPL_OPT_TYPE_INT || opt->int_low < opt->int_high);
+        }
+    }
+
+    opt_idx = nm_utils_array_find_binary_search(opt_table,
+                                                sizeof(opt_table[0]),
+                                                G_N_ELEMENTS(opt_table),
+                                                &key,
+                                                nm_strcmp_p_with_data,
+                                                NULL);
+    if (opt_idx < 0) {
+        if (nm_streq(key, "mode")) {
+            if (len != 1)
+                return NM_SUPPL_OPT_TYPE_INVALID;
+            if (!NM_IN_SET(value[0], '1', '2', '5'))
+                return NM_SUPPL_OPT_TYPE_INVALID;
+            return NM_SUPPL_OPT_TYPE_INT;
+        }
+        return NM_SUPPL_OPT_TYPE_INVALID;
+    }
+
+    opt = &opt_table[opt_idx];
+    if (!((validate_table[opt->type - 1])(opt, value, len)))
+        return NM_SUPPL_OPT_TYPE_INVALID;
+
+    return opt->type;
+}
diff --git a/src/core/supplicant/nm-supplicant-settings-verify.h b/src/core/supplicant/nm-supplicant-settings-verify.h
new file mode 100644
index 00000000..8ba50b67
--- /dev/null
+++ b/src/core/supplicant/nm-supplicant-settings-verify.h
@@ -0,0 +1,22 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2006 - 2008 Red Hat, Inc.
+ */
+
+#ifndef __NETWORKMANAGER_SUPPLICANT_SETTINGS_VERIFY_H__
+#define __NETWORKMANAGER_SUPPLICANT_SETTINGS_VERIFY_H__
+
+typedef enum {
+    NM_SUPPL_OPT_TYPE_INVALID = 0,
+    NM_SUPPL_OPT_TYPE_INT,
+    NM_SUPPL_OPT_TYPE_BYTES,
+    NM_SUPPL_OPT_TYPE_UTF8,
+    NM_SUPPL_OPT_TYPE_KEYWORD,
+    NM_SUPPL_OPT_TYPE_STRING,
+    _NM_SUPPL_OPT_TYPE_NUM,
+} NMSupplOptType;
+
+NMSupplOptType
+nm_supplicant_settings_verify_setting(const char *key, const char *value, const guint32 len);
+
+#endif /* __NETWORKMANAGER_SUPPLICANT_SETTINGS_VERIFY_H__ */
diff --git a/src/core/supplicant/nm-supplicant-types.h b/src/core/supplicant/nm-supplicant-types.h
new file mode 100644
index 00000000..adcf02db
--- /dev/null
+++ b/src/core/supplicant/nm-supplicant-types.h
@@ -0,0 +1,205 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2006 - 2008 Red Hat, Inc.
+ */
+
+#ifndef __NETWORKMANAGER_SUPPLICANT_TYPES_H__
+#define __NETWORKMANAGER_SUPPLICANT_TYPES_H__
+
+#include "c-list/src/c-list.h"
+
+#define NM_WPAS_DBUS_SERVICE   "fi.w1.wpa_supplicant1"
+#define NM_WPAS_DBUS_PATH      "/fi/w1/wpa_supplicant1"
+#define NM_WPAS_DBUS_INTERFACE "fi.w1.wpa_supplicant1"
+
+#if HAVE_WEXT
+    #define NM_WPAS_DEFAULT_WIFI_DRIVER "nl80211,wext"
+#else
+    #define NM_WPAS_DEFAULT_WIFI_DRIVER "nl80211"
+#endif
+
+#define NM_WPAS_DBUS_IFACE_INTERFACE            NM_WPAS_DBUS_INTERFACE ".Interface"
+#define NM_WPAS_DBUS_IFACE_INTERFACE_WPS        NM_WPAS_DBUS_INTERFACE ".Interface.WPS"
+#define NM_WPAS_DBUS_IFACE_INTERFACE_P2P_DEVICE NM_WPAS_DBUS_INTERFACE ".Interface.P2PDevice"
+#define NM_WPAS_DBUS_IFACE_BSS                  NM_WPAS_DBUS_INTERFACE ".BSS"
+#define NM_WPAS_DBUS_IFACE_PEER                 NM_WPAS_DBUS_INTERFACE ".Peer"
+#define NM_WPAS_DBUS_IFACE_GROUP                NM_WPAS_DBUS_INTERFACE ".Group"
+#define NM_WPAS_DBUS_IFACE_NETWORK              NM_WPAS_DBUS_INTERFACE ".Network"
+#define NM_WPAS_ERROR_INVALID_IFACE             NM_WPAS_DBUS_INTERFACE ".InvalidInterface"
+#define NM_WPAS_ERROR_EXISTS_ERROR              NM_WPAS_DBUS_INTERFACE ".InterfaceExists"
+#define NM_WPAS_ERROR_UNKNOWN_IFACE             NM_WPAS_DBUS_INTERFACE ".InterfaceUnknown"
+
+typedef struct _NMSupplicantManager   NMSupplicantManager;
+typedef struct _NMSupplicantInterface NMSupplicantInterface;
+typedef struct _NMSupplicantConfig    NMSupplicantConfig;
+
+/*****************************************************************************/
+
+typedef enum {
+    NM_SUPPL_CAP_TYPE_AP,
+    NM_SUPPL_CAP_TYPE_PMF,
+    NM_SUPPL_CAP_TYPE_FILS,
+    NM_SUPPL_CAP_TYPE_P2P,
+    NM_SUPPL_CAP_TYPE_FT,
+    NM_SUPPL_CAP_TYPE_SHA384,
+    NM_SUPPL_CAP_TYPE_MESH,
+    NM_SUPPL_CAP_TYPE_FAST,
+    NM_SUPPL_CAP_TYPE_WFD,
+    NM_SUPPL_CAP_TYPE_SUITEB192,
+    _NM_SUPPL_CAP_TYPE_NUM,
+} NMSupplCapType;
+
+#define NM_SUPPL_CAP_MASK_NO(type)   ((NMSupplCapMask)(1llu << ((type) *2u)))
+#define NM_SUPPL_CAP_MASK_YES(type)  ((NMSupplCapMask)(2llu << ((type) *2u)))
+#define NM_SUPPL_CAP_MASK_MASK(type) ((NMSupplCapMask)(3llu << ((type) *2u)))
+
+typedef enum {
+    NM_SUPPL_CAP_MASK_NONE = 0,
+    NM_SUPPL_CAP_MASK_ALL  = ((1llu << (_NM_SUPPL_CAP_TYPE_NUM * 2)) - 1),
+
+/* usually it's bad to use macros to define enum values (because you cannot find them with ctags/cscope
+ * anymore. In this case, still do it because the alternative is ugly too. */
+#define _NM_SUPPL_CAP_MASK_DEFINE(type)                                              \
+    NM_SUPPL_CAP_MASK_T_##type##_NO   = (1llu << ((NM_SUPPL_CAP_TYPE_##type) * 2u)), \
+    NM_SUPPL_CAP_MASK_T_##type##_YES  = (2llu << ((NM_SUPPL_CAP_TYPE_##type) * 2u)), \
+    NM_SUPPL_CAP_MASK_T_##type##_MASK = (3llu << ((NM_SUPPL_CAP_TYPE_##type) * 2u))
+    _NM_SUPPL_CAP_MASK_DEFINE(AP),
+    _NM_SUPPL_CAP_MASK_DEFINE(FAST),
+    _NM_SUPPL_CAP_MASK_DEFINE(PMF),
+    _NM_SUPPL_CAP_MASK_DEFINE(FILS),
+    _NM_SUPPL_CAP_MASK_DEFINE(P2P),
+    _NM_SUPPL_CAP_MASK_DEFINE(MESH),
+    _NM_SUPPL_CAP_MASK_DEFINE(WFD),
+    _NM_SUPPL_CAP_MASK_DEFINE(FT),
+    _NM_SUPPL_CAP_MASK_DEFINE(SHA384),
+#undef _NM_SUPPL_CAP_MASK_DEFINE
+} NMSupplCapMask;
+
+static inline NMSupplCapMask
+NM_SUPPL_CAP_MASK_SET(NMSupplCapMask features, NMSupplCapType type, NMTernary value)
+{
+    nm_assert(_NM_INT_NOT_NEGATIVE(type));
+    nm_assert(type < _NM_SUPPL_CAP_TYPE_NUM);
+    nm_assert(NM_IN_SET(value, NM_TERNARY_DEFAULT, NM_TERNARY_TRUE, NM_TERNARY_FALSE));
+    nm_assert(!(features & ~NM_SUPPL_CAP_MASK_ALL));
+
+    features &= ~NM_SUPPL_CAP_MASK_MASK(type);
+    switch (value) {
+    case NM_TERNARY_FALSE:
+        features |= NM_SUPPL_CAP_MASK_NO(type);
+        break;
+    case NM_TERNARY_TRUE:
+        features |= NM_SUPPL_CAP_MASK_YES(type);
+        break;
+    case NM_TERNARY_DEFAULT:
+        break;
+    }
+
+    return features;
+}
+
+static inline NMTernary
+NM_SUPPL_CAP_MASK_GET(NMSupplCapMask features, NMSupplCapType type)
+{
+    int f;
+
+    nm_assert(_NM_INT_NOT_NEGATIVE(type));
+    nm_assert(type < _NM_SUPPL_CAP_TYPE_NUM);
+    nm_assert(!(features & ~NM_SUPPL_CAP_MASK_ALL));
+
+    f = ((int) (features >> (2 * (int) type))) & 0x3;
+
+    nm_assert(NM_IN_SET(f, 0, 1, 2));
+
+    return (NMTernary)(f - 1);
+}
+
+/*****************************************************************************/
+
+/**
+ * NMSupplicantError:
+ * @NM_SUPPLICANT_ERROR_UNKNOWN: unknown or unclassified error
+ * @NM_SUPPLICANT_ERROR_CONFIG: a failure constructing the
+ *   wpa-supplicant configuration.
+ */
+typedef enum {
+    NM_SUPPLICANT_ERROR_UNKNOWN = 0, /*< nick=Unknown >*/
+    NM_SUPPLICANT_ERROR_CONFIG  = 1, /*< nick=Config >*/
+} NMSupplicantError;
+
+typedef enum {
+    NM_SUPPLICANT_DRIVER_UNKNOWN,
+    NM_SUPPLICANT_DRIVER_WIRELESS,
+    NM_SUPPLICANT_DRIVER_WIRED,
+    NM_SUPPLICANT_DRIVER_MACSEC,
+} NMSupplicantDriver;
+
+const char *nm_supplicant_driver_to_string(NMSupplicantDriver driver);
+
+#define NM_SUPPLICANT_ERROR (nm_supplicant_error_quark())
+GQuark nm_supplicant_error_quark(void);
+
+typedef struct _NMSupplicantBssInfo {
+    NMRefString *bss_path;
+
+    NMSupplicantInterface *_self;
+    CList                  _bss_lst;
+    GCancellable *         _init_cancellable;
+
+    GBytes *ssid;
+
+    gint64 last_seen_msec;
+
+    NM80211ApSecurityFlags wpa_flags; /* WPA-related flags */
+    NM80211ApSecurityFlags rsn_flags; /* RSN (WPA2) -related flags */
+
+    guint32 frequency;
+
+    guint32 max_rate;
+
+    guint8 signal_percent;
+
+    NMEtherAddr bssid;
+
+    NM80211ApFlags ap_flags : 5;
+
+    NM80211Mode mode : 4;
+
+    bool bssid_valid : 1;
+
+    bool metered : 1;
+
+    bool _bss_dirty : 1;
+
+} NMSupplicantBssInfo;
+
+typedef struct _NMSupplicantPeerInfo {
+    NMRefString *peer_path;
+
+    CList                  _peer_lst;
+    NMSupplicantInterface *_self;
+    GCancellable *         _init_cancellable;
+
+    char *device_name;
+    char *manufacturer;
+    char *model;
+    char *model_number;
+    char *serial;
+
+    const char **groups;
+
+    GBytes *ies;
+
+    gint64 last_seen_msec;
+
+    guint8 address[6 /* ETH_ALEN */];
+
+    gint8 signal_percent;
+
+    bool address_valid : 1;
+
+    bool _peer_dirty : 1;
+
+} NMSupplicantPeerInfo;
+
+#endif /* NM_SUPPLICANT_TYPES_H */
diff --git a/src/core/supplicant/tests/certs/test-ca-cert.pem b/src/core/supplicant/tests/certs/test-ca-cert.pem
new file mode 100644
index 00000000..ef1be20d
--- /dev/null
+++ b/src/core/supplicant/tests/certs/test-ca-cert.pem
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEjzCCA3egAwIBAgIJAOvnZPt59yIZMA0GCSqGSIb3DQEBBQUAMIGLMQswCQYD
+VQQGEwJVUzESMBAGA1UECBMJQmVya3NoaXJlMRAwDgYDVQQHEwdOZXdidXJ5MRcw
+FQYDVQQKEw5NeSBDb21wYW55IEx0ZDEQMA4GA1UECxMHVGVzdGluZzENMAsGA1UE
+AxMEdGVzdDEcMBoGCSqGSIb3DQEJARYNdGVzdEB0ZXN0LmNvbTAeFw0wOTAzMTAx
+NTEyMTRaFw0xOTAzMDgxNTEyMTRaMIGLMQswCQYDVQQGEwJVUzESMBAGA1UECBMJ
+QmVya3NoaXJlMRAwDgYDVQQHEwdOZXdidXJ5MRcwFQYDVQQKEw5NeSBDb21wYW55
+IEx0ZDEQMA4GA1UECxMHVGVzdGluZzENMAsGA1UEAxMEdGVzdDEcMBoGCSqGSIb3
+DQEJARYNdGVzdEB0ZXN0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAKot9j+/+CX1/gZLgJHIXCRgCItKLGnf7qGbgqB9T2ACBqR0jllKWwDKrcWU
+xjXNIc+GF9Wnv+lX6G0Okn4Zt3/uRNobL+2b/yOF7M3Td3/9W873zdkQQX930YZc
+Rr8uxdRPP5bxiCgtcw632y21sSEbG9mjccAUnV/0jdvfmMNj0i8gN6E0fMBiJ9S3
+FkxX/KFvt9JWE9CtoyL7ki7UIDq+6vj7Gd5N0B3dOa1y+rRHZzKlJPcSXQSEYUS4
+HmKDwiKSVahft8c4tDn7KPi0vex91hlgZVd3usL2E/Vq7o5D9FAZ5kZY0AdFXwdm
+J4lO4Mj7ac7GE4vNERNcXVIX59sCAwEAAaOB8zCB8DAdBgNVHQ4EFgQUuDU3Mr7P
+T3n1e3Sy8hBauoDFahAwgcAGA1UdIwSBuDCBtYAUuDU3Mr7PT3n1e3Sy8hBauoDF
+ahChgZGkgY4wgYsxCzAJBgNVBAYTAlVTMRIwEAYDVQQIEwlCZXJrc2hpcmUxEDAO
+BgNVBAcTB05ld2J1cnkxFzAVBgNVBAoTDk15IENvbXBhbnkgTHRkMRAwDgYDVQQL
+EwdUZXN0aW5nMQ0wCwYDVQQDEwR0ZXN0MRwwGgYJKoZIhvcNAQkBFg10ZXN0QHRl
+c3QuY29tggkA6+dk+3n3IhkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOC
+AQEAVRG4aALIvCXCiKfe7K+iJxjBVRDFPEf7JWA9LGgbFOn6pNvbxonrR+0BETdc
+JV1ET4ct2xsE7QNFIkp9GKRC+6J32zCo8qtLCD5+v436r8TUG2/t2JRMkb9I2XVT
+p7RJoot6M0Ltf8KNQUPYh756xmKZ4USfQUwc58MOSDGY8VWEXJOYij9Pf0e0c52t
+qiCEjXH7uXiS8Pgq9TYm7AkWSOrglYhSa83x0f8mtT8Q15nBESIHZ6o8FAS2bBgn
+B0BkrKRjtBUkuJG3vTox+bYINh2Gxi1JZHWSV1tN5z3hd4VFcKqanW5OgQwToBqp
+3nniskIjbH0xjgZf/nVMyLnjxg==
+-----END CERTIFICATE-----
diff --git a/src/core/supplicant/tests/certs/test-cert.p12 b/src/core/supplicant/tests/certs/test-cert.p12
new file mode 100644
index 00000000..ae4a6830
--- /dev/null
+++ b/src/core/supplicant/tests/certs/test-cert.p12
Binary files differdiff --git a/src/core/supplicant/tests/meson.build b/src/core/supplicant/tests/meson.build
new file mode 100644
index 00000000..88832a9b
--- /dev/null
+++ b/src/core/supplicant/tests/meson.build
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+test_unit = 'test-supplicant-config'
+
+exe = executable(
+  test_unit,
+  test_unit + '.c',
+  dependencies: libNetworkManagerTest_dep,
+  c_args: test_c_flags,
+)
+
+test(
+  'supplicant/' + test_unit,
+  test_script,
+  args: test_args + [exe.full_path()],
+  timeout: default_test_timeout,
+)
diff --git a/src/core/supplicant/tests/test-supplicant-config.c b/src/core/supplicant/tests/test-supplicant-config.c
new file mode 100644
index 00000000..99729c18
--- /dev/null
+++ b/src/core/supplicant/tests/test-supplicant-config.c
@@ -0,0 +1,909 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2008 - 2011 Red Hat, Inc.
+ */
+
+#include "src/core/nm-default-daemon.h"
+
+#include <stdio.h>
+#include <stdarg.h>
+#include <unistd.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include "nm-core-internal.h"
+
+#include "supplicant/nm-supplicant-config.h"
+#include "supplicant/nm-supplicant-settings-verify.h"
+
+#include "nm-test-utils-core.h"
+
+#define TEST_CERT_DIR NM_BUILD_SRCDIR "/src/core/supplicant/tests/certs"
+
+/*****************************************************************************/
+
+static gboolean
+validate_opt(const char *   detail,
+             GVariant *     config,
+             const char *   key,
+             NMSupplOptType val_type,
+             gconstpointer  expected)
+{
+    char *       config_key;
+    GVariant *   config_value;
+    gboolean     found = FALSE;
+    GVariantIter iter;
+
+    g_assert(g_variant_is_of_type(config, G_VARIANT_TYPE_VARDICT));
+
+    g_variant_iter_init(&iter, config);
+    while (g_variant_iter_next(&iter, "{&sv}", (gpointer) &config_key, (gpointer) &config_value)) {
+        if (!strcmp(key, config_key)) {
+            found = TRUE;
+            switch (val_type) {
+            case NM_SUPPL_OPT_TYPE_INT:
+            {
+                g_assert(g_variant_is_of_type(config_value, G_VARIANT_TYPE_INT32));
+                g_assert_cmpint(g_variant_get_int32(config_value), ==, GPOINTER_TO_INT(expected));
+                break;
+            }
+            case NM_SUPPL_OPT_TYPE_BYTES:
+            {
+                const guint8 *expected_bytes;
+                gsize         expected_len = 0;
+                const guint8 *config_bytes;
+                gsize         config_len = 0;
+
+                expected_bytes = g_bytes_get_data((GBytes *) expected, &expected_len);
+                g_assert(g_variant_is_of_type(config_value, G_VARIANT_TYPE_BYTESTRING));
+                config_bytes = g_variant_get_fixed_array(config_value, &config_len, 1);
+                g_assert_cmpmem(config_bytes, config_len, expected_bytes, expected_len);
+                break;
+            }
+            case NM_SUPPL_OPT_TYPE_KEYWORD:
+            case NM_SUPPL_OPT_TYPE_STRING:
+            {
+                const char *expected_str = expected;
+                const char *config_str;
+
+                g_assert(g_variant_is_of_type(config_value, G_VARIANT_TYPE_STRING));
+                config_str = g_variant_get_string(config_value, NULL);
+                g_assert_cmpstr(config_str, ==, expected_str);
+                break;
+            }
+            default:
+                g_assert_not_reached();
+                break;
+            }
+        }
+        g_variant_unref(config_value);
+    }
+
+    return found;
+}
+
+static GVariant *
+build_supplicant_config(NMConnection * connection,
+                        guint          mtu,
+                        guint          fixed_freq,
+                        NMSupplCapMask capabilities)
+{
+    gs_unref_object NMSupplicantConfig *config = NULL;
+    gs_free_error GError *     error           = NULL;
+    NMSettingWireless *        s_wifi;
+    NMSettingWirelessSecurity *s_wsec;
+    NMSetting8021x *           s_8021x;
+    gboolean                   success;
+
+    config = nm_supplicant_config_new(capabilities);
+
+    s_wifi = nm_connection_get_setting_wireless(connection);
+    g_assert(s_wifi);
+    success = nm_supplicant_config_add_setting_wireless(config, s_wifi, fixed_freq, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    s_wsec = nm_connection_get_setting_wireless_security(connection);
+    if (s_wsec) {
+        NMSettingWirelessSecurityPmf  pmf  = nm_setting_wireless_security_get_pmf(s_wsec);
+        NMSettingWirelessSecurityFils fils = nm_setting_wireless_security_get_fils(s_wsec);
+        s_8021x                            = nm_connection_get_setting_802_1x(connection);
+        success =
+            nm_supplicant_config_add_setting_wireless_security(config,
+                                                               s_wsec,
+                                                               s_8021x,
+                                                               nm_connection_get_uuid(connection),
+                                                               mtu,
+                                                               pmf,
+                                                               fils,
+                                                               &error);
+    } else {
+        success = nm_supplicant_config_add_no_security(config, &error);
+    }
+    g_assert_no_error(error);
+    g_assert(success);
+
+    success = nm_supplicant_config_add_bgscan(config, connection, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    return nm_supplicant_config_to_variant(config);
+}
+
+static NMConnection *
+new_basic_connection(const char *id, GBytes *ssid, const char *bssid_str)
+{
+    NMConnection *       connection;
+    NMSettingConnection *s_con;
+    NMSettingWireless *  s_wifi;
+    NMSettingIPConfig *  s_ip4;
+    gs_free char *       uuid = nm_utils_uuid_generate();
+
+    connection = nm_simple_connection_new();
+
+    /* Connection setting */
+    s_con = (NMSettingConnection *) nm_setting_connection_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_con));
+    g_object_set(s_con,
+                 NM_SETTING_CONNECTION_ID,
+                 id,
+                 NM_SETTING_CONNECTION_UUID,
+                 uuid,
+                 NM_SETTING_CONNECTION_AUTOCONNECT,
+                 TRUE,
+                 NM_SETTING_CONNECTION_TYPE,
+                 NM_SETTING_WIRELESS_SETTING_NAME,
+                 NULL);
+
+    /* Wifi setting */
+    s_wifi = (NMSettingWireless *) nm_setting_wireless_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_wifi));
+    g_object_set(s_wifi,
+                 NM_SETTING_WIRELESS_SSID,
+                 ssid,
+                 NM_SETTING_WIRELESS_BSSID,
+                 bssid_str,
+                 NM_SETTING_WIRELESS_MODE,
+                 "infrastructure",
+                 NM_SETTING_WIRELESS_BAND,
+                 "bg",
+                 NULL);
+
+    /* IP4 setting */
+    s_ip4 = (NMSettingIPConfig *) nm_setting_ip4_config_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_ip4));
+    g_object_set(s_ip4, NM_SETTING_IP_CONFIG_METHOD, NM_SETTING_IP4_CONFIG_METHOD_AUTO, NULL);
+
+    return connection;
+}
+
+static void
+test_wifi_open(void)
+{
+    gs_unref_object NMConnection *connection = NULL;
+    gs_unref_variant GVariant *config_dict   = NULL;
+    gboolean                   success;
+    GError *                   error       = NULL;
+    const unsigned char        ssid_data[] = {0x54, 0x65, 0x73, 0x74, 0x20, 0x53, 0x53, 0x49, 0x44};
+    gs_unref_bytes GBytes *ssid            = g_bytes_new(ssid_data, sizeof(ssid_data));
+    const char *           bssid_str       = "11:22:33:44:55:66";
+
+    connection = new_basic_connection("Test Wifi Open", ssid, bssid_str);
+    success    = nm_connection_verify(connection, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    NMTST_EXPECT_NM_INFO("Config: added 'ssid' value 'Test SSID'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'scan_ssid' value '1'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'bssid' value '11:22:33:44:55:66'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'freq_list' value *");
+    NMTST_EXPECT_NM_INFO("Config: added 'key_mgmt' value 'NONE'");
+    config_dict =
+        build_supplicant_config(connection,
+                                1500,
+                                0,
+                                NM_SUPPL_CAP_MASK_T_PMF_YES | NM_SUPPL_CAP_MASK_T_FILS_YES);
+    g_test_assert_expected_messages();
+    g_assert(config_dict);
+
+    validate_opt("wifi-open", config_dict, "scan_ssid", NM_SUPPL_OPT_TYPE_INT, GINT_TO_POINTER(1));
+    validate_opt("wifi-open", config_dict, "ssid", NM_SUPPL_OPT_TYPE_BYTES, ssid);
+    validate_opt("wifi-open", config_dict, "bssid", NM_SUPPL_OPT_TYPE_KEYWORD, bssid_str);
+    validate_opt("wifi-open", config_dict, "key_mgmt", NM_SUPPL_OPT_TYPE_KEYWORD, "NONE");
+}
+
+static void
+test_wifi_wep_key(const char *         detail,
+                  gboolean             test_bssid,
+                  NMWepKeyType         wep_type,
+                  const char *         key_data,
+                  const unsigned char *expected,
+                  size_t               expected_size)
+{
+    gs_unref_object NMConnection *connection = NULL;
+    gs_unref_variant GVariant *config_dict   = NULL;
+    NMSettingWirelessSecurity *s_wsec;
+    gboolean                   success;
+    GError *                   error       = NULL;
+    const unsigned char        ssid_data[] = {0x54, 0x65, 0x73, 0x74, 0x20, 0x53, 0x53, 0x49, 0x44};
+    gs_unref_bytes GBytes *ssid            = g_bytes_new(ssid_data, sizeof(ssid_data));
+    const char *           bssid_str       = "11:22:33:44:55:66";
+    gs_unref_bytes GBytes *wep_key_bytes   = g_bytes_new(expected, expected_size);
+    const char *           bgscan_data     = "simple:30:-70:86400";
+    gs_unref_bytes GBytes *bgscan          = g_bytes_new(bgscan_data, strlen(bgscan_data));
+
+    connection = new_basic_connection("Test Wifi WEP Key", ssid, test_bssid ? bssid_str : NULL);
+
+    /* Wifi Security setting */
+    s_wsec = (NMSettingWirelessSecurity *) nm_setting_wireless_security_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_wsec));
+    g_object_set(s_wsec,
+                 NM_SETTING_WIRELESS_SECURITY_KEY_MGMT,
+                 "none",
+                 NM_SETTING_WIRELESS_SECURITY_WEP_KEY_TYPE,
+                 wep_type,
+                 NULL);
+    nm_setting_wireless_security_set_wep_key(s_wsec, 0, key_data);
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    NMTST_EXPECT_NM_INFO("Config: added 'ssid' value 'Test SSID'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'scan_ssid' value '1'*");
+    if (test_bssid)
+        NMTST_EXPECT_NM_INFO("Config: added 'bssid' value '11:22:33:44:55:66'*");
+
+    NMTST_EXPECT_NM_INFO("Config: added 'freq_list' value *");
+    NMTST_EXPECT_NM_INFO("Config: added 'key_mgmt' value 'NONE'");
+    NMTST_EXPECT_NM_INFO("Config: added 'wep_key0' value *");
+    NMTST_EXPECT_NM_INFO("Config: added 'wep_tx_keyidx' value '0'");
+    if (!test_bssid)
+        NMTST_EXPECT_NM_INFO("Config: added 'bgscan' value 'simple:30:-70:86400'*");
+
+    config_dict =
+        build_supplicant_config(connection,
+                                1500,
+                                0,
+                                NM_SUPPL_CAP_MASK_T_PMF_YES | NM_SUPPL_CAP_MASK_T_FILS_YES);
+    g_test_assert_expected_messages();
+    g_assert(config_dict);
+
+    validate_opt(detail, config_dict, "scan_ssid", NM_SUPPL_OPT_TYPE_INT, GINT_TO_POINTER(1));
+    validate_opt(detail, config_dict, "ssid", NM_SUPPL_OPT_TYPE_BYTES, ssid);
+    if (test_bssid)
+        validate_opt(detail, config_dict, "bssid", NM_SUPPL_OPT_TYPE_KEYWORD, bssid_str);
+    else
+        validate_opt(detail, config_dict, "bgscan", NM_SUPPL_OPT_TYPE_BYTES, bgscan);
+
+    validate_opt(detail, config_dict, "key_mgmt", NM_SUPPL_OPT_TYPE_KEYWORD, "NONE");
+    validate_opt(detail, config_dict, "wep_tx_keyidx", NM_SUPPL_OPT_TYPE_INT, GINT_TO_POINTER(0));
+    validate_opt(detail, config_dict, "wep_key0", NM_SUPPL_OPT_TYPE_BYTES, wep_key_bytes);
+}
+
+static void
+test_wifi_wep(void)
+{
+    const char *        key1            = "12345";
+    const unsigned char key1_expected[] = {0x31, 0x32, 0x33, 0x34, 0x35};
+    const char *        key2            = "ascii test$$$";
+    const unsigned char key2_expected[] =
+        {0x61, 0x73, 0x63, 0x69, 0x69, 0x20, 0x74, 0x65, 0x73, 0x74, 0x24, 0x24, 0x24};
+    const char *        key3            = "abcdef1234";
+    const unsigned char key3_expected[] = {0xab, 0xcd, 0xef, 0x12, 0x34};
+    const char *        key4            = "96aec785c6392675f87f592972";
+    const unsigned char key4_expected[] =
+        {0x96, 0xae, 0xc7, 0x85, 0xc6, 0x39, 0x26, 0x75, 0xf8, 0x7f, 0x59, 0x29, 0x72};
+    const char *        key5 = "r34lly l33t w3p p4ssphr4s3 for t3st1ng";
+    const unsigned char key5_expected[] =
+        {0xce, 0x68, 0x8b, 0x35, 0xf6, 0x0a, 0x2b, 0xbf, 0xc9, 0x8f, 0xed, 0x10, 0xda};
+
+    test_wifi_wep_key("wifi-wep-ascii-40",
+                      TRUE,
+                      NM_WEP_KEY_TYPE_KEY,
+                      key1,
+                      key1_expected,
+                      sizeof(key1_expected));
+    test_wifi_wep_key("wifi-wep-ascii-104",
+                      TRUE,
+                      NM_WEP_KEY_TYPE_KEY,
+                      key2,
+                      key2_expected,
+                      sizeof(key2_expected));
+    test_wifi_wep_key("wifi-wep-hex-40",
+                      TRUE,
+                      NM_WEP_KEY_TYPE_KEY,
+                      key3,
+                      key3_expected,
+                      sizeof(key3_expected));
+    test_wifi_wep_key("wifi-wep-hex-104",
+                      TRUE,
+                      NM_WEP_KEY_TYPE_KEY,
+                      key4,
+                      key4_expected,
+                      sizeof(key4_expected));
+    test_wifi_wep_key("wifi-wep-passphrase-104",
+                      TRUE,
+                      NM_WEP_KEY_TYPE_PASSPHRASE,
+                      key5,
+                      key5_expected,
+                      sizeof(key5_expected));
+
+    test_wifi_wep_key("wifi-wep-old-hex-104",
+                      TRUE,
+                      NM_WEP_KEY_TYPE_UNKNOWN,
+                      key4,
+                      key4_expected,
+                      sizeof(key4_expected));
+
+    /* Unlocked BSSID to test bgscan */
+    test_wifi_wep_key("wifi-wep-hex-40",
+                      FALSE,
+                      NM_WEP_KEY_TYPE_KEY,
+                      key3,
+                      key3_expected,
+                      sizeof(key3_expected));
+}
+
+static void
+test_wifi_wpa_psk(const char *                 detail,
+                  NMSupplOptType               key_type,
+                  const char *                 key_data,
+                  const unsigned char *        expected,
+                  size_t                       expected_size,
+                  NMSettingWirelessSecurityPmf pmf)
+{
+    gs_unref_object NMConnection *connection = NULL;
+    gs_unref_variant GVariant *config_dict   = NULL;
+    NMSettingWirelessSecurity *s_wsec;
+    gboolean                   success;
+    GError *                   error       = NULL;
+    const unsigned char        ssid_data[] = {0x54, 0x65, 0x73, 0x74, 0x20, 0x53, 0x53, 0x49, 0x44};
+    gs_unref_bytes GBytes *ssid            = g_bytes_new(ssid_data, sizeof(ssid_data));
+    const char *           bssid_str       = "11:22:33:44:55:66";
+    gs_unref_bytes GBytes *wpa_psk_bytes   = g_bytes_new(expected, expected_size);
+
+    connection = new_basic_connection("Test Wifi WPA PSK", ssid, bssid_str);
+
+    /* Wifi Security setting */
+    s_wsec = (NMSettingWirelessSecurity *) nm_setting_wireless_security_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_wsec));
+    g_object_set(s_wsec,
+                 NM_SETTING_WIRELESS_SECURITY_KEY_MGMT,
+                 "wpa-psk",
+                 NM_SETTING_WIRELESS_SECURITY_PSK,
+                 key_data,
+                 NM_SETTING_WIRELESS_SECURITY_PMF,
+                 (int) pmf,
+                 NULL);
+    nm_setting_wireless_security_add_proto(s_wsec, "wpa");
+    nm_setting_wireless_security_add_proto(s_wsec, "rsn");
+    nm_setting_wireless_security_add_pairwise(s_wsec, "tkip");
+    nm_setting_wireless_security_add_pairwise(s_wsec, "ccmp");
+    nm_setting_wireless_security_add_group(s_wsec, "tkip");
+    nm_setting_wireless_security_add_group(s_wsec, "ccmp");
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    NMTST_EXPECT_NM_INFO("Config: added 'ssid' value 'Test SSID'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'scan_ssid' value '1'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'bssid' value '11:22:33:44:55:66'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'freq_list' value *");
+    NMTST_EXPECT_NM_INFO("Config: added 'key_mgmt' value 'WPA-PSK WPA-PSK-SHA256'");
+    NMTST_EXPECT_NM_INFO("Config: added 'psk' value *");
+    NMTST_EXPECT_NM_INFO("Config: added 'proto' value 'WPA RSN'");
+    NMTST_EXPECT_NM_INFO("Config: added 'pairwise' value 'TKIP CCMP'");
+    NMTST_EXPECT_NM_INFO("Config: added 'group' value 'TKIP CCMP'");
+    switch (pmf) {
+    case NM_SETTING_WIRELESS_SECURITY_PMF_DISABLE:
+        NMTST_EXPECT_NM_INFO("Config: added 'ieee80211w' value '0'");
+        break;
+    case NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED:
+        NMTST_EXPECT_NM_INFO("Config: added 'ieee80211w' value '2'");
+        break;
+    default:
+        break;
+    }
+    config_dict =
+        build_supplicant_config(connection,
+                                1500,
+                                0,
+                                NM_SUPPL_CAP_MASK_T_PMF_YES | NM_SUPPL_CAP_MASK_T_FILS_YES);
+
+    g_test_assert_expected_messages();
+    g_assert(config_dict);
+
+    validate_opt(detail, config_dict, "scan_ssid", NM_SUPPL_OPT_TYPE_INT, GINT_TO_POINTER(1));
+    validate_opt(detail, config_dict, "ssid", NM_SUPPL_OPT_TYPE_BYTES, ssid);
+    validate_opt(detail, config_dict, "bssid", NM_SUPPL_OPT_TYPE_KEYWORD, bssid_str);
+    validate_opt(detail,
+                 config_dict,
+                 "key_mgmt",
+                 NM_SUPPL_OPT_TYPE_KEYWORD,
+                 "WPA-PSK WPA-PSK-SHA256");
+    validate_opt(detail, config_dict, "proto", NM_SUPPL_OPT_TYPE_KEYWORD, "WPA RSN");
+    validate_opt(detail, config_dict, "pairwise", NM_SUPPL_OPT_TYPE_KEYWORD, "TKIP CCMP");
+    validate_opt(detail, config_dict, "group", NM_SUPPL_OPT_TYPE_KEYWORD, "TKIP CCMP");
+    if (key_type == NM_SUPPL_OPT_TYPE_BYTES)
+        validate_opt(detail, config_dict, "psk", key_type, wpa_psk_bytes);
+    else if (key_type == NM_SUPPL_OPT_TYPE_STRING)
+        validate_opt(detail, config_dict, "psk", key_type, expected);
+    else
+        g_assert_not_reached();
+}
+
+static void
+test_wifi_sae_psk(const char *psk)
+{
+    gs_unref_object NMConnection *connection = NULL;
+    gs_unref_variant GVariant *config_dict   = NULL;
+    NMSettingWirelessSecurity *s_wsec;
+    gboolean                   success;
+    GError *                   error       = NULL;
+    const unsigned char        ssid_data[] = {0x54, 0x65, 0x73, 0x74, 0x20, 0x53, 0x53, 0x49, 0x44};
+    gs_unref_bytes GBytes *ssid            = g_bytes_new(ssid_data, sizeof(ssid_data));
+    const char *           bssid_str       = "11:22:33:44:55:66";
+    int                    short_psk       = strlen(psk) < 8;
+
+    connection = new_basic_connection("Test Wifi SAE", ssid, bssid_str);
+
+    /* Wifi Security setting */
+    s_wsec = (NMSettingWirelessSecurity *) nm_setting_wireless_security_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_wsec));
+    g_object_set(s_wsec,
+                 NM_SETTING_WIRELESS_SECURITY_KEY_MGMT,
+                 "sae",
+                 NM_SETTING_WIRELESS_SECURITY_PSK,
+                 psk,
+                 NULL);
+    nm_setting_wireless_security_add_proto(s_wsec, "rsn");
+    nm_setting_wireless_security_add_pairwise(s_wsec, "tkip");
+    nm_setting_wireless_security_add_pairwise(s_wsec, "ccmp");
+    nm_setting_wireless_security_add_group(s_wsec, "tkip");
+    nm_setting_wireless_security_add_group(s_wsec, "ccmp");
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    NMTST_EXPECT_NM_INFO("Config: added 'ssid' value 'Test SSID'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'scan_ssid' value '1'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'bssid' value '11:22:33:44:55:66'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'freq_list' value *");
+    NMTST_EXPECT_NM_INFO("Config: added 'key_mgmt' value 'SAE'");
+    if (short_psk)
+        NMTST_EXPECT_NM_INFO("Config: added 'sae_password' value *");
+    else
+        NMTST_EXPECT_NM_INFO("Config: added 'psk' value *");
+    NMTST_EXPECT_NM_INFO("Config: added 'proto' value 'RSN'");
+    NMTST_EXPECT_NM_INFO("Config: added 'pairwise' value 'TKIP CCMP'");
+    NMTST_EXPECT_NM_INFO("Config: added 'group' value 'TKIP CCMP'");
+    config_dict =
+        build_supplicant_config(connection,
+                                1500,
+                                0,
+                                NM_SUPPL_CAP_MASK_T_PMF_YES | NM_SUPPL_CAP_MASK_T_FILS_YES);
+
+    g_test_assert_expected_messages();
+    g_assert(config_dict);
+
+    validate_opt("wifi-sae", config_dict, "scan_ssid", NM_SUPPL_OPT_TYPE_INT, GINT_TO_POINTER(1));
+    validate_opt("wifi-sae", config_dict, "ssid", NM_SUPPL_OPT_TYPE_BYTES, ssid);
+    validate_opt("wifi-sae", config_dict, "bssid", NM_SUPPL_OPT_TYPE_KEYWORD, bssid_str);
+    validate_opt("wifi-sae", config_dict, "key_mgmt", NM_SUPPL_OPT_TYPE_KEYWORD, "SAE");
+    validate_opt("wifi-sae", config_dict, "proto", NM_SUPPL_OPT_TYPE_KEYWORD, "RSN");
+    validate_opt("wifi-sae", config_dict, "pairwise", NM_SUPPL_OPT_TYPE_KEYWORD, "TKIP CCMP");
+    validate_opt("wifi-sae", config_dict, "group", NM_SUPPL_OPT_TYPE_KEYWORD, "TKIP CCMP");
+    if (short_psk)
+        validate_opt("wifi-sae", config_dict, "sae_password", NM_SUPPL_OPT_TYPE_KEYWORD, psk);
+    else
+        validate_opt("wifi-sae", config_dict, "psk", NM_SUPPL_OPT_TYPE_KEYWORD, psk);
+}
+
+static void
+test_wifi_sae(void)
+{
+    test_wifi_sae_psk("Moo");
+    test_wifi_sae_psk("Hello World!");
+}
+
+static void
+test_wifi_wpa_psk_types(void)
+{
+    const char *        key1 = "d4721e911461d3cdef9793858e977fcda091779243abb7316c2f11605a160893";
+    const unsigned char key1_expected[] = {0xd4, 0x72, 0x1e, 0x91, 0x14, 0x61, 0xd3, 0xcd,
+                                           0xef, 0x97, 0x93, 0x85, 0x8e, 0x97, 0x7f, 0xcd,
+                                           0xa0, 0x91, 0x77, 0x92, 0x43, 0xab, 0xb7, 0x31,
+                                           0x6c, 0x2f, 0x11, 0x60, 0x5a, 0x16, 0x08, 0x93};
+    const char *        key2            = "r34lly l33t wp4 p4ssphr4s3 for t3st1ng";
+
+    test_wifi_wpa_psk("wifi-wpa-psk-hex",
+                      NM_SUPPL_OPT_TYPE_BYTES,
+                      key1,
+                      key1_expected,
+                      sizeof(key1_expected),
+                      NM_SETTING_WIRELESS_SECURITY_PMF_OPTIONAL);
+    test_wifi_wpa_psk("wifi-wep-psk-passphrase",
+                      NM_SUPPL_OPT_TYPE_STRING,
+                      key2,
+                      (gconstpointer) key2,
+                      strlen(key2),
+                      NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED);
+    test_wifi_wpa_psk("pmf-disabled",
+                      NM_SUPPL_OPT_TYPE_STRING,
+                      key2,
+                      (gconstpointer) key2,
+                      strlen(key2),
+                      NM_SETTING_WIRELESS_SECURITY_PMF_DISABLE);
+}
+
+static NMConnection *
+generate_wifi_eap_connection(const char *                  id,
+                             GBytes *                      ssid,
+                             const char *                  bssid_str,
+                             NMSettingWirelessSecurityFils fils)
+{
+    NMConnection *             connection = NULL;
+    NMSettingWirelessSecurity *s_wsec;
+    NMSetting8021x *           s_8021x;
+    gboolean                   success;
+    GError *                   error = NULL;
+
+    connection = new_basic_connection(id, ssid, bssid_str);
+
+    /* Wifi Security setting */
+    s_wsec = (NMSettingWirelessSecurity *) nm_setting_wireless_security_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_wsec));
+    g_object_set(s_wsec,
+                 NM_SETTING_WIRELESS_SECURITY_KEY_MGMT,
+                 "wpa-eap",
+                 NM_SETTING_WIRELESS_SECURITY_FILS,
+                 (int) fils,
+                 NULL);
+    nm_setting_wireless_security_add_proto(s_wsec, "wpa");
+    nm_setting_wireless_security_add_proto(s_wsec, "rsn");
+    nm_setting_wireless_security_add_pairwise(s_wsec, "tkip");
+    nm_setting_wireless_security_add_pairwise(s_wsec, "ccmp");
+    nm_setting_wireless_security_add_group(s_wsec, "tkip");
+    nm_setting_wireless_security_add_group(s_wsec, "ccmp");
+
+    /* 802-1X setting */
+    s_8021x = (NMSetting8021x *) nm_setting_802_1x_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_8021x));
+    nm_setting_802_1x_add_eap_method(s_8021x, "tls");
+    nm_setting_802_1x_set_client_cert(s_8021x,
+                                      TEST_CERT_DIR "/test-cert.p12",
+                                      NM_SETTING_802_1X_CK_SCHEME_PATH,
+                                      NULL,
+                                      NULL);
+    g_assert(nm_setting_802_1x_set_ca_cert(s_8021x,
+                                           TEST_CERT_DIR "/test-ca-cert.pem",
+                                           NM_SETTING_802_1X_CK_SCHEME_PATH,
+                                           NULL,
+                                           NULL));
+    nm_setting_802_1x_set_private_key(s_8021x,
+                                      TEST_CERT_DIR "/test-cert.p12",
+                                      NULL,
+                                      NM_SETTING_802_1X_CK_SCHEME_PATH,
+                                      NULL,
+                                      NULL);
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    return connection;
+}
+
+static NMConnection *
+generate_wifi_eap_suite_b_192_connection(const char *id, GBytes *ssid, const char *bssid_str)
+{
+    NMConnection *             connection = NULL;
+    NMSettingWirelessSecurity *s_wsec;
+    NMSetting8021x *           s_8021x;
+    gboolean                   success;
+    GError *                   error = NULL;
+
+    connection = new_basic_connection(id, ssid, bssid_str);
+
+    /* Wifi Security setting */
+    s_wsec = (NMSettingWirelessSecurity *) nm_setting_wireless_security_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_wsec));
+    g_object_set(s_wsec, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT, "wpa-eap-suite-b-192", NULL);
+
+    /* 802-1X setting */
+    s_8021x = (NMSetting8021x *) nm_setting_802_1x_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_8021x));
+    nm_setting_802_1x_add_eap_method(s_8021x, "tls");
+    nm_setting_802_1x_set_client_cert(s_8021x,
+                                      TEST_CERT_DIR "/test-cert.p12",
+                                      NM_SETTING_802_1X_CK_SCHEME_PATH,
+                                      NULL,
+                                      NULL);
+    g_assert(nm_setting_802_1x_set_ca_cert(s_8021x,
+                                           TEST_CERT_DIR "/test-ca-cert.pem",
+                                           NM_SETTING_802_1X_CK_SCHEME_PATH,
+                                           NULL,
+                                           NULL));
+    nm_setting_802_1x_set_private_key(s_8021x,
+                                      TEST_CERT_DIR "/test-cert.p12",
+                                      NULL,
+                                      NM_SETTING_802_1X_CK_SCHEME_PATH,
+                                      NULL,
+                                      NULL);
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    return connection;
+}
+
+static void
+test_wifi_eap_locked_bssid(void)
+{
+    gs_unref_object NMConnection *connection = NULL;
+    gs_unref_variant GVariant *config_dict   = NULL;
+    const unsigned char        ssid_data[] = {0x54, 0x65, 0x73, 0x74, 0x20, 0x53, 0x53, 0x49, 0x44};
+    gs_unref_bytes GBytes *ssid            = g_bytes_new(ssid_data, sizeof(ssid_data));
+    const char *           bssid_str       = "11:22:33:44:55:66";
+    guint32                mtu             = 1100;
+
+    connection = generate_wifi_eap_connection("Test Wifi EAP-TLS Locked",
+                                              ssid,
+                                              bssid_str,
+                                              NM_SETTING_WIRELESS_SECURITY_FILS_OPTIONAL);
+
+    NMTST_EXPECT_NM_INFO("Config: added 'ssid' value 'Test SSID'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'scan_ssid' value '1'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'bssid' value '11:22:33:44:55:66'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'freq_list' value *");
+    NMTST_EXPECT_NM_INFO("Config: added 'key_mgmt' value 'WPA-EAP'");
+    NMTST_EXPECT_NM_INFO("Config: added 'proto' value 'WPA RSN'");
+    NMTST_EXPECT_NM_INFO("Config: added 'pairwise' value 'TKIP CCMP'");
+    NMTST_EXPECT_NM_INFO("Config: added 'group' value 'TKIP CCMP'");
+    NMTST_EXPECT_NM_INFO("Config: added 'eap' value 'TLS'");
+    NMTST_EXPECT_NM_INFO("Config: added 'fragment_size' value '1086'");
+    NMTST_EXPECT_NM_INFO("Config: added 'ca_cert' value '*/test-ca-cert.pem'");
+    NMTST_EXPECT_NM_INFO("Config: added 'private_key' value '*/test-cert.p12'");
+    NMTST_EXPECT_NM_INFO("Config: added 'proactive_key_caching' value '1'");
+    config_dict = build_supplicant_config(connection, mtu, 0, NM_SUPPL_CAP_MASK_NONE);
+    g_test_assert_expected_messages();
+    g_assert(config_dict);
+
+    validate_opt("wifi-eap", config_dict, "scan_ssid", NM_SUPPL_OPT_TYPE_INT, GINT_TO_POINTER(1));
+    validate_opt("wifi-eap", config_dict, "ssid", NM_SUPPL_OPT_TYPE_BYTES, ssid);
+    validate_opt("wifi-eap", config_dict, "bssid", NM_SUPPL_OPT_TYPE_KEYWORD, bssid_str);
+    validate_opt("wifi-eap", config_dict, "key_mgmt", NM_SUPPL_OPT_TYPE_KEYWORD, "WPA-EAP");
+    validate_opt("wifi-eap", config_dict, "eap", NM_SUPPL_OPT_TYPE_KEYWORD, "TLS");
+    validate_opt("wifi-eap", config_dict, "proto", NM_SUPPL_OPT_TYPE_KEYWORD, "WPA RSN");
+    validate_opt("wifi-eap", config_dict, "pairwise", NM_SUPPL_OPT_TYPE_KEYWORD, "TKIP CCMP");
+    validate_opt("wifi-eap", config_dict, "group", NM_SUPPL_OPT_TYPE_KEYWORD, "TKIP CCMP");
+    validate_opt("wifi-eap",
+                 config_dict,
+                 "fragment_size",
+                 NM_SUPPL_OPT_TYPE_INT,
+                 GINT_TO_POINTER(mtu - 14));
+}
+
+static void
+test_wifi_eap_unlocked_bssid(void)
+{
+    gs_unref_object NMConnection *connection = NULL;
+    gs_unref_variant GVariant *config_dict   = NULL;
+    const unsigned char        ssid_data[] = {0x54, 0x65, 0x73, 0x74, 0x20, 0x53, 0x53, 0x49, 0x44};
+    gs_unref_bytes GBytes *ssid            = g_bytes_new(ssid_data, sizeof(ssid_data));
+    const char *           bgscan_data     = "simple:30:-65:300";
+    gs_unref_bytes GBytes *bgscan          = g_bytes_new(bgscan_data, strlen(bgscan_data));
+    guint32                mtu             = 1100;
+
+    connection = generate_wifi_eap_connection("Test Wifi EAP-TLS Unlocked",
+                                              ssid,
+                                              NULL,
+                                              NM_SETTING_WIRELESS_SECURITY_FILS_REQUIRED);
+
+    NMTST_EXPECT_NM_INFO("Config: added 'ssid' value 'Test SSID'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'scan_ssid' value '1'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'freq_list' value *");
+    NMTST_EXPECT_NM_INFO("Config: added 'key_mgmt' value 'FILS-SHA256 FILS-SHA384'");
+    NMTST_EXPECT_NM_INFO("Config: added 'proto' value 'WPA RSN'");
+    NMTST_EXPECT_NM_INFO("Config: added 'pairwise' value 'TKIP CCMP'");
+    NMTST_EXPECT_NM_INFO("Config: added 'group' value 'TKIP CCMP'");
+    NMTST_EXPECT_NM_INFO("Config: added 'eap' value 'TLS'");
+    NMTST_EXPECT_NM_INFO("Config: added 'fragment_size' value '1086'");
+    NMTST_EXPECT_NM_INFO("Config: added 'ca_cert' value '*/test-ca-cert.pem'");
+    NMTST_EXPECT_NM_INFO("Config: added 'private_key' value '*/test-cert.p12'");
+    NMTST_EXPECT_NM_INFO("Config: added 'proactive_key_caching' value '1'");
+    NMTST_EXPECT_NM_INFO("Config: added 'bgscan' value 'simple:30:-65:300'");
+    config_dict = build_supplicant_config(connection, mtu, 0, NM_SUPPL_CAP_MASK_T_FILS_YES);
+    g_test_assert_expected_messages();
+    g_assert(config_dict);
+
+    validate_opt("wifi-eap", config_dict, "scan_ssid", NM_SUPPL_OPT_TYPE_INT, GINT_TO_POINTER(1));
+    validate_opt("wifi-eap", config_dict, "ssid", NM_SUPPL_OPT_TYPE_BYTES, ssid);
+    validate_opt("wifi-eap",
+                 config_dict,
+                 "key_mgmt",
+                 NM_SUPPL_OPT_TYPE_KEYWORD,
+                 "FILS-SHA256 FILS-SHA384");
+    validate_opt("wifi-eap", config_dict, "eap", NM_SUPPL_OPT_TYPE_KEYWORD, "TLS");
+    validate_opt("wifi-eap", config_dict, "proto", NM_SUPPL_OPT_TYPE_KEYWORD, "WPA RSN");
+    validate_opt("wifi-eap", config_dict, "pairwise", NM_SUPPL_OPT_TYPE_KEYWORD, "TKIP CCMP");
+    validate_opt("wifi-eap", config_dict, "group", NM_SUPPL_OPT_TYPE_KEYWORD, "TKIP CCMP");
+    validate_opt("wifi-eap",
+                 config_dict,
+                 "fragment_size",
+                 NM_SUPPL_OPT_TYPE_INT,
+                 GINT_TO_POINTER(mtu - 14));
+    validate_opt("wifi-eap", config_dict, "bgscan", NM_SUPPL_OPT_TYPE_BYTES, bgscan);
+}
+
+static void
+test_wifi_eap_fils_disabled(void)
+{
+    gs_unref_object NMConnection *connection = NULL;
+    gs_unref_variant GVariant *config_dict   = NULL;
+    const unsigned char        ssid_data[] = {0x54, 0x65, 0x73, 0x74, 0x20, 0x53, 0x53, 0x49, 0x44};
+    gs_unref_bytes GBytes *ssid            = g_bytes_new(ssid_data, sizeof(ssid_data));
+    const char *           bgscan_data     = "simple:30:-65:300";
+    gs_unref_bytes GBytes *bgscan          = g_bytes_new(bgscan_data, strlen(bgscan_data));
+    guint32                mtu             = 1100;
+
+    connection = generate_wifi_eap_connection("Test Wifi FILS disabled",
+                                              ssid,
+                                              NULL,
+                                              NM_SETTING_WIRELESS_SECURITY_FILS_DISABLE);
+
+    NMTST_EXPECT_NM_INFO("Config: added 'ssid' value 'Test SSID'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'scan_ssid' value '1'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'freq_list' value *");
+    NMTST_EXPECT_NM_INFO("Config: added 'key_mgmt' value 'WPA-EAP WPA-EAP-SHA256'");
+    NMTST_EXPECT_NM_INFO("Config: added 'proto' value 'WPA RSN'");
+    NMTST_EXPECT_NM_INFO("Config: added 'pairwise' value 'TKIP CCMP'");
+    NMTST_EXPECT_NM_INFO("Config: added 'group' value 'TKIP CCMP'");
+    NMTST_EXPECT_NM_INFO("Config: added 'eap' value 'TLS'");
+    NMTST_EXPECT_NM_INFO("Config: added 'fragment_size' value '1086'");
+    NMTST_EXPECT_NM_INFO("Config: added 'ca_cert' value '*/test-ca-cert.pem'");
+    NMTST_EXPECT_NM_INFO("Config: added 'private_key' value '*/test-cert.p12'");
+    NMTST_EXPECT_NM_INFO("Config: added 'proactive_key_caching' value '1'");
+    NMTST_EXPECT_NM_INFO("Config: added 'bgscan' value 'simple:30:-65:300'");
+    config_dict =
+        build_supplicant_config(connection,
+                                mtu,
+                                0,
+                                NM_SUPPL_CAP_MASK_T_PMF_YES | NM_SUPPL_CAP_MASK_T_FILS_YES);
+    g_test_assert_expected_messages();
+    g_assert(config_dict);
+
+    validate_opt("wifi-eap", config_dict, "scan_ssid", NM_SUPPL_OPT_TYPE_INT, GINT_TO_POINTER(1));
+    validate_opt("wifi-eap", config_dict, "ssid", NM_SUPPL_OPT_TYPE_BYTES, ssid);
+    validate_opt("wifi-eap",
+                 config_dict,
+                 "key_mgmt",
+                 NM_SUPPL_OPT_TYPE_KEYWORD,
+                 "WPA-EAP WPA-EAP-SHA256");
+    validate_opt("wifi-eap", config_dict, "eap", NM_SUPPL_OPT_TYPE_KEYWORD, "TLS");
+    validate_opt("wifi-eap", config_dict, "proto", NM_SUPPL_OPT_TYPE_KEYWORD, "WPA RSN");
+    validate_opt("wifi-eap", config_dict, "pairwise", NM_SUPPL_OPT_TYPE_KEYWORD, "TKIP CCMP");
+    validate_opt("wifi-eap", config_dict, "group", NM_SUPPL_OPT_TYPE_KEYWORD, "TKIP CCMP");
+    validate_opt("wifi-eap",
+                 config_dict,
+                 "fragment_size",
+                 NM_SUPPL_OPT_TYPE_INT,
+                 GINT_TO_POINTER(mtu - 14));
+    validate_opt("wifi-eap", config_dict, "bgscan", NM_SUPPL_OPT_TYPE_BYTES, bgscan);
+}
+
+static void
+test_wifi_eap_suite_b_generation(void)
+{
+    gs_unref_object NMConnection *connection = NULL;
+    gs_unref_variant GVariant *config_dict   = NULL;
+    const unsigned char        ssid_data[] = {0x54, 0x65, 0x73, 0x74, 0x20, 0x53, 0x53, 0x49, 0x44};
+    gs_unref_bytes GBytes *ssid            = g_bytes_new(ssid_data, sizeof(ssid_data));
+    const char *           bssid_str       = "11:22:33:44:55:66";
+    guint32                mtu             = 1100;
+
+    connection = generate_wifi_eap_suite_b_192_connection("EAP-TLS Suite B 192", ssid, bssid_str);
+
+    NMTST_EXPECT_NM_INFO("Config: added 'ssid' value 'Test SSID'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'scan_ssid' value '1'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'bssid' value '11:22:33:44:55:66'*");
+    NMTST_EXPECT_NM_INFO("Config: added 'freq_list' value *");
+    NMTST_EXPECT_NM_INFO("Config: added 'pairwise' value 'GCMP-256'");
+    NMTST_EXPECT_NM_INFO("Config: added 'group' value 'GCMP-256'");
+    NMTST_EXPECT_NM_INFO("Config: added 'key_mgmt' value 'WPA-EAP-SUITE-B-192'");
+    NMTST_EXPECT_NM_INFO("Config: added 'eap' value 'TLS'");
+    NMTST_EXPECT_NM_INFO("Config: added 'fragment_size' value '1086'");
+    NMTST_EXPECT_NM_INFO("Config: added 'ca_cert' value '*/test-ca-cert.pem'");
+    NMTST_EXPECT_NM_INFO("Config: added 'private_key' value '*/test-cert.p12'");
+    NMTST_EXPECT_NM_INFO("Config: added 'proactive_key_caching' value '1'");
+    config_dict = build_supplicant_config(connection, mtu, 0, NM_SUPPL_CAP_MASK_T_PMF_YES);
+    g_test_assert_expected_messages();
+    g_assert(config_dict);
+
+    validate_opt("wifi-eap", config_dict, "scan_ssid", NM_SUPPL_OPT_TYPE_INT, GINT_TO_POINTER(1));
+    validate_opt("wifi-eap", config_dict, "ssid", NM_SUPPL_OPT_TYPE_BYTES, ssid);
+    validate_opt("wifi-eap", config_dict, "bssid", NM_SUPPL_OPT_TYPE_KEYWORD, bssid_str);
+    validate_opt("wifi-eap",
+                 config_dict,
+                 "key_mgmt",
+                 NM_SUPPL_OPT_TYPE_KEYWORD,
+                 "WPA-EAP-SUITE-B-192");
+    validate_opt("wifi-eap", config_dict, "eap", NM_SUPPL_OPT_TYPE_KEYWORD, "TLS");
+    validate_opt("wifi-eap", config_dict, "pairwise", NM_SUPPL_OPT_TYPE_KEYWORD, "GCMP-256");
+    validate_opt("wifi-eap", config_dict, "group", NM_SUPPL_OPT_TYPE_KEYWORD, "GCMP-256");
+}
+
+/*****************************************************************************/
+
+static void
+test_suppl_cap_mask(void)
+{
+    NMSupplCapType type;
+
+    g_assert_cmpint(NM_SUPPL_CAP_MASK_GET(NM_SUPPL_CAP_MASK_T_AP_NO, NM_SUPPL_CAP_TYPE_AP),
+                    ==,
+                    NM_TERNARY_FALSE);
+    g_assert_cmpint(NM_SUPPL_CAP_MASK_GET(NM_SUPPL_CAP_MASK_T_AP_YES, NM_SUPPL_CAP_TYPE_AP),
+                    ==,
+                    NM_TERNARY_TRUE);
+    g_assert_cmpint(NM_SUPPL_CAP_MASK_GET(NM_SUPPL_CAP_MASK_NONE, NM_SUPPL_CAP_TYPE_AP),
+                    ==,
+                    NM_TERNARY_DEFAULT);
+
+    g_assert_cmpint(NM_SUPPL_CAP_MASK_GET(NM_SUPPL_CAP_MASK_T_FILS_NO, NM_SUPPL_CAP_TYPE_FILS),
+                    ==,
+                    NM_TERNARY_FALSE);
+    g_assert_cmpint(NM_SUPPL_CAP_MASK_GET(NM_SUPPL_CAP_MASK_T_FILS_YES, NM_SUPPL_CAP_TYPE_FILS),
+                    ==,
+                    NM_TERNARY_TRUE);
+    g_assert_cmpint(NM_SUPPL_CAP_MASK_GET(NM_SUPPL_CAP_MASK_NONE, NM_SUPPL_CAP_TYPE_FILS),
+                    ==,
+                    NM_TERNARY_DEFAULT);
+
+    for (type = 0; type < _NM_SUPPL_CAP_TYPE_NUM; type++) {
+        NMTernary      value;
+        NMSupplCapMask feature;
+        NMSupplCapMask feature2;
+
+        feature = nmtst_get_rand_bool() ? 0u : nmtst_get_rand_uint64();
+        feature &= NM_SUPPL_CAP_MASK_ALL;
+
+        value = nmtst_rand_select(NM_TERNARY_DEFAULT, NM_TERNARY_FALSE, NM_TERNARY_TRUE);
+
+        feature2 = NM_SUPPL_CAP_MASK_SET(feature, type, value);
+
+        g_assert_cmpint(NM_SUPPL_CAP_MASK_GET(feature2, type), ==, value);
+        g_assert_cmpint(feature & ~NM_SUPPL_CAP_MASK_MASK(type),
+                        ==,
+                        feature2 & ~NM_SUPPL_CAP_MASK_MASK(type));
+    }
+}
+
+/*****************************************************************************/
+
+NMTST_DEFINE();
+
+int
+main(int argc, char **argv)
+{
+    nmtst_init_assert_logging(&argc, &argv, "INFO", "DEFAULT");
+
+    g_test_add_func("/supplicant-config/wifi-open", test_wifi_open);
+    g_test_add_func("/supplicant-config/wifi-wep", test_wifi_wep);
+    g_test_add_func("/supplicant-config/wifi-wpa-psk-types", test_wifi_wpa_psk_types);
+    g_test_add_func("/supplicant-config/wifi-eap/locked-bssid", test_wifi_eap_locked_bssid);
+    g_test_add_func("/supplicant-config/wifi-eap/unlocked-bssid", test_wifi_eap_unlocked_bssid);
+    g_test_add_func("/supplicant-config/wifi-eap/fils-disabled", test_wifi_eap_fils_disabled);
+    g_test_add_func("/supplicant-config/wifi-sae", test_wifi_sae);
+    g_test_add_func("/supplicant-config/test_suppl_cap_mask", test_suppl_cap_mask);
+    g_test_add_func("/supplicant-config/wifi-eap-suite-b-192", test_wifi_eap_suite_b_generation);
+
+    return g_test_run();
+}