New upstream version 1.48.2 upstream/1.48.2

27 files changed, 297 insertions, 147 deletions

diff --git a/src/core/devices/nm-device-bridge.c b/src/core/devices/nm-device-bridge.c
index 2405beea..82314f13 100644
--- a/src/core/devices/nm-device-bridge.c
+++ b/src/core/devices/nm-device-bridge.c
@@ -299,13 +299,11 @@ typedef struct {
 } Option;
 
 #define OPTION(_name, _sysname, ...) \
-    {                                \
-        .name    = ""_name           \
-                   "",               \
-        .sysname = ""_sysname        \
-                   "",               \
-        __VA_ARGS__                  \
-    }
+    {.name    = ""_name              \
+                "",                  \
+     .sysname = ""_sysname           \
+                "",                  \
+     __VA_ARGS__}
 
 #define OPTION_TYPE_INT(min, max, def) .nm_min = (min), .nm_max = (max), .nm_default = (def)
 
diff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c
index b96adefb..f3441508 100644
--- a/src/core/devices/nm-device.c
+++ b/src/core/devices/nm-device.c
@@ -17205,6 +17205,14 @@ nm_device_get_state(NMDevice *self)
     return NM_DEVICE_GET_PRIVATE(self)->state;
 }
 
+NMDeviceStateReason
+nm_device_get_state_reason(NMDevice *self)
+{
+    g_return_val_if_fail(NM_IS_DEVICE(self), NM_DEVICE_STATE_REASON_NONE);
+
+    return NM_DEVICE_GET_PRIVATE(self)->state_reason;
+}
+
 /*****************************************************************************/
 
 /**
diff --git a/src/core/devices/nm-device.h b/src/core/devices/nm-device.h
index ffe6b1af..ba45497c 100644
--- a/src/core/devices/nm-device.h
+++ b/src/core/devices/nm-device.h
@@ -561,7 +561,8 @@ int      nm_device_spec_match_list_full(NMDevice *self, const GSList *specs, int
 gboolean nm_device_is_activating(NMDevice *dev);
 gboolean nm_device_autoconnect_allowed(NMDevice *self);
 
-NMDeviceState nm_device_get_state(NMDevice *device);
+NMDeviceState       nm_device_get_state(NMDevice *device);
+NMDeviceStateReason nm_device_get_state_reason(NMDevice *device);
 
 gboolean nm_device_get_enabled(NMDevice *device);
 
diff --git a/src/core/devices/ovs/nm-ovsdb.c b/src/core/devices/ovs/nm-ovsdb.c
index 68366f73..8e32cff5 100644
--- a/src/core/devices/ovs/nm-ovsdb.c
+++ b/src/core/devices/ovs/nm-ovsdb.c
@@ -461,7 +461,7 @@ ovsdb_call_method(NMOvsdb                  *self,
                    "new: add-interface bridge=%s port=%s interface=%s",
                    nm_connection_get_interface_name(call->payload.add_interface.bridge),
                    nm_connection_get_interface_name(call->payload.add_interface.port),
-                   nm_connection_get_interface_name(call->payload.add_interface.interface));
+                   nm_device_get_iface(call->payload.add_interface.interface_device));
         break;
     case OVSDB_DEL_INTERFACE:
         call->payload.del_interface.ifname = g_strdup(payload->del_interface.ifname);
@@ -945,7 +945,7 @@ _insert_interface(json_t       *params,
 
     row = json_pack("{s:s, s:s, s:o, s:o, s:o}",
                     "name",
-                    nm_connection_get_interface_name(interface),
+                    nm_device_get_iface(interface_device),
                     "type",
                     type ?: "",
                     "options",
@@ -1196,7 +1196,7 @@ _add_interface(NMOvsdb      *self,
 
     bridge_name        = nm_connection_get_interface_name(bridge);
     port_name          = nm_connection_get_interface_name(port);
-    interface_name     = nm_connection_get_interface_name(interface);
+    interface_name     = nm_device_get_iface(interface_device);
     interface_is_local = nm_streq0(bridge_name, interface_name);
 
     /* Determine cloned MAC addresses */
diff --git a/src/core/dhcp/nm-dhcp-options.c b/src/core/dhcp/nm-dhcp-options.c
index 7c47c82e..f89237c5 100644
--- a/src/core/dhcp/nm-dhcp-options.c
+++ b/src/core/dhcp/nm-dhcp-options.c
@@ -11,9 +11,11 @@
 
 /*****************************************************************************/
 
-#define REQ(_num, _name, _include)                                                         \
-    {                                                                                      \
-        .name = NM_DHCP_OPTION_REQPREFIX ""_name, .option_num = _num, .include = _include, \
+#define REQ(_num, _name, _include)                      \
+    {                                                   \
+        .name       = NM_DHCP_OPTION_REQPREFIX ""_name, \
+        .option_num = _num,                             \
+        .include    = _include,                         \
     }
 
 const NMDhcpOption _nm_dhcp_option_dhcp4_options[] = {
diff --git a/src/core/nm-active-connection.c b/src/core/nm-active-connection.c
index b08d26c2..7d89251c 100644
--- a/src/core/nm-active-connection.c
+++ b/src/core/nm-active-connection.c
@@ -50,6 +50,7 @@ typedef struct _NMActiveConnectionPrivate {
 
     NMAuthSubject      *subject;
     NMActiveConnection *controller;
+    NMDevice           *controller_dev;
 
     NMActiveConnection *parent;
 
@@ -826,6 +827,31 @@ master_state_cb(NMActiveConnection *master, GParamSpec *pspec, gpointer user_dat
     }
 }
 
+static void
+controller_dev_state_cb(NMDevice           *controller_dev,
+                        NMDeviceState       new_state,
+                        NMDeviceState       old_state,
+                        NMDeviceStateReason reason,
+                        gpointer            user_data)
+{
+    NMActiveConnection        *self = NM_ACTIVE_CONNECTION(user_data);
+    NMActiveConnectionPrivate *priv = NM_ACTIVE_CONNECTION_GET_PRIVATE(self);
+    NMActRequest              *controller_act_request;
+    NMActiveConnection        *controller_ac;
+
+    if (new_state >= NM_DEVICE_STATE_PREPARE && new_state <= NM_DEVICE_STATE_ACTIVATED) {
+        controller_act_request = nm_device_get_act_request(controller_dev);
+        if (controller_act_request) {
+            controller_ac = NM_ACTIVE_CONNECTION(controller_act_request);
+            g_signal_handlers_disconnect_by_func(controller_dev,
+                                                 G_CALLBACK(controller_dev_state_cb),
+                                                 self);
+            g_clear_object(&priv->controller_dev);
+            nm_active_connection_set_controller(self, controller_ac);
+        }
+    }
+}
+
 /**
  * nm_active_connection_set_controller:
  * @self: the #NMActiveConnection
@@ -867,6 +893,36 @@ nm_active_connection_set_controller(NMActiveConnection *self, NMActiveConnection
     check_controller_ready(self);
 }
 
+void
+nm_active_connection_set_controller_dev(NMActiveConnection *self, NMDevice *controller_dev)
+{
+    NMActiveConnectionPrivate *priv;
+
+    g_return_if_fail(NM_IS_ACTIVE_CONNECTION(self));
+    g_return_if_fail(NM_IS_DEVICE(controller_dev));
+
+    priv = NM_ACTIVE_CONNECTION_GET_PRIVATE(self);
+
+    /* Controller device is write-once, and must be set before exporting the object */
+    g_return_if_fail(priv->controller_dev == NULL);
+    g_return_if_fail(!nm_dbus_object_is_exported(NM_DBUS_OBJECT(self)));
+    if (priv->device) {
+        g_return_if_fail(priv->device != controller_dev);
+    }
+
+    _LOGD("set controller device %p, %s(%s), state %s",
+          controller_dev,
+          nm_device_get_iface(controller_dev),
+          nm_device_get_type_desc(controller_dev),
+          nm_device_state_to_string(nm_device_get_state(controller_dev)));
+
+    priv->controller_dev = g_object_ref(controller_dev);
+    g_signal_connect(priv->controller_dev,
+                     NM_DEVICE_STATE_CHANGED,
+                     G_CALLBACK(controller_dev_state_cb),
+                     self);
+}
+
 NMActivationType
 nm_active_connection_get_activation_type(NMActiveConnection *self)
 {
@@ -1533,7 +1589,13 @@ dispose(GObject *object)
     if (priv->controller) {
         g_signal_handlers_disconnect_by_func(priv->controller, G_CALLBACK(master_state_cb), self);
     }
+    if (priv->controller_dev) {
+        g_signal_handlers_disconnect_by_func(priv->controller_dev,
+                                             G_CALLBACK(controller_dev_state_cb),
+                                             self);
+    }
     g_clear_object(&priv->controller);
+    g_clear_object(&priv->controller_dev);
 
     if (priv->parent)
         unwatch_parent(self, TRUE);
diff --git a/src/core/nm-active-connection.h b/src/core/nm-active-connection.h
index 12cb311c..ba328302 100644
--- a/src/core/nm-active-connection.h
+++ b/src/core/nm-active-connection.h
@@ -175,6 +175,7 @@ NMActiveConnection *nm_active_connection_get_controller(NMActiveConnection *self
 gboolean nm_active_connection_get_controller_ready(NMActiveConnection *self);
 
 void nm_active_connection_set_controller(NMActiveConnection *self, NMActiveConnection *controller);
+void nm_active_connection_set_controller_dev(NMActiveConnection *self, NMDevice *controller_dev);
 
 void nm_active_connection_set_parent(NMActiveConnection *self, NMActiveConnection *parent);
 
diff --git a/src/core/nm-manager.c b/src/core/nm-manager.c
index b2a827e3..ddbd2021 100644
--- a/src/core/nm-manager.c
+++ b/src/core/nm-manager.c
@@ -5943,7 +5943,20 @@ _internal_activate_device(NMManager *self, NMActiveConnection *active, GError **
                                              NM_DEVICE_STATE_REASON_USER_REQUESTED);
         }
 
-        nm_active_connection_set_controller(active, master_ac);
+        /* If controller NMActiveConnection is deactivating, we should wait on
+         * controller's NMDevice to have new NMActiveConnection after
+         * controller device state change to between NM_DEVICE_STATE_PREPARE and
+         * NM_DEVICE_STATE_ACTIVATED.
+         */
+        if ((nm_active_connection_get_state(master_ac) >= NM_ACTIVE_CONNECTION_STATE_DEACTIVATING)
+            && master_device
+            && (nm_device_get_state_reason(master_device)
+                == NM_DEVICE_STATE_REASON_NEW_ACTIVATION)) {
+            nm_active_connection_set_controller_dev(active, master_device);
+        } else {
+            nm_active_connection_set_controller(active, master_ac);
+        }
+
         _LOGD(LOGD_CORE,
               "Activation of '%s' depends on active connection %p %s",
               nm_settings_connection_get_id(sett_conn),
@@ -7947,6 +7960,7 @@ nm_manager_write_device_state_all(NMManager *self)
     NMManagerPrivate              *priv               = NM_MANAGER_GET_PRIVATE(self);
     gs_unref_hashtable GHashTable *preserve_ifindexes = NULL;
     NMDevice                      *device;
+    NMActiveConnection            *ac;
 
     preserve_ifindexes = g_hash_table_new(nm_direct_hash, NULL);
 
@@ -7958,6 +7972,14 @@ nm_manager_write_device_state_all(NMManager *self)
         }
     }
 
+    /* Save to disk the timestamps of active connections as if we were bringing them down.
+     * Otherwise they will be wrong on next start and affect the activation order.
+     */
+    c_list_for_each_entry (ac, &priv->active_connections_lst_head, active_connections_lst) {
+        NMSettingsConnection *sett = nm_active_connection_get_settings_connection(ac);
+        nm_settings_connection_update_timestamp(sett, (guint64) time(NULL));
+    }
+
     nm_config_device_state_prune_stale(preserve_ifindexes, NULL);
 }
 
diff --git a/src/core/platform/tests/test-common.c b/src/core/platform/tests/test-common.c
index fde7dc0d..99b8bc45 100644
--- a/src/core/platform/tests/test-common.c
+++ b/src/core/platform/tests/test-common.c
@@ -59,10 +59,8 @@ typedef struct {
 
 } IPTunnelModInfo;
 
-#define INF(_module_name, _iftype, _ifname, ...)                                           \
-    {                                                                                      \
-        .module_name = ""_module_name, .iftype = _iftype, .ifname = ""_ifname, __VA_ARGS__ \
-    }
+#define INF(_module_name, _iftype, _ifname, ...) \
+    {.module_name = ""_module_name, .iftype = _iftype, .ifname = ""_ifname, __VA_ARGS__}
 
 static const IPTunnelModInfo ip_tunnel_mod_infos[] = {
     INF("ip_gre", NM_LINK_TYPE_GRE, "gre0"),
diff --git a/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c b/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c
index 277d0d5f..50484405 100644
--- a/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c
+++ b/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c
@@ -700,9 +700,10 @@ nms_ifcfg_rh_utils_is_numbered_tag_impl(const char *key,
 
 /*****************************************************************************/
 
-#define _KEY_TYPE(key, flags)                                                            \
-    {                                                                                    \
-        .key_name = "" key "", .key_flags = ((NMS_IFCFG_KEY_TYPE_WELL_KNOWN) | (flags)), \
+#define _KEY_TYPE(key, flags)                                     \
+    {                                                             \
+        .key_name  = "" key "",                                   \
+        .key_flags = ((NMS_IFCFG_KEY_TYPE_WELL_KNOWN) | (flags)), \
     }
 
 const NMSIfcfgKeyTypeInfo nms_ifcfg_well_known_keys[] = {
diff --git a/src/core/supplicant/nm-supplicant-settings-verify.c b/src/core/supplicant/nm-supplicant-settings-verify.c
index c7aaf47d..76328541 100644
--- a/src/core/supplicant/nm-supplicant-settings-verify.c
+++ b/src/core/supplicant/nm-supplicant-settings-verify.c
@@ -20,21 +20,30 @@ struct Opt {
 
 typedef gboolean (*validate_func)(const struct Opt *, const char *, const guint32);
 
-#define OPT_INT(_key, _int_low, _int_high)                                                      \
-    {                                                                                           \
-        .key = _key, .type = NM_SUPPL_OPT_TYPE_INT, .int_high = _int_high, .int_low = _int_low, \
+#define OPT_INT(_key, _int_low, _int_high) \
+    {                                      \
+        .key      = _key,                  \
+        .type     = NM_SUPPL_OPT_TYPE_INT, \
+        .int_high = _int_high,             \
+        .int_low  = _int_low,              \
     }
-#define OPT_BYTES(_key, _int_high)                                           \
-    {                                                                        \
-        .key = _key, .type = NM_SUPPL_OPT_TYPE_BYTES, .int_high = _int_high, \
+#define OPT_BYTES(_key, _int_high)           \
+    {                                        \
+        .key      = _key,                    \
+        .type     = NM_SUPPL_OPT_TYPE_BYTES, \
+        .int_high = _int_high,               \
     }
-#define OPT_UTF8(_key, _int_high)                                           \
-    {                                                                       \
-        .key = _key, .type = NM_SUPPL_OPT_TYPE_UTF8, .int_high = _int_high, \
+#define OPT_UTF8(_key, _int_high)           \
+    {                                       \
+        .key      = _key,                   \
+        .type     = NM_SUPPL_OPT_TYPE_UTF8, \
+        .int_high = _int_high,              \
     }
-#define OPT_KEYWORD(_key, _str_allowed)                                              \
-    {                                                                                \
-        .key = _key, .type = NM_SUPPL_OPT_TYPE_KEYWORD, .str_allowed = _str_allowed, \
+#define OPT_KEYWORD(_key, _str_allowed)           \
+    {                                             \
+        .key         = _key,                      \
+        .type        = NM_SUPPL_OPT_TYPE_KEYWORD, \
+        .str_allowed = _str_allowed,              \
     }
 
 static const struct Opt opt_table[] = {
diff --git a/src/libnm-client-impl/nm-libnm-utils.h b/src/libnm-client-impl/nm-libnm-utils.h
index d56d0fc1..53fa36be 100644
--- a/src/libnm-client-impl/nm-libnm-utils.h
+++ b/src/libnm-client-impl/nm-libnm-utils.h
@@ -379,11 +379,10 @@ typedef struct {
 } NMLDBusMetaProperty;
 
 #define NML_DBUS_META_PROPERTY_INIT(v_dbus_property_name, v_dbus_type, v_obj_properties_idx, ...) \
-    {                                                                                             \
-        .dbus_property_name = "" v_dbus_property_name "",                                         \
-        .dbus_type          = NM_G_VARIANT_TYPE("" v_dbus_type ""),                               \
-        .obj_properties_idx = v_obj_properties_idx, ##__VA_ARGS__                                 \
-    }
+    {.dbus_property_name = "" v_dbus_property_name "",                                            \
+     .dbus_type          = NM_G_VARIANT_TYPE("" v_dbus_type ""),                                  \
+     .obj_properties_idx = v_obj_properties_idx,                                                  \
+     ##__VA_ARGS__}
 
 #define _NML_DBUS_META_PROPERTY_INIT_DEFAULT(v_dbus_type,          \
                                              v_exp_type,           \
@@ -568,10 +567,10 @@ struct _NMLDBusMetaIface {
         (sizeof((const NMLDBusMetaProperty[]){__VA_ARGS__}) / sizeof(NMLDBusMetaProperty))
 
 #define NML_DBUS_META_IFACE_INIT(v_dbus_iface_name, v_get_type_fcn, v_interface_prio, ...) \
-    {                                                                                      \
-        .dbus_iface_name = "" v_dbus_iface_name "", .get_type_fcn = v_get_type_fcn,        \
-        .interface_prio = v_interface_prio, ##__VA_ARGS__                                  \
-    }
+    {.dbus_iface_name = "" v_dbus_iface_name "",                                           \
+     .get_type_fcn    = v_get_type_fcn,                                                    \
+     .interface_prio  = v_interface_prio,                                                  \
+     ##__VA_ARGS__}
 
 #define NML_DBUS_META_IFACE_INIT_PROP(v_dbus_iface_name, v_get_type_fcn, v_interface_prio, ...) \
     NML_DBUS_META_IFACE_INIT(v_dbus_iface_name,                                                 \
diff --git a/src/libnm-client-impl/tests/test-libnm.c b/src/libnm-client-impl/tests/test-libnm.c
index 687e6c17..f677ad8e 100644
--- a/src/libnm-client-impl/tests/test-libnm.c
+++ b/src/libnm-client-impl/tests/test-libnm.c
@@ -57,9 +57,11 @@ _test_fixup_string(const TestFixupData *data, guint n_data, char *(*func)(const
     }
 }
 
-#define T_DATA(_desc, _expected)                                \
-    {                                                           \
-        .desc = _desc, .expected = _expected, .line = __LINE__, \
+#define T_DATA(_desc, _expected) \
+    {                            \
+        .desc     = _desc,       \
+        .expected = _expected,   \
+        .line     = __LINE__,    \
     }
 
 static void
diff --git a/src/libnm-core-impl/nm-setting-private.h b/src/libnm-core-impl/nm-setting-private.h
index a1ae6825..7d493248 100644
--- a/src/libnm-core-impl/nm-setting-private.h
+++ b/src/libnm-core-impl/nm-setting-private.h
@@ -484,10 +484,7 @@ void _nm_setting_class_commit(NMSettingClass             *setting_class,
 
 #define NM_SETT_INFO_SETT_DETAIL(...) (&((const NMSettInfoSettDetail){__VA_ARGS__}))
 
-#define NM_SETT_INFO_PROPERT_TYPE_DBUS_INIT(_dbus_type, ...) \
-    {                                                        \
-        .dbus_type = _dbus_type, __VA_ARGS__                 \
-    }
+#define NM_SETT_INFO_PROPERT_TYPE_DBUS_INIT(_dbus_type, ...) {.dbus_type = _dbus_type, __VA_ARGS__}
 
 #define NM_SETT_INFO_PROPERT_TYPE_GPROP_INIT(_dbus_type, ...)                                  \
     NM_SETT_INFO_PROPERT_TYPE_DBUS_INIT(_dbus_type,                                            \
diff --git a/src/libnm-core-impl/nm-setting-vpn.c b/src/libnm-core-impl/nm-setting-vpn.c
index b867d018..65a14866 100644
--- a/src/libnm-core-impl/nm-setting-vpn.c
+++ b/src/libnm-core-impl/nm-setting-vpn.c
@@ -577,14 +577,48 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
     return TRUE;
 }
 
+static gboolean
+_parse_secret_hint_tag(const char           *secret_name,
+                       const char          **out_secret_name,
+                       NMSettingSecretFlags *out_implied_flags)
+{
+    NMSettingSecretFlags implied_flags = NM_SETTING_SECRET_FLAG_NONE;
+    gboolean             ret           = FALSE;
+
+    nm_assert(secret_name);
+
+    if (g_str_has_prefix(secret_name, NM_SECRET_TAG_DYNAMIC_CHALLENGE)) {
+        secret_name += NM_STRLEN(NM_SECRET_TAG_DYNAMIC_CHALLENGE);
+        implied_flags |= NM_SETTING_SECRET_FLAG_NOT_SAVED;
+        ret = TRUE;
+    } else if (g_str_has_prefix(secret_name, NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO)) {
+        secret_name += NM_STRLEN(NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO);
+        implied_flags |= NM_SETTING_SECRET_FLAG_NOT_SAVED;
+        ret = TRUE;
+    }
+
+    NM_SET_OUT(out_secret_name, secret_name);
+    NM_SET_OUT(out_implied_flags, implied_flags);
+    return ret;
+}
+
 static NMSettingUpdateSecretResult
 update_secret_string(NMSetting *setting, const char *key, const char *value, GError **error)
 {
     NMSettingVpnPrivate *priv = NM_SETTING_VPN_GET_PRIVATE(setting);
+    NMSettingSecretFlags hint_implied_flags, flags;
 
     g_return_val_if_fail(key && key[0], NM_SETTING_UPDATE_SECRET_ERROR);
     g_return_val_if_fail(value, NM_SETTING_UPDATE_SECRET_ERROR);
 
+    /* If the name is prefixed with a hint tag, process it before saving:
+     * remove the prefix and apply the flags that it implies */
+    _parse_secret_hint_tag(key, &key, &hint_implied_flags);
+    if (hint_implied_flags) {
+        nm_setting_get_secret_flags(setting, key, &flags, NULL);
+        nm_setting_set_secret_flags(setting, key, flags | hint_implied_flags, NULL);
+    }
+
     if (nm_streq0(nm_g_hash_table_lookup(priv->secrets, key), value))
         return NM_SETTING_UPDATE_SECRET_SUCCESS_UNCHANGED;
 
@@ -599,6 +633,7 @@ update_secret_dict(NMSetting *setting, GVariant *secrets, GError **error)
     GVariantIter                iter;
     const char                 *name, *value;
     NMSettingUpdateSecretResult result = NM_SETTING_UPDATE_SECRET_SUCCESS_UNCHANGED;
+    NMSettingSecretFlags        hint_implied_flags, flags;
 
     g_return_val_if_fail(secrets != NULL, NM_SETTING_UPDATE_SECRET_ERROR);
 
@@ -618,6 +653,14 @@ update_secret_dict(NMSetting *setting, GVariant *secrets, GError **error)
     /* Now add the items to the settings' secrets list */
     g_variant_iter_init(&iter, secrets);
     while (g_variant_iter_next(&iter, "{&s&s}", &name, &value)) {
+        /* If the name is prefixed with a hint tag, process it before saving:
+         * remove the prefix and apply the flags that it implies */
+        _parse_secret_hint_tag(name, &name, &hint_implied_flags);
+        if (hint_implied_flags) {
+            nm_setting_get_secret_flags(setting, name, &flags, NULL);
+            nm_setting_set_secret_flags(setting, name, flags | hint_implied_flags, NULL);
+        }
+
         if (nm_streq0(nm_g_hash_table_lookup(priv->secrets, name), value))
             continue;
 
@@ -727,6 +770,7 @@ get_secret_flags(NMSetting            *setting,
                  GError              **error)
 {
     NMSettingVpnPrivate *priv           = NM_SETTING_VPN_GET_PRIVATE(setting);
+    NMSettingSecretFlags implied_flags  = NM_SETTING_SECRET_FLAG_NONE;
     gs_free char        *flags_key_free = NULL;
     const char          *flags_key;
     const char          *flags_val;
@@ -734,6 +778,10 @@ get_secret_flags(NMSetting            *setting,
 
     nm_assert(secret_name);
 
+    /* Secrets received via D-Bus from VPN plugins might be prefixed by a hint tag. If
+     * that's the case, process it first: remove the tag and get the flags that it implies */
+    _parse_secret_hint_tag(secret_name, &secret_name, &implied_flags);
+
     if (!secret_name[0]) {
         g_set_error(error,
                     NM_CONNECTION_ERROR,
@@ -746,7 +794,7 @@ get_secret_flags(NMSetting            *setting,
 
     if (!priv->data
         || !g_hash_table_lookup_extended(priv->data, flags_key, NULL, (gpointer *) &flags_val)) {
-        NM_SET_OUT(out_flags, NM_SETTING_SECRET_FLAG_NONE);
+        NM_SET_OUT(out_flags, implied_flags);
 
         /* having no secret flag for the secret is fine, as long as there
          * is the secret itself... */
@@ -772,7 +820,7 @@ get_secret_flags(NMSetting            *setting,
         return TRUE;
     }
 
-    NM_SET_OUT(out_flags, (NMSettingSecretFlags) i64);
+    NM_SET_OUT(out_flags, (NMSettingSecretFlags) i64 | implied_flags);
     return TRUE;
 }
 
@@ -783,7 +831,8 @@ set_secret_flags(NMSetting           *setting,
                  GError             **error)
 {
     nm_assert(secret_name);
-
+    nm_assert(!_parse_secret_hint_tag(secret_name, NULL, NULL)); /* Accept hint tags only via D-Bus,
+                                                                    saved by update_one_secret */
     if (!secret_name[0]) {
         g_set_error(error,
                     NM_CONNECTION_ERROR,
diff --git a/src/libnm-core-impl/nm-setting.c b/src/libnm-core-impl/nm-setting.c
index bbaa6fcd..a97edc2a 100644
--- a/src/libnm-core-impl/nm-setting.c
+++ b/src/libnm-core-impl/nm-setting.c
@@ -3745,6 +3745,7 @@ nm_setting_to_string(NMSetting *setting)
         value_str = g_variant_print(value, FALSE);
 
         g_string_append_printf(string, "\t%s : %s\n", name, value_str);
+        g_variant_unref(child);
     }
 
     return g_string_free(string, FALSE);
diff --git a/src/libnm-core-impl/nm-utils.c b/src/libnm-core-impl/nm-utils.c
index b6e24141..745b1f33 100644
--- a/src/libnm-core-impl/nm-utils.c
+++ b/src/libnm-core-impl/nm-utils.c
@@ -329,9 +329,10 @@ good:
 
 typedef const char *const StrvArray4Type[4];
 
-#define LL(l, ...)                               \
-    {                                            \
-        .name = l, .value = {__VA_ARGS__, NULL}, \
+#define LL(l, ...)                    \
+    {                                 \
+        .name  = l,                   \
+        .value = {__VA_ARGS__, NULL}, \
     }
 
 /* 5-letter language codes */
diff --git a/src/libnm-core-impl/tests/certs/test-cert.p12 b/src/libnm-core-impl/tests/certs/test-cert.p12
index ae4a6830..185ed336 100644
--- a/src/libnm-core-impl/tests/certs/test-cert.p12
+++ b/src/libnm-core-impl/tests/certs/test-cert.p12
Binary files differdiff --git a/src/libnm-core-impl/tests/certs/test2-cert.p12 b/src/libnm-core-impl/tests/certs/test2-cert.p12
index 9d5732b0..1f341dd9 100644
--- a/src/libnm-core-impl/tests/certs/test2-cert.p12
+++ b/src/libnm-core-impl/tests/certs/test2-cert.p12
Binary files differdiff --git a/src/libnm-glib-aux/nm-prioq.h b/src/libnm-glib-aux/nm-prioq.h
index 51e5b059..1c16452b 100644
--- a/src/libnm-glib-aux/nm-prioq.h
+++ b/src/libnm-glib-aux/nm-prioq.h
@@ -25,11 +25,12 @@ typedef struct {
     } _priv;
 } NMPrioq;
 
-#define NM_PRIOQ_ZERO             \
-    {                             \
-        ._priv = {                \
-            .compare_func = NULL, \
-        },                        \
+#define NM_PRIOQ_ZERO                 \
+    {                                 \
+        ._priv =                      \
+            {                         \
+                .compare_func = NULL, \
+            },                        \
     }
 
 void nm_prioq_init(NMPrioq *q, GCompareFunc compare_func);
diff --git a/src/libnm-glib-aux/nm-shared-utils.h b/src/libnm-glib-aux/nm-shared-utils.h
index 804034d2..d350d32e 100644
--- a/src/libnm-glib-aux/nm-shared-utils.h
+++ b/src/libnm-glib-aux/nm-shared-utils.h
@@ -198,14 +198,15 @@ typedef struct {
 
 #define _NM_ETHER_ADDR_INIT(a0, a1, a2, a3, a4, a5) \
     {                                               \
-        .ether_addr_octet = {                       \
-            (a0),                                   \
-            (a1),                                   \
-            (a2),                                   \
-            (a3),                                   \
-            (a4),                                   \
-            (a5),                                   \
-        },                                          \
+        .ether_addr_octet =                         \
+            {                                       \
+                (a0),                               \
+                (a1),                               \
+                (a2),                               \
+                (a3),                               \
+                (a4),                               \
+                (a5),                               \
+            },                                      \
     }
 
 #define NM_ETHER_ADDR_INIT(...) ((NMEtherAddr) _NM_ETHER_ADDR_INIT(__VA_ARGS__))
@@ -806,7 +807,8 @@ typedef struct {
 
 #define NM_UTILS_FLAGS2STR(f, n) \
     {                            \
-        .flag = f, .name = "" n, \
+        .flag = f,               \
+        .name = "" n,            \
     }
 
 #define NM_UTILS_FLAGS2STR_DEFINE(fcn_name, flags_type, ...)                    \
@@ -1749,10 +1751,7 @@ typedef struct {
     };
 } NMUtilsNamedValue;
 
-#define NM_UTILS_NAMED_VALUE_INIT(n, v) \
-    {                                   \
-        .name = (n), .value_ptr = (v)   \
-    }
+#define NM_UTILS_NAMED_VALUE_INIT(n, v) {.name = (n), .value_ptr = (v)}
 
 NMUtilsNamedValue *nm_utils_hash_to_array_full(GHashTable         *hash,
                                                guint              *out_len,
@@ -2444,10 +2443,7 @@ int     nm_utils_fd_read_loop_exact(int fd, void *buf, size_t nbytes, bool do_po
         __VA_ARGS__ NULL,                                   \
     }))
 
-#define NM_DEFINE_GDBUS_SIGNAL_INFO_INIT(name_, ...) \
-    {                                                \
-        .ref_count = -1, .name = name_, __VA_ARGS__  \
-    }
+#define NM_DEFINE_GDBUS_SIGNAL_INFO_INIT(name_, ...) {.ref_count = -1, .name = name_, __VA_ARGS__}
 
 #define NM_DEFINE_GDBUS_SIGNAL_INFO(name_, ...) \
     ((GDBusSignalInfo *) (&(                    \
@@ -2458,10 +2454,7 @@ int     nm_utils_fd_read_loop_exact(int fd, void *buf, size_t nbytes, bool do_po
         __VA_ARGS__ NULL,                               \
     }))
 
-#define NM_DEFINE_GDBUS_METHOD_INFO_INIT(name_, ...) \
-    {                                                \
-        .ref_count = -1, .name = name_, __VA_ARGS__  \
-    }
+#define NM_DEFINE_GDBUS_METHOD_INFO_INIT(name_, ...) {.ref_count = -1, .name = name_, __VA_ARGS__}
 
 #define NM_DEFINE_GDBUS_METHOD_INFO(name_, ...) \
     ((GDBusMethodInfo *) (&(                    \
@@ -2473,9 +2466,7 @@ int     nm_utils_fd_read_loop_exact(int fd, void *buf, size_t nbytes, bool do_po
     }))
 
 #define NM_DEFINE_GDBUS_INTERFACE_INFO_INIT(name_, ...) \
-    {                                                   \
-        .ref_count = -1, .name = name_, __VA_ARGS__     \
-    }
+    {.ref_count = -1, .name = name_, __VA_ARGS__}
 
 #define NM_DEFINE_GDBUS_INTERFACE_INFO(name_, ...) \
     ((GDBusInterfaceInfo *) (&(                    \
diff --git a/src/libnm-platform/nm-platform-utils.c b/src/libnm-platform/nm-platform-utils.c
index 6074c342..6f3ad05c 100644
--- a/src/libnm-platform/nm-platform-utils.c
+++ b/src/libnm-platform/nm-platform-utils.c
@@ -68,9 +68,10 @@ typedef struct {
     char      ifname[IFNAMSIZ];
 } SocketHandle;
 
-#define SOCKET_HANDLE_INIT(_ifindex)     \
-    {                                    \
-        .fd = -1, .ifindex = (_ifindex), \
+#define SOCKET_HANDLE_INIT(_ifindex) \
+    {                                \
+        .fd      = -1,               \
+        .ifindex = (_ifindex),       \
     }
 
 static void
@@ -430,10 +431,11 @@ ethtool_get_stringset_index(SocketHandle *shandle, int stringset_id, const char
 /*****************************************************************************/
 
 static const NMEthtoolFeatureInfo _ethtool_feature_infos[_NM_ETHTOOL_ID_FEATURE_NUM] = {
-#define ETHT_FEAT(eid, ...)                                        \
-    {                                                              \
-        .ethtool_id = eid, .n_kernel_names = NM_NARG(__VA_ARGS__), \
-        .kernel_names = ((const char *const[]){__VA_ARGS__}),      \
+#define ETHT_FEAT(eid, ...)                                     \
+    {                                                           \
+        .ethtool_id     = eid,                                  \
+        .n_kernel_names = NM_NARG(__VA_ARGS__),                 \
+        .kernel_names   = ((const char *const[]){__VA_ARGS__}), \
     }
 
     /* the order does only matter for one thing: if it happens that more than one NMEthtoolID
diff --git a/src/libnm-platform/nmp-object.c b/src/libnm-platform/nmp-object.c
index cb4e9764..4ba9773c 100644
--- a/src/libnm-platform/nmp-object.c
+++ b/src/libnm-platform/nmp-object.c
@@ -2002,7 +2002,8 @@ _vt_dedup_obj_clone(const NMDedupMultiObj *obj)
 
 #define DEDUP_MULTI_OBJ_CLASS_INIT()                                                       \
     {                                                                                      \
-        .obj_clone = _vt_dedup_obj_clone, .obj_destroy = _vt_dedup_obj_destroy,            \
+        .obj_clone   = _vt_dedup_obj_clone,                                                \
+        .obj_destroy = _vt_dedup_obj_destroy,                                              \
         .obj_full_hash_update =                                                            \
             (void (*)(const NMDedupMultiObj *obj, NMHashState *h)) nmp_object_hash_update, \
         .obj_full_equal = (gboolean(*)(const NMDedupMultiObj *obj_a,                       \
diff --git a/src/libnm-platform/nmp-object.h b/src/libnm-platform/nmp-object.h
index 19cace3d..9406f651 100644
--- a/src/libnm-platform/nmp-object.h
+++ b/src/libnm-platform/nmp-object.h
@@ -38,11 +38,12 @@ G_STATIC_ASSERT(sizeof(NMSockAddrUnion) == sizeof(((NMSockAddrUnion *) NULL)->in
 
 /* we initialize the largest union member, to ensure that all fields are initialized. */
 
-#define NM_SOCK_ADDR_UNION_INIT_UNSPEC \
-    {                                  \
-        .in6 = {                       \
-            .sin6_family = AF_UNSPEC,  \
-        },                             \
+#define NM_SOCK_ADDR_UNION_INIT_UNSPEC    \
+    {                                     \
+        .in6 =                            \
+            {                             \
+                .sin6_family = AF_UNSPEC, \
+            },                            \
     }
 
 int nm_sock_addr_union_cmp(const NMSockAddrUnion *a, const NMSockAddrUnion *b);
diff --git a/src/libnmc-base/nm-secret-agent-simple.c b/src/libnmc-base/nm-secret-agent-simple.c
index 4bb77c98..9d1a2ae9 100644
--- a/src/libnmc-base/nm-secret-agent-simple.c
+++ b/src/libnmc-base/nm-secret-agent-simple.c
@@ -431,7 +431,7 @@ add_vpn_secrets(RequestData *request, GPtrArray *secrets, char **msg)
     const NmcVpnPasswordName *p;
     const char               *vpn_msg = NULL;
     char                    **iter;
-    char                     *secret_name;
+    char                     *ui_name;
     bool                      is_challenge = FALSE;
     bool                      force_echo;
 
@@ -442,19 +442,19 @@ add_vpn_secrets(RequestData *request, GPtrArray *secrets, char **msg)
                 vpn_msg = &(*iter)[NM_STRLEN(NM_SECRET_TAG_VPN_MSG)];
             } else {
                 if (NM_STR_HAS_PREFIX(*iter, NM_SECRET_TAG_DYNAMIC_CHALLENGE)) {
-                    secret_name  = &(*iter)[NM_STRLEN(NM_SECRET_TAG_DYNAMIC_CHALLENGE)];
+                    ui_name      = &(*iter)[NM_STRLEN(NM_SECRET_TAG_DYNAMIC_CHALLENGE)];
                     is_challenge = TRUE;
                     force_echo   = FALSE;
                 } else if (NM_STR_HAS_PREFIX(*iter, NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO)) {
-                    secret_name  = &(*iter)[NM_STRLEN(NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO)];
+                    ui_name      = &(*iter)[NM_STRLEN(NM_SECRET_TAG_DYNAMIC_CHALLENGE_ECHO)];
                     is_challenge = TRUE;
                     force_echo   = TRUE;
                 } else {
-                    secret_name = *iter;
-                    force_echo  = FALSE;
+                    ui_name    = *iter;
+                    force_echo = FALSE;
                 }
 
-                add_vpn_secret_helper(secrets, s_vpn, secret_name, secret_name, force_echo);
+                add_vpn_secret_helper(secrets, s_vpn, *iter, ui_name, force_echo);
             }
         }
     }
diff --git a/src/nmcli/gen-metadata-nm-settings-nmcli.c b/src/nmcli/gen-metadata-nm-settings-nmcli.c
index babf1f06..1764da73 100644
--- a/src/nmcli/gen-metadata-nm-settings-nmcli.c
+++ b/src/nmcli/gen-metadata-nm-settings-nmcli.c
@@ -34,6 +34,8 @@ static void G_GNUC_PRINTF(3, 4)
                                prop_info->property_name,
                                (int) prop_info->property_type->doc_format,
                                msg);
+    va_end(vaargs);
+
     if (fatal)
         g_error("%s", msg_full);
     else
diff --git a/src/nmcli/nmcli.c b/src/nmcli/nmcli.c
index 6de42faa..a8eb732c 100644
--- a/src/nmcli/nmcli.c
+++ b/src/nmcli/nmcli.c
@@ -35,49 +35,50 @@
 #define NMCLI_VERSION VERSION
 #endif
 
-#define _NMC_COLOR_PALETTE_INIT()                              \
-    {                                                          \
-        .ansi_seq = {                                          \
-            [NM_META_COLOR_CONNECTION_ACTIVATED]     = "32",   \
-            [NM_META_COLOR_CONNECTION_ACTIVATING]    = "33",   \
-            [NM_META_COLOR_CONNECTION_DISCONNECTING] = "31",   \
-            [NM_META_COLOR_CONNECTION_INVISIBLE]     = "2",    \
-            [NM_META_COLOR_CONNECTION_EXTERNAL]      = "32;2", \
-            [NM_META_COLOR_CONNECTION_DEPRECATED]    = "2",    \
-            [NM_META_COLOR_CONNECTIVITY_FULL]        = "32",   \
-            [NM_META_COLOR_CONNECTIVITY_LIMITED]     = "33",   \
-            [NM_META_COLOR_CONNECTIVITY_NONE]        = "31",   \
-            [NM_META_COLOR_CONNECTIVITY_PORTAL]      = "33",   \
-            [NM_META_COLOR_DEVICE_ACTIVATED]         = "32",   \
-            [NM_META_COLOR_DEVICE_ACTIVATING]        = "33",   \
-            [NM_META_COLOR_DEVICE_DISCONNECTED]      = "31",   \
-            [NM_META_COLOR_DEVICE_FIRMWARE_MISSING]  = "31",   \
-            [NM_META_COLOR_DEVICE_PLUGIN_MISSING]    = "31",   \
-            [NM_META_COLOR_DEVICE_UNAVAILABLE]       = "2",    \
-            [NM_META_COLOR_DEVICE_DISABLED]          = "31",   \
-            [NM_META_COLOR_DEVICE_EXTERNAL]          = "32;2", \
-            [NM_META_COLOR_MANAGER_RUNNING]          = "32",   \
-            [NM_META_COLOR_MANAGER_STARTING]         = "33",   \
-            [NM_META_COLOR_MANAGER_STOPPED]          = "31",   \
-            [NM_META_COLOR_PERMISSION_AUTH]          = "33",   \
-            [NM_META_COLOR_PERMISSION_NO]            = "31",   \
-            [NM_META_COLOR_PERMISSION_YES]           = "32",   \
-            [NM_META_COLOR_STATE_ASLEEP]             = "31",   \
-            [NM_META_COLOR_STATE_CONNECTED_GLOBAL]   = "32",   \
-            [NM_META_COLOR_STATE_CONNECTED_LOCAL]    = "32",   \
-            [NM_META_COLOR_STATE_CONNECTED_SITE]     = "32",   \
-            [NM_META_COLOR_STATE_CONNECTING]         = "33",   \
-            [NM_META_COLOR_STATE_DISCONNECTED]       = "31",   \
-            [NM_META_COLOR_STATE_DISCONNECTING]      = "33",   \
-            [NM_META_COLOR_WIFI_SIGNAL_EXCELLENT]    = "32",   \
-            [NM_META_COLOR_WIFI_SIGNAL_FAIR]         = "35",   \
-            [NM_META_COLOR_WIFI_SIGNAL_GOOD]         = "33",   \
-            [NM_META_COLOR_WIFI_SIGNAL_POOR]         = "36",   \
-            [NM_META_COLOR_WIFI_SIGNAL_UNKNOWN]      = "2",    \
-            [NM_META_COLOR_WIFI_DEPRECATED]          = "2",    \
-            [NM_META_COLOR_ENABLED]                  = "32",   \
-            [NM_META_COLOR_DISABLED]                 = "31",   \
-        },                                                     \
+#define _NMC_COLOR_PALETTE_INIT()                                  \
+    {                                                              \
+        .ansi_seq =                                                \
+            {                                                      \
+                [NM_META_COLOR_CONNECTION_ACTIVATED]     = "32",   \
+                [NM_META_COLOR_CONNECTION_ACTIVATING]    = "33",   \
+                [NM_META_COLOR_CONNECTION_DISCONNECTING] = "31",   \
+                [NM_META_COLOR_CONNECTION_INVISIBLE]     = "2",    \
+                [NM_META_COLOR_CONNECTION_EXTERNAL]      = "32;2", \
+                [NM_META_COLOR_CONNECTION_DEPRECATED]    = "2",    \
+                [NM_META_COLOR_CONNECTIVITY_FULL]        = "32",   \
+                [NM_META_COLOR_CONNECTIVITY_LIMITED]     = "33",   \
+                [NM_META_COLOR_CONNECTIVITY_NONE]        = "31",   \
+                [NM_META_COLOR_CONNECTIVITY_PORTAL]      = "33",   \
+                [NM_META_COLOR_DEVICE_ACTIVATED]         = "32",   \
+                [NM_META_COLOR_DEVICE_ACTIVATING]        = "33",   \
+                [NM_META_COLOR_DEVICE_DISCONNECTED]      = "31",   \
+                [NM_META_COLOR_DEVICE_FIRMWARE_MISSING]  = "31",   \
+                [NM_META_COLOR_DEVICE_PLUGIN_MISSING]    = "31",   \
+                [NM_META_COLOR_DEVICE_UNAVAILABLE]       = "2",    \
+                [NM_META_COLOR_DEVICE_DISABLED]          = "31",   \
+                [NM_META_COLOR_DEVICE_EXTERNAL]          = "32;2", \
+                [NM_META_COLOR_MANAGER_RUNNING]          = "32",   \
+                [NM_META_COLOR_MANAGER_STARTING]         = "33",   \
+                [NM_META_COLOR_MANAGER_STOPPED]          = "31",   \
+                [NM_META_COLOR_PERMISSION_AUTH]          = "33",   \
+                [NM_META_COLOR_PERMISSION_NO]            = "31",   \
+                [NM_META_COLOR_PERMISSION_YES]           = "32",   \
+                [NM_META_COLOR_STATE_ASLEEP]             = "31",   \
+                [NM_META_COLOR_STATE_CONNECTED_GLOBAL]   = "32",   \
+                [NM_META_COLOR_STATE_CONNECTED_LOCAL]    = "32",   \
+                [NM_META_COLOR_STATE_CONNECTED_SITE]     = "32",   \
+                [NM_META_COLOR_STATE_CONNECTING]         = "33",   \
+                [NM_META_COLOR_STATE_DISCONNECTED]       = "31",   \
+                [NM_META_COLOR_STATE_DISCONNECTING]      = "33",   \
+                [NM_META_COLOR_WIFI_SIGNAL_EXCELLENT]    = "32",   \
+                [NM_META_COLOR_WIFI_SIGNAL_FAIR]         = "35",   \
+                [NM_META_COLOR_WIFI_SIGNAL_GOOD]         = "33",   \
+                [NM_META_COLOR_WIFI_SIGNAL_POOR]         = "36",   \
+                [NM_META_COLOR_WIFI_SIGNAL_UNKNOWN]      = "2",    \
+                [NM_META_COLOR_WIFI_DEPRECATED]          = "2",    \
+                [NM_META_COLOR_ENABLED]                  = "32",   \
+                [NM_META_COLOR_DISABLED]                 = "31",   \
+            },                                                     \
     }
 
 static NmCli nm_cli = {