// SPDX-License-Identifier: LGPL-2.1+
/*
 * Copyright (C) 2018 - 2019 Red Hat, Inc.
 */

#include "nm-default.h"

#include "nm-setting-wireguard.h"

#include "nm-setting-private.h"
#include "nm-utils-private.h"
#include "nm-connection-private.h"
#include "nm-glib-aux/nm-secret-utils.h"

/*****************************************************************************/

/**
 * SECTION:nm-setting-wireguard
 * @short_description: Describes connection properties for wireguard related options
 *
 * The #NMSettingWireGuard object is a #NMSetting subclass that contains settings
 * for configuring WireGuard.
 **/

/*****************************************************************************/

static NMWireGuardPeer *_wireguard_peer_dup (const NMWireGuardPeer *self);

G_DEFINE_BOXED_TYPE (NMWireGuardPeer, nm_wireguard_peer, _wireguard_peer_dup, nm_wireguard_peer_unref)

/* NMWireGuardPeer can also track invalid allowed-ip settings, and only reject
 * them later during is_valid(). Such values are marked by a leading 'X' character
 * in the @allowed_ips. It is expected, that such values are the expception, and
 * commonly not present. */
#define ALLOWED_IP_INVALID_X     'X'
#define ALLOWED_IP_INVALID_X_STR "X"

/**
 * NMWireGuardPeer:
 *
 * The settings of one WireGuard peer.
 *
 * Since: 1.16
 */
struct _NMWireGuardPeer {
	NMSockAddrEndpoint *endpoint;
	char *public_key;
	char *preshared_key;
	GPtrArray *allowed_ips;
	guint refcount;
	NMSettingSecretFlags preshared_key_flags;
	guint16 persistent_keepalive;
	bool public_key_valid:1;
	bool preshared_key_valid:1;
	bool sealed:1;
};

static gboolean
NM_IS_WIREGUARD_PEER (const NMWireGuardPeer *self, gboolean also_sealed)
{
	return    self
	       && self->refcount > 0
	       && (   also_sealed
	           || !self->sealed);
}

/**
 * nm_wireguard_peer_new:
 *
 * Returns: (transfer full): a new, default, unsealed #NMWireGuardPeer instance.
 *
 * Since: 1.16
 */
NMWireGuardPeer *
nm_wireguard_peer_new (void)
{
	NMWireGuardPeer *self;

	self = g_slice_new (NMWireGuardPeer);
	*self = (NMWireGuardPeer) {
		.refcount            = 1,
		.preshared_key_flags = NM_SETTING_SECRET_FLAG_NOT_REQUIRED,
	};
	return self;
}

/**
 * nm_wireguard_peer_new_clone:
 * @self: the #NMWireGuardPeer instance to copy.
 * @with_secrets: if %TRUE, the preshared-key secrets are copied
 *  as well. Otherwise, they will be removed.
 *
 * Returns: (transfer full): a clone of @self. This instance
 *   is always unsealed.
 *
 * Since: 1.16
 */
NMWireGuardPeer *
nm_wireguard_peer_new_clone (const NMWireGuardPeer *self,
                             gboolean with_secrets)
{
	NMWireGuardPeer *new;
	guint i;

	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE), NULL);

	new = g_slice_new (NMWireGuardPeer);
	*new = (NMWireGuardPeer) {
		.refcount             = 1,
		.public_key           = g_strdup (self->public_key),
		.public_key_valid     = self->public_key_valid,
		.preshared_key        = with_secrets ? g_strdup (self->preshared_key) : NULL,
		.preshared_key_valid  = self->preshared_key_valid,
		.preshared_key_flags  = self->preshared_key_flags,
		.endpoint             = nm_sock_addr_endpoint_ref (self->endpoint),
		.persistent_keepalive = self->persistent_keepalive,
	};
	if (   self->allowed_ips
	    && self->allowed_ips->len > 0) {
		new->allowed_ips = g_ptr_array_new_full (self->allowed_ips->len,
		                                         g_free);
		for (i = 0; i < self->allowed_ips->len; i++) {
			g_ptr_array_add (new->allowed_ips,
			                 g_strdup (self->allowed_ips->pdata[i]));
		}
	}
	return new;
}

/**
 * nm_wireguard_peer_ref:
 * @self: (allow-none): the #NMWireGuardPeer instance
 *
 * This is not thread-safe.
 *
 * Returns: returns the input argument @self after incrementing
 *   the reference count.
 *
 * Since: 1.16
 */
NMWireGuardPeer *
nm_wireguard_peer_ref (NMWireGuardPeer *self)
{
	if (!self)
		return NULL;

	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE), NULL);

	nm_assert (self->refcount < G_MAXUINT);

	self->refcount++;
	return self;
}

/**
 * nm_wireguard_peer_unref:
 * @self: (allow-none): the #NMWireGuardPeer instance
 *
 * Drop a reference to @self. If the last reference is dropped,
 * the instance is freed and all accociate data released.
 *
 * This is not thread-safe.
 *
 * Since: 1.16
 */
void
nm_wireguard_peer_unref (NMWireGuardPeer *self)
{
	if (!self)
		return;

	g_return_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE));

	if (--self->refcount > 0)
		return;

	nm_sock_addr_endpoint_unref (self->endpoint);
	if (self->allowed_ips)
		g_ptr_array_unref (self->allowed_ips);
	g_free (self->public_key);
	nm_free_secret (self->preshared_key);
	g_slice_free (NMWireGuardPeer, self);
}

/**
 * _wireguard_peer_dup:
 * @self: the #NMWireGuardPeer instance
 *
 * Duplicates the #NMWireGuardPeer instance. Note that if @self
 * is already sealed, this increments the reference count and
 * returns it. If the instance is still unsealed, it is copied.
 *
 * Returns: (transfer full): a duplicate of @self, or (if the
 *   instance is sealed and thus immutable) a reference to @self.
 *   As such, the instance will be sealed if and only if @self is
 *   sealed.
 */
static NMWireGuardPeer *
_wireguard_peer_dup (const NMWireGuardPeer *self)
{
	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE), NULL);

	if (self->sealed)
		return nm_wireguard_peer_ref ((NMWireGuardPeer *) self);
	return nm_wireguard_peer_new_clone (self, TRUE);
}

/**
 * nm_wireguard_peer_seal:
 * @self: the #NMWireGuardPeer instance
 *
 * Seal the #NMWireGuardPeer instance. Afterwards, it is a bug
 * to call all functions that modify the instance (except ref/unref).
 * A sealed instance cannot be unsealed again, but you can create
 * an unsealed copy with nm_wireguard_peer_new_clone().
 *
 * Since: 1.16
 */
void
nm_wireguard_peer_seal (NMWireGuardPeer *self)
{
	g_return_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE));

	self->sealed = TRUE;

	if (self->allowed_ips) {
		if (self->allowed_ips->len == 0)
			nm_clear_pointer (&self->allowed_ips, g_ptr_array_unref);
	}
}

/**
 * nm_wireguard_peer_is_sealed:
 * @self: the #NMWireGuardPeer instance
 *
 * Returns: whether @self is sealed or not.
 *
 * Since: 1.16
 */
gboolean
nm_wireguard_peer_is_sealed (const NMWireGuardPeer *self)
{
	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE), FALSE);

	return self->sealed;
}

/**
 * nm_wireguard_peer_get_public_key:
 * @self: the #NMWireGuardPeer instance
 *
 * Returns: (transfer none): the public key or %NULL if unset.
 *
 * Since: 1.16
 */
const char *
nm_wireguard_peer_get_public_key (const NMWireGuardPeer *self)
{
	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE), NULL);

	return self->public_key;
}

/**
 * nm_wireguard_peer_set_public_key:
 * @self: the unsealed #NMWireGuardPeer instance
 * @public_key: (allow-none) (transfer none): the new public
 *   key or %NULL to clear the public key.
 * @accept_invalid: if %TRUE and @public_key is not %NULL and
 *   invalid, then do not modify the instance.
 *
 * Reset the public key. Note that if the public key is valid, it
 * will be normalized (which may or may not modify the set value).
 *
 * It is a bug trying to modify a sealed #NMWireGuardPeer instance.
 *
 * Returns: %TRUE if the key was valid or %NULL. Returns
 *   %FALSE for invalid keys. Depending on @accept_invalid
 *   will an invalid key be set or not.
 *
 * Since: 1.16
 */
gboolean
nm_wireguard_peer_set_public_key (NMWireGuardPeer *self,
                                  const char *public_key,
                                  gboolean accept_invalid)
{
	char *public_key_normalized = NULL;
	gboolean is_valid;

	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, FALSE), FALSE);

	if (!public_key) {
		nm_clear_g_free (&self->public_key);
		return TRUE;
	}

	is_valid = nm_utils_base64secret_normalize (public_key,
	                                            NM_WIREGUARD_PUBLIC_KEY_LEN,
	                                            &public_key_normalized);
	nm_assert (is_valid == (public_key_normalized != NULL));

	if (   !is_valid
	    && !accept_invalid)
		return FALSE;

	self->public_key_valid = is_valid;
	g_free (self->public_key);
	self->public_key = public_key_normalized ?: g_strdup (public_key);
	return is_valid;
}

void
_nm_wireguard_peer_set_public_key_bin (NMWireGuardPeer *self,
                                       const guint8 public_key[static NM_WIREGUARD_PUBLIC_KEY_LEN])
{
	g_return_if_fail (NM_IS_WIREGUARD_PEER (self, FALSE));

	nm_clear_g_free (&self->public_key);

	if (!public_key)
		return;

	self->public_key = g_base64_encode (public_key, NM_WIREGUARD_PUBLIC_KEY_LEN);
	self->public_key_valid = TRUE;
}

/**
 * nm_wireguard_peer_get_preshared_key:
 * @self: the #NMWireGuardPeer instance
 *
 * Returns: (transfer none): the preshared key or %NULL if unset.
 *
 * Since: 1.16
 */
const char *
nm_wireguard_peer_get_preshared_key (const NMWireGuardPeer *self)
{
	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE), NULL);

	return self->preshared_key;
}

/**
 * nm_wireguard_peer_set_preshared_key:
 * @self: the unsealed #NMWireGuardPeer instance
 * @preshared_key: (allow-none) (transfer none): the new preshared
 *   key or %NULL to clear the preshared key.
 * @accept_invalid: whether to allow setting the key to an invalid
 *   value. If %FALSE, @self is unchanged if the key is invalid
 *   and if %FALSE is returned.
 *
 * Reset the preshared key. Note that if the preshared key is valid, it
 * will be normalized (which may or may not modify the set value).
 *
 * Note that the preshared-key is a secret and consequently has corresponding
 * preshared-key-flags property. This is so that secrets can be optional
 * and requested on demand from a secret-agent. Also, an invalid  preshared-key
 * may optionally cause nm_wireguard_peer_is_valid() to fail or it may
 * be accepted.
 *
 * It is a bug trying to modify a sealed #NMWireGuardPeer instance.
 *
 * Returns: %TRUE if the preshared-key is valid, otherwise %FALSE.
 *   %NULL is considered a valid value.
 *   If the key is invalid, it depends on @accept_invalid whether the
 *   previous value was reset.
 *
 * Since: 1.16
 */
gboolean
nm_wireguard_peer_set_preshared_key (NMWireGuardPeer *self,
                                     const char *preshared_key,
                                     gboolean accept_invalid)
{
	char *preshared_key_normalized = NULL;
	gboolean is_valid;

	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, FALSE), FALSE);

	if (!preshared_key) {
		nm_clear_pointer (&self->preshared_key, nm_free_secret);
		return TRUE;
	}

	is_valid = nm_utils_base64secret_normalize (preshared_key,
	                                            NM_WIREGUARD_SYMMETRIC_KEY_LEN,
	                                            &preshared_key_normalized);
	nm_assert (is_valid == (preshared_key_normalized != NULL));

	if (   !is_valid
	    && !accept_invalid)
		return FALSE;

	self->preshared_key_valid = is_valid;
	nm_free_secret (self->preshared_key);
	self->preshared_key = preshared_key_normalized ?: g_strdup (preshared_key);
	return is_valid;
}

/**
 * nm_wireguard_peer_get_preshared_key_flags:
 * @self: the #NMWireGuardPeer instance
 *
 * Returns: get the secret flags for the preshared-key.
 *
 * Since: 1.16
 */
NMSettingSecretFlags
nm_wireguard_peer_get_preshared_key_flags (const NMWireGuardPeer *self)
{
	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE), 0);

	return self->preshared_key_flags;
}

/**
 * nm_wireguard_peer_set_preshared_key_flags:
 * @self: the unsealed #NMWireGuardPeer instance
 * @preshared_key_flags: the secret flags to set.
 *
 * It is a bug trying to modify a sealed #NMWireGuardPeer instance.
 *
 * Since: 1.16
 */
void
nm_wireguard_peer_set_preshared_key_flags (NMWireGuardPeer *self,
                                           NMSettingSecretFlags preshared_key_flags)
{
	g_return_if_fail (NM_IS_WIREGUARD_PEER (self, FALSE));

	self->preshared_key_flags = preshared_key_flags;
}

/**
 * nm_wireguard_peer_get_persistent_keepalive:
 * @self: the #NMWireGuardPeer instance
 *
 * Returns: get the persistent-keepalive setting in seconds. Set to zero to disable
 *   keep-alive.
 *
 * Since: 1.16
 */
guint16
nm_wireguard_peer_get_persistent_keepalive (const NMWireGuardPeer *self)
{
	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE), 0);

	return self->persistent_keepalive;
}

/**
 * nm_wireguard_peer_set_persistent_keepalive:
 * @self: the unsealed #NMWireGuardPeer instance
 * @persistent_keepalive: the keep-alive value to set.
 *
 * It is a bug trying to modify a sealed #NMWireGuardPeer instance.
 *
 * Since: 1.16
 */
void
nm_wireguard_peer_set_persistent_keepalive (NMWireGuardPeer *self,
                                            guint16 persistent_keepalive)
{
	g_return_if_fail (NM_IS_WIREGUARD_PEER (self, FALSE));

	self->persistent_keepalive = persistent_keepalive;
}

NMSockAddrEndpoint *
_nm_wireguard_peer_get_endpoint (const NMWireGuardPeer *self)
{
	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE), NULL);

	return self->endpoint;
}

/**
 * nm_wireguard_peer_get_endpoint:
 * @self: the #NMWireGuardPeer instance
 *
 * Returns: (transfer none): the endpoint or %NULL if none was set.
 *
 * Since: 1.16
 */
const char *
nm_wireguard_peer_get_endpoint (const NMWireGuardPeer *self)
{
	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE), NULL);

	return   self->endpoint
	       ? nm_sock_addr_endpoint_get_endpoint (self->endpoint)
	       : NULL;
}

void
_nm_wireguard_peer_set_endpoint (NMWireGuardPeer *self,
                                 NMSockAddrEndpoint *endpoint)
{
	NMSockAddrEndpoint *old;

	nm_assert (NM_IS_WIREGUARD_PEER (self, FALSE));

	old = self->endpoint;
	self->endpoint = nm_sock_addr_endpoint_ref (endpoint);
	nm_sock_addr_endpoint_unref (old);
}

/**
 * nm_wireguard_peer_set_endpoint:
 * @self: the unsealed #NMWireGuardPeer instance
 * @endpoint: the socket address endpoint to set or %NULL.
 * @allow_invalid: if %TRUE, also invalid values are set.
 *   If %FALSE, the function does nothing for invalid @endpoint
 *   arguments.
 *
 * Sets or clears the endpoint of @self.
 *
 * It is a bug trying to modify a sealed #NMWireGuardPeer instance.
 *
 * Returns: %TRUE if the endpoint is %NULL or valid. For an
 *   invalid @endpoint argument, %FALSE is returned. Depending
 *   on @allow_invalid, the instance will be modified.
 *
 * Since: 1.16
 */
gboolean
nm_wireguard_peer_set_endpoint (NMWireGuardPeer *self,
                                const char *endpoint,
                                gboolean allow_invalid)
{
	NMSockAddrEndpoint *old;
	NMSockAddrEndpoint *new;
	gboolean is_valid;

	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, FALSE), FALSE);

	if (!endpoint) {
		nm_clear_pointer (&self->endpoint, nm_sock_addr_endpoint_unref);
		return TRUE;
	}

	new = nm_sock_addr_endpoint_new (endpoint);

	is_valid = (nm_sock_addr_endpoint_get_host (new) != NULL);

	if (   !allow_invalid
	    && !is_valid) {
		nm_sock_addr_endpoint_unref (new);
		return FALSE;
	}

	old = self->endpoint;
	self->endpoint = new;
	nm_sock_addr_endpoint_unref (old);
	return is_valid;
}

/**
 * nm_wireguard_peer_get_allowed_ips_len:
 * @self: the #NMWireGuardPeer instance
 *
 * Returns: the number of allowed-ips entries.
 *
 * Since: 1.16
 */
guint
nm_wireguard_peer_get_allowed_ips_len (const NMWireGuardPeer *self)
{
	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE), 0);

	return self->allowed_ips ? self->allowed_ips->len : 0u;
}

/**
 * nm_wireguard_peer_get_allowed_ip:
 * @self: the #NMWireGuardPeer instance
 * @idx: the index from zero to (allowed-ips-len - 1) to
 *   retrieve.
 * @out_is_valid: (allow-none): %TRUE if the returned value is a valid allowed-ip
 *   setting.
 *
 * Returns: (transfer none): the allowed-ip setting at index @idx.
 *   If @idx is out of range, %NULL will be returned.
 *
 * Since: 1.16
 */
const char *
nm_wireguard_peer_get_allowed_ip (const NMWireGuardPeer *self,
                                  guint idx,
                                  gboolean *out_is_valid)
{
	const char *s;

	/* With LTO, the compiler might warn about the g_return_val_if_fail()
	 * code path not initializing the output argument. Workaround that by
	 * always setting the out argument. */
	NM_SET_OUT (out_is_valid, FALSE);

	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE), NULL);

	if (   !self->allowed_ips
	    || idx >= self->allowed_ips->len)
		return NULL;

	s = self->allowed_ips->pdata[idx];
	NM_SET_OUT (out_is_valid, s[0] != ALLOWED_IP_INVALID_X);
	return s[0] == ALLOWED_IP_INVALID_X ? &s[1] : s;
}

/**
 * nm_wireguard_peer_clear_allowed_ips:
 * @self: the unsealed #NMWireGuardPeer instance
 *
 * Removes all allowed-ip entries.
 *
 * It is a bug trying to modify a sealed #NMWireGuardPeer instance.
 *
 * Since: 1.16
 */
void
nm_wireguard_peer_clear_allowed_ips (NMWireGuardPeer *self)
{
	g_return_if_fail (NM_IS_WIREGUARD_PEER (self, FALSE));

	if (self->allowed_ips)
		g_ptr_array_set_size (self->allowed_ips, 0);
}

static gboolean
_peer_append_allowed_ip (NMWireGuardPeer *self,
                         const char *allowed_ip,
                         gboolean accept_invalid)
{
	int addr_family;
	int prefix;
	NMIPAddr addrbin;
	char *str;
	gboolean is_valid = TRUE;

	nm_assert (NM_IS_WIREGUARD_PEER (self, FALSE));
	nm_assert (allowed_ip);

	/* normalize the address (if it is valid. Otherwise, take it
	 * as-is (it will render the instance invalid). */
	if (!nm_utils_parse_inaddr_prefix_bin (AF_UNSPEC,
	                                       allowed_ip,
	                                       &addr_family,
	                                       &addrbin,
	                                       &prefix)) {
		if (!accept_invalid)
			return FALSE;
		/* mark the entry as invalid by having a "X" prefix. */
		str = g_strconcat (ALLOWED_IP_INVALID_X_STR, allowed_ip, NULL);
		is_valid = FALSE;
	} else {
		char addrstr[NM_UTILS_INET_ADDRSTRLEN];

		nm_assert_addr_family (addr_family);

		nm_utils_inet_ntop (addr_family, &addrbin, addrstr);
		if (prefix >= 0)
			str = g_strdup_printf ("%s/%d", addrstr, prefix);
		else
			str = g_strdup (addrstr);
		nm_assert (str[0] != ALLOWED_IP_INVALID_X);
	}

	if (!self->allowed_ips)
		self->allowed_ips = g_ptr_array_new_with_free_func (g_free);

	g_ptr_array_add (self->allowed_ips, str);
	return is_valid;
}

/**
 * nm_wireguard_peer_append_allowed_ip:
 * @self: the unsealed #NMWireGuardPeer instance
 * @allowed_ip: the allowed-ip entry to set.
 * @accept_invalid: if %TRUE, also invalid @allowed_ip value
 *   will be appended. Otherwise, the function does nothing
 *   in face of invalid values and returns %FALSE.
 *
 * Appends @allowed_ip setting to the list. This does not check
 * for duplicates and always appends @allowed_ip to the end of the
 * list. If @allowed_ip is valid, it will be normalized and a modified
 * for might be appended. If @allowed_ip is invalid, it will still be
 * appended, but later verification will fail.
 *
 * It is a bug trying to modify a sealed #NMWireGuardPeer instance.
 *
 * Returns: %TRUE if the value is a valid allowed-ips value, %FALSE otherwise.
 *   Depending on @accept_invalid, also invalid values are added.
 *
 * Since: 1.16
 */
gboolean
nm_wireguard_peer_append_allowed_ip (NMWireGuardPeer *self,
                                     const char *allowed_ip,
                                     gboolean accept_invalid)
{
	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, FALSE), FALSE);
	g_return_val_if_fail (allowed_ip, FALSE);

	return _peer_append_allowed_ip (self, allowed_ip, accept_invalid);
}

/**
 * nm_wireguard_peer_remove_allowed_ip:
 * @self: the unsealed #NMWireGuardPeer instance
 * @idx: the index from zero to (allowed-ips-len - 1) to
 *   retrieve. If the index is out of range, %FALSE is returned
 *   and nothing is done.
 *
 * Removes the allowed-ip at the given @idx. This shifts all
 * following entries one index down.
 *
 * It is a bug trying to modify a sealed #NMWireGuardPeer instance.
 *
 * Returns: %TRUE if @idx was valid and the allowed-ip was removed.
 *   %FALSE otherwise, and the peer will not be changed.
 *
 * Since: 1.16
 */
gboolean
nm_wireguard_peer_remove_allowed_ip (NMWireGuardPeer *self,
                                     guint idx)
{
	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, FALSE), FALSE);

	if (   !self->allowed_ips
	    || idx >= self->allowed_ips->len)
		return FALSE;

	g_ptr_array_remove_index (self->allowed_ips, idx);
	return TRUE;
}

/**
 * nm_wireguard_peer_is_valid:
 * @self: the #NMWireGuardPeer instance
 * @check_secrets: if %TRUE, non-secret properties are validated.
 *   Otherwise they are ignored for this purpose.
 * @check_non_secrets: if %TRUE, secret properties are validated.
 *   Otherwise they are ignored for this purpose.
 * @error: the #GError location for returning the failure reason.
 *
 * Returns:  %TRUE if the peer is valid or fails with an error
 *   reason.
 *
 * Since: 1.16
 */
gboolean
nm_wireguard_peer_is_valid (const NMWireGuardPeer *self,
                            gboolean check_non_secrets,
                            gboolean check_secrets,
                            GError **error)
{
	guint i;

	g_return_val_if_fail (NM_IS_WIREGUARD_PEER (self, TRUE), FALSE);
	g_return_val_if_fail (!error || !*error, FALSE);

	if (check_non_secrets) {
		if (!self->public_key) {
			g_set_error_literal (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_MISSING_PROPERTY,
			                     _("missing public-key for peer"));
			return FALSE;
		} else if (!self->public_key_valid) {
			g_set_error_literal (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY,
			                     _("invalid public-key for peer"));
			return FALSE;
		}
	}

	if (check_secrets) {
		if (   self->preshared_key
		    && !self->preshared_key_valid) {
			g_set_error_literal (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY,
			                     _("invalid preshared-key for peer"));
			return FALSE;
		}
	}

	if (check_non_secrets) {
		if (!_nm_utils_secret_flags_validate (self->preshared_key_flags,
		                                      NULL,
		                                      NULL,
		                                      NM_SETTING_SECRET_FLAG_NONE,
		                                      error))
			return FALSE;
	}

	if (check_non_secrets) {
		if (   self->endpoint
		    && !nm_sock_addr_endpoint_get_host (self->endpoint)) {
			g_set_error_literal (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY,
			                     _("invalid endpoint for peer"));
			return FALSE;
		}

		if (self->allowed_ips) {
			for (i = 0; i < self->allowed_ips->len; i++) {
				const char *s = self->allowed_ips->pdata[i];

				if (s[0] == ALLOWED_IP_INVALID_X) {
					g_set_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY,
					             _("invalid IP address \"%s\" for allowed-ip of peer"),
					             &s[1]);
					return FALSE;
				}
			}
		}

		if (!_nm_setting_secret_flags_valid (self->preshared_key_flags)) {
			g_set_error_literal (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY,
			                     _("invalid preshared-key-flags for peer"));
			return FALSE;
		}
	}

	return TRUE;
}

/**
 * nm_wireguard_peer_cmp:
 * @a: (allow-none): the #NMWireGuardPeer to compare.
 * @b: (allow-none): the other #NMWireGuardPeer to compare.
 * @compare_flags: #NMSettingCompareFlags to affect the comparison.
 *
 * Returns: zero of the two instances are equivalent or
 *   a non-zero integer otherwise. This defines a total ordering
 *   over the peers. Whether a peer is sealed or not, does not
 *   affect the comparison.
 *
 * Since: 1.16
 */
int
nm_wireguard_peer_cmp (const NMWireGuardPeer *a,
                       const NMWireGuardPeer *b,
                       NMSettingCompareFlags compare_flags)
{
	guint i, n;

	NM_CMP_SELF (a, b);

	/* regardless of the @compare_flags, the public-key is the ID of the peer. It must
	 * always be compared. */
	NM_CMP_FIELD_BOOL (a, b, public_key_valid);
	NM_CMP_FIELD_STR0 (a, b, public_key);

	if (NM_FLAGS_ANY (compare_flags,   NM_SETTING_COMPARE_FLAG_INFERRABLE
	                                 | NM_SETTING_COMPARE_FLAG_FUZZY))
		return 0;

	NM_CMP_FIELD_BOOL (a, b, endpoint);
	if (a->endpoint) {
		NM_CMP_DIRECT_STRCMP0 (nm_sock_addr_endpoint_get_endpoint (a->endpoint),
		                       nm_sock_addr_endpoint_get_endpoint (b->endpoint));
	}

	NM_CMP_FIELD (a, b, persistent_keepalive);

	NM_CMP_DIRECT ((n = (a->allowed_ips ? a->allowed_ips->len : 0u)),
	               (     b->allowed_ips ? b->allowed_ips->len : 0u ));
	for (i = 0; i < n; i++)
		NM_CMP_DIRECT_STRCMP0 (a->allowed_ips->pdata[i], b->allowed_ips->pdata[i]);

	NM_CMP_FIELD (a, b, preshared_key_flags);

	if (!NM_FLAGS_HAS (compare_flags, NM_SETTING_COMPARE_FLAG_IGNORE_SECRETS)) {
		if (   NM_FLAGS_HAS (compare_flags, NM_SETTING_COMPARE_FLAG_IGNORE_AGENT_OWNED_SECRETS)
		    && NM_FLAGS_HAS (a->preshared_key_flags, NM_SETTING_SECRET_FLAG_AGENT_OWNED)) {
			/* pass */
		} else if (   NM_FLAGS_HAS (compare_flags, NM_SETTING_COMPARE_FLAG_IGNORE_NOT_SAVED_SECRETS)
		           && NM_FLAGS_HAS (a->preshared_key_flags, NM_SETTING_SECRET_FLAG_NOT_SAVED)) {
			/* pass */
		} else {
			NM_CMP_FIELD_BOOL (a, b, preshared_key_valid);
			NM_CMP_FIELD_STR0 (a, b, preshared_key);
		}
	}

	return 0;
}

/*****************************************************************************/

typedef struct {
	const char *public_key;
	NMWireGuardPeer *peer;
	guint idx;
} PeerData;

/*****************************************************************************/

NM_GOBJECT_PROPERTIES_DEFINE_BASE (
	PROP_FWMARK,
	PROP_IP4_AUTO_DEFAULT_ROUTE,
	PROP_IP6_AUTO_DEFAULT_ROUTE,
	PROP_LISTEN_PORT,
	PROP_MTU,
	PROP_PEER_ROUTES,
	PROP_PRIVATE_KEY,
	PROP_PRIVATE_KEY_FLAGS,
);

typedef struct {
	char *private_key;
	GPtrArray *peers_arr;
	GHashTable *peers_hash;
	NMSettingSecretFlags private_key_flags;
	NMTernary ip4_auto_default_route;
	NMTernary ip6_auto_default_route;
	guint32 fwmark;
	guint32 mtu;
	guint16 listen_port;
	bool private_key_valid:1;
	bool peer_routes:1;
} NMSettingWireGuardPrivate;

/**
 * NMSettingWireGuard:
 *
 * WireGuard Settings
 *
 * Since: 1.16
 */
struct _NMSettingWireGuard {
	NMSetting parent;
	NMSettingWireGuardPrivate _priv;
};

struct _NMSettingWireGuardClass {
	NMSettingClass parent;
};

G_DEFINE_TYPE (NMSettingWireGuard, nm_setting_wireguard, NM_TYPE_SETTING)

#define NM_SETTING_WIREGUARD_GET_PRIVATE(self) _NM_GET_PRIVATE (self, NMSettingWireGuard, NM_IS_SETTING_WIREGUARD, NMSetting)

/*****************************************************************************/

#define peers_psk_get_secret_name_a(public_key, to_free) \
	nm_construct_name_a (NM_SETTING_WIREGUARD_PEERS".%s."NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY, (public_key), (to_free))

#define peers_psk_get_secret_name_dup(public_key) \
	g_strdup_printf (NM_SETTING_WIREGUARD_PEERS".%s."NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY, (public_key))

#define peers_psk_get_secret_parse_a(secret_public_key, public_key_free) \
	({ \
		const char *_secret_public_key = (secret_public_key); \
		char **_public_key_free = (public_key_free); \
		const char *_public_key = NULL; \
		\
		nm_assert (_public_key_free && !*_public_key_free); \
		\
		if (NM_STR_HAS_PREFIX (_secret_public_key, NM_SETTING_WIREGUARD_PEERS".")) { \
			_secret_public_key += NM_STRLEN (NM_SETTING_WIREGUARD_PEERS"."); \
			if (NM_STR_HAS_SUFFIX (_secret_public_key, "."NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY)) { \
				_public_key = nm_strndup_a (300, _secret_public_key, strlen (_secret_public_key) - NM_STRLEN ("."NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY), _public_key_free); \
			} \
		} \
		\
		_public_key; \
	})

/*****************************************************************************/

/**
 * nm_setting_wireguard_get_private_key:
 * @self: the #NMSettingWireGuard instance
 *
 * Returns: (transfer none): the set private-key or %NULL.
 *
 * Since: 1.16
 */
const char *
nm_setting_wireguard_get_private_key (NMSettingWireGuard *self)
{
	g_return_val_if_fail (NM_IS_SETTING_WIREGUARD (self), NULL);

	return NM_SETTING_WIREGUARD_GET_PRIVATE (self)->private_key;
}

/**
 * nm_setting_wireguard_get_private_key_flags:
 * @self: the #NMSettingWireGuard instance
 *
 * Returns: the secret-flags for #NMSettingWireGuard:private-key.
 *
 * Since: 1.16
 */
NMSettingSecretFlags
nm_setting_wireguard_get_private_key_flags (NMSettingWireGuard *self)
{
	g_return_val_if_fail (NM_IS_SETTING_WIREGUARD (self), 0);

	return NM_SETTING_WIREGUARD_GET_PRIVATE (self)->private_key_flags;
}

/**
 * nm_setting_wireguard_get_fwmark:
 * @self: the #NMSettingWireGuard instance
 *
 * Returns: the set firewall mark.
 *
 * Since: 1.16
 */
guint32
nm_setting_wireguard_get_fwmark (NMSettingWireGuard *self)
{
	g_return_val_if_fail (NM_IS_SETTING_WIREGUARD (self), 0);

	return NM_SETTING_WIREGUARD_GET_PRIVATE (self)->fwmark;
}

/**
 * nm_setting_wireguard_get_listen_port:
 * @self: the #NMSettingWireGuard instance
 *
 * Returns: the set UDP listen port.
 *
 * Since: 1.16
 */
guint16
nm_setting_wireguard_get_listen_port (NMSettingWireGuard *self)
{
	g_return_val_if_fail (NM_IS_SETTING_WIREGUARD (self), 0);

	return NM_SETTING_WIREGUARD_GET_PRIVATE (self)->listen_port;
}

/**
 * nm_setting_wireguard_get_peer_routes:
 * @self: the #NMSettingWireGuard instance
 *
 * Returns: whether automatically add peer routes.
 *
 * Since: 1.16
 */
gboolean
nm_setting_wireguard_get_peer_routes (NMSettingWireGuard *self)
{
	g_return_val_if_fail (NM_IS_SETTING_WIREGUARD (self), TRUE);

	return NM_SETTING_WIREGUARD_GET_PRIVATE (self)->peer_routes;
}

/**
 * nm_setting_wireguard_get_mtu:
 * @self: the #NMSettingWireGuard instance
 *
 * Returns: the MTU of the setting.
 *
 * Since: 1.16
 */
guint32
nm_setting_wireguard_get_mtu (NMSettingWireGuard *self)
{
	g_return_val_if_fail (NM_IS_SETTING_WIREGUARD (self), 0);

	return NM_SETTING_WIREGUARD_GET_PRIVATE (self)->mtu;
}

/**
 * nm_setting_wireguard_get_ip4_auto_default_route:
 * @self: the #NMSettingWireGuard setting.
 *
 * Returns: the "ip4-auto-default-route" property of the setting.
 *
 * Since: 1.20
 */
NMTernary
nm_setting_wireguard_get_ip4_auto_default_route (NMSettingWireGuard *self)
{
	g_return_val_if_fail (NM_IS_SETTING_WIREGUARD (self), NM_TERNARY_DEFAULT);

	return NM_SETTING_WIREGUARD_GET_PRIVATE (self)->ip4_auto_default_route;
}

/**
 * nm_setting_wireguard_get_ip6_auto_default_route:
 * @self: the #NMSettingWireGuard setting.
 *
 * Returns: the "ip6-auto-default-route" property of the setting.
 *
 * Since: 1.20
 */
NMTernary
nm_setting_wireguard_get_ip6_auto_default_route (NMSettingWireGuard *self)
{
	g_return_val_if_fail (NM_IS_SETTING_WIREGUARD (self), NM_TERNARY_DEFAULT);

	return NM_SETTING_WIREGUARD_GET_PRIVATE (self)->ip6_auto_default_route;
}

/*****************************************************************************/

static void
_peer_free (PeerData *pd)
{
	nm_assert (pd);

	nm_wireguard_peer_unref (pd->peer);
	g_slice_free (PeerData, pd);
}

/*****************************************************************************/

static void
_peers_notify (gpointer self)
{
	_nm_setting_emit_property_changed (self);
}

static PeerData *
_peers_get (NMSettingWireGuardPrivate *priv,
            guint idx)
{
	PeerData *pd;

	nm_assert (priv);
	nm_assert (idx < priv->peers_arr->len);

	pd = priv->peers_arr->pdata[idx];

	nm_assert (pd);
	nm_assert (pd->idx == idx);
	nm_assert (NM_IS_WIREGUARD_PEER (pd->peer, TRUE));
	nm_assert (nm_wireguard_peer_is_sealed (pd->peer));
	nm_assert (pd->public_key == nm_wireguard_peer_get_public_key (pd->peer));
	nm_assert (g_hash_table_lookup (priv->peers_hash, pd) == pd);

	return pd;
}

static PeerData *
_peers_get_by_public_key (NMSettingWireGuardPrivate *priv,
                          const char *public_key,
                          gboolean try_with_normalized_key)
{
	gs_free char *public_key_normalized = NULL;
	PeerData *pd;

again:
	nm_assert (priv);
	nm_assert (public_key);

	pd = g_hash_table_lookup (priv->peers_hash, &public_key);
	if (pd) {
		nm_assert (_peers_get (priv, pd->idx) == pd);
		return pd;
	}
	if (   try_with_normalized_key
	    && nm_utils_base64secret_normalize (public_key,
	                                        NM_WIREGUARD_PUBLIC_KEY_LEN,
	                                        &public_key_normalized)) {
		public_key = public_key_normalized;
		try_with_normalized_key = FALSE;
		goto again;
	}
	return NULL;
}

static void
_peers_remove (NMSettingWireGuardPrivate *priv,
               PeerData *pd,
               gboolean do_free)
{
	guint i;

	nm_assert (pd);
	nm_assert (_peers_get (priv, pd->idx) == pd);

	for (i = pd->idx + 1; i < priv->peers_arr->len; i++)
		_peers_get (priv, i)->idx--;

	g_ptr_array_remove_index (priv->peers_arr, pd->idx);
	if (!g_hash_table_remove (priv->peers_hash, pd))
		nm_assert_not_reached ();
	if (do_free)
		_peer_free (pd);
}

/**
 * nm_setting_wireguard_get_peers_len:
 * @self: the #NMSettingWireGuard instance
 *
 * Returns: the number of registered peers.
 *
 * Since: 1.16
 */
guint
nm_setting_wireguard_get_peers_len (NMSettingWireGuard *self)
{
	g_return_val_if_fail (NM_IS_SETTING_WIREGUARD (self), 0);

	return NM_SETTING_WIREGUARD_GET_PRIVATE (self)->peers_arr->len;
}

/**
 * nm_setting_wireguard_get_peer:
 * @self: the #NMSettingWireGuard instance
 * @idx: the index to lookup.
 *
 * Returns: (transfer none): the #NMWireGuardPeer entry at
 *   index @idx. If the index is out of range, %NULL is returned.
 *
 * Since: 1.16
 */
NMWireGuardPeer *
nm_setting_wireguard_get_peer (NMSettingWireGuard *self,
                               guint idx)
{
	NMSettingWireGuardPrivate *priv;

	g_return_val_if_fail (NM_IS_SETTING_WIREGUARD (self), NULL);

	priv = NM_SETTING_WIREGUARD_GET_PRIVATE (self);

	if (idx >= priv->peers_arr->len)
		return NULL;

	return _peers_get (priv, idx)->peer;
}

/**
 * nm_setting_wireguard_get_peer_by_public_key:
 * @self: the #NMSettingWireGuard instance
 * @public_key: the public key for looking up the
 *   peer.
 * @out_idx: (out) (allow-none): optional output argument
 *   for the index of the found peer. If no index is found,
 *   this is set to the nm_setting_wireguard_get_peers_len().
 *
 * Returns: (transfer none): the #NMWireGuardPeer instance with a
 *   matching public key. If no such peer exists, %NULL is returned.
 *
 * Since: 1.16
 */
NMWireGuardPeer *
nm_setting_wireguard_get_peer_by_public_key (NMSettingWireGuard *self,
                                             const char *public_key,
                                             guint *out_idx)
{
	NMSettingWireGuardPrivate *priv;
	PeerData *pd;

	g_return_val_if_fail (NM_IS_SETTING_WIREGUARD (self), NULL);
	g_return_val_if_fail (public_key, NULL);

	priv = NM_SETTING_WIREGUARD_GET_PRIVATE (self);

	pd = _peers_get_by_public_key (priv, public_key, TRUE);
	if (!pd) {
		NM_SET_OUT (out_idx, priv->peers_arr->len);
		return NULL;
	}
	NM_SET_OUT (out_idx, pd->idx);
	return pd->peer;
}

static gboolean
_peers_set (NMSettingWireGuardPrivate *priv,
            NMWireGuardPeer *peer,
            guint idx,
            gboolean check_same_key)
{
	PeerData *pd_same_key = NULL;
	PeerData *pd_idx = NULL;
	const char *public_key;

	nm_assert (idx <= priv->peers_arr->len);

	public_key = nm_wireguard_peer_get_public_key (peer);

	if (idx < priv->peers_arr->len) {
		pd_idx = _peers_get (priv, idx);

		if (pd_idx->peer == peer)
			return FALSE;

		if (   check_same_key
		    && nm_streq (public_key, nm_wireguard_peer_get_public_key (pd_idx->peer)))
			check_same_key = FALSE;
	}

	nm_wireguard_peer_seal (peer);
	nm_wireguard_peer_ref (peer);

	if (check_same_key) {
		pd_same_key = _peers_get_by_public_key (priv, public_key, FALSE);
		if (pd_same_key) {
			if (pd_idx) {
				nm_assert (pd_same_key != pd_idx);
				_peers_remove (priv, pd_same_key, TRUE);
				pd_same_key = NULL;
			} else {
				if (   pd_same_key->peer == peer
				    && pd_same_key->idx == priv->peers_arr->len - 1) {
					nm_wireguard_peer_unref (peer);
					return FALSE;
				}
				_peers_remove (priv, pd_same_key, FALSE);
				nm_wireguard_peer_unref (pd_same_key->peer);
			}
		}
	} else
		nm_assert (_peers_get_by_public_key (priv, public_key, FALSE) == pd_idx);

	if (pd_idx) {
		g_hash_table_remove (priv->peers_hash, pd_idx);
		nm_wireguard_peer_unref (pd_idx->peer);
		pd_idx->public_key = public_key;
		pd_idx->peer = peer;
		g_hash_table_add (priv->peers_hash, pd_idx);
		return TRUE;
	}


	if (!pd_same_key)
		pd_same_key = g_slice_new (PeerData);

	*pd_same_key = (PeerData) {
		.peer = peer,
		.public_key = public_key,
		.idx = priv->peers_arr->len,
	};

	g_ptr_array_add (priv->peers_arr, pd_same_key);
	if (!nm_g_hash_table_add (priv->peers_hash, pd_same_key))
		nm_assert_not_reached ();

	nm_assert (_peers_get (priv, pd_same_key->idx) == pd_same_key);

	return TRUE;
}

static gboolean
_peers_append (NMSettingWireGuardPrivate *priv,
               NMWireGuardPeer *peer,
               gboolean check_same_key)
{
	return _peers_set (priv, peer, priv->peers_arr->len, check_same_key);
}

/**
 * nm_setting_wireguard_set_peer:
 * @self: the #NMSettingWireGuard instance
 * @peer: the #NMWireGuardPeer instance to set.
 *   This seals @peer and keeps a reference on the
 *   instance.
 * @idx: the index, in the range of 0 to the number of
 *   peers (including). That means, if @idx is one past
 *   the end of the number of peers, this is the same as
 *   nm_setting_wireguard_append_peer(). Otherwise, the
 *   peer at this index is replaced.
 *
 * If @idx is one past the last peer, the behavior is the same
 * as nm_setting_wireguard_append_peer().
 * Otherwise, the peer will be at @idx and replace the peer
 * instance at that index. Note that if a peer with the same
 * public-key exists on another index, then that peer will also
 * be replaced. In that case, the number of peers will shrink
 * by one (because the one at @idx got replace and then one
 * with the same public-key got removed). This also means,
 * that the resulting index afterwards may be one less than
 * @idx (if another peer with a lower index was dropped).
 *
 * Since: 1.16
 */
void
nm_setting_wireguard_set_peer (NMSettingWireGuard *self,
                               NMWireGuardPeer *peer,
                               guint idx)
{
	NMSettingWireGuardPrivate *priv;

	g_return_if_fail (NM_IS_SETTING_WIREGUARD (self));
	g_return_if_fail (NM_IS_WIREGUARD_PEER (peer, TRUE));

	priv = NM_SETTING_WIREGUARD_GET_PRIVATE (self);

	g_return_if_fail (idx <= priv->peers_arr->len);

	if (_peers_set (priv, peer, idx, TRUE))
		_peers_notify (self);
}

/**
 * nm_setting_wireguard_append_peer:
 * @self: the #NMSettingWireGuard instance
 * @peer: the #NMWireGuardPeer instance to append.
 *   This seals @peer and keeps a reference on the
 *   instance.
 *
 * If a peer with the same public-key already exists, that
 * one is replaced by @peer. The new @peer is always appended
 * (or moved to) the end, so in case a peer is replaced, the
 * indexes are shifted and the number of peers stays unchanged.
 *
 * Since: 1.16
 */
void
nm_setting_wireguard_append_peer (NMSettingWireGuard *self,
                                  NMWireGuardPeer *peer)
{
	g_return_if_fail (NM_IS_SETTING_WIREGUARD (self));
	g_return_if_fail (NM_IS_WIREGUARD_PEER (peer, TRUE));

	if (_peers_append (NM_SETTING_WIREGUARD_GET_PRIVATE (self),
	                   peer,
	                   TRUE))
		_peers_notify (self);
}

/**
 * nm_setting_wireguard_remove_peer
 * @self: the #NMSettingWireGuard instance
 * @idx: the index to remove.
 *
 * Returns: %TRUE if @idx was in range and a peer
 *   was removed. Otherwise, @self is unchanged.
 *
 * Since: 1.16
 */
gboolean
nm_setting_wireguard_remove_peer (NMSettingWireGuard *self,
                                  guint idx)
{
	NMSettingWireGuardPrivate *priv;

	g_return_val_if_fail (NM_IS_SETTING_WIREGUARD (self), FALSE);

	priv = NM_SETTING_WIREGUARD_GET_PRIVATE (self);

	if (idx >= priv->peers_arr->len)
		return FALSE;

	_peers_remove (priv, _peers_get (priv, idx), TRUE);
	_peers_notify (self);
	return TRUE;
}

static guint
_peers_clear (NMSettingWireGuardPrivate *priv)
{
	guint l;

	l = priv->peers_arr->len;
	while (priv->peers_arr->len > 0) {
		_peers_remove (priv,
		               _peers_get (priv, priv->peers_arr->len - 1),
		               TRUE);
	}
	return l;
}

/**
 * nm_setting_wireguard_:
 * @self: the #NMSettingWireGuard instance
 *
 * Returns: the number of cleared peers.
 *
 * Since: 1.16
 */
guint
nm_setting_wireguard_clear_peers (NMSettingWireGuard *self)
{
	guint l;

	g_return_val_if_fail (NM_IS_SETTING_WIREGUARD (self), 0);

	l = _peers_clear (NM_SETTING_WIREGUARD_GET_PRIVATE (self));
	if (l > 0)
		_peers_notify (self);
	return l;
}

/*****************************************************************************/

static GVariant *
_peers_dbus_only_synth (const NMSettInfoSetting *sett_info,
                        guint property_idx,
                        NMConnection *connection,
                        NMSetting *setting,
                        NMConnectionSerializationFlags flags,
                        const NMConnectionSerializationOptions *options)
{
	NMSettingWireGuard *self = NM_SETTING_WIREGUARD (setting);
	NMSettingWireGuardPrivate *priv;
	gboolean any_peers = FALSE;
	GVariantBuilder peers_builder;
	guint i_peer, n_peers;
	guint i;

	n_peers = nm_setting_wireguard_get_peers_len (self);
	if (n_peers == 0)
		return NULL;

	priv = NM_SETTING_WIREGUARD_GET_PRIVATE (self);

	for (i_peer = 0; i_peer < n_peers; i_peer++) {
		const NMWireGuardPeer *peer = _peers_get (priv, i_peer)->peer;
		GVariantBuilder builder;

		if (!peer->public_key)
			continue;

		g_variant_builder_init (&builder, G_VARIANT_TYPE ("a{sv}"));

		g_variant_builder_add (&builder, "{sv}", NM_WIREGUARD_PEER_ATTR_PUBLIC_KEY, g_variant_new_string (peer->public_key));

		if (   !NM_FLAGS_HAS (flags, NM_CONNECTION_SERIALIZE_ONLY_SECRETS)
		    && peer->endpoint)
			g_variant_builder_add (&builder, "{sv}", NM_WIREGUARD_PEER_ATTR_ENDPOINT, g_variant_new_string (nm_sock_addr_endpoint_get_endpoint (peer->endpoint)));

		if (   _nm_connection_serialize_secrets (flags, peer->preshared_key_flags)
		    && peer->preshared_key)
			g_variant_builder_add (&builder, "{sv}", NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY, g_variant_new_string (peer->preshared_key));

		if (   !NM_FLAGS_HAS (flags, NM_CONNECTION_SERIALIZE_ONLY_SECRETS)
		    && peer->preshared_key_flags != NM_SETTING_SECRET_FLAG_NOT_REQUIRED)
			g_variant_builder_add (&builder, "{sv}", NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY_FLAGS, g_variant_new_uint32 (peer->preshared_key_flags));

		if (   !NM_FLAGS_HAS (flags, NM_CONNECTION_SERIALIZE_ONLY_SECRETS)
		    && peer->persistent_keepalive != 0)
			g_variant_builder_add (&builder, "{sv}", NM_WIREGUARD_PEER_ATTR_PERSISTENT_KEEPALIVE, g_variant_new_uint32 (peer->persistent_keepalive));

		if (   !NM_FLAGS_HAS (flags, NM_CONNECTION_SERIALIZE_ONLY_SECRETS)
		    && peer->allowed_ips
		    && peer->allowed_ips->len > 0) {
			const char *const*strv = (const char *const*) peer->allowed_ips->pdata;
			gs_free const char **strv_fixed = NULL;

			for (i = 0; i < peer->allowed_ips->len; i++) {
				if (strv[i][0] != ALLOWED_IP_INVALID_X)
					continue;
				if (!strv_fixed) {
					strv_fixed = nm_memdup (strv, sizeof (strv[0]) * peer->allowed_ips->len);
					strv = strv_fixed;
				}
				((const char **) strv)[i]++;
			}
			g_variant_builder_add (&builder, "{sv}", NM_WIREGUARD_PEER_ATTR_ALLOWED_IPS,
			                       g_variant_new_strv (strv, peer->allowed_ips->len));
		}

		if (!any_peers) {
			g_variant_builder_init (&peers_builder, G_VARIANT_TYPE ("aa{sv}"));
			any_peers = TRUE;
		}
		g_variant_builder_add (&peers_builder, "a{sv}", &builder);
	}

	return   any_peers
	       ? g_variant_builder_end (&peers_builder)
	       : NULL;
}

static gboolean
_peers_dbus_only_set (NMSetting     *setting,
                      GVariant      *connection_dict,
                      const char    *property,
                      GVariant      *value,
                      NMSettingParseFlags parse_flags,
                      GError       **error)
{
	GVariantIter iter_peers;
	GVariant *peer_var;
	guint i_peer;
	gboolean success = FALSE;
	gboolean peers_changed = FALSE;

	nm_assert (g_variant_is_of_type (value, G_VARIANT_TYPE ("aa{sv}")));

	g_variant_iter_init (&iter_peers, value);

	i_peer = 0;
	while (g_variant_iter_next (&iter_peers, "@a{sv}", &peer_var)) {
		_nm_unused gs_unref_variant GVariant *peer_var_unref = peer_var;
		nm_auto_unref_wgpeer NMWireGuardPeer *peer = NULL;
		const char *cstr;
		guint32 u32;
		GVariant *var;

		i_peer++;

		if (!g_variant_lookup (peer_var, NM_WIREGUARD_PEER_ATTR_PUBLIC_KEY, "&s", &cstr)) {
			if (NM_FLAGS_HAS (parse_flags, NM_SETTING_PARSE_FLAGS_STRICT)) {
				g_set_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_MISSING_PROPERTY,
				             _("peer #%u has no public-key"),
				             i_peer);
				goto out;
			}
			continue;
		}

		peer = nm_wireguard_peer_new ();
		if (!nm_wireguard_peer_set_public_key (peer, cstr, TRUE)) {
			if (NM_FLAGS_HAS (parse_flags, NM_SETTING_PARSE_FLAGS_STRICT)) {
				g_set_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_MISSING_PROPERTY,
				             _("peer #%u has invalid public-key"),
				             i_peer);
				goto out;
			}
			continue;
		}

		if (g_variant_lookup (peer_var, NM_WIREGUARD_PEER_ATTR_ENDPOINT, "&s", &cstr)) {
			nm_auto_unref_sockaddrendpoint NMSockAddrEndpoint *ep = NULL;

			ep = nm_sock_addr_endpoint_new (cstr);
			if (!nm_sock_addr_endpoint_get_host (ep)) {
				if (NM_FLAGS_HAS (parse_flags, NM_SETTING_PARSE_FLAGS_STRICT)) {
					g_set_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_MISSING_PROPERTY,
					             _("peer #%u has invalid endpoint"),
					             i_peer);
					goto out;
				}
			} else
				_nm_wireguard_peer_set_endpoint (peer, ep);
		}

		if (g_variant_lookup (peer_var, NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY, "&s", &cstr))
			nm_wireguard_peer_set_preshared_key (peer, cstr, TRUE);

		if (g_variant_lookup (peer_var, NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY_FLAGS, "u", &u32))
			nm_wireguard_peer_set_preshared_key_flags (peer, u32);

		if (g_variant_lookup (peer_var, NM_WIREGUARD_PEER_ATTR_PERSISTENT_KEEPALIVE, "u", &u32))
			nm_wireguard_peer_set_persistent_keepalive (peer, u32);

		if (g_variant_lookup (peer_var, NM_WIREGUARD_PEER_ATTR_ALLOWED_IPS, "@as", &var)) {
			_nm_unused gs_unref_variant GVariant *var_free = var;
			gs_free const char **allowed_ips = NULL;
			gsize i, l;

			allowed_ips = g_variant_get_strv (var, &l);
			if (allowed_ips) {
				for (i = 0; i < l; i++) {
					if (_peer_append_allowed_ip (peer, allowed_ips[i], FALSE))
						continue;
					if (!NM_FLAGS_HAS (parse_flags, NM_SETTING_PARSE_FLAGS_STRICT))
						continue;
					g_set_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_MISSING_PROPERTY,
					             _("peer #%u has invalid allowed-ips setting"),
					             i_peer);
					goto out;
				}
			}
		}

		if (NM_FLAGS_HAS (parse_flags, NM_SETTING_PARSE_FLAGS_STRICT)) {
			gs_free_error GError *local = NULL;

			if (!nm_wireguard_peer_is_valid (peer, TRUE, FALSE, &local)) {
				g_set_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_MISSING_PROPERTY,
				             _("peer #%u is invalid: %s"),
				             i_peer, local->message);
				goto out;
			}
		}

		/* we could easily reject duplicate peers (by public-key) or duplicate GVariant attributes.
		 * However, don't do that. In case of duplicate values, the latter peer overwrite the earlier
		 * and GVariant attributes are ignored by g_variant_lookup() above. */
		if (_peers_append (NM_SETTING_WIREGUARD_GET_PRIVATE (setting),
		                   peer,
		                   TRUE))
			peers_changed = TRUE;
	}

	success = TRUE;

out:
	if (peers_changed)
		_peers_notify (setting);
	return success;
}

/*****************************************************************************/

static gboolean
verify (NMSetting *setting, NMConnection *connection, GError **error)
{
	NMSettingWireGuard *s_wg = NM_SETTING_WIREGUARD (setting);
	NMSettingWireGuardPrivate *priv = NM_SETTING_WIREGUARD_GET_PRIVATE (setting);
	guint i;

	if (!_nm_connection_verify_required_interface_name (connection, error))
		return FALSE;

	if (!_nm_utils_secret_flags_validate (nm_setting_wireguard_get_private_key_flags (s_wg),
	                                      NM_SETTING_WIREGUARD_SETTING_NAME,
	                                      NM_SETTING_WIREGUARD_PRIVATE_KEY_FLAGS,
	                                      NM_SETTING_SECRET_FLAG_NOT_REQUIRED,
	                                      error))
		return FALSE;

	for (i = 0; i < priv->peers_arr->len; i++) {
		NMWireGuardPeer *peer = _peers_get (priv, i)->peer;

		if (!nm_wireguard_peer_is_valid (peer, TRUE, FALSE, error)) {
			g_prefix_error (error,
			                "%s.%s[%u]: ",
			                NM_SETTING_WIREGUARD_SETTING_NAME,
			                NM_SETTING_WIREGUARD_PEERS,
			                i);
			return FALSE;
		}
	}

	if (connection) {
		NMSettingIPConfig *s_ip4;
		NMSettingIPConfig *s_ip6;
		const char *method;

		/* WireGuard is Layer 3 only. For the moment, we only support a restricted set of
		 * IP methods. We may relax that later, once we fix the implementations so they
		 * actually work. */

		if (   (s_ip4 = nm_connection_get_setting_ip4_config (connection))
		    && (method = nm_setting_ip_config_get_method (s_ip4))
		    && !NM_IN_STRSET (method, NM_SETTING_IP4_CONFIG_METHOD_DISABLED,
		                              NM_SETTING_IP4_CONFIG_METHOD_MANUAL)) {
			g_set_error (error,
			             NM_CONNECTION_ERROR,
			             NM_CONNECTION_ERROR_INVALID_PROPERTY,
			             _("method \"%s\" is not supported for WireGuard"),
			             method);
			g_prefix_error (error, "%s.%s: ", NM_SETTING_IP4_CONFIG_SETTING_NAME, NM_SETTING_IP_CONFIG_METHOD);
			return FALSE;
		}

		if (   (s_ip6 = nm_connection_get_setting_ip6_config (connection))
		    && (method = nm_setting_ip_config_get_method (s_ip6))
		    && !NM_IN_STRSET (method, NM_SETTING_IP6_CONFIG_METHOD_IGNORE,
		                              NM_SETTING_IP6_CONFIG_METHOD_LINK_LOCAL,
		                              NM_SETTING_IP6_CONFIG_METHOD_MANUAL,
		                              NM_SETTING_IP6_CONFIG_METHOD_DISABLED)) {
			g_set_error (error,
			             NM_CONNECTION_ERROR,
			             NM_CONNECTION_ERROR_INVALID_PROPERTY,
			             _("method \"%s\" is not supported for WireGuard"),
			             method);
			g_prefix_error (error, "%s.%s: ", NM_SETTING_IP6_CONFIG_SETTING_NAME, NM_SETTING_IP_CONFIG_METHOD);
			return FALSE;
		}
	}

	/* private-key is a secret, hence we cannot verify it like a regular property. */
	return TRUE;
}

static gboolean
verify_secrets (NMSetting *setting, NMConnection *connection, GError **error)
{
	NMSettingWireGuardPrivate *priv = NM_SETTING_WIREGUARD_GET_PRIVATE (setting);
	guint i;

	if (   priv->private_key
	    && !priv->private_key_valid) {
		g_set_error_literal (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY,
		                     _("key must be 32 bytes base64 encoded"));
		g_prefix_error (error, "%s.%s: ", NM_SETTING_WIREGUARD_SETTING_NAME, NM_SETTING_WIREGUARD_PRIVATE_KEY);
		return FALSE;
	}

	for (i = 0; i < priv->peers_arr->len; i++) {
		NMWireGuardPeer *peer = _peers_get (priv, i)->peer;

		if (!nm_wireguard_peer_is_valid (peer, FALSE, TRUE, error)) {
			g_prefix_error (error,
			                "%s.%s[%u]: ",
			                NM_SETTING_WIREGUARD_SETTING_NAME,
			                NM_SETTING_WIREGUARD_PEERS,
			                i);
			return FALSE;
		}
	}

	return TRUE;
}

static GPtrArray *
need_secrets (NMSetting *setting)
{
	NMSettingWireGuardPrivate *priv = NM_SETTING_WIREGUARD_GET_PRIVATE (setting);
	GPtrArray *secrets = NULL;
	guint i;

	if (   !priv->private_key
	    || !priv->private_key_valid) {
		secrets = g_ptr_array_new_full (1, g_free);
		g_ptr_array_add (secrets, g_strdup (NM_SETTING_WIREGUARD_PRIVATE_KEY));
	}

	for (i = 0; i < priv->peers_arr->len; i++) {
		NMWireGuardPeer *peer = _peers_get (priv, i)->peer;

		if (NM_FLAGS_HAS (peer->preshared_key_flags, NM_SETTING_SECRET_FLAG_NOT_REQUIRED))
			continue;

		if (peer->preshared_key_valid)
			continue;

		if (!peer->public_key_valid)
			continue;

		if (!secrets)
			secrets = g_ptr_array_new_full (1, g_free);
		g_ptr_array_add (secrets, peers_psk_get_secret_name_dup (peer->public_key));
	}

	return secrets;
}

static gboolean
clear_secrets (const NMSettInfoSetting *sett_info,
               guint property_idx,
               NMSetting *setting,
               NMSettingClearSecretsWithFlagsFn func,
               gpointer user_data)
{
	if (nm_streq (sett_info->property_infos[property_idx].name, NM_SETTING_WIREGUARD_PEERS)) {
		NMSettingWireGuardPrivate *priv = NM_SETTING_WIREGUARD_GET_PRIVATE (setting);
		gboolean peers_changed = FALSE;
		guint i, j;

		j = 0;
		for (i = 0; i < priv->peers_arr->len; i++) {
			NMWireGuardPeer *peer = _peers_get (priv, i)->peer;

			if (!peer->preshared_key)
				continue;

			if (func) {
				gs_free char *name_free = NULL;
				const char *name;

				/* only stack-allocate (alloca) a few times. */
				if (j++ < 5)
					name = peers_psk_get_secret_name_a (peer->public_key, &name_free);
				else {
					name_free = peers_psk_get_secret_name_dup (peer->public_key);
					name = name_free;
				}

				if (!func (setting, name, peer->preshared_key_flags, user_data))
					continue;
			}

			{
				nm_auto_unref_wgpeer NMWireGuardPeer *peer2 = NULL;

				peer2 = nm_wireguard_peer_new_clone (peer, FALSE);

				if (_peers_set (priv, peer2, i, FALSE))
					peers_changed = TRUE;
			}
		}

		if (peers_changed)
			_peers_notify (setting);
		return peers_changed;
	}

	return NM_SETTING_CLASS (nm_setting_wireguard_parent_class)->clear_secrets (sett_info,
	                                                                            property_idx,
	                                                                            setting,
	                                                                            func,
	                                                                            user_data);
}

static int
update_one_secret (NMSetting *setting,
                   const char *key,
                   GVariant *value,
                   GError **error)
{
	NMSettingWireGuard *self = NM_SETTING_WIREGUARD (setting);
	NMSettingWireGuardPrivate *priv;
	gboolean has_changes = FALSE;
	gboolean has_error = FALSE;
	GVariantIter iter_peers;
	GVariant *peer_var;
	guint i_peer;

	if (!nm_streq (key, NM_SETTING_WIREGUARD_PEERS)) {
		return NM_SETTING_CLASS (nm_setting_wireguard_parent_class)->update_one_secret (setting,
		                                                                                key,
		                                                                                value,
		                                                                                error);
	}

	if (!g_variant_is_of_type (value, G_VARIANT_TYPE ("aa{sv}"))) {
		g_set_error_literal (error,
		                     NM_CONNECTION_ERROR,
		                     NM_CONNECTION_ERROR_PROPERTY_NOT_SECRET,
		                     _("invalid peer secrets"));
		g_prefix_error (error, "%s.%s: ", NM_SETTING_WIREGUARD_SETTING_NAME, NM_SETTING_WIREGUARD_PEERS);
		return NM_SETTING_UPDATE_SECRET_ERROR;
	}

	priv = NM_SETTING_WIREGUARD_GET_PRIVATE (self);

	g_variant_iter_init (&iter_peers, value);

	i_peer = 0;
	while (g_variant_iter_next (&iter_peers, "@a{sv}", &peer_var)) {
		_nm_unused gs_unref_variant GVariant *peer_var_unref = peer_var;
		nm_auto_unref_wgpeer NMWireGuardPeer *peer = NULL;
		PeerData *pd;
		const char *cstr;

		i_peer++;

		if (!g_variant_lookup (peer_var, NM_WIREGUARD_PEER_ATTR_PUBLIC_KEY, "&s", &cstr)) {
			if (!has_error) {
				g_set_error (error,
				             NM_CONNECTION_ERROR,
				             NM_CONNECTION_ERROR_PROPERTY_NOT_SECRET,
				             _("peer #%u lacks public-key"),
				             i_peer - 1);
				g_prefix_error (error, "%s.%s: ", NM_SETTING_WIREGUARD_SETTING_NAME, NM_SETTING_WIREGUARD_PEERS);
				has_error = TRUE;
			}
			continue;
		}

		pd = _peers_get_by_public_key (priv, cstr, TRUE);
		if (!pd) {
			if (!has_error) {
				g_set_error (error,
				             NM_CONNECTION_ERROR,
				             NM_CONNECTION_ERROR_PROPERTY_NOT_SECRET,
				             _("non-existing peer '%s'"),
				             cstr);
				g_prefix_error (error, "%s.%s: ", NM_SETTING_WIREGUARD_SETTING_NAME, NM_SETTING_WIREGUARD_PEERS);
				has_error = TRUE;
			}
			continue;
		}

		if (!g_variant_lookup (peer_var, NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY, "&s", &cstr)) {
			/* no preshared-key. Ignore the rest.
			 *
			 * In particular, we don't reject all unknown fields. */
			continue;
		}

		if (nm_streq0  (cstr, nm_wireguard_peer_get_preshared_key (pd->peer)))
			continue;

		peer = nm_wireguard_peer_new_clone (pd->peer, FALSE);
		nm_wireguard_peer_set_preshared_key (peer, cstr, TRUE);

		if (!_peers_set (priv, peer, pd->idx, FALSE))
			nm_assert_not_reached ();
		has_changes = TRUE;
	}

	if (has_error)
		return NM_SETTING_UPDATE_SECRET_ERROR;
	if (has_changes)
		return NM_SETTING_UPDATE_SECRET_SUCCESS_MODIFIED;
	return NM_SETTING_UPDATE_SECRET_SUCCESS_UNCHANGED;
}

static NMTernary
compare_property (const NMSettInfoSetting *sett_info,
                  guint property_idx,
                  NMConnection *con_a,
                  NMSetting *set_a,
                  NMConnection *con_b,
                  NMSetting *set_b,
                  NMSettingCompareFlags flags)
{
	NMSettingWireGuardPrivate *a_priv;
	NMSettingWireGuardPrivate *b_priv;
	guint i;

	if (nm_streq (sett_info->property_infos[property_idx].name, NM_SETTING_WIREGUARD_PEERS)) {

		if (NM_FLAGS_HAS (flags, NM_SETTING_COMPARE_FLAG_INFERRABLE))
			return NM_TERNARY_DEFAULT;

		if (!set_b)
			return TRUE;

		a_priv = NM_SETTING_WIREGUARD_GET_PRIVATE (set_a);
		b_priv = NM_SETTING_WIREGUARD_GET_PRIVATE (set_b);

		if (a_priv->peers_arr->len != b_priv->peers_arr->len)
			return FALSE;
		for (i = 0; i < a_priv->peers_arr->len; i++) {
			NMWireGuardPeer *a_peer = _peers_get (a_priv, i)->peer;
			NMWireGuardPeer *b_peer = _peers_get (b_priv, i)->peer;

			if (nm_wireguard_peer_cmp (a_peer,
			                           b_peer,
			                           flags) != 0)
				return FALSE;
		}

		return TRUE;
	}

	return NM_SETTING_CLASS (nm_setting_wireguard_parent_class)->compare_property (sett_info,
	                                                                               property_idx,
	                                                                               con_a,
	                                                                               set_a,
	                                                                               con_b,
	                                                                               set_b,
	                                                                               flags);
}

static void
duplicate_copy_properties (const NMSettInfoSetting *sett_info,
                           NMSetting *src,
                           NMSetting *dst)
{
	NMSettingWireGuardPrivate *priv_src = NM_SETTING_WIREGUARD_GET_PRIVATE (src);
	NMSettingWireGuardPrivate *priv_dst = NM_SETTING_WIREGUARD_GET_PRIVATE (dst);
	guint i;
	gboolean peers_changed = FALSE;

	NM_SETTING_CLASS (nm_setting_wireguard_parent_class)->duplicate_copy_properties (sett_info,
	                                                                                 src,
	                                                                                 dst);

	/* We don't bother comparing the existing peers with what we are about to set.
	 * Always reset all. */
	if (_peers_clear (priv_dst) > 0)
		peers_changed = TRUE;
	for (i = 0; i < priv_src->peers_arr->len; i++) {
		if (_peers_append (priv_dst,
		                   _peers_get (priv_src, i)->peer,
		                   FALSE))
			peers_changed = TRUE;
	}
	if (peers_changed)
		_peers_notify (dst);
}

static void
enumerate_values (const NMSettInfoProperty *property_info,
                  NMSetting *setting,
                  NMSettingValueIterFn func,
                  gpointer user_data)
{
	if (nm_streq (property_info->name, NM_SETTING_WIREGUARD_PEERS)) {
		NMSettingWireGuardPrivate *priv = NM_SETTING_WIREGUARD_GET_PRIVATE (setting);
		nm_auto_unset_gvalue GValue value = G_VALUE_INIT;
		GPtrArray *ptr = NULL;
		guint i;

		if (priv->peers_arr && priv->peers_arr->len > 0) {
			ptr = g_ptr_array_new_with_free_func ((GDestroyNotify) nm_wireguard_peer_unref);
			for (i = 0; i < priv->peers_arr->len; i++)
				g_ptr_array_add (ptr, nm_wireguard_peer_ref (_peers_get (priv, i)->peer));
		}
		g_value_init (&value, G_TYPE_PTR_ARRAY);
		g_value_take_boxed (&value, ptr);
		func (setting,
		      property_info->name,
		      &value,
		      0,
		      user_data);
		return;
	}

	NM_SETTING_CLASS (nm_setting_wireguard_parent_class)->enumerate_values (property_info,
	                                                                        setting,
	                                                                        func,
	                                                                        user_data);
}

static gboolean
aggregate (NMSetting *setting,
           int type_i,
           gpointer arg)
{
	NMSettingWireGuardPrivate *priv = NM_SETTING_WIREGUARD_GET_PRIVATE (setting);
	NMConnectionAggregateType type = type_i;
	NMSettingSecretFlags secret_flags;
	guint i;

	nm_assert (NM_IN_SET (type, NM_CONNECTION_AGGREGATE_ANY_SECRETS,
	                            NM_CONNECTION_AGGREGATE_ANY_SYSTEM_SECRET_FLAGS));

	switch (type) {

	case NM_CONNECTION_AGGREGATE_ANY_SECRETS:
		if (priv->private_key)
			goto out_done;
		for (i = 0; i < priv->peers_arr->len; i++) {
			if (nm_wireguard_peer_get_preshared_key (_peers_get (priv, i)->peer))
				goto out_done;
		}
		break;

	case NM_CONNECTION_AGGREGATE_ANY_SYSTEM_SECRET_FLAGS:
#if NM_MORE_ASSERTS
		if (!nm_setting_get_secret_flags (setting, NM_SETTING_WIREGUARD_PRIVATE_KEY, &secret_flags, NULL))
			nm_assert_not_reached ();
		nm_assert (secret_flags == priv->private_key_flags);
#endif
		if (priv->private_key_flags == NM_SETTING_SECRET_FLAG_NONE)
			goto out_done;
		for (i = 0; i < priv->peers_arr->len; i++) {
			secret_flags = nm_wireguard_peer_get_preshared_key_flags (_peers_get (priv, i)->peer);
			if (secret_flags == NM_SETTING_SECRET_FLAG_NONE)
				goto out_done;
		}
		break;
	}

	return FALSE;

out_done:
	*((gboolean *) arg) = TRUE;
	return TRUE;
}

static gboolean
get_secret_flags (NMSetting *setting,
                  const char *secret_name,
                  NMSettingSecretFlags *out_flags,
                  GError **error)
{
	if (NM_STR_HAS_PREFIX (secret_name, NM_SETTING_WIREGUARD_PEERS".")) {
		NMSettingWireGuardPrivate *priv = NM_SETTING_WIREGUARD_GET_PRIVATE (setting);
		gs_free char *public_key_free = NULL;
		const char *public_key;
		PeerData *pd;

		public_key = peers_psk_get_secret_parse_a (secret_name, &public_key_free);
		if (   public_key
		    && (pd = _peers_get_by_public_key (priv, public_key, FALSE))) {
			NM_SET_OUT (out_flags, nm_wireguard_peer_get_preshared_key_flags (pd->peer));
			return TRUE;
		}
	}

	return NM_SETTING_CLASS (nm_setting_wireguard_parent_class)->get_secret_flags (setting,
	                                                                               secret_name,
	                                                                               out_flags,
	                                                                               error);
}

static gboolean
set_secret_flags (NMSetting *setting,
                  const char *secret_name,
                  NMSettingSecretFlags flags,
                  GError **error)
{
	if (NM_STR_HAS_PREFIX (secret_name, NM_SETTING_WIREGUARD_PEERS".")) {
		NMSettingWireGuard *self = NM_SETTING_WIREGUARD (setting);
		NMSettingWireGuardPrivate *priv = NM_SETTING_WIREGUARD_GET_PRIVATE (self);
		gs_free char *public_key_free = NULL;
		const char *public_key;
		PeerData *pd;

		public_key = peers_psk_get_secret_parse_a (secret_name, &public_key_free);
		if (   public_key
		    && (pd = _peers_get_by_public_key (priv, public_key, FALSE))) {

			if (nm_wireguard_peer_get_preshared_key_flags (pd->peer) != flags) {
				nm_auto_unref_wgpeer NMWireGuardPeer *peer = NULL;

				peer = nm_wireguard_peer_new_clone (pd->peer, TRUE);
				peer->preshared_key_flags = flags;
				if (_peers_set (priv, peer, pd->idx, FALSE))
					_peers_notify (self);
			}

			return TRUE;
		}
	}

	return NM_SETTING_CLASS (nm_setting_wireguard_parent_class)->set_secret_flags (setting,
	                                                                               secret_name,
	                                                                               flags,
	                                                                               error);
}

static void
for_each_secret (NMSetting *setting,
                 const char *data_key,
                 GVariant *data_val,
                 gboolean remove_non_secrets,
                 _NMConnectionForEachSecretFunc callback,
                 gpointer callback_data,
                 GVariantBuilder *setting_builder)
{
	NMSettingWireGuard *s_wg;
	NMSettingWireGuardPrivate *priv;
	GVariantBuilder peers_builder;
	GVariantIter *peer_iter;
	GVariantIter data_iter;
	const char *key;

	if (!nm_streq (data_key, NM_SETTING_WIREGUARD_PEERS)) {
		NM_SETTING_CLASS (nm_setting_wireguard_parent_class)->for_each_secret (setting,
		                                                                       data_key,
		                                                                       data_val,
		                                                                       remove_non_secrets,
		                                                                       callback,
		                                                                       callback_data,
		                                                                       setting_builder);
		return;
	}

	if (!g_variant_is_of_type (data_val, G_VARIANT_TYPE ("aa{sv}"))) {
		/* invalid type. Silently ignore content as we cannot find secret-keys
		 * here. */
		return;
	}

	s_wg = NM_SETTING_WIREGUARD (setting);
	priv = NM_SETTING_WIREGUARD_GET_PRIVATE (s_wg);

	g_variant_builder_init (&peers_builder, G_VARIANT_TYPE ("aa{sv}"));
	g_variant_iter_init (&data_iter, data_val);
	while (g_variant_iter_next (&data_iter, "a{sv}", &peer_iter)) {
		_nm_unused nm_auto_free_variant_iter GVariantIter *peer_iter_free = peer_iter;
		gs_unref_variant GVariant *preshared_key = NULL;
		PeerData *pd = NULL;
		NMSettingSecretFlags secret_flags;
		GVariant *val;
		GVariantBuilder peer_builder;

		g_variant_builder_init (&peer_builder, G_VARIANT_TYPE ("a{sv}"));

		while (g_variant_iter_next (peer_iter, "{&sv}", &key, &val)) {
			_nm_unused gs_unref_variant GVariant *val_free = val;

			if (nm_streq (key, NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY)) {
				if (   !preshared_key
				    && g_variant_is_of_type (val, G_VARIANT_TYPE_STRING))
					preshared_key = g_variant_ref (val);
				continue;
			}

			if (nm_streq (key, NM_WIREGUARD_PEER_ATTR_PUBLIC_KEY)) {
				if (   !pd
				    && g_variant_is_of_type (val, G_VARIANT_TYPE_STRING))
					pd = _peers_get_by_public_key (priv, g_variant_get_string (val, NULL), TRUE);
			} else if (remove_non_secrets)
				continue;

			g_variant_builder_add (&peer_builder, "{sv}", key, val);
		}

		if (pd && preshared_key) {
			/* without specifying a public-key of an existing peer, the secret is
			 * ignored. */
			secret_flags = nm_wireguard_peer_get_preshared_key_flags (pd->peer);
			if (callback (secret_flags, callback_data))
				g_variant_builder_add (&peer_builder, "{sv}", NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY, preshared_key);
		}

		g_variant_builder_add (&peers_builder, "a{sv}", &peer_builder);
	}

	g_variant_builder_add (setting_builder,
	                       "{sv}",
	                       NM_SETTING_WIREGUARD_PEERS,
	                       g_variant_builder_end (&peers_builder));
}

/*****************************************************************************/

static void
get_property (GObject *object, guint prop_id,
              GValue *value, GParamSpec *pspec)
{
	NMSettingWireGuard *setting = NM_SETTING_WIREGUARD (object);
	NMSettingWireGuardPrivate *priv = NM_SETTING_WIREGUARD_GET_PRIVATE (setting);

	switch (prop_id) {
	case PROP_FWMARK:
		g_value_set_uint (value, priv->fwmark);
		break;
	case PROP_IP4_AUTO_DEFAULT_ROUTE:
		g_value_set_enum (value, priv->ip4_auto_default_route);
		break;
	case PROP_IP6_AUTO_DEFAULT_ROUTE:
		g_value_set_enum (value, priv->ip6_auto_default_route);
		break;
	case PROP_LISTEN_PORT:
		g_value_set_uint (value, priv->listen_port);
		break;
	case PROP_MTU:
		g_value_set_uint (value, priv->mtu);
		break;
	case PROP_PEER_ROUTES:
		g_value_set_boolean (value, priv->peer_routes);
		break;
	case PROP_PRIVATE_KEY:
		g_value_set_string (value, priv->private_key);
		break;
	case PROP_PRIVATE_KEY_FLAGS:
		g_value_set_flags (value, priv->private_key_flags);
		break;
	default:
		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
		break;
	}
}

static void
set_property (GObject *object, guint prop_id,
              const GValue *value, GParamSpec *pspec)
{
	NMSettingWireGuardPrivate *priv = NM_SETTING_WIREGUARD_GET_PRIVATE (object);
	const char *str;

	switch (prop_id) {
	case PROP_FWMARK:
		priv->fwmark = g_value_get_uint (value);
		break;
	case PROP_IP4_AUTO_DEFAULT_ROUTE:
		priv->ip4_auto_default_route = g_value_get_enum (value);
		break;
	case PROP_IP6_AUTO_DEFAULT_ROUTE:
		priv->ip6_auto_default_route = g_value_get_enum (value);
		break;
	case PROP_LISTEN_PORT:
		priv->listen_port = g_value_get_uint (value);
		break;
	case PROP_MTU:
		priv->mtu = g_value_get_uint (value);
		break;
	case PROP_PEER_ROUTES:
		priv->peer_routes = g_value_get_boolean (value);
		break;
	case PROP_PRIVATE_KEY:
		nm_clear_pointer (&priv->private_key, nm_free_secret);
		str = g_value_get_string (value);
		if (str) {
			if (nm_utils_base64secret_normalize (str,
			                                     NM_WIREGUARD_PUBLIC_KEY_LEN,
			                                     &priv->private_key))
				priv->private_key_valid = TRUE;
			else {
				priv->private_key = g_strdup (str);
				priv->private_key_valid = FALSE;
			}
		}
		break;
	case PROP_PRIVATE_KEY_FLAGS:
		priv->private_key_flags = g_value_get_flags (value);
		break;
	default:
		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
		break;
	}
}

/*****************************************************************************/

static void
nm_setting_wireguard_init (NMSettingWireGuard *setting)
{
	NMSettingWireGuardPrivate *priv = NM_SETTING_WIREGUARD_GET_PRIVATE (setting);

	priv->peers_arr = g_ptr_array_new ();
	priv->peers_hash = g_hash_table_new (nm_pstr_hash, nm_pstr_equal);
	priv->peer_routes = TRUE;
	priv->ip4_auto_default_route = NM_TERNARY_DEFAULT;
	priv->ip6_auto_default_route = NM_TERNARY_DEFAULT;
}

/**
 * nm_setting_wireguard_new:
 *
 * Creates a new #NMSettingWireGuard object with default values.
 *
 * Returns: (transfer full): the new empty #NMSettingWireGuard object
 *
 * Since: 1.16
 **/
NMSetting *
nm_setting_wireguard_new (void)
{
	return g_object_new (NM_TYPE_SETTING_WIREGUARD, NULL);
}

static void
finalize (GObject *object)
{
	NMSettingWireGuardPrivate *priv = NM_SETTING_WIREGUARD_GET_PRIVATE (object);

	nm_free_secret (priv->private_key);

	_peers_clear (priv);
	g_ptr_array_unref (priv->peers_arr);
	g_hash_table_unref (priv->peers_hash);

	G_OBJECT_CLASS (nm_setting_wireguard_parent_class)->finalize (object);
}

static void
nm_setting_wireguard_class_init (NMSettingWireGuardClass *klass)
{
	GObjectClass *object_class = G_OBJECT_CLASS (klass);
	NMSettingClass *setting_class = NM_SETTING_CLASS (klass);
	GArray *properties_override = _nm_sett_info_property_override_create_array ();

	object_class->get_property = get_property;
	object_class->set_property = set_property;
	object_class->finalize     = finalize;

	setting_class->verify                    = verify;
	setting_class->verify_secrets            = verify_secrets;
	setting_class->need_secrets              = need_secrets;
	setting_class->clear_secrets             = clear_secrets;
	setting_class->update_one_secret         = update_one_secret;
	setting_class->compare_property          = compare_property;
	setting_class->duplicate_copy_properties = duplicate_copy_properties;
	setting_class->enumerate_values          = enumerate_values;
	setting_class->aggregate                 = aggregate;
	setting_class->get_secret_flags          = get_secret_flags;
	setting_class->set_secret_flags          = set_secret_flags;
	setting_class->for_each_secret           = for_each_secret;

	/**
	 * NMSettingWireGuard:private-key:
	 *
	 * The 256 bit private-key in base64 encoding.
	 *
	 * Since: 1.16
	 **/
	obj_properties[PROP_PRIVATE_KEY] =
	    g_param_spec_string (NM_SETTING_WIREGUARD_PRIVATE_KEY, "", "",
	                         NULL,
	                           G_PARAM_READWRITE
	                         | NM_SETTING_PARAM_SECRET
	                         | G_PARAM_STATIC_STRINGS);

	/**
	 * NMSettingWireGuard:private-key-flags:
	 *
	 * Flags indicating how to handle the #NMSettingWirelessSecurity:private-key
	 * property.
	 *
	 * Since: 1.16
	 **/
	obj_properties[PROP_PRIVATE_KEY_FLAGS] =
	    g_param_spec_flags (NM_SETTING_WIREGUARD_PRIVATE_KEY_FLAGS, "", "",
	                        NM_TYPE_SETTING_SECRET_FLAGS,
	                        NM_SETTING_SECRET_FLAG_NONE,
	                          G_PARAM_READWRITE
	                        | G_PARAM_STATIC_STRINGS);

	/**
	 * NMSettingWireGuard:fwmark:
	 *
	 * The use of fwmark is optional and is by default off. Setting it to 0
	 * disables it. Otherwise it is a 32-bit fwmark for outgoing packets.
	 *
	 * Note that "ip4-auto-default-route" or "ip6-auto-default-route" enabled,
	 * implies to automatically choose a fwmark.
	 *
	 * Since: 1.16
	 **/
	obj_properties[PROP_FWMARK] =
	    g_param_spec_uint (NM_SETTING_WIREGUARD_FWMARK, "", "",
	                       0, G_MAXUINT32, 0,
	                         G_PARAM_READWRITE
	                       | NM_SETTING_PARAM_INFERRABLE
	                       | G_PARAM_STATIC_STRINGS);

	/**
	 * NMSettingWireGuard:listen-port:
	 *
	 * The listen-port. If listen-port is not specified, the port will be chosen
	 * randomly when the interface comes up.
	 *
	 * Since: 1.16
	 **/
	obj_properties[PROP_LISTEN_PORT] =
	    g_param_spec_uint (NM_SETTING_WIREGUARD_LISTEN_PORT, "", "",
	                       0, 65535, 0,
	                         G_PARAM_READWRITE
	                       | NM_SETTING_PARAM_INFERRABLE
	                       | G_PARAM_STATIC_STRINGS);

	/**
	 * NMSettingWireGuard:peer-routes:
	 *
	 * Whether to automatically add routes for the AllowedIPs ranges
	 * of the peers. If %TRUE (the default), NetworkManager will automatically
	 * add routes in the routing tables according to ipv4.route-table and
	 * ipv6.route-table. Usually you want this automatism enabled.
	 * If %FALSE, no such routes are added automatically. In this case, the
	 * user may want to configure static routes in ipv4.routes and ipv6.routes,
	 * respectively.
	 *
	 * Note that if the peer's AllowedIPs is "0.0.0.0/0" or "::/0" and the profile's
	 * ipv4.never-default or ipv6.never-default setting is enabled, the peer route for
	 * this peer won't be added automatically.
	 *
	 * Since: 1.16
	 **/
	obj_properties[PROP_PEER_ROUTES] =
	    g_param_spec_boolean (NM_SETTING_WIREGUARD_PEER_ROUTES, "", "",
	                          TRUE,
	                            G_PARAM_READWRITE
	                          | NM_SETTING_PARAM_INFERRABLE
	                          | G_PARAM_STATIC_STRINGS);

	/**
	 * NMSettingWireGuard:mtu:
	 *
	 * If non-zero, only transmit packets of the specified size or smaller,
	 * breaking larger packets up into multiple fragments.
	 *
	 * If zero a default MTU is used. Note that contrary to wg-quick's MTU
	 * setting, this does not take into account the current routes at the
	 * time of activation.
	 *
	 * Since: 1.16
	 **/
	obj_properties[PROP_MTU] =
	    g_param_spec_uint (NM_SETTING_WIREGUARD_MTU, "", "",
	                       0, G_MAXUINT32, 0,
	                         G_PARAM_READWRITE
	                       | NM_SETTING_PARAM_INFERRABLE
	                       | G_PARAM_STATIC_STRINGS);

	/**
	 * NMSettingWireGuard:ip4-auto-default-route:
	 *
	 * Whether to enable special handling of the IPv4 default route.
	 * If enabled, the IPv4 default route from wireguard.peer-routes
	 * will be placed to a dedicated routing-table and two policy routing rules
	 * will be added. The fwmark number is also used as routing-table for the default-route,
	 * and if fwmark is zero, an unused fwmark/table is chosen automatically.
	 * This corresponds to what wg-quick does with Table=auto and what WireGuard
	 * calls "Improved Rule-based Routing".
	 *
	 * Note that for this automatism to work, you usually don't want to set
	 * ipv4.gateway, because that will result in a conflicting default route.
	 *
	 * Leaving this at the default will enable this option automatically
	 * if ipv4.never-default is not set and there are any peers that use
	 * a default-route as allowed-ips.
	 *
	 * Since: 1.20
	 **/
	obj_properties[PROP_IP4_AUTO_DEFAULT_ROUTE] =
	    g_param_spec_enum (NM_SETTING_WIREGUARD_IP4_AUTO_DEFAULT_ROUTE, "", "",
	                       NM_TYPE_TERNARY,
	                       NM_TERNARY_DEFAULT,
	                       NM_SETTING_PARAM_FUZZY_IGNORE |
	                       G_PARAM_READWRITE |
	                       G_PARAM_STATIC_STRINGS);

	/**
	 * NMSettingWireGuard:ip6-auto-default-route:
	 *
	 * Like ip4-auto-default-route, but for the IPv6 default route.
	 *
	 * Since: 1.20
	 **/
	obj_properties[PROP_IP6_AUTO_DEFAULT_ROUTE] =
	    g_param_spec_enum (NM_SETTING_WIREGUARD_IP6_AUTO_DEFAULT_ROUTE, "", "",
	                       NM_TYPE_TERNARY,
	                       NM_TERNARY_DEFAULT,
	                       NM_SETTING_PARAM_FUZZY_IGNORE |
	                       G_PARAM_READWRITE |
	                       G_PARAM_STATIC_STRINGS);

	/* ---dbus---
	 * property: peers
	 * format: array of 'a{sv}'
	 * description: Array of dictionaries for the WireGuard peers.
	 * ---end---
	 */
	_nm_properties_override_dbus (properties_override,
	                              NM_SETTING_WIREGUARD_PEERS,
	                              NM_SETT_INFO_PROPERT_TYPE (
	                                  .dbus_type     = NM_G_VARIANT_TYPE ("aa{sv}"),
	                                  .to_dbus_fcn   = _peers_dbus_only_synth,
	                                  .from_dbus_fcn = _peers_dbus_only_set,
	                              ));

	g_object_class_install_properties (object_class, _PROPERTY_ENUMS_LAST, obj_properties);

	_nm_setting_class_commit_full (setting_class, NM_META_SETTING_TYPE_WIREGUARD, NULL, properties_override);
}
