libnm: Refactor NM_CONNECTION_SERIALIZE_* flags

nm-settings-connection.c has code similar to this in two places:

    /* FIXME: improve NMConnection API so we can avoid the overhead of cloning the connection,
     *   in particular if there are no secrets to begin with. */

    connection_cloned = nm_simple_connection_new_clone(new);

    /* Clear out unwanted secrets */
    _nm_connection_clear_secrets_by_secret_flags(connection_cloned,
                                                 NM_SETTING_SECRET_FLAG_NOT_SAVED
                                                     | NM_SETTING_SECRET_FLAG_AGENT_OWNED);

    secrets = nm_g_variant_ref_sink(
        nm_connection_to_dbus(connection_cloned, NM_CONNECTION_SERIALIZE_ONLY_SECRETS));

It seems the secrets filtering can be done by nm_connection_to_dbus() if
the NM_CONNECTION_SERIALIZE_* flags are extended.  The current set of
flags contains flags that start with NO, ONLY and WITH prefixes, which
makes it useless for combining the flags because most combinations of
more than one flag don't have a clear interpretation.  So they're mostly
useful when used alone, i.e. you'd need to add a new enum value for
each new subset of settings to be serialized.

To get the most flexibility from a small set of flags they should
either all be of the WITH_* type or NO_* type.  In the former case they
could be combined to extend the subset of properties serialized, in the
latter case each flag would reduce the subset.  After trying both
options I found it's easier to adapt the current set of flags to the
WITH_* schema while keeping binary and source compatibility.  This
commit changes the set of flags in the following way:

NM_CONNECTION_SERIALIZE_ALL is kept for compatibility but is equivalent
to a combination of other flags.

NM_CONNECTION_SERIALIZE_WITH_NON_SECRET is added with the same value as
NM_CONNECTION_SERIALIZE_NO_SECRETS, it implies that non-secret
properties are included but doesn't prevent including other properties.
Since it couldn't be meaningfully combined with any other flag this
change shouldn't break compatibility.

Similarly NM_CONNECTION_SERIALIZE_WITH_SECRETS is added with the same
value as existing NM_CONNECTION_SERIALIZE_ONLY_SECRETS with the same
consideration about compatibility.

NM_CONNECTION_SERIALIZE_WITH_SECRETS_AGENT_OWNED and the new
NM_CONNECTION_SERIALIZE_WITH_SECRETS_SYSTEM_OWNED and
NM_CONNECTION_SERIALIZE_WITH_SECRETS_NOT_SAVED add only subsets of
secrets and can be combined.  For backwards compatibility
NM_CONNECTION_SERIALIZE_ONLY_SECRETS is basically ignored when either of
these three is present, so that the value:
..ONLY_SECRETS | ..AGENT_OWNED works as previously.

9 files changed, 96 insertions, 44 deletions

diff --git a/src/libnm-core-impl/nm-setting-ip4-config.c b/src/libnm-core-impl/nm-setting-ip4-config.c
index b19d82e618..7c386d1fd4 100644
--- a/src/libnm-core-impl/nm-setting-ip4-config.c
+++ b/src/libnm-core-impl/nm-setting-ip4-config.c
@@ -388,7 +388,7 @@ ip4_address_labels_get(const NMSettInfoSetting *               sett_info,
     GVariant *         ret;
     int                num_addrs, i;
 
-    if (flags & NM_CONNECTION_SERIALIZE_ONLY_SECRETS)
+    if (!_nm_connection_serialize_non_secret(flags))
         return NULL;
 
     num_addrs = nm_setting_ip_config_get_num_addresses(s_ip);
@@ -428,7 +428,7 @@ ip4_address_data_get(const NMSettInfoSetting *               sett_info,
 {
     gs_unref_ptrarray GPtrArray *addrs = NULL;
 
-    if (flags & NM_CONNECTION_SERIALIZE_ONLY_SECRETS)
+    if (!_nm_connection_serialize_non_secret(flags))
         return NULL;
 
     g_object_get(setting, NM_SETTING_IP_CONFIG_ADDRESSES, &addrs, NULL);
@@ -502,7 +502,7 @@ ip4_route_data_get(const NMSettInfoSetting *               sett_info,
 {
     gs_unref_ptrarray GPtrArray *routes = NULL;
 
-    if (flags & NM_CONNECTION_SERIALIZE_ONLY_SECRETS)
+    if (!_nm_connection_serialize_non_secret(flags))
         return NULL;
 
     g_object_get(setting, NM_SETTING_IP_CONFIG_ROUTES, &routes, NULL);
diff --git a/src/libnm-core-impl/nm-setting-ip6-config.c b/src/libnm-core-impl/nm-setting-ip6-config.c
index 4477436edb..815a118db8 100644
--- a/src/libnm-core-impl/nm-setting-ip6-config.c
+++ b/src/libnm-core-impl/nm-setting-ip6-config.c
@@ -410,7 +410,7 @@ ip6_address_data_get(const NMSettInfoSetting *               sett_info,
 {
     gs_unref_ptrarray GPtrArray *addrs = NULL;
 
-    if (flags & NM_CONNECTION_SERIALIZE_ONLY_SECRETS)
+    if (!_nm_connection_serialize_non_secret(flags))
         return NULL;
 
     g_object_get(setting, NM_SETTING_IP_CONFIG_ADDRESSES, &addrs, NULL);
@@ -484,7 +484,7 @@ ip6_route_data_get(const NMSettInfoSetting *               sett_info,
 {
     gs_unref_ptrarray GPtrArray *routes = NULL;
 
-    if (flags & NM_CONNECTION_SERIALIZE_ONLY_SECRETS)
+    if (!_nm_connection_serialize_non_secret(flags))
         return NULL;
 
     g_object_get(setting, NM_SETTING_IP_CONFIG_ROUTES, &routes, NULL);
diff --git a/src/libnm-core-impl/nm-setting-vpn.c b/src/libnm-core-impl/nm-setting-vpn.c
index ce6e73f5b4..a70fa9b939 100644
--- a/src/libnm-core-impl/nm-setting-vpn.c
+++ b/src/libnm-core-impl/nm-setting-vpn.c
@@ -937,21 +937,30 @@ vpn_secrets_to_dbus(const NMSettInfoSetting *               sett_info,
     gs_free const char **keys = NULL;
     guint                i, len;
 
-    if (NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_NO_SECRETS))
+    if (flags != NM_CONNECTION_SERIALIZE_ALL
+        && !NM_FLAGS_ANY(flags,
+                         NM_CONNECTION_SERIALIZE_WITH_SECRETS
+                             | NM_CONNECTION_SERIALIZE_WITH_SECRETS_AGENT_OWNED
+                             | NM_CONNECTION_SERIALIZE_WITH_SECRETS_SYSTEM_OWNED
+                             | NM_CONNECTION_SERIALIZE_WITH_SECRETS_NOT_SAVED))
         return NULL;
 
     g_variant_builder_init(&builder, G_VARIANT_TYPE("a{ss}"));
 
     keys = nm_utils_strdict_get_keys(priv->secrets, TRUE, &len);
     for (i = 0; i < len; i++) {
-        const char *         key = keys[i];
-        NMSettingSecretFlags secret_flags;
+        const char *         key          = keys[i];
+        NMSettingSecretFlags secret_flags = NM_SETTING_SECRET_FLAG_NONE;
+
+        if (NM_FLAGS_ANY(flags,
+                         NM_CONNECTION_SERIALIZE_WITH_SECRETS_AGENT_OWNED
+                             | NM_CONNECTION_SERIALIZE_WITH_SECRETS_SYSTEM_OWNED
+                             | NM_CONNECTION_SERIALIZE_WITH_SECRETS_NOT_SAVED))
+            nm_setting_get_secret_flags(setting, key, &secret_flags, NULL);
+
+        if (!_nm_connection_serialize_secrets(flags, secret_flags))
+            continue;
 
-        if (NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_WITH_SECRETS_AGENT_OWNED)) {
-            if (!nm_setting_get_secret_flags(setting, key, &secret_flags, NULL)
-                || !NM_FLAGS_HAS(secret_flags, NM_SETTING_SECRET_FLAG_AGENT_OWNED))
-                continue;
-        }
         g_variant_builder_add(&builder, "{ss}", key, g_hash_table_lookup(priv->secrets, key));
     }
 
diff --git a/src/libnm-core-impl/nm-setting-wireguard.c b/src/libnm-core-impl/nm-setting-wireguard.c
index 5c96fc6dfa..70862f6147 100644
--- a/src/libnm-core-impl/nm-setting-wireguard.c
+++ b/src/libnm-core-impl/nm-setting-wireguard.c
@@ -1494,7 +1494,7 @@ _peers_dbus_only_synth(const NMSettInfoSetting *               sett_info,
                               NM_WIREGUARD_PEER_ATTR_PUBLIC_KEY,
                               g_variant_new_string(peer->public_key));
 
-        if (!NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_ONLY_SECRETS) && peer->endpoint)
+        if (_nm_connection_serialize_non_secret(flags) && peer->endpoint)
             g_variant_builder_add(
                 &builder,
                 "{sv}",
@@ -1508,21 +1508,20 @@ _peers_dbus_only_synth(const NMSettInfoSetting *               sett_info,
                                   NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY,
                                   g_variant_new_string(peer->preshared_key));
 
-        if (!NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_ONLY_SECRETS)
+        if (_nm_connection_serialize_non_secret(flags)
             && peer->preshared_key_flags != NM_SETTING_SECRET_FLAG_NOT_REQUIRED)
             g_variant_builder_add(&builder,
                                   "{sv}",
                                   NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY_FLAGS,
                                   g_variant_new_uint32(peer->preshared_key_flags));
 
-        if (!NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_ONLY_SECRETS)
-            && peer->persistent_keepalive != 0)
+        if (_nm_connection_serialize_non_secret(flags) && peer->persistent_keepalive != 0)
             g_variant_builder_add(&builder,
                                   "{sv}",
                                   NM_WIREGUARD_PEER_ATTR_PERSISTENT_KEEPALIVE,
                                   g_variant_new_uint32(peer->persistent_keepalive));
 
-        if (!NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_ONLY_SECRETS) && peer->allowed_ips
+        if (_nm_connection_serialize_non_secret(flags) && peer->allowed_ips
             && peer->allowed_ips->len > 0) {
             const char *const *  strv       = (const char *const *) peer->allowed_ips->pdata;
             gs_free const char **strv_fixed = NULL;
diff --git a/src/libnm-core-impl/nm-setting-wireless.c b/src/libnm-core-impl/nm-setting-wireless.c
index 54c12c818a..95041aeaa5 100644
--- a/src/libnm-core-impl/nm-setting-wireless.c
+++ b/src/libnm-core-impl/nm-setting-wireless.c
@@ -1080,7 +1080,7 @@ nm_setting_wireless_get_security(const NMSettInfoSetting *               sett_in
                                  NMConnectionSerializationFlags          flags,
                                  const NMConnectionSerializationOptions *options)
 {
-    if (flags & NM_CONNECTION_SERIALIZE_ONLY_SECRETS)
+    if (!_nm_connection_serialize_non_secret(flags))
         return NULL;
 
     if (!connection)
diff --git a/src/libnm-core-impl/nm-setting.c b/src/libnm-core-impl/nm-setting.c
index 22ec0f6d34..2e373a5ab0 100644
--- a/src/libnm-core-impl/nm-setting.c
+++ b/src/libnm-core-impl/nm-setting.c
@@ -582,20 +582,20 @@ property_to_dbus(const NMSettInfoSetting *               sett_info,
             return NULL;
 
         if (NM_FLAGS_HAS(property->param_spec->flags, NM_SETTING_PARAM_SECRET)) {
-            if (NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_NO_SECRETS))
-                return NULL;
-
-            if (NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_WITH_SECRETS_AGENT_OWNED)) {
-                NMSettingSecretFlags f;
+            NMSettingSecretFlags f = NM_SETTING_SECRET_FLAG_NONE;
 
-                /* see also _nm_connection_serialize_secrets() */
+            if (NM_FLAGS_ANY(flags,
+                             NM_CONNECTION_SERIALIZE_WITH_SECRETS_AGENT_OWNED
+                                 | NM_CONNECTION_SERIALIZE_WITH_SECRETS_SYSTEM_OWNED
+                                 | NM_CONNECTION_SERIALIZE_WITH_SECRETS_NOT_SAVED)) {
                 if (!nm_setting_get_secret_flags(setting, property->param_spec->name, &f, NULL))
                     return NULL;
-                if (!NM_FLAGS_HAS(f, NM_SETTING_SECRET_FLAG_AGENT_OWNED))
-                    return NULL;
             }
+
+            if (!_nm_connection_serialize_secrets(flags, f))
+                return NULL;
         } else {
-            if (NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_ONLY_SECRETS))
+            if (!_nm_connection_serialize_non_secret(flags))
                 return NULL;
         }
     }
diff --git a/src/libnm-core-impl/nm-utils.c b/src/libnm-core-impl/nm-utils.c
index badae39a1b..8f6a858530 100644
--- a/src/libnm-core-impl/nm-utils.c
+++ b/src/libnm-core-impl/nm-utils.c
@@ -4306,7 +4306,8 @@ _nm_utils_hwaddr_cloned_data_synth(const NMSettInfoSetting *               sett_
 {
     gs_free char *addr = NULL;
 
-    if (flags & NM_CONNECTION_SERIALIZE_ONLY_SECRETS)
+    if (flags != NM_CONNECTION_SERIALIZE_ALL
+        && !NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_WITH_NON_SECRET))
         return NULL;
 
     nm_assert(nm_streq0(sett_info->property_infos[property_idx].name, "assigned-mac-address"));
diff --git a/src/libnm-core-intern/nm-core-internal.h b/src/libnm-core-intern/nm-core-internal.h
index bd607b45b6..aa24c3644c 100644
--- a/src/libnm-core-intern/nm-core-internal.h
+++ b/src/libnm-core-intern/nm-core-internal.h
@@ -802,15 +802,42 @@ GBytes *_nm_setting_802_1x_cert_value_to_bytes(NMSetting8021xCKScheme scheme,
 /*****************************************************************************/
 
 static inline gboolean
+_nm_connection_serialize_non_secret(NMConnectionSerializationFlags flags)
+{
+    if (flags == NM_CONNECTION_SERIALIZE_ALL)
+        return TRUE;
+
+    return NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_WITH_NON_SECRET);
+}
+
+static inline gboolean
 _nm_connection_serialize_secrets(NMConnectionSerializationFlags flags,
                                  NMSettingSecretFlags           secret_flags)
 {
-    if (NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_NO_SECRETS))
-        return FALSE;
+    if (flags == NM_CONNECTION_SERIALIZE_ALL)
+        return TRUE;
+
+    if (NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_WITH_SECRETS)
+        && !NM_FLAGS_ANY(flags,
+                         NM_CONNECTION_SERIALIZE_WITH_SECRETS_AGENT_OWNED
+                             | NM_CONNECTION_SERIALIZE_WITH_SECRETS_SYSTEM_OWNED
+                             | NM_CONNECTION_SERIALIZE_WITH_SECRETS_NOT_SAVED))
+        return TRUE;
+
     if (NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_WITH_SECRETS_AGENT_OWNED)
-        && !NM_FLAGS_HAS(secret_flags, NM_SETTING_SECRET_FLAG_AGENT_OWNED))
-        return FALSE;
-    return TRUE;
+        && NM_FLAGS_HAS(secret_flags, NM_SETTING_SECRET_FLAG_AGENT_OWNED))
+        return TRUE;
+
+    if (NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_WITH_SECRETS_SYSTEM_OWNED)
+        && !NM_FLAGS_ANY(secret_flags,
+                         NM_SETTING_SECRET_FLAG_AGENT_OWNED | NM_SETTING_SECRET_FLAG_NOT_SAVED))
+        return TRUE;
+
+    if (NM_FLAGS_HAS(flags, NM_CONNECTION_SERIALIZE_WITH_SECRETS_NOT_SAVED)
+        && NM_FLAGS_HAS(secret_flags, NM_SETTING_SECRET_FLAG_NOT_SAVED))
+        return TRUE;
+
+    return FALSE;
 }
 
 void _nm_connection_clear_secrets_by_secret_flags(NMConnection *       self,
diff --git a/src/libnm-core-public/nm-connection.h b/src/libnm-core-public/nm-connection.h
index 19034e790a..44d1568d7a 100644
--- a/src/libnm-core-public/nm-connection.h
+++ b/src/libnm-core-public/nm-connection.h
@@ -91,19 +91,35 @@ NMSetting *nm_connection_get_setting_by_name(NMConnection *connection, const cha
 /**
  * NMConnectionSerializationFlags:
  * @NM_CONNECTION_SERIALIZE_ALL: serialize all properties (including secrets)
- * @NM_CONNECTION_SERIALIZE_NO_SECRETS: do not include secrets
- * @NM_CONNECTION_SERIALIZE_ONLY_SECRETS: only serialize secrets
- * @NM_CONNECTION_SERIALIZE_WITH_SECRETS_AGENT_OWNED: if set, only secrets that
- *   are agent owned will be serialized. Since: 1.20.
+ * @NM_CONNECTION_SERIALIZE_WITH_NON_SECRET: serialize properties that are
+ *   not secrets. Since 1.32.
+ * @NM_CONNECTION_SERIALIZE_NO_SECRETS: this is a deprecated alias for
+ *   @NM_CONNECTION_SERIALIZE_WITH_NON_SECRET.
+ * @NM_CONNECTION_SERIALIZE_WITH_SECRETS: serialize all secrets. This flag is
+ *   ignored if any of @NM_CONNECTION_SERIALIZE_WITH_SECRETS_AGENT_OWNED,
+ *   @NM_CONNECTION_SERIALIZE_WITH_SECRETS_SYSTEM_OWNED or
+ *   @NM_CONNECTION_SERIALIZE_WITH_SECRETS_NOT_SAVED is set. Since 1.32.
+ * @NM_CONNECTION_SERIALIZE_ONLY_SECRETS: a deprecated alias for
+ *   @NM_CONNECTION_SERIALIZE_WITH_SECRETS.
+ * @NM_CONNECTION_SERIALIZE_WITH_SECRETS_AGENT_OWNED: serialize agent-owned
+ *   secrets. Since: 1.20.
+ * @NM_CONNECTION_SERIALIZE_WITH_SECRETS_SYSTEM_OWNED: serialize system-owned
+ *   secrets. Since: 1.32.
+ * @NM_CONNECTION_SERIALIZE_WITH_SECRETS_NOT_SAVED: serialize secrets that
+ *   are marked as never saved. Since: 1.32.
  *
- * These flags determine which properties are serialized when calling when
- * calling nm_connection_to_dbus().
+ * These flags determine which properties are serialized when calling
+ * nm_connection_to_dbus().
  **/
 typedef enum { /*< flags >*/
-               NM_CONNECTION_SERIALIZE_ALL                      = 0x00000000,
-               NM_CONNECTION_SERIALIZE_NO_SECRETS               = 0x00000001,
-               NM_CONNECTION_SERIALIZE_ONLY_SECRETS             = 0x00000002,
-               NM_CONNECTION_SERIALIZE_WITH_SECRETS_AGENT_OWNED = 0x00000004,
+               NM_CONNECTION_SERIALIZE_ALL                       = 0x00000000,
+               NM_CONNECTION_SERIALIZE_WITH_NON_SECRET           = 0x00000001,
+               NM_CONNECTION_SERIALIZE_NO_SECRETS                = 0x00000001,
+               NM_CONNECTION_SERIALIZE_WITH_SECRETS              = 0x00000002,
+               NM_CONNECTION_SERIALIZE_ONLY_SECRETS              = 0x00000002,
+               NM_CONNECTION_SERIALIZE_WITH_SECRETS_AGENT_OWNED  = 0x00000004,
+               NM_CONNECTION_SERIALIZE_WITH_SECRETS_SYSTEM_OWNED = 0x00000008,
+               NM_CONNECTION_SERIALIZE_WITH_SECRETS_NOT_SAVED    = 0x00000010,
 } NMConnectionSerializationFlags;
 
 GVariant *nm_connection_to_dbus(NMConnection *connection, NMConnectionSerializationFlags flags);