core,nmcli: merge branch 'th/mark-external-connection'

https://bugzilla.redhat.com/show_bug.cgi?id=1816202

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/533

26 files changed, 255 insertions, 89 deletions

diff --git a/clients/cli/connections.c b/clients/cli/connections.c
index 36cb5ae5d1..44e34d56a6 100644
--- a/clients/cli/connections.c
+++ b/clients/cli/connections.c
@@ -490,9 +490,7 @@ _metagen_con_show_get_fcn (NMC_META_GENERIC_INFO_GET_FCN_ARGS)
 	const char *s;
 	char *s_mut;
 
-	NMC_HANDLE_COLOR (  ac
-	                  ? nmc_active_connection_state_to_color (nm_active_connection_get_state (ac))
-	                  : NM_META_COLOR_CONNECTION_UNKNOWN);
+	NMC_HANDLE_COLOR (nmc_active_connection_state_to_color (ac));
 
 	if (c)
 		s_con = nm_connection_get_setting_connection (c);
@@ -1427,8 +1425,18 @@ nmc_connection_profile_details (NMConnection *connection, NmCli *nmc)
 }
 
 NMMetaColor
-nmc_active_connection_state_to_color (NMActiveConnectionState state)
+nmc_active_connection_state_to_color (NMActiveConnection *ac)
 {
+	NMActiveConnectionState state;
+
+	if (!ac)
+		return NM_META_COLOR_CONNECTION_UNKNOWN;
+
+	if (NM_FLAGS_HAS (nm_active_connection_get_state_flags (ac), NM_ACTIVATION_STATE_FLAG_EXTERNAL))
+		return NM_META_COLOR_CONNECTION_EXTERNAL;
+
+	state = nm_active_connection_get_state (ac);
+
 	if (state == NM_ACTIVE_CONNECTION_STATE_ACTIVATING)
 		return NM_META_COLOR_CONNECTION_ACTIVATING;
 	else if (state == NM_ACTIVE_CONNECTION_STATE_ACTIVATED)
@@ -2605,7 +2613,7 @@ progress_active_connection_cb (gpointer user_data)
 	}
 
 	str =   device
-	      ? gettext (nmc_device_state_to_string (nm_device_get_state (device)))
+	      ? gettext (nmc_device_state_to_string_with_external (device))
 	      : active_connection_state_to_string (ac_state);
 
 	nmc_terminal_show_progress (str);
@@ -6812,7 +6820,7 @@ progress_activation_editor_cb (gpointer user_data)
 	ac_state = nm_active_connection_get_state (ac);
 	dev_state = nm_device_get_state (device);
 
-	nmc_terminal_show_progress (gettext (nmc_device_state_to_string (dev_state)));
+	nmc_terminal_show_progress (gettext (nmc_device_state_to_string_with_external (device)));
 
 	if (   ac_state == NM_ACTIVE_CONNECTION_STATE_ACTIVATED
 	    || dev_state == NM_DEVICE_STATE_ACTIVATED) {
diff --git a/clients/cli/connections.h b/clients/cli/connections.h
index 79359a1f07..31b024d719 100644
--- a/clients/cli/connections.h
+++ b/clients/cli/connections.h
@@ -18,7 +18,7 @@ nmc_process_connection_properties (NmCli *nmc,
                                    gboolean allow_remove_setting,
                                    GError **error);
 
-NMMetaColor nmc_active_connection_state_to_color (NMActiveConnectionState state);
+NMMetaColor nmc_active_connection_state_to_color (NMActiveConnection *ac);
 
 int nmc_active_connection_cmp (NMActiveConnection *ac_a, NMActiveConnection *ac_b);
 
diff --git a/clients/cli/devices.c b/clients/cli/devices.c
index 3e5e49d9a6..eaa9f0c3d1 100644
--- a/clients/cli/devices.c
+++ b/clients/cli/devices.c
@@ -92,7 +92,7 @@ _metagen_device_status_get_fcn (NMC_META_GENERIC_INFO_GET_FCN_ARGS)
 	NMDevice *d = target;
 	NMActiveConnection *ac;
 
-	NMC_HANDLE_COLOR (nmc_device_state_to_color (nm_device_get_state (d)));
+	NMC_HANDLE_COLOR (nmc_device_state_to_color (d));
 
 	switch (info->info_type) {
 	case NMC_GENERIC_INFO_TYPE_DEVICE_STATUS_DEVICE:
@@ -100,7 +100,7 @@ _metagen_device_status_get_fcn (NMC_META_GENERIC_INFO_GET_FCN_ARGS)
 	case NMC_GENERIC_INFO_TYPE_DEVICE_STATUS_TYPE:
 		return nm_device_get_type_description (d);
 	case NMC_GENERIC_INFO_TYPE_DEVICE_STATUS_STATE:
-		return nmc_meta_generic_get_str_i18n (nmc_device_state_to_string (nm_device_get_state (d)),
+		return nmc_meta_generic_get_str_i18n (nmc_device_state_to_string_with_external (d),
 		                                      get_type);
 	case NMC_GENERIC_INFO_TYPE_DEVICE_STATUS_IP4_CONNECTIVITY:
 		return nmc_meta_generic_get_str_i18n (nm_connectivity_to_string (nm_device_get_connectivity (d, AF_INET)),
@@ -147,7 +147,6 @@ _metagen_device_detail_general_get_fcn (NMC_META_GENERIC_INFO_GET_FCN_ARGS)
 {
 	NMDevice *d = target;
 	NMActiveConnection *ac;
-	NMDeviceState state;
 	NMDeviceStateReason state_reason;
 	NMConnectivityState connectivity;
 	const char *s;
@@ -180,10 +179,9 @@ _metagen_device_detail_general_get_fcn (NMC_META_GENERIC_INFO_GET_FCN_ARGS)
 	case NMC_GENERIC_INFO_TYPE_DEVICE_DETAIL_GENERAL_MTU:
 		return (*out_to_free = g_strdup_printf ("%u", (guint) nm_device_get_mtu (d)));
 	case NMC_GENERIC_INFO_TYPE_DEVICE_DETAIL_GENERAL_STATE:
-		state = nm_device_get_state (d);
 		return (*out_to_free = nmc_meta_generic_get_enum_with_detail (NMC_META_GENERIC_GET_ENUM_TYPE_PARENTHESES,
-		                                                              state,
-		                                                              nmc_device_state_to_string (state),
+		                                                              nm_device_get_state (d),
+		                                                              nmc_device_state_to_string_with_external (d),
 		                                                              get_type));
 	case NMC_GENERIC_INFO_TYPE_DEVICE_DETAIL_GENERAL_REASON:
 		state_reason = nm_device_get_state_reason (d);
@@ -1716,8 +1714,20 @@ show_device_info (NMDevice *device, NmCli *nmc)
 }
 
 NMMetaColor
-nmc_device_state_to_color (NMDeviceState state)
+nmc_device_state_to_color (NMDevice *device)
 {
+	NMDeviceState state;
+	NMActiveConnection *ac;
+
+	if (!device)
+		return NM_META_COLOR_DEVICE_UNKNOWN;
+
+	ac = nm_device_get_active_connection (device);
+	if (   ac
+	    && NM_FLAGS_HAS (nm_active_connection_get_state_flags (ac), NM_ACTIVATION_STATE_FLAG_EXTERNAL))
+		return NM_META_COLOR_CONNECTION_EXTERNAL;
+
+	state = nm_device_get_state (device);
 	if (state <= NM_DEVICE_STATE_UNAVAILABLE)
 		return NM_META_COLOR_DEVICE_UNAVAILABLE;
 	else if (state == NM_DEVICE_STATE_DISCONNECTED)
@@ -1837,7 +1847,7 @@ progress_cb (gpointer user_data)
 {
 	NMDevice *device = (NMDevice *) user_data;
 
-	nmc_terminal_show_progress (device ? gettext (nmc_device_state_to_string (nm_device_get_state (device))) : "");
+	nmc_terminal_show_progress (device ? gettext (nmc_device_state_to_string_with_external (device)) : "");
 
 	return TRUE;
 }
@@ -2608,17 +2618,15 @@ do_device_set (const NMCCommand *cmd, NmCli *nmc, int argc, const char *const*ar
 static void
 device_state (NMDevice *device, GParamSpec *pspec, NmCli *nmc)
 {
-	NMDeviceState state = nm_device_get_state (device);
+	gs_free char *str = NULL;
 	NMMetaColor color;
-	char *str;
 
-	color = nmc_device_state_to_color (state);
+	color = nmc_device_state_to_color (device);
 	str = nmc_colorize (&nmc->nmc_config, color, "%s: %s\n",
 	                    nm_device_get_iface (device),
-	                    gettext (nmc_device_state_to_string (state)));
+	                    gettext (nmc_device_state_to_string_with_external (device)));
 
 	g_print ("%s", str);
-	g_free (str);
 }
 
 static void
diff --git a/clients/cli/devices.h b/clients/cli/devices.h
index 8b7aa90198..b5d646b58c 100644
--- a/clients/cli/devices.h
+++ b/clients/cli/devices.h
@@ -16,7 +16,7 @@ void monitor_devices (NmCli *nmc);
 
 NMDevice ** nmc_get_devices_sorted (NMClient *client);
 
-NMMetaColor nmc_device_state_to_color (NMDeviceState state);
+NMMetaColor nmc_device_state_to_color (NMDevice *device);
 
 extern const NmcMetaGenericInfo *const metagen_device_status[];
 extern const NmcMetaGenericInfo *const metagen_device_detail_general[];
diff --git a/clients/cli/general.c b/clients/cli/general.c
index 05ff4dee37..a771e1d58f 100644
--- a/clients/cli/general.c
+++ b/clients/cli/general.c
@@ -1408,15 +1408,12 @@ nmc_command_func_overview (const NMCCommand *cmd, NmCli *nmc, int argc, const ch
 	/* The VPN connections don't have devices (yet?). */
 	p = nm_client_get_active_connections (nmc->client);
 	for (i = 0; i < p->len; i++) {
-		NMActiveConnectionState state;
-
 		ac = p->pdata[i];
 
 		if (!nm_active_connection_get_vpn (ac))
 			continue;
 
-		state = nm_active_connection_get_state (ac);
-		color = nmc_active_connection_state_to_color (state);
+		color = nmc_active_connection_state_to_color (ac);
 		tmp = nmc_colorize (&nmc->nmc_config, color, _("%s VPN connection"),
 		                    nm_active_connection_get_id (ac));
 		g_print ("%s\n", tmp);
@@ -1428,33 +1425,32 @@ nmc_command_func_overview (const NMCCommand *cmd, NmCli *nmc, int argc, const ch
 
 	devices = nmc_get_devices_sorted (nmc->client);
 	for (i = 0; devices[i]; i++) {
-		NMDeviceState state;
+		NMDevice *device = devices[i];
 
-		ac = nm_device_get_active_connection (devices[i]);
+		ac = nm_device_get_active_connection (device);
 
-		state = nm_device_get_state (devices[i]);
-		color = nmc_device_state_to_color (state);
+		color = nmc_device_state_to_color (device);
 		if (ac) {
 			/* TRANSLATORS: prints header line for activated device in plain `nmcli` overview output as
 			 * "<interface-name>: <device-state> to <connection-id>" */
 			tmp = nmc_colorize (&nmc->nmc_config, color, C_("nmcli-overview", "%s: %s to %s"),
-			                    nm_device_get_iface (devices[i]),
-			                    gettext (nmc_device_state_to_string (state)),
+			                    nm_device_get_iface (device),
+			                    gettext (nmc_device_state_to_string_with_external (device)),
 			                    nm_active_connection_get_id (ac));
 		} else {
 			/* TRANSLATORS: prints header line for not active device in plain `nmcli` overview output as
 			 * "<interface-name>: <device-state>" */
 			tmp = nmc_colorize (&nmc->nmc_config, color, C_("nmcli-overview", "%s: %s"),
-			                    nm_device_get_iface (devices[i]),
-			                    gettext (nmc_device_state_to_string (state)));
+			                    nm_device_get_iface (device),
+			                    gettext (nmc_device_state_to_string_with_external (device)));
 		}
 		g_print ("%s\n", tmp);
 		g_free (tmp);
 
-		if (nm_device_get_description (devices[i]) && strcmp (nm_device_get_description (devices[i]), ""))
-			g_print ("\t\"%s\"\n", nm_device_get_description (devices[i]));
+		if (nm_device_get_description (device) && strcmp (nm_device_get_description (device), ""))
+			g_print ("\t\"%s\"\n", nm_device_get_description (device));
 
-		device_overview (nmc, devices[i]);
+		device_overview (nmc, device);
 		if (ac)
 			ac_overview (nmc, ac);
 		g_print ("\n");
diff --git a/clients/cli/nmcli.c b/clients/cli/nmcli.c
index e23212eb02..0ae4a4de57 100644
--- a/clients/cli/nmcli.c
+++ b/clients/cli/nmcli.c
@@ -38,6 +38,7 @@
 	[NM_META_COLOR_CONNECTION_ACTIVATING]    = "33", \
 	[NM_META_COLOR_CONNECTION_DISCONNECTING] = "31", \
 	[NM_META_COLOR_CONNECTION_INVISIBLE]     =  "2", \
+	[NM_META_COLOR_CONNECTION_EXTERNAL]      = "32;2", \
 	[NM_META_COLOR_CONNECTIVITY_FULL]        = "32", \
 	[NM_META_COLOR_CONNECTIVITY_LIMITED]     = "33", \
 	[NM_META_COLOR_CONNECTIVITY_NONE]        = "31", \
@@ -49,6 +50,7 @@
 	[NM_META_COLOR_DEVICE_PLUGIN_MISSING]    = "31", \
 	[NM_META_COLOR_DEVICE_UNAVAILABLE]       =  "2", \
 	[NM_META_COLOR_DEVICE_DISABLED]          = "31", \
+	[NM_META_COLOR_DEVICE_EXTERNAL]          = "32;2", \
 	[NM_META_COLOR_MANAGER_RUNNING]          = "32", \
 	[NM_META_COLOR_MANAGER_STARTING]         = "33", \
 	[NM_META_COLOR_MANAGER_STOPPED]          = "31", \
@@ -550,6 +552,7 @@ parse_color_scheme (char *palette_buffer,
 		[NM_META_COLOR_CONNECTION_ACTIVATING]    = "connection-activating",
 		[NM_META_COLOR_CONNECTION_DISCONNECTING] = "connection-disconnecting",
 		[NM_META_COLOR_CONNECTION_INVISIBLE]     = "connection-invisible",
+		[NM_META_COLOR_CONNECTION_EXTERNAL]      = "connection-external",
 		[NM_META_COLOR_CONNECTION_UNKNOWN]       = "connection-unknown",
 		[NM_META_COLOR_CONNECTIVITY_FULL]        = "connectivity-full",
 		[NM_META_COLOR_CONNECTIVITY_LIMITED]     = "connectivity-limited",
@@ -563,6 +566,7 @@ parse_color_scheme (char *palette_buffer,
 		[NM_META_COLOR_DEVICE_PLUGIN_MISSING]    = "device-plugin-missing",
 		[NM_META_COLOR_DEVICE_UNAVAILABLE]       = "device-unavailable",
 		[NM_META_COLOR_DEVICE_DISABLED]          = "device-disabled",
+		[NM_META_COLOR_DEVICE_EXTERNAL]          = "device-external",
 		[NM_META_COLOR_DEVICE_UNKNOWN]           = "device-unknown",
 		[NM_META_COLOR_MANAGER_RUNNING]          = "manager-running",
 		[NM_META_COLOR_MANAGER_STARTING]         = "manager-starting",
diff --git a/clients/common/nm-client-utils.c b/clients/common/nm-client-utils.c
index 97885291d6..d3a02161ce 100644
--- a/clients/common/nm-client-utils.c
+++ b/clients/common/nm-client-utils.c
@@ -265,6 +265,38 @@ NM_UTILS_LOOKUP_STR_DEFINE (nmc_device_state_to_string, NMDeviceState,
 	NM_UTILS_LOOKUP_ITEM (NM_DEVICE_STATE_UNKNOWN,      N_("unknown")),
 )
 
+static
+NM_UTILS_LOOKUP_STR_DEFINE (_device_state_to_string, NMDeviceState,
+	NM_UTILS_LOOKUP_DEFAULT (NULL),
+	NM_UTILS_LOOKUP_ITEM (NM_DEVICE_STATE_PREPARE,      N_("connecting (externally)")),
+	NM_UTILS_LOOKUP_ITEM (NM_DEVICE_STATE_CONFIG,       N_("connecting (externally)")),
+	NM_UTILS_LOOKUP_ITEM (NM_DEVICE_STATE_NEED_AUTH,    N_("connecting (externally)")),
+	NM_UTILS_LOOKUP_ITEM (NM_DEVICE_STATE_IP_CONFIG,    N_("connecting (externally)")),
+	NM_UTILS_LOOKUP_ITEM (NM_DEVICE_STATE_IP_CHECK,     N_("connecting (externally)")),
+	NM_UTILS_LOOKUP_ITEM (NM_DEVICE_STATE_SECONDARIES,  N_("connecting (externally)")),
+	NM_UTILS_LOOKUP_ITEM (NM_DEVICE_STATE_ACTIVATED,    N_("connected (externally)")),
+	NM_UTILS_LOOKUP_ITEM (NM_DEVICE_STATE_DEACTIVATING, N_("deactivating (externally)")),
+	NM_UTILS_LOOKUP_ITEM (NM_DEVICE_STATE_FAILED,       N_("deactivating (externally)")),
+	NM_UTILS_LOOKUP_ITEM_IGNORE_OTHER (),
+)
+
+const char *
+nmc_device_state_to_string_with_external (NMDevice *device)
+{
+	NMActiveConnection *ac;
+	NMDeviceState state;
+	const char *s;
+
+	state = nm_device_get_state (device);
+
+	if (   (ac = nm_device_get_active_connection (device))
+	    && NM_FLAGS_HAS (nm_active_connection_get_state_flags (ac), NM_ACTIVATION_STATE_FLAG_EXTERNAL)
+	    && (s = _device_state_to_string (state)))
+		return s;
+
+	return nmc_device_state_to_string (state);
+}
+
 NM_UTILS_LOOKUP_STR_DEFINE (nmc_device_metered_to_string, NMMetered,
 	NM_UTILS_LOOKUP_DEFAULT (N_("unknown")),
 	NM_UTILS_LOOKUP_ITEM (NM_METERED_YES,       N_("yes")),
diff --git a/clients/common/nm-client-utils.h b/clients/common/nm-client-utils.h
index 8983e6c89b..28eac4573f 100644
--- a/clients/common/nm-client-utils.h
+++ b/clients/common/nm-client-utils.h
@@ -28,6 +28,8 @@ gboolean matches (const char *cmd, const char *pattern);
 /* FIXME: don't expose this function on its own, at least not from this file. */
 const char *nmc_bond_validate_mode (const char *mode, GError **error);
 
+const char *nmc_device_state_to_string_with_external (NMDevice *device);
+
 const char *nm_active_connection_state_reason_to_string (NMActiveConnectionStateReason reason);
 const char *nmc_device_state_to_string (NMDeviceState state);
 const char *nmc_device_reason_to_string (NMDeviceStateReason reason);
diff --git a/clients/common/nm-meta-setting-desc.h b/clients/common/nm-meta-setting-desc.h
index 639f4200e3..2468972092 100644
--- a/clients/common/nm-meta-setting-desc.h
+++ b/clients/common/nm-meta-setting-desc.h
@@ -76,6 +76,7 @@ typedef enum {
 	NM_META_COLOR_CONNECTION_ACTIVATING,
 	NM_META_COLOR_CONNECTION_DISCONNECTING,
 	NM_META_COLOR_CONNECTION_INVISIBLE,
+	NM_META_COLOR_CONNECTION_EXTERNAL,
 	NM_META_COLOR_CONNECTION_UNKNOWN,
 	NM_META_COLOR_CONNECTIVITY_FULL,
 	NM_META_COLOR_CONNECTIVITY_LIMITED,
@@ -89,6 +90,7 @@ typedef enum {
 	NM_META_COLOR_DEVICE_PLUGIN_MISSING,
 	NM_META_COLOR_DEVICE_UNAVAILABLE,
 	NM_META_COLOR_DEVICE_DISABLED,
+	NM_META_COLOR_DEVICE_EXTERNAL,
 	NM_META_COLOR_DEVICE_UNKNOWN,
 	NM_META_COLOR_MANAGER_RUNNING,
 	NM_META_COLOR_MANAGER_STARTING,
diff --git a/libnm-core/nm-dbus-interface.h b/libnm-core/nm-dbus-interface.h
index 7d3482622f..1e656333c6 100644
--- a/libnm-core/nm-dbus-interface.h
+++ b/libnm-core/nm-dbus-interface.h
@@ -995,6 +995,8 @@ typedef enum { /*< skip >*/
  *  currently active but deleted on disconnect. Volatile connections are
  *  always unsaved, but they are also no backing file on disk and are entirely
  *  in-memory only.
+ * @NM_SETTINGS_CONNECTION_FLAG_EXTERNAL: the profile was generated to represent
+ *  an external configuration of a networking device. Since: 1.26
  *
  * Flags describing the current activation state.
  *
@@ -1005,6 +1007,7 @@ typedef enum { /*< flags >*/
 	NM_SETTINGS_CONNECTION_FLAG_UNSAVED                    = 0x01,
 	NM_SETTINGS_CONNECTION_FLAG_NM_GENERATED               = 0x02,
 	NM_SETTINGS_CONNECTION_FLAG_VOLATILE                   = 0x04,
+	NM_SETTINGS_CONNECTION_FLAG_EXTERNAL                   = 0x08,
 } NMSettingsConnectionFlags;
 
 /**
@@ -1021,6 +1024,8 @@ typedef enum { /*< flags >*/
  *   of the activation is bound to the visilibity of the connection profile,
  *   which in turn depends on "connection.permissions" and whether a session
  *   for the user exists. Since: 1.16
+ * @NM_ACTIVATION_STATE_FLAG_EXTERNAL: the active connection was generated to
+ *  represent an external configuration of a networking device. Since: 1.26
  *
  * Flags describing the current activation state.
  *
@@ -1036,6 +1041,7 @@ typedef enum { /*< flags >*/
 	NM_ACTIVATION_STATE_FLAG_IP6_READY                            = 0x10,
 	NM_ACTIVATION_STATE_FLAG_MASTER_HAS_SLAVES                    = 0x20,
 	NM_ACTIVATION_STATE_FLAG_LIFETIME_BOUND_TO_PROFILE_VISIBILITY = 0x40,
+	NM_ACTIVATION_STATE_FLAG_EXTERNAL                             = 0x80,
 } NMActivationStateFlags;
 
 /**
diff --git a/shared/nm-keyfile/nm-keyfile-internal.h b/shared/nm-keyfile/nm-keyfile-internal.h
index dc4082cf52..b6ac71d65c 100644
--- a/shared/nm-keyfile/nm-keyfile-internal.h
+++ b/shared/nm-keyfile/nm-keyfile-internal.h
@@ -191,6 +191,7 @@ gboolean _nm_keyfile_has_values (GKeyFile *keyfile);
 #define NM_KEYFILE_GROUP_NMMETA                 ".nmmeta"
 #define NM_KEYFILE_KEY_NMMETA_NM_GENERATED      "nm-generated"
 #define NM_KEYFILE_KEY_NMMETA_VOLATILE          "volatile"
+#define NM_KEYFILE_KEY_NMMETA_EXTERNAL          "external"
 #define NM_KEYFILE_KEY_NMMETA_SHADOWED_STORAGE  "shadowed-storage"
 #define NM_KEYFILE_KEY_NMMETA_SHADOWED_OWNED    "shadowed-owned"
 
diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
index 30b16f449b..ef4b5cf8d0 100644
--- a/src/devices/nm-device.c
+++ b/src/devices/nm-device.c
@@ -13320,10 +13320,8 @@ nm_device_set_ip_config (NMDevice *self,
 
 		if (   nm_device_sys_iface_state_is_external (self)
 		    && (settings_connection = nm_device_get_settings_connection (self))
-		    && NM_FLAGS_ALL (nm_settings_connection_get_flags (settings_connection),
-		                       NM_SETTINGS_CONNECTION_INT_FLAGS_UNSAVED
-		                     | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
-		                     | NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED)
+		    && NM_FLAGS_HAS (nm_settings_connection_get_flags (settings_connection),
+		                     NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL)
 		    && nm_active_connection_get_activation_type (NM_ACTIVE_CONNECTION (priv->act_request.obj)) == NM_ACTIVATION_TYPE_EXTERNAL) {
 			gs_unref_object NMConnection *new_connection = NULL;
 
diff --git a/src/nm-active-connection.c b/src/nm-active-connection.c
index f1bb1ede81..08037ebe71 100644
--- a/src/nm-active-connection.c
+++ b/src/nm-active-connection.c
@@ -163,6 +163,7 @@ NM_UTILS_FLAGS2STR_DEFINE (_state_flags_to_string, NMActivationStateFlags,
 	NM_UTILS_FLAGS2STR (NM_ACTIVATION_STATE_FLAG_IP6_READY,                            "ip6-ready"),
 	NM_UTILS_FLAGS2STR (NM_ACTIVATION_STATE_FLAG_MASTER_HAS_SLAVES,                    "master-has-slaves"),
 	NM_UTILS_FLAGS2STR (NM_ACTIVATION_STATE_FLAG_LIFETIME_BOUND_TO_PROFILE_VISIBILITY, "lifetime-bound-to-profile-visibility"),
+	NM_UTILS_FLAGS2STR (NM_ACTIVATION_STATE_FLAG_EXTERNAL,                             "external"),
 );
 
 /*****************************************************************************/
@@ -340,7 +341,12 @@ nm_active_connection_set_state_fail (NMActiveConnection *self,
 NMActivationStateFlags
 nm_active_connection_get_state_flags (NMActiveConnection *self)
 {
-	return NM_ACTIVE_CONNECTION_GET_PRIVATE (self)->state_flags;
+	NMActiveConnectionPrivate *priv = NM_ACTIVE_CONNECTION_GET_PRIVATE (self);
+
+	return   priv->state_flags
+	       | (  priv->activation_type == NM_ACTIVATION_TYPE_EXTERNAL
+	          ? NM_ACTIVATION_STATE_FLAG_EXTERNAL
+	          : NM_ACTIVATION_STATE_FLAG_NONE);
 }
 
 void
@@ -351,6 +357,8 @@ nm_active_connection_set_state_flags_full (NMActiveConnection *self,
 	NMActiveConnectionPrivate *priv = NM_ACTIVE_CONNECTION_GET_PRIVATE (self);
 	NMActivationStateFlags f;
 
+	nm_assert (!NM_FLAGS_HAS (mask, NM_ACTIVATION_STATE_FLAG_EXTERNAL));
+
 	f = (priv->state_flags & ~mask) | (state_flags & mask);
 	if (f != priv->state_flags) {
 		char buf1[_NM_ACTIVATION_STATE_FLAG_TO_STRING_BUFSIZE];
@@ -869,10 +877,14 @@ _set_activation_type (NMActiveConnection *self,
                       NMActivationType activation_type)
 {
 	NMActiveConnectionPrivate *priv = NM_ACTIVE_CONNECTION_GET_PRIVATE (self);
+	gboolean state_flags_changed;
 
 	if (priv->activation_type == activation_type)
 		return;
 
+	state_flags_changed =    (priv->activation_type == NM_ACTIVATION_TYPE_EXTERNAL)
+	                      != (activation_type == NM_ACTIVATION_TYPE_EXTERNAL);
+
 	priv->activation_type = activation_type;
 
 	if (priv->settings_connection.obj) {
@@ -881,6 +893,9 @@ _set_activation_type (NMActiveConnection *self,
 		else
 			g_signal_handlers_disconnect_by_func (priv->settings_connection.obj, _settings_connection_flags_changed, self);
 	}
+
+	if (state_flags_changed)
+		_notify (self, PROP_STATE_FLAGS);
 }
 
 static void
@@ -953,7 +968,7 @@ _settings_connection_flags_changed (NMSettingsConnection *settings_connection,
 	nm_assert (NM_ACTIVE_CONNECTION_GET_PRIVATE (self)->settings_connection.obj == settings_connection);
 
 	if (NM_FLAGS_HAS (nm_settings_connection_get_flags (settings_connection),
-	                  NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED))
+	                  NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL))
 		return;
 
 	_set_activation_type_managed (self);
@@ -1253,7 +1268,8 @@ static void
 get_property (GObject *object, guint prop_id,
               GValue *value, GParamSpec *pspec)
 {
-	NMActiveConnectionPrivate *priv = NM_ACTIVE_CONNECTION_GET_PRIVATE (object);
+	NMActiveConnection *self = NM_ACTIVE_CONNECTION (object);
+	NMActiveConnectionPrivate *priv = NM_ACTIVE_CONNECTION_GET_PRIVATE (self);
 	char **strv;
 	NMDevice *master_device = NULL;
 
@@ -1300,7 +1316,7 @@ get_property (GObject *object, guint prop_id,
 		}
 		break;
 	case PROP_STATE_FLAGS:
-		g_value_set_uint (value, priv->state_flags);
+		g_value_set_uint (value, nm_active_connection_get_state_flags (self));
 		break;
 	case PROP_DEFAULT:
 		g_value_set_boolean (value, priv->is_default);
diff --git a/src/nm-manager.c b/src/nm-manager.c
index 2b922fd716..ae78b7c9ce 100644
--- a/src/nm-manager.c
+++ b/src/nm-manager.c
@@ -815,8 +815,9 @@ _delete_volatile_connection_do (NMManager *self,
 {
 	NMManagerPrivate *priv = NM_MANAGER_GET_PRIVATE (self);
 
-	if (!NM_FLAGS_HAS (nm_settings_connection_get_flags (connection),
-	                   NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE))
+	if (!NM_FLAGS_ANY (nm_settings_connection_get_flags (connection),
+	                     NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+	                   | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL))
 		return;
 	if (!nm_settings_has_connection (priv->settings, connection))
 		return;
@@ -1058,8 +1059,9 @@ _get_activatable_connections_filter (NMSettings *settings,
 	const GetActivatableConnectionsFilterData *d = user_data;
 	NMConnectionMultiConnect multi_connect;
 
-	if (NM_FLAGS_HAS (nm_settings_connection_get_flags (sett_conn),
-	                  NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE))
+	if (NM_FLAGS_ANY (nm_settings_connection_get_flags (sett_conn),
+	                    NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+	                  | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL))
 		return FALSE;
 
 	multi_connect = _nm_connection_get_multi_connect (nm_settings_connection_get_connection (sett_conn));
@@ -2117,8 +2119,9 @@ connection_changed (NMManager *self,
 	NMConnection *connection;
 	NMDevice *device;
 
-	if (NM_FLAGS_HAS (nm_settings_connection_get_flags (sett_conn),
-	                  NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE))
+	if (NM_FLAGS_ANY (nm_settings_connection_get_flags (sett_conn),
+	                    NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+	                  | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL))
 		return;
 
 	connection = nm_settings_connection_get_connection (sett_conn);
@@ -2189,8 +2192,9 @@ connection_flags_changed (NMSettings *settings,
 	NMManager *self = user_data;
 	NMManagerPrivate *priv = NM_MANAGER_GET_PRIVATE (self);
 
-	if (!NM_FLAGS_HAS (nm_settings_connection_get_flags (connection),
-	                   NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE))
+	if (!NM_FLAGS_ANY (nm_settings_connection_get_flags (connection),
+	                     NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+	                   | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL))
 		return;
 
 	if (active_connection_find (self, connection, NULL, NM_ACTIVE_CONNECTION_STATE_DEACTIVATED, NULL)) {
@@ -2695,11 +2699,19 @@ get_existing_connection (NMManager *self,
 	}
 
 	if (matched) {
-		_LOG2I (LOGD_DEVICE, device, "assume: will attempt to assume matching connection '%s' (%s)%s",
-		        nm_settings_connection_get_id (matched),
-		        nm_settings_connection_get_uuid (matched),
-		        assume_state_connection_uuid && nm_streq (assume_state_connection_uuid, nm_settings_connection_get_uuid (matched))
-		            ? " (indicated)" : " (guessed)");
+
+		if (NM_FLAGS_HAS (nm_settings_connection_get_flags (matched), NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL)) {
+			_LOG2D (LOGD_DEVICE, device, "assume: take over previous connection '%s' (%s)",
+			        nm_settings_connection_get_id (matched),
+			        nm_settings_connection_get_uuid (matched));
+			NM_SET_OUT (out_generated, TRUE);
+		} else {
+			_LOG2I (LOGD_DEVICE, device, "assume: will attempt to assume matching connection '%s' (%s)%s",
+			        nm_settings_connection_get_id (matched),
+			        nm_settings_connection_get_uuid (matched),
+			        assume_state_connection_uuid && nm_streq (assume_state_connection_uuid, nm_settings_connection_get_uuid (matched))
+			            ? " (indicated)" : " (guessed)");
+		}
 		nm_device_assume_state_reset (device);
 		return matched;
 	}
@@ -2714,8 +2726,9 @@ get_existing_connection (NMManager *self,
 	                                 connection,
 	                                 NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY_ONLY,
 	                                 NM_SETTINGS_CONNECTION_ADD_REASON_NONE,
-	                                   NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
-	                                 | NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED,
+	                                   NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
+	                                 | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+	                                 | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL,
 	                                 &added,
 	                                 &error)) {
 		_LOG2W (LOGD_SETTINGS, device, "assume: failure to save generated connection '%s': %s",
@@ -2819,8 +2832,9 @@ recheck_assume_connection (NMManager *self,
 				nm_settings_connection_update (sett_conn,
 				                               NULL,
 				                               NM_SETTINGS_CONNECTION_PERSIST_MODE_KEEP,
-				                               0,
-				                               NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE,
+				                               NM_SETTINGS_CONNECTION_INT_FLAGS_NONE,
+				                                 NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+				                               | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL,
 				                               NM_SETTINGS_CONNECTION_UPDATE_REASON_NONE,
 				                               "assume-initrd",
 				                               NULL);
diff --git a/src/settings/nm-settings-connection.c b/src/settings/nm-settings-connection.c
index a79e2afaa6..ca46de681d 100644
--- a/src/settings/nm-settings-connection.c
+++ b/src/settings/nm-settings-connection.c
@@ -1535,7 +1535,8 @@ update_auth_cb (NMSettingsConnection *self,
 	                                ? NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
 	                                : NM_SETTINGS_CONNECTION_INT_FLAGS_NONE),
 	                                 NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
-	                               | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE,
+	                               | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+	                               | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL,
 	                                 NM_SETTINGS_CONNECTION_UPDATE_REASON_FORCE_RENAME
 	                               | (  NM_FLAGS_HAS (info->flags, NM_SETTINGS_UPDATE2_FLAG_NO_REAPPLY)
 	                                  ? NM_SETTINGS_CONNECTION_UPDATE_REASON_NONE
@@ -2028,6 +2029,7 @@ NM_UTILS_FLAGS2STR_DEFINE (_settings_connection_flags_to_string, NMSettingsConne
 	NM_UTILS_FLAGS2STR (NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED,  "nm-generated"),
 	NM_UTILS_FLAGS2STR (NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE,      "volatile"),
 	NM_UTILS_FLAGS2STR (NM_SETTINGS_CONNECTION_INT_FLAGS_VISIBLE,       "visible"),
+	NM_UTILS_FLAGS2STR (NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL,       "external"),
 );
 
 NMSettingsConnectionIntFlags
@@ -2481,7 +2483,8 @@ nm_settings_connection_autoconnect_is_blocked (NMSettingsConnection *self)
 		return TRUE;
 
 	flags = priv->flags;
-	if (NM_FLAGS_HAS (flags, NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE))
+	if (NM_FLAGS_ANY (flags,   NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+	                         | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL))
 		return TRUE;
 	if (!NM_FLAGS_HAS (flags, NM_SETTINGS_CONNECTION_INT_FLAGS_VISIBLE))
 		return TRUE;
diff --git a/src/settings/nm-settings-connection.h b/src/settings/nm-settings-connection.h
index ebc46414f0..17573bbe05 100644
--- a/src/settings/nm-settings-connection.h
+++ b/src/settings/nm-settings-connection.h
@@ -147,6 +147,8 @@ typedef enum {
  *  when it disconnects. That is for in-memory connections (unsaved), which are
  *  currently active but cleanup on disconnect.
  *  See also #NM_SETTINGS_CONNECTION_FLAG_VOLATILE.
+ * @NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL: the profile was generated to
+ *  represent the external activation of a device. See also #NM_SETTINGS_CONNECTION_FLAG_EXTERNAL.
  * @NM_SETTINGS_CONNECTION_INT_FLAGS_VISIBLE: The connection is visible
  * @_NM_SETTINGS_CONNECTION_INT_FLAGS_EXPORTED_MASK: the entire enum is
  *   internal, however, parts of it is public API as #NMSettingsConnectionFlags.
@@ -161,8 +163,9 @@ typedef enum _NMSettingsConnectionIntFlags {
 	NM_SETTINGS_CONNECTION_INT_FLAGS_UNSAVED                = NM_SETTINGS_CONNECTION_FLAG_UNSAVED,
 	NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED           = NM_SETTINGS_CONNECTION_FLAG_NM_GENERATED,
 	NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE               = NM_SETTINGS_CONNECTION_FLAG_VOLATILE,
+	NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL               = NM_SETTINGS_CONNECTION_FLAG_EXTERNAL,
 
-	NM_SETTINGS_CONNECTION_INT_FLAGS_VISIBLE                = 0x08,
+	NM_SETTINGS_CONNECTION_INT_FLAGS_VISIBLE                = 0x10,
 
 	_NM_SETTINGS_CONNECTION_INT_FLAGS_LAST,
 
@@ -170,11 +173,13 @@ typedef enum _NMSettingsConnectionIntFlags {
 	                                                          | NM_SETTINGS_CONNECTION_INT_FLAGS_UNSAVED
 	                                                          | NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
 	                                                          | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+	                                                          | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL
 	                                                          | 0,
 
 	_NM_SETTINGS_CONNECTION_INT_FLAGS_PERSISTENT_MASK       = 0
 	                                                          | NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
 	                                                          | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+	                                                          | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL
 	                                                          | 0,
 
 	_NM_SETTINGS_CONNECTION_INT_FLAGS_ALL = ((_NM_SETTINGS_CONNECTION_INT_FLAGS_LAST - 1) << 1) - 1,
diff --git a/src/settings/nm-settings.c b/src/settings/nm-settings.c
index 874efbfc2b..5899b07945 100644
--- a/src/settings/nm-settings.c
+++ b/src/settings/nm-settings.c
@@ -1091,12 +1091,14 @@ _connection_changed_update (NMSettings *self,
 	else {
 		nm_assert (!NM_FLAGS_HAS (sett_flags, NM_SETTINGS_CONNECTION_INT_FLAGS_UNSAVED));
 
-		/* Profiles that don't reside in /run, are never nm-generated
-		 * and never volatile. */
+		/* Profiles that don't reside in /run, are never nm-generated,
+		 * volatile, and external. */
 		sett_mask |= (  NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
-		              | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE);
+		              | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+		              | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL);
 		sett_flags &= ~(  NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
-		                | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE);
+		                | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+		                | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL);
 	}
 
 	nm_settings_connection_set_flags_full (sett_conn,
@@ -1200,7 +1202,8 @@ _connection_changed_delete (NMSettings *self,
 
 	nm_settings_connection_set_flags (sett_conn,
 	                                    NM_SETTINGS_CONNECTION_INT_FLAGS_VISIBLE
-	                                  | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE,
+	                                  | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+	                                  | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL,
 	                                  FALSE);
 
 	_emit_connection_removed (self, sett_conn);
@@ -1491,6 +1494,7 @@ _add_connection_to_first_plugin (NMSettings *self,
 			                                             in_memory,
 			                                             NM_FLAGS_HAS (sett_flags, NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED),
 			                                             NM_FLAGS_HAS (sett_flags, NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE),
+			                                             NM_FLAGS_HAS (sett_flags, NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL),
 			                                             shadowed_storage,
 			                                             shadowed_owned,
 			                                             &storage,
@@ -1501,6 +1505,7 @@ _add_connection_to_first_plugin (NMSettings *self,
 				continue;
 			nm_assert (!NM_FLAGS_HAS (sett_flags, NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED));
 			nm_assert (!NM_FLAGS_HAS (sett_flags, NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE));
+			nm_assert (!NM_FLAGS_HAS (sett_flags, NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL));
 			success = nm_settings_plugin_add_connection (plugin,
 			                                             new_connection,
 			                                             &storage,
@@ -1578,6 +1583,7 @@ _update_connection_to_plugin (NMSettings *self,
 		                                                connection,
 		                                                NM_FLAGS_HAS (sett_flags, NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED),
 		                                                NM_FLAGS_HAS (sett_flags, NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE),
+		                                                NM_FLAGS_HAS (sett_flags, NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL),
 		                                                shadowed_storage,
 		                                                shadowed_owned,
 		                                                force_rename,
@@ -1693,8 +1699,9 @@ nm_settings_add_connection (NMSettings *self,
 
 	nm_assert (!NM_FLAGS_ANY (sett_flags, ~_NM_SETTINGS_CONNECTION_INT_FLAGS_PERSISTENT_MASK));
 
-	if (NM_FLAGS_ANY (sett_flags,   NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
-	                              | NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED)) {
+	if (NM_FLAGS_ANY (sett_flags,   NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
+	                              | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+	                              | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL)) {
 		nm_assert (new_in_memory);
 		new_in_memory = TRUE;
 	}
@@ -1992,7 +1999,8 @@ nm_settings_update_connection (NMSettings *self,
 			nm_assert (cur_in_memory);
 			nm_assert (!NM_FLAGS_ANY (nm_settings_connection_get_flags (sett_conn),
 			                            NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
-			                          | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE));
+			                          | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+			                          | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL));
 
 			default_wired_clear_tag (self, device, sett_conn, FALSE);
 
@@ -2011,11 +2019,13 @@ nm_settings_update_connection (NMSettings *self,
 
 	if (   persist_mode == NM_SETTINGS_CONNECTION_PERSIST_MODE_NO_PERSIST
 	    && NM_FLAGS_ANY (sett_mask,   NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
-	                                | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE)
+	                                | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+	                                | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL)
 	    && NM_FLAGS_ANY ((sett_flags ^ nm_settings_connection_get_flags (sett_conn)) & sett_mask,
 	                       NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
-	                     | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE)) {
-		/* we update the nm-generated/volatile setting of a profile (which is inherrently
+	                     | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+	                     | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL)) {
+		/* we update the nm-generated/volatile setting of a profile (which is inherently
 		 * in-memory. The caller did not request to persist this to disk, however we need
 		 * to store the flags in run. */
 		nm_assert (cur_in_memory);
@@ -2043,11 +2053,14 @@ nm_settings_update_connection (NMSettings *self,
 		 * the nm-generated flag after restart/reload, and that cannot be right. If a profile
 		 * ends up on disk, the information who created it gets lost. */
 		nm_assert (!NM_FLAGS_ANY (sett_flags,   NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
-		                                      | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE));
+		                                      | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+		                                      | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL));
 		sett_mask |=   NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
-		             | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE;
+		             | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+		             | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL;
 		sett_flags &= ~(  NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
-		                | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE);
+		                | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+		                | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL);
 	}
 
 	if (persist_mode == NM_SETTINGS_CONNECTION_PERSIST_MODE_NO_PERSIST) {
@@ -3374,7 +3387,8 @@ have_connection_for_device (NMSettings *self, NMDevice *device)
 			continue;
 
 		if (NM_FLAGS_ANY (nm_settings_connection_get_flags (sett_conn),
-		                  NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE))
+		                    NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+		                  | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL))
 			continue;
 
 		return TRUE;
diff --git a/src/settings/plugins/keyfile/nms-keyfile-plugin.c b/src/settings/plugins/keyfile/nms-keyfile-plugin.c
index 2906b3995c..c84bd78d0d 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-plugin.c
+++ b/src/settings/plugins/keyfile/nms-keyfile-plugin.c
@@ -89,22 +89,33 @@ G_DEFINE_TYPE (NMSKeyfilePlugin, nms_keyfile_plugin, NM_TYPE_SETTINGS_PLUGIN)
 /*****************************************************************************/
 
 static const char *
-_extra_flags_to_string (char *str, gsize str_len, gboolean is_nm_generated, gboolean is_volatile)
+_extra_flags_to_string (char *str, gsize str_len, gboolean is_nm_generated, gboolean is_volatile, gboolean is_external)
 {
 	const char *str0 = str;
 
 	if (   !is_nm_generated
-	    && !is_volatile)
+	    && !is_volatile
+	    && !is_external)
 		nm_utils_strbuf_append_str (&str, &str_len, "");
 	else {
-		nm_utils_strbuf_append_str (&str, &str_len, " (");
+		char ch = '(';
+
+		nm_utils_strbuf_append_c (&str, &str_len, ' ');
 		if (is_nm_generated) {
+			nm_utils_strbuf_append_c (&str, &str_len, ch);
 			nm_utils_strbuf_append_str (&str, &str_len, "nm-generated");
-			if (is_volatile)
-				nm_utils_strbuf_append_c (&str, &str_len, ',');
+			ch = ',';
 		}
-		if (is_volatile)
+		if (is_volatile) {
+			nm_utils_strbuf_append_c (&str, &str_len, ch);
 			nm_utils_strbuf_append_str (&str, &str_len, "volatile");
+			ch = ',';
+		}
+		if (is_external) {
+			nm_utils_strbuf_append_c (&str, &str_len, ch);
+			nm_utils_strbuf_append_str (&str, &str_len, "external");
+			ch = ',';
+		}
 		nm_utils_strbuf_append_c (&str, &str_len, ')');
 	}
 
@@ -202,6 +213,7 @@ _read_from_file (const char *full_filename,
                  struct stat *out_stat,
                  NMTernary *out_is_nm_generated,
                  NMTernary *out_is_volatile,
+                 NMTernary *out_is_external,
                  char **out_shadowed_storage,
                  NMTernary *out_shadowed_owned,
                  GError **error)
@@ -215,6 +227,7 @@ _read_from_file (const char *full_filename,
 	                                           out_stat,
 	                                           out_is_nm_generated,
 	                                           out_is_volatile,
+	                                           out_is_external,
 	                                           out_shadowed_storage,
 	                                           out_shadowed_owned,
 	                                           error);
@@ -284,8 +297,9 @@ _load_file (NMSKeyfilePlugin *self,
 {
 	NMSKeyfilePluginPrivate *priv;
 	gs_unref_object NMConnection *connection = NULL;
-	NMTernary is_volatile_opt;
 	NMTernary is_nm_generated_opt;
+	NMTernary is_volatile_opt;
+	NMTernary is_external_opt;
 	NMTernary shadowed_owned_opt;
 	gs_free char *shadowed_storage = NULL;
 	gs_free_error GError *local = NULL;
@@ -350,6 +364,7 @@ _load_file (NMSKeyfilePlugin *self,
 	                              &st,
 	                              &is_nm_generated_opt,
 	                              &is_volatile_opt,
+	                              &is_external_opt,
 	                              &shadowed_storage,
 	                              &shadowed_owned_opt,
 	                              &local);
@@ -367,6 +382,7 @@ _load_file (NMSKeyfilePlugin *self,
 	                                           storage_type,
 	                                           is_nm_generated_opt,
 	                                           is_volatile_opt,
+	                                           is_external_opt,
 	                                           shadowed_storage,
 	                                           shadowed_owned_opt,
 	                                           &st.st_mtim);
@@ -732,6 +748,7 @@ nms_keyfile_plugin_add_connection (NMSKeyfilePlugin *self,
                                    gboolean in_memory,
                                    gboolean is_nm_generated,
                                    gboolean is_volatile,
+                                   gboolean is_external,
                                    const char *shadowed_storage,
                                    gboolean shadowed_owned,
                                    NMSettingsStorage **out_storage,
@@ -756,6 +773,7 @@ nms_keyfile_plugin_add_connection (NMSKeyfilePlugin *self,
 	nm_assert (   in_memory
 	           || (   !is_nm_generated
 	               && !is_volatile
+	               && !is_external
 	               && !shadowed_storage
 	               && !shadowed_owned));
 
@@ -770,6 +788,7 @@ nms_keyfile_plugin_add_connection (NMSKeyfilePlugin *self,
 	if (!nms_keyfile_writer_connection (connection,
 	                                    is_nm_generated,
 	                                    is_volatile,
+	                                    is_external,
 	                                    shadowed_storage,
 	                                    shadowed_owned,
 	                                      storage_type == NMS_KEYFILE_STORAGE_TYPE_ETC
@@ -807,7 +826,7 @@ nms_keyfile_plugin_add_connection (NMSKeyfilePlugin *self,
 	       uuid,
 	       nm_connection_get_id (connection),
 	       full_filename,
-	       _extra_flags_to_string (strbuf, sizeof (strbuf), is_nm_generated, is_volatile),
+	       _extra_flags_to_string (strbuf, sizeof (strbuf), is_nm_generated, is_volatile, is_external),
 	       NM_PRINT_FMT_QUOTED (shadowed_storage, " (shadows \"", shadowed_storage, shadowed_owned ? "\", owned)" : "\")", ""));
 
 	storage = nms_keyfile_storage_new_connection (self,
@@ -816,6 +835,7 @@ nms_keyfile_plugin_add_connection (NMSKeyfilePlugin *self,
 	                                              storage_type,
 	                                              is_nm_generated ? NM_TERNARY_TRUE : NM_TERNARY_FALSE,
 	                                              is_volatile ? NM_TERNARY_TRUE : NM_TERNARY_FALSE,
+	                                              is_external ? NM_TERNARY_TRUE : NM_TERNARY_FALSE,
 	                                              shadowed_storage,
 	                                              shadowed_owned ? NM_TERNARY_TRUE : NM_TERNARY_FALSE,
 	                                              nm_sett_util_stat_mtime (full_filename, FALSE, &mtime));
@@ -840,6 +860,7 @@ add_connection (NMSettingsPlugin *plugin,
 	                                          FALSE,
 	                                          FALSE,
 	                                          FALSE,
+	                                          FALSE,
 	                                          NULL,
 	                                          FALSE,
 	                                          out_storage,
@@ -853,6 +874,7 @@ nms_keyfile_plugin_update_connection (NMSKeyfilePlugin *self,
                                       NMConnection *connection,
                                       gboolean is_nm_generated,
                                       gboolean is_volatile,
+                                      gboolean is_external,
                                       const char *shadowed_storage,
                                       gboolean shadowed_owned,
                                       gboolean force_rename,
@@ -883,6 +905,7 @@ nms_keyfile_plugin_update_connection (NMSKeyfilePlugin *self,
 	nm_assert (   storage->storage_type == NMS_KEYFILE_STORAGE_TYPE_RUN
 	           || (   !is_nm_generated
 	               && !is_volatile
+	               && !is_external
 	               && !shadowed_storage
 	               && !shadowed_owned));
 	nm_assert (!shadowed_owned || shadowed_storage);
@@ -895,6 +918,7 @@ nms_keyfile_plugin_update_connection (NMSKeyfilePlugin *self,
 	if (!nms_keyfile_writer_connection (connection,
 	                                    is_nm_generated,
 	                                    is_volatile,
+	                                    is_external,
 	                                    shadowed_storage,
 	                                    shadowed_owned,
 	                                      storage->storage_type == NMS_KEYFILE_STORAGE_TYPE_ETC
@@ -933,11 +957,12 @@ nms_keyfile_plugin_update_connection (NMSKeyfilePlugin *self,
 	       full_filename,
 	       uuid,
 	       nm_connection_get_id (connection),
-	       _extra_flags_to_string (strbuf, sizeof (strbuf), is_nm_generated, is_volatile),
+	       _extra_flags_to_string (strbuf, sizeof (strbuf), is_nm_generated, is_volatile, is_external),
 	       NM_PRINT_FMT_QUOTED (shadowed_storage, shadowed_owned ? " (owns \"" : " (shadows \"", shadowed_storage, "\")", ""));
 
 	storage->u.conn_data.is_nm_generated = is_nm_generated;
 	storage->u.conn_data.is_volatile     = is_volatile;
+	storage->u.conn_data.is_external     = is_external;
 	storage->u.conn_data.stat_mtime      = *nm_sett_util_stat_mtime (full_filename, FALSE, &mtime);
 	storage->u.conn_data.shadowed_owned  = shadowed_owned;
 
@@ -959,6 +984,7 @@ update_connection (NMSettingsPlugin *plugin,
 	                                             connection,
 	                                             FALSE,
 	                                             FALSE,
+	                                             FALSE,
 	                                             NULL,
 	                                             FALSE,
 	                                             FALSE,
diff --git a/src/settings/plugins/keyfile/nms-keyfile-plugin.h b/src/settings/plugins/keyfile/nms-keyfile-plugin.h
index e885f16c9a..603f0c26cc 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-plugin.h
+++ b/src/settings/plugins/keyfile/nms-keyfile-plugin.h
@@ -31,6 +31,7 @@ gboolean nms_keyfile_plugin_add_connection (NMSKeyfilePlugin *self,
                                             gboolean in_memory,
                                             gboolean is_nm_generated,
                                             gboolean is_volatile,
+                                            gboolean is_external,
                                             const char *shadowed_storage,
                                             gboolean shadowed_owned,
                                             NMSettingsStorage **out_storage,
@@ -42,6 +43,7 @@ gboolean nms_keyfile_plugin_update_connection (NMSKeyfilePlugin *self,
                                                NMConnection *connection,
                                                gboolean is_nm_generated,
                                                gboolean is_volatile,
+                                               gboolean is_external,
                                                const char *shadowed_storage,
                                                gboolean shadowed_owned,
                                                gboolean force_rename,
diff --git a/src/settings/plugins/keyfile/nms-keyfile-reader.c b/src/settings/plugins/keyfile/nms-keyfile-reader.c
index ceda7f3f17..577709d84d 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-reader.c
+++ b/src/settings/plugins/keyfile/nms-keyfile-reader.c
@@ -156,6 +156,7 @@ nms_keyfile_reader_from_file (const char *full_filename,
                               struct stat *out_stat,
                               NMTernary *out_is_nm_generated,
                               NMTernary *out_is_volatile,
+                              NMTernary *out_is_external,
                               char **out_shadowed_storage,
                               NMTernary *out_shadowed_owned,
                               GError **error)
@@ -169,6 +170,7 @@ nms_keyfile_reader_from_file (const char *full_filename,
 
 	NM_SET_OUT (out_is_nm_generated, NM_TERNARY_DEFAULT);
 	NM_SET_OUT (out_is_volatile, NM_TERNARY_DEFAULT);
+	NM_SET_OUT (out_is_external, NM_TERNARY_DEFAULT);
 
 	if (!nms_keyfile_utils_check_file_permissions (NMS_KEYFILE_FILETYPE_KEYFILE,
 	                                               full_filename,
@@ -204,6 +206,11 @@ nms_keyfile_reader_from_file (const char *full_filename,
 	                                                      NM_KEYFILE_KEY_NMMETA_VOLATILE,
 	                                                      NM_TERNARY_DEFAULT));
 
+	NM_SET_OUT (out_is_external, nm_key_file_get_boolean (key_file,
+	                                                      NM_KEYFILE_GROUP_NMMETA,
+	                                                      NM_KEYFILE_KEY_NMMETA_EXTERNAL,
+	                                                      NM_TERNARY_DEFAULT));
+
 	NM_SET_OUT (out_shadowed_storage, g_key_file_get_string (key_file,
 	                                                         NM_KEYFILE_GROUP_NMMETA,
 	                                                         NM_KEYFILE_KEY_NMMETA_SHADOWED_STORAGE,
diff --git a/src/settings/plugins/keyfile/nms-keyfile-reader.h b/src/settings/plugins/keyfile/nms-keyfile-reader.h
index 307d6ffe77..828715fabe 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-reader.h
+++ b/src/settings/plugins/keyfile/nms-keyfile-reader.h
@@ -23,6 +23,7 @@ NMConnection *nms_keyfile_reader_from_file (const char *full_filename,
                                             struct stat *out_stat,
                                             NMTernary *out_is_nm_generated,
                                             NMTernary *out_is_volatile,
+                                            NMTernary *out_is_external,
                                             char **out_shadowed_storage,
                                             NMTernary *out_shadowed_owned,
                                             GError **error);
diff --git a/src/settings/plugins/keyfile/nms-keyfile-storage.c b/src/settings/plugins/keyfile/nms-keyfile-storage.c
index bcc06795a1..15f20295f7 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-storage.c
+++ b/src/settings/plugins/keyfile/nms-keyfile-storage.c
@@ -155,6 +155,7 @@ nms_keyfile_storage_new_connection (NMSKeyfilePlugin *plugin,
                                     NMSKeyfileStorageType storage_type,
                                     NMTernary is_nm_generated_opt,
                                     NMTernary is_volatile_opt,
+                                    NMTernary is_external_opt,
                                     const char *shadowed_storage,
                                     NMTernary shadowed_owned_opt,
                                     const struct timespec *stat_mtime)
@@ -181,6 +182,7 @@ nms_keyfile_storage_new_connection (NMSKeyfilePlugin *plugin,
 	if (storage_type == NMS_KEYFILE_STORAGE_TYPE_RUN) {
 		self->u.conn_data.is_nm_generated = (is_nm_generated_opt == NM_TERNARY_TRUE);
 		self->u.conn_data.is_volatile     = (is_volatile_opt == NM_TERNARY_TRUE);
+		self->u.conn_data.is_external     = (is_external_opt == NM_TERNARY_TRUE);
 		self->u.conn_data.shadowed_owned  =    shadowed_storage
 		                                    && (shadowed_owned_opt == NM_TERNARY_TRUE);
 	}
@@ -243,7 +245,8 @@ nm_settings_storage_load_sett_flags (NMSettingsStorage *self,
 
 	*sett_flags = NM_SETTINGS_CONNECTION_INT_FLAGS_NONE;
 	*sett_mask =   NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
-	             | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE;
+	             | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
+	             | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL;
 
 	if (!NMS_IS_KEYFILE_STORAGE (self))
 		return;
@@ -260,4 +263,7 @@ nm_settings_storage_load_sett_flags (NMSettingsStorage *self,
 
 	if (s->u.conn_data.is_volatile)
 		*sett_flags |= NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE;
+
+	if (s->u.conn_data.is_external)
+		*sett_flags |= NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL;
 }
diff --git a/src/settings/plugins/keyfile/nms-keyfile-storage.h b/src/settings/plugins/keyfile/nms-keyfile-storage.h
index 00a034d462..bd8a43674d 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-storage.h
+++ b/src/settings/plugins/keyfile/nms-keyfile-storage.h
@@ -65,6 +65,7 @@ typedef struct {
 			 * That is, it must be tied to the actual keyfile, and not to the UUID. */
 			bool is_nm_generated:1;
 			bool is_volatile:1;
+			bool is_external:1;
 
 			/* if shadowed_storage is set, then this flag indicates whether the file
 			 * is owned. The difference comes into play when deleting the in-memory,
@@ -112,6 +113,7 @@ NMSKeyfileStorage *nms_keyfile_storage_new_connection (struct _NMSKeyfilePlugin
                                                        NMSKeyfileStorageType storage_type,
                                                        NMTernary is_nm_generated_opt,
                                                        NMTernary is_volatile_opt,
+                                                       NMTernary is_external_opt,
                                                        const char *shadowed_storage,
                                                        NMTernary shadowed_owned_opt,
                                                        const struct timespec *stat_mtime);
diff --git a/src/settings/plugins/keyfile/nms-keyfile-writer.c b/src/settings/plugins/keyfile/nms-keyfile-writer.c
index a1bd661413..feea606517 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-writer.c
+++ b/src/settings/plugins/keyfile/nms-keyfile-writer.c
@@ -167,6 +167,7 @@ static gboolean
 _internal_write_connection (NMConnection *connection,
                             gboolean is_nm_generated,
                             gboolean is_volatile,
+                            gboolean is_external,
                             const char *shadowed_storage,
                             gboolean shadowed_owned,
                             const char *keyfile_dir,
@@ -232,6 +233,13 @@ _internal_write_connection (NMConnection *connection,
 		                        TRUE);
 	}
 
+	if (is_external) {
+		g_key_file_set_boolean (kf_file,
+		                        NM_KEYFILE_GROUP_NMMETA,
+		                        NM_KEYFILE_KEY_NMMETA_EXTERNAL,
+		                        TRUE);
+	}
+
 	if (shadowed_storage) {
 		g_key_file_set_string (kf_file,
 		                       NM_KEYFILE_GROUP_NMMETA,
@@ -378,6 +386,7 @@ gboolean
 nms_keyfile_writer_connection (NMConnection *connection,
                                gboolean is_nm_generated,
                                gboolean is_volatile,
+                               gboolean is_external,
                                const char *shadowed_storage,
                                gboolean shadowed_owned,
                                const char *keyfile_dir,
@@ -395,6 +404,7 @@ nms_keyfile_writer_connection (NMConnection *connection,
 	return _internal_write_connection (connection,
 	                                   is_nm_generated,
 	                                   is_volatile,
+	                                   is_external,
 	                                   shadowed_storage,
 	                                   shadowed_owned,
 	                                   keyfile_dir,
@@ -426,6 +436,7 @@ nms_keyfile_writer_test_connection (NMConnection *connection,
 	return _internal_write_connection (connection,
 	                                   FALSE,
 	                                   FALSE,
+	                                   FALSE,
 	                                   NULL,
 	                                   FALSE,
 	                                   keyfile_dir,
diff --git a/src/settings/plugins/keyfile/nms-keyfile-writer.h b/src/settings/plugins/keyfile/nms-keyfile-writer.h
index 98ec8a6b4c..73a2e333c6 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-writer.h
+++ b/src/settings/plugins/keyfile/nms-keyfile-writer.h
@@ -15,6 +15,7 @@ typedef gboolean (*NMSKeyfileWriterAllowFilenameCb) (const char *check_filename,
 gboolean nms_keyfile_writer_connection (NMConnection *connection,
                                         gboolean is_nm_generated,
                                         gboolean is_volatile,
+                                        gboolean is_external,
                                         const char *shadowed_storage,
                                         gboolean shadowed_owned,
                                         const char *keyfile_dir,
diff --git a/src/settings/plugins/keyfile/tests/test-keyfile-settings.c b/src/settings/plugins/keyfile/tests/test-keyfile-settings.c
index d2da09da71..1a9482e5b6 100644
--- a/src/settings/plugins/keyfile/tests/test-keyfile-settings.c
+++ b/src/settings/plugins/keyfile/tests/test-keyfile-settings.c
@@ -63,6 +63,7 @@ check_ip_route (NMSettingIPConfig *config, int idx, const char *destination, int
 	                                            NULL, \
 	                                            NULL, \
 	                                            NULL, \
+	                                            NULL, \
 	                                            (nmtst_get_rand_uint32 () % 2) ? &_error : NULL); \
 	nmtst_assert_success (_connection, _error); \
 	nmtst_assert_connection_verifies_without_normalization (_connection); \