core,libnm: add VRF supportbg/vrf

Add VRF support to the daemon. When the device we are activating is a
VRF or a VRF's slave, put routes in the table specified by the VRF
connection.

Also, introduce a VRF device type in libnm.

21 files changed, 647 insertions, 3 deletions

diff --git a/Makefile.am b/Makefile.am
index a7e0495a59..ab4f8b8e3b 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -693,6 +693,8 @@ introspection_sources = \
 	introspection/org.freedesktop.NetworkManager.Device.Veth.h \
 	introspection/org.freedesktop.NetworkManager.Device.Vlan.c \
 	introspection/org.freedesktop.NetworkManager.Device.Vlan.h \
+	introspection/org.freedesktop.NetworkManager.Device.Vrf.c \
+	introspection/org.freedesktop.NetworkManager.Device.Vrf.h \
 	introspection/org.freedesktop.NetworkManager.Device.Vxlan.c \
 	introspection/org.freedesktop.NetworkManager.Device.Vxlan.h \
 	introspection/org.freedesktop.NetworkManager.Device.WiMax.c \
@@ -764,6 +766,7 @@ DBUS_INTERFACE_DOCS = \
 	docs/api/dbus-org.freedesktop.NetworkManager.Device.Tun.xml \
 	docs/api/dbus-org.freedesktop.NetworkManager.Device.Veth.xml \
 	docs/api/dbus-org.freedesktop.NetworkManager.Device.Vlan.xml \
+	docs/api/dbus-org.freedesktop.NetworkManager.Device.Vrf.xml \
 	docs/api/dbus-org.freedesktop.NetworkManager.Device.Vxlan.xml \
 	docs/api/dbus-org.freedesktop.NetworkManager.Device.WiMax.xml \
 	docs/api/dbus-org.freedesktop.NetworkManager.Device.WifiP2P.xml \
@@ -831,6 +834,7 @@ dbusinterfaces_DATA = \
 	introspection/org.freedesktop.NetworkManager.Device.Tun.xml \
 	introspection/org.freedesktop.NetworkManager.Device.Veth.xml \
 	introspection/org.freedesktop.NetworkManager.Device.Vlan.xml \
+	introspection/org.freedesktop.NetworkManager.Device.Vrf.xml \
 	introspection/org.freedesktop.NetworkManager.Device.Vxlan.xml \
 	introspection/org.freedesktop.NetworkManager.Device.WiMax.xml \
 	introspection/org.freedesktop.NetworkManager.Device.WifiP2P.xml \
@@ -1319,6 +1323,7 @@ libnm_lib_h_pub_real = \
 	libnm/nm-device-team.h \
 	libnm/nm-device-tun.h \
 	libnm/nm-device-vlan.h \
+	libnm/nm-device-vrf.h \
 	libnm/nm-device-vxlan.h \
 	libnm/nm-device-wifi-p2p.h \
 	libnm/nm-device-wifi.h \
@@ -1382,6 +1387,7 @@ libnm_lib_c_real = \
 	libnm/nm-device-team.c \
 	libnm/nm-device-tun.c \
 	libnm/nm-device-vlan.c \
+	libnm/nm-device-vrf.c \
 	libnm/nm-device-vxlan.c \
 	libnm/nm-device-wifi-p2p.c \
 	libnm/nm-device-wifi.c \
@@ -2169,6 +2175,8 @@ src_libNetworkManager_la_SOURCES = \
 	src/devices/nm-device-veth.h \
 	src/devices/nm-device-vlan.c \
 	src/devices/nm-device-vlan.h \
+	src/devices/nm-device-vrf.c \
+	src/devices/nm-device-vrf.h \
 	src/devices/nm-device-vxlan.c \
 	src/devices/nm-device-vxlan.h \
 	src/devices/nm-device-wireguard.c \
diff --git a/docs/api/network-manager-docs.xml b/docs/api/network-manager-docs.xml
index fd7a1c3ec4..883df41d78 100644
--- a/docs/api/network-manager-docs.xml
+++ b/docs/api/network-manager-docs.xml
@@ -202,6 +202,7 @@
       <xi:include href="dbus-org.freedesktop.NetworkManager.Device.Tun.xml"/>
       <xi:include href="dbus-org.freedesktop.NetworkManager.Device.Veth.xml"/>
       <xi:include href="dbus-org.freedesktop.NetworkManager.Device.Vlan.xml"/>
+      <xi:include href="dbus-org.freedesktop.NetworkManager.Device.Vrf.xml"/>
       <xi:include href="dbus-org.freedesktop.NetworkManager.Device.Vxlan.xml"/>
       <xi:include href="dbus-org.freedesktop.NetworkManager.Device.WifiP2P.xml"/>
       <xi:include href="dbus-org.freedesktop.NetworkManager.Device.WireGuard.xml"/>
diff --git a/docs/libnm/libnm-docs.xml b/docs/libnm/libnm-docs.xml
index e92f2a3117..b482207abb 100644
--- a/docs/libnm/libnm-docs.xml
+++ b/docs/libnm/libnm-docs.xml
@@ -387,6 +387,7 @@ print ("NetworkManager version " + client.get_version())]]></programlisting></in
     <xi:include href="xml/nm-device-team.xml"/>
     <xi:include href="xml/nm-device-tun.xml"/>
     <xi:include href="xml/nm-device-vlan.xml"/>
+    <xi:include href="xml/nm-device-vrf.xml"/>
     <xi:include href="xml/nm-device-vxlan.xml"/>
     <xi:include href="xml/nm-device-wifi-p2p.xml"/>
     <xi:include href="xml/nm-device-wifi.xml"/>
diff --git a/introspection/meson.build b/introspection/meson.build
index 3f8a1b1581..f25251fd78 100644
--- a/introspection/meson.build
+++ b/introspection/meson.build
@@ -33,6 +33,7 @@ ifaces = [
   'org.freedesktop.NetworkManager.Device.Tun',
   'org.freedesktop.NetworkManager.Device.Veth',
   'org.freedesktop.NetworkManager.Device.Vlan',
+  'org.freedesktop.NetworkManager.Device.Vrf',
   'org.freedesktop.NetworkManager.Device.Vxlan',
   'org.freedesktop.NetworkManager.Device.WiMax',
   'org.freedesktop.NetworkManager.Device.WifiP2P',
diff --git a/introspection/org.freedesktop.NetworkManager.Device.Vrf.xml b/introspection/org.freedesktop.NetworkManager.Device.Vrf.xml
new file mode 100644
index 0000000000..971d2b619d
--- /dev/null
+++ b/introspection/org.freedesktop.NetworkManager.Device.Vrf.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<node name="/">
+  <!--
+      org.freedesktop.NetworkManager.Device.Vrf:
+      @short_description: VRF Device
+
+  -->
+  <interface name="org.freedesktop.NetworkManager.Device.Vrf">
+
+    <!--
+        Table:
+
+        The routing table of the VRF.
+    -->
+    <property name="Table" type="u" access="read"/>
+  </interface>
+</node>
diff --git a/libnm-core/nm-dbus-interface.h b/libnm-core/nm-dbus-interface.h
index d5f17f1428..28ee89bfbe 100644
--- a/libnm-core/nm-dbus-interface.h
+++ b/libnm-core/nm-dbus-interface.h
@@ -52,6 +52,7 @@
 #define NM_DBUS_INTERFACE_DEVICE_TUN           NM_DBUS_INTERFACE_DEVICE ".Tun"
 #define NM_DBUS_INTERFACE_DEVICE_VETH          NM_DBUS_INTERFACE_DEVICE ".Veth"
 #define NM_DBUS_INTERFACE_DEVICE_VLAN          NM_DBUS_INTERFACE_DEVICE ".Vlan"
+#define NM_DBUS_INTERFACE_DEVICE_VRF           NM_DBUS_INTERFACE_DEVICE ".Vrf"
 #define NM_DBUS_INTERFACE_DEVICE_VXLAN         NM_DBUS_INTERFACE_DEVICE ".Vxlan"
 #define NM_DBUS_INTERFACE_DEVICE_WIFI_P2P      NM_DBUS_INTERFACE_DEVICE ".WifiP2P"
 #define NM_DBUS_INTERFACE_DEVICE_WIMAX         NM_DBUS_INTERFACE_DEVICE ".WiMax"
@@ -213,6 +214,7 @@ typedef enum {
  * @NM_DEVICE_TYPE_6LOWPAN: 6LoWPAN interface
  * @NM_DEVICE_TYPE_WIREGUARD: a WireGuard interface
  * @NM_DEVICE_TYPE_WIFI_P2P: an 802.11 Wi-Fi P2P device (Since: 1.16)
+ * @NM_DEVICE_TYPE_VRF: A VRF (Virtual Routing and Forwarding) interface (Since: 1.24)
  *
  * #NMDeviceType values indicate the type of hardware represented by a
  * device object.
@@ -249,6 +251,7 @@ typedef enum {
 	NM_DEVICE_TYPE_6LOWPAN       = 28,
 	NM_DEVICE_TYPE_WIREGUARD     = 29,
 	NM_DEVICE_TYPE_WIFI_P2P      = 30,
+	NM_DEVICE_TYPE_VRF           = 31,
 } NMDeviceType;
 
 /**
diff --git a/libnm/libnm.ver b/libnm/libnm.ver
index 8544fd43d7..3ff469b0c5 100644
--- a/libnm/libnm.ver
+++ b/libnm/libnm.ver
@@ -1664,6 +1664,8 @@ global:
 	nm_client_get_object_by_path;
 	nm_client_get_permissions_state;
 	nm_client_instance_flags_get_type;
+	nm_device_vrf_get_table;
+	nm_device_vrf_get_type;
 	nm_object_get_client;
 	nm_setting_vrf_get_table;
 	nm_setting_vrf_get_type;
diff --git a/libnm/meson.build b/libnm/meson.build
index 7680b9ebe0..29a21db76a 100644
--- a/libnm/meson.build
+++ b/libnm/meson.build
@@ -39,6 +39,7 @@ libnm_headers = files(
   'nm-device-team.h',
   'nm-device-tun.h',
   'nm-device-vlan.h',
+  'nm-device-vrf.h',
   'nm-device-vxlan.h',
   'nm-device-wifi-p2p.h',
   'nm-device-wifi.h',
@@ -104,6 +105,7 @@ libnm_sources = files(
   'nm-device-team.c',
   'nm-device-tun.c',
   'nm-device-vlan.c',
+  'nm-device-vrf.c',
   'nm-device-vxlan.c',
   'nm-device-wifi-p2p.c',
   'nm-device-wifi.c',
diff --git a/libnm/nm-device-vrf.c b/libnm/nm-device-vrf.c
new file mode 100644
index 0000000000..2036e16f8c
--- /dev/null
+++ b/libnm/nm-device-vrf.c
@@ -0,0 +1,145 @@
+// SPDX-License-Identifier: LGPL-2.1+
+
+#include "nm-default.h"
+
+#include "nm-device-vrf.h"
+
+#include "nm-setting-connection.h"
+#include "nm-setting-vrf.h"
+#include "nm-utils.h"
+#include "nm-object-private.h"
+
+/*****************************************************************************/
+
+NM_GOBJECT_PROPERTIES_DEFINE_BASE (
+	PROP_TABLE,
+);
+
+typedef struct {
+	guint32 table;
+} NMDeviceVrfPrivate;
+
+struct _NMDeviceVrf {
+	NMDevice parent;
+	NMDeviceVrfPrivate _priv;
+};
+
+struct _NMDeviceVrfClass {
+	NMDeviceClass parent;
+};
+
+G_DEFINE_TYPE (NMDeviceVrf, nm_device_vrf, NM_TYPE_DEVICE)
+
+#define NM_DEVICE_VRF_GET_PRIVATE(self) _NM_GET_PRIVATE(self, NMDeviceVrf, NM_IS_DEVICE_VRF, NMObject, NMDevice)
+
+/*****************************************************************************/
+
+/**
+ * nm_device_vrf_get_table:
+ * @device: a #NMDeviceVrf
+ *
+ * Returns: the device's VRF routing table.
+ *
+ * Since: 1.24
+ **/
+guint32
+nm_device_vrf_get_table (NMDeviceVrf *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_VRF (device), 0);
+
+	return NM_DEVICE_VRF_GET_PRIVATE (device)->table;
+}
+
+static gboolean
+connection_compatible (NMDevice *device, NMConnection *connection, GError **error)
+{
+	NMSettingVrf *s_vrf;
+
+	if (!NM_DEVICE_CLASS (nm_device_vrf_parent_class)->connection_compatible (device, connection, error))
+		return FALSE;
+
+	if (!nm_connection_is_type (connection, NM_SETTING_VRF_SETTING_NAME)) {
+		g_set_error_literal (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_INCOMPATIBLE_CONNECTION,
+		                     _("The connection was not a VRF connection."));
+		return FALSE;
+	}
+
+	s_vrf = (NMSettingVrf *) nm_connection_get_setting (connection, NM_TYPE_SETTING_VRF);
+	if (nm_setting_vrf_get_table (s_vrf) != nm_device_vrf_get_table (NM_DEVICE_VRF (device))) {
+		g_set_error_literal (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_INCOMPATIBLE_CONNECTION,
+		                     _("The VRF table of the device and the connection didn't match."));
+		return FALSE;
+	}
+
+	return TRUE;
+}
+
+static GType
+get_setting_type (NMDevice *device)
+{
+	return NM_TYPE_SETTING_VRF;
+}
+
+/*****************************************************************************/
+
+static void
+get_property (GObject *object,
+              guint prop_id,
+              GValue *value,
+              GParamSpec *pspec)
+{
+	NMDeviceVrf *device = NM_DEVICE_VRF (object);
+
+	switch (prop_id) {
+	case PROP_TABLE:
+		g_value_set_uint (value, nm_device_vrf_get_table (device));
+		break;
+	default:
+		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+		break;
+	}
+}
+
+static void
+nm_device_vrf_init (NMDeviceVrf *device)
+{
+}
+
+const NMLDBusMetaIface _nml_dbus_meta_iface_nm_device_vrf = NML_DBUS_META_IFACE_INIT_PROP (
+	NM_DBUS_INTERFACE_DEVICE_VRF,
+	nm_device_vrf_get_type,
+	NML_DBUS_META_INTERFACE_PRIO_INSTANTIATE_HIGH,
+	NML_DBUS_META_IFACE_DBUS_PROPERTIES (
+		NML_DBUS_META_PROPERTY_INIT_U ("Table", PROP_TABLE, NMDeviceVrf, _priv.table),
+	),
+);
+
+static void
+nm_device_vrf_class_init (NMDeviceVrfClass *klass)
+{
+	GObjectClass *object_class = G_OBJECT_CLASS (klass);
+	NMObjectClass *nm_object_class = NM_OBJECT_CLASS (klass);
+	NMDeviceClass *device_class = NM_DEVICE_CLASS (klass);
+
+	object_class->get_property = get_property;
+
+	_NM_OBJECT_CLASS_INIT_PRIV_PTR_DIRECT (nm_object_class, NMDeviceVrf);
+
+	device_class->connection_compatible = connection_compatible;
+	device_class->get_setting_type      = get_setting_type;
+
+	/**
+	 * NMDeviceVrf:table:
+	 *
+	 * The device's VRF table.
+	 *
+	 * Since: 1.24
+	 **/
+	obj_properties[PROP_TABLE] =
+	    g_param_spec_uint (NM_DEVICE_VRF_TABLE, "", "",
+	                       0, G_MAXUINT32, 0,
+	                       G_PARAM_READABLE |
+	                       G_PARAM_STATIC_STRINGS);
+
+	_nml_dbus_meta_class_init_with_properties (object_class, &_nml_dbus_meta_iface_nm_device_vrf);
+}
diff --git a/libnm/nm-device-vrf.h b/libnm/nm-device-vrf.h
new file mode 100644
index 0000000000..bf7499ca70
--- /dev/null
+++ b/libnm/nm-device-vrf.h
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: LGPL-2.1+
+
+#ifndef __NM_DEVICE_VRF_H__
+#define __NM_DEVICE_VRF_H__
+
+#if !defined (__NETWORKMANAGER_H_INSIDE__) && !defined (NETWORKMANAGER_COMPILATION)
+#error "Only <NetworkManager.h> can be included directly."
+#endif
+
+#include "nm-device.h"
+
+G_BEGIN_DECLS
+
+#define NM_TYPE_DEVICE_VRF            (nm_device_vrf_get_type ())
+#define NM_DEVICE_VRF(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), NM_TYPE_DEVICE_VRF, NMDeviceVrf))
+#define NM_DEVICE_VRF_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), NM_TYPE_DEVICE_VRF, NMDeviceVrfClass))
+#define NM_IS_DEVICE_VRF(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), NM_TYPE_DEVICE_VRF))
+#define NM_IS_DEVICE_VRF_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), NM_TYPE_DEVICE_VRF))
+#define NM_DEVICE_VRF_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), NM_TYPE_DEVICE_VRF, NMDeviceVrfClass))
+
+#define NM_DEVICE_VRF_TABLE         "table"
+
+/**
+ * NMDeviceVrf:
+ */
+typedef struct _NMDeviceVrfClass NMDeviceVrfClass;
+
+NM_AVAILABLE_IN_1_24
+GType nm_device_vrf_get_type (void);
+NM_AVAILABLE_IN_1_24
+guint32      nm_device_vrf_get_table (NMDeviceVrf *device);
+
+G_END_DECLS
+
+#endif /* __NM_DEVICE_VRF_H__ */
diff --git a/libnm/nm-device.c b/libnm/nm-device.c
index ade67b0474..77b7da6b09 100644
--- a/libnm/nm-device.c
+++ b/libnm/nm-device.c
@@ -296,6 +296,7 @@ coerce_type (NMDeviceType type)
 	case NM_DEVICE_TYPE_6LOWPAN:
 	case NM_DEVICE_TYPE_WIREGUARD:
 	case NM_DEVICE_TYPE_WIFI_P2P:
+	case NM_DEVICE_TYPE_VRF:
 		return type;
 	}
 	return NM_DEVICE_TYPE_UNKNOWN;
@@ -1505,6 +1506,8 @@ get_type_name (NMDevice *device)
 		return _("WireGuard");
 	case NM_DEVICE_TYPE_WIFI_P2P:
 		return _("Wi-Fi P2P");
+	case NM_DEVICE_TYPE_VRF:
+		return _("VRF");
 	case NM_DEVICE_TYPE_GENERIC:
 	case NM_DEVICE_TYPE_UNUSED1:
 	case NM_DEVICE_TYPE_UNUSED2:
diff --git a/libnm/nm-libnm-utils.c b/libnm/nm-libnm-utils.c
index 5f78f264f2..f04a7419f5 100644
--- a/libnm/nm-libnm-utils.c
+++ b/libnm/nm-libnm-utils.c
@@ -694,6 +694,7 @@ const NMLDBusMetaIface *const _nml_dbus_meta_ifaces[] = {
 	&_nml_dbus_meta_iface_nm_device_tun,
 	&_nml_dbus_meta_iface_nm_device_veth,
 	&_nml_dbus_meta_iface_nm_device_vlan,
+	&_nml_dbus_meta_iface_nm_device_vrf,
 	&_nml_dbus_meta_iface_nm_device_vxlan,
 	&_nml_dbus_meta_iface_nm_device_wifip2p,
 	&_nml_dbus_meta_iface_nm_device_wireguard,
diff --git a/libnm/nm-libnm-utils.h b/libnm/nm-libnm-utils.h
index db6f55ec0e..ec9f23ba8e 100644
--- a/libnm/nm-libnm-utils.h
+++ b/libnm/nm-libnm-utils.h
@@ -505,7 +505,7 @@ struct _NMLDBusMetaIface {
 	NML_DBUS_META_IFACE_INIT (__VA_ARGS__ \
 	                          NML_DBUS_META_IFACE_OBJ_PROPERTIES ())
 
-extern const NMLDBusMetaIface *const _nml_dbus_meta_ifaces[43];
+extern const NMLDBusMetaIface *const _nml_dbus_meta_ifaces[44];
 
 extern const NMLDBusMetaIface _nml_dbus_meta_iface_nm;
 extern const NMLDBusMetaIface _nml_dbus_meta_iface_nm_accesspoint;
@@ -535,6 +535,7 @@ extern const NMLDBusMetaIface _nml_dbus_meta_iface_nm_device_team;
 extern const NMLDBusMetaIface _nml_dbus_meta_iface_nm_device_tun;
 extern const NMLDBusMetaIface _nml_dbus_meta_iface_nm_device_veth;
 extern const NMLDBusMetaIface _nml_dbus_meta_iface_nm_device_vlan;
+extern const NMLDBusMetaIface _nml_dbus_meta_iface_nm_device_vrf;
 extern const NMLDBusMetaIface _nml_dbus_meta_iface_nm_device_vxlan;
 extern const NMLDBusMetaIface _nml_dbus_meta_iface_nm_device_wifip2p;
 extern const NMLDBusMetaIface _nml_dbus_meta_iface_nm_device_wired;
diff --git a/libnm/nm-types.h b/libnm/nm-types.h
index 11e9f05570..d390e61a3b 100644
--- a/libnm/nm-types.h
+++ b/libnm/nm-types.h
@@ -37,6 +37,7 @@ typedef struct _NMDevicePpp          NMDevicePpp;
 typedef struct _NMDeviceTeam         NMDeviceTeam;
 typedef struct _NMDeviceTun          NMDeviceTun;
 typedef struct _NMDeviceVlan         NMDeviceVlan;
+typedef struct _NMDeviceVrf          NMDeviceVrf;
 typedef struct _NMDeviceVxlan        NMDeviceVxlan;
 typedef struct _NMDeviceWifi         NMDeviceWifi;
 typedef struct _NMDeviceWifiP2P      NMDeviceWifiP2P;
diff --git a/po/POTFILES.in b/po/POTFILES.in
index d09909f8a4..9379fae271 100644
--- a/po/POTFILES.in
+++ b/po/POTFILES.in
@@ -125,6 +125,7 @@ libnm/nm-device-ovs-port.c
 libnm/nm-device-team.c
 libnm/nm-device-tun.c
 libnm/nm-device-vlan.c
+libnm/nm-device-vrf.c
 libnm/nm-device-vxlan.c
 libnm/nm-device-wifi-p2p.c
 libnm/nm-device-wifi.c
@@ -161,6 +162,7 @@ src/devices/nm-device-ip-tunnel.c
 src/devices/nm-device-macvlan.c
 src/devices/nm-device-tun.c
 src/devices/nm-device-vlan.c
+src/devices/nm-device-vrf.c
 src/devices/nm-device-vxlan.c
 src/devices/nm-device-wpan.c
 src/devices/team/nm-device-team.c
diff --git a/src/devices/nm-device-bond.c b/src/devices/nm-device-bond.c
index c6ecb2e85f..08a288601e 100644
--- a/src/devices/nm-device-bond.c
+++ b/src/devices/nm-device-bond.c
@@ -414,7 +414,7 @@ release_slave (NMDevice *device,
 	ifindex_slave = nm_device_get_ip_ifindex (slave);
 
 	if (ifindex_slave <= 0)
-		_LOGD (LOGD_TEAM, "bond slave %s is already released", nm_device_get_ip_iface (slave));
+		_LOGD (LOGD_BOND, "bond slave %s is already released", nm_device_get_ip_iface (slave));
 
 	if (configure) {
 		/* When the last slave is released the bond MAC will be set to a random
diff --git a/src/devices/nm-device-factory.c b/src/devices/nm-device-factory.c
index 232e69ef2c..0046785056 100644
--- a/src/devices/nm-device-factory.c
+++ b/src/devices/nm-device-factory.c
@@ -393,6 +393,7 @@ nm_device_factory_manager_load_factories (NMDeviceFactoryManagerFactoryFunc call
 	_ADD_INTERNAL (nm_tun_device_factory_get_type);
 	_ADD_INTERNAL (nm_veth_device_factory_get_type);
 	_ADD_INTERNAL (nm_vlan_device_factory_get_type);
+	_ADD_INTERNAL (nm_vrf_device_factory_get_type);
 	_ADD_INTERNAL (nm_vxlan_device_factory_get_type);
 	_ADD_INTERNAL (nm_wireguard_device_factory_get_type);
 	_ADD_INTERNAL (nm_wpan_device_factory_get_type);
diff --git a/src/devices/nm-device-vrf.c b/src/devices/nm-device-vrf.c
new file mode 100644
index 0000000000..11caedf46c
--- /dev/null
+++ b/src/devices/nm-device-vrf.c
@@ -0,0 +1,371 @@
+// SPDX-License-Identifier: LGPL-2.1+
+
+#include "nm-default.h"
+
+#include "nm-device-vrf.h"
+
+#include "nm-core-internal.h"
+#include "nm-device-factory.h"
+#include "nm-device-private.h"
+#include "nm-manager.h"
+#include "nm-setting-vrf.h"
+#include "platform/nm-platform.h"
+#include "settings/nm-settings.h"
+
+#include "nm-device-logging.h"
+_LOG_DECLARE_SELF(NMDeviceVrf);
+
+/*****************************************************************************/
+
+NM_GOBJECT_PROPERTIES_DEFINE (NMDeviceVrf,
+	PROP_TABLE,
+);
+
+typedef struct {
+	NMPlatformLnkVrf props;
+} NMDeviceVrfPrivate;
+
+struct _NMDeviceVrf {
+	NMDevice parent;
+	NMDeviceVrfPrivate _priv;
+};
+
+struct _NMDeviceVrfClass {
+	NMDeviceClass parent;
+};
+
+G_DEFINE_TYPE (NMDeviceVrf, nm_device_vrf, NM_TYPE_DEVICE)
+
+#define NM_DEVICE_VRF_GET_PRIVATE(self) _NM_GET_PRIVATE (self, NMDeviceVrf, NM_IS_DEVICE_VRF, NMDevice)
+
+/*****************************************************************************/
+
+static void
+do_update_properties (NMDeviceVrf *self, const NMPlatformLnkVrf *props)
+{
+	NMDeviceVrfPrivate *priv = NM_DEVICE_VRF_GET_PRIVATE (self);
+	GObject *object = G_OBJECT (self);
+	NMPlatformLnkVrf props_null;
+
+	if (!props) {
+		props_null = (NMPlatformLnkVrf) { };
+		props = &props_null;
+	}
+
+	g_object_freeze_notify (object);
+
+#define CHECK_PROPERTY_CHANGED(field, prop) \
+	G_STMT_START { \
+		if (priv->props.field != props->field) { \
+			priv->props.field = props->field; \
+			_notify (self, prop); \
+		} \
+	} G_STMT_END
+
+	CHECK_PROPERTY_CHANGED (table, PROP_TABLE);
+
+	g_object_thaw_notify (object);
+}
+
+static void
+update_properties (NMDevice *device)
+{
+	NMDeviceVrf *self = NM_DEVICE_VRF (device);
+	const NMPlatformLnkVrf *props;
+
+	props = nm_platform_link_get_lnk_vrf (nm_device_get_platform (device), nm_device_get_ifindex (device), NULL);
+	if (!props) {
+		_LOGW (LOGD_PLATFORM, "could not get vrf properties");
+		return;
+	}
+
+	do_update_properties (self, props);
+}
+
+static NMDeviceCapabilities
+get_generic_capabilities (NMDevice *dev)
+{
+	return NM_DEVICE_CAP_IS_SOFTWARE;
+}
+
+static void
+link_changed (NMDevice *device,
+              const NMPlatformLink *pllink)
+{
+	NM_DEVICE_CLASS (nm_device_vrf_parent_class)->link_changed (device, pllink);
+	update_properties (device);
+}
+
+static void
+unrealize_notify (NMDevice *device)
+{
+	NMDeviceVrf *self = NM_DEVICE_VRF (device);
+
+	NM_DEVICE_CLASS (nm_device_vrf_parent_class)->unrealize_notify (device);
+
+	do_update_properties (self, NULL);
+}
+
+static gboolean
+create_and_realize (NMDevice *device,
+                    NMConnection *connection,
+                    NMDevice *parent,
+                    const NMPlatformLink **out_plink,
+                    GError **error)
+{
+	const char *iface = nm_device_get_iface (device);
+	NMPlatformLnkVrf props = { };
+	NMSettingVrf *s_vrf;
+	int r;
+
+	s_vrf = _nm_connection_get_setting (connection, NM_TYPE_SETTING_VRF);
+	nm_assert (s_vrf);
+
+	props.table = nm_setting_vrf_get_table (s_vrf);
+
+	r = nm_platform_link_vrf_add (nm_device_get_platform (device), iface, &props, out_plink);
+	if (r < 0) {
+		g_set_error (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_CREATION_FAILED,
+		             "Failed to create VRF interface '%s' for '%s': %s",
+		             iface,
+		             nm_connection_get_id (connection),
+		             nm_strerror (r));
+		return FALSE;
+	}
+
+	return TRUE;
+}
+
+static gboolean
+check_connection_compatible (NMDevice *device, NMConnection *connection, GError **error)
+{
+	NMDeviceVrfPrivate *priv = NM_DEVICE_VRF_GET_PRIVATE (device);
+	NMSettingVrf *s_vrf;
+
+	if (!NM_DEVICE_CLASS (nm_device_vrf_parent_class)->check_connection_compatible (device, connection, error))
+		return FALSE;
+
+	if (nm_device_is_real (device)) {
+		s_vrf = _nm_connection_get_setting (connection, NM_TYPE_SETTING_VRF);
+
+		if (priv->props.table != nm_setting_vrf_get_table (s_vrf)) {
+			nm_utils_error_set_literal (error, NM_UTILS_ERROR_CONNECTION_AVAILABLE_TEMPORARY,
+			                            "vrf table mismatches");
+			return FALSE;
+		}
+	}
+
+	return TRUE;
+}
+
+static gboolean
+complete_connection (NMDevice *device,
+                     NMConnection *connection,
+                     const char *specific_object,
+                     NMConnection *const*existing_connections,
+                     GError **error)
+{
+	NMSettingVrf *s_vrf;
+
+	nm_utils_complete_generic (nm_device_get_platform (device),
+	                           connection,
+	                           NM_SETTING_VRF_SETTING_NAME,
+	                           existing_connections,
+	                           NULL,
+	                           _("VRF connection"),
+	                           NULL,
+	                           NULL,
+	                           TRUE);
+
+	s_vrf = _nm_connection_get_setting (connection, NM_TYPE_SETTING_VRF);
+	if (!s_vrf) {
+		g_set_error_literal (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_INVALID_CONNECTION,
+		                     "A 'vrf' setting is required.");
+		return FALSE;
+	}
+
+	return TRUE;
+}
+
+static void
+update_connection (NMDevice *device, NMConnection *connection)
+{
+	NMDeviceVrfPrivate *priv = NM_DEVICE_VRF_GET_PRIVATE (device);
+	NMSettingVrf *s_vrf = _nm_connection_get_setting (connection, NM_TYPE_SETTING_VRF);
+
+	if (!s_vrf) {
+		s_vrf = (NMSettingVrf *) nm_setting_vrf_new ();
+		nm_connection_add_setting (connection, (NMSetting *) s_vrf);
+	}
+
+	if (priv->props.table != nm_setting_vrf_get_table (s_vrf))
+		g_object_set (G_OBJECT (s_vrf), NM_SETTING_VRF_TABLE, priv->props.table, NULL);
+}
+
+static gboolean
+enslave_slave (NMDevice *device,
+               NMDevice *slave,
+               NMConnection *connection,
+               gboolean configure)
+{
+	NMDeviceVrf *self = NM_DEVICE_VRF (device);
+	gboolean success = TRUE;
+	const char *slave_iface = nm_device_get_ip_iface (slave);
+
+	nm_device_master_check_slave_physical_port (device, slave, LOGD_DEVICE);
+
+	if (configure) {
+		nm_device_take_down (slave, TRUE);
+		success = nm_platform_link_enslave (nm_device_get_platform (device),
+		                                    nm_device_get_ip_ifindex (device),
+		                                    nm_device_get_ip_ifindex (slave));
+		nm_device_bring_up (slave, TRUE, NULL);
+
+		if (!success)
+			return FALSE;
+
+		_LOGI (LOGD_DEVICE, "enslaved VRF slave %s", slave_iface);
+	} else
+		_LOGI (LOGD_BOND, "VRF slave %s was enslaved", slave_iface);
+
+	return TRUE;
+}
+
+static void
+release_slave (NMDevice *device,
+               NMDevice *slave,
+               gboolean configure)
+{
+	NMDeviceVrf *self = NM_DEVICE_VRF (device);
+	gboolean success;
+	int ifindex_slave;
+	int ifindex;
+
+	if (configure) {
+		ifindex = nm_device_get_ifindex (device);
+		if (   ifindex <= 0
+		    || !nm_platform_link_get (nm_device_get_platform (device), ifindex))
+			configure = FALSE;
+	}
+
+	ifindex_slave = nm_device_get_ip_ifindex (slave);
+
+	if (ifindex_slave <= 0)
+		_LOGD (LOGD_DEVICE, "VRF slave %s is already released", nm_device_get_ip_iface (slave));
+
+	if (configure) {
+		if (ifindex_slave > 0) {
+			success = nm_platform_link_release (nm_device_get_platform (device),
+			                                    nm_device_get_ip_ifindex (device),
+			                                    ifindex_slave);
+
+			if (success) {
+				_LOGI (LOGD_DEVICE, "released VRF slave %s",
+				       nm_device_get_ip_iface (slave));
+			} else {
+				_LOGW (LOGD_DEVICE, "failed to release VRF slave %s",
+				       nm_device_get_ip_iface (slave));
+			}
+		}
+	} else {
+		if (ifindex_slave > 0) {
+			_LOGI (LOGD_DEVICE, "VRF slave %s was released",
+			       nm_device_get_ip_iface (slave));
+		}
+	}
+}
+
+/*****************************************************************************/
+
+static void
+get_property (GObject *object, guint prop_id,
+              GValue *value, GParamSpec *pspec)
+{
+	NMDeviceVrfPrivate *priv = NM_DEVICE_VRF_GET_PRIVATE (object);
+
+	switch (prop_id) {
+	case PROP_TABLE:
+		g_value_set_uint (value, priv->props.table);
+		break;
+	default:
+		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+		break;
+	}
+}
+
+/*****************************************************************************/
+
+static void
+nm_device_vrf_init (NMDeviceVrf *self)
+{
+}
+
+static const NMDBusInterfaceInfoExtended interface_info_device_vrf = {
+	.parent = NM_DEFINE_GDBUS_INTERFACE_INFO_INIT (
+		NM_DBUS_INTERFACE_DEVICE_VRF,
+		.properties = NM_DEFINE_GDBUS_PROPERTY_INFOS (
+			NM_DEFINE_DBUS_PROPERTY_INFO_EXTENDED_READABLE ("Table", "u", NM_DEVICE_VRF_TABLE),
+		),
+	),
+};
+
+static void
+nm_device_vrf_class_init (NMDeviceVrfClass *klass)
+{
+	GObjectClass *object_class = G_OBJECT_CLASS (klass);
+	NMDBusObjectClass *dbus_object_class = NM_DBUS_OBJECT_CLASS (klass);
+	NMDeviceClass *device_class = NM_DEVICE_CLASS (klass);
+
+	object_class->get_property = get_property;
+
+	dbus_object_class->interface_infos = NM_DBUS_INTERFACE_INFOS (&interface_info_device_vrf);
+
+	device_class->connection_type_supported = NM_SETTING_VRF_SETTING_NAME;
+	device_class->connection_type_check_compatible = NM_SETTING_VRF_SETTING_NAME;
+	device_class->is_master = TRUE;
+	device_class->link_types = NM_DEVICE_DEFINE_LINK_TYPES (NM_LINK_TYPE_VRF);
+
+	device_class->enslave_slave = enslave_slave;
+	device_class->release_slave = release_slave;
+	device_class->link_changed = link_changed;
+	device_class->unrealize_notify = unrealize_notify;
+	device_class->create_and_realize = create_and_realize;
+	device_class->check_connection_compatible = check_connection_compatible;
+	device_class->complete_connection = complete_connection;
+	device_class->get_generic_capabilities = get_generic_capabilities;
+	device_class->update_connection = update_connection;
+
+	obj_properties[PROP_TABLE] =
+	     g_param_spec_uint (NM_DEVICE_VRF_TABLE, "", "",
+	                        0, G_MAXUINT32, 0,
+	                        G_PARAM_READABLE |
+	                        G_PARAM_STATIC_STRINGS);
+
+	g_object_class_install_properties (object_class, _PROPERTY_ENUMS_LAST, obj_properties);
+}
+
+/*****************************************************************************/
+
+#define NM_TYPE_VRF_DEVICE_FACTORY (nm_vrf_device_factory_get_type ())
+#define NM_VRF_DEVICE_FACTORY(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), NM_TYPE_VRF_DEVICE_FACTORY, NMVrfDeviceFactory))
+
+static NMDevice *
+create_device (NMDeviceFactory *factory,
+               const char *iface,
+               const NMPlatformLink *plink,
+               NMConnection *connection,
+               gboolean *out_ignore)
+{
+	return g_object_new (NM_TYPE_DEVICE_VRF,
+	                     NM_DEVICE_IFACE, iface,
+	                     NM_DEVICE_TYPE_DESC, "Vrf",
+	                     NM_DEVICE_DEVICE_TYPE, NM_DEVICE_TYPE_VRF,
+	                     NM_DEVICE_LINK_TYPE, NM_LINK_TYPE_VRF,
+	                     NULL);
+}
+
+NM_DEVICE_FACTORY_DEFINE_INTERNAL (VRF, Vrf, vrf,
+	NM_DEVICE_FACTORY_DECLARE_LINK_TYPES (NM_LINK_TYPE_VRF)
+	NM_DEVICE_FACTORY_DECLARE_SETTING_TYPES (NM_SETTING_VRF_SETTING_NAME),
+	factory_class->create_device = create_device;
+);
diff --git a/src/devices/nm-device-vrf.h b/src/devices/nm-device-vrf.h
new file mode 100644
index 0000000000..b5f3ec6563
--- /dev/null
+++ b/src/devices/nm-device-vrf.h
@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: LGPL-2.1+
+
+#ifndef __NETWORKMANAGER_DEVICE_VRF_H__
+#define __NETWORKMANAGER_DEVICE_VRF_H__
+
+#include "nm-device-generic.h"
+
+#define NM_TYPE_DEVICE_VRF            (nm_device_vrf_get_type ())
+#define NM_DEVICE_VRF(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), NM_TYPE_DEVICE_VRF, NMDeviceVrf))
+#define NM_DEVICE_VRF_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass),  NM_TYPE_DEVICE_VRF, NMDeviceVrfClass))
+#define NM_IS_DEVICE_VRF(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), NM_TYPE_DEVICE_VRF))
+#define NM_IS_DEVICE_VRF_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass),  NM_TYPE_DEVICE_VRF))
+#define NM_DEVICE_VRF_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj),  NM_TYPE_DEVICE_VRF, NMDeviceVrfClass))
+
+#define NM_DEVICE_VRF_TABLE          "table"
+
+typedef struct _NMDeviceVrf NMDeviceVrf;
+typedef struct _NMDeviceVrfClass NMDeviceVrfClass;
+
+GType nm_device_vrf_get_type (void);
+
+#endif /* __NETWORKMANAGER_DEVICE_VRF_H__ */
diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
index 3898d1565a..22ab17c8fb 100644
--- a/src/devices/nm-device.c
+++ b/src/devices/nm-device.c
@@ -2109,6 +2109,8 @@ nm_device_get_route_metric_default (NMDeviceType device_type)
 		return 450;
 	case NM_DEVICE_TYPE_PPP:
 		return 460;
+	case NM_DEVICE_TYPE_VRF:
+		return 470;
 	case NM_DEVICE_TYPE_VXLAN:
 		return 500;
 	case NM_DEVICE_TYPE_DUMMY:
@@ -2274,6 +2276,8 @@ _get_route_table (NMDevice *self,
 	NMSettingIPConfig *s_ip;
 	guint32 route_table = 0;
 	gboolean is_user_config = TRUE;
+	NMSettingConnection *s_con;
+	NMSettingVrf *s_vrf;
 
 	nm_assert_addr_family (addr_family);
 
@@ -2310,6 +2314,28 @@ _get_route_table (NMDevice *self,
 		}
 	}
 
+	if (   route_table == 0u
+	    && connection
+	    && (s_con = nm_connection_get_setting_connection (connection))
+	    && (nm_streq0 (nm_setting_connection_get_slave_type (s_con), NM_SETTING_VRF_SETTING_NAME)
+	    && priv->master
+	    && nm_device_get_device_type (priv->master) == NM_DEVICE_TYPE_VRF)) {
+		const NMPlatformLnkVrf *lnk;
+
+		lnk = nm_platform_link_get_lnk_vrf (nm_device_get_platform (self),
+		                                    nm_device_get_ifindex (priv->master),
+		                                    NULL);
+
+		if (lnk)
+			route_table = lnk->table;
+	}
+
+	if (   route_table == 0u
+	    && connection
+	    && (s_vrf = (NMSettingVrf *) nm_connection_get_setting (connection, NM_TYPE_SETTING_VRF))) {
+		route_table = nm_setting_vrf_get_table (s_vrf);
+	}
+
 	klass = NM_DEVICE_GET_CLASS (self);
 	if (klass->coerce_route_table)
 		route_table = klass->coerce_route_table (self, addr_family, route_table, is_user_config);
@@ -17152,7 +17178,7 @@ set_property (GObject *object, guint prop_id,
 		nm_assert (priv->type == NM_DEVICE_TYPE_UNKNOWN);
 		priv->type = g_value_get_uint (value);
 		nm_assert (priv->type > NM_DEVICE_TYPE_UNKNOWN);
-		nm_assert (priv->type <= NM_DEVICE_TYPE_WIFI_P2P);
+		nm_assert (priv->type <= NM_DEVICE_TYPE_VRF);
 		break;
 	case PROP_LINK_TYPE:
 		/* construct-only */
diff --git a/src/meson.build b/src/meson.build
index 47acb4a686..bc816a8543 100644
--- a/src/meson.build
+++ b/src/meson.build
@@ -87,6 +87,7 @@ sources = files(
   'devices/nm-device-tun.c',
   'devices/nm-device-veth.c',
   'devices/nm-device-vlan.c',
+  'devices/nm-device-vrf.c',
   'devices/nm-device-vxlan.c',
   'devices/nm-device-wireguard.c',
   'devices/nm-device-wpan.c',