core: switch to use *_get_live_connection()

Especially, refactor find_master() in NMManager not to
return an NMConnection master, if a master device was found. The reason
is, that now we also have the applied connection which makes it
confusing to know which one was returned.

Signed-off-by: Thomas Haller <thaller@redhat.com>

15 files changed, 222 insertions, 156 deletions

diff --git a/src/devices/nm-device-adsl.c b/src/devices/nm-device-adsl.c
index 02acd66977..37cdfdcac6 100644
--- a/src/devices/nm-device-adsl.c
+++ b/src/devices/nm-device-adsl.c
@@ -348,7 +348,7 @@ act_stage2_config (NMDevice *device, NMDeviceStateReason *out_reason)
 
 	g_assert (out_reason);
 
-	s_adsl = nm_connection_get_setting_adsl (nm_device_get_connection (device));
+	s_adsl = nm_connection_get_setting_adsl (nm_device_get_applied_connection (device));
 	g_assert (s_adsl);
 
 	protocol = nm_setting_adsl_get_protocol (s_adsl);
@@ -442,8 +442,8 @@ act_stage3_ip4_config_start (NMDevice *device,
 	req = nm_device_get_act_request (device);
 	g_assert (req);
 
-	connection = nm_act_request_get_connection (req);
-	g_assert (req);
+	connection = nm_act_request_get_applied_connection (req);
+	g_assert (connection);
 
 	s_adsl = nm_connection_get_setting_adsl (connection);
 	g_assert (s_adsl);
diff --git a/src/devices/nm-device-bond.c b/src/devices/nm-device-bond.c
index 8d9939b096..dcf315acdb 100644
--- a/src/devices/nm-device-bond.c
+++ b/src/devices/nm-device-bond.c
@@ -310,7 +310,7 @@ apply_bonding_config (NMDevice *device)
 	 *     arp_interval doesn't require miimon to be 0
 	 */
 
-	connection = nm_device_get_connection (device);
+	connection = nm_device_get_applied_connection (device);
 	g_assert (connection);
 	s_bond = nm_connection_get_setting_bond (connection);
 	g_assert (s_bond);
@@ -415,7 +415,6 @@ act_stage1_prepare (NMDevice *dev, NMDeviceStateReason *reason)
 static gboolean
 enslave_slave (NMDevice *device,
                NMDevice *slave,
-               NMConnection *connection,
                gboolean configure)
 {
 	gboolean success = TRUE, no_firmware = FALSE;
diff --git a/src/devices/nm-device-bridge.c b/src/devices/nm-device-bridge.c
index 92cc9f2a77..69c33431f6 100644
--- a/src/devices/nm-device-bridge.c
+++ b/src/devices/nm-device-bridge.c
@@ -362,7 +362,7 @@ static NMActStageReturn
 act_stage1_prepare (NMDevice *device, NMDeviceStateReason *reason)
 {
 	NMActStageReturn ret;
-	NMConnection *connection = nm_device_get_connection (device);
+	NMConnection *connection = nm_device_get_applied_connection (device);
 
 	g_assert (connection);
 
@@ -378,13 +378,15 @@ act_stage1_prepare (NMDevice *device, NMDeviceStateReason *reason)
 static gboolean
 enslave_slave (NMDevice *device,
                NMDevice *slave,
-               NMConnection *connection,
                gboolean configure)
 {
+	NMConnection *connection;
+
 	if (configure) {
 		if (!nm_platform_link_enslave (nm_device_get_ip_ifindex (device), nm_device_get_ip_ifindex (slave)))
 			return FALSE;
 
+		connection = nm_device_get_applied_connection (slave);
 		commit_slave_options (slave, nm_connection_get_setting_bridge_port (connection));
 	}
 
diff --git a/src/devices/nm-device-bt.c b/src/devices/nm-device-bt.c
index e22c96eee3..d90bb4bf38 100644
--- a/src/devices/nm-device-bt.c
+++ b/src/devices/nm-device-bt.c
@@ -812,7 +812,7 @@ act_stage2_config (NMDevice *device, NMDeviceStateReason *reason)
 	NMDeviceBtPrivate *priv = NM_DEVICE_BT_GET_PRIVATE (device);
 	NMConnection *connection;
 
-	connection = nm_device_get_connection (device);
+	connection = nm_device_get_applied_connection (device);
 	g_assert (connection);
 	priv->bt_type = get_connection_bt_type (connection);
 	if (priv->bt_type == NM_BT_CAPABILITY_NONE) {
diff --git a/src/devices/nm-device-ethernet.c b/src/devices/nm-device-ethernet.c
index a6279a4cb5..1fb2c5f91c 100644
--- a/src/devices/nm-device-ethernet.c
+++ b/src/devices/nm-device-ethernet.c
@@ -653,6 +653,7 @@ build_supplicant_config (NMDeviceEthernet *self)
 	NMSetting8021x *security;
 	NMConnection *connection;
 
+	/* FIXME: use applied connection */
 	connection = nm_device_get_connection (NM_DEVICE (self));
 	g_assert (connection);
 	con_uuid = nm_connection_get_uuid (connection);
@@ -977,6 +978,7 @@ nm_8021x_stage2_config (NMDeviceEthernet *self, NMDeviceStateReason *reason)
 	const char *iface;
 	NMActStageReturn ret = NM_ACT_STAGE_RETURN_FAILURE;
 
+	/* FIXME: use applied connection */
 	connection = nm_device_get_connection (NM_DEVICE (self));
 	g_assert (connection);
 	security = nm_connection_get_setting_802_1x (connection);
@@ -1167,7 +1169,7 @@ ip4_config_pre_commit (NMDevice *device, NMIP4Config *config)
 	if (NM_DEVICE_ETHERNET_GET_PRIVATE (device)->ppp_manager)
 		return;
 
-	connection = nm_device_get_connection (device);
+	connection = nm_device_get_applied_connection (device);
 	g_assert (connection);
 	s_wired = nm_connection_get_setting_wired (connection);
 	g_assert (s_wired);
diff --git a/src/devices/nm-device-infiniband.c b/src/devices/nm-device-infiniband.c
index be79094c07..4d2c96bb13 100644
--- a/src/devices/nm-device-infiniband.c
+++ b/src/devices/nm-device-infiniband.c
@@ -198,7 +198,7 @@ ip4_config_pre_commit (NMDevice *self, NMIP4Config *config)
 	NMSettingInfiniband *s_infiniband;
 	guint32 mtu;
 
-	connection = nm_device_get_connection (self);
+	connection = nm_device_get_applied_connection (self);
 	g_assert (connection);
 	s_infiniband = nm_connection_get_setting_infiniband (connection);
 	g_assert (s_infiniband);
diff --git a/src/devices/nm-device-olpc-mesh.c b/src/devices/nm-device-olpc-mesh.c
index c419daa5e7..2da7d3af56 100644
--- a/src/devices/nm-device-olpc-mesh.c
+++ b/src/devices/nm-device-olpc-mesh.c
@@ -306,7 +306,7 @@ act_stage2_config (NMDevice *dev, NMDeviceStateReason *reason)
 	const GByteArray *anycast_addr_array;
 	guint8 *anycast_addr = NULL;
 
-	connection = nm_device_get_connection (dev);
+	connection = nm_device_get_applied_connection (dev);
 	g_assert (connection);
 
 	s_mesh = nm_connection_get_setting_olpc_mesh (connection);
diff --git a/src/devices/nm-device-team.c b/src/devices/nm-device-team.c
index df37cee308..f66b29e764 100644
--- a/src/devices/nm-device-team.c
+++ b/src/devices/nm-device-team.c
@@ -618,7 +618,7 @@ act_stage1_prepare (NMDevice *dev, NMDeviceStateReason *reason)
 
 	ret = NM_DEVICE_CLASS (nm_device_team_parent_class)->act_stage1_prepare (dev, reason);
 	if (ret == NM_ACT_STAGE_RETURN_SUCCESS) {
-		connection = nm_device_get_connection (dev);
+		connection = nm_device_get_applied_connection (dev);
 		g_assert (connection);
 		s_team = nm_connection_get_setting_team (connection);
 		g_assert (s_team);
@@ -641,7 +641,6 @@ deactivate (NMDevice *dev)
 static gboolean
 enslave_slave (NMDevice *device,
                NMDevice *slave,
-               NMConnection *connection,
                gboolean configure)
 {
 #if WITH_TEAMDCTL
@@ -651,12 +650,14 @@ enslave_slave (NMDevice *device,
 	const char *iface = nm_device_get_ip_iface (device);
 	const char *slave_iface = nm_device_get_ip_iface (slave);
 	NMSettingTeamPort *s_team_port;
+	NMConnection *connection;
 
 	nm_device_master_check_slave_physical_port (device, slave, LOGD_TEAM);
 
 	if (configure) {
 		nm_device_take_down (slave, TRUE);
 
+		connection = nm_device_get_applied_connection (slave);
 		s_team_port = nm_connection_get_setting_team_port (connection);
 		if (s_team_port) {
 			const char *config = nm_setting_team_port_get_config (s_team_port);
diff --git a/src/devices/nm-device-vlan.c b/src/devices/nm-device-vlan.c
index f64fd87eb7..bdae7642c1 100644
--- a/src/devices/nm-device-vlan.c
+++ b/src/devices/nm-device-vlan.c
@@ -411,7 +411,7 @@ ip4_config_pre_commit (NMDevice *device, NMIP4Config *config)
 	NMSettingWired *s_wired;
 	guint32 mtu;
 
-	connection = nm_device_get_connection (device);
+	connection = nm_device_get_applied_connection (device);
 	g_assert (connection);
 
 	s_wired = nm_connection_get_setting_wired (connection);
diff --git a/src/devices/nm-device-wifi.c b/src/devices/nm-device-wifi.c
index fe4c7e0f91..3b81a59f40 100644
--- a/src/devices/nm-device-wifi.c
+++ b/src/devices/nm-device-wifi.c
@@ -2162,6 +2162,7 @@ need_new_8021x_secrets (NMDeviceWifi *self,
 
 	g_assert (setting_name != NULL);
 
+	/* FIXME: use applied connection */
 	connection = nm_device_get_connection (NM_DEVICE (self));
 	g_return_val_if_fail (connection != NULL, FALSE);
 
@@ -2213,7 +2214,8 @@ need_new_wpa_psk (NMDeviceWifi *self,
 
 	g_assert (setting_name != NULL);
 
-	connection = nm_device_get_connection (NM_DEVICE (self));
+	/* FIXME: use applied connection */
+	connection = nm_device_get_applied_connection (NM_DEVICE (self));
 	g_return_val_if_fail (connection != NULL, FALSE);
 
 	/* A bad PSK will cause the supplicant to disconnect during the 4-way handshake */
@@ -2343,7 +2345,7 @@ supplicant_iface_state_cb (NMSupplicantInterface *iface,
 			NMSettingWireless *s_wifi;
 			const GByteArray *ssid;
 
-			connection = nm_device_get_connection (NM_DEVICE (self));
+			connection = nm_device_get_applied_connection (NM_DEVICE (self));
 			g_return_if_fail (connection);
 
 			s_wifi = nm_connection_get_setting_wireless (connection);
@@ -3069,7 +3071,7 @@ act_stage3_ip4_config_start (NMDevice *device,
 	NMSettingIP4Config *s_ip4;
 	const char *method = NM_SETTING_IP4_CONFIG_METHOD_AUTO;
 
-	connection = nm_device_get_connection (device);
+	connection = nm_device_get_applied_connection (device);
 	g_assert (connection);
 	s_ip4 = nm_connection_get_setting_ip4_config (connection);
 	if (s_ip4)
@@ -3092,7 +3094,7 @@ act_stage3_ip6_config_start (NMDevice *device,
 	NMSettingIP6Config *s_ip6;
 	const char *method = NM_SETTING_IP6_CONFIG_METHOD_AUTO;
 
-	connection = nm_device_get_connection (device);
+	connection = nm_device_get_applied_connection (device);
 	g_assert (connection);
 	s_ip6 = nm_connection_get_setting_ip6_config (connection);
 	if (s_ip6)
@@ -3113,7 +3115,7 @@ ip4_config_pre_commit (NMDevice *device, NMIP4Config *config)
 	NMSettingWireless *s_wifi;
 	guint32 mtu;
 
-	connection = nm_device_get_connection (device);
+	connection = nm_device_get_applied_connection (device);
 	g_assert (connection);
 	s_wifi = nm_connection_get_setting_wireless (connection);
 	g_assert (s_wifi);
@@ -3203,7 +3205,7 @@ act_stage4_ip4_config_timeout (NMDevice *dev, NMDeviceStateReason *reason)
 	gboolean may_fail = FALSE, chain_up = FALSE;
 	NMActStageReturn ret;
 
-	connection = nm_device_get_connection (dev);
+	connection = nm_device_get_applied_connection (dev);
 	g_assert (connection);
 
 	s_ip4 = nm_connection_get_setting_ip4_config (connection);
@@ -3224,7 +3226,7 @@ act_stage4_ip6_config_timeout (NMDevice *dev, NMDeviceStateReason *reason)
 	gboolean may_fail = FALSE, chain_up = FALSE;
 	NMActStageReturn ret;
 
-	connection = nm_device_get_connection (dev);
+	connection = nm_device_get_applied_connection (dev);
 	g_assert (connection);
 
 	s_ip6 = nm_connection_get_setting_ip6_config (connection);
@@ -3321,7 +3323,7 @@ activation_failure_handler (NMDevice *dev)
 {
 	NMConnection *connection;
 
-	connection = nm_device_get_connection (dev);
+	connection = nm_device_get_applied_connection (dev);
 	g_assert (connection);
 
 	/* Clear wireless secrets tries on failure */
diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
index 6d3651c83d..b9ee388741 100644
--- a/src/devices/nm-device.c
+++ b/src/devices/nm-device.c
@@ -977,7 +977,6 @@ free_slave_info (SlaveInfo *info)
  * nm_device_enslave_slave:
  * @dev: the master device
  * @slave: the slave device to enslave
- * @connection: the slave device's connection
  *
  * If @dev is capable of enslaving other devices (ie it's a bridge, bond, team,
  * etc) then this function enslaves @slave.
@@ -986,7 +985,7 @@ free_slave_info (SlaveInfo *info)
  *  other devices.
  */
 static gboolean
-nm_device_enslave_slave (NMDevice *dev, NMDevice *slave, NMConnection *connection)
+nm_device_enslave_slave (NMDevice *dev, NMDevice *slave)
 {
 	SlaveInfo *info;
 	gboolean success = FALSE;
@@ -1001,7 +1000,7 @@ nm_device_enslave_slave (NMDevice *dev, NMDevice *slave, NMConnection *connectio
 		return FALSE;
 
 	g_warn_if_fail (info->enslaved == FALSE);
-	success = NM_DEVICE_GET_CLASS (dev)->enslave_slave (dev, slave, connection, info->configure);
+	success = NM_DEVICE_GET_CLASS (dev)->enslave_slave (dev, slave, info->configure);
 
 	info->enslaved = success;
 	nm_device_slave_notify_enslave (info->slave, success);
@@ -1281,7 +1280,7 @@ slave_state_changed (NMDevice *slave,
 		return;
 
 	if (slave_new_state == NM_DEVICE_STATE_IP_CONFIG)
-		nm_device_enslave_slave (self, slave, nm_device_get_connection (slave));
+		nm_device_enslave_slave (self, slave);
 	else if (slave_new_state > NM_DEVICE_STATE_ACTIVATED)
 		release = TRUE;
 	else if (   slave_new_state <= NM_DEVICE_STATE_DISCONNECTED
@@ -1478,7 +1477,7 @@ static void
 nm_device_slave_notify_enslave (NMDevice *dev, gboolean success)
 {
 	NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE (dev);
-	NMConnection *connection = nm_device_get_connection (dev);
+	NMConnection *connection = nm_device_get_applied_connection (dev);
 
 	g_assert (priv->master);
 	g_warn_if_fail (priv->enslaved == FALSE);
@@ -1486,9 +1485,9 @@ nm_device_slave_notify_enslave (NMDevice *dev, gboolean success)
 
 	if (success) {
 		nm_log_info (LOGD_DEVICE,
-				     "Activation (%s) connection '%s' enslaved, continuing activation",
-				     nm_device_get_iface (dev),
-				     nm_connection_get_id (connection));
+		             "Activation (%s) connection '%s' enslaved, continuing activation",
+		             nm_device_get_iface (dev),
+		             nm_connection_get_id (connection));
 
 		priv->enslaved = TRUE;
 		g_object_notify (G_OBJECT (dev), NM_DEVICE_MASTER);
@@ -1517,7 +1516,7 @@ static void
 nm_device_slave_notify_release (NMDevice *dev, NMDeviceStateReason reason)
 {
 	NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE (dev);
-	NMConnection *connection = nm_device_get_connection (dev);
+	NMConnection *connection = nm_device_get_applied_connection (dev);
 	NMDeviceState new_state;
 	const char *master_status;
 
@@ -2061,7 +2060,7 @@ nm_device_ip_config_should_fail (NMDevice *self, gboolean ip6)
 
 	g_return_val_if_fail (self != NULL, TRUE);
 
-	connection = nm_device_get_connection (self);
+	connection = nm_device_get_applied_connection (self);
 	g_assert (connection);
 
 	/* Fail the connection if the failed IP method is required to complete */
@@ -2257,7 +2256,7 @@ nm_device_activate_stage2_device_config (gpointer user_data)
 		SlaveInfo *info = iter->data;
 
 		if (nm_device_get_state (info->slave) == NM_DEVICE_STATE_IP_CONFIG)
-			nm_device_enslave_slave (self, info->slave, nm_device_get_connection (info->slave));
+			nm_device_enslave_slave (self, info->slave);
 	}
 
 	nm_log_info (LOGD_DEVICE, "Activation (%s) Stage 2 of 5 (Device Configure) successful.", iface);
@@ -2608,7 +2607,7 @@ ip4_config_merge_and_apply (NMDevice *self,
 		nm_ip4_config_merge (composite, priv->ext_ip4_config);
 
 	/* Merge user overrides into the composite config */
-	connection = nm_device_get_connection (self);
+	connection = nm_device_get_applied_connection (self);
 	if (connection)
 		nm_ip4_config_merge_setting (composite, nm_connection_get_setting_ip4_config (connection));
 
@@ -2637,7 +2636,7 @@ dhcp4_lease_change (NMDevice *self, NMIP4Config *config)
 	} else {
 		/* Notify dispatcher scripts of new DHCP4 config */
 		nm_dispatcher_call (DISPATCHER_ACTION_DHCP4_CHANGE,
-		                    nm_device_get_connection (self),
+		                    nm_device_get_applied_connection (self),
 		                    self,
 		                    NULL,
 		                    NULL);
@@ -2798,7 +2797,7 @@ nm_device_dhcp4_renew (NMDevice *self, gboolean release)
 	/* Terminate old DHCP instance and release the old lease */
 	dhcp4_cleanup (self, TRUE, release);
 
-	connection = nm_device_get_connection (self);
+	connection = nm_device_get_applied_connection (self);
 	g_assert (connection);
 
 	/* Start DHCP again on the interface */
@@ -2921,7 +2920,7 @@ act_stage3_ip4_config_start (NMDevice *self,
 
 	g_return_val_if_fail (reason != NULL, NM_ACT_STAGE_RETURN_FAILURE);
 
-	connection = nm_device_get_connection (self);
+	connection = nm_device_get_applied_connection (self);
 	g_assert (connection);
 
 	method = nm_utils_get_ip_config_method (connection, NM_TYPE_SETTING_IP4_CONFIG);
@@ -3017,7 +3016,7 @@ ip6_config_merge_and_apply (NMDevice *self,
 		nm_ip6_config_merge (composite, priv->ext_ip6_config);
 
 	/* Merge user overrides into the composite config */
-	connection = nm_device_get_connection (self);
+	connection = nm_device_get_applied_connection (self);
 	if (connection)
 		nm_ip6_config_merge_setting (composite, nm_connection_get_setting_ip6_config (connection));
 
@@ -3042,7 +3041,7 @@ dhcp6_lease_change (NMDevice *device)
 
 	g_assert (priv->dhcp6_client);  /* sanity check */
 
-	connection = nm_device_get_connection (device);
+	connection = nm_device_get_applied_connection (device);
 	g_assert (connection);
 
 	/* Apply the updated config */
@@ -3156,7 +3155,6 @@ dhcp6_timeout (NMDHCPClient *client, gpointer user_data)
 
 static NMActStageReturn
 dhcp6_start (NMDevice *self,
-             NMConnection *connection,
              guint32 dhcp_opt,
              NMDeviceStateReason *reason)
 {
@@ -3164,11 +3162,10 @@ dhcp6_start (NMDevice *self,
 	NMActStageReturn ret = NM_ACT_STAGE_RETURN_FAILURE;
 	guint8 *anycast = NULL;
 	GByteArray *tmp = NULL;
+	NMConnection *connection;
 
-	if (!connection) {
-		connection = nm_device_get_connection (self);
-		g_assert (connection);
-	}
+	connection = nm_device_get_applied_connection (self);
+	g_assert (connection);
 
 	/* Begin a DHCP transaction on the interface */
 
@@ -3280,7 +3277,7 @@ linklocal6_complete (NMDevice *self)
 
 	linklocal6_cleanup (self);
 
-	connection = nm_device_get_connection (self);
+	connection = nm_device_get_applied_connection (self);
 	g_assert (connection);
 
 	method = nm_utils_get_ip_config_method (connection, NM_TYPE_SETTING_IP6_CONFIG);
@@ -3308,7 +3305,7 @@ linklocal6_start (NMDevice *self)
 	if (linklocal6_config_is_ready (priv->ip6_config))
 		return NM_ACT_STAGE_RETURN_SUCCESS;
 
-	connection = nm_device_get_connection (self);
+	connection = nm_device_get_applied_connection (self);
 	g_assert (connection);
 
 	method = nm_utils_get_ip_config_method (connection, NM_TYPE_SETTING_IP6_CONFIG);
@@ -3375,7 +3372,6 @@ static void
 rdisc_config_changed (NMRDisc *rdisc, NMRDiscConfigMap changed, NMDevice *device)
 {
 	NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE (device);
-	NMConnection *connection;
 	int i;
 	NMDeviceStateReason reason;
 	static int system_support = -1;
@@ -3402,8 +3398,6 @@ rdisc_config_changed (NMRDisc *rdisc, NMRDiscConfigMap changed, NMDevice *device
 		ifa_flags |= IFA_F_MANAGETEMPADDR;
 
 	g_return_if_fail (priv->act_request);
-	connection = nm_device_get_connection (device);
-	g_assert (connection);
 
 	if (!priv->ac_ip6_config)
 		priv->ac_ip6_config = nm_ip6_config_new ();
@@ -3503,7 +3497,7 @@ rdisc_config_changed (NMRDisc *rdisc, NMRDiscConfigMap changed, NMDevice *device
 			             "Activation (%s) Stage 3 of 5 (IP Configure Start) starting DHCPv6"
 			             " as requested by IPv6 router...",
 			             priv->iface);
-			switch (dhcp6_start (device, connection, priv->dhcp6_mode, &reason)) {
+			switch (dhcp6_start (device, priv->dhcp6_mode, &reason)) {
 			case NM_ACT_STAGE_RETURN_SUCCESS:
 				g_warn_if_reached ();
 				break;
@@ -3523,13 +3517,9 @@ static gboolean
 addrconf6_start (NMDevice *self, NMSettingIP6ConfigPrivacy use_tempaddr)
 {
 	NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE (self);
-	NMConnection *connection;
 	NMActStageReturn ret;
 	const char *ip_iface = nm_device_get_ip_iface (self);
 
-	connection = nm_device_get_connection (self);
-	g_assert (connection);
-
 	g_warn_if_fail (priv->ac_ip6_config == NULL);
 	if (priv->ac_ip6_config) {
 		g_object_unref (priv->ac_ip6_config);
@@ -3679,7 +3669,7 @@ act_stage3_ip6_config_start (NMDevice *self,
 
 	ip_iface = nm_device_get_ip_iface (self);
 
-	connection = nm_device_get_connection (self);
+	connection = nm_device_get_applied_connection (self);
 	g_assert (connection);
 
 	method = nm_utils_get_ip_config_method (connection, NM_TYPE_SETTING_IP6_CONFIG);
@@ -3749,7 +3739,7 @@ act_stage3_ip6_config_start (NMDevice *self,
 		}
 	} else if (strcmp (method, NM_SETTING_IP6_CONFIG_METHOD_DHCP) == 0) {
 		priv->dhcp6_mode = NM_RDISC_DHCP_LEVEL_MANAGED;
-		ret = dhcp6_start (self, connection, priv->dhcp6_mode, reason);
+		ret = dhcp6_start (self, priv->dhcp6_mode, reason);
 	} else if (strcmp (method, NM_SETTING_IP6_CONFIG_METHOD_MANUAL) == 0) {
 		/* New blank config */
 		*out_config = nm_ip6_config_new ();
@@ -3903,7 +3893,7 @@ nm_device_activate_stage3_ip_config_start (gpointer user_data)
 		if (priv->ip4_state == IP_WAIT && priv->ip6_state == IP_WAIT) {
 			nm_log_info (LOGD_DEVICE, "Activation (%s) connection '%s' waiting on master '%s'",
 						 nm_device_get_iface (self),
-						 nm_connection_get_id (nm_device_get_connection (self)),
+						 nm_connection_get_id (nm_device_get_applied_connection (self)),
 						 nm_device_get_iface (master_device));
 		}
 		goto out;
@@ -3968,7 +3958,7 @@ nm_device_activate_schedule_stage3_ip_config_start (NMDevice *self)
 	state = nm_device_get_state (self);
 
 	/* Add the interface to the specified firewall zone */
-	connection = nm_device_get_connection (self);
+	connection = nm_device_get_applied_connection (self);
 	g_assert (connection);
 	s_con = nm_connection_get_setting_connection (connection);
 
@@ -4807,7 +4797,11 @@ impl_device_disconnect (NMDevice *device, DBusGMethodInvocation *context)
 		return;
 	}
 
-	connection = nm_device_get_connection (device);
+	/* use the applied connection for checking permissions.
+	 * FIXME: user changes to the connection, should propagate
+	 * immediatly to the applied connection.
+	 **/
+	connection = nm_device_get_applied_connection (device);
 	g_assert (connection);
 
 	/* Ask the manager to authenticate this request for us */
@@ -5253,7 +5247,7 @@ nm_device_start_ip_check (NMDevice *self)
 	NMSettingConnection *s_con;
 	guint timeout = 0;
 	const char *ping_binary = NULL;
-	char buf[INET6_ADDRSTRLEN] = { 0 };
+	char buf[INET6_ADDRSTRLEN];
 	guint log_domain = LOGD_IP4;
 
 	/* Shouldn't be any active ping here, since IP_CHECK happens after the
@@ -5265,13 +5259,14 @@ nm_device_start_ip_check (NMDevice *self)
 	g_assert (!priv->gw_ping.pid);
 	g_assert (priv->ip4_state == IP_DONE || priv->ip6_state == IP_DONE);
 
-	connection = nm_device_get_connection (self);
+	connection = nm_device_get_applied_connection (self);
 	g_assert (connection);
 
 	s_con = nm_connection_get_setting_connection (connection);
 	g_assert (s_con);
 	timeout = nm_setting_connection_get_gateway_ping_timeout (s_con);
 
+	buf[0] = 0;
 	if (timeout) {
 		if (priv->ip4_state == IP_DONE) {
 			guint gw = 0;
@@ -5280,8 +5275,8 @@ nm_device_start_ip_check (NMDevice *self)
 			log_domain = LOGD_IP4;
 
 			gw = nm_ip4_config_get_gateway (priv->ip4_config);
-			if (gw && !inet_ntop (AF_INET, &gw, buf, sizeof (buf)))
-				buf[0] = '\0';
+			if (gw)
+				nm_utils_inet4_ntop (gw, buf);
 		} else if (priv->ip6_config && priv->ip6_state == IP_DONE) {
 			const struct in6_addr *gw = NULL;
 
@@ -5289,8 +5284,8 @@ nm_device_start_ip_check (NMDevice *self)
 			log_domain = LOGD_IP6;
 
 			gw = nm_ip6_config_get_gateway (priv->ip6_config);
-			if (gw && !inet_ntop (AF_INET6, gw, buf, sizeof (buf)))
-				buf[0] = '\0';
+			if (gw)
+				nm_utils_inet6_ntop (gw, buf);
 		}
 	}
 
@@ -5434,7 +5429,7 @@ dispose (GObject *object)
 		NMConnection *connection;
 		const char *method;
 
-		connection = nm_device_get_connection (self);
+		connection = nm_device_get_applied_connection (self);
 		if (connection) {
 			/* Only static or DHCP IPv4 connections can be left up.
 			 * All IPv6 connections can be left up, so we don't have
@@ -6365,7 +6360,6 @@ nm_device_state_changed (NMDevice *device,
 	NMDeviceState old_state;
 	NMActRequest *req;
 	gboolean no_firmware = FALSE;
-	NMConnection *connection;
 
 	/* Track re-entry */
 	g_warn_if_fail (priv->in_state_changed == FALSE);
@@ -6496,8 +6490,9 @@ nm_device_state_changed (NMDevice *device,
 		             nm_device_get_iface (device));
 		nm_dispatcher_call (DISPATCHER_ACTION_UP, nm_act_request_get_connection (req), device, NULL, NULL);
 		break;
-	case NM_DEVICE_STATE_FAILED:
-		connection = nm_device_get_connection (device);
+	case NM_DEVICE_STATE_FAILED: {
+		NMConnection *connection = nm_device_get_connection (device);
+
 		nm_log_warn (LOGD_DEVICE | LOGD_WIFI,
 		             "Activation (%s) failed for connection '%s'",
 		             nm_device_get_iface (device),
@@ -6510,6 +6505,9 @@ nm_device_state_changed (NMDevice *device,
 		 * we can distinguish between connections we've tried to activate and have
 		 * failed (zero timestamp), connections that succeeded (non-zero timestamp),
 		 * and those we haven't tried yet (no timestamp).
+		 *
+		 * The connection time stamp is not associated with the applied connection
+		 * instance.
 		 */
 		if (connection && !nm_settings_connection_get_timestamp (NM_SETTINGS_CONNECTION (connection), NULL)) {
 			nm_settings_connection_update_timestamp (NM_SETTINGS_CONNECTION (connection),
@@ -6523,6 +6521,7 @@ nm_device_state_changed (NMDevice *device,
 		 */
 		nm_device_queue_state (device, NM_DEVICE_STATE_DISCONNECTED, NM_DEVICE_STATE_REASON_NONE);
 		break;
+	}
 	case NM_DEVICE_STATE_IP_CHECK:
 		nm_device_start_ip_check (device);
 
diff --git a/src/devices/nm-device.h b/src/devices/nm-device.h
index 2a73fa090e..1615f6fdbd 100644
--- a/src/devices/nm-device.h
+++ b/src/devices/nm-device.h
@@ -187,7 +187,6 @@ typedef struct {
 
 	gboolean        (* enslave_slave) (NMDevice *self,
 	                                   NMDevice *slave,
-	                                   NMConnection *connection,
 	                                   gboolean configure);
 
 	gboolean        (* release_slave) (NMDevice *self,
diff --git a/src/devices/wimax/nm-device-wimax.c b/src/devices/wimax/nm-device-wimax.c
index 995d3cf01b..a544b2964c 100644
--- a/src/devices/wimax/nm-device-wimax.c
+++ b/src/devices/wimax/nm-device-wimax.c
@@ -673,7 +673,7 @@ act_stage2_config (NMDevice *device, NMDeviceStateReason *reason)
 	iface = nm_device_get_iface (device);
 	g_assert (iface);
 
-	connection = nm_device_get_connection (device);
+	connection = nm_device_get_applied_connection (device);
 	g_assert (connection);
 
 	s_wimax = nm_connection_get_setting_wimax (connection);
diff --git a/src/nm-manager.c b/src/nm-manager.c
index 932fbb1058..cb993bb5da 100644
--- a/src/nm-manager.c
+++ b/src/nm-manager.c
@@ -181,7 +181,6 @@ static gboolean find_master (NMManager *self,
                              NMDevice *device,
                              NMConnection **out_master_connection,
                              NMDevice **out_master_device,
-                             NMActiveConnection **out_master_ac,
                              GError **error);
 
 static void nm_manager_update_state (NMManager *manager);
@@ -1803,6 +1802,20 @@ get_existing_connection (NMManager *manager, NMDevice *device)
 	return added ? NM_CONNECTION (added) : NULL;
 }
 
+static NMActiveConnection *
+get_active_connection_for_device_or_connection (NMManager *self, NMDevice *device, NMConnection *connection)
+{
+	NMActiveConnection *ac = NULL;
+
+	if (device)
+		ac = NM_ACTIVE_CONNECTION (nm_device_get_act_request (device));
+
+	if (!ac && connection)
+		ac = find_ac_for_connection (self, connection);
+
+	return ac;
+}
+
 static void
 add_device (NMManager *self, NMDevice *device, gboolean generate_con)
 {
@@ -1938,11 +1951,29 @@ add_device (NMManager *self, NMDevice *device, gboolean generate_con)
 		subject = nm_auth_subject_new_internal ();
 		active = _new_active_connection (self, connection, NULL, device, subject, &error);
 		if (active) {
+			NMDevice *master_device;
+			NMConnection *master_connection;
 			NMActiveConnection *master_ac = NULL;
 
+			g_assert (!error);
+
 			/* If the device is a slave or VLAN, find the master ActiveConnection */
-			if (find_master (self, connection, device, NULL, NULL, &master_ac, NULL) && master_ac)
-				nm_active_connection_set_master (active, master_ac);
+			if (find_master (self, connection, device, &master_connection, &master_device, &error)) {
+				master_ac = get_active_connection_for_device_or_connection (self, master_device, master_connection);
+
+				if (master_ac)
+					nm_active_connection_set_master (active, master_ac);
+			}
+			if (error) {
+				/* FIXME: Should we abort assumption? */
+				nm_log_dbg (LOGD_DEVICE, "(%s): invalid master while assuming connection %s: %s",
+				            nm_device_get_iface (device), nm_connection_get_id (connection), error->message);
+				g_error_free (error);
+			} else if (!master_ac && (master_connection || master_device)) {
+				/* FIXME: Should we abort assumption? */
+				nm_log_dbg (LOGD_DEVICE, "(%s): no active master connection while assuming connection %s",
+				            nm_device_get_iface (device), nm_connection_get_id (connection));
+			}
 
 			nm_active_connection_set_assumed (active, TRUE);
 			nm_active_connection_export (active);
@@ -2432,35 +2463,41 @@ is_compatible_with_slave (NMConnection *master, NMConnection *slave)
  *   that master connection was found
  * @out_master_device: on success, the master device of @connection if that
  *   master device was found
- * @out_master_ac: on success, the master ActiveConnection of @connection if
- *   there already is one
  * @error: the error, if an error occurred
  *
- * Given an #NMConnection, attempts to find its master. If @connection has
- * no master, this will return %TRUE and @out_master_connection and
- * @out_master_device will be untouched.
+ * Given an #NMConnection, attempts to find its master. The two output
+ * parameters @out_master_connection and @out_master_device will always be
+ * set if provided (possibly to %NULL). If the function returns %FALSE, both output
+ * parameters will be set to %NULL. Both output parameters are never set
+ * to non %NULL together.
+ *
+ * If we find a @out_master_device, @out_master_connection will be set to %NULL.
+ * (regardless, whether the device is currently active or not).
+ * If @out_master_connection is returned, there is currently no active device
+ * for this connection.
+ *
+ * If @connection has no master, this will return %TRUE and @out_master_connection
+ * and @out_master_device will set to %NULL.
  *
  * If @connection does have a master, then the outputs depend on what is in its
  * #NMSettingConnection:master property:
  *
  * If "master" is the ifname of an existing #NMDevice, and that device has a
  * compatible master connection activated or activating on it, then
- * @out_master_device, @out_master_connection, and @out_master_ac will all be
- * set. If the device exists and is idle, only @out_master_device will be set.
- * If the device exists and has an incompatible connection on it, an error
+ * @out_master_device will all be set.
+ * If the device exists and has an incompatible connection applied, an error
  * will be returned.
  *
+ * If "master" is the UUID of a compatible master connection, then
+ * @out_master_connection will be the identified connection and @out_master_device
+ * will be set to %NULL if the connection is not active. If the connection is
+ * currently active on a device, @out_master_device will be set and
+ * @out_master_connection will be set to %NULL (if the applied connection
+ * is compatible.
+ *
  * If "master" is the ifname of a non-existent device, then @out_master_device
  * will be %NULL, and @out_master_connection will be a connection whose
- * activation would cause the creation of that device. @out_master_ac MAY be
- * set in this case as well (if the connection has started activating, but has
- * not yet created its device).
- *
- * If "master" is the UUID of a compatible master connection, then
- * @out_master_connection will be the identified connection, and @out_master_device
- * and/or @out_master_ac will be set if the connection is currently activating.
- * (@out_master_device will not be set if the device exists but does not have
- * @out_master_connection active/activating on it.)
+ * activation would cause the creation of that device.
  *
  * Returns: %TRUE if the master device and/or connection could be found or if
  *  the connection did not require a master, %FALSE otherwise
@@ -2471,7 +2508,6 @@ find_master (NMManager *self,
              NMDevice *device,
              NMConnection **out_master_connection,
              NMDevice **out_master_device,
-             NMActiveConnection **out_master_ac,
              GError **error)
 {
 	NMManagerPrivate *priv = NM_MANAGER_GET_PRIVATE (self);
@@ -2480,46 +2516,74 @@ find_master (NMManager *self,
 	NMDevice *master_device = NULL;
 	NMConnection *master_connection = NULL;
 	GSList *iter, *connections = NULL;
+	gboolean success = FALSE;
 
 	s_con = nm_connection_get_setting_connection (connection);
 	g_assert (s_con);
 	master = nm_setting_connection_get_master (s_con);
 
-	if (master == NULL)
-		return TRUE;  /* success, but no master */
+	if (master == NULL) {
+		success = TRUE;
+		goto exit;  /* success, but no master */
+	}
 
 	/* Try as an interface name first */
 	master_device = find_device_by_ip_iface (self, master);
 	if (master_device) {
 		if (master_device == device) {
-			g_set_error_literal (error, NM_MANAGER_ERROR, NM_MANAGER_ERROR_DEPENDENCY_FAILED,
-			                     "Device cannot be its own master");
-			return FALSE;
+			g_set_error (error, NM_MANAGER_ERROR, NM_MANAGER_ERROR_DEPENDENCY_FAILED,
+			             "Device %s cannot be its own master for connection '%s'",
+			             nm_device_get_iface (master_device),
+			             nm_connection_get_id (connection));
+			goto exit;
 		}
 
-		master_connection = nm_device_get_connection (master_device);
+		master_connection = nm_device_get_applied_connection (master_device);
 		if (master_connection && !is_compatible_with_slave (master_connection, connection)) {
 			g_set_error (error, NM_MANAGER_ERROR, NM_MANAGER_ERROR_DEPENDENCY_FAILED,
-			             "The active connection on %s is not a valid master for '%s'",
+			             "The applied active connection '%s' on device %s is not a valid master for '%s'",
+			             nm_connection_get_id (master_connection),
 			             nm_device_get_iface (master_device),
 			             nm_connection_get_id (connection));
-			return FALSE;
+			goto exit;
 		}
+		master_connection = NULL;
 	} else {
 		/* Try master as a connection UUID */
 		master_connection = (NMConnection *) nm_settings_get_connection_by_uuid (priv->settings, master);
 		if (master_connection) {
+			if (!is_compatible_with_slave (master_connection, connection)) {
+				g_set_error (error, NM_MANAGER_ERROR, NM_MANAGER_ERROR_DEPENDENCY_FAILED,
+				             "The connection '%s' is not a valid master for '%s'",
+				             master,
+				             nm_connection_get_id (connection));
+				goto exit;
+			}
 			/* Check if the master connection is activated on some device already */
 			for (iter = priv->devices; iter; iter = g_slist_next (iter)) {
 				NMDevice *candidate = NM_DEVICE (iter->data);
 
-				if (candidate == device)
+				if (nm_device_get_connection (candidate) != master_connection)
 					continue;
 
-				if (nm_device_get_connection (candidate) == master_connection) {
-					master_device = candidate;
-					break;
+				if (device == candidate) {
+					g_set_error (error, NM_MANAGER_ERROR, NM_MANAGER_ERROR_DEPENDENCY_FAILED,
+					             "The applied active connection '%s' on device %s is not a valid master because the device cannot be its own master",
+					             master,
+					             nm_device_get_iface (master_device));
+					goto exit;
+				}
+				if (!is_compatible_with_slave (nm_device_get_applied_connection (candidate), connection)) {
+					g_set_error (error, NM_MANAGER_ERROR, NM_MANAGER_ERROR_DEPENDENCY_FAILED,
+					             "The applied active connection '%s' on device %s is not a valid master for '%s'",
+					             master,
+					             nm_device_get_iface (master_device),
+					             nm_connection_get_id (connection));
+					goto exit;
 				}
+				master_device = candidate;
+				master_connection = NULL;
+				break;
 			}
 		} else {
 			/* Might be a virtual interface that hasn't been created yet, so
@@ -2544,20 +2608,20 @@ find_master (NMManager *self,
 		}
 	}
 
-	if (out_master_connection)
-		*out_master_connection = master_connection;
-	if (out_master_device)
-		*out_master_device = master_device;
-	if (out_master_ac && master_connection)
-		*out_master_ac = find_ac_for_connection (self, master_connection);
-
 	if (master_device || master_connection)
-		return TRUE;
+		success = TRUE;
 	else {
 		g_set_error_literal (error, NM_MANAGER_ERROR, NM_MANAGER_ERROR_UNKNOWN_DEVICE,
 		                     "Master connection not found or invalid");
-		return FALSE;
 	}
+
+exit:
+	g_assert (!success || master_connection != NULL || master_device != NULL);
+	if (out_master_connection)
+		*out_master_connection = success ? master_connection : NULL;
+	if (out_master_device)
+		*out_master_device = success ? master_device : NULL;
+	return success;
 }
 
 /**
@@ -2609,28 +2673,19 @@ ensure_master_active_connection (NMManager *self,
 	 * compatible connection.  If it's already activating we can just proceed.
 	 */
 	if (master_device) {
-		NMConnection *device_connection = nm_device_get_connection (master_device);
-
-		/* If we're passed a connection and a device, we require that connection
-		 * be already activated on the device, eg returned from find_master().
-		 */
-		if (master_connection)
-			g_assert (device_connection == master_connection);
-		else if (!is_compatible_with_slave (device_connection, connection)) {
-			g_set_error (error, NM_MANAGER_ERROR, NM_MANAGER_ERROR_DEPENDENCY_FAILED,
-			             "The active connection on %s is not a valid master for '%s'",
-			             nm_device_get_iface (master_device),
-			             nm_connection_get_id (connection));
-			return NULL;
-		}
-
 		master_state = nm_device_get_state (master_device);
 		if (   (master_state == NM_DEVICE_STATE_ACTIVATED)
 		    || nm_device_is_activating (master_device)) {
 			/* Device already using master_connection */
+#ifndef G_DISABLE_ASSERT
+			master_connection = nm_device_get_applied_connection (master_device);
+			g_assert (master_connection && is_compatible_with_slave (master_connection, connection));
+#endif
 			return NM_ACTIVE_CONNECTION (nm_device_get_act_request (master_device));
 		}
 
+		g_assert (!nm_device_get_applied_connection (master_device));
+
 		/* If the device is disconnected, find a compatible connection and
 		 * activate it on the device.
 		 */
@@ -2752,7 +2807,7 @@ _internal_activate_device (NMManager *self, NMActiveConnection *active, GError *
 	NMDevice *device, *master_device = NULL;
 	NMConnection *connection;
 	NMConnection *master_connection = NULL;
-	NMActiveConnection *master_ac = NULL;
+	GError *local_error = NULL;
 
 	g_return_val_if_fail (NM_IS_MANAGER (self), FALSE);
 	g_return_val_if_fail (NM_IS_ACTIVE_CONNECTION (active), FALSE);
@@ -2817,14 +2872,21 @@ _internal_activate_device (NMManager *self, NMActiveConnection *active, GError *
 
 	/* Try to find the master connection/device if the connection has a dependency */
 	if (!find_master (self, connection, device,
-	                  &master_connection, &master_device, &master_ac,
-	                  error))
+	                  &master_connection, &master_device,
+	                  &local_error)) {
+		nm_log_dbg (LOGD_CORE, "Activation of '%s' fails because of missing master: %s",
+		                       nm_connection_get_id (connection),
+		                       local_error->message);
+		g_propagate_error (error, local_error);
 		return FALSE;
+	}
 
 	/* Ensure there's a master active connection the new connection we're
 	 * activating can depend on.
 	 */
 	if (master_connection || master_device) {
+		NMActiveConnection *master_ac = NULL;
+
 		if (master_connection) {
 			nm_log_dbg (LOGD_CORE, "Activation of '%s' requires master connection '%s'",
 			            nm_connection_get_id (connection),
@@ -2836,26 +2898,16 @@ _internal_activate_device (NMManager *self, NMActiveConnection *active, GError *
 			            nm_device_get_ip_iface (master_device));
 		}
 
-		/* Ensure eg bond slave and the candidate master is a bond master */
-		if (master_connection && !is_compatible_with_slave (master_connection, connection)) {
-			g_set_error_literal (error, NM_MANAGER_ERROR, NM_MANAGER_ERROR_DEPENDENCY_FAILED,
-			                     "The master connection was not compatible");
-			return FALSE;
-		}
-
+		master_ac = ensure_master_active_connection (self,
+		                                             nm_active_connection_get_subject (active),
+		                                             connection,
+		                                             device,
+		                                             master_connection,
+		                                             master_device,
+		                                             error);
 		if (!master_ac) {
-			master_ac = ensure_master_active_connection (self,
-			                                             nm_active_connection_get_subject (active),
-			                                             connection,
-			                                             device,
-			                                             master_connection,
-			                                             master_device,
-			                                             error);
-			if (!master_ac) {
-				if (error)
-					g_assert (*error);
-				return FALSE;
-			}
+			g_assert (!error || *error);
+			return FALSE;
 		}
 
 		nm_active_connection_set_master (active, master_ac);
diff --git a/src/nm-policy.c b/src/nm-policy.c
index 34216c8717..e520bf2cfd 100644
--- a/src/nm-policy.c
+++ b/src/nm-policy.c
@@ -1398,6 +1398,7 @@ device_state_changed (NMDevice *device,
 	NMPolicy *policy = (NMPolicy *) user_data;
 	NMPolicyPrivate *priv = NM_POLICY_GET_PRIVATE (policy);
 	NMSettingsConnection *connection = NM_SETTINGS_CONNECTION (nm_device_get_connection (device));
+	NMConnection *applied_connection = nm_device_get_applied_connection (device);
 	const char *ip_iface = nm_device_get_ip_iface (device);
 	NMIP4Config *ip4_config;
 	NMIP6Config *ip6_config;
@@ -1506,13 +1507,13 @@ device_state_changed (NMDevice *device,
 		nm_settings_connection_set_autoconnect_blocked_reason (connection, NM_DEVICE_STATE_REASON_NONE);
 		break;
 	case NM_DEVICE_STATE_SECONDARIES:
-		s_con = nm_connection_get_setting_connection (NM_CONNECTION (connection));
+		s_con = nm_connection_get_setting_connection (applied_connection);
 		if (s_con && nm_setting_connection_get_num_secondaries (s_con) > 0) {
 			/* Make routes and DNS up-to-date before activating dependent connections */
 			update_routing_and_dns (policy, FALSE);
 
 			/* Activate secondary (VPN) connections */
-			if (!activate_secondary_connections (policy, NM_CONNECTION (connection), device))
+			if (!activate_secondary_connections (policy, applied_connection, device))
 				nm_device_queue_state (device, NM_DEVICE_STATE_FAILED,
 				                       NM_DEVICE_STATE_REASON_SECONDARY_CONNECTION_FAILED);
 		} else
@@ -1866,8 +1867,8 @@ static void
 firewall_update_zone (NMPolicy *policy, NMConnection *connection)
 {
 	NMPolicyPrivate *priv = NM_POLICY_GET_PRIVATE (policy);
-	NMSettingConnection *s_con = nm_connection_get_setting_connection (connection);
 	GSList *iter, *devices;
+	const char *zone;
 
 	devices = nm_manager_get_devices (priv->manager);
 	/* find dev with passed connection and change zone its interface belongs to */
@@ -1876,12 +1877,21 @@ firewall_update_zone (NMPolicy *policy, NMConnection *connection)
 
 		if (   (nm_device_get_connection (dev) == connection)
 		    && (nm_device_get_state (dev) == NM_DEVICE_STATE_ACTIVATED)) {
+			/* The zone is one of the parameters, that have immediate effect when
+			 * updating the connection. Therefore, we copy the property over to the
+			 * applied_connection and change the zone. */
+			NMConnection *applied_connection = nm_device_get_applied_connection (dev);
+
+			zone = nm_setting_connection_get_zone (nm_connection_get_setting_connection (connection));
+			g_object_set (nm_connection_get_setting_connection (applied_connection),
+			              NM_SETTING_CONNECTION_ZONE, zone, NULL);
 			nm_firewall_manager_add_or_change_zone (priv->fw_manager,
 			                                        nm_device_get_ip_iface (dev),
-			                                        nm_setting_connection_get_zone (s_con),
+			                                        zone,
 			                                        FALSE, /* change zone */
 			                                        add_or_change_zone_cb,
 			                                        g_object_ref (dev));
+			break;
 		}
 	}
 }
@@ -1901,9 +1911,9 @@ firewall_started (NMFirewallManager *manager,
 	for (iter = devices; iter; iter = g_slist_next (iter)) {
 		NMDevice *dev = NM_DEVICE (iter->data);
 
-		connection = nm_device_get_connection (dev);
-		s_con = nm_connection_get_setting_connection (connection);
 		if (nm_device_get_state (dev) == NM_DEVICE_STATE_ACTIVATED) {
+			connection = nm_device_get_applied_connection (dev);
+			s_con = nm_connection_get_setting_connection (connection);
 			nm_firewall_manager_add_or_change_zone (priv->fw_manager,
 			                                        nm_device_get_ip_iface (dev),
 			                                        nm_setting_connection_get_zone (s_con),