refactor: move VPN DNS mode handling to session plugin

[52cyb]

1. Relocate VPN DNS mode handler from libdde-network-core to network-
   service-plugin session service
2. Add VpnDnsModeHandler class to monitor VPN connections and trigger
   DNS mode application
3. Introduce VpnDnsModeWorker with async polkit authorization and queued
   request processing
4. Add VpnDnsModeApplyState and VpnDnsModeRequestQueue for state
   management
5. Move polkit policy file installation from libdde-network-core to
   network-service-plugin
6. Remove obsolete VpnDnsRouteController from core library and its
   dependencies
7. Add PolkitQt6-1 dependency to network-service-plugin CMake
   configuration

Log: Refactored VPN DNS mode handling architecture, moving from core
library to session plugin for better service separation

Influence:

1. Verify VPN connection with preferred DNS mode applies DNS correctly
2. Verify VPN connection with secondary DNS mode applies DNS correctly
3. Verify VPN connection without dns-priority setting reverts link DNS
   properly
4. Test VPN connection updates while active to confirm DNS
   reconfiguration
5. Verify polkit authorization prompt appears when applying DNS settings
6. Test VPN disconnect and reconnect to ensure DNS state resets
   correctly
7. Verify concurrent VPN connections with different DNS modes work
   independently

refactor: 将VPN DNS模式处理移动到会话插件

1. 将VPN DNS模式处理器从libdde-network-core迁移到network-service-plugin
   会话服务
2. 新增VpnDnsModeHandler类用于监控VPN连接并触发DNS模式应用
3. 引入VpnDnsModeWorker，支持异步polkit授权和请求队列处理
4. 新增VpnDnsModeApplyState和VpnDnsModeRequestQueue用于状态管理
5. 将polkit策略文件安装从libdde-network-core迁移至network-service-plugin
6. 移除核心库中过时的VpnDnsRouteController及其依赖
7. 在network-service-plugin的CMake配置中添加PolkitQt6-1依赖

Log: 重构VPN DNS模式处理架构，从核心库移至会话插件以更好分离服务

Influence:

1. 验证首选DNS模式的VPN连接能正确应用DNS配置
2. 验证次要DNS模式的VPN连接能正确应用DNS配置
3. 验证未设置dns-priority的VPN连接能正确恢复链路DNS
4. 测试VPN连接激活状态下更新配置，确认DNS重新配置生效
5. 验证应用DNS设置时polkit授权提示是否正常弹出
6. 测试VPN断开和重连后DNS状态是否正确重置
7. 验证多个不同DNS模式的VPN连接能独立工作

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: 52cyb

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR fixes the VPN DNS worker thread cleanup logic by removing a redundant deleteLater connection, tightening destructor cleanup flow, ensuring the worker is deleted from the correct thread, and nulling the worker pointer after cleanup to avoid crashes and use-after-free issues.

Sequence diagram for updated VPN DNS worker thread cleanup

sequenceDiagram
    participant Controller as VpnDnsRouteController
    participant WorkerThread as QThread
    participant Worker as VpnDnsRouteWorker

    Controller->>WorkerThread: start()
    WorkerThread-->>Worker: finished (signal)
    WorkerThread->>Worker: QObject::deleteLater()

    Controller->>WorkerThread: ~VpnDnsRouteController()
    Controller->>Worker: disconnect(this, nullptr, m_worker, nullptr)
    alt m_workerThread && isRunning()
        Controller->>WorkerThread: quit()
        opt wait(3000) succeeds
            Controller->>WorkerThread: wait(3000)
            Controller->>Controller: m_worker = nullptr
        end
        else wait(3000) times out
            Controller->>WorkerThread: terminate()
            Controller->>WorkerThread: wait(500)
            alt m_worker not null
                Controller->>Worker: moveToThread(QThread::currentThread())
                Controller->>Worker: delete m_worker
                Controller->>Controller: m_worker = nullptr
            end
    end

Loading

File-Level Changes

Change	Details	Files
Adjust worker thread cleanup connections to avoid double deletion and ensure proper lifetime management.	Keep only the QThread::finished → worker QObject::deleteLater connection and remove the QThread::finished → workerThread QObject::deleteLater connection. Rely on explicit teardown logic instead of a queued deleteLater on the worker thread object.	src/impl/vpndnsroutecontroller.cpp
Harden VpnDnsRouteController destructor cleanup logic for the DNS worker thread to prevent crashes and use-after-free.	Remove early-return on null workerThread to ensure destructor always runs core cleanup logic paths. On normal quit/wait success, set the worker pointer to nullptr after thread shutdown. On forced-terminate path, move the worker object to the current thread before calling delete to ensure deletion in a valid thread context. Simplify nullptr checks in the destructor by consolidating conditions around m_workerThread->isRunning() and m_worker presence.	src/impl/vpndnsroutecontroller.cpp

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• In the destructor, consider guarding against a null m_workerThread (e.g., an early return as before) to avoid calling methods on a potentially uninitialized or already-cleared thread pointer.
• When moving the worker to the current thread in the termination path, it may be safer to check the worker’s existing thread affinity (worker->thread()) before calling moveToThread to avoid unnecessary moves or subtle lifecycle issues if the current thread is not intended to own the worker.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In the destructor, consider guarding against a null m_workerThread (e.g., an early return as before) to avoid calling methods on a potentially uninitialized or already-cleared thread pointer.
- When moving the worker to the current thread in the termination path, it may be safer to check the worker’s existing thread affinity (worker->thread()) before calling moveToThread to avoid unnecessary moves or subtle lifecycle issues if the current thread is not intended to own the worker.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[52cyb]

@sourceAI review

[deepin-ci-robot]

deepin pr auto review

★ 总体评分：75分

■ 【总体评价】

代码成功将同步阻塞的VPN DNS控制重构为异步事务化架构，设计优雅且性能大幅提升
逻辑基本正确但因析构函数中存在工作对象内存泄漏扣15分，限制在及格区间

■ 【详细分析】

• 1.语法逻辑（存在错误）✕

在 vpndnsmodehandler.cpp 的 VpnDnsModeHandler::~VpnDnsModeHandler 中，调用了 m_workerThread->quit 和 m_workerThread->wait 等待工作线程结束。由于在 ensureWorkerThread 中连接了 connect(m_workerThread, &QThread::finished, m_worker, &QObject::deleteLater)，当工作线程的事件循环退出后，deleteLater 投递的延迟删除事件无法被已停止的事件循环处理，导致 m_worker 对象内存泄漏。
潜在问题：进程退出时发生单次内存泄漏，虽不影响运行时状态但违反资源管理规范，且在静态分析中会被标记为严重缺陷
建议：在 m_workerThread->wait 返回后，手动执行 delete m_worker 并置空指针以确保资源释放

• 2.代码质量（优秀）✓

代码结构清晰，职责划分明确，Handler负责协调与状态管理，Worker负责执行，State与Transaction及Queue分别封装了版本号控制、事务回退与请求合并机制。命名规范符合Qt及项目风格，头文件注释详尽，日志分类使用 qCDebug 与 qCWarning 合理
建议：无

• 3.代码性能（高效）✓

彻底消除了旧代码中 waitForFinished 和 checkAuthorizationSync 带来的线程阻塞风险。通过 QDBusPendingCallWatcher 实现全异步链式调用，结合请求队列按 Profile 合并机制，有效避免了重复的 D-Bus 调用和 Polkit 弹窗，版本号机制也杜绝了过期异步结果的无用处理
建议：无

• 4.代码安全（存在0个安全漏洞）✓

漏洞对比统计：新增漏洞 0 个，减少漏洞 0 个，持平 0 个
代码通过异步 Polkit 鉴权保护了对 systemd-resolved 的 D-Bus 接口调用，未发现命令注入、缓冲区溢出、权限绕过或敏感信息泄露等安全漏洞

• 建议：保持当前的异步鉴权与权限校验设计

■ 【改进建议代码示例】

// network-service-plugin/src/session/vpndnsmode/vpndnsmodehandler.cpp
VpnDnsModeHandler::~VpnDnsModeHandler() 
{
    disconnect(this, nullptr, m_worker, nullptr);
    disconnect(m_worker, nullptr, this, nullptr);

    if (m_workerThread && m_workerThread->isRunning()) {
        Q_ASSERT(QThread::currentThread() != m_workerThread);
        if (m_worker) {
            QMetaObject::invokeMethod(m_worker, "stop", Qt::BlockingQueuedConnection);
        }

        m_workerThread->quit();
        m_workerThread->wait();
        
        // 修复：线程事件循环退出后，deleteLater无法被处理，需手动释放
        delete m_worker;
        m_worker = nullptr;
    }

    if (m_workerThread) {
        delete m_workerThread;
        m_workerThread = nullptr;
    }
}