merge: branch 'bg/macsec-bgo762114'

https://bugzilla.gnome.org/show_bug.cgi?id=762114

44 files changed, 3488 insertions, 47 deletions

diff --git a/Makefile.am b/Makefile.am
index 1631c3c957..609e4be225 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -195,6 +195,8 @@ introspection_sources = \
 	introspection/org.freedesktop.NetworkManager.Device.Infiniband.h \
 	introspection/org.freedesktop.NetworkManager.Device.IPTunnel.c \
 	introspection/org.freedesktop.NetworkManager.Device.IPTunnel.h \
+	introspection/org.freedesktop.NetworkManager.Device.Macsec.c \
+	introspection/org.freedesktop.NetworkManager.Device.Macsec.h \
 	introspection/org.freedesktop.NetworkManager.Device.Macvlan.c \
 	introspection/org.freedesktop.NetworkManager.Device.Macvlan.h \
 	introspection/org.freedesktop.NetworkManager.Device.Modem.c \
@@ -262,6 +264,7 @@ DBUS_INTERFACE_DOCS = \
 	docs/api/dbus-org.freedesktop.NetworkManager.Device.Vxlan.xml \
 	docs/api/dbus-org.freedesktop.NetworkManager.Settings.Connection.xml \
 	docs/api/dbus-org.freedesktop.NetworkManager.Device.Bond.xml \
+	docs/api/dbus-org.freedesktop.NetworkManager.Device.Macsec.xml \
 	docs/api/dbus-org.freedesktop.NetworkManager.Device.Macvlan.xml \
 	docs/api/dbus-org.freedesktop.NetworkManager.PPP.xml \
 	docs/api/dbus-org.freedesktop.NetworkManager.Device.Vlan.xml \
@@ -313,6 +316,7 @@ dbusinterfaces_DATA = \
 	introspection/org.freedesktop.NetworkManager.Device.Generic.xml \
 	introspection/org.freedesktop.NetworkManager.Device.Infiniband.xml \
 	introspection/org.freedesktop.NetworkManager.Device.IPTunnel.xml \
+	introspection/org.freedesktop.NetworkManager.Device.Macsec.xml \
 	introspection/org.freedesktop.NetworkManager.Device.Macvlan.xml \
 	introspection/org.freedesktop.NetworkManager.Device.Modem.xml \
 	introspection/org.freedesktop.NetworkManager.Device.OlpcMesh.xml \
@@ -375,6 +379,7 @@ libnm_core_lib_h_pub_real = \
 	libnm-core/nm-setting-ip-tunnel.h \
 	libnm-core/nm-setting-ip4-config.h \
 	libnm-core/nm-setting-ip6-config.h \
+	libnm-core/nm-setting-macsec.h \
 	libnm-core/nm-setting-macvlan.h \
 	libnm-core/nm-setting-olpc-mesh.h \
 	libnm-core/nm-setting-ppp.h \
@@ -437,6 +442,7 @@ libnm_core_lib_c_real = \
 	libnm-core/nm-setting-ip-tunnel.c \
 	libnm-core/nm-setting-ip4-config.c \
 	libnm-core/nm-setting-ip6-config.c \
+	libnm-core/nm-setting-macsec.c \
 	libnm-core/nm-setting-macvlan.c \
 	libnm-core/nm-setting-olpc-mesh.c \
 	libnm-core/nm-setting-ppp.c \
@@ -668,6 +674,7 @@ libnm_lib_h_pub_real = \
 	libnm/nm-device-generic.h \
 	libnm/nm-device-infiniband.h \
 	libnm/nm-device-ip-tunnel.h \
+	libnm/nm-device-macsec.h \
 	libnm/nm-device-macvlan.h \
 	libnm/nm-device-modem.h \
 	libnm/nm-device-olpc-mesh.h \
@@ -717,6 +724,7 @@ libnm_lib_c_real = \
 	libnm/nm-device-generic.c \
 	libnm/nm-device-infiniband.c \
 	libnm/nm-device-ip-tunnel.c \
+	libnm/nm-device-macsec.c \
 	libnm/nm-device-macvlan.c \
 	libnm/nm-device-modem.c \
 	libnm/nm-device-olpc-mesh.c \
@@ -1291,6 +1299,8 @@ src_libNetworkManager_la_SOURCES = \
 	src/devices/nm-device-infiniband.h \
 	src/devices/nm-device-ip-tunnel.c \
 	src/devices/nm-device-ip-tunnel.h \
+	src/devices/nm-device-macsec.c \
+	src/devices/nm-device-macsec.h \
 	src/devices/nm-device-macvlan.c \
 	src/devices/nm-device-macvlan.h \
 	src/devices/nm-device-tun.c \
diff --git a/clients/cli/connections.c b/clients/cli/connections.c
index 851ed85f21..02f5ed9e4e 100644
--- a/clients/cli/connections.c
+++ b/clients/cli/connections.c
@@ -169,9 +169,10 @@ NmcOutputField nmc_fields_settings_names[] = {
 	SETTING_FIELD (NM_SETTING_DCB_SETTING_NAME,               nmc_fields_setting_dcb + 1),               /* 24 */
 	SETTING_FIELD (NM_SETTING_TUN_SETTING_NAME,               nmc_fields_setting_tun + 1),               /* 25 */
 	SETTING_FIELD (NM_SETTING_IP_TUNNEL_SETTING_NAME,         nmc_fields_setting_ip_tunnel + 1),         /* 26 */
-	SETTING_FIELD (NM_SETTING_MACVLAN_SETTING_NAME,           nmc_fields_setting_macvlan + 1),           /* 27 */
-	SETTING_FIELD (NM_SETTING_VXLAN_SETTING_NAME,             nmc_fields_setting_vxlan + 1),             /* 28 */
-	SETTING_FIELD (NM_SETTING_PROXY_SETTING_NAME,             nmc_fields_setting_proxy + 1),             /* 29 */
+	SETTING_FIELD (NM_SETTING_MACSEC_SETTING_NAME,            nmc_fields_setting_macsec + 1),            /* 27 */
+	SETTING_FIELD (NM_SETTING_MACVLAN_SETTING_NAME,           nmc_fields_setting_macvlan + 1),           /* 28 */
+	SETTING_FIELD (NM_SETTING_VXLAN_SETTING_NAME,             nmc_fields_setting_vxlan + 1),             /* 29 */
+	SETTING_FIELD (NM_SETTING_PROXY_SETTING_NAME,             nmc_fields_setting_proxy + 1),             /* 30 */
 	{NULL, NULL, 0, NULL, NULL, FALSE, FALSE, 0}
 };
 #define NMC_FIELDS_SETTINGS_NAMES_ALL_X  NM_SETTING_CONNECTION_SETTING_NAME","\
@@ -200,6 +201,7 @@ NmcOutputField nmc_fields_settings_names[] = {
                                          NM_SETTING_DCB_SETTING_NAME"," \
                                          NM_SETTING_TUN_SETTING_NAME"," \
                                          NM_SETTING_IP_TUNNEL_SETTING_NAME"," \
+                                         NM_SETTING_MACSEC_SETTING_NAME"," \
                                          NM_SETTING_MACVLAN_SETTING_NAME"," \
                                          NM_SETTING_VXLAN_SETTING_NAME"," \
                                          NM_SETTING_PROXY_SETTING_NAME
@@ -450,6 +452,11 @@ usage_connection_add (void)
 	              "                  remote <remote endpoint IP>\n"
 	              "                  [local <local endpoint IP>]\n"
 	              "                  [dev <parent device (ifname or connection UUID)>]\n\n"
+	              "    macsec:       dev <parent device (connection UUID, ifname, or MAC)>\n"
+	              "                  mode <psk|eap>\n"
+	              "                  [cak <key> ckn <key>]\n"
+	              "                  [encrypt yes|no]\n"
+	              "                  [port 1-65534]\n\n\n"
 	              "    macvlan:      dev <parent device (connection UUID, ifname, or MAC)>\n"
 	              "                  mode vepa|bridge|private|passthru|source\n"
 	              "                  [tap yes|no]\n\n"
@@ -3028,6 +3035,14 @@ static const NameItem nmc_ip_tunnel_settings [] = {
 	{ NULL, NULL, NULL, FALSE }
 };
 
+static const NameItem nmc_macsec_settings [] = {
+	{ NM_SETTING_CONNECTION_SETTING_NAME, NULL,       NULL, TRUE  },
+	{ NM_SETTING_WIRED_SETTING_NAME,      "ethernet", NULL, FALSE },
+	{ NM_SETTING_802_1X_SETTING_NAME,     NULL,       NULL, FALSE },
+	{ NM_SETTING_MACSEC_SETTING_NAME,     NULL,       NULL, TRUE  },
+	{ NULL, NULL, NULL, FALSE }
+};
+
 static const NameItem nmc_macvlan_settings [] = {
 	{ NM_SETTING_CONNECTION_SETTING_NAME, NULL,       NULL, TRUE  },
 	{ NM_SETTING_WIRED_SETTING_NAME,      "ethernet", NULL, FALSE },
@@ -3066,6 +3081,7 @@ static const NameItem nmc_valid_connection_types[] = {
 	{ "no-slave",                         NULL,        nmc_no_slave_settings     },
 	{ NM_SETTING_TUN_SETTING_NAME,        NULL,        nmc_tun_settings          },
 	{ NM_SETTING_IP_TUNNEL_SETTING_NAME,  NULL,        nmc_ip_tunnel_settings    },
+	{ NM_SETTING_MACSEC_SETTING_NAME,     NULL,        nmc_macsec_settings       },
 	{ NM_SETTING_MACVLAN_SETTING_NAME,    NULL,        nmc_macvlan_settings      },
 	{ NM_SETTING_VXLAN_SETTING_NAME,      NULL,        nmc_vxlan_settings        },
 	{ NULL, NULL, NULL }
@@ -3878,6 +3894,17 @@ gen_func_ip_tunnel_mode (const char *text, int state)
 }
 
 static char *
+gen_func_macsec_mode (const char *text, int state)
+{
+	gs_free const char **words = NULL;
+
+	words = nm_utils_enum_get_values (nm_setting_macsec_mode_get_type (),
+	                                  G_MININT,
+	                                  G_MAXINT);
+	return nmc_rl_gen_func_basic (text, state, words);
+}
+
+static char *
 gen_func_macvlan_mode (const char *text, int state)
 {
 	gs_free const char **words = NULL;
@@ -4292,6 +4319,13 @@ static OptionInfo option_info[] = {
 	{ NM_SETTING_ADSL_SETTING_NAME,         NM_SETTING_ADSL_PASSWORD,               "password",     OPTION_NONE, N_("Password [none]"), NULL, NULL, NULL },
 	{ NM_SETTING_ADSL_SETTING_NAME,         NM_SETTING_ADSL_ENCAPSULATION,          "encapsulation", OPTION_NONE, PROMPT_ADSL_ENCAP, PROMPT_ADSL_ENCAP_CHOICES,
                                                                                                         NULL, gen_func_adsl_encap },
+	{ NM_SETTING_MACSEC_SETTING_NAME,       NM_SETTING_MACSEC_PARENT,               "dev",          OPTION_REQD, N_("MACsec parent device or connection UUID"), NULL, NULL, NULL },
+	{ NM_SETTING_MACSEC_SETTING_NAME,       NM_SETTING_MACSEC_MODE,                 "mode",         OPTION_REQD, N_("Mode"), NULL, NULL, gen_func_macsec_mode },
+	{ NM_SETTING_MACSEC_SETTING_NAME,       NM_SETTING_MACSEC_ENCRYPT,              "encrypt",      OPTION_NONE, N_("Enable encryption [yes]"), NULL, set_yes_no, gen_func_bool_values_l10n },
+	{ NM_SETTING_MACSEC_SETTING_NAME,       NM_SETTING_MACSEC_MKA_CAK,              "cak",          OPTION_NONE, N_("MKA CAK"), NULL, NULL, NULL },
+	{ NM_SETTING_MACSEC_SETTING_NAME,       NM_SETTING_MACSEC_MKA_CKN,              "ckn",          OPTION_NONE, N_("MKA_CKN"), NULL, NULL, NULL },
+	{ NM_SETTING_MACSEC_SETTING_NAME,       NM_SETTING_MACSEC_PORT,                 "port",         OPTION_NONE, N_("SCI port [1]"), NULL, NULL, NULL },
+
 	{ NM_SETTING_MACVLAN_SETTING_NAME,      NM_SETTING_MACVLAN_PARENT,              "dev",          OPTION_REQD, N_("MACVLAN parent device or connection UUID"), NULL,
                                                                                                         NULL, nmc_rl_gen_func_ifnames },
 	{ NM_SETTING_MACVLAN_SETTING_NAME,      NM_SETTING_MACVLAN_MODE,                "mode",         OPTION_REQD, PROMPT_MACVLAN_MODE, NULL,
@@ -4823,6 +4857,8 @@ setting_name_to_name (const char *name)
 		return _("OLPC Mesh connection");
 	if (strcmp (name, NM_SETTING_ADSL_SETTING_NAME) == 0)
 		return _("ADSL connection");
+	if (strcmp (name, NM_SETTING_MACSEC_SETTING_NAME) == 0)
+		return _("MACsec connection");
 	if (strcmp (name, NM_SETTING_MACVLAN_SETTING_NAME) == 0)
 		return _("macvlan connection");
 	if (strcmp (name, NM_SETTING_VXLAN_SETTING_NAME) == 0)
diff --git a/clients/cli/settings.c b/clients/cli/settings.c
index c88892383a..5b5822610b 100644
--- a/clients/cli/settings.c
+++ b/clients/cli/settings.c
@@ -743,6 +743,29 @@ NmcOutputField nmc_fields_setting_ip_tunnel[] = {
                                               NM_SETTING_IP_TUNNEL_FLOW_LABEL","\
                                               NM_SETTING_IP_TUNNEL_MTU
 
+/* Available fields for NM_SETTING_MACSEC_SETTING_NAME */
+NmcOutputField nmc_fields_setting_macsec[] = {
+	SETTING_FIELD ("name"),                                 /* 0 */
+	SETTING_FIELD (NM_SETTING_MACSEC_PARENT),               /* 1 */
+	SETTING_FIELD (NM_SETTING_MACSEC_MODE),                 /* 2 */
+	SETTING_FIELD (NM_SETTING_MACSEC_ENCRYPT),              /* 3 */
+	SETTING_FIELD (NM_SETTING_MACSEC_MKA_CAK),              /* 4 */
+	SETTING_FIELD (NM_SETTING_MACSEC_MKA_CAK_FLAGS),        /* 5 */
+	SETTING_FIELD (NM_SETTING_MACSEC_MKA_CKN),              /* 6 */
+	SETTING_FIELD (NM_SETTING_MACSEC_PORT),                 /* 7 */
+	SETTING_FIELD (NM_SETTING_MACSEC_VALIDATION),           /* 8 */
+	{NULL, NULL, 0, NULL, FALSE, FALSE, 0}
+};
+#define NMC_FIELDS_SETTING_MACSEC_ALL     "name"","\
+                                           NM_SETTING_MACSEC_PARENT","\
+                                           NM_SETTING_MACSEC_MODE","\
+                                           NM_SETTING_MACSEC_ENCRYPT","\
+                                           NM_SETTING_MACSEC_MKA_CAK","\
+                                           NM_SETTING_MACSEC_MKA_CAK_FLAGS","\
+                                           NM_SETTING_MACSEC_MKA_CKN","\
+                                           NM_SETTING_MACSEC_PORT","\
+                                           NM_SETTING_MACSEC_VALIDATION
+
 /* Available fields for NM_SETTING_MACVLAN_SETTING_NAME */
 NmcOutputField nmc_fields_setting_macvlan[] = {
 	SETTING_FIELD ("name"),                                 /* 0 */
@@ -2115,6 +2138,94 @@ nmc_property_wifi_sec_get_wep_key_type (NMSetting *setting, NmcPropertyGetType g
 	return wep_key_type_to_string (nm_setting_wireless_security_get_wep_key_type (s_wireless_sec));
 }
 
+/* --- NM_SETTING_MACSEC_SETTING_NAME property get functions --- */
+DEFINE_GETTER (nmc_property_macsec_get_parent, NM_SETTING_MACSEC_PARENT)
+DEFINE_GETTER (nmc_property_macsec_get_encrypt, NM_SETTING_MACSEC_ENCRYPT)
+DEFINE_GETTER (nmc_property_macsec_get_mka_cak, NM_SETTING_MACSEC_MKA_CAK)
+DEFINE_SECRET_FLAGS_GETTER (nmc_property_macsec_get_mka_cak_flags, NM_SETTING_MACSEC_MKA_CAK_FLAGS)
+DEFINE_GETTER (nmc_property_macsec_get_mka_ckn, NM_SETTING_MACSEC_MKA_CKN)
+DEFINE_GETTER (nmc_property_macsec_get_port, NM_SETTING_MACSEC_PORT)
+
+/* 'mode' */
+static char *
+nmc_property_macsec_get_mode (NMSetting *setting, NmcPropertyGetType get_type)
+{
+	NMSettingMacsec *s_macsec = NM_SETTING_MACSEC (setting);
+	NMSettingMacsecMode mode;
+
+	mode = nm_setting_macsec_get_mode (s_macsec);
+	return nm_utils_enum_to_str (nm_setting_macsec_mode_get_type (), mode);
+}
+
+
+static gboolean
+nmc_property_macsec_set_mode (NMSetting *setting, const char *prop,
+                              const char *val, GError **error)
+{
+	NMSettingMacsecMode mode;
+	gs_free char *options = NULL;
+
+	if (!nm_utils_enum_from_str (nm_setting_macsec_mode_get_type (), val,
+	                             (int *) &mode, NULL)) {
+		options = g_strjoinv (",",
+		                      (char **) nm_utils_enum_get_values (nm_setting_macsec_mode_get_type (),
+		                                                          G_MININT,
+		                                                          G_MAXINT));
+		g_set_error (error, 1, 0, _("invalid option '%s', use one of [%s]"),
+		             val, options);
+			return FALSE;
+	}
+
+	g_object_set (setting, prop, mode, NULL);
+	return TRUE;
+}
+
+/* 'mode' */
+static char *
+nmc_property_macsec_get_validation (NMSetting *setting, NmcPropertyGetType get_type)
+{
+	NMSettingMacsec *s_macsec = NM_SETTING_MACSEC (setting);
+	NMSettingMacsecValidation validation;
+
+	validation = nm_setting_macsec_get_validation (s_macsec);
+	return nm_utils_enum_to_str (nm_setting_macsec_validation_get_type (), validation);
+}
+
+
+static gboolean
+nmc_property_macsec_set_validation (NMSetting *setting, const char *prop,
+                                    const char *val, GError **error)
+{
+	NMSettingMacsecMode validation;
+	gs_free char *options = NULL;
+
+	if (!nm_utils_enum_from_str (nm_setting_macsec_validation_get_type (), val,
+	                             (int *) &validation, NULL)) {
+		options = g_strjoinv (",",
+		                      (char **) nm_utils_enum_get_values (nm_setting_macsec_validation_get_type (),
+		                                                          G_MININT,
+		                                                          G_MAXINT));
+		g_set_error (error, 1, 0, _("invalid option '%s', use one of [%s]"),
+		             val, options);
+			return FALSE;
+	}
+
+	g_object_set (setting, prop, validation, NULL);
+	return TRUE;
+}
+
+static const char **
+nmc_property_macsec_allowed_validation (NMSetting *setting, const char *prop)
+{
+	static const char **words = NULL;
+
+	if (!words)
+		words = nm_utils_enum_get_values (nm_setting_macsec_validation_get_type(),
+		                                  G_MININT,
+		                                  G_MAXINT);
+	return words;
+}
+
 /* --- NM_SETTING_MACVLAN_SETTING_NAME property get functions --- */
 DEFINE_GETTER (nmc_property_macvlan_get_parent, NM_SETTING_MACVLAN_PARENT)
 DEFINE_GETTER (nmc_property_macvlan_get_promiscuous, NM_SETTING_MACVLAN_PROMISCUOUS)
@@ -7836,6 +7947,64 @@ nmc_properties_init (void)
 	                    NULL,
 	                    NULL);
 
+	/* Add editable properties for NM_SETTING_MACSEC_SETTING_NAME */
+	nmc_add_prop_funcs (GLUE (MACSEC, PARENT),
+	                    nmc_property_macsec_get_parent,
+	                    nmc_property_set_string,
+	                    NULL,
+	                    NULL,
+	                    NULL,
+	                    NULL);
+	nmc_add_prop_funcs (GLUE (MACSEC, MODE),
+	                    nmc_property_macsec_get_mode,
+	                    nmc_property_macsec_set_mode,
+	                    NULL,
+	                    NULL,
+	                    NULL,
+	                    NULL);
+	nmc_add_prop_funcs (GLUE (MACSEC, ENCRYPT),
+	                    nmc_property_macsec_get_encrypt,
+	                    nmc_property_set_bool,
+	                    NULL,
+	                    NULL,
+	                    NULL,
+	                    NULL);
+	nmc_add_prop_funcs (GLUE (MACSEC, MKA_CAK),
+	                    nmc_property_macsec_get_mka_cak,
+	                    nmc_property_set_string,
+	                    NULL,
+	                    NULL,
+	                    NULL,
+	                    NULL);
+	nmc_add_prop_funcs (GLUE (MACSEC, MKA_CAK_FLAGS),
+	                    nmc_property_macsec_get_mka_cak_flags,
+	                    nmc_property_set_secret_flags,
+	                    NULL,
+	                    NULL,
+	                    NULL,
+	                    NULL);
+	nmc_add_prop_funcs (GLUE (MACSEC, MKA_CKN),
+	                    nmc_property_macsec_get_mka_ckn,
+	                    nmc_property_set_string,
+	                    NULL,
+	                    NULL,
+	                    NULL,
+	                    NULL);
+	nmc_add_prop_funcs (GLUE (MACSEC, PORT),
+	                    nmc_property_macsec_get_port,
+	                    nmc_property_set_int,
+	                    NULL,
+	                    NULL,
+	                    NULL,
+	                    NULL);
+	nmc_add_prop_funcs (GLUE (MACSEC, VALIDATION),
+	                    nmc_property_macsec_get_validation,
+	                    nmc_property_macsec_set_validation,
+	                    NULL,
+	                    NULL,
+	                    nmc_property_macsec_allowed_validation,
+	                    NULL);
+
 	/* Add editable properties for NM_SETTING_MACVLAN_SETTING_NAME */
 	nmc_add_prop_funcs (GLUE (MACVLAN, PARENT),
 	                    nmc_property_macvlan_get_parent,
@@ -9233,6 +9402,39 @@ setting_ip_tunnel_details (NMSetting *setting, NmCli *nmc,  const char *one_prop
 }
 
 static gboolean
+setting_macsec_details (NMSetting *setting, NmCli *nmc,  const char *one_prop, gboolean secrets)
+{
+	NMSettingMacsec *s_macsec = NM_SETTING_MACSEC (setting);
+	NmcOutputField *tmpl, *arr;
+	size_t tmpl_len;
+
+	g_return_val_if_fail (NM_IS_SETTING_MACSEC (s_macsec), FALSE);
+
+	tmpl = nmc_fields_setting_macsec;
+	tmpl_len = sizeof (nmc_fields_setting_macsec);
+	nmc->print_fields.indices = parse_output_fields (one_prop ? one_prop : NMC_FIELDS_SETTING_MACSEC_ALL,
+	                                                 tmpl, FALSE, NULL, NULL);
+	arr = nmc_dup_fields_array (tmpl, tmpl_len, NMC_OF_FLAG_FIELD_NAMES);
+	g_ptr_array_add (nmc->output_data, arr);
+
+	arr = nmc_dup_fields_array (tmpl, tmpl_len, NMC_OF_FLAG_SECTION_PREFIX);
+	set_val_str (arr, 0, g_strdup (nm_setting_get_name (setting)));
+	set_val_str (arr, 1, nmc_property_macsec_get_parent (setting, NMC_PROPERTY_GET_PRETTY));
+	set_val_str (arr, 2, nmc_property_macsec_get_mode (setting, NMC_PROPERTY_GET_PRETTY));
+	set_val_str (arr, 3, nmc_property_macsec_get_encrypt (setting, NMC_PROPERTY_GET_PRETTY));
+	set_val_str (arr, 4, GET_SECRET (secrets, setting, nmc_property_macsec_get_mka_cak));
+	set_val_str (arr, 5, nmc_property_macsec_get_mka_cak_flags (setting, NMC_PROPERTY_GET_PRETTY));
+	set_val_str (arr, 6, nmc_property_macsec_get_mka_ckn (setting, NMC_PROPERTY_GET_PRETTY));
+	set_val_str (arr, 7, nmc_property_macsec_get_port (setting, NMC_PROPERTY_GET_PRETTY));
+	set_val_str (arr, 8, nmc_property_macsec_get_validation (setting, NMC_PROPERTY_GET_PRETTY));
+	g_ptr_array_add (nmc->output_data, arr);
+
+	print_data (nmc);  /* Print all data */
+
+	return TRUE;
+}
+
+static gboolean
 setting_macvlan_details (NMSetting *setting, NmCli *nmc,  const char *one_prop, gboolean secrets)
 {
 	NMSettingMacvlan *s_macvlan = NM_SETTING_MACVLAN (setting);
@@ -9364,6 +9566,7 @@ static const SettingDetails detail_printers[] = {
 	{ NM_SETTING_DCB_SETTING_NAME,               setting_dcb_details },
 	{ NM_SETTING_TUN_SETTING_NAME,               setting_tun_details },
 	{ NM_SETTING_IP_TUNNEL_SETTING_NAME,         setting_ip_tunnel_details },
+	{ NM_SETTING_MACSEC_SETTING_NAME,            setting_macsec_details },
 	{ NM_SETTING_MACVLAN_SETTING_NAME,           setting_macvlan_details },
 	{ NM_SETTING_VXLAN_SETTING_NAME,             setting_vxlan_details },
 	{ NM_SETTING_PROXY_SETTING_NAME,             setting_proxy_details },
diff --git a/clients/cli/settings.h b/clients/cli/settings.h
index 9ef9c270d2..ad503f9ef6 100644
--- a/clients/cli/settings.h
+++ b/clients/cli/settings.h
@@ -92,6 +92,7 @@ extern NmcOutputField nmc_fields_setting_dcb[];
 extern NmcOutputField nmc_fields_setting_tun[];
 extern NmcOutputField nmc_fields_setting_ip_tunnel[];
 extern NmcOutputField nmc_fields_setting_macvlan[];
+extern NmcOutputField nmc_fields_setting_macsec[];
 extern NmcOutputField nmc_fields_setting_vxlan[];
 extern NmcOutputField nmc_fields_setting_proxy[];
 
diff --git a/clients/common/nm-secret-agent-simple.c b/clients/common/nm-secret-agent-simple.c
index 4e59f489f0..b763bf8985 100644
--- a/clients/common/nm-secret-agent-simple.c
+++ b/clients/common/nm-secret-agent-simple.c
@@ -492,7 +492,7 @@ request_secrets_from_ui (NMSecretAgentSimpleRequest *request)
 			secret = nm_secret_agent_simple_secret_new (_("PIN"),
 			                                            NM_SETTING (s_gsm),
 			                                            NM_SETTING_GSM_PIN,
-								    NULL,
+			                                            NULL,
 			                                            NULL,
 			                                            FALSE);
 			g_ptr_array_add (secrets, secret);
@@ -509,6 +509,25 @@ request_secrets_from_ui (NMSecretAgentSimpleRequest *request)
 			                                            TRUE);
 			g_ptr_array_add (secrets, secret);
 		}
+	} else if (nm_connection_is_type (request->connection, NM_SETTING_MACSEC_SETTING_NAME)) {
+		NMSettingMacsec *s_macsec = nm_connection_get_setting_macsec (request->connection);
+
+		msg = g_strdup_printf (_("Secrets are required to access the MACsec network '%s'"),
+		                       nm_connection_get_id (request->connection));
+
+		if (nm_setting_macsec_get_mode (s_macsec) == NM_SETTING_MACSEC_MODE_PSK) {
+			title = _("MACsec PSK authentication");
+			secret = nm_secret_agent_simple_secret_new (_("MKA CAK"),
+			                                            NM_SETTING (s_macsec),
+			                                            NM_SETTING_MACSEC_MKA_CAK,
+			                                            NULL,
+			                                            NULL,
+			                                            TRUE);
+			g_ptr_array_add (secrets, secret);
+		} else {
+			title = _("MACsec EAP authentication");
+			ok = add_8021x_secrets (request, secrets);
+		}
 	} else if (nm_connection_is_type (request->connection, NM_SETTING_CDMA_SETTING_NAME)) {
 		NMSettingCdma *s_cdma = nm_connection_get_setting_cdma (request->connection);
 
diff --git a/contrib/scripts/test-macsec b/contrib/scripts/test-macsec
new file mode 100755
index 0000000000..60f207bb05
--- /dev/null
+++ b/contrib/scripts/test-macsec
@@ -0,0 +1,102 @@
+#!/bin/sh
+
+# Test for MACsec in PSK mode
+
+if [ "$#" = 2 ]; then
+    # DHCP helper
+    dev=$1
+    addr=$2
+    net=${addr%.*}
+
+    while [ ! -d "/sys/class/net/$dev" ]; do
+	    sleep 1
+    done
+
+    ip a add $addr/24 dev "$dev"
+
+    dnsmasq --conf-file --no-hosts --keep-in-foreground --listen-address=$addr \
+            --dhcp-range=$net.250,$net.255,60m  -i "$dev" \
+            --bind-interface --except-interface=lo
+
+    exit 0
+fi
+
+TMPDIR=$(mktemp -d /tmp/macsec-XXXXXX)
+ADDR=172.16.10.1
+MKA_CAK=00112233445566778899001122334455
+MKA_CKN=5544332211009988776655443322110055443322110099887766554433221100
+
+trap 'rm -rf "$TMPDIR"; kill $(jobs -p)' EXIT
+
+echo "* Setup..."
+
+# Clean up
+ip netns del macsec-ns 2> /dev/null
+ip link del macsec-veth 2> /dev/null
+# Create namespace
+ip netns add macsec-ns
+# Create interfaces
+ip link add macsec-veth type veth peer name macsec-vethp
+# Move interfaces into namespace
+ip link set macsec-vethp netns macsec-ns
+# Bring up interfaces
+ip link set macsec-veth up
+ip -n macsec-ns link set macsec-vethp up
+
+echo "* Start wpa_supplicant..."
+
+cat <<EOF > $TMPDIR/wpa_supplicant.conf
+ctrl_interface=/var/run/hostapd1
+eapol_version=3
+ap_scan=0
+fast_reauth=1
+network={
+	key_mgmt=NONE
+	eapol_flags=0
+	macsec_policy=1
+	mka_cak=$MKA_CAK
+	mka_ckn=$MKA_CKN
+}
+EOF
+ip netns exec macsec-ns wpa_supplicant \
+   -c "$TMPDIR/wpa_supplicant.conf" -i macsec-vethp -Dmacsec_linux -dd > /dev/null 2>&1 &
+ip netns exec macsec-ns $0 macsec0 $ADDR > /dev/null 2>&1 &
+
+echo "* Create connections..."
+
+nmcli connection delete test-macsec+ test-veth+ > /dev/null 2>&1
+nmcli connection add type ethernet ifname macsec-veth con-name test-veth+ \
+      ipv4.method disabled ipv6.method ignore
+nmcli connection add type macsec con-name test-macsec+ ifname macsec0 \
+      connection.autoconnect no \
+      macsec.parent macsec-veth macsec.mode psk \
+      macsec.mka-cak $MKA_CAK \
+      macsec.mka-cak-flags 0 \
+      macsec.mka-ckn $MKA_CKN
+
+echo "* Bring up connections..."
+nmcli connection up test-veth+
+nmcli connection up test-macsec+
+
+echo "* Test connectivity..."
+ping $ADDR -c2 -q > /dev/null
+res=$?
+
+echo "* Clean up..."
+
+nmcli connection delete test-macsec+ test-veth+ > /dev/null 2>&1
+ip link del macsec-veth 2> /dev/null
+ip netns del macsec-ns 2> /dev/null
+
+echo
+
+if [ "$res" = 0 ]; then
+	echo "Success"
+else
+	echo "Failure"
+fi
+
+exit $res
+
+
+
diff --git a/docs/api/Makefile.am b/docs/api/Makefile.am
index 18cb167dc7..bb54fb35ea 100644
--- a/docs/api/Makefile.am
+++ b/docs/api/Makefile.am
@@ -55,6 +55,7 @@ content_files = \
 	dbus-org.freedesktop.NetworkManager.Settings.Connection.xml \
 	dbus-org.freedesktop.NetworkManager.Device.Bond.xml \
 	dbus-org.freedesktop.NetworkManager.Device.Macvlan.xml \
+	dbus-org.freedesktop.NetworkManager.Device.Macsec.xml \
 	dbus-org.freedesktop.NetworkManager.PPP.xml \
 	dbus-org.freedesktop.NetworkManager.Device.Vlan.xml \
 	dbus-org.freedesktop.NetworkManager.Device.Adsl.xml \
diff --git a/docs/api/network-manager-docs.xml b/docs/api/network-manager-docs.xml
index 51ac3d1483..45164ce068 100644
--- a/docs/api/network-manager-docs.xml
+++ b/docs/api/network-manager-docs.xml
@@ -82,6 +82,7 @@
       <xi:include href="dbus-org.freedesktop.NetworkManager.Device.Generic.xml"/>
       <xi:include href="dbus-org.freedesktop.NetworkManager.Device.Infiniband.xml"/>
       <xi:include href="dbus-org.freedesktop.NetworkManager.Device.IPTunnel.xml"/>
+      <xi:include href="dbus-org.freedesktop.NetworkManager.Device.Macsec.xml"/>
       <xi:include href="dbus-org.freedesktop.NetworkManager.Device.Macvlan.xml"/>
       <xi:include href="dbus-org.freedesktop.NetworkManager.Device.Modem.xml"/>
       <xi:include href="dbus-org.freedesktop.NetworkManager.Device.OlpcMesh.xml"/>
diff --git a/introspection/org.freedesktop.NetworkManager.Device.Macsec.xml b/introspection/org.freedesktop.NetworkManager.Device.Macsec.xml
new file mode 100644
index 0000000000..e67f937cbb
--- /dev/null
+++ b/introspection/org.freedesktop.NetworkManager.Device.Macsec.xml
@@ -0,0 +1,113 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<node name="/">
+  <interface name="org.freedesktop.NetworkManager.Device.Macsec">
+
+    <!--
+        Parent:
+
+        The object path of the parent device.
+    -->
+    <property name="Parent" type="o" access="read"/>
+
+    <!--
+        Sci:
+
+        The Secure Channel Identifier in use.
+    -->
+    <property name="Sci" type="t" access="read"/>
+
+    <!--
+        IcvLength:
+
+        The length of ICV (Integrity Check Value).
+    -->
+    <property name="IcvLength" type="y" access="read"/>
+
+    <!--
+        CipherSuite:
+
+        The set of cryptographic algorithms in use
+        (e.g. 0x0080020001000001 for GCM-AES-128).
+    -->
+    <property name="CipherSuite" type="t" access="read"/>
+
+    <!--
+        Window:
+
+        The size of the replay window.
+    -->
+    <property name="Window" type="u" access="read"/>
+
+    <!--
+        EncodingSa:
+
+        The value of the Association Number (0..3) for the Security
+        Association in use.
+    -->
+    <property name="EncodingSa" type="y" access="read"/>
+
+    <!--
+        Validation:
+
+        The validation mode for incoming packets (strict, check,
+        disabled).
+    -->
+    <property name="Validation" type="s" access="read"/>
+
+    <!--
+        Encrypt:
+
+        Whether encryption of transmitted frames is enabled.
+    -->
+    <property name="Encrypt" type="b" access="read"/>
+
+    <!--
+        Protect:
+
+        Whether protection of transmitted frames is enabled.
+    -->
+    <property name="Protect" type="b" access="read"/>
+
+    <!--
+        IncludeSci:
+
+        Whether the SCI is always included in SecTAG for transmitted
+        frames.
+
+    -->
+    <property name="IncludeSci" type="b" access="read"/>
+
+    <!--
+        Es:
+
+        Whether the ES (End station) bit is enabled in SecTAG for
+        transmitted frames.
+    -->
+    <property name="Es" type="b" access="read"/>
+
+    <!--
+        Scb:
+
+        Whether the SCB (Single Copy Broadcast) bit is enabled in
+        SecTAG for transmitted frames.
+    -->
+    <property name="Scb" type="b" access="read"/>
+
+    <!--
+        ReplayProtect:
+
+        Whether replay protection is enabled.
+    -->
+    <property name="ReplayProtect" type="b" access="read"/>
+
+    <!--
+        PropertiesChanged:
+        @properties: A dictionary mapping property names to variant boxed values
+
+        DEPRECATED. Use the standard "PropertiesChanged" signal from "org.freedesktop.DBus.Properties" instead which exists since version NetworkManager 1.2.0.
+    -->
+    <signal name="PropertiesChanged">
+      <arg name="properties" type="a{sv}"/>
+    </signal>
+  </interface>
+</node>
diff --git a/libnm-core/nm-connection.c b/libnm-core/nm-connection.c
index 923df3d976..40322427b4 100644
--- a/libnm-core/nm-connection.c
+++ b/libnm-core/nm-connection.c
@@ -1850,6 +1850,7 @@ nm_connection_is_virtual (NMConnection *connection)
 	    || !strcmp (type, NM_SETTING_VLAN_SETTING_NAME)
 	    || !strcmp (type, NM_SETTING_TUN_SETTING_NAME)
 	    || !strcmp (type, NM_SETTING_IP_TUNNEL_SETTING_NAME)
+	    || !strcmp (type, NM_SETTING_MACSEC_SETTING_NAME)
 	    || !strcmp (type, NM_SETTING_MACVLAN_SETTING_NAME)
 	    || !strcmp (type, NM_SETTING_VXLAN_SETTING_NAME))
 		return TRUE;
@@ -2162,6 +2163,24 @@ nm_connection_get_setting_ip6_config (NMConnection *connection)
 }
 
 /**
+ * nm_connection_get_setting_macsec:
+ * @connection: the #NMConnection
+ *
+ * A shortcut to return any #NMSettingMacsec the connection might contain.
+ *
+ * Returns: (transfer none): an #NMSettingMacsec if the connection contains one, otherwise %NULL
+ *
+ * Since: 1.6
+ **/
+NMSettingMacsec *
+nm_connection_get_setting_macsec (NMConnection *connection)
+{
+	g_return_val_if_fail (NM_IS_CONNECTION (connection), NULL);
+
+	return (NMSettingMacsec *) nm_connection_get_setting (connection, NM_TYPE_SETTING_MACSEC);
+}
+
+/**
  * nm_connection_get_setting_macvlan:
  * @connection: the #NMConnection
  *
diff --git a/libnm-core/nm-connection.h b/libnm-core/nm-connection.h
index 4de15c9263..36ef7b6f34 100644
--- a/libnm-core/nm-connection.h
+++ b/libnm-core/nm-connection.h
@@ -206,6 +206,8 @@ NM_AVAILABLE_IN_1_2
 NMSettingIPTunnel *        nm_connection_get_setting_ip_tunnel         (NMConnection *connection);
 NMSettingIPConfig *        nm_connection_get_setting_ip4_config        (NMConnection *connection);
 NMSettingIPConfig *        nm_connection_get_setting_ip6_config        (NMConnection *connection);
+NM_AVAILABLE_IN_1_6
+NMSettingMacsec *          nm_connection_get_setting_macsec            (NMConnection *connection);
 NM_AVAILABLE_IN_1_2
 NMSettingMacvlan *         nm_connection_get_setting_macvlan           (NMConnection *connection);
 NMSettingOlpcMesh *        nm_connection_get_setting_olpc_mesh         (NMConnection *connection);
diff --git a/libnm-core/nm-core-internal.h b/libnm-core/nm-core-internal.h
index 1b4c469420..74f45100b1 100644
--- a/libnm-core/nm-core-internal.h
+++ b/libnm-core/nm-core-internal.h
@@ -52,6 +52,7 @@
 #include "nm-setting-proxy.h"
 #include "nm-setting-ip4-config.h"
 #include "nm-setting-ip6-config.h"
+#include "nm-setting-macsec.h"
 #include "nm-setting-macvlan.h"
 #include "nm-setting-olpc-mesh.h"
 #include "nm-setting-ppp.h"
diff --git a/libnm-core/nm-core-types.h b/libnm-core/nm-core-types.h
index 8e7c0ce8c6..2948b5f596 100644
--- a/libnm-core/nm-core-types.h
+++ b/libnm-core/nm-core-types.h
@@ -46,6 +46,7 @@ typedef struct _NMSettingIPTunnel         NMSettingIPTunnel;
 typedef struct _NMSettingProxy            NMSettingProxy;
 typedef struct _NMSettingIP4Config        NMSettingIP4Config;
 typedef struct _NMSettingIP6Config        NMSettingIP6Config;
+typedef struct _NMSettingMacsec           NMSettingMacsec;
 typedef struct _NMSettingMacvlan          NMSettingMacvlan;
 typedef struct _NMSettingOlpcMesh         NMSettingOlpcMesh;
 typedef struct _NMSettingPpp              NMSettingPpp;
diff --git a/libnm-core/nm-dbus-interface.h b/libnm-core/nm-dbus-interface.h
index 9ad3aad30d..d2d54f69c5 100644
--- a/libnm-core/nm-dbus-interface.h
+++ b/libnm-core/nm-dbus-interface.h
@@ -64,6 +64,7 @@
 #define NM_DBUS_INTERFACE_DEVICE_GENERIC    NM_DBUS_INTERFACE_DEVICE ".Generic"
 #define NM_DBUS_INTERFACE_DEVICE_VETH       NM_DBUS_INTERFACE_DEVICE ".Veth"
 #define NM_DBUS_INTERFACE_DEVICE_TUN        NM_DBUS_INTERFACE_DEVICE ".Tun"
+#define NM_DBUS_INTERFACE_DEVICE_MACSEC     NM_DBUS_INTERFACE_DEVICE ".Macsec"
 #define NM_DBUS_INTERFACE_DEVICE_MACVLAN    NM_DBUS_INTERFACE_DEVICE ".Macvlan"
 #define NM_DBUS_INTERFACE_DEVICE_VXLAN      NM_DBUS_INTERFACE_DEVICE ".Vxlan"
 #define NM_DBUS_INTERFACE_DEVICE_GRE        NM_DBUS_INTERFACE_DEVICE ".Gre"
@@ -169,6 +170,7 @@ typedef enum {
  * @NM_DEVICE_TYPE_MACVLAN: a MACVLAN interface
  * @NM_DEVICE_TYPE_VXLAN: a VXLAN interface
  * @NM_DEVICE_TYPE_VETH: a VETH interface
+ * @NM_DEVICE_TYPE_MACSEC: a MACsec interface
  *
  * #NMDeviceType values indicate the type of hardware represented by a
  * device object.
@@ -195,6 +197,7 @@ typedef enum {
 	NM_DEVICE_TYPE_MACVLAN    = 18,
 	NM_DEVICE_TYPE_VXLAN      = 19,
 	NM_DEVICE_TYPE_VETH       = 20,
+	NM_DEVICE_TYPE_MACSEC     = 21,
 } NMDeviceType;
 
 /**
diff --git a/libnm-core/nm-setting-macsec.c b/libnm-core/nm-setting-macsec.c
new file mode 100644
index 0000000000..60df6839f0
--- /dev/null
+++ b/libnm-core/nm-setting-macsec.c
@@ -0,0 +1,592 @@
+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
+/*
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301 USA.
+ *
+ * Copyright 2017 Red Hat, Inc.
+ */
+
+#include "nm-default.h"
+
+#include "nm-setting-macsec.h"
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "nm-utils.h"
+#include "nm-core-types-internal.h"
+#include "nm-setting-connection.h"
+#include "nm-setting-private.h"
+#include "nm-setting-wired.h"
+#include "nm-connection-private.h"
+
+/**
+ * SECTION:nm-setting-macsec
+ * @short_description: Describes connection properties for MACSEC interfaces
+ *
+ * The #NMSettingMacsec object is a #NMSetting subclass that describes properties
+ * necessary for connection to MACsec (IEEE 802.1AE) interfaces.
+ **/
+
+G_DEFINE_TYPE_WITH_CODE (NMSettingMacsec, nm_setting_macsec, NM_TYPE_SETTING,
+                         _nm_register_setting (MACSEC, 1))
+NM_SETTING_REGISTER_TYPE (NM_TYPE_SETTING_MACSEC)
+
+#define NM_SETTING_MACSEC_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), NM_TYPE_SETTING_MACSEC, NMSettingMacsecPrivate))
+
+typedef struct {
+	char *parent;
+	NMSettingMacsecMode mode;
+	gboolean encrypt;
+	char *mka_cak;
+	NMSettingSecretFlags mka_cak_flags;
+	char *mka_ckn;
+	int port;
+	NMSettingMacsecValidation validation;
+} NMSettingMacsecPrivate;
+
+NM_GOBJECT_PROPERTIES_DEFINE_BASE (
+	PROP_PARENT,
+	PROP_MODE,
+	PROP_ENCRYPT,
+	PROP_MKA_CAK,
+	PROP_MKA_CAK_FLAGS,
+	PROP_MKA_CKN,
+	PROP_PORT,
+	PROP_VALIDATION,
+);
+
+/**
+ * nm_setting_macsec_new:
+ *
+ * Creates a new #NMSettingMacsec object with default values.
+ *
+ * Returns: (transfer full): the new empty #NMSettingMacsec object
+ *
+ * Since: 1.6
+ **/
+NMSetting *
+nm_setting_macsec_new (void)
+{
+	return (NMSetting *) g_object_new (NM_TYPE_SETTING_MACSEC, NULL);
+}
+
+/**
+ * nm_setting_macsec_get_parent:
+ * @setting: the #NMSettingMacsec
+ *
+ * Returns: the #NMSettingMacsec:parent property of the setting
+ *
+ * Since: 1.6
+ **/
+const char *
+nm_setting_macsec_get_parent (NMSettingMacsec *setting)
+{
+	g_return_val_if_fail (NM_IS_SETTING_MACSEC (setting), NULL);
+	return NM_SETTING_MACSEC_GET_PRIVATE (setting)->parent;
+}
+
+/**
+ * nm_setting_macsec_get_mode:
+ * @setting: the #NMSettingMacsec
+ *
+ * Returns: the #NMSettingMacsec:mode property of the setting
+ *
+ * Since: 1.6
+ **/
+NMSettingMacsecMode
+nm_setting_macsec_get_mode (NMSettingMacsec *setting)
+{
+	g_return_val_if_fail (NM_IS_SETTING_MACSEC (setting), NM_SETTING_MACSEC_MODE_PSK);
+	return NM_SETTING_MACSEC_GET_PRIVATE (setting)->mode;
+}
+
+/**
+ * nm_setting_macsec_get_encrypt:
+ * @setting: the #NMSettingMacsec
+ *
+ * Returns: the #NMSettingMacsec:encrypt property of the setting
+ *
+ * Since: 1.6
+ **/
+gboolean
+nm_setting_macsec_get_encrypt (NMSettingMacsec *setting)
+{
+	g_return_val_if_fail (NM_IS_SETTING_MACSEC (setting), TRUE);
+	return NM_SETTING_MACSEC_GET_PRIVATE (setting)->encrypt;
+}
+
+/**
+ * nm_setting_macsec_get_mka_cak
+ * @setting: the #NMSettingMacsec
+ *
+ * Returns: the #NMSettingMacsec:mka-cak property of the setting
+ *
+ * Since: 1.6
+ **/
+const char *
+nm_setting_macsec_get_mka_cak (NMSettingMacsec *setting)
+{
+	g_return_val_if_fail (NM_IS_SETTING_MACSEC (setting), NULL);
+	return NM_SETTING_MACSEC_GET_PRIVATE (setting)->mka_cak;
+}
+
+/**
+ * nm_setting_macsec_get_mka_cak_flags:
+ * @setting: the #NMSettingMacsec
+ *
+ * Returns: the #NMSettingSecretFlags pertaining to the #NMSettingMacsec:mka-cak
+ *
+ * Since: 1.6
+ **/
+NMSettingSecretFlags
+nm_setting_macsec_get_mka_cak_flags (NMSettingMacsec *setting)
+{
+	g_return_val_if_fail (NM_IS_SETTING_MACSEC (setting), NM_SETTING_SECRET_FLAG_NONE);
+
+	return NM_SETTING_MACSEC_GET_PRIVATE (setting)->mka_cak_flags;
+}
+
+/**
+ * nm_setting_macsec_get_mka_ckn:
+ * @setting: the #NMSettingMacsec
+ *
+ * Returns: the #NMSettingMacsec:mka-ckn property of the setting
+ *
+ * Since: 1.6
+ **/
+const char *
+nm_setting_macsec_get_mka_ckn (NMSettingMacsec *setting)
+{
+	g_return_val_if_fail (NM_IS_SETTING_MACSEC (setting), NULL);
+	return NM_SETTING_MACSEC_GET_PRIVATE (setting)->mka_ckn;
+}
+
+/**
+ * nm_setting_macsec_get_port:
+ * @setting: the #NMSettingMacsec
+ *
+ * Returns: the #NMSettingMacsec:port property of the setting
+ *
+ * Since: 1.6
+ **/
+int
+nm_setting_macsec_get_port (NMSettingMacsec *setting)
+{
+	g_return_val_if_fail (NM_IS_SETTING_MACSEC (setting), 1);
+	return NM_SETTING_MACSEC_GET_PRIVATE (setting)->port;
+}
+
+/**
+ * nm_setting_macsec_get_validation:
+ * @setting: the #NMSettingMacsec
+ *
+ * Returns: the #NMSettingMacsec:validation property of the setting
+ *
+ * Since: 1.6
+ **/
+NMSettingMacsecValidation
+nm_setting_macsec_get_validation (NMSettingMacsec *setting)
+{
+	g_return_val_if_fail (NM_IS_SETTING_MACSEC (setting), NM_SETTING_MACSEC_VALIDATION_DISABLE);
+	return NM_SETTING_MACSEC_GET_PRIVATE (setting)->validation;
+}
+
+static GPtrArray *
+need_secrets (NMSetting *setting)
+{
+	NMSettingMacsecPrivate *priv = NM_SETTING_MACSEC_GET_PRIVATE (setting);
+	GPtrArray *secrets = NULL;
+
+	if (priv->mode == NM_SETTING_MACSEC_MODE_PSK) {
+		if (   !priv->mka_cak
+		    && !NM_FLAGS_HAS (priv->mka_cak_flags, NM_SETTING_SECRET_FLAG_NOT_REQUIRED)) {
+			secrets = g_ptr_array_sized_new (1);
+			g_ptr_array_add (secrets, NM_SETTING_MACSEC_MKA_CAK);
+		}
+	}
+
+	return secrets;
+}
+
+/*********************************************************************/
+
+static gboolean
+verify_macsec_key (const char *key, gboolean cak, GError **error)
+{
+	int req_len;
+
+	if (!key || !key[0]) {
+		g_set_error_literal (error,
+		                     NM_CONNECTION_ERROR,
+		                     NM_CONNECTION_ERROR_INVALID_PROPERTY,
+		                     _("the key is empty"));
+		return FALSE;
+	}
+
+	req_len = cak ?
+	    NM_SETTING_MACSEC_MKA_CAK_LENGTH :
+	    NM_SETTING_MACSEC_MKA_CKN_LENGTH;
+	if (strlen (key) != req_len) {
+		g_set_error (error,
+		             NM_CONNECTION_ERROR,
+		             NM_CONNECTION_ERROR_INVALID_PROPERTY,
+		             _("the key must be %d characters"), req_len);
+		return FALSE;
+	}
+
+	if (!NM_STRCHAR_ALL (key, ch, g_ascii_isxdigit (ch))) {
+		g_set_error_literal (error,
+		                     NM_CONNECTION_ERROR,
+		                     NM_CONNECTION_ERROR_INVALID_PROPERTY,
+		                     _("the key contais non-hexadecimal characters"));
+		return FALSE;
+	}
+
+	return TRUE;
+}
+
+static gboolean
+verify (NMSetting *setting, NMConnection *connection, GError **error)
+{
+	NMSettingMacsecPrivate *priv = NM_SETTING_MACSEC_GET_PRIVATE (setting);
+	NMSettingConnection *s_con = NULL;
+	NMSettingWired *s_wired = NULL;
+	NMSetting8021x *s_8021x = NULL;
+
+	if (connection) {
+		s_con = nm_connection_get_setting_connection (connection);
+		s_wired = nm_connection_get_setting_wired (connection);
+		s_8021x = nm_connection_get_setting_802_1x (connection);
+	}
+
+	if (priv->parent) {
+		if (nm_utils_is_uuid (priv->parent)) {
+			/* If we have an NMSettingConnection:master with slave-type="macsec",
+			 * then it must be the same UUID.
+			 */
+			if (s_con) {
+				const char *master = NULL, *slave_type = NULL;
+
+				slave_type = nm_setting_connection_get_slave_type (s_con);
+				if (!g_strcmp0 (slave_type, NM_SETTING_MACSEC_SETTING_NAME))
+					master = nm_setting_connection_get_master (s_con);
+
+				if (master && g_strcmp0 (priv->parent, master) != 0) {
+					g_set_error (error,
+					             NM_CONNECTION_ERROR,
+					             NM_CONNECTION_ERROR_INVALID_PROPERTY,
+					             _("'%s' value doesn't match '%s=%s'"),
+					             priv->parent, NM_SETTING_CONNECTION_MASTER, master);
+					g_prefix_error (error, "%s.%s: ", NM_SETTING_MACSEC_SETTING_NAME, NM_SETTING_MACSEC_PARENT);
+					return FALSE;
+				}
+			}
+		} else if (!nm_utils_iface_valid_name (priv->parent)) {
+			/* parent must be either a UUID or an interface name */
+			g_set_error (error,
+			             NM_CONNECTION_ERROR,
+			             NM_CONNECTION_ERROR_INVALID_PROPERTY,
+			             _("'%s' is neither an UUID nor an interface name"),
+			             priv->parent);
+			g_prefix_error (error, "%s.%s: ", NM_SETTING_MACSEC_SETTING_NAME, NM_SETTING_MACSEC_PARENT);
+			return FALSE;
+		}
+	} else {
+		/* If parent is NULL, the parent must be specified via
+		 * NMSettingWired:mac-address.
+		 */
+		if (   connection
+		    && (!s_wired || !nm_setting_wired_get_mac_address (s_wired))) {
+			g_set_error (error,
+			             NM_CONNECTION_ERROR,
+			             NM_CONNECTION_ERROR_MISSING_PROPERTY,
+			             _("property is not specified and neither is '%s:%s'"),
+			             NM_SETTING_WIRED_SETTING_NAME, NM_SETTING_WIRED_MAC_ADDRESS);
+			g_prefix_error (error, "%s.%s: ", NM_SETTING_MACSEC_SETTING_NAME, NM_SETTING_MACSEC_PARENT);
+			return FALSE;
+		}
+	}
+
+	if (priv->mode == NM_SETTING_MACSEC_MODE_PSK) {
+		if (!verify_macsec_key (priv->mka_ckn, FALSE, error)) {
+			g_prefix_error (error, "%s.%s: ", NM_SETTING_MACSEC_SETTING_NAME, NM_SETTING_MACSEC_MKA_CKN);
+			return FALSE;
+		}
+	} else if (priv->mode == NM_SETTING_MACSEC_MODE_EAP) {
+		if (!s_8021x) {
+			g_set_error (error,
+			             NM_CONNECTION_ERROR,
+			             NM_CONNECTION_ERROR_MISSING_SETTING,
+			             _("EAP key management requires '%s' setting presence"),
+			             NM_SETTING_802_1X_SETTING_NAME);
+			g_prefix_error (error, "%s: ", NM_SETTING_MACSEC_SETTING_NAME);
+			return FALSE;
+		}
+	}
+
+	if (priv->port <= 0 || priv->port > 65534) {
+		g_set_error (error,
+		             NM_CONNECTION_ERROR,
+		             NM_CONNECTION_ERROR_MISSING_PROPERTY,
+		             _("invalid port %d"),
+		             priv->port);
+		g_prefix_error (error, "%s.%s: ", NM_SETTING_MACSEC_SETTING_NAME, NM_SETTING_MACSEC_PORT);
+		return FALSE;
+	}
+
+	return TRUE;
+}
+
+static void
+nm_setting_macsec_init (NMSettingMacsec *setting)
+{
+}
+
+static void
+set_property (GObject *object, guint prop_id,
+              const GValue *value, GParamSpec *pspec)
+{
+	NMSettingMacsec *setting = NM_SETTING_MACSEC (object);
+	NMSettingMacsecPrivate *priv = NM_SETTING_MACSEC_GET_PRIVATE (setting);
+
+	switch (prop_id) {
+	case PROP_PARENT:
+		g_free (priv->parent);
+		priv->parent = g_value_dup_string (value);
+		break;
+	case PROP_MODE:
+		priv->mode = g_value_get_int (value);
+		break;
+	case PROP_ENCRYPT:
+		priv->encrypt = g_value_get_boolean (value);
+		break;
+	case PROP_MKA_CAK:
+		g_free (priv->mka_cak);
+		priv->mka_cak = g_value_dup_string (value);
+		break;
+	case PROP_MKA_CAK_FLAGS:
+		priv->mka_cak_flags = g_value_get_flags (value);
+		break;
+	case PROP_MKA_CKN:
+		g_free (priv->mka_ckn);
+		priv->mka_ckn = g_value_dup_string (value);
+		break;
+	case PROP_PORT:
+		priv->port = g_value_get_int (value);
+		break;
+	case PROP_VALIDATION:
+		priv->validation = g_value_get_int (value);
+		break;
+	default:
+		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+		break;
+	}
+}
+
+static void
+get_property (GObject *object, guint prop_id,
+              GValue *value, GParamSpec *pspec)
+{
+	NMSettingMacsec *setting = NM_SETTING_MACSEC (object);
+	NMSettingMacsecPrivate *priv = NM_SETTING_MACSEC_GET_PRIVATE (setting);
+
+	switch (prop_id) {
+	case PROP_PARENT:
+		g_value_set_string (value, priv->parent);
+		break;
+	case PROP_MODE:
+		g_value_set_int (value, priv->mode);
+		break;
+	case PROP_ENCRYPT:
+		g_value_set_boolean (value, priv->encrypt);
+		break;
+	case PROP_MKA_CAK:
+		g_value_set_string (value, priv->mka_cak);
+		break;
+	case PROP_MKA_CAK_FLAGS:
+		g_value_set_flags (value, priv->mka_cak_flags);
+		break;
+	case PROP_MKA_CKN:
+		g_value_set_string (value, priv->mka_ckn);
+		break;
+	case PROP_PORT:
+		g_value_set_int (value, priv->port);
+		break;
+	case PROP_VALIDATION:
+		g_value_set_int (value, priv->validation);
+		break;
+	default:
+		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+		break;
+	}
+}
+
+static void
+finalize (GObject *object)
+{
+	NMSettingMacsec *setting = NM_SETTING_MACSEC (object);
+	NMSettingMacsecPrivate *priv = NM_SETTING_MACSEC_GET_PRIVATE (setting);
+
+	g_free (priv->parent);
+	if (priv->mka_cak) {
+		memset (priv->mka_cak, 0, strlen (priv->mka_cak));
+		g_free (priv->mka_cak);
+	}
+	g_free (priv->mka_ckn);
+
+	G_OBJECT_CLASS (nm_setting_macsec_parent_class)->finalize (object);
+}
+
+static void
+nm_setting_macsec_class_init (NMSettingMacsecClass *setting_class)
+{
+	GObjectClass *object_class = G_OBJECT_CLASS (setting_class);
+	NMSettingClass *parent_class = NM_SETTING_CLASS (setting_class);
+
+	g_type_class_add_private (setting_class, sizeof (NMSettingMacsecPrivate));
+
+	object_class->set_property = set_property;
+	object_class->get_property = get_property;
+	object_class->finalize     = finalize;
+	parent_class->verify       = verify;
+	parent_class->need_secrets = need_secrets;
+
+	/**
+	 * NMSettingMacsec:parent:
+	 *
+	 * If given, specifies the parent interface name or parent connection UUID
+	 * from which this MACSEC interface should be created.  If this property is
+	 * not specified, the connection must contain an #NMSettingWired setting
+	 * with a #NMSettingWired:mac-address property.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_PARENT] =
+	    g_param_spec_string (NM_SETTING_MACSEC_PARENT, "", "",
+	                         NULL,
+	                         G_PARAM_READWRITE |
+	                         G_PARAM_CONSTRUCT |
+	                         NM_SETTING_PARAM_INFERRABLE |
+	                         G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMSettingMacsec:mode:
+	 *
+	 * Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key
+	 * Agreement) is obtained.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_MODE] =
+	    g_param_spec_int (NM_SETTING_MACSEC_MODE, "", "",
+	                      G_MININT, G_MAXINT, NM_SETTING_MACSEC_MODE_PSK,
+	                      G_PARAM_READWRITE |
+	                      G_PARAM_CONSTRUCT |
+	                      NM_SETTING_PARAM_INFERRABLE |
+	                      G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMSettingMacsec:encrypt:
+	 *
+	 * Whether the transmitted traffic must be encrypted.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_ENCRYPT] =
+	    g_param_spec_boolean (NM_SETTING_MACSEC_ENCRYPT, "", "",
+	                          TRUE,
+	                          G_PARAM_READWRITE |
+	                          G_PARAM_CONSTRUCT |
+	                          G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMSettingMacsec:mka-cak:
+	 *
+	 * The pre-shared CAK (Connectivity Association Key) for MACsec
+	 * Key Agreement.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_MKA_CAK] =
+	    g_param_spec_string (NM_SETTING_MACSEC_MKA_CAK, "", "",
+	                         NULL,
+	                         G_PARAM_READWRITE |
+	                         G_PARAM_CONSTRUCT |
+	                         NM_SETTING_PARAM_SECRET |
+	                         G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMSettingMacsec:mka-cak-flags:
+	 *
+	 * Flags indicating how to handle the #NMSettingMacsec:mka-cak
+	 * property.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_MKA_CAK_FLAGS] =
+	    g_param_spec_flags (NM_SETTING_MACSEC_MKA_CAK_FLAGS, "", "",
+	                        NM_TYPE_SETTING_SECRET_FLAGS,
+	                        NM_SETTING_SECRET_FLAG_NONE,
+	                        G_PARAM_READWRITE |
+	                        G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMSettingMacsec:mka-ckn:
+	 *
+	 * The pre-shared CKN (Connectivity-association Key Name) for
+	 * MACsec Key Agreement.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_MKA_CKN] =
+	    g_param_spec_string (NM_SETTING_MACSEC_MKA_CKN, "", "",
+	                         NULL,
+	                         G_PARAM_READWRITE |
+	                         G_PARAM_CONSTRUCT |
+	                         G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMSettingMacsec:port:
+	 *
+	 * The port component of the SCI (Secure Channel Identifier), between 1 and 65534.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_PORT] =
+	    g_param_spec_int (NM_SETTING_MACSEC_PORT, "", "",
+	                      1, 65534, 1,
+	                      G_PARAM_READWRITE |
+	                      G_PARAM_CONSTRUCT |
+	                      NM_SETTING_PARAM_INFERRABLE |
+	                      G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMSettingMacsec:validation:
+	 *
+	 * Specifies the validation mode for incoming frames.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_VALIDATION] =
+	    g_param_spec_int (NM_SETTING_MACSEC_VALIDATION, "", "",
+	                      G_MININT, G_MAXINT, NM_SETTING_MACSEC_VALIDATION_STRICT,
+	                      G_PARAM_READWRITE |
+	                      G_PARAM_CONSTRUCT |
+	                      NM_SETTING_PARAM_INFERRABLE |
+	                      G_PARAM_STATIC_STRINGS);
+
+	g_object_class_install_properties (object_class, _PROPERTY_ENUMS_LAST, obj_properties);
+}
diff --git a/libnm-core/nm-setting-macsec.h b/libnm-core/nm-setting-macsec.h
new file mode 100644
index 0000000000..f9431dfe51
--- /dev/null
+++ b/libnm-core/nm-setting-macsec.h
@@ -0,0 +1,126 @@
+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
+
+/*
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301 USA.
+ *
+ * Copyright 2017 Red Hat, Inc.
+ */
+
+#ifndef __NM_SETTING_MACSEC_H__
+#define __NM_SETTING_MACSEC_H__
+
+#if !defined (__NETWORKMANAGER_H_INSIDE__) && !defined (NETWORKMANAGER_COMPILATION)
+#error "Only <NetworkManager.h> can be included directly."
+#endif
+
+#include "nm-setting.h"
+
+G_BEGIN_DECLS
+
+#define NM_TYPE_SETTING_MACSEC            (nm_setting_macsec_get_type ())
+#define NM_SETTING_MACSEC(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), NM_TYPE_SETTING_MACSEC, NMSettingMacsec))
+#define NM_SETTING_MACSEC_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), NM_TYPE_SETTING_MACSECCONFIG, NMSettingMacsecClass))
+#define NM_IS_SETTING_MACSEC(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), NM_TYPE_SETTING_MACSEC))
+#define NM_IS_SETTING_MACSEC_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), NM_TYPE_SETTING_MACSEC))
+#define NM_SETTING_MACSEC_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), NM_TYPE_SETTING_MACSEC, NMSettingMacsecClass))
+
+#define NM_SETTING_MACSEC_SETTING_NAME         "macsec"
+
+#define NM_SETTING_MACSEC_PARENT               "parent"
+#define NM_SETTING_MACSEC_MODE                 "mode"
+#define NM_SETTING_MACSEC_ENCRYPT              "encrypt"
+#define NM_SETTING_MACSEC_MKA_CAK              "mka-cak"
+#define NM_SETTING_MACSEC_MKA_CAK_FLAGS        "mka-cak-flags"
+#define NM_SETTING_MACSEC_MKA_CKN              "mka-ckn"
+#define NM_SETTING_MACSEC_PORT                 "port"
+#define NM_SETTING_MACSEC_VALIDATION           "validation"
+
+/**
+ * NMSettingMacsec:
+ */
+struct _NMSettingMacsec {
+	NMSetting parent;
+};
+
+typedef struct {
+	NMSettingClass parent;
+
+	/*< private >*/
+	gpointer padding[4];
+} NMSettingMacsecClass;
+
+/**
+ * NMSettingMacsecMode:
+ * @NM_SETTING_MACSEC_MODE_PSK: The CAK is pre-shared
+ * @NM_SETTING_MACSEC_MODE_EAP: The CAK is the result of participation in EAP
+ *
+ * #NMSettingMacsecMode controls how the CAK (Connectivity Association Key) used
+ * in MKA (MACsec Key Agreement) is obtained.
+ *
+ * Since: 1.6
+ */
+typedef enum {
+	NM_SETTING_MACSEC_MODE_PSK = 0,
+	NM_SETTING_MACSEC_MODE_EAP = 1,
+} NMSettingMacsecMode;
+
+/**
+ * NMSettingMacsecValidation:
+ * @NM_SETTING_MACSEC_VALIDATION_DISABLE: All incoming frames are accepted if
+ *   possible
+ * @NM_SETTING_MACSEC_VALIDATION_CHECK: Non protected, invalid, or impossible to
+ *   verify frames are accepted and counted as "invalid"
+ * @NM_SETTING_MACSEC_VALIDATION_STRICT: Non protected, invalid, or impossible to
+ *   verify frames are dropped
+ *
+ * #NMSettingMacsecValidation specifies a validation mode for incoming frames.
+ *
+ * Since: 1.6
+ */
+typedef enum {
+	NM_SETTING_MACSEC_VALIDATION_DISABLE   = 0,
+	NM_SETTING_MACSEC_VALIDATION_CHECK     = 1,
+	NM_SETTING_MACSEC_VALIDATION_STRICT    = 2,
+} NMSettingMacsecValidation;
+
+#define NM_SETTING_MACSEC_MKA_CAK_LENGTH     32
+#define NM_SETTING_MACSEC_MKA_CKN_LENGTH     64
+
+NM_AVAILABLE_IN_1_6
+GType nm_setting_macsec_get_type (void);
+NM_AVAILABLE_IN_1_6
+NMSetting *nm_setting_macsec_new (void);
+
+NM_AVAILABLE_IN_1_6
+const char *nm_setting_macsec_get_parent         (NMSettingMacsec *setting);
+NM_AVAILABLE_IN_1_6
+NMSettingMacsecMode nm_setting_macsec_get_mode   (NMSettingMacsec *setting);
+NM_AVAILABLE_IN_1_6
+gboolean    nm_setting_macsec_get_encrypt        (NMSettingMacsec *setting);
+NM_AVAILABLE_IN_1_6
+const char *nm_setting_macsec_get_mka_cak        (NMSettingMacsec *setting);
+NM_AVAILABLE_IN_1_6
+NMSettingSecretFlags nm_setting_macsec_get_mka_cak_flags  (NMSettingMacsec *setting);
+NM_AVAILABLE_IN_1_6
+const char *nm_setting_macsec_get_mka_ckn        (NMSettingMacsec *setting);
+NM_AVAILABLE_IN_1_6
+int         nm_setting_macsec_get_port           (NMSettingMacsec *setting);
+NM_AVAILABLE_IN_1_6
+NMSettingMacsecValidation nm_setting_macsec_get_validation (NMSettingMacsec *setting);
+
+G_END_DECLS
+
+#endif /* __NM_SETTING_MACSEC_H__ */
diff --git a/libnm/NetworkManager.h b/libnm/NetworkManager.h
index 6af091faeb..d0dec1a019 100644
--- a/libnm/NetworkManager.h
+++ b/libnm/NetworkManager.h
@@ -68,6 +68,7 @@
 #include <nm-setting-ip6-config.h>
 #include <nm-setting-ip-config.h>
 #include <nm-setting-ip-tunnel.h>
+#include <nm-setting-macsec.h>
 #include <nm-setting-macvlan.h>
 #include <nm-setting-olpc-mesh.h>
 #include <nm-setting-ppp.h>
diff --git a/libnm/libnm.ver b/libnm/libnm.ver
index cc39286564..d0562e2c11 100644
--- a/libnm/libnm.ver
+++ b/libnm/libnm.ver
@@ -1090,7 +1090,22 @@ global:
 	nm_client_get_dns_configuration;
 	nm_client_get_dns_mode;
 	nm_client_get_dns_rc_manager;
+	nm_connection_get_setting_macsec;
 	nm_connection_get_setting_proxy;
+	nm_device_macsec_get_cipher_suite;
+	nm_device_macsec_get_encoding_sa;
+	nm_device_macsec_get_encrypt;
+	nm_device_macsec_get_es;
+	nm_device_macsec_get_hw_address;
+	nm_device_macsec_get_icv_length;
+	nm_device_macsec_get_include_sci;
+	nm_device_macsec_get_protect;
+	nm_device_macsec_get_replay_protect;
+	nm_device_macsec_get_scb;
+	nm_device_macsec_get_sci;
+	nm_device_macsec_get_type;
+	nm_device_macsec_get_validation;
+	nm_device_macsec_get_window;
 	nm_dns_entry_get_domains;
 	nm_dns_entry_get_interface;
 	nm_dns_entry_get_nameservers;
@@ -1099,6 +1114,18 @@ global:
 	nm_dns_entry_get_vpn;
 	nm_dns_entry_unref;
 	nm_setting_connection_get_autoconnect_retries;
+	nm_setting_macsec_get_encrypt;
+	nm_setting_macsec_get_mka_cak;
+	nm_setting_macsec_get_mka_cak_flags;
+	nm_setting_macsec_get_mka_ckn;
+	nm_setting_macsec_get_mode;
+	nm_setting_macsec_get_parent;
+	nm_setting_macsec_get_port;
+	nm_setting_macsec_get_type;
+	nm_setting_macsec_get_validation;
+	nm_setting_macsec_mode_get_type;
+	nm_setting_macsec_new;
+	nm_setting_macsec_validation_get_type;
 	nm_setting_proxy_get_type;
 	nm_setting_proxy_new;
 	nm_setting_proxy_get_method;
diff --git a/libnm/nm-client.c b/libnm/nm-client.c
index 4b31236e39..63eaa84ce3 100644
--- a/libnm/nm-client.c
+++ b/libnm/nm-client.c
@@ -56,6 +56,7 @@
 #include "nm-device-generic.h"
 #include "nm-device-infiniband.h"
 #include "nm-device-ip-tunnel.h"
+#include "nm-device-macsec.h"
 #include "nm-device-macvlan.h"
 #include "nm-device-modem.h"
 #include "nm-device-olpc-mesh.h"
@@ -2061,6 +2062,8 @@ obj_nm_for_gdbus_object (GDBusObject *object, GDBusObjectManager *object_manager
 			type = NM_TYPE_DEVICE_INFINIBAND;
 		else if (strcmp (ifname, NM_DBUS_INTERFACE_DEVICE_IP_TUNNEL) == 0)
 			type = NM_TYPE_DEVICE_IP_TUNNEL;
+		else if (strcmp (ifname, NM_DBUS_INTERFACE_DEVICE_MACSEC) == 0)
+			type = NM_TYPE_DEVICE_MACSEC;
 		else if (strcmp (ifname, NM_DBUS_INTERFACE_DEVICE_MACVLAN) == 0)
 			type = NM_TYPE_DEVICE_MACVLAN;
 		else if (strcmp (ifname, NM_DBUS_INTERFACE_DEVICE_MODEM) == 0)
diff --git a/libnm/nm-device-macsec.c b/libnm/nm-device-macsec.c
new file mode 100644
index 0000000000..c4762041be
--- /dev/null
+++ b/libnm/nm-device-macsec.c
@@ -0,0 +1,639 @@
+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
+/*
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301 USA.
+ *
+ * Copyright 2017 Red Hat, Inc.
+ */
+
+#include "nm-default.h"
+
+#include <string.h>
+
+#include "nm-device-macsec.h"
+#include "nm-device-private.h"
+#include "nm-object-private.h"
+#include "nm-utils.h"
+
+G_DEFINE_TYPE (NMDeviceMacsec, nm_device_macsec, NM_TYPE_DEVICE)
+
+#define NM_DEVICE_MACSEC_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), NM_TYPE_DEVICE_MACSEC, NMDeviceMacsecPrivate))
+
+typedef struct {
+	NMDevice *parent;
+	char *hw_address;
+	guint64 sci;
+	guint64 cipher_suite;
+	guint8 icv_length;
+	guint32 window;
+	guint8 encoding_sa;
+	gboolean encrypt;
+	gboolean protect;
+	gboolean include_sci;
+	gboolean es;
+	gboolean scb;
+	gboolean replay_protect;
+	char *validation;
+} NMDeviceMacsecPrivate;
+
+NM_GOBJECT_PROPERTIES_DEFINE_BASE (
+	PROP_PARENT,
+	PROP_HW_ADDRESS,
+	PROP_SCI,
+	PROP_CIPHER_SUITE,
+	PROP_ICV_LENGTH,
+	PROP_WINDOW,
+	PROP_ENCODING_SA,
+	PROP_ENCRYPT,
+	PROP_PROTECT,
+	PROP_INCLUDE_SCI,
+	PROP_ES,
+	PROP_SCB,
+	PROP_REPLAY_PROTECT,
+	PROP_VALIDATION,
+);
+
+/**
+ * nm_device_macsec_get_parent:
+ * @device: a #NMDeviceMacsec
+ *
+ * Returns: (transfer none): the device's parent device
+ *
+ * Since: 1.6
+ **/
+NMDevice *
+nm_device_macsec_get_parent (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), NULL);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->parent;
+}
+
+/**
+ * nm_device_macsec_get_hw_address:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets the hardware (MAC) address of the #NMDeviceMacsec
+ *
+ * Returns: the hardware address. This is the internal string used by the
+ * device, and must not be modified.
+ *
+ * Since: 1.6
+ **/
+const char *
+nm_device_macsec_get_hw_address (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), NULL);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->hw_address;
+}
+
+/**
+ * nm_device_macsec_get_sci:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets the Secure Channel Identifier in use
+ *
+ * Returns: the SCI
+ *
+ * Since: 1.6
+ **/
+guint64
+nm_device_macsec_get_sci (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), 0);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->sci;
+}
+
+/**
+ * nm_device_macsec_get_icv_length:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets the length of ICV (Integrity Check Value)
+ *
+ * Returns: the length of ICV
+ *
+ * Since: 1.6
+ **/
+guint8
+nm_device_macsec_get_icv_length (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), 0);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->icv_length;
+}
+
+/**
+ * nm_device_macsec_get_cipher_suite:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets the set of cryptographic algorithms in use
+ *
+ * Returns:
+ *
+ * Since: 1.6
+ **/
+guint64
+nm_device_macsec_get_cipher_suite (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), 0);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->cipher_suite;
+}
+
+/**
+ * nm_device_macsec_get_window:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets the size of the replay window
+ *
+ * Returns: size of the replay window
+ *
+ * Since: 1.6
+ **/
+guint
+nm_device_macsec_get_window (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), 0);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->window;
+}
+
+/**
+ * nm_device_macsec_get_encoding_sa:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets the value of the Association Number (0..3) for the Security
+ * Association in use.
+ *
+ * Returns: the current Security Association
+ *
+ * Since: 1.6
+ **/
+guint8
+nm_device_macsec_get_encoding_sa (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), 0);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->encoding_sa;
+}
+
+/**
+ * nm_device_macsec_get_validation:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets the validation mode for incoming packets (strict, check,
+ * disabled)
+ *
+ * Returns: the validation mode
+ *
+ * Since: 1.6
+ **/
+const char *
+nm_device_macsec_get_validation (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), NULL);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->validation;
+}
+
+/**
+ * nm_device_macsec_get_encrypt:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets whether encryption of transmitted frames is enabled
+ *
+ * Returns: whether encryption is enabled
+ *
+ * Since: 1.6
+ **/
+gboolean
+nm_device_macsec_get_encrypt (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), FALSE);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->encrypt;
+}
+
+/**
+ * nm_device_macsec_get_protect:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets whether protection of transmitted frames is enabled
+ *
+ * Returns: whether protection is enabled
+ *
+ * Since: 1.6
+ **/
+gboolean
+nm_device_macsec_get_protect (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), FALSE);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->protect;
+}
+
+/**
+ * nm_device_macsec_get_include_sci:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets whether the SCI is always included in SecTAG for transmitted
+ * frames
+ *
+ * Returns: whether the SCI is always included
+ *
+ * Since: 1.6
+ **/
+gboolean
+nm_device_macsec_get_include_sci (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), FALSE);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->include_sci;
+}
+
+/**
+ * nm_device_macsec_get_es:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets whether the ES (End station) bit is enabled in SecTAG for
+ * transmitted frames
+ *
+ * Returns: whether the ES (End station) bit is enabled
+ *
+ * Since: 1.6
+ **/
+gboolean
+nm_device_macsec_get_es (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), FALSE);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->es;
+}
+
+/**
+ * nm_device_macsec_get_scb:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets whether the SCB (Single Copy Broadcast) bit is enabled in
+ * SecTAG for transmitted frames
+ *
+ * Returns: whether the SCB (Single Copy Broadcast) bit is enabled
+ *
+ * Since: 1.6
+ **/
+gboolean
+nm_device_macsec_get_scb (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), FALSE);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->scb;
+}
+
+/**
+ * nm_device_macsec_get_replay_protect:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets whether replay protection is enabled
+ *
+ * Returns: whether replay protection is enabled
+ *
+ * Since: 1.6
+ **/
+gboolean
+nm_device_macsec_get_replay_protect (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), FALSE);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->replay_protect;
+}
+
+static const char *
+get_hw_address (NMDevice *device)
+{
+	return nm_device_macsec_get_hw_address (NM_DEVICE_MACSEC (device));
+}
+
+/***********************************************************/
+
+static void
+nm_device_macsec_init (NMDeviceMacsec *device)
+{
+}
+
+static void
+init_dbus (NMObject *object)
+{
+	NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (object);
+	const NMPropertiesInfo property_info[] = {
+		{ NM_DEVICE_MACSEC_PARENT,         &priv->parent, NULL, NM_TYPE_DEVICE },
+		{ NM_DEVICE_MACSEC_HW_ADDRESS,     &priv->hw_address },
+		{ NM_DEVICE_MACSEC_SCI,            &priv->sci },
+		{ NM_DEVICE_MACSEC_CIPHER_SUITE,   &priv->cipher_suite },
+		{ NM_DEVICE_MACSEC_ICV_LENGTH,     &priv->icv_length },
+		{ NM_DEVICE_MACSEC_WINDOW,         &priv->window },
+		{ NM_DEVICE_MACSEC_ENCODING_SA,    &priv->encoding_sa },
+		{ NM_DEVICE_MACSEC_ENCRYPT,        &priv->encrypt },
+		{ NM_DEVICE_MACSEC_PROTECT,        &priv->protect },
+		{ NM_DEVICE_MACSEC_INCLUDE_SCI,    &priv->include_sci },
+		{ NM_DEVICE_MACSEC_ES,             &priv->es },
+		{ NM_DEVICE_MACSEC_SCB,            &priv->scb },
+		{ NM_DEVICE_MACSEC_REPLAY_PROTECT, &priv->replay_protect },
+		{ NM_DEVICE_MACSEC_VALIDATION,     &priv->validation },
+		{ NULL },
+	};
+
+	NM_OBJECT_CLASS (nm_device_macsec_parent_class)->init_dbus (object);
+
+	_nm_object_register_properties (object,
+	                                NM_DBUS_INTERFACE_DEVICE_MACSEC,
+	                                property_info);
+}
+
+static void
+finalize (GObject *object)
+{
+	NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (object);
+
+	g_free (priv->validation);
+	g_free (priv->hw_address);
+	g_clear_object (&priv->parent);
+
+	G_OBJECT_CLASS (nm_device_macsec_parent_class)->finalize (object);
+}
+
+static void
+get_property (GObject *object,
+              guint prop_id,
+              GValue *value,
+              GParamSpec *pspec)
+{
+	NMDeviceMacsec *device = NM_DEVICE_MACSEC (object);
+
+	switch (prop_id) {
+	case PROP_PARENT:
+		g_value_set_object (value, nm_device_macsec_get_parent (device));
+		break;
+	case PROP_HW_ADDRESS:
+		g_value_set_string (value, nm_device_macsec_get_hw_address (device));
+		break;
+	case PROP_SCI:
+		g_value_set_uint64 (value, nm_device_macsec_get_sci (device));
+		break;
+	case PROP_ICV_LENGTH:
+		g_value_set_uchar (value, nm_device_macsec_get_icv_length (device));
+		break;
+	case PROP_CIPHER_SUITE:
+		g_value_set_uint64 (value, nm_device_macsec_get_cipher_suite (device));
+		break;
+	case PROP_WINDOW:
+		g_value_set_uint (value, nm_device_macsec_get_window (device));
+		break;
+	case PROP_ENCODING_SA:
+		g_value_set_uchar (value, nm_device_macsec_get_encoding_sa (device));
+		break;
+	case PROP_VALIDATION:
+		g_value_set_string (value, nm_device_macsec_get_validation (device));
+		break;
+	case PROP_ENCRYPT:
+		g_value_set_boolean (value, nm_device_macsec_get_encrypt (device));
+		break;
+	case PROP_PROTECT:
+		g_value_set_boolean (value, nm_device_macsec_get_protect (device));
+		break;
+	case PROP_INCLUDE_SCI:
+		g_value_set_boolean (value, nm_device_macsec_get_include_sci (device));
+		break;
+	case PROP_ES:
+		g_value_set_boolean (value, nm_device_macsec_get_es (device));
+		break;
+	case PROP_SCB:
+		g_value_set_boolean (value, nm_device_macsec_get_scb (device));
+		break;
+	case PROP_REPLAY_PROTECT:
+		g_value_set_boolean (value, nm_device_macsec_get_replay_protect (device));
+		break;
+	default:
+		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+		break;
+	}
+}
+
+static void
+nm_device_macsec_class_init (NMDeviceMacsecClass *macsec_class)
+{
+	GObjectClass *object_class = G_OBJECT_CLASS (macsec_class);
+	NMObjectClass *nm_object_class = NM_OBJECT_CLASS (macsec_class);
+	NMDeviceClass *device_class = NM_DEVICE_CLASS (macsec_class);
+
+	g_type_class_add_private (macsec_class, sizeof (NMDeviceMacsecPrivate));
+
+	object_class->finalize = finalize;
+	object_class->get_property = get_property;
+
+	nm_object_class->init_dbus = init_dbus;
+
+	device_class->get_hw_address = get_hw_address;
+
+	/**
+	 * NMDeviceMacsec:parent:
+	 *
+	 * The devices's parent device.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_PARENT] =
+		g_param_spec_object (NM_DEVICE_MACSEC_PARENT, "", "",
+		                     NM_TYPE_DEVICE,
+		                     G_PARAM_READABLE |
+		                     G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:hw-address:
+	 *
+	 * The hardware (MAC) address of the device.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_HW_ADDRESS] =
+		g_param_spec_string (NM_DEVICE_MACSEC_HW_ADDRESS, "", "",
+		                     NULL,
+		                     G_PARAM_READABLE |
+		                     G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:sci:
+	 *
+	 * The Secure Channel Identifier in use.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_SCI] =
+		g_param_spec_uint64 (NM_DEVICE_MACSEC_SCI, "", "",
+		                     0, G_MAXUINT64, 0,
+		                     G_PARAM_READABLE |
+		                     G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:icv-length:
+	 *
+	 * The length of ICV (Integrity Check Value).
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_ICV_LENGTH] =
+		g_param_spec_uchar (NM_DEVICE_MACSEC_ICV_LENGTH, "", "",
+		                    0, G_MAXUINT8, 0,
+		                    G_PARAM_READABLE |
+		                    G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:cipher-suite:
+	 *
+	 * The set of cryptographic algorithms in use.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_CIPHER_SUITE] =
+		g_param_spec_uint64 (NM_DEVICE_MACSEC_CIPHER_SUITE, "", "",
+		                     0, G_MAXUINT64, 0,
+		                     G_PARAM_READABLE |
+		                     G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:window:
+	 *
+	 * The size of the replay window.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_WINDOW] =
+		g_param_spec_uint (NM_DEVICE_MACSEC_WINDOW, "", "",
+		                   0, G_MAXUINT32, 0,
+		                   G_PARAM_READABLE |
+		                   G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:encoding-sa:
+	 *
+	 * The value of the Association Number (0..3) for the Security
+	 * Association in use.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_ENCODING_SA] =
+		g_param_spec_uchar (NM_DEVICE_MACSEC_ENCODING_SA, "", "",
+		                    0, G_MAXUINT8, 0,
+		                    G_PARAM_READABLE |
+		                    G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:validation:
+	 *
+	 * The validation mode for incoming packets (strict, check,
+	 * disabled).
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_VALIDATION] =
+		g_param_spec_string (NM_DEVICE_MACSEC_VALIDATION, "", "",
+		                     NULL,
+		                     G_PARAM_READABLE |
+		                     G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:encrypt:
+	 *
+	 * Whether encryption of transmitted frames is enabled.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_ENCRYPT] =
+		g_param_spec_boolean (NM_DEVICE_MACSEC_ENCRYPT, "", "",
+		                      FALSE,
+		                      G_PARAM_READABLE |
+		                      G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:protect:
+	 *
+	 * Whether protection of transmitted frames is enabled.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_PROTECT] =
+		g_param_spec_boolean (NM_DEVICE_MACSEC_PROTECT, "", "",
+		                      FALSE,
+		                      G_PARAM_READABLE |
+		                      G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:include-sci:
+	 *
+	 * Whether the SCI is always included in SecTAG for transmitted
+	 * frames.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_INCLUDE_SCI] =
+		g_param_spec_boolean (NM_DEVICE_MACSEC_INCLUDE_SCI, "", "",
+		                      FALSE,
+		                      G_PARAM_READABLE |
+		                      G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:es:
+	 *
+	 * Whether the ES (End station) bit is enabled in SecTAG for
+	 * transmitted frames.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_ES] =
+		g_param_spec_boolean (NM_DEVICE_MACSEC_ES, "", "",
+		                      FALSE,
+		                      G_PARAM_READABLE |
+		                      G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:scb:
+	 *
+	 * Whether the SCB (Single Copy Broadcast) bit is enabled in
+	 * SecTAG for transmitted frames.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_SCB] =
+		g_param_spec_boolean (NM_DEVICE_MACSEC_SCB, "", "",
+		                      FALSE,
+		                      G_PARAM_READABLE |
+		                      G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:replay-protect:
+	 *
+	 * Whether replay protection is enabled.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_REPLAY_PROTECT] =
+		g_param_spec_boolean (NM_DEVICE_MACSEC_REPLAY_PROTECT, "", "",
+		                      FALSE,
+		                      G_PARAM_READABLE |
+		                      G_PARAM_STATIC_STRINGS);
+
+	g_object_class_install_properties (object_class, _PROPERTY_ENUMS_LAST, obj_properties);
+}
diff --git a/libnm/nm-device-macsec.h b/libnm/nm-device-macsec.h
new file mode 100644
index 0000000000..d6d7c0ef79
--- /dev/null
+++ b/libnm/nm-device-macsec.h
@@ -0,0 +1,101 @@
+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
+/*
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301 USA.
+ *
+ * Copyright 2017 Red Hat, Inc.
+ */
+
+#ifndef __NM_DEVICE_MACSEC_H__
+#define __NM_DEVICE_MACSEC_H__
+
+#if !defined (__NETWORKMANAGER_H_INSIDE__) && !defined(NETWORKMANAGER_COMPILATION)
+#error "Only <NetworkManager.h> can be included directly."
+#endif
+
+#include <nm-device.h>
+
+G_BEGIN_DECLS
+
+#define NM_TYPE_DEVICE_MACSEC            (nm_device_macsec_get_type ())
+#define NM_DEVICE_MACSEC(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), NM_TYPE_DEVICE_MACSEC, NMDeviceMacsec))
+#define NM_DEVICE_MACSEC_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), NM_TYPE_DEVICE_MACSEC, NMDeviceMacsecClass))
+#define NM_IS_DEVICE_MACSEC(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), NM_TYPE_DEVICE_MACSEC))
+#define NM_IS_DEVICE_MACSEC_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), NM_TYPE_DEVICE_MACSEC))
+#define NM_DEVICE_MACSEC_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), NM_TYPE_DEVICE_MACSEC, NMDeviceMacsecClass))
+
+#define NM_DEVICE_MACSEC_PARENT          "parent"
+#define NM_DEVICE_MACSEC_HW_ADDRESS      "hw-address"
+#define NM_DEVICE_MACSEC_SCI             "sci"
+#define NM_DEVICE_MACSEC_ICV_LENGTH      "icv-length"
+#define NM_DEVICE_MACSEC_CIPHER_SUITE    "cipher-suite"
+#define NM_DEVICE_MACSEC_WINDOW          "window"
+#define NM_DEVICE_MACSEC_ENCODING_SA     "encoding-sa"
+#define NM_DEVICE_MACSEC_VALIDATION      "validation"
+#define NM_DEVICE_MACSEC_ENCRYPT         "encrypt"
+#define NM_DEVICE_MACSEC_PROTECT         "protect"
+#define NM_DEVICE_MACSEC_INCLUDE_SCI     "include-sci"
+#define NM_DEVICE_MACSEC_ES              "es"
+#define NM_DEVICE_MACSEC_SCB             "scb"
+#define NM_DEVICE_MACSEC_REPLAY_PROTECT  "replay-protect"
+
+/**
+ * NMDeviceMacsec:
+ */
+struct _NMDeviceMacsec {
+	NMDevice parent;
+};
+
+typedef struct {
+	NMDeviceClass parent;
+
+	/*< private >*/
+	gpointer padding[4];
+} NMDeviceMacsecClass;
+
+NM_AVAILABLE_IN_1_6
+GType nm_device_macsec_get_type (void);
+
+NM_AVAILABLE_IN_1_6
+NMDevice *   nm_device_macsec_get_parent (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+const char * nm_device_macsec_get_hw_address (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+guint64      nm_device_macsec_get_sci (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+guint8       nm_device_macsec_get_icv_length (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+guint64      nm_device_macsec_get_cipher_suite (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+guint        nm_device_macsec_get_window (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+guint8       nm_device_macsec_get_encoding_sa (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+const char * nm_device_macsec_get_validation (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+gboolean     nm_device_macsec_get_encrypt (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+gboolean     nm_device_macsec_get_protect (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+gboolean     nm_device_macsec_get_include_sci (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+gboolean     nm_device_macsec_get_es (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+gboolean     nm_device_macsec_get_scb (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+gboolean     nm_device_macsec_get_replay_protect (NMDeviceMacsec *device);
+G_END_DECLS
+
+#endif /* __NM_DEVICE_MACSEC_H__ */
diff --git a/libnm/nm-device.c b/libnm/nm-device.c
index 5c5988862c..02b5cad550 100644
--- a/libnm/nm-device.c
+++ b/libnm/nm-device.c
@@ -267,6 +267,7 @@ coerce_type (NMDeviceType type)
 	case NM_DEVICE_TYPE_BRIDGE:
 	case NM_DEVICE_TYPE_VLAN:
 	case NM_DEVICE_TYPE_ADSL:
+	case NM_DEVICE_TYPE_MACSEC:
 	case NM_DEVICE_TYPE_MACVLAN:
 	case NM_DEVICE_TYPE_VXLAN:
 	case NM_DEVICE_TYPE_IP_TUNNEL:
@@ -1691,6 +1692,8 @@ get_type_name (NMDevice *device)
 		return _("Tun");
 	case NM_DEVICE_TYPE_VETH:
 		return _("Veth");
+	case NM_DEVICE_TYPE_MACSEC:
+		return _("MACsec");
 	case NM_DEVICE_TYPE_GENERIC:
 	case NM_DEVICE_TYPE_UNUSED1:
 	case NM_DEVICE_TYPE_UNUSED2:
diff --git a/libnm/nm-types.h b/libnm/nm-types.h
index be09daaf89..7d224c86fe 100644
--- a/libnm/nm-types.h
+++ b/libnm/nm-types.h
@@ -38,6 +38,7 @@ typedef struct _NMDeviceEthernet    NMDeviceEthernet;
 typedef struct _NMDeviceGeneric     NMDeviceGeneric;
 typedef struct _NMDeviceInfiniband  NMDeviceInfiniband;
 typedef struct _NMDeviceIPTunnel    NMDeviceIPTunnel;
+typedef struct _NMDeviceMacsec      NMDeviceMacsec;
 typedef struct _NMDeviceMacvlan     NMDeviceMacvlan;
 typedef struct _NMDeviceModem       NMDeviceModem;
 typedef struct _NMDeviceOlpcMesh    NMDeviceOlpcMesh;
diff --git a/po/POTFILES.in b/po/POTFILES.in
index 411868b8c8..d9faa7b112 100644
--- a/po/POTFILES.in
+++ b/po/POTFILES.in
@@ -68,6 +68,7 @@ libnm-core/nm-setting-ip-config.c
 libnm-core/nm-setting-ip4-config.c
 libnm-core/nm-setting-ip6-config.c
 libnm-core/nm-setting-ip-tunnel.c
+libnm-core/nm-setting-macsec.c
 libnm-core/nm-setting-macvlan.c
 libnm-core/nm-setting-olpc-mesh.c
 libnm-core/nm-setting-ppp.c
diff --git a/src/devices/nm-device-ethernet.c b/src/devices/nm-device-ethernet.c
index 0dc09762aa..f9d753a58f 100644
--- a/src/devices/nm-device-ethernet.c
+++ b/src/devices/nm-device-ethernet.c
@@ -75,7 +75,6 @@ typedef struct Supplicant {
 	gulong iface_state_id;
 
 	/* Timeouts and idles */
-	guint iface_con_error_cb_id;
 	guint con_timeout_id;
 } Supplicant;
 
@@ -430,7 +429,6 @@ supplicant_interface_clear_handlers (NMDeviceEthernet *self)
 
 	nm_clear_g_source (&priv->supplicant_timeout_id);
 	nm_clear_g_source (&priv->supplicant.con_timeout_id);
-	nm_clear_g_source (&priv->supplicant.iface_con_error_cb_id);
 	nm_clear_g_signal_handler (priv->supplicant.iface, &priv->supplicant.iface_error_id);
 }
 
@@ -679,19 +677,6 @@ supplicant_iface_state_cb (NMSupplicantInterface *iface,
 	}
 }
 
-static gboolean
-supplicant_iface_connection_error_cb_handler (gpointer user_data)
-{
-	NMDeviceEthernet *self = NM_DEVICE_ETHERNET (user_data);
-	NMDeviceEthernetPrivate *priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);
-
-	supplicant_interface_release (self);
-	nm_device_state_changed (NM_DEVICE (self), NM_DEVICE_STATE_FAILED, NM_DEVICE_STATE_REASON_SUPPLICANT_CONFIG_FAILED);
-
-	priv->supplicant.iface_con_error_cb_id = 0;
-	return FALSE;
-}
-
 static void
 supplicant_iface_connection_error_cb (NMSupplicantInterface *iface,
                                       const char *name,
@@ -699,18 +684,15 @@ supplicant_iface_connection_error_cb (NMSupplicantInterface *iface,
                                       gpointer user_data)
 {
 	NMDeviceEthernet *self = NM_DEVICE_ETHERNET (user_data);
-	NMDeviceEthernetPrivate *priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);
-	guint id;
 
 	_LOGW (LOGD_DEVICE | LOGD_ETHER,
 	       "Activation: (ethernet) association request to the supplicant failed: %s - %s",
 	       name, message);
 
-	if (priv->supplicant.iface_con_error_cb_id)
-		g_source_remove (priv->supplicant.iface_con_error_cb_id);
-
-	id = g_idle_add (supplicant_iface_connection_error_cb_handler, self);
-	priv->supplicant.iface_con_error_cb_id = id;
+	supplicant_interface_release (self);
+	nm_device_queue_state (NM_DEVICE (self),
+	                       NM_DEVICE_STATE_FAILED,
+	                       NM_DEVICE_STATE_REASON_SUPPLICANT_CONFIG_FAILED);
 }
 
 static NMActStageReturn
@@ -794,7 +776,7 @@ supplicant_interface_init (NMDeviceEthernet *self)
 
 	priv->supplicant.iface = nm_supplicant_manager_create_interface (priv->supplicant.mgr,
 	                                                                 nm_device_get_iface (NM_DEVICE (self)),
-	                                                                 FALSE);
+	                                                                 NM_SUPPLICANT_DRIVER_WIRED);
 
 	if (!priv->supplicant.iface) {
 		_LOGE (LOGD_DEVICE | LOGD_ETHER,
@@ -810,7 +792,7 @@ supplicant_interface_init (NMDeviceEthernet *self)
 
 	/* Hook up error signal handler to capture association errors */
 	priv->supplicant.iface_error_id = g_signal_connect (priv->supplicant.iface,
-	                                                    "connection-error",
+	                                                    NM_SUPPLICANT_INTERFACE_CONNECTION_ERROR,
 	                                                    G_CALLBACK (supplicant_iface_connection_error_cb),
 	                                                    self);
 
diff --git a/src/devices/nm-device-factory.c b/src/devices/nm-device-factory.c
index dc8e26605b..0ce2cb48c5 100644
--- a/src/devices/nm-device-factory.c
+++ b/src/devices/nm-device-factory.c
@@ -405,6 +405,7 @@ nm_device_factory_manager_load_factories (NMDeviceFactoryManagerFactoryFunc call
 	_ADD_INTERNAL (nm_ethernet_device_factory_get_type);
 	_ADD_INTERNAL (nm_infiniband_device_factory_get_type);
 	_ADD_INTERNAL (nm_ip_tunnel_device_factory_get_type);
+	_ADD_INTERNAL (nm_macsec_device_factory_get_type);
 	_ADD_INTERNAL (nm_macvlan_device_factory_get_type);
 	_ADD_INTERNAL (nm_tun_device_factory_get_type);
 	_ADD_INTERNAL (nm_veth_device_factory_get_type);
diff --git a/src/devices/nm-device-macsec.c b/src/devices/nm-device-macsec.c
new file mode 100644
index 0000000000..c511a0e721
--- /dev/null
+++ b/src/devices/nm-device-macsec.c
@@ -0,0 +1,1009 @@
+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
+/* NetworkManager -- Network link manager
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Copyright 2017 Red Hat, Inc.
+ */
+
+#include "nm-default.h"
+
+#include "nm-device-macsec.h"
+
+#include "nm-act-request.h"
+#include "nm-device-private.h"
+#include "platform/nm-platform.h"
+#include "nm-device-factory.h"
+#include "nm-manager.h"
+#include "nm-setting-macsec.h"
+#include "nm-core-internal.h"
+#include "supplicant/nm-supplicant-manager.h"
+#include "supplicant/nm-supplicant-interface.h"
+#include "supplicant/nm-supplicant-config.h"
+
+#include "introspection/org.freedesktop.NetworkManager.Device.Macsec.h"
+
+#include "nm-device-logging.h"
+_LOG_DECLARE_SELF(NMDeviceMacsec);
+
+/*****************************************************************************/
+
+typedef struct Supplicant {
+	NMSupplicantManager *mgr;
+	NMSupplicantInterface *iface;
+
+	/* signal handler ids */
+	gulong iface_error_id;
+	gulong iface_state_id;
+
+	/* Timeouts and idles */
+	guint con_timeout_id;
+} Supplicant;
+
+NM_GOBJECT_PROPERTIES_DEFINE (NMDeviceMacsec,
+	PROP_SCI,
+	PROP_CIPHER_SUITE,
+	PROP_ICV_LENGTH,
+	PROP_WINDOW,
+	PROP_ENCODING_SA,
+	PROP_ENCRYPT,
+	PROP_PROTECT,
+	PROP_INCLUDE_SCI,
+	PROP_ES,
+	PROP_SCB,
+	PROP_REPLAY_PROTECT,
+	PROP_VALIDATION,
+);
+
+typedef struct {
+	NMPlatformLnkMacsec props;
+	gulong parent_state_id;
+	Supplicant supplicant;
+	guint supplicant_timeout_id;
+	NMActRequestGetSecretsCallId macsec_secrets_id;
+} NMDeviceMacsecPrivate;
+
+struct _NMDeviceMacsec {
+	NMDevice parent;
+	NMDeviceMacsecPrivate _priv;
+};
+
+struct _NMDeviceMacsecClass {
+	NMDeviceClass parent;
+};
+
+G_DEFINE_TYPE (NMDeviceMacsec, nm_device_macsec, NM_TYPE_DEVICE)
+
+#define NM_DEVICE_MACSEC_GET_PRIVATE(self) _NM_GET_PRIVATE (self, NMDeviceMacsec, NM_IS_DEVICE_MACSEC)
+
+/******************************************************************/
+
+#define MACSEC_SECRETS_TRIES "macsec-secrets-tries"
+
+static void macsec_secrets_cancel (NMDeviceMacsec *self);
+
+/******************************************************************/
+
+NM_UTILS_LOOKUP_STR_DEFINE_STATIC (validation_mode_to_string, guint8,
+	NM_UTILS_LOOKUP_DEFAULT_WARN ("<unknown>"),
+	NM_UTILS_LOOKUP_STR_ITEM (0, "disable"),
+	NM_UTILS_LOOKUP_STR_ITEM (1, "check"),
+	NM_UTILS_LOOKUP_STR_ITEM (2, "strict"),
+);
+
+static void
+parent_state_changed (NMDevice *parent,
+                      NMDeviceState new_state,
+                      NMDeviceState old_state,
+                      NMDeviceStateReason reason,
+                      gpointer user_data)
+{
+	NMDeviceMacsec *self = NM_DEVICE_MACSEC (user_data);
+
+	/* We'll react to our own carrier state notifications. Ignore the parent's. */
+	if (reason == NM_DEVICE_STATE_REASON_CARRIER)
+		return;
+
+	nm_device_set_unmanaged_by_flags (NM_DEVICE (self), NM_UNMANAGED_PARENT, !nm_device_get_managed (parent, FALSE), reason);
+}
+
+static void
+parent_changed_notify (NMDevice *device,
+                       int old_ifindex,
+                       NMDevice *old_parent,
+                       int new_ifindex,
+                       NMDevice *new_parent)
+{
+	NMDeviceMacsec *self = NM_DEVICE_MACSEC (device);
+	NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self);
+
+	NM_DEVICE_CLASS (nm_device_macsec_parent_class)->parent_changed_notify (device,
+	                                                                        old_ifindex,
+	                                                                        old_parent,
+	                                                                        new_ifindex,
+	                                                                        new_parent);
+
+	/*  note that @self doesn't have to clear @parent_state_id on dispose,
+	 *  because NMDevice's dispose() will unset the parent, which in turn calls
+	 *  parent_changed_notify(). */
+	nm_clear_g_signal_handler (old_parent, &priv->parent_state_id);
+
+	if (new_parent) {
+		priv->parent_state_id = g_signal_connect (new_parent,
+		                                          NM_DEVICE_STATE_CHANGED,
+		                                          G_CALLBACK (parent_state_changed),
+		                                          device);
+
+		/* Set parent-dependent unmanaged flag */
+		nm_device_set_unmanaged_by_flags (device,
+		                                  NM_UNMANAGED_PARENT,
+		                                  !nm_device_get_managed (new_parent, FALSE),
+		                                  NM_DEVICE_STATE_REASON_PARENT_MANAGED_CHANGED);
+	}
+
+	/* Recheck availability now that the parent has changed */
+	if (new_ifindex > 0) {
+		nm_device_queue_recheck_available (device,
+		                                   NM_DEVICE_STATE_REASON_PARENT_CHANGED,
+		                                   NM_DEVICE_STATE_REASON_PARENT_CHANGED);
+	}
+}
+
+static void
+update_properties (NMDevice *device)
+{
+	NMDeviceMacsec *self;
+	NMDeviceMacsecPrivate *priv;
+	const NMPlatformLink *plink = NULL;
+	const NMPlatformLnkMacsec *props = NULL;
+	int ifindex;
+
+	g_return_if_fail (NM_IS_DEVICE_MACSEC (device));
+	self = NM_DEVICE_MACSEC (device);
+	priv = NM_DEVICE_MACSEC_GET_PRIVATE (self);
+
+	ifindex = nm_device_get_ifindex (device);
+	g_return_if_fail (ifindex > 0);
+	props = nm_platform_link_get_lnk_macsec (NM_PLATFORM_GET, ifindex, &plink);
+
+	if (!props) {
+		_LOGW (LOGD_PLATFORM, "could not get macsec properties");
+		return;
+	}
+
+	g_object_freeze_notify ((GObject *) device);
+
+	if (priv->props.parent_ifindex != props->parent_ifindex)
+		nm_device_parent_set_ifindex (device, props->parent_ifindex);
+
+#define CHECK_PROPERTY_CHANGED(field, prop) \
+	if (props->field != priv->props.field) \
+		_notify (self, prop)
+
+	CHECK_PROPERTY_CHANGED (sci, PROP_SCI);
+	CHECK_PROPERTY_CHANGED (cipher_suite, PROP_CIPHER_SUITE);
+	CHECK_PROPERTY_CHANGED (window, PROP_WINDOW);
+	CHECK_PROPERTY_CHANGED (icv_length, PROP_ICV_LENGTH);
+	CHECK_PROPERTY_CHANGED (encoding_sa, PROP_ENCODING_SA);
+	CHECK_PROPERTY_CHANGED (validation, PROP_VALIDATION);
+	CHECK_PROPERTY_CHANGED (encrypt, PROP_ENCRYPT);
+	CHECK_PROPERTY_CHANGED (protect, PROP_PROTECT);
+	CHECK_PROPERTY_CHANGED (include_sci, PROP_INCLUDE_SCI);
+	CHECK_PROPERTY_CHANGED (es, PROP_ES);
+	CHECK_PROPERTY_CHANGED (scb, PROP_SCB);
+	CHECK_PROPERTY_CHANGED (replay_protect, PROP_REPLAY_PROTECT);
+
+	priv->props = *props;
+	g_object_thaw_notify ((GObject *) device);
+}
+
+static NMSupplicantConfig *
+build_supplicant_config (NMDeviceMacsec *self, GError **error)
+{
+	NMSupplicantConfig *config = NULL;
+	NMSettingMacsec *s_macsec;
+	NMSetting8021x *s_8021x;
+	NMConnection *connection;
+	const char *con_uuid;
+	guint32 mtu;
+
+	connection = nm_device_get_applied_connection (NM_DEVICE (self));
+	g_assert (connection);
+	con_uuid = nm_connection_get_uuid (connection);
+	mtu = nm_platform_link_get_mtu (NM_PLATFORM_GET,
+	                                nm_device_get_ifindex (NM_DEVICE (self)));
+
+	config = nm_supplicant_config_new ();
+
+	s_macsec = (NMSettingMacsec *)
+		nm_device_get_applied_setting (NM_DEVICE (self), NM_TYPE_SETTING_MACSEC);
+
+	if (!nm_supplicant_config_add_setting_macsec (config, s_macsec, error)) {
+		g_prefix_error (error, "macsec-setting: ");
+		g_object_unref (config);
+		return NULL;
+	}
+
+	if (nm_setting_macsec_get_mode (s_macsec) == NM_SETTING_MACSEC_MODE_EAP) {
+		s_8021x = nm_connection_get_setting_802_1x (connection);
+		if (!nm_supplicant_config_add_setting_8021x (config, s_8021x, con_uuid, mtu, TRUE, error)) {
+			g_prefix_error (error, "802-1x-setting: ");
+			g_clear_object (&config);
+		}
+	}
+
+	return config;
+}
+
+static void
+supplicant_interface_clear_handlers (NMDeviceMacsec *self)
+{
+	NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self);
+
+	nm_clear_g_source (&priv->supplicant_timeout_id);
+	nm_clear_g_source (&priv->supplicant.con_timeout_id);
+	nm_clear_g_signal_handler (priv->supplicant.iface, &priv->supplicant.iface_error_id);
+}
+
+static void
+supplicant_interface_release (NMDeviceMacsec *self)
+{
+	NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self);
+
+	supplicant_interface_clear_handlers (self);
+
+	nm_clear_g_signal_handler (priv->supplicant.iface, &priv->supplicant.iface_state_id);
+
+	if (priv->supplicant.iface) {
+		nm_supplicant_interface_disconnect (priv->supplicant.iface);
+		g_clear_object (&priv->supplicant.iface);
+	}
+}
+
+static void
+supplicant_iface_connection_error_cb (NMSupplicantInterface *iface,
+                                      const char *name,
+                                      const char *message,
+                                      gpointer user_data)
+{
+	NMDeviceMacsec *self = NM_DEVICE_MACSEC (user_data);
+
+	_LOGW (LOGD_DEVICE,
+	       "Activation: association request to the supplicant failed: %s - %s",
+	       name, message);
+
+	supplicant_interface_release (self);
+	nm_device_queue_state (NM_DEVICE (self),
+	                       NM_DEVICE_STATE_FAILED,
+	                       NM_DEVICE_STATE_REASON_SUPPLICANT_CONFIG_FAILED);
+}
+
+static void
+macsec_secrets_cb (NMActRequest *req,
+                   NMActRequestGetSecretsCallId call_id,
+                   NMSettingsConnection *connection,
+                   GError *error,
+                   gpointer user_data)
+{
+	NMDeviceMacsec *self = NM_DEVICE_MACSEC (user_data);
+	NMDevice *device = NM_DEVICE (self);
+	NMDeviceMacsecPrivate *priv;
+
+	g_return_if_fail (NM_IS_DEVICE_MACSEC (self));
+	g_return_if_fail (NM_IS_ACT_REQUEST (req));
+
+	priv = NM_DEVICE_MACSEC_GET_PRIVATE (self);
+
+	g_return_if_fail (priv->macsec_secrets_id == call_id);
+
+	priv->macsec_secrets_id = NULL;
+
+	if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED))
+		return;
+
+	g_return_if_fail (req == nm_device_get_act_request (device));
+	g_return_if_fail (nm_device_get_state (device) == NM_DEVICE_STATE_NEED_AUTH);
+	g_return_if_fail (nm_act_request_get_settings_connection (req) == connection);
+
+	if (error) {
+		_LOGW (LOGD_ETHER, "%s", error->message);
+		nm_device_state_changed (device,
+		                         NM_DEVICE_STATE_FAILED,
+		                         NM_DEVICE_STATE_REASON_NO_SECRETS);
+	} else
+		nm_device_activate_schedule_stage1_device_prepare (device);
+}
+
+static void
+macsec_secrets_cancel (NMDeviceMacsec *self)
+{
+	NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self);
+
+	if (priv->macsec_secrets_id)
+		nm_act_request_cancel_secrets (NULL, priv->macsec_secrets_id);
+	nm_assert (!priv->macsec_secrets_id);
+}
+
+static void
+macsec_secrets_get_secrets (NMDeviceMacsec *self,
+                            const char *setting_name,
+                            NMSecretAgentGetSecretsFlags flags)
+{
+	NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self);
+	NMActRequest *req;
+
+	macsec_secrets_cancel (self);
+
+	req = nm_device_get_act_request (NM_DEVICE (self));
+	g_return_if_fail (NM_IS_ACT_REQUEST (req));
+
+	priv->macsec_secrets_id = nm_act_request_get_secrets (req,
+	                                                      TRUE,
+	                                                      setting_name,
+	                                                      flags,
+	                                                      NULL,
+	                                                      macsec_secrets_cb,
+	                                                      self);
+	g_return_if_fail (priv->macsec_secrets_id);
+}
+
+static gboolean
+link_timeout_cb (gpointer user_data)
+{
+	NMDeviceMacsec *self = NM_DEVICE_MACSEC (user_data);
+	NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self);
+	NMDevice *dev = NM_DEVICE (self);
+	NMActRequest *req;
+	NMConnection *applied_connection;
+	const char *setting_name;
+
+	priv->supplicant_timeout_id = 0;
+
+	req = nm_device_get_act_request (dev);
+
+	if (nm_device_get_state (dev) == NM_DEVICE_STATE_ACTIVATED) {
+		nm_device_state_changed (dev,
+		                         NM_DEVICE_STATE_FAILED,
+		                         NM_DEVICE_STATE_REASON_SUPPLICANT_TIMEOUT);
+		return FALSE;
+	}
+
+	/* Disconnect event during initial authentication and credentials
+	 * ARE checked - we are likely to have wrong key.  Ask the user for
+	 * another one.
+	 */
+	if (nm_device_get_state (dev) != NM_DEVICE_STATE_CONFIG)
+		goto time_out;
+
+	nm_active_connection_clear_secrets (NM_ACTIVE_CONNECTION (req));
+
+	applied_connection = nm_act_request_get_applied_connection (req);
+	setting_name = nm_connection_need_secrets (applied_connection, NULL);
+	if (!setting_name)
+		goto time_out;
+
+	_LOGI (LOGD_DEVICE | LOGD_ETHER,
+	       "Activation: disconnected during authentication, asking for new key.");
+	supplicant_interface_release (self);
+
+	nm_device_state_changed (dev, NM_DEVICE_STATE_NEED_AUTH, NM_DEVICE_STATE_REASON_SUPPLICANT_DISCONNECT);
+	macsec_secrets_get_secrets (self, setting_name, NM_SECRET_AGENT_GET_SECRETS_FLAG_REQUEST_NEW);
+
+	return FALSE;
+
+time_out:
+	_LOGW (LOGD_DEVICE | LOGD_ETHER, "link timed out.");
+	nm_device_state_changed (dev, NM_DEVICE_STATE_FAILED, NM_DEVICE_STATE_REASON_SUPPLICANT_DISCONNECT);
+
+	return FALSE;
+}
+
+static void
+supplicant_iface_state_cb (NMSupplicantInterface *iface,
+                           guint32 new_state,
+                           guint32 old_state,
+                           int disconnect_reason,
+                           gpointer user_data)
+{
+	NMDeviceMacsec *self = NM_DEVICE_MACSEC (user_data);
+	NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self);
+	NMDevice *device = NM_DEVICE (self);
+	NMSupplicantConfig *config;
+	gboolean success = FALSE;
+	NMDeviceState devstate;
+	GError *error = NULL;
+
+	if (new_state == old_state)
+		return;
+
+	_LOGI (LOGD_DEVICE, "supplicant interface state: %s -> %s",
+	       nm_supplicant_interface_state_to_string (old_state),
+	       nm_supplicant_interface_state_to_string (new_state));
+
+	devstate = nm_device_get_state (device);
+
+	switch (new_state) {
+	case NM_SUPPLICANT_INTERFACE_STATE_READY:
+		config = build_supplicant_config (self, &error);
+		if (config) {
+			success = nm_supplicant_interface_set_config (priv->supplicant.iface, config, &error);
+			g_object_unref (config);
+
+			if (!success) {
+				_LOGE (LOGD_DEVICE,
+				       "Activation: couldn't send security configuration to the supplicant: %s",
+				       error->message);
+				g_clear_error (&error);
+			}
+		} else {
+			_LOGE (LOGD_DEVICE,
+			       "Activation: couldn't build security configuration: %s",
+			       error->message);
+			g_clear_error (&error);
+		}
+
+		if (!success) {
+			nm_device_state_changed (device,
+			                         NM_DEVICE_STATE_FAILED,
+			                         NM_DEVICE_STATE_REASON_SUPPLICANT_CONFIG_FAILED);
+		}
+		break;
+	case NM_SUPPLICANT_INTERFACE_STATE_COMPLETED:
+		supplicant_interface_clear_handlers (self);
+		nm_device_bring_up (device, TRUE, NULL);
+
+		/* If this is the initial association during device activation,
+		 * schedule the next activation stage.
+		 */
+		if (devstate == NM_DEVICE_STATE_CONFIG) {
+			_LOGI (LOGD_DEVICE,
+			       "Activation: Stage 2 of 5 (Device Configure) successful.");
+			nm_device_activate_schedule_stage3_ip_config_start (device);
+		}
+		break;
+	case NM_SUPPLICANT_INTERFACE_STATE_DISCONNECTED:
+		if ((devstate == NM_DEVICE_STATE_ACTIVATED) || nm_device_is_activating (device)) {
+			/* Start the link timeout so we allow some time for reauthentication */
+			if (!priv->supplicant_timeout_id)
+				priv->supplicant_timeout_id = g_timeout_add_seconds (15, link_timeout_cb, device);
+		}
+		break;
+	case NM_SUPPLICANT_INTERFACE_STATE_DOWN:
+		supplicant_interface_release (self);
+
+		if ((devstate == NM_DEVICE_STATE_ACTIVATED) || nm_device_is_activating (device)) {
+			nm_device_state_changed (device,
+			                         NM_DEVICE_STATE_FAILED,
+			                         NM_DEVICE_STATE_REASON_SUPPLICANT_FAILED);
+		}
+		break;
+	default:
+		;
+	}
+}
+
+static NMActStageReturn
+handle_auth_or_fail (NMDeviceMacsec *self,
+                     NMActRequest *req,
+                     gboolean new_secrets)
+{
+	const char *setting_name;
+	guint32 tries;
+	NMConnection *applied_connection;
+
+	applied_connection = nm_act_request_get_applied_connection (req);
+
+	tries = GPOINTER_TO_UINT (g_object_get_data (G_OBJECT (applied_connection), MACSEC_SECRETS_TRIES));
+	if (tries > 3)
+		return NM_ACT_STAGE_RETURN_FAILURE;
+
+	nm_device_state_changed (NM_DEVICE (self), NM_DEVICE_STATE_NEED_AUTH, NM_DEVICE_STATE_REASON_NONE);
+
+	nm_active_connection_clear_secrets (NM_ACTIVE_CONNECTION (req));
+
+	setting_name = nm_connection_need_secrets (applied_connection, NULL);
+	if (setting_name) {
+		macsec_secrets_get_secrets (self, setting_name,
+		                            NM_SECRET_AGENT_GET_SECRETS_FLAG_ALLOW_INTERACTION
+		                             | (new_secrets ? NM_SECRET_AGENT_GET_SECRETS_FLAG_REQUEST_NEW : 0));
+		g_object_set_data (G_OBJECT (applied_connection), MACSEC_SECRETS_TRIES, GUINT_TO_POINTER (++tries));
+	} else
+		_LOGI (LOGD_DEVICE, "Cleared secrets, but setting didn't need any secrets.");
+
+	return NM_ACT_STAGE_RETURN_POSTPONE;
+}
+
+static gboolean
+supplicant_connection_timeout_cb (gpointer user_data)
+{
+	NMDeviceMacsec *self = NM_DEVICE_MACSEC (user_data);
+	NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self);
+	NMDevice *device = NM_DEVICE (self);
+	NMActRequest *req;
+	NMSettingsConnection *connection;
+	guint64 timestamp = 0;
+	gboolean new_secrets = TRUE;
+
+	priv->supplicant.con_timeout_id = 0;
+
+	/* Authentication failed; either driver problems, the encryption key is
+	 * wrong, the passwords or certificates were wrong or the Ethernet switch's
+	 * port is not configured for 802.1x. */
+	_LOGW (LOGD_DEVICE,
+	       "Activation: (macsec) association took too long.");
+
+	supplicant_interface_release (self);
+	req = nm_device_get_act_request (device);
+	g_assert (req);
+
+	connection = nm_act_request_get_settings_connection (req);
+	g_assert (connection);
+
+	/* Ask for new secrets only if we've never activated this connection
+	 * before.  If we've connected before, don't bother the user with dialogs,
+	 * just retry or fail, and if we never connect the user can fix the
+	 * password somewhere else. */
+	if (nm_settings_connection_get_timestamp (connection, &timestamp))
+		new_secrets = !timestamp;
+
+	if (handle_auth_or_fail (self, req, new_secrets) == NM_ACT_STAGE_RETURN_POSTPONE)
+		_LOGW (LOGD_DEVICE, "Activation: (macsec) asking for new secrets");
+	else
+		nm_device_state_changed (device, NM_DEVICE_STATE_FAILED, NM_DEVICE_STATE_REASON_NO_SECRETS);
+
+	return FALSE;
+}
+
+static gboolean
+supplicant_interface_init (NMDeviceMacsec *self)
+{
+	NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self);
+	NMDevice *parent;
+
+	parent = nm_device_parent_get_device (NM_DEVICE (self));
+	g_return_val_if_fail (parent, FALSE);
+
+	supplicant_interface_release (self);
+
+	priv->supplicant.iface = nm_supplicant_manager_create_interface (priv->supplicant.mgr,
+	                                                                 nm_device_get_iface (parent),
+	                                                                 NM_SUPPLICANT_DRIVER_MACSEC);
+
+	if (!priv->supplicant.iface) {
+		_LOGE (LOGD_DEVICE,
+		       "Couldn't initialize supplicant interface");
+		return FALSE;
+	}
+
+	/* Listen for its state signals */
+	priv->supplicant.iface_state_id = g_signal_connect (priv->supplicant.iface,
+	                                                    NM_SUPPLICANT_INTERFACE_STATE,
+	                                                    G_CALLBACK (supplicant_iface_state_cb),
+	                                                    self);
+
+	/* Hook up error signal handler to capture association errors */
+	priv->supplicant.iface_error_id = g_signal_connect (priv->supplicant.iface,
+	                                                    NM_SUPPLICANT_INTERFACE_CONNECTION_ERROR,
+	                                                    G_CALLBACK (supplicant_iface_connection_error_cb),
+	                                                    self);
+
+	/* Set up a timeout on the connection attempt to fail it after 25 seconds */
+	priv->supplicant.con_timeout_id = g_timeout_add_seconds (25, supplicant_connection_timeout_cb, self);
+
+	return TRUE;
+}
+
+static NMActStageReturn
+act_stage2_config (NMDevice *device, NMDeviceStateReason *reason)
+{
+	NMDeviceMacsec *self = NM_DEVICE_MACSEC (device);
+	NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self);
+	NMConnection *connection;
+	NMActStageReturn ret = NM_ACT_STAGE_RETURN_FAILURE;
+	const char *setting_name;
+
+	connection = nm_device_get_applied_connection (NM_DEVICE (self));
+	g_assert (connection);
+
+	if (!priv->supplicant.mgr)
+		priv->supplicant.mgr = g_object_ref (nm_supplicant_manager_get ());
+
+	/* If we need secrets, get them */
+	setting_name = nm_connection_need_secrets (connection, NULL);
+	if (setting_name) {
+		NMActRequest *req = nm_device_get_act_request (NM_DEVICE (self));
+
+		_LOGI (LOGD_DEVICE,
+		       "Activation: connection '%s' has security, but secrets are required.",
+		       nm_connection_get_id (connection));
+
+		ret = handle_auth_or_fail (self, req, FALSE);
+		if (ret != NM_ACT_STAGE_RETURN_POSTPONE)
+			*reason = NM_DEVICE_STATE_REASON_NO_SECRETS;
+	} else {
+		_LOGI (LOGD_DEVICE | LOGD_ETHER,
+		       "Activation: connection '%s' requires no security. No secrets needed.",
+		       nm_connection_get_id (connection));
+
+		if (supplicant_interface_init (self))
+			ret = NM_ACT_STAGE_RETURN_POSTPONE;
+		else
+			*reason = NM_DEVICE_STATE_REASON_CONFIG_FAILED;
+	}
+
+	return ret;
+}
+
+static void
+deactivate (NMDevice *device)
+{
+	NMDeviceMacsec *self = NM_DEVICE_MACSEC (device);
+
+	supplicant_interface_release (self);
+}
+
+static gboolean
+check_connection_compatible (NMDevice *device, NMConnection *connection)
+{
+	NMSettingMacsec *s_macsec;
+
+	if (!NM_DEVICE_CLASS (nm_device_macsec_parent_class)->check_connection_compatible (device, connection))
+		return FALSE;
+
+	s_macsec = nm_connection_get_setting_macsec (connection);
+	if (!s_macsec)
+		return FALSE;
+
+	return TRUE;
+}
+
+/******************************************************************/
+
+static NMDeviceCapabilities
+get_generic_capabilities (NMDevice *dev)
+{
+	/* We assume MACsec interfaces always support carrier detect */
+	return NM_DEVICE_CAP_CARRIER_DETECT | NM_DEVICE_CAP_IS_SOFTWARE;
+}
+
+/******************************************************************/
+
+static gboolean
+is_available (NMDevice *device, NMDeviceCheckDevAvailableFlags flags)
+{
+	if (!nm_device_parent_get_device (device))
+		return FALSE;
+	return NM_DEVICE_CLASS (nm_device_macsec_parent_class)->is_available (device, flags);
+}
+
+static gboolean
+create_and_realize (NMDevice *device,
+                    NMConnection *connection,
+                    NMDevice *parent,
+                    const NMPlatformLink **out_plink,
+                    GError **error)
+{
+	const char *iface = nm_device_get_iface (device);
+	NMPlatformError plerr;
+	NMSettingMacsec *s_macsec;
+	NMPlatformLnkMacsec lnk = { };
+	int parent_ifindex;
+	const char *hw_addr;
+	union {
+		struct {
+			guint8 mac[6];
+			guint16 port;
+		} s;
+		guint64 u;
+	} sci;
+
+	s_macsec = nm_connection_get_setting_macsec (connection);
+	g_assert (s_macsec);
+
+	if (!parent) {
+		g_set_error (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_FAILED,
+		             "MACsec devices can not be created without a parent interface");
+		return FALSE;
+	}
+
+	lnk.encrypt = nm_setting_macsec_get_encrypt (s_macsec);
+
+	hw_addr = nm_device_get_hw_address (parent);
+	if (!hw_addr) {
+		g_set_error (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_FAILED,
+		             "can't read parent MAC");
+		return FALSE;
+	}
+
+	nm_utils_hwaddr_aton (hw_addr, sci.s.mac, ETH_ALEN);
+	sci.s.port = htons (nm_setting_macsec_get_port (s_macsec));
+	lnk.sci = be64toh (sci.u);
+	lnk.validation = nm_setting_macsec_get_validation (s_macsec);
+
+	parent_ifindex = nm_device_get_ifindex (parent);
+	g_warn_if_fail (parent_ifindex > 0);
+
+	plerr = nm_platform_link_macsec_add (NM_PLATFORM_GET, iface, parent_ifindex, &lnk, out_plink);
+	if (plerr != NM_PLATFORM_ERROR_SUCCESS) {
+		g_set_error (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_CREATION_FAILED,
+		             "Failed to create macsec interface '%s' for '%s': %s",
+		             iface,
+		             nm_connection_get_id (connection),
+		             nm_platform_error_to_string (plerr));
+		return FALSE;
+	}
+
+	nm_device_parent_set_ifindex (device, parent_ifindex);
+
+	return TRUE;
+}
+
+static void
+link_changed (NMDevice *device,
+              const NMPlatformLink *pllink)
+{
+	NM_DEVICE_CLASS (nm_device_macsec_parent_class)->link_changed (device, pllink);
+	update_properties (device);
+}
+
+static void
+clear_secrets_tries (NMDevice *device)
+{
+	NMActRequest *req;
+	NMConnection *connection;
+
+	req = nm_device_get_act_request (device);
+	if (req) {
+		connection = nm_act_request_get_applied_connection (req);
+		/* Clear macsec secrets tries on success, failure, or when deactivating */
+		g_object_set_data (G_OBJECT (connection), MACSEC_SECRETS_TRIES, NULL);
+	}
+}
+
+static void
+device_state_changed (NMDevice *device,
+                      NMDeviceState new_state,
+                      NMDeviceState old_state,
+                      NMDeviceStateReason reason)
+{
+	if (new_state > NM_DEVICE_STATE_ACTIVATED)
+		macsec_secrets_cancel (NM_DEVICE_MACSEC (device));
+
+	if (   new_state == NM_DEVICE_STATE_ACTIVATED
+	    || new_state == NM_DEVICE_STATE_FAILED
+	    || new_state == NM_DEVICE_STATE_DISCONNECTED)
+		clear_secrets_tries (device);
+}
+
+/******************************************************************/
+
+static void
+get_property (GObject *object, guint prop_id,
+              GValue *value, GParamSpec *pspec)
+{
+	NMDeviceMacsec *self = NM_DEVICE_MACSEC (object);
+	NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (self);
+
+	switch (prop_id) {
+	case PROP_SCI:
+		g_value_set_uint64 (value, priv->props.sci);
+		break;
+	case PROP_CIPHER_SUITE:
+		g_value_set_uint64 (value, priv->props.cipher_suite);
+		break;
+	case PROP_ICV_LENGTH:
+		g_value_set_uchar (value, priv->props.icv_length);
+		break;
+	case PROP_WINDOW:
+		g_value_set_uint (value, priv->props.window);
+		break;
+	case PROP_ENCODING_SA:
+		g_value_set_uchar (value, priv->props.encoding_sa);
+		break;
+	case PROP_ENCRYPT:
+		g_value_set_boolean (value, priv->props.encrypt);
+		break;
+	case PROP_PROTECT:
+		g_value_set_boolean (value, priv->props.protect);
+		break;
+	case PROP_INCLUDE_SCI:
+		g_value_set_boolean (value, priv->props.include_sci);
+		break;
+	case PROP_ES:
+		g_value_set_boolean (value, priv->props.es);
+		break;
+	case PROP_SCB:
+		g_value_set_boolean (value, priv->props.scb);
+		break;
+	case PROP_REPLAY_PROTECT:
+		g_value_set_boolean (value, priv->props.replay_protect);
+		break;
+	case PROP_VALIDATION:
+		g_value_set_string (value,
+		                    validation_mode_to_string (priv->props.validation));
+		break;
+	default:
+		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+		break;
+	}
+}
+
+static void
+nm_device_macsec_init (NMDeviceMacsec * self)
+{
+}
+
+static void
+dispose (GObject *object)
+{
+	NMDeviceMacsec *self = NM_DEVICE_MACSEC (object);
+
+	macsec_secrets_cancel (self);
+	supplicant_interface_release (self);
+
+	G_OBJECT_CLASS (nm_device_macsec_parent_class)->dispose (object);
+}
+
+static void
+nm_device_macsec_class_init (NMDeviceMacsecClass *klass)
+{
+	GObjectClass *object_class = G_OBJECT_CLASS (klass);
+	NMDeviceClass *parent_class = NM_DEVICE_CLASS (klass);
+
+	NM_DEVICE_CLASS_DECLARE_TYPES (klass, NULL, NM_LINK_TYPE_MACSEC)
+
+	object_class->get_property = get_property;
+	object_class->dispose = dispose;
+
+	parent_class->act_stage2_config = act_stage2_config;
+	parent_class->check_connection_compatible = check_connection_compatible;
+	parent_class->create_and_realize = create_and_realize;
+	parent_class->deactivate = deactivate;
+	parent_class->get_generic_capabilities = get_generic_capabilities;
+	parent_class->link_changed = link_changed;
+	parent_class->is_available = is_available;
+	parent_class->parent_changed_notify = parent_changed_notify;
+	parent_class->state_changed = device_state_changed;
+	parent_class->get_configured_mtu = nm_device_get_configured_mtu_for_wired;
+
+	parent_class->connection_type = NM_SETTING_MACSEC_SETTING_NAME;
+
+	obj_properties[PROP_SCI] =
+	    g_param_spec_uint64 (NM_DEVICE_MACSEC_SCI, "", "",
+	                         0, G_MAXUINT64, 0,
+	                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+	obj_properties[PROP_CIPHER_SUITE] =
+	    g_param_spec_uint64 (NM_DEVICE_MACSEC_CIPHER_SUITE, "", "",
+	                         0, G_MAXUINT64, 0,
+	                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+	obj_properties[PROP_ICV_LENGTH] =
+	    g_param_spec_uchar (NM_DEVICE_MACSEC_ICV_LENGTH, "", "",
+	                        0, G_MAXUINT8, 0,
+	                        G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+	obj_properties[PROP_WINDOW] =
+	    g_param_spec_uint (NM_DEVICE_MACSEC_WINDOW, "", "",
+	                       0, G_MAXUINT32, 0,
+	                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+	obj_properties[PROP_ENCODING_SA] =
+	    g_param_spec_uchar (NM_DEVICE_MACSEC_ENCODING_SA, "", "",
+	                        0, 3, 0,
+	                        G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+	obj_properties[PROP_VALIDATION] =
+	    g_param_spec_string (NM_DEVICE_MACSEC_VALIDATION, "", "",
+	                         NULL,
+	                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+	obj_properties[PROP_ENCRYPT] =
+	    g_param_spec_boolean (NM_DEVICE_MACSEC_ENCRYPT, "", "",
+	                          FALSE,
+	                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+	obj_properties[PROP_PROTECT] =
+	    g_param_spec_boolean (NM_DEVICE_MACSEC_PROTECT, "", "",
+	                          FALSE,
+	                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+	obj_properties[PROP_INCLUDE_SCI] =
+	    g_param_spec_boolean (NM_DEVICE_MACSEC_INCLUDE_SCI, "", "",
+	                          FALSE,
+	                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+	obj_properties[PROP_ES] =
+	    g_param_spec_boolean (NM_DEVICE_MACSEC_ES, "", "",
+	                          FALSE,
+	                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+	obj_properties[PROP_SCB] =
+	    g_param_spec_boolean (NM_DEVICE_MACSEC_SCB, "", "",
+	                          FALSE,
+	                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+	obj_properties[PROP_REPLAY_PROTECT] =
+	    g_param_spec_boolean (NM_DEVICE_MACSEC_REPLAY_PROTECT, "", "",
+	                          FALSE,
+	                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
+
+	g_object_class_install_properties (object_class, _PROPERTY_ENUMS_LAST, obj_properties);
+
+	nm_exported_object_class_add_interface (NM_EXPORTED_OBJECT_CLASS (klass),
+	                                        NMDBUS_TYPE_DEVICE_MACSEC_SKELETON,
+	                                        NULL);
+}
+
+/*************************************************************/
+
+#define NM_TYPE_MACSEC_DEVICE_FACTORY (nm_macsec_device_factory_get_type ())
+#define NM_MACSEC_DEVICE_FACTORY(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), NM_TYPE_MACSEC_DEVICE_FACTORY, NMMacsecDeviceFactory))
+
+static NMDevice *
+create_device (NMDeviceFactory *factory,
+               const char *iface,
+               const NMPlatformLink *plink,
+               NMConnection *connection,
+               gboolean *out_ignore)
+{
+	return (NMDevice *) g_object_new (NM_TYPE_DEVICE_MACSEC,
+	                                  NM_DEVICE_IFACE, iface,
+	                                  NM_DEVICE_TYPE_DESC, "Macsec",
+	                                  NM_DEVICE_DEVICE_TYPE, NM_DEVICE_TYPE_MACSEC,
+	                                  NM_DEVICE_LINK_TYPE, NM_LINK_TYPE_MACSEC,
+	                                  NULL);
+}
+
+static const char *
+get_connection_parent (NMDeviceFactory *factory, NMConnection *connection)
+{
+	NMSettingMacsec *s_macsec;
+	NMSettingWired *s_wired;
+	const char *parent = NULL;
+
+	g_return_val_if_fail (nm_connection_is_type (connection, NM_SETTING_MACSEC_SETTING_NAME), NULL);
+
+	s_macsec = nm_connection_get_setting_macsec (connection);
+	g_assert (s_macsec);
+
+	parent = nm_setting_macsec_get_parent (s_macsec);
+	if (parent)
+		return parent;
+
+	/* Try the hardware address from the MACsec connection's hardware setting */
+	s_wired = nm_connection_get_setting_wired (connection);
+	if (s_wired)
+		return nm_setting_wired_get_mac_address (s_wired);
+
+	return NULL;
+}
+
+static char *
+get_connection_iface (NMDeviceFactory *factory,
+                      NMConnection *connection,
+                      const char *parent_iface)
+{
+	NMSettingMacsec *s_macsec;
+	const char *ifname;
+
+	g_return_val_if_fail (nm_connection_is_type (connection, NM_SETTING_MACSEC_SETTING_NAME), NULL);
+
+	s_macsec = nm_connection_get_setting_macsec (connection);
+	g_assert (s_macsec);
+
+	if (!parent_iface)
+		return NULL;
+
+	ifname = nm_connection_get_interface_name (connection);
+	return g_strdup (ifname);
+}
+
+NM_DEVICE_FACTORY_DEFINE_INTERNAL (MACSEC, Macsec, macsec,
+	NM_DEVICE_FACTORY_DECLARE_LINK_TYPES (NM_LINK_TYPE_MACSEC)
+	NM_DEVICE_FACTORY_DECLARE_SETTING_TYPES (NM_SETTING_MACSEC_SETTING_NAME),
+	factory_class->create_device = create_device;
+	factory_class->get_connection_parent = get_connection_parent;
+	factory_class->get_connection_iface = get_connection_iface;
+)
diff --git a/src/devices/nm-device-macsec.h b/src/devices/nm-device-macsec.h
new file mode 100644
index 0000000000..17b33bf593
--- /dev/null
+++ b/src/devices/nm-device-macsec.h
@@ -0,0 +1,54 @@
+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
+/* NetworkManager -- Network link manager
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Copyright 2017 Red Hat, Inc.
+ */
+
+#ifndef __NM_DEVICE_MACSEC_H__
+#define __NM_DEVICE_MACSEC_H__
+
+#include "nm-device.h"
+
+#define NM_TYPE_DEVICE_MACSEC            (nm_device_macsec_get_type ())
+#define NM_DEVICE_MACSEC(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), NM_TYPE_DEVICE_MACSEC, NMDeviceMacsec))
+#define NM_DEVICE_MACSEC_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass),  NM_TYPE_DEVICE_MACSEC, NMDeviceMacsecClass))
+#define NM_IS_DEVICE_MACSEC(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), NM_TYPE_DEVICE_MACSEC))
+#define NM_IS_DEVICE_MACSEC_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass),  NM_TYPE_DEVICE_MACSEC))
+#define NM_DEVICE_MACSEC_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj),  NM_TYPE_DEVICE_MACSEC, NMDeviceMacsecClass))
+
+#define NM_DEVICE_MACSEC_SCI             "sci"
+#define NM_DEVICE_MACSEC_CIPHER_SUITE    "cipher-suite"
+#define NM_DEVICE_MACSEC_ICV_LENGTH      "icv-length"
+#define NM_DEVICE_MACSEC_WINDOW          "window"
+#define NM_DEVICE_MACSEC_ENCODING_SA     "encoding-sa"
+#define NM_DEVICE_MACSEC_VALIDATION      "validation"
+#define NM_DEVICE_MACSEC_ENCRYPT         "encrypt"
+#define NM_DEVICE_MACSEC_PROTECT         "protect"
+#define NM_DEVICE_MACSEC_INCLUDE_SCI     "include-sci"
+#define NM_DEVICE_MACSEC_ES              "es"
+#define NM_DEVICE_MACSEC_SCB             "scb"
+#define NM_DEVICE_MACSEC_REPLAY_PROTECT  "replay-protect"
+
+/* defined in the parent class, but exposed on D-Bus by the subclass. */
+#define NM_DEVICE_MACSEC_PARENT          NM_DEVICE_PARENT
+
+typedef struct _NMDeviceMacsec NMDeviceMacsec;
+typedef struct _NMDeviceMacsecClass NMDeviceMacsecClass;
+
+GType nm_device_macsec_get_type (void);
+
+#endif /* __NM_DEVICE_MACSEC_H__ */
diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
index c236a85803..f0a218ee18 100644
--- a/src/devices/nm-device.c
+++ b/src/devices/nm-device.c
@@ -1330,6 +1330,8 @@ nm_device_get_priority (NMDevice *self)
 	case NM_DEVICE_TYPE_ETHERNET:
 	case NM_DEVICE_TYPE_VETH:
 		return 100;
+	case NM_DEVICE_TYPE_MACSEC:
+		return 125;
 	case NM_DEVICE_TYPE_INFINIBAND:
 		return 150;
 	case NM_DEVICE_TYPE_ADSL:
diff --git a/src/devices/wifi/nm-device-wifi.c b/src/devices/wifi/nm-device-wifi.c
index 9d002e8362..9e7196d3ec 100644
--- a/src/devices/wifi/nm-device-wifi.c
+++ b/src/devices/wifi/nm-device-wifi.c
@@ -232,7 +232,7 @@ supplicant_interface_acquire (NMDeviceWifi *self)
 
 	priv->sup_iface = nm_supplicant_manager_create_interface (priv->sup_mgr,
 	                                                          nm_device_get_iface (NM_DEVICE (self)),
-	                                                          TRUE);
+	                                                          NM_SUPPLICANT_DRIVER_WIRELESS);
 	if (!priv->sup_iface) {
 		_LOGE (LOGD_WIFI, "Couldn't initialize supplicant interface");
 		return FALSE;
diff --git a/src/nm-types.h b/src/nm-types.h
index 8f0cc5849f..c323c9a786 100644
--- a/src/nm-types.h
+++ b/src/nm-types.h
@@ -129,6 +129,7 @@ typedef enum {
 	NM_LINK_TYPE_IP6TNL,
 	NM_LINK_TYPE_IPIP,
 	NM_LINK_TYPE_LOOPBACK,
+	NM_LINK_TYPE_MACSEC,
 	NM_LINK_TYPE_MACVLAN,
 	NM_LINK_TYPE_MACVTAP,
 	NM_LINK_TYPE_OPENVSWITCH,
@@ -160,6 +161,7 @@ typedef enum {
 	NMP_OBJECT_TYPE_LNK_INFINIBAND,
 	NMP_OBJECT_TYPE_LNK_IP6TNL,
 	NMP_OBJECT_TYPE_LNK_IPIP,
+	NMP_OBJECT_TYPE_LNK_MACSEC,
 	NMP_OBJECT_TYPE_LNK_MACVLAN,
 	NMP_OBJECT_TYPE_LNK_MACVTAP,
 	NMP_OBJECT_TYPE_LNK_SIT,
diff --git a/src/platform/nm-linux-platform.c b/src/platform/nm-linux-platform.c
index 7b68d14437..ef946e39a0 100644
--- a/src/platform/nm-linux-platform.c
+++ b/src/platform/nm-linux-platform.c
@@ -21,6 +21,7 @@
 
 #include "nm-linux-platform.h"
 
+#include <endian.h>
 #include <errno.h>
 #include <unistd.h>
 #include <sys/socket.h>
@@ -111,6 +112,25 @@
 
 /*****************************************************************************/
 
+#define IFLA_MACSEC_UNSPEC              0
+#define IFLA_MACSEC_SCI                 1
+#define IFLA_MACSEC_PORT                2
+#define IFLA_MACSEC_ICV_LEN             3
+#define IFLA_MACSEC_CIPHER_SUITE        4
+#define IFLA_MACSEC_WINDOW              5
+#define IFLA_MACSEC_ENCODING_SA         6
+#define IFLA_MACSEC_ENCRYPT             7
+#define IFLA_MACSEC_PROTECT             8
+#define IFLA_MACSEC_INC_SCI             9
+#define IFLA_MACSEC_ES                  10
+#define IFLA_MACSEC_SCB                 11
+#define IFLA_MACSEC_REPLAY_PROTECT      12
+#define IFLA_MACSEC_VALIDATION          13
+#define IFLA_MACSEC_PAD                 14
+#define __IFLA_MACSEC_MAX               15
+
+/*****************************************************************************/
+
 #define _NMLOG_PREFIX_NAME                "platform-linux"
 #define _NMLOG_DOMAIN                     LOGD_PLATFORM
 #define _NMLOG2_DOMAIN                    LOGD_PLATFORM
@@ -365,6 +385,7 @@ static const LinkDesc linktypes[] = {
 	{ NM_LINK_TYPE_IP6TNL,        "ip6tnl",      "ip6tnl",      NULL },
 	{ NM_LINK_TYPE_IPIP,          "ipip",        "ipip",        NULL },
 	{ NM_LINK_TYPE_LOOPBACK,      "loopback",    NULL,          NULL },
+	{ NM_LINK_TYPE_MACSEC,        "macsec",      "macsec",      NULL },
 	{ NM_LINK_TYPE_MACVLAN,       "macvlan",     "macvlan",     NULL },
 	{ NM_LINK_TYPE_MACVTAP,       "macvtap",     "macvtap",     NULL },
 	{ NM_LINK_TYPE_OPENVSWITCH,   "openvswitch", "openvswitch", NULL },
@@ -1110,6 +1131,56 @@ _parse_lnk_macvlan (const char *kind, struct nlattr *info_data)
 /*****************************************************************************/
 
 static NMPObject *
+_parse_lnk_macsec (const char *kind, struct nlattr *info_data)
+{
+	static struct nla_policy policy[__IFLA_MACSEC_MAX] = {
+		[IFLA_MACSEC_SCI]            = { .type = NLA_U64 },
+		[IFLA_MACSEC_ICV_LEN]        = { .type = NLA_U8 },
+		[IFLA_MACSEC_CIPHER_SUITE]   = { .type = NLA_U64 },
+		[IFLA_MACSEC_WINDOW]         = { .type = NLA_U32 },
+		[IFLA_MACSEC_ENCODING_SA]    = { .type = NLA_U8 },
+		[IFLA_MACSEC_ENCRYPT]        = { .type = NLA_U8 },
+		[IFLA_MACSEC_PROTECT]        = { .type = NLA_U8 },
+		[IFLA_MACSEC_INC_SCI]        = { .type = NLA_U8 },
+		[IFLA_MACSEC_ES]             = { .type = NLA_U8 },
+		[IFLA_MACSEC_SCB]            = { .type = NLA_U8 },
+		[IFLA_MACSEC_REPLAY_PROTECT] = { .type = NLA_U8 },
+		[IFLA_MACSEC_VALIDATION]     = { .type = NLA_U8 },
+	};
+	struct nlattr *tb[__IFLA_MACSEC_MAX];
+	int err;
+	NMPObject *obj;
+	NMPlatformLnkMacsec *props;
+
+	if (!info_data || !nm_streq0 (kind, "macsec"))
+		return NULL;
+
+	err = nla_parse_nested (tb, __IFLA_MACSEC_MAX - 1, info_data, policy);
+	if (err < 0)
+		return NULL;
+
+	obj = nmp_object_new (NMP_OBJECT_TYPE_LNK_MACSEC, NULL);
+	props = &obj->lnk_macsec;
+
+	props->sci = tb[IFLA_MACSEC_SCI] ? be64toh (nla_get_u64 (tb[IFLA_MACSEC_SCI])) : 0;
+	props->icv_length = tb[IFLA_MACSEC_ICV_LEN] ? nla_get_u8 (tb[IFLA_MACSEC_ICV_LEN]) : 0;
+	props->cipher_suite = tb [IFLA_MACSEC_CIPHER_SUITE] ? nla_get_u64 (tb[IFLA_MACSEC_CIPHER_SUITE]) : 0;
+	props->window = tb [IFLA_MACSEC_WINDOW] ? nla_get_u32 (tb[IFLA_MACSEC_WINDOW]) : 0;
+	props->encoding_sa = tb[IFLA_MACSEC_ENCODING_SA] ? !!nla_get_u8 (tb[IFLA_MACSEC_ENCODING_SA]) : 0;
+	props->encrypt = tb[IFLA_MACSEC_ENCRYPT] ? !!nla_get_u8 (tb[IFLA_MACSEC_ENCRYPT]) : 0;
+	props->protect = tb[IFLA_MACSEC_PROTECT] ? !!nla_get_u8 (tb[IFLA_MACSEC_PROTECT]) : 0;
+	props->include_sci = tb[IFLA_MACSEC_INC_SCI] ? !!nla_get_u8 (tb[IFLA_MACSEC_INC_SCI]) : 0;
+	props->es = tb[IFLA_MACSEC_ES] ? !!nla_get_u8 (tb[IFLA_MACSEC_ES]) : 0;
+	props->scb = tb[IFLA_MACSEC_SCB] ? !!nla_get_u8 (tb[IFLA_MACSEC_SCB]) : 0;
+	props->replay_protect = tb[IFLA_MACSEC_REPLAY_PROTECT] ? !!nla_get_u8 (tb[IFLA_MACSEC_REPLAY_PROTECT]) : 0;
+	props->validation = tb[IFLA_MACSEC_VALIDATION] ? nla_get_u8 (tb[IFLA_MACSEC_VALIDATION]) : 0;
+
+	return obj;
+}
+
+/*****************************************************************************/
+
+static NMPObject *
 _parse_lnk_sit (const char *kind, struct nlattr *info_data)
 {
 	static struct nla_policy policy[IFLA_IPTUN_MAX + 1] = {
@@ -1555,6 +1626,9 @@ _new_from_nl_link (NMPlatform *platform, const NMPCache *cache, struct nlmsghdr
 	case NM_LINK_TYPE_IPIP:
 		lnk_data = _parse_lnk_ipip (nl_info_kind, nl_info_data);
 		break;
+	case NM_LINK_TYPE_MACSEC:
+		lnk_data = _parse_lnk_macsec (nl_info_kind, nl_info_data);
+		break;
 	case NM_LINK_TYPE_MACVLAN:
 	case NM_LINK_TYPE_MACVTAP:
 		lnk_data = _parse_lnk_macvlan (nl_info_kind, nl_info_data);
@@ -4813,6 +4887,68 @@ nla_put_failure:
 }
 
 static int
+link_macsec_add (NMPlatform *platform,
+                 const char *name,
+                 int parent,
+                 const NMPlatformLnkMacsec *props,
+                 const NMPlatformLink **out_link)
+{
+	nm_auto_nlmsg struct nl_msg *nlmsg = NULL;
+	struct nlattr *info;
+	struct nlattr *data;
+
+	_LOGD ("adding macsec '%s' parent %u sci %llx",
+	       name,
+	       parent,
+	       (unsigned long long) props->sci);
+
+	nlmsg = _nl_msg_new_link (RTM_NEWLINK,
+	                          NLM_F_CREATE | NLM_F_EXCL,
+	                          0,
+	                          name,
+	                          0,
+	                          0);
+	if (!nlmsg)
+		return FALSE;
+
+	NLA_PUT_U32 (nlmsg, IFLA_LINK, parent);
+
+	if (!(info = nla_nest_start (nlmsg, IFLA_LINKINFO)))
+		goto nla_put_failure;
+
+	NLA_PUT_STRING (nlmsg, IFLA_INFO_KIND, "macsec");
+
+	if (!(data = nla_nest_start (nlmsg, IFLA_INFO_DATA)))
+		goto nla_put_failure;
+
+	if (props->icv_length)
+		NLA_PUT_U8 (nlmsg, IFLA_MACSEC_ICV_LEN, 16);
+	if (props->cipher_suite)
+		NLA_PUT_U64 (nlmsg, IFLA_MACSEC_CIPHER_SUITE, props->cipher_suite);
+	if (props->replay_protect)
+		NLA_PUT_U32 (nlmsg, IFLA_MACSEC_WINDOW, props->window);
+
+	NLA_PUT_U64 (nlmsg, IFLA_MACSEC_SCI, htobe64 (props->sci));
+	NLA_PUT_U8 (nlmsg, IFLA_MACSEC_ENCODING_SA, props->encoding_sa);
+	NLA_PUT_U8 (nlmsg, IFLA_MACSEC_ENCRYPT, props->encrypt);
+	NLA_PUT_U8 (nlmsg, IFLA_MACSEC_PROTECT, props->protect);
+	NLA_PUT_U8 (nlmsg, IFLA_MACSEC_INC_SCI, props->include_sci);
+	NLA_PUT_U8 (nlmsg, IFLA_MACSEC_ES, props->es);
+	NLA_PUT_U8 (nlmsg, IFLA_MACSEC_SCB, props->scb);
+	NLA_PUT_U8 (nlmsg, IFLA_MACSEC_REPLAY_PROTECT, props->replay_protect);
+	NLA_PUT_U8 (nlmsg, IFLA_MACSEC_VALIDATION, props->validation);
+
+	nla_nest_end (nlmsg, data);
+	nla_nest_end (nlmsg, info);
+
+	return do_add_link_with_lookup (platform,
+	                               NM_LINK_TYPE_MACSEC,
+	                                name, nlmsg, out_link);
+nla_put_failure:
+	g_return_val_if_reached (FALSE);
+}
+
+static int
 link_macvlan_add (NMPlatform *platform,
                   const char *name,
                   int parent,
@@ -6654,6 +6790,7 @@ nm_linux_platform_class_init (NMLinuxPlatformClass *klass)
 
 	platform_class->link_gre_add = link_gre_add;
 	platform_class->link_ip6tnl_add = link_ip6tnl_add;
+	platform_class->link_macsec_add = link_macsec_add;
 	platform_class->link_macvlan_add = link_macvlan_add;
 	platform_class->link_ipip_add = link_ipip_add;
 	platform_class->link_sit_add = link_sit_add;
diff --git a/src/platform/nm-platform.c b/src/platform/nm-platform.c
index 0b23b67f14..4552f76069 100644
--- a/src/platform/nm-platform.c
+++ b/src/platform/nm-platform.c
@@ -1527,6 +1527,12 @@ nm_platform_link_get_lnk_ipip (NMPlatform *self, int ifindex, const NMPlatformLi
 	return _link_get_lnk (self, ifindex, NM_LINK_TYPE_IPIP, out_link);
 }
 
+const NMPlatformLnkMacsec *
+nm_platform_link_get_lnk_macsec (NMPlatform *self, int ifindex, const NMPlatformLink **out_link)
+{
+	return _link_get_lnk (self, ifindex, NM_LINK_TYPE_MACSEC, out_link);
+}
+
 const NMPlatformLnkMacvlan *
 nm_platform_link_get_lnk_macvlan (NMPlatform *self, int ifindex, const NMPlatformLink **out_link)
 {
@@ -2171,6 +2177,43 @@ nm_platform_link_ipip_add (NMPlatform *self,
 }
 
 /**
+ * nm_platform_macsec_add:
+ * @self: platform instance
+ * @name: name of the new interface
+ * @props: interface properties
+ * @out_link: on success, the link object
+ *
+ * Create a MACsec interface.
+ */
+NMPlatformError
+nm_platform_link_macsec_add (NMPlatform *self,
+                             const char *name,
+                             int parent,
+                             const NMPlatformLnkMacsec *props,
+                             const NMPlatformLink **out_link)
+{
+	NMPlatformError plerr;
+
+	_CHECK_SELF (self, klass, NM_PLATFORM_ERROR_BUG);
+
+	g_return_val_if_fail (props, NM_PLATFORM_ERROR_BUG);
+	g_return_val_if_fail (name, NM_PLATFORM_ERROR_BUG);
+
+	plerr = _link_add_check_existing (self, name, NM_LINK_TYPE_MACSEC, out_link);
+	if (plerr != NM_PLATFORM_ERROR_SUCCESS)
+		return plerr;
+
+	_LOGD ("adding macsec '%s' parent %u sci %llx",
+	       name,
+	       parent,
+	       (unsigned long long) props->sci);
+
+	if (!klass->link_macsec_add (self, name, parent, props, out_link))
+		return NM_PLATFORM_ERROR_UNSPECIFIED;
+	return NM_PLATFORM_ERROR_SUCCESS;
+}
+
+/**
  * nm_platform_macvlan_add:
  * @self: platform instance
  * @name: name of the new interface
@@ -3484,6 +3527,39 @@ nm_platform_lnk_ipip_to_string (const NMPlatformLnkIpIp *lnk, char *buf, gsize l
 }
 
 const char *
+nm_platform_lnk_macsec_to_string (const NMPlatformLnkMacsec *lnk, char *buf, gsize len)
+{
+	if (!nm_utils_to_string_buffer_init_null (lnk, &buf, &len))
+		return buf;
+
+	g_snprintf (buf, len,
+	            "macsec "
+	            "sci %016llx "
+	            "protect %s "
+	            "cipher %016llx "
+	            "icvlen %u "
+	            "encodingsa %u "
+	            "validate %u "
+	            "encrypt %s "
+	            "send_sci %s "
+	            "end_station %s "
+	            "scb %s "
+	            "replay %s",
+	            (unsigned long long) lnk->sci,
+	            lnk->protect ? "on" : "off",
+	            (unsigned long long) lnk->cipher_suite,
+	            lnk->icv_length,
+	            lnk->encoding_sa,
+	            lnk->validation,
+	            lnk->encrypt ? "on" : "off",
+	            lnk->include_sci ? "on" : "off",
+	            lnk->es ? "on" : "off",
+	            lnk->scb ? "on" : "off",
+	            lnk->replay_protect ? "on" : "off");
+	return buf;
+}
+
+const char *
 nm_platform_lnk_macvlan_to_string (const NMPlatformLnkMacvlan *lnk, char *buf, gsize len)
 {
 	if (!nm_utils_to_string_buffer_init_null (lnk, &buf, &len))
@@ -4065,6 +4141,25 @@ nm_platform_lnk_ipip_cmp (const NMPlatformLnkIpIp *a, const NMPlatformLnkIpIp *b
 }
 
 int
+nm_platform_lnk_macsec_cmp (const NMPlatformLnkMacsec *a, const NMPlatformLnkMacsec *b)
+{
+	_CMP_SELF (a, b);
+	_CMP_FIELD (a, b, sci);
+	_CMP_FIELD (a, b, icv_length);
+	_CMP_FIELD (a, b, cipher_suite);
+	_CMP_FIELD (a, b, window);
+	_CMP_FIELD (a, b, encoding_sa);
+	_CMP_FIELD (a, b, validation);
+	_CMP_FIELD (a, b, encrypt);
+	_CMP_FIELD (a, b, protect);
+	_CMP_FIELD (a, b, include_sci);
+	_CMP_FIELD (a, b, es);
+	_CMP_FIELD (a, b, scb);
+	_CMP_FIELD (a, b, replay_protect);
+	return 0;
+}
+
+int
 nm_platform_lnk_macvlan_cmp (const NMPlatformLnkMacvlan *a, const NMPlatformLnkMacvlan *b)
 {
 	_CMP_SELF (a, b);
diff --git a/src/platform/nm-platform.h b/src/platform/nm-platform.h
index 91f8ab5d6f..f0b2cc8225 100644
--- a/src/platform/nm-platform.h
+++ b/src/platform/nm-platform.h
@@ -427,6 +427,22 @@ typedef struct {
 } NMPlatformLnkIpIp;
 
 typedef struct {
+	int parent_ifindex;
+	guint64 sci;	/* host byte order */
+	guint64 cipher_suite;
+	guint32 window;
+	guint8 icv_length;
+	guint8 encoding_sa;
+	guint8 validation;
+	bool encrypt:1;
+	bool protect:1;
+	bool include_sci:1;
+	bool es:1;
+	bool scb:1;
+	bool replay_protect:1;
+} NMPlatformLnkMacsec;
+
+typedef struct {
 	guint mode;
 	bool no_promisc:1;
 	bool tap:1;
@@ -588,6 +604,11 @@ typedef struct {
 	                           const char *name,
 	                           const NMPlatformLnkIpIp *props,
 	                           const NMPlatformLink **out_link);
+	gboolean (*link_macsec_add) (NMPlatform *,
+	                             const char *name,
+	                             int parent,
+	                             const NMPlatformLnkMacsec *props,
+	                             const NMPlatformLink **out_link);
 	gboolean (*link_macvlan_add) (NMPlatform *,
 	                              const char *name,
 	                              int parent,
@@ -818,6 +839,7 @@ const NMPlatformLnkIp6Tnl *nm_platform_link_get_lnk_ip6tnl (NMPlatform *self, in
 const NMPlatformLnkIpIp *nm_platform_link_get_lnk_ipip (NMPlatform *self, int ifindex, const NMPlatformLink **out_link);
 const NMPlatformLnkInfiniband *nm_platform_link_get_lnk_infiniband (NMPlatform *self, int ifindex, const NMPlatformLink **out_link);
 const NMPlatformLnkIpIp *nm_platform_link_get_lnk_ipip (NMPlatform *self, int ifindex, const NMPlatformLink **out_link);
+const NMPlatformLnkMacsec *nm_platform_link_get_lnk_macsec (NMPlatform *self, int ifindex, const NMPlatformLink **out_link);
 const NMPlatformLnkMacvlan *nm_platform_link_get_lnk_macvlan (NMPlatform *self, int ifindex, const NMPlatformLink **out_link);
 const NMPlatformLnkMacvtap *nm_platform_link_get_lnk_macvtap (NMPlatform *self, int ifindex, const NMPlatformLink **out_link);
 const NMPlatformLnkSit *nm_platform_link_get_lnk_sit (NMPlatform *self, int ifindex, const NMPlatformLink **out_link);
@@ -902,6 +924,11 @@ NMPlatformError nm_platform_link_ipip_add (NMPlatform *self,
                                            const char *name,
                                            const NMPlatformLnkIpIp *props,
                                            const NMPlatformLink **out_link);
+NMPlatformError nm_platform_link_macsec_add (NMPlatform *self,
+                                             const char *name,
+                                             int parent,
+                                             const NMPlatformLnkMacsec *props,
+                                             const NMPlatformLink **out_link);
 NMPlatformError nm_platform_link_macvlan_add (NMPlatform *self,
                                               const char *name,
                                               int parent,
@@ -956,6 +983,7 @@ const char *nm_platform_lnk_gre_to_string (const NMPlatformLnkGre *lnk, char *bu
 const char *nm_platform_lnk_infiniband_to_string (const NMPlatformLnkInfiniband *lnk, char *buf, gsize len);
 const char *nm_platform_lnk_ip6tnl_to_string (const NMPlatformLnkIp6Tnl *lnk, char *buf, gsize len);
 const char *nm_platform_lnk_ipip_to_string (const NMPlatformLnkIpIp *lnk, char *buf, gsize len);
+const char *nm_platform_lnk_macsec_to_string (const NMPlatformLnkMacsec *lnk, char *buf, gsize len);
 const char *nm_platform_lnk_macvlan_to_string (const NMPlatformLnkMacvlan *lnk, char *buf, gsize len);
 const char *nm_platform_lnk_sit_to_string (const NMPlatformLnkSit *lnk, char *buf, gsize len);
 const char *nm_platform_lnk_vlan_to_string (const NMPlatformLnkVlan *lnk, char *buf, gsize len);
@@ -976,6 +1004,7 @@ int nm_platform_lnk_gre_cmp (const NMPlatformLnkGre *a, const NMPlatformLnkGre *
 int nm_platform_lnk_infiniband_cmp (const NMPlatformLnkInfiniband *a, const NMPlatformLnkInfiniband *b);
 int nm_platform_lnk_ip6tnl_cmp (const NMPlatformLnkIp6Tnl *a, const NMPlatformLnkIp6Tnl *b);
 int nm_platform_lnk_ipip_cmp (const NMPlatformLnkIpIp *a, const NMPlatformLnkIpIp *b);
+int nm_platform_lnk_macsec_cmp (const NMPlatformLnkMacsec *a, const NMPlatformLnkMacsec *b);
 int nm_platform_lnk_macvlan_cmp (const NMPlatformLnkMacvlan *a, const NMPlatformLnkMacvlan *b);
 int nm_platform_lnk_sit_cmp (const NMPlatformLnkSit *a, const NMPlatformLnkSit *b);
 int nm_platform_lnk_vlan_cmp (const NMPlatformLnkVlan *a, const NMPlatformLnkVlan *b);
diff --git a/src/platform/nmp-object.c b/src/platform/nmp-object.c
index e1e13882da..1503ca9a17 100644
--- a/src/platform/nmp-object.c
+++ b/src/platform/nmp-object.c
@@ -2230,6 +2230,15 @@ const NMPClass _nmp_classes[NMP_OBJECT_TYPE_MAX] = {
 		.cmd_plobj_to_string                = (const char *(*) (const NMPlatformObject *obj, char *buf, gsize len)) nm_platform_lnk_ipip_to_string,
 		.cmd_plobj_cmp                      = (int (*) (const NMPlatformObject *obj1, const NMPlatformObject *obj2)) nm_platform_lnk_ipip_cmp,
 	},
+	[NMP_OBJECT_TYPE_LNK_MACSEC - 1] = {
+		.obj_type                           = NMP_OBJECT_TYPE_LNK_MACSEC,
+		.sizeof_data                        = sizeof (NMPObjectLnkMacsec),
+		.sizeof_public                      = sizeof (NMPlatformLnkMacsec),
+		.obj_type_name                      = "macsec",
+		.lnk_link_type                      = NM_LINK_TYPE_MACSEC,
+		.cmd_plobj_to_string                = (const char *(*) (const NMPlatformObject *obj, char *buf, gsize len)) nm_platform_lnk_macsec_to_string,
+		.cmd_plobj_cmp                      = (int (*) (const NMPlatformObject *obj1, const NMPlatformObject *obj2)) nm_platform_lnk_macsec_cmp,
+	},
 	[NMP_OBJECT_TYPE_LNK_MACVLAN - 1] = {
 		.obj_type                           = NMP_OBJECT_TYPE_LNK_MACVLAN,
 		.sizeof_data                        = sizeof (NMPObjectLnkMacvlan),
diff --git a/src/platform/nmp-object.h b/src/platform/nmp-object.h
index 7a91583a25..dd11b98586 100644
--- a/src/platform/nmp-object.h
+++ b/src/platform/nmp-object.h
@@ -207,6 +207,10 @@ typedef struct {
 } NMPObjectLnkIpIp;
 
 typedef struct {
+	NMPlatformLnkMacsec _public;
+} NMPObjectLnkMacsec;
+
+typedef struct {
 	NMPlatformLnkMacvlan _public;
 } NMPObjectLnkMacvlan;
 
@@ -267,6 +271,9 @@ struct _NMPObject {
 		NMPlatformLnkIp6Tnl     lnk_ip6tnl;
 		NMPObjectLnkIp6Tnl      _lnk_ip6tnl;
 
+		NMPlatformLnkMacsec     lnk_macsec;
+		NMPObjectLnkMacsec      _lnk_macsec;
+
 		NMPlatformLnkMacvlan    lnk_macvlan;
 		NMPObjectLnkMacvlan     _lnk_macvlan;
 
diff --git a/src/supplicant/nm-supplicant-config.c b/src/supplicant/nm-supplicant-config.c
index a312d65919..8f766d7cb9 100644
--- a/src/supplicant/nm-supplicant-config.c
+++ b/src/supplicant/nm-supplicant-config.c
@@ -363,6 +363,83 @@ wifi_freqs_to_string (gboolean bg_band)
 }
 
 gboolean
+nm_supplicant_config_add_setting_macsec (NMSupplicantConfig * self,
+                                         NMSettingMacsec * setting,
+                                         GError **error)
+{
+	NMSupplicantConfigPrivate *priv;
+	gs_unref_bytes GBytes *bytes = NULL;
+	const char *value;
+	char buf[32];
+	int port;
+
+	g_return_val_if_fail (NM_IS_SUPPLICANT_CONFIG (self), FALSE);
+	g_return_val_if_fail (setting != NULL, FALSE);
+	g_return_val_if_fail (!error || !*error, FALSE);
+
+	priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE (self);
+
+	if (!nm_supplicant_config_add_option (self, "macsec_policy", "1", -1, NULL, error))
+		return FALSE;
+
+	value = nm_setting_macsec_get_encrypt (setting) ? "0" : "1";
+	if (!nm_supplicant_config_add_option (self, "macsec_integ_only", value, -1, NULL, error))
+		return FALSE;
+
+	port = nm_setting_macsec_get_port (setting);
+	if (port > 0 && port < 65534) {
+		snprintf (buf, sizeof (buf), "%d", port);
+		if (!nm_supplicant_config_add_option (self, "macsec_port", buf, -1, NULL, error))
+			return FALSE;
+	}
+
+	if (nm_setting_macsec_get_mode (setting) == NM_SETTING_MACSEC_MODE_PSK) {
+		if (!nm_supplicant_config_add_option (self, "key_mgmt", "NONE", -1, NULL, error))
+			return FALSE;
+
+		/* CAK */
+		value = nm_setting_macsec_get_mka_cak (setting);
+		if (!value) {
+			g_set_error_literal (error,
+			                     NM_SUPPLICANT_ERROR,
+			                     NM_SUPPLICANT_ERROR_CONFIG,
+			                     "missing MKA CAK");
+			return FALSE;
+		}
+
+		bytes = nm_utils_hexstr2bin (value);
+		if (!nm_supplicant_config_add_option (self,
+		                                      "mka_cak",
+		                                      g_bytes_get_data (bytes, NULL),
+		                                      g_bytes_get_size (bytes),
+		                                      "<hidden>",
+		                                      error))
+			return FALSE;
+
+		/* CKN */
+		value = nm_setting_macsec_get_mka_ckn (setting);
+		if (!value) {
+			g_set_error_literal (error,
+			                     NM_SUPPLICANT_ERROR,
+			                     NM_SUPPLICANT_ERROR_CONFIG,
+			                     "missing MKA CKN");
+			return FALSE;
+		}
+
+		bytes = nm_utils_hexstr2bin (value);
+		if (!nm_supplicant_config_add_option (self,
+		                                      "mka_ckn",
+		                                      g_bytes_get_data (bytes, NULL),
+		                                      g_bytes_get_size (bytes),
+		                                      NULL,
+		                                      error))
+			return FALSE;
+	}
+
+	return TRUE;
+}
+
+gboolean
 nm_supplicant_config_add_setting_wireless (NMSupplicantConfig * self,
                                            NMSettingWireless * setting,
                                            guint32 fixed_freq,
diff --git a/src/supplicant/nm-supplicant-config.h b/src/supplicant/nm-supplicant-config.h
index 5b12a41175..40fca61b03 100644
--- a/src/supplicant/nm-supplicant-config.h
+++ b/src/supplicant/nm-supplicant-config.h
@@ -22,6 +22,7 @@
 #ifndef __NETWORKMANAGER_SUPPLICANT_CONFIG_H__
 #define __NETWORKMANAGER_SUPPLICANT_CONFIG_H__
 
+#include <nm-setting-macsec.h>
 #include <nm-setting-wireless.h>
 #include <nm-setting-wireless-security.h>
 #include <nm-setting-8021x.h>
@@ -71,4 +72,8 @@ gboolean nm_supplicant_config_add_setting_8021x (NMSupplicantConfig *self,
                                                  gboolean wired,
                                                  GError **error);
 
+gboolean nm_supplicant_config_add_setting_macsec (NMSupplicantConfig *self,
+                                                  NMSettingMacsec *setting,
+                                                  GError **error);
+
 #endif /* __NETWORKMANAGER_SUPPLICANT_CONFIG_H__ */
diff --git a/src/supplicant/nm-supplicant-interface.c b/src/supplicant/nm-supplicant-interface.c
index 408704bc60..6fc8553584 100644
--- a/src/supplicant/nm-supplicant-interface.c
+++ b/src/supplicant/nm-supplicant-interface.c
@@ -56,14 +56,14 @@ NM_GOBJECT_PROPERTIES_DEFINE (NMSupplicantInterface,
 	PROP_IFACE,
 	PROP_SCANNING,
 	PROP_CURRENT_BSS,
-	PROP_IS_WIRELESS,
+	PROP_DRIVER,
 	PROP_FAST_SUPPORTED,
 	PROP_AP_SUPPORT,
 );
 
 typedef struct {
 	char *         dev;
-	bool           is_wireless;
+	NMSupplicantDriver driver;
 	bool           fast_supported;
 	gboolean       has_credreq;  /* Whether querying 802.1x credentials is supported */
 	NMSupplicantFeature ap_support;   /* Lightweight AP mode support */
@@ -918,6 +918,7 @@ on_wpas_proxy_acquired (GDBusProxy *proxy, GAsyncResult *result, gpointer user_d
 	gs_free_error GError *error = NULL;
 	GDBusProxy *wpas_proxy;
 	GVariantBuilder props;
+	const char *driver_name = NULL;
 
 	wpas_proxy = g_dbus_proxy_new_for_bus_finish (result, &error);
 	if (!wpas_proxy) {
@@ -939,10 +940,24 @@ on_wpas_proxy_acquired (GDBusProxy *proxy, GAsyncResult *result, gpointer user_d
 	 * when the supplicant has started.
 	 */
 
+	switch (priv->driver) {
+	case NM_SUPPLICANT_DRIVER_WIRELESS:
+		driver_name = DEFAULT_WIFI_DRIVER;
+		break;
+	case NM_SUPPLICANT_DRIVER_WIRED:
+		driver_name = "wired";
+		break;
+	case NM_SUPPLICANT_DRIVER_MACSEC:
+		driver_name = "macsec_linux";
+		break;
+	}
+
+	g_return_if_fail (driver_name);
+
 	g_variant_builder_init (&props, G_VARIANT_TYPE_VARDICT);
 	g_variant_builder_add (&props, "{sv}",
 	                       "Driver",
-	                       g_variant_new_string (priv->is_wireless ? DEFAULT_WIFI_DRIVER : "wired"));
+	                       g_variant_new_string (driver_name));
 	g_variant_builder_add (&props, "{sv}",
 	                       "Ifname",
 	                       g_variant_new_string (priv->dev));
@@ -1448,7 +1463,7 @@ nm_supplicant_interface_get_max_scan_ssids (NMSupplicantInterface *self)
 
 NMSupplicantInterface *
 nm_supplicant_interface_new (const char *ifname,
-                             gboolean is_wireless,
+                             NMSupplicantDriver driver,
                              gboolean fast_supported,
                              NMSupplicantFeature ap_support)
 {
@@ -1456,7 +1471,7 @@ nm_supplicant_interface_new (const char *ifname,
 
 	return g_object_new (NM_TYPE_SUPPLICANT_INTERFACE,
 	                     NM_SUPPLICANT_INTERFACE_IFACE, ifname,
-	                     NM_SUPPLICANT_INTERFACE_IS_WIRELESS, is_wireless,
+	                     NM_SUPPLICANT_INTERFACE_DRIVER, (guint) driver,
 	                     NM_SUPPLICANT_INTERFACE_FAST_SUPPORTED, fast_supported,
 	                     NM_SUPPLICANT_INTERFACE_AP_SUPPORT, (int) ap_support,
 	                     NULL);
@@ -1485,9 +1500,9 @@ set_property (GObject *object,
 		priv->dev = g_value_dup_string (value);
 		g_return_if_fail (priv->dev);
 		break;
-	case PROP_IS_WIRELESS:
+	case PROP_DRIVER:
 		/* construct-only */
-		priv->is_wireless = g_value_get_boolean (value);
+		priv->driver = g_value_get_uint (value);
 		break;
 	case PROP_FAST_SUPPORTED:
 		/* construct-only */
@@ -1576,12 +1591,12 @@ nm_supplicant_interface_class_init (NMSupplicantInterfaceClass *klass)
 	                         G_PARAM_WRITABLE |
 	                         G_PARAM_CONSTRUCT_ONLY |
 	                         G_PARAM_STATIC_STRINGS);
-	obj_properties[PROP_IS_WIRELESS] =
-	    g_param_spec_boolean (NM_SUPPLICANT_INTERFACE_IS_WIRELESS, "", "",
-	                          TRUE,
-	                          G_PARAM_WRITABLE |
-	                          G_PARAM_CONSTRUCT_ONLY |
-	                          G_PARAM_STATIC_STRINGS);
+	obj_properties[PROP_DRIVER] =
+	    g_param_spec_uint (NM_SUPPLICANT_INTERFACE_DRIVER, "", "",
+	                       0, G_MAXUINT, NM_SUPPLICANT_DRIVER_WIRELESS,
+	                       G_PARAM_WRITABLE |
+	                       G_PARAM_CONSTRUCT_ONLY |
+	                       G_PARAM_STATIC_STRINGS);
 	obj_properties[PROP_FAST_SUPPORTED] =
 	    g_param_spec_boolean (NM_SUPPLICANT_INTERFACE_FAST_SUPPORTED, "", "",
 	                          TRUE,
diff --git a/src/supplicant/nm-supplicant-interface.h b/src/supplicant/nm-supplicant-interface.h
index 852bf10409..5ab66d5dee 100644
--- a/src/supplicant/nm-supplicant-interface.h
+++ b/src/supplicant/nm-supplicant-interface.h
@@ -57,7 +57,7 @@ enum {
 #define NM_SUPPLICANT_INTERFACE_IFACE            "iface"
 #define NM_SUPPLICANT_INTERFACE_SCANNING         "scanning"
 #define NM_SUPPLICANT_INTERFACE_CURRENT_BSS      "current-bss"
-#define NM_SUPPLICANT_INTERFACE_IS_WIRELESS      "is-wireless"
+#define NM_SUPPLICANT_INTERFACE_DRIVER           "driver"
 #define NM_SUPPLICANT_INTERFACE_FAST_SUPPORTED   "fast-supported"
 #define NM_SUPPLICANT_INTERFACE_AP_SUPPORT       "ap-support"
 
@@ -76,7 +76,7 @@ typedef struct _NMSupplicantInterfaceClass NMSupplicantInterfaceClass;
 GType nm_supplicant_interface_get_type (void);
 
 NMSupplicantInterface * nm_supplicant_interface_new (const char *ifname,
-                                                     gboolean is_wireless,
+                                                     NMSupplicantDriver driver,
                                                      gboolean fast_supported,
                                                      NMSupplicantFeature ap_support);
 
diff --git a/src/supplicant/nm-supplicant-manager.c b/src/supplicant/nm-supplicant-manager.c
index 573fdaa0fa..2fbfa391ba 100644
--- a/src/supplicant/nm-supplicant-manager.c
+++ b/src/supplicant/nm-supplicant-manager.c
@@ -137,7 +137,7 @@ _sup_iface_last_ref (gpointer data,
 NMSupplicantInterface *
 nm_supplicant_manager_create_interface (NMSupplicantManager *self,
                                         const char *ifname,
-                                        gboolean is_wireless)
+                                        NMSupplicantDriver driver)
 {
 	NMSupplicantManagerPrivate *priv;
 	NMSupplicantInterface *iface;
@@ -157,7 +157,7 @@ nm_supplicant_manager_create_interface (NMSupplicantManager *self,
 	}
 
 	iface = nm_supplicant_interface_new (ifname,
-	                                     is_wireless,
+	                                     driver,
 	                                     priv->fast_supported,
 	                                     priv->ap_support);
 
diff --git a/src/supplicant/nm-supplicant-manager.h b/src/supplicant/nm-supplicant-manager.h
index 3c1627b5aa..8928cf206b 100644
--- a/src/supplicant/nm-supplicant-manager.h
+++ b/src/supplicant/nm-supplicant-manager.h
@@ -40,6 +40,6 @@ NMSupplicantManager *nm_supplicant_manager_get (void);
 
 NMSupplicantInterface *nm_supplicant_manager_create_interface (NMSupplicantManager *mgr,
                                                                const char *ifname,
-                                                               gboolean is_wireless);
+                                                               NMSupplicantDriver driver);
 
 #endif /* __NETWORKMANAGER_SUPPLICANT_MANAGER_H__ */
diff --git a/src/supplicant/nm-supplicant-settings-verify.c b/src/supplicant/nm-supplicant-settings-verify.c
index 9355b210bc..9e22080857 100644
--- a/src/supplicant/nm-supplicant-settings-verify.c
+++ b/src/supplicant/nm-supplicant-settings-verify.c
@@ -141,6 +141,11 @@ static const struct Opt opt_table[] = {
 	{ "bgscan",             TYPE_BYTES,   0, 0, FALSE,  NULL },
 	{ "pac_file",           TYPE_BYTES,   0, 1024, FALSE,  NULL },
 	{ "freq_list",          TYPE_KEYWORD, 0, 0, FALSE,  NULL },
+	{ "macsec_policy",      TYPE_INT,     0, 1, FALSE, NULL },
+	{ "macsec_integ_only",  TYPE_INT,     0, 1, FALSE, NULL },
+	{ "mka_cak",            TYPE_BYTES,   0, 65536, FALSE, NULL },
+	{ "mka_ckn",            TYPE_BYTES,   0, 65536, FALSE, NULL },
+	{ "macsec_port",        TYPE_INT,     1, 65534, FALSE, NULL },
 };
 
 
diff --git a/src/supplicant/nm-supplicant-types.h b/src/supplicant/nm-supplicant-types.h
index e9be5be463..f75827ec60 100644
--- a/src/supplicant/nm-supplicant-types.h
+++ b/src/supplicant/nm-supplicant-types.h
@@ -46,6 +46,12 @@ typedef enum {
 	NM_SUPPLICANT_ERROR_CONFIG = 1,                     /*< nick=Config >*/
 } NMSupplicantError;
 
+typedef enum {
+	NM_SUPPLICANT_DRIVER_WIRELESS,
+	NM_SUPPLICANT_DRIVER_WIRED,
+	NM_SUPPLICANT_DRIVER_MACSEC,
+} NMSupplicantDriver;
+
 #define NM_SUPPLICANT_ERROR (nm_supplicant_error_quark ())
 GQuark nm_supplicant_error_quark (void);