core,libnm: introduce NMDeviceMacsec

At the moment the device only exposes the current link status, but
cannot create new links.

6 files changed, 761 insertions, 0 deletions

diff --git a/libnm/libnm.ver b/libnm/libnm.ver
index cc39286564..1c58d6c14b 100644
--- a/libnm/libnm.ver
+++ b/libnm/libnm.ver
@@ -1091,6 +1091,20 @@ global:
 	nm_client_get_dns_mode;
 	nm_client_get_dns_rc_manager;
 	nm_connection_get_setting_proxy;
+	nm_device_macsec_get_cipher_suite;
+	nm_device_macsec_get_encoding_sa;
+	nm_device_macsec_get_encrypt;
+	nm_device_macsec_get_es;
+	nm_device_macsec_get_hw_address;
+	nm_device_macsec_get_icv_length;
+	nm_device_macsec_get_include_sci;
+	nm_device_macsec_get_protect;
+	nm_device_macsec_get_replay_protect;
+	nm_device_macsec_get_scb;
+	nm_device_macsec_get_sci;
+	nm_device_macsec_get_type;
+	nm_device_macsec_get_validation;
+	nm_device_macsec_get_window;
 	nm_dns_entry_get_domains;
 	nm_dns_entry_get_interface;
 	nm_dns_entry_get_nameservers;
diff --git a/libnm/nm-client.c b/libnm/nm-client.c
index 4b31236e39..63eaa84ce3 100644
--- a/libnm/nm-client.c
+++ b/libnm/nm-client.c
@@ -56,6 +56,7 @@
 #include "nm-device-generic.h"
 #include "nm-device-infiniband.h"
 #include "nm-device-ip-tunnel.h"
+#include "nm-device-macsec.h"
 #include "nm-device-macvlan.h"
 #include "nm-device-modem.h"
 #include "nm-device-olpc-mesh.h"
@@ -2061,6 +2062,8 @@ obj_nm_for_gdbus_object (GDBusObject *object, GDBusObjectManager *object_manager
 			type = NM_TYPE_DEVICE_INFINIBAND;
 		else if (strcmp (ifname, NM_DBUS_INTERFACE_DEVICE_IP_TUNNEL) == 0)
 			type = NM_TYPE_DEVICE_IP_TUNNEL;
+		else if (strcmp (ifname, NM_DBUS_INTERFACE_DEVICE_MACSEC) == 0)
+			type = NM_TYPE_DEVICE_MACSEC;
 		else if (strcmp (ifname, NM_DBUS_INTERFACE_DEVICE_MACVLAN) == 0)
 			type = NM_TYPE_DEVICE_MACVLAN;
 		else if (strcmp (ifname, NM_DBUS_INTERFACE_DEVICE_MODEM) == 0)
diff --git a/libnm/nm-device-macsec.c b/libnm/nm-device-macsec.c
new file mode 100644
index 0000000000..c4762041be
--- /dev/null
+++ b/libnm/nm-device-macsec.c
@@ -0,0 +1,639 @@
+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
+/*
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301 USA.
+ *
+ * Copyright 2017 Red Hat, Inc.
+ */
+
+#include "nm-default.h"
+
+#include <string.h>
+
+#include "nm-device-macsec.h"
+#include "nm-device-private.h"
+#include "nm-object-private.h"
+#include "nm-utils.h"
+
+G_DEFINE_TYPE (NMDeviceMacsec, nm_device_macsec, NM_TYPE_DEVICE)
+
+#define NM_DEVICE_MACSEC_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), NM_TYPE_DEVICE_MACSEC, NMDeviceMacsecPrivate))
+
+typedef struct {
+	NMDevice *parent;
+	char *hw_address;
+	guint64 sci;
+	guint64 cipher_suite;
+	guint8 icv_length;
+	guint32 window;
+	guint8 encoding_sa;
+	gboolean encrypt;
+	gboolean protect;
+	gboolean include_sci;
+	gboolean es;
+	gboolean scb;
+	gboolean replay_protect;
+	char *validation;
+} NMDeviceMacsecPrivate;
+
+NM_GOBJECT_PROPERTIES_DEFINE_BASE (
+	PROP_PARENT,
+	PROP_HW_ADDRESS,
+	PROP_SCI,
+	PROP_CIPHER_SUITE,
+	PROP_ICV_LENGTH,
+	PROP_WINDOW,
+	PROP_ENCODING_SA,
+	PROP_ENCRYPT,
+	PROP_PROTECT,
+	PROP_INCLUDE_SCI,
+	PROP_ES,
+	PROP_SCB,
+	PROP_REPLAY_PROTECT,
+	PROP_VALIDATION,
+);
+
+/**
+ * nm_device_macsec_get_parent:
+ * @device: a #NMDeviceMacsec
+ *
+ * Returns: (transfer none): the device's parent device
+ *
+ * Since: 1.6
+ **/
+NMDevice *
+nm_device_macsec_get_parent (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), NULL);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->parent;
+}
+
+/**
+ * nm_device_macsec_get_hw_address:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets the hardware (MAC) address of the #NMDeviceMacsec
+ *
+ * Returns: the hardware address. This is the internal string used by the
+ * device, and must not be modified.
+ *
+ * Since: 1.6
+ **/
+const char *
+nm_device_macsec_get_hw_address (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), NULL);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->hw_address;
+}
+
+/**
+ * nm_device_macsec_get_sci:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets the Secure Channel Identifier in use
+ *
+ * Returns: the SCI
+ *
+ * Since: 1.6
+ **/
+guint64
+nm_device_macsec_get_sci (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), 0);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->sci;
+}
+
+/**
+ * nm_device_macsec_get_icv_length:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets the length of ICV (Integrity Check Value)
+ *
+ * Returns: the length of ICV
+ *
+ * Since: 1.6
+ **/
+guint8
+nm_device_macsec_get_icv_length (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), 0);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->icv_length;
+}
+
+/**
+ * nm_device_macsec_get_cipher_suite:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets the set of cryptographic algorithms in use
+ *
+ * Returns:
+ *
+ * Since: 1.6
+ **/
+guint64
+nm_device_macsec_get_cipher_suite (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), 0);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->cipher_suite;
+}
+
+/**
+ * nm_device_macsec_get_window:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets the size of the replay window
+ *
+ * Returns: size of the replay window
+ *
+ * Since: 1.6
+ **/
+guint
+nm_device_macsec_get_window (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), 0);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->window;
+}
+
+/**
+ * nm_device_macsec_get_encoding_sa:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets the value of the Association Number (0..3) for the Security
+ * Association in use.
+ *
+ * Returns: the current Security Association
+ *
+ * Since: 1.6
+ **/
+guint8
+nm_device_macsec_get_encoding_sa (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), 0);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->encoding_sa;
+}
+
+/**
+ * nm_device_macsec_get_validation:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets the validation mode for incoming packets (strict, check,
+ * disabled)
+ *
+ * Returns: the validation mode
+ *
+ * Since: 1.6
+ **/
+const char *
+nm_device_macsec_get_validation (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), NULL);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->validation;
+}
+
+/**
+ * nm_device_macsec_get_encrypt:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets whether encryption of transmitted frames is enabled
+ *
+ * Returns: whether encryption is enabled
+ *
+ * Since: 1.6
+ **/
+gboolean
+nm_device_macsec_get_encrypt (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), FALSE);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->encrypt;
+}
+
+/**
+ * nm_device_macsec_get_protect:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets whether protection of transmitted frames is enabled
+ *
+ * Returns: whether protection is enabled
+ *
+ * Since: 1.6
+ **/
+gboolean
+nm_device_macsec_get_protect (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), FALSE);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->protect;
+}
+
+/**
+ * nm_device_macsec_get_include_sci:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets whether the SCI is always included in SecTAG for transmitted
+ * frames
+ *
+ * Returns: whether the SCI is always included
+ *
+ * Since: 1.6
+ **/
+gboolean
+nm_device_macsec_get_include_sci (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), FALSE);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->include_sci;
+}
+
+/**
+ * nm_device_macsec_get_es:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets whether the ES (End station) bit is enabled in SecTAG for
+ * transmitted frames
+ *
+ * Returns: whether the ES (End station) bit is enabled
+ *
+ * Since: 1.6
+ **/
+gboolean
+nm_device_macsec_get_es (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), FALSE);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->es;
+}
+
+/**
+ * nm_device_macsec_get_scb:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets whether the SCB (Single Copy Broadcast) bit is enabled in
+ * SecTAG for transmitted frames
+ *
+ * Returns: whether the SCB (Single Copy Broadcast) bit is enabled
+ *
+ * Since: 1.6
+ **/
+gboolean
+nm_device_macsec_get_scb (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), FALSE);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->scb;
+}
+
+/**
+ * nm_device_macsec_get_replay_protect:
+ * @device: a #NMDeviceMacsec
+ *
+ * Gets whether replay protection is enabled
+ *
+ * Returns: whether replay protection is enabled
+ *
+ * Since: 1.6
+ **/
+gboolean
+nm_device_macsec_get_replay_protect (NMDeviceMacsec *device)
+{
+	g_return_val_if_fail (NM_IS_DEVICE_MACSEC (device), FALSE);
+
+	return NM_DEVICE_MACSEC_GET_PRIVATE (device)->replay_protect;
+}
+
+static const char *
+get_hw_address (NMDevice *device)
+{
+	return nm_device_macsec_get_hw_address (NM_DEVICE_MACSEC (device));
+}
+
+/***********************************************************/
+
+static void
+nm_device_macsec_init (NMDeviceMacsec *device)
+{
+}
+
+static void
+init_dbus (NMObject *object)
+{
+	NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (object);
+	const NMPropertiesInfo property_info[] = {
+		{ NM_DEVICE_MACSEC_PARENT,         &priv->parent, NULL, NM_TYPE_DEVICE },
+		{ NM_DEVICE_MACSEC_HW_ADDRESS,     &priv->hw_address },
+		{ NM_DEVICE_MACSEC_SCI,            &priv->sci },
+		{ NM_DEVICE_MACSEC_CIPHER_SUITE,   &priv->cipher_suite },
+		{ NM_DEVICE_MACSEC_ICV_LENGTH,     &priv->icv_length },
+		{ NM_DEVICE_MACSEC_WINDOW,         &priv->window },
+		{ NM_DEVICE_MACSEC_ENCODING_SA,    &priv->encoding_sa },
+		{ NM_DEVICE_MACSEC_ENCRYPT,        &priv->encrypt },
+		{ NM_DEVICE_MACSEC_PROTECT,        &priv->protect },
+		{ NM_DEVICE_MACSEC_INCLUDE_SCI,    &priv->include_sci },
+		{ NM_DEVICE_MACSEC_ES,             &priv->es },
+		{ NM_DEVICE_MACSEC_SCB,            &priv->scb },
+		{ NM_DEVICE_MACSEC_REPLAY_PROTECT, &priv->replay_protect },
+		{ NM_DEVICE_MACSEC_VALIDATION,     &priv->validation },
+		{ NULL },
+	};
+
+	NM_OBJECT_CLASS (nm_device_macsec_parent_class)->init_dbus (object);
+
+	_nm_object_register_properties (object,
+	                                NM_DBUS_INTERFACE_DEVICE_MACSEC,
+	                                property_info);
+}
+
+static void
+finalize (GObject *object)
+{
+	NMDeviceMacsecPrivate *priv = NM_DEVICE_MACSEC_GET_PRIVATE (object);
+
+	g_free (priv->validation);
+	g_free (priv->hw_address);
+	g_clear_object (&priv->parent);
+
+	G_OBJECT_CLASS (nm_device_macsec_parent_class)->finalize (object);
+}
+
+static void
+get_property (GObject *object,
+              guint prop_id,
+              GValue *value,
+              GParamSpec *pspec)
+{
+	NMDeviceMacsec *device = NM_DEVICE_MACSEC (object);
+
+	switch (prop_id) {
+	case PROP_PARENT:
+		g_value_set_object (value, nm_device_macsec_get_parent (device));
+		break;
+	case PROP_HW_ADDRESS:
+		g_value_set_string (value, nm_device_macsec_get_hw_address (device));
+		break;
+	case PROP_SCI:
+		g_value_set_uint64 (value, nm_device_macsec_get_sci (device));
+		break;
+	case PROP_ICV_LENGTH:
+		g_value_set_uchar (value, nm_device_macsec_get_icv_length (device));
+		break;
+	case PROP_CIPHER_SUITE:
+		g_value_set_uint64 (value, nm_device_macsec_get_cipher_suite (device));
+		break;
+	case PROP_WINDOW:
+		g_value_set_uint (value, nm_device_macsec_get_window (device));
+		break;
+	case PROP_ENCODING_SA:
+		g_value_set_uchar (value, nm_device_macsec_get_encoding_sa (device));
+		break;
+	case PROP_VALIDATION:
+		g_value_set_string (value, nm_device_macsec_get_validation (device));
+		break;
+	case PROP_ENCRYPT:
+		g_value_set_boolean (value, nm_device_macsec_get_encrypt (device));
+		break;
+	case PROP_PROTECT:
+		g_value_set_boolean (value, nm_device_macsec_get_protect (device));
+		break;
+	case PROP_INCLUDE_SCI:
+		g_value_set_boolean (value, nm_device_macsec_get_include_sci (device));
+		break;
+	case PROP_ES:
+		g_value_set_boolean (value, nm_device_macsec_get_es (device));
+		break;
+	case PROP_SCB:
+		g_value_set_boolean (value, nm_device_macsec_get_scb (device));
+		break;
+	case PROP_REPLAY_PROTECT:
+		g_value_set_boolean (value, nm_device_macsec_get_replay_protect (device));
+		break;
+	default:
+		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+		break;
+	}
+}
+
+static void
+nm_device_macsec_class_init (NMDeviceMacsecClass *macsec_class)
+{
+	GObjectClass *object_class = G_OBJECT_CLASS (macsec_class);
+	NMObjectClass *nm_object_class = NM_OBJECT_CLASS (macsec_class);
+	NMDeviceClass *device_class = NM_DEVICE_CLASS (macsec_class);
+
+	g_type_class_add_private (macsec_class, sizeof (NMDeviceMacsecPrivate));
+
+	object_class->finalize = finalize;
+	object_class->get_property = get_property;
+
+	nm_object_class->init_dbus = init_dbus;
+
+	device_class->get_hw_address = get_hw_address;
+
+	/**
+	 * NMDeviceMacsec:parent:
+	 *
+	 * The devices's parent device.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_PARENT] =
+		g_param_spec_object (NM_DEVICE_MACSEC_PARENT, "", "",
+		                     NM_TYPE_DEVICE,
+		                     G_PARAM_READABLE |
+		                     G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:hw-address:
+	 *
+	 * The hardware (MAC) address of the device.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_HW_ADDRESS] =
+		g_param_spec_string (NM_DEVICE_MACSEC_HW_ADDRESS, "", "",
+		                     NULL,
+		                     G_PARAM_READABLE |
+		                     G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:sci:
+	 *
+	 * The Secure Channel Identifier in use.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_SCI] =
+		g_param_spec_uint64 (NM_DEVICE_MACSEC_SCI, "", "",
+		                     0, G_MAXUINT64, 0,
+		                     G_PARAM_READABLE |
+		                     G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:icv-length:
+	 *
+	 * The length of ICV (Integrity Check Value).
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_ICV_LENGTH] =
+		g_param_spec_uchar (NM_DEVICE_MACSEC_ICV_LENGTH, "", "",
+		                    0, G_MAXUINT8, 0,
+		                    G_PARAM_READABLE |
+		                    G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:cipher-suite:
+	 *
+	 * The set of cryptographic algorithms in use.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_CIPHER_SUITE] =
+		g_param_spec_uint64 (NM_DEVICE_MACSEC_CIPHER_SUITE, "", "",
+		                     0, G_MAXUINT64, 0,
+		                     G_PARAM_READABLE |
+		                     G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:window:
+	 *
+	 * The size of the replay window.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_WINDOW] =
+		g_param_spec_uint (NM_DEVICE_MACSEC_WINDOW, "", "",
+		                   0, G_MAXUINT32, 0,
+		                   G_PARAM_READABLE |
+		                   G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:encoding-sa:
+	 *
+	 * The value of the Association Number (0..3) for the Security
+	 * Association in use.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_ENCODING_SA] =
+		g_param_spec_uchar (NM_DEVICE_MACSEC_ENCODING_SA, "", "",
+		                    0, G_MAXUINT8, 0,
+		                    G_PARAM_READABLE |
+		                    G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:validation:
+	 *
+	 * The validation mode for incoming packets (strict, check,
+	 * disabled).
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_VALIDATION] =
+		g_param_spec_string (NM_DEVICE_MACSEC_VALIDATION, "", "",
+		                     NULL,
+		                     G_PARAM_READABLE |
+		                     G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:encrypt:
+	 *
+	 * Whether encryption of transmitted frames is enabled.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_ENCRYPT] =
+		g_param_spec_boolean (NM_DEVICE_MACSEC_ENCRYPT, "", "",
+		                      FALSE,
+		                      G_PARAM_READABLE |
+		                      G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:protect:
+	 *
+	 * Whether protection of transmitted frames is enabled.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_PROTECT] =
+		g_param_spec_boolean (NM_DEVICE_MACSEC_PROTECT, "", "",
+		                      FALSE,
+		                      G_PARAM_READABLE |
+		                      G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:include-sci:
+	 *
+	 * Whether the SCI is always included in SecTAG for transmitted
+	 * frames.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_INCLUDE_SCI] =
+		g_param_spec_boolean (NM_DEVICE_MACSEC_INCLUDE_SCI, "", "",
+		                      FALSE,
+		                      G_PARAM_READABLE |
+		                      G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:es:
+	 *
+	 * Whether the ES (End station) bit is enabled in SecTAG for
+	 * transmitted frames.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_ES] =
+		g_param_spec_boolean (NM_DEVICE_MACSEC_ES, "", "",
+		                      FALSE,
+		                      G_PARAM_READABLE |
+		                      G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:scb:
+	 *
+	 * Whether the SCB (Single Copy Broadcast) bit is enabled in
+	 * SecTAG for transmitted frames.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_SCB] =
+		g_param_spec_boolean (NM_DEVICE_MACSEC_SCB, "", "",
+		                      FALSE,
+		                      G_PARAM_READABLE |
+		                      G_PARAM_STATIC_STRINGS);
+
+	/**
+	 * NMDeviceMacsec:replay-protect:
+	 *
+	 * Whether replay protection is enabled.
+	 *
+	 * Since: 1.6
+	 **/
+	obj_properties[PROP_REPLAY_PROTECT] =
+		g_param_spec_boolean (NM_DEVICE_MACSEC_REPLAY_PROTECT, "", "",
+		                      FALSE,
+		                      G_PARAM_READABLE |
+		                      G_PARAM_STATIC_STRINGS);
+
+	g_object_class_install_properties (object_class, _PROPERTY_ENUMS_LAST, obj_properties);
+}
diff --git a/libnm/nm-device-macsec.h b/libnm/nm-device-macsec.h
new file mode 100644
index 0000000000..d6d7c0ef79
--- /dev/null
+++ b/libnm/nm-device-macsec.h
@@ -0,0 +1,101 @@
+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
+/*
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301 USA.
+ *
+ * Copyright 2017 Red Hat, Inc.
+ */
+
+#ifndef __NM_DEVICE_MACSEC_H__
+#define __NM_DEVICE_MACSEC_H__
+
+#if !defined (__NETWORKMANAGER_H_INSIDE__) && !defined(NETWORKMANAGER_COMPILATION)
+#error "Only <NetworkManager.h> can be included directly."
+#endif
+
+#include <nm-device.h>
+
+G_BEGIN_DECLS
+
+#define NM_TYPE_DEVICE_MACSEC            (nm_device_macsec_get_type ())
+#define NM_DEVICE_MACSEC(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), NM_TYPE_DEVICE_MACSEC, NMDeviceMacsec))
+#define NM_DEVICE_MACSEC_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), NM_TYPE_DEVICE_MACSEC, NMDeviceMacsecClass))
+#define NM_IS_DEVICE_MACSEC(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), NM_TYPE_DEVICE_MACSEC))
+#define NM_IS_DEVICE_MACSEC_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), NM_TYPE_DEVICE_MACSEC))
+#define NM_DEVICE_MACSEC_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), NM_TYPE_DEVICE_MACSEC, NMDeviceMacsecClass))
+
+#define NM_DEVICE_MACSEC_PARENT          "parent"
+#define NM_DEVICE_MACSEC_HW_ADDRESS      "hw-address"
+#define NM_DEVICE_MACSEC_SCI             "sci"
+#define NM_DEVICE_MACSEC_ICV_LENGTH      "icv-length"
+#define NM_DEVICE_MACSEC_CIPHER_SUITE    "cipher-suite"
+#define NM_DEVICE_MACSEC_WINDOW          "window"
+#define NM_DEVICE_MACSEC_ENCODING_SA     "encoding-sa"
+#define NM_DEVICE_MACSEC_VALIDATION      "validation"
+#define NM_DEVICE_MACSEC_ENCRYPT         "encrypt"
+#define NM_DEVICE_MACSEC_PROTECT         "protect"
+#define NM_DEVICE_MACSEC_INCLUDE_SCI     "include-sci"
+#define NM_DEVICE_MACSEC_ES              "es"
+#define NM_DEVICE_MACSEC_SCB             "scb"
+#define NM_DEVICE_MACSEC_REPLAY_PROTECT  "replay-protect"
+
+/**
+ * NMDeviceMacsec:
+ */
+struct _NMDeviceMacsec {
+	NMDevice parent;
+};
+
+typedef struct {
+	NMDeviceClass parent;
+
+	/*< private >*/
+	gpointer padding[4];
+} NMDeviceMacsecClass;
+
+NM_AVAILABLE_IN_1_6
+GType nm_device_macsec_get_type (void);
+
+NM_AVAILABLE_IN_1_6
+NMDevice *   nm_device_macsec_get_parent (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+const char * nm_device_macsec_get_hw_address (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+guint64      nm_device_macsec_get_sci (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+guint8       nm_device_macsec_get_icv_length (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+guint64      nm_device_macsec_get_cipher_suite (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+guint        nm_device_macsec_get_window (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+guint8       nm_device_macsec_get_encoding_sa (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+const char * nm_device_macsec_get_validation (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+gboolean     nm_device_macsec_get_encrypt (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+gboolean     nm_device_macsec_get_protect (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+gboolean     nm_device_macsec_get_include_sci (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+gboolean     nm_device_macsec_get_es (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+gboolean     nm_device_macsec_get_scb (NMDeviceMacsec *device);
+NM_AVAILABLE_IN_1_6
+gboolean     nm_device_macsec_get_replay_protect (NMDeviceMacsec *device);
+G_END_DECLS
+
+#endif /* __NM_DEVICE_MACSEC_H__ */
diff --git a/libnm/nm-device.c b/libnm/nm-device.c
index 5c5988862c..02b5cad550 100644
--- a/libnm/nm-device.c
+++ b/libnm/nm-device.c
@@ -267,6 +267,7 @@ coerce_type (NMDeviceType type)
 	case NM_DEVICE_TYPE_BRIDGE:
 	case NM_DEVICE_TYPE_VLAN:
 	case NM_DEVICE_TYPE_ADSL:
+	case NM_DEVICE_TYPE_MACSEC:
 	case NM_DEVICE_TYPE_MACVLAN:
 	case NM_DEVICE_TYPE_VXLAN:
 	case NM_DEVICE_TYPE_IP_TUNNEL:
@@ -1691,6 +1692,8 @@ get_type_name (NMDevice *device)
 		return _("Tun");
 	case NM_DEVICE_TYPE_VETH:
 		return _("Veth");
+	case NM_DEVICE_TYPE_MACSEC:
+		return _("MACsec");
 	case NM_DEVICE_TYPE_GENERIC:
 	case NM_DEVICE_TYPE_UNUSED1:
 	case NM_DEVICE_TYPE_UNUSED2:
diff --git a/libnm/nm-types.h b/libnm/nm-types.h
index be09daaf89..7d224c86fe 100644
--- a/libnm/nm-types.h
+++ b/libnm/nm-types.h
@@ -38,6 +38,7 @@ typedef struct _NMDeviceEthernet    NMDeviceEthernet;
 typedef struct _NMDeviceGeneric     NMDeviceGeneric;
 typedef struct _NMDeviceInfiniband  NMDeviceInfiniband;
 typedef struct _NMDeviceIPTunnel    NMDeviceIPTunnel;
+typedef struct _NMDeviceMacsec      NMDeviceMacsec;
 typedef struct _NMDeviceMacvlan     NMDeviceMacvlan;
 typedef struct _NMDeviceModem       NMDeviceModem;
 typedef struct _NMDeviceOlpcMesh    NMDeviceOlpcMesh;