c-e: forward the validation error to print more sensible error message to stdout

When a connection doesn't verify, the "Save" dialog stays desensitized.
Even for an advanced user it's not immediately clear what causes the
valdation failure.

We already print a message like "Invalid setting Ethernet" to stdout.
Extend the message to also print an more detailed error that gets propagated
from the validation.

This later should be improved further to indicating the failure reason
in the UI too.

(cherry picked from commit e01de57530a6ce59085fec013f60052916fc5b5e)

30 files changed, 259 insertions, 140 deletions

diff --git a/src/connection-editor/ce-page.c b/src/connection-editor/ce-page.c
index 7dc1d267..c7ce73e5 100644
--- a/src/connection-editor/ce-page.c
+++ b/src/connection-editor/ce-page.c
@@ -132,8 +132,13 @@ ce_page_validate (CEPage *self, NMConnection *connection, GError **error)
 	g_return_val_if_fail (CE_IS_PAGE (self), FALSE);
 	g_return_val_if_fail (NM_IS_CONNECTION (connection), FALSE);
 
-	if (CE_PAGE_GET_CLASS (self)->ce_page_validate_v)
-		return CE_PAGE_GET_CLASS (self)->ce_page_validate_v (self, connection, error);
+	if (CE_PAGE_GET_CLASS (self)->ce_page_validate_v) {
+		if (!CE_PAGE_GET_CLASS (self)->ce_page_validate_v (self, connection, error)) {
+			if (error && !*error)
+				g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("unspecified error"));
+			return FALSE;
+		}
+	}
 
 	return TRUE;
 }
@@ -291,18 +296,30 @@ _mac_is_valid (const char *mac, int type)
 }
 
 gboolean
-ce_page_mac_entry_valid (GtkEntry *entry, int type)
+ce_page_mac_entry_valid (GtkEntry *entry, int type, const char *property_name, GError **error)
 {
 	const char *mac;
 
-	g_return_val_if_fail (entry != NULL, FALSE);
 	g_return_val_if_fail (GTK_IS_ENTRY (entry), FALSE);
 
 	mac = gtk_entry_get_text (entry);
-	if (!mac || !*mac)
-		return TRUE;
-
-	return _mac_is_valid (mac, type);
+	if (    mac && *mac
+	    &&  !_mac_is_valid (mac, type)) {
+		const char *addr_type;
+
+		addr_type = type == ARPHRD_ETHER ? _("MAC address") : _("HW addreess");
+		if (property_name) {
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC,
+			             _("invalid %s for %s (%s)"),
+			             addr_type, property_name, mac);
+		} else {
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC,
+			             _("invalid %s (%s)"),
+			             addr_type, mac);
+		}
+		return FALSE;
+	}
+	return TRUE;
 }
 
 void
@@ -342,6 +359,26 @@ ce_page_entry_to_mac (GtkEntry *entry, int type, gboolean *invalid)
 	return nm_utils_hwaddr_atoba (temp, type);
 }
 
+gboolean
+ce_page_interface_name_valid (const char *iface, const char *property_name, GError **error)
+{
+	if (iface && *iface) {
+		if (!nm_utils_iface_valid_name (iface)) {
+			if (property_name) {
+				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC,
+				             _("invalid interface-name for %s (%s)"),
+				             property_name, iface);
+			} else {
+				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC,
+				             _("invalid interface-name (%s)"),
+				             iface);
+			}
+			return FALSE;
+		}
+	}
+	return TRUE;
+}
+
 static char **
 _get_device_list (CEPage *self,
                   GType device_type,
@@ -498,16 +535,19 @@ ce_page_setup_device_combo (CEPage *self,
 }
 
 gboolean
-ce_page_device_entry_get (GtkEntry *entry, int type, char **ifname, GByteArray **mac)
+ce_page_device_entry_get (GtkEntry *entry, int type, char **ifname, GByteArray **mac, const char *device_name, GError **error)
 {
 	char *first, *second;
 	const char *ifname_tmp = NULL, *mac_tmp = NULL;
 	gboolean valid = TRUE;
+	const char *str;
 
 	g_return_val_if_fail (entry != NULL, FALSE);
 	g_return_val_if_fail (GTK_IS_ENTRY (entry), FALSE);
 
-	valid = _device_entry_parse (gtk_entry_get_text (entry), &first, &second);
+	str = gtk_entry_get_text (entry);
+
+	valid = _device_entry_parse (str, &first, &second);
 
 	if (first) {
 		if (_mac_is_valid (first, type))
@@ -541,6 +581,13 @@ ce_page_device_entry_get (GtkEntry *entry, int type, char **ifname, GByteArray *
 	g_free (first);
 	g_free (second);
 
+	if (!valid) {
+		g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC,
+		             _("invalid %s (%s)"),
+		             device_name ? device_name : _("device"),
+		             str);
+	}
+
 	return valid;
 }
 
diff --git a/src/connection-editor/ce-page.h b/src/connection-editor/ce-page.h
index a90386e5..fe5e8bdf 100644
--- a/src/connection-editor/ce-page.h
+++ b/src/connection-editor/ce-page.h
@@ -120,9 +120,12 @@ void ce_page_setup_device_combo (CEPage *self,
                                  int mac_type,
                                  const char *mac_property,
                                  gboolean ifname_first);
-gboolean ce_page_mac_entry_valid (GtkEntry *entry, int type);
+gboolean ce_page_mac_entry_valid (GtkEntry *entry, int type, const char *property_name, GError **error);
+gboolean ce_page_interface_name_valid (const char *iface, const char *property_name, GError **error);
 gboolean ce_page_device_entry_get (GtkEntry *entry, int type,
-                                   char **ifname, GByteArray **mac);
+                                   char **ifname, GByteArray **mac,
+                                   const char *device_name,
+                                   GError **error);
 void ce_page_mac_to_entry (const GByteArray *mac, int type, GtkEntry *entry);
 GByteArray *ce_page_entry_to_mac (GtkEntry *entry, int type, gboolean *invalid);
 
diff --git a/src/connection-editor/page-8021x-security.c b/src/connection-editor/page-8021x-security.c
index bb44dfca..eec4216e 100644
--- a/src/connection-editor/page-8021x-security.c
+++ b/src/connection-editor/page-8021x-security.c
@@ -152,8 +152,7 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 		NMConnection *tmp_connection;
 		NMSetting *s_8021x;
 
-		/* FIXME: get failed property and error out of wireless security objects */
-		valid = wireless_security_validate (priv->security);
+		valid = wireless_security_validate (priv->security, error);
 		if (valid) {
 			NMSetting *s_con;
 
@@ -173,8 +172,7 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 			nm_connection_add_setting (connection, NM_SETTING (g_object_ref (s_8021x)));
 
 			g_object_unref (tmp_connection);
-		} else
-			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, "Invalid 802.1x security");
+		}
 	} else {
 		nm_connection_remove_setting (connection, NM_TYPE_SETTING_802_1X);
 		valid = TRUE;
diff --git a/src/connection-editor/page-bluetooth.c b/src/connection-editor/page-bluetooth.c
index 4dbfd0b3..4c697b83 100644
--- a/src/connection-editor/page-bluetooth.c
+++ b/src/connection-editor/page-bluetooth.c
@@ -148,7 +148,7 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 	CEPageBluetooth *self = CE_PAGE_BLUETOOTH (page);
 	CEPageBluetoothPrivate *priv = CE_PAGE_BLUETOOTH_GET_PRIVATE (self);
 
-	if (!ce_page_mac_entry_valid (priv->bdaddr, ARPHRD_ETHER))
+	if (!ce_page_mac_entry_valid (priv->bdaddr, ARPHRD_ETHER, _("bdaddr"), error))
 		return FALSE;
 
 	ui_to_setting (self);
diff --git a/src/connection-editor/page-bond.c b/src/connection-editor/page-bond.c
index 6dd446f0..bc66e0ae 100644
--- a/src/connection-editor/page-bond.c
+++ b/src/connection-editor/page-bond.c
@@ -564,13 +564,12 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 {
 	CEPageBond *self = CE_PAGE_BOND (page);
 	CEPageBondPrivate *priv = CE_PAGE_BOND_GET_PRIVATE (self);
-	const char *primary;
 
 	if (!CE_PAGE_CLASS (ce_page_bond_parent_class)->ce_page_validate_v (page, connection, error))
 		return FALSE;
 
-	primary = gtk_entry_get_text (priv->primary);
-	if (primary && *primary && !nm_utils_iface_valid_name (primary))
+	if (!ce_page_interface_name_valid (gtk_entry_get_text (priv->primary),
+	                                   _("primary"), error))
 		return FALSE;
 
 	ui_to_setting (self);
diff --git a/src/connection-editor/page-ethernet.c b/src/connection-editor/page-ethernet.c
index 0494f3d7..c4da0e8d 100644
--- a/src/connection-editor/page-ethernet.c
+++ b/src/connection-editor/page-ethernet.c
@@ -310,7 +310,7 @@ ui_to_setting (CEPageEthernet *self)
 
 	entry = gtk_bin_get_child (GTK_BIN (priv->device_combo));
 	if (entry)
-		ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, &ifname, &device_mac);
+		ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, &ifname, &device_mac, NULL, NULL);
 	cloned_mac = ce_page_entry_to_mac (priv->cloned_mac, ARPHRD_ETHER, NULL);
 
 	g_object_set (s_con,
@@ -343,11 +343,11 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 
 	entry = gtk_bin_get_child (GTK_BIN (priv->device_combo));
 	if (entry) {
-		if (!ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, NULL, NULL))
+		if (!ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, NULL, NULL, _("Ethernet device"), error))
 			return FALSE;
 	}
 
-	if (!ce_page_mac_entry_valid (priv->cloned_mac, ARPHRD_ETHER))
+	if (!ce_page_mac_entry_valid (priv->cloned_mac, ARPHRD_ETHER, _("cloned MAC"), error))
 		return FALSE;
 
 	ui_to_setting (self);
diff --git a/src/connection-editor/page-infiniband.c b/src/connection-editor/page-infiniband.c
index 5ef37477..bb6013e2 100644
--- a/src/connection-editor/page-infiniband.c
+++ b/src/connection-editor/page-infiniband.c
@@ -197,7 +197,7 @@ ui_to_setting (CEPageInfiniband *self)
 
 	entry = gtk_bin_get_child (GTK_BIN (priv->device_combo));
 	if (entry)
-		ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_INFINIBAND, &ifname, &device_mac);
+		ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_INFINIBAND, &ifname, &device_mac, NULL, NULL);
 
 	g_object_set (s_con,
 	              NM_SETTING_CONNECTION_INTERFACE_NAME, ifname,
@@ -222,7 +222,7 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 
 	entry = gtk_bin_get_child (GTK_BIN (priv->device_combo));
 	if (entry) {
-		if (!ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_INFINIBAND, NULL, NULL))
+		if (!ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_INFINIBAND, NULL, NULL, _("infiniband device"), error))
 			return FALSE;
 	}
 
diff --git a/src/connection-editor/page-ip4.c b/src/connection-editor/page-ip4.c
index d94d9692..bb47ee53 100644
--- a/src/connection-editor/page-ip4.c
+++ b/src/connection-editor/page-ip4.c
@@ -1039,7 +1039,7 @@ free_one_addr (gpointer data)
 }
 
 static gboolean
-ui_to_setting (CEPageIP4 *self)
+ui_to_setting (CEPageIP4 *self, GError **error)
 {
 	CEPageIP4Private *priv = CE_PAGE_IP4_GET_PRIVATE (self);
 	GtkTreeModel *model;
@@ -1096,8 +1096,7 @@ ui_to_setting (CEPageIP4 *self)
 
 		gtk_tree_model_get (model, &tree_iter, COL_ADDRESS, &item, -1);
 		if (!item || inet_pton (AF_INET, item, &tmp_addr) <= 0) {
-			g_warning ("%s: IPv4 address '%s' missing or invalid!",
-			           __func__, item ? item : "<none>");
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv4 address \"%s\" invalid"), item ? item : "");
 			g_free (item);
 			goto out;
 		}
@@ -1105,14 +1104,12 @@ ui_to_setting (CEPageIP4 *self)
 
 		gtk_tree_model_get (model, &tree_iter, COL_PREFIX, &item, -1);
 		if (!item) {
-			g_warning ("%s: IPv4 prefix '%s' missing!",
-			           __func__, item ? item : "<none>");
+			g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv4 address netmask missing"));
 			goto out;
 		}
 
 		if (!parse_netmask (item, &prefix)) {
-			g_warning ("%s: IPv4 prefix '%s' invalid!",
-			           __func__, item ? item : "<none>");
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv4 address netmask \"%s\" invalid"), item);
 			g_free (item);
 			goto out;
 		}
@@ -1121,8 +1118,7 @@ ui_to_setting (CEPageIP4 *self)
 		/* Gateway is optional... */
 		gtk_tree_model_get (model, &tree_iter, COL_GATEWAY, &item, -1);
 		if (item && strlen (item) && inet_pton (AF_INET, item, &tmp_gateway) <= 0) {
-			g_warning ("%s: IPv4 gateway '%s' invalid!",
-			           __func__, item ? item : "<none>");
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv4 gateway \"%s\" invalid"), item);
 			g_free (item);
 			goto out;
 		}
@@ -1162,6 +1158,7 @@ ui_to_setting (CEPageIP4 *self)
 			if (inet_pton (AF_INET, stripped, &tmp_addr))
 				g_array_append_val (dns_servers, tmp_addr.s_addr);
 			else {
+				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv4 DNS server \"%s\" invalid"), stripped);
 				g_strfreev (items);
 				goto out;
 			}
@@ -1226,7 +1223,7 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 	CEPageIP4 *self = CE_PAGE_IP4 (page);
 	CEPageIP4Private *priv = CE_PAGE_IP4_GET_PRIVATE (self);
 
-	if (!ui_to_setting (self))
+	if (!ui_to_setting (self, error))
 		return FALSE;
 	return nm_setting_verify (NM_SETTING (priv->setting), NULL, error);
 }
diff --git a/src/connection-editor/page-ip6.c b/src/connection-editor/page-ip6.c
index e577e399..1353d250 100644
--- a/src/connection-editor/page-ip6.c
+++ b/src/connection-editor/page-ip6.c
@@ -1028,7 +1028,7 @@ ce_page_ip6_new (NMConnection *connection,
 }
 
 static gboolean
-ui_to_setting (CEPageIP6 *self)
+ui_to_setting (CEPageIP6 *self, GError **error)
 {
 	CEPageIP6Private *priv = CE_PAGE_IP6_GET_PRIVATE (self);
 	GtkTreeModel *model;
@@ -1092,8 +1092,7 @@ ui_to_setting (CEPageIP6 *self)
 		/* IP address */
 		gtk_tree_model_get (model, &tree_iter, COL_ADDRESS, &item, -1);
 		if (!item || !inet_pton (AF_INET6, item, &tmp_addr)) {
-			g_warning ("%s: IPv6 address '%s' missing or invalid!",
-			           __func__, item ? item : "<none>");
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv6 address \"%s\" invalid"), item ? item : "");
 			g_free (item);
 			goto out;
 		}
@@ -1102,15 +1101,13 @@ ui_to_setting (CEPageIP6 *self)
 		/* Prefix */
 		gtk_tree_model_get (model, &tree_iter, COL_PREFIX, &item, -1);
 		if (!item) {
-			g_warning ("%s: IPv6 prefix '%s' missing!",
-			           __func__, item ? item : "<none>");
+			g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv6 prefix \"%s\" missing"));
 			goto out;
 		}
 
 		prefix = strtoul (item, &end, 10);
 		if (!end || *end || prefix == 0 || prefix > 128) {
-			g_warning ("%s: IPv6 prefix '%s' invalid!",
-			           __func__, item ? item : "<none>");
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv6 prefix \"%s\" invalid"), item);
 			g_free (item);
 			goto out;
 		}
@@ -1120,8 +1117,7 @@ ui_to_setting (CEPageIP6 *self)
 		gtk_tree_model_get (model, &tree_iter, COL_GATEWAY, &item, -1);
 		if (item && strlen (item)) {
 			if (!inet_pton (AF_INET6, item, &tmp_gw)) {
-				g_warning ("%s: IPv6 gateway '%s' missing or invalid!",
-				           __func__, item ? item : "<none>");
+				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv6 gateway \"%s\" invalid"), item);
 				g_free (item);
 				goto out;
 			}
@@ -1156,6 +1152,7 @@ ui_to_setting (CEPageIP6 *self)
 			if (inet_pton (AF_INET6, stripped, &tmp_addr)) {
 				nm_setting_ip6_config_add_dns (priv->setting, &tmp_addr);
 			} else {
+				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv6 DNS server \"%s\" invalid"), stripped);
 				g_strfreev (items);
 				goto out;
 			}
@@ -1213,7 +1210,7 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 	CEPageIP6 *self = CE_PAGE_IP6 (page);
 	CEPageIP6Private *priv = CE_PAGE_IP6_GET_PRIVATE (self);
 
-	if (!ui_to_setting (self))
+	if (!ui_to_setting (self, error))
 		return FALSE;
 	return nm_setting_verify (NM_SETTING (priv->setting), NULL, error);
 }
diff --git a/src/connection-editor/page-vlan.c b/src/connection-editor/page-vlan.c
index f782068e..7e97525a 100644
--- a/src/connection-editor/page-vlan.c
+++ b/src/connection-editor/page-vlan.c
@@ -635,17 +635,16 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 
 	parent_id = gtk_combo_box_get_active (GTK_COMBO_BOX (priv->parent));
 	if (parent_id == -1) {
-		gboolean valid;
-
 		parent = gtk_entry_get_text (priv->parent_entry);
 		parent_iface = g_strndup (parent, strcspn (parent, " "));
-		valid = nm_utils_iface_valid_name (parent_iface);
-		g_free (parent_iface);
-		if (!valid)
+		if (!ce_page_interface_name_valid (parent_iface, _("vlan parent"), error)) {
+			g_free (parent_iface);
 			return FALSE;
+		}
+		g_free (parent_iface);
 	}
 
-	if (!ce_page_mac_entry_valid (priv->cloned_mac, ARPHRD_ETHER))
+	if (!ce_page_mac_entry_valid (priv->cloned_mac, ARPHRD_ETHER, _("cloned MAC"), error))
 		return FALSE;
 
 	ui_to_setting (self);
diff --git a/src/connection-editor/page-wifi-security.c b/src/connection-editor/page-wifi-security.c
index 05beb30a..9e87e51b 100644
--- a/src/connection-editor/page-wifi-security.c
+++ b/src/connection-editor/page-wifi-security.c
@@ -484,20 +484,17 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 		const GByteArray *ssid = nm_setting_wireless_get_ssid (s_wireless);
 
 		if (ssid) {
-			/* FIXME: get failed property and error out of wifi security objects */
-			valid = wireless_security_validate (sec);
+			valid = wireless_security_validate (sec, error);
 			if (valid)
 				wireless_security_fill_connection (sec, connection);
-			else
-				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, "Invalid Wi-Fi security");
 		} else {
-			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, "Missing SSID");
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing SSID"));
 			valid = FALSE;
 		}
 
 		if (priv->adhoc) {
 			if (!wireless_security_adhoc_compatible (sec)) {
-				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, "Security not compatible with Ad-Hoc mode");
+				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("Security not compatible with Ad-Hoc mode"));
 				valid = FALSE;
 			}
 		}
diff --git a/src/connection-editor/page-wifi.c b/src/connection-editor/page-wifi.c
index 3d4386b3..6266186c 100644
--- a/src/connection-editor/page-wifi.c
+++ b/src/connection-editor/page-wifi.c
@@ -540,7 +540,7 @@ ui_to_setting (CEPageWifi *self)
 		bssid = ce_page_entry_to_mac (GTK_ENTRY (entry), ARPHRD_ETHER, NULL);
 	entry = gtk_bin_get_child (GTK_BIN (priv->device_combo));
 	if (entry)
-		ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, &ifname, &device_mac);
+		ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, &ifname, &device_mac, NULL, NULL);
 	cloned_mac = ce_page_entry_to_mac (priv->cloned_mac, ARPHRD_ETHER, NULL);
 
 	g_object_set (s_con,
@@ -579,17 +579,17 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 
 	entry = gtk_bin_get_child (GTK_BIN (priv->bssid));
 	if (entry) {
-		if (!ce_page_mac_entry_valid (GTK_ENTRY (entry), ARPHRD_ETHER))
+		if (!ce_page_mac_entry_valid (GTK_ENTRY (entry), ARPHRD_ETHER, _("bssid"), error))
 			return FALSE;
 	}
 
 	entry = gtk_bin_get_child (GTK_BIN (priv->device_combo));
 	if (entry) {
-		if (!ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, NULL, NULL))
+		if (!ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, NULL, NULL, _("Wi-Fi device"), error))
 			return FALSE;
 	}
 
-	if (!ce_page_mac_entry_valid (priv->cloned_mac, ARPHRD_ETHER))
+	if (!ce_page_mac_entry_valid (priv->cloned_mac, ARPHRD_ETHER, _("cloned MAC"), error))
 		return FALSE;
 
 	ui_to_setting (self);
diff --git a/src/connection-editor/page-wimax.c b/src/connection-editor/page-wimax.c
index dc425c54..77245e67 100644
--- a/src/connection-editor/page-wimax.c
+++ b/src/connection-editor/page-wimax.c
@@ -156,7 +156,7 @@ ui_to_setting (CEPageWimax *self)
 
 	entry = gtk_bin_get_child (GTK_BIN (priv->device_combo));
 	if (entry)
-		ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, &ifname, &device_mac);
+		ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, &ifname, &device_mac, NULL, NULL);
 
 	g_object_set (s_con,
 	              NM_SETTING_CONNECTION_INTERFACE_NAME, ifname,
@@ -180,12 +180,14 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 	GtkWidget *entry;
 
 	name = gtk_entry_get_text (priv->name);
-	if (!*name)
+	if (!*name) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("WiMAX name missing"));
 		return FALSE;
+	}
 
 	entry = gtk_bin_get_child (GTK_BIN (priv->device_combo));
 	if (entry) {
-		if (!ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, NULL, NULL))
+		if (!ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, NULL, NULL, _("WiMAX device"), error))
 			return FALSE;
 	}
 
diff --git a/src/ethernet-dialog.c b/src/ethernet-dialog.c
index 9fd7c1a9..b36cb6c1 100644
--- a/src/ethernet-dialog.c
+++ b/src/ethernet-dialog.c
@@ -39,8 +39,8 @@ static void
 stuff_changed_cb (WirelessSecurity *sec, gpointer user_data)
 {
 	GtkWidget *button = GTK_WIDGET (user_data);
-	
-	gtk_widget_set_sensitive (button, wireless_security_validate (sec));
+
+	gtk_widget_set_sensitive (button, wireless_security_validate (sec, NULL));
 }
 
 static void
diff --git a/src/libnm-gtk/nm-wifi-dialog.c b/src/libnm-gtk/nm-wifi-dialog.c
index aef1bc32..396217ba 100644
--- a/src/libnm-gtk/nm-wifi-dialog.c
+++ b/src/libnm-gtk/nm-wifi-dialog.c
@@ -276,7 +276,7 @@ stuff_changed_cb (WirelessSecurity *sec, gpointer user_data)
 	GByteArray *ssid = NULL;
 	gboolean free_ssid = TRUE;
 	gboolean valid = FALSE;
-	
+
 	if (priv->connection) {
 		NMSettingWireless *s_wireless;
 		s_wireless = nm_connection_get_setting_wireless (priv->connection);
@@ -288,7 +288,7 @@ stuff_changed_cb (WirelessSecurity *sec, gpointer user_data)
 	}
 
 	if (ssid) {
-		valid = wireless_security_validate (sec);
+		valid = wireless_security_validate (sec, NULL);
 		if (free_ssid)
 			g_byte_array_free (ssid, TRUE);
 	}
@@ -328,7 +328,7 @@ ssid_entry_changed (GtkWidget *entry, gpointer user_data)
 		gtk_tree_model_get (model, &iter, S_SEC_COLUMN, &sec, -1);
 
 	if (sec) {
-		valid = wireless_security_validate (sec);
+		valid = wireless_security_validate (sec, NULL);
 		wireless_security_unref (sec);
 	} else {
 		valid = TRUE;
diff --git a/src/wireless-security/eap-method-fast.c b/src/wireless-security/eap-method-fast.c
index 47f3d70b..ba6b1aa3 100644
--- a/src/wireless-security/eap-method-fast.c
+++ b/src/wireless-security/eap-method-fast.c
@@ -31,6 +31,7 @@
 
 #include "eap-method.h"
 #include "wireless-security.h"
+#include "utils.h"
 
 #define I_NAME_COLUMN   0
 #define I_METHOD_COLUMN 1
@@ -53,7 +54,7 @@ destroy (EAPMethod *parent)
 }
 
 static gboolean
-validate (EAPMethod *parent)
+validate (EAPMethod *parent, GError **error)
 {
 	GtkWidget *widget;
 	GtkTreeModel *model;
@@ -69,8 +70,10 @@ validate (EAPMethod *parent)
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_fast_pac_file_button"));
 	g_assert (widget);
 	file = gtk_file_chooser_get_filename (GTK_FILE_CHOOSER (widget));
-	if (!provisioning && !file)
+	if (!provisioning && !file) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP-FAST PAC file"));
 		return FALSE;
+	}
 
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_fast_inner_auth_combo"));
 	g_assert (widget);
@@ -78,7 +81,7 @@ validate (EAPMethod *parent)
 	gtk_combo_box_get_active_iter (GTK_COMBO_BOX (widget), &iter);
 	gtk_tree_model_get (model, &iter, I_METHOD_COLUMN, &eap, -1);
 	g_assert (eap);
-	valid = eap_method_validate (eap);
+	valid = eap_method_validate (eap, error);
 	eap_method_unref (eap);
 	return valid;
 }
diff --git a/src/wireless-security/eap-method-leap.c b/src/wireless-security/eap-method-leap.c
index 461ced4f..1f105f40 100644
--- a/src/wireless-security/eap-method-leap.c
+++ b/src/wireless-security/eap-method-leap.c
@@ -22,12 +22,15 @@
 
 #include <ctype.h>
 #include <string.h>
+#include <glib/gi18n.h>
+
 #include <nm-setting-8021x.h>
 
 #include "eap-method.h"
 #include "wireless-security.h"
 #include "helpers.h"
 #include "nm-ui-utils.h"
+#include "utils.h"
 
 struct _EAPMethodLEAP {
 	EAPMethod parent;
@@ -51,18 +54,22 @@ show_toggled_cb (GtkToggleButton *button, EAPMethodLEAP *method)
 }
 
 static gboolean
-validate (EAPMethod *parent)
+validate (EAPMethod *parent, GError **error)
 {
 	EAPMethodLEAP *method = (EAPMethodLEAP *)parent;
 	const char *text;
 
 	text = gtk_entry_get_text (method->username_entry);
-	if (!text || !strlen (text))
+	if (!text || !strlen (text)) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP-LEAP username"));
 		return FALSE;
+	}
 
-	text = gtk_entry_get_text (method->password_entry);
+	text = gtk_entry_get_text (method->password_entry); {
 	if (!text || !strlen (text))
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP-LEAP password"));
 		return FALSE;
+	}
 
 	return TRUE;
 }
diff --git a/src/wireless-security/eap-method-peap.c b/src/wireless-security/eap-method-peap.c
index d4fa7dbb..ca104fed 100644
--- a/src/wireless-security/eap-method-peap.c
+++ b/src/wireless-security/eap-method-peap.c
@@ -31,6 +31,7 @@
 
 #include "eap-method.h"
 #include "wireless-security.h"
+#include "utils.h"
 
 #define I_NAME_COLUMN   0
 #define I_METHOD_COLUMN 1
@@ -53,18 +54,24 @@ destroy (EAPMethod *parent)
 }
 
 static gboolean
-validate (EAPMethod *parent)
+validate (EAPMethod *parent, GError **error)
 {
 	GtkWidget *widget;
 	GtkTreeModel *model;
 	GtkTreeIter iter;
 	EAPMethod *eap = NULL;
 	gboolean valid = FALSE;
+	GError *local = NULL;
 
-	if (!eap_method_validate_filepicker (parent->builder, "eap_peap_ca_cert_button", TYPE_CA_CERT, NULL, NULL))
+	if (!eap_method_validate_filepicker (parent->builder, "eap_peap_ca_cert_button", TYPE_CA_CERT, NULL, NULL, &local)) {
+		g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-PEAP CA certificate: %s"), local->message);
+		g_clear_error (&local);
 		return FALSE;
-	if (eap_method_ca_cert_required (parent->builder, "eap_peap_ca_cert_not_required_checkbox", "eap_peap_ca_cert_button") )
+	}
+	if (eap_method_ca_cert_required (parent->builder, "eap_peap_ca_cert_not_required_checkbox", "eap_peap_ca_cert_button")) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-PEAP CA ertificate: no certificate specified"));
 		return FALSE;
+	}
 
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_peap_inner_auth_combo"));
 	g_assert (widget);
@@ -73,7 +80,7 @@ validate (EAPMethod *parent)
 	gtk_combo_box_get_active_iter (GTK_COMBO_BOX (widget), &iter);
 	gtk_tree_model_get (model, &iter, I_METHOD_COLUMN, &eap, -1);
 	g_assert (eap);
-	valid = eap_method_validate (eap);
+	valid = eap_method_validate (eap, error);
 	eap_method_unref (eap);
 	return valid;
 }
diff --git a/src/wireless-security/eap-method-simple.c b/src/wireless-security/eap-method-simple.c
index fe7680d6..557bc747 100644
--- a/src/wireless-security/eap-method-simple.c
+++ b/src/wireless-security/eap-method-simple.c
@@ -22,6 +22,8 @@
 
 #include <ctype.h>
 #include <string.h>
+#include <glib/gi18n.h>
+
 #include <nm-setting-8021x.h>
 #include <nm-setting-connection.h>
 
@@ -29,6 +31,7 @@
 #include "wireless-security.h"
 #include "helpers.h"
 #include "nm-ui-utils.h"
+#include "utils.h"
 
 struct _EAPMethodSimple {
 	EAPMethod parent;
@@ -61,22 +64,26 @@ always_ask_selected (GtkEntry *passwd_entry)
 }
 
 static gboolean
-validate (EAPMethod *parent)
+validate (EAPMethod *parent, GError **error)
 {
 	EAPMethodSimple *method = (EAPMethodSimple *)parent;
 	const char *text;
 
 	text = gtk_entry_get_text (method->username_entry);
-	if (!text || !strlen (text))
+	if (!text || !strlen (text)) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP username"));
 		return FALSE;
+	}
 
 	/* Check if the password should always be requested */
 	if (always_ask_selected (method->password_entry))
 		return TRUE;
 
 	text = gtk_entry_get_text (method->password_entry);
-	if (!text || !strlen (text))
+	if (!text || !strlen (text)) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP password"));
 		return FALSE;
+	}
 
 	return TRUE;
 }
diff --git a/src/wireless-security/eap-method-tls.c b/src/wireless-security/eap-method-tls.c
index ff8cfdb7..5294d207 100644
--- a/src/wireless-security/eap-method-tls.c
+++ b/src/wireless-security/eap-method-tls.c
@@ -33,6 +33,7 @@
 #include "wireless-security.h"
 #include "helpers.h"
 #include "nm-ui-utils.h"
+#include "utils.h"
 
 struct _EAPMethodTLS {
 	EAPMethod parent;
@@ -55,40 +56,56 @@ show_toggled_cb (GtkCheckButton *button, EAPMethod *method)
 }
 
 static gboolean
-validate (EAPMethod *parent)
+validate (EAPMethod *parent, GError **error)
 {
 	NMSetting8021xCKFormat format = NM_SETTING_802_1X_CK_FORMAT_UNKNOWN;
 	GtkWidget *widget;
 	const char *password, *identity;
+	GError *local = NULL;
 
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_tls_identity_entry"));
 	g_assert (widget);
 	identity = gtk_entry_get_text (GTK_ENTRY (widget));
-	if (!identity || !strlen (identity))
+	if (!identity || !strlen (identity)) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP-TLS identity"));
 		return FALSE;
+	}
 
-	if (!eap_method_validate_filepicker (parent->builder, "eap_tls_ca_cert_button", TYPE_CA_CERT, NULL, NULL))
+	if (!eap_method_validate_filepicker (parent->builder, "eap_tls_ca_cert_button", TYPE_CA_CERT, NULL, NULL, &local)) {
+		g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-TLS CA certificate: %s"), local->message);
+		g_clear_error (&local);
 		return FALSE;
-	if (eap_method_ca_cert_required (parent->builder, "eap_tls_ca_cert_not_required_checkbox", "eap_tls_ca_cert_button") )
+	}
+	if (eap_method_ca_cert_required (parent->builder, "eap_tls_ca_cert_not_required_checkbox", "eap_tls_ca_cert_button")) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-TLS CA certificate: no certificate specified"));
 		return FALSE;
-
+	}
 
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_tls_private_key_password_entry"));
 	g_assert (widget);
 	password = gtk_entry_get_text (GTK_ENTRY (widget));
-	if (!password || !strlen (password))
+	if (!password || !strlen (password)) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-TLS password: missing"));
 		return FALSE;
+	}
 
 	if (!eap_method_validate_filepicker (parent->builder,
 	                                     "eap_tls_private_key_button",
 	                                     TYPE_PRIVATE_KEY,
 	                                     password,
-	                                     &format))
+	                                     &format,
+	                                     &local)) {
+		g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-TLS private-key: %s"), local->message);
+		g_clear_error (&local);
 		return FALSE;
+	}
 
 	if (format != NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
-		if (!eap_method_validate_filepicker (parent->builder, "eap_tls_user_cert_button", TYPE_CLIENT_CERT, NULL, NULL))
+		if (!eap_method_validate_filepicker (parent->builder, "eap_tls_user_cert_button", TYPE_CLIENT_CERT, NULL, NULL, &local)) {
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-TLS user-certificate: %s"), local->message);
+			g_clear_error (&local);
 			return FALSE;
+		}
 	}
 
 	return TRUE;
diff --git a/src/wireless-security/eap-method-ttls.c b/src/wireless-security/eap-method-ttls.c
index 294734d6..9cfedec5 100644
--- a/src/wireless-security/eap-method-ttls.c
+++ b/src/wireless-security/eap-method-ttls.c
@@ -31,6 +31,7 @@
 
 #include "eap-method.h"
 #include "wireless-security.h"
+#include "utils.h"
 
 #define I_NAME_COLUMN   0
 #define I_METHOD_COLUMN 1
@@ -53,18 +54,24 @@ destroy (EAPMethod *parent)
 }
 
 static gboolean
-validate (EAPMethod *parent)
+validate (EAPMethod *parent, GError **error)
 {
 	GtkWidget *widget;
 	GtkTreeModel *model;
 	GtkTreeIter iter;
 	EAPMethod *eap = NULL;
 	gboolean valid = FALSE;
+	GError *local = NULL;
 
-	if (!eap_method_validate_filepicker (parent->builder, "eap_ttls_ca_cert_button", TYPE_CA_CERT, NULL, NULL))
+	if (!eap_method_validate_filepicker (parent->builder, "eap_ttls_ca_cert_button", TYPE_CA_CERT, NULL, NULL, &local)) {
+		g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-TTLS CA certificate: %s"), local->message);
+		g_clear_error (&local);
 		return FALSE;
-	if (eap_method_ca_cert_required (parent->builder, "eap_ttls_ca_cert_not_required_checkbox", "eap_ttls_ca_cert_button") )
+	}
+	if (eap_method_ca_cert_required (parent->builder, "eap_ttls_ca_cert_not_required_checkbox", "eap_ttls_ca_cert_button")) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-TTLS CA certificate: no certificate specified"));
 		return FALSE;
+	}
 
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_ttls_inner_auth_combo"));
 	g_assert (widget);
@@ -73,7 +80,7 @@ validate (EAPMethod *parent)
 	gtk_combo_box_get_active_iter (GTK_COMBO_BOX (widget), &iter);
 	gtk_tree_model_get (model, &iter, I_METHOD_COLUMN, &eap, -1);
 	g_assert (eap);
-	valid = eap_method_validate (eap);
+	valid = eap_method_validate (eap, error);
 	eap_method_unref (eap);
 	return valid;
 }
diff --git a/src/wireless-security/eap-method.c b/src/wireless-security/eap-method.c
index 1adc2b5e..a886d70b 100644
--- a/src/wireless-security/eap-method.c
+++ b/src/wireless-security/eap-method.c
@@ -36,6 +36,7 @@
 #include <nm-setting-8021x.h>
 #include "eap-method.h"
 #include "nm-utils.h"
+#include "utils.h"
 
 G_DEFINE_BOXED_TYPE (EAPMethod, eap_method, eap_method_ref, eap_method_unref)
 
@@ -48,12 +49,17 @@ eap_method_get_widget (EAPMethod *method)
 }
 
 gboolean
-eap_method_validate (EAPMethod *method)
+eap_method_validate (EAPMethod *method, GError **error)
 {
+	gboolean result;
+
 	g_return_val_if_fail (method != NULL, FALSE);
 
 	g_assert (method->validate);
-	return (*(method->validate)) (method);
+	result = (*(method->validate)) (method, error);
+	if (!result && error && !*error)
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("undefined error in 802.1x security (wpa-eap)"));
+	return result;
 }
 
 void
@@ -209,13 +215,13 @@ eap_method_validate_filepicker (GtkBuilder *builder,
                                 const char *name,
                                 guint32 item_type,
                                 const char *password,
-                                NMSetting8021xCKFormat *out_format)
+                                NMSetting8021xCKFormat *out_format,
+                                GError **error)
 {
 	GtkWidget *widget;
 	char *filename;
 	NMSetting8021x *setting;
 	gboolean success = FALSE;
-	GError *error = NULL;
 
 	if (item_type == TYPE_PRIVATE_KEY) {
 		g_return_val_if_fail (password != NULL, FALSE);
@@ -234,25 +240,13 @@ eap_method_validate_filepicker (GtkBuilder *builder,
 	setting = (NMSetting8021x *) nm_setting_802_1x_new ();
 
 	if (item_type == TYPE_PRIVATE_KEY) {
-		if (!nm_setting_802_1x_set_private_key (setting, filename, password, NM_SETTING_802_1X_CK_SCHEME_PATH, out_format, &error)) {
-			g_warning ("Error: couldn't verify private key: %d %s",
-			           error ? error->code : -1, error ? error->message : "(none)");
-			g_clear_error (&error);
-		} else
+		if (nm_setting_802_1x_set_private_key (setting, filename, password, NM_SETTING_802_1X_CK_SCHEME_PATH, out_format, error))
 			success = TRUE;
 	} else if (item_type == TYPE_CLIENT_CERT) {
-		if (!nm_setting_802_1x_set_client_cert (setting, filename, NM_SETTING_802_1X_CK_SCHEME_PATH, out_format, &error)) {
-			g_warning ("Error: couldn't verify client certificate: %d %s",
-			           error ? error->code : -1, error ? error->message : "(none)");
-			g_clear_error (&error);
-		} else
+		if (nm_setting_802_1x_set_client_cert (setting, filename, NM_SETTING_802_1X_CK_SCHEME_PATH, out_format, error))
 			success = TRUE;
 	} else if (item_type == TYPE_CA_CERT) {
-		if (!nm_setting_802_1x_set_ca_cert (setting, filename, NM_SETTING_802_1X_CK_SCHEME_PATH, out_format, &error)) {
-			g_warning ("Error: couldn't verify CA certificate: %d %s",
-			           error ? error->code : -1, error ? error->message : "(none)");
-			g_clear_error (&error);
-		} else
+		if (nm_setting_802_1x_set_ca_cert (setting, filename, NM_SETTING_802_1X_CK_SCHEME_PATH, out_format, error))
 			success = TRUE;
 	} else
 		g_warning ("%s: invalid item type %d.", __func__, item_type);
@@ -261,6 +255,9 @@ eap_method_validate_filepicker (GtkBuilder *builder,
 
 out:
 	g_free (filename);
+
+	if (!success && error && !*error)
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("unspecified error validating eap-method file"));
 	return success;
 }
 
diff --git a/src/wireless-security/eap-method.h b/src/wireless-security/eap-method.h
index cf02081e..493f3721 100644
--- a/src/wireless-security/eap-method.h
+++ b/src/wireless-security/eap-method.h
@@ -35,7 +35,7 @@ typedef void        (*EMAddToSizeGroupFunc) (EAPMethod *method, GtkSizeGroup *gr
 typedef void        (*EMFillConnectionFunc) (EAPMethod *method, NMConnection *connection, NMSettingSecretFlags flags);
 typedef void        (*EMUpdateSecretsFunc)  (EAPMethod *method, NMConnection *connection);
 typedef void        (*EMDestroyFunc)        (EAPMethod *method);
-typedef gboolean    (*EMValidateFunc)       (EAPMethod *method);
+typedef gboolean    (*EMValidateFunc)       (EAPMethod *method, GError **error);
 
 struct _EAPMethod {
 	guint32 refcount;
@@ -62,7 +62,7 @@ struct _EAPMethod {
 
 GtkWidget *eap_method_get_widget (EAPMethod *method);
 
-gboolean eap_method_validate (EAPMethod *method);
+gboolean eap_method_validate (EAPMethod *method, GError **error);
 
 void eap_method_add_to_size_group (EAPMethod *method, GtkSizeGroup *group);
 
@@ -110,7 +110,8 @@ gboolean eap_method_validate_filepicker (GtkBuilder *builder,
                                          const char *name,
                                          guint32 item_type,
                                          const char *password,
-                                         NMSetting8021xCKFormat *out_format);
+                                         NMSetting8021xCKFormat *out_format,
+                                         GError **error);
 
 void eap_method_phase2_update_secrets_helper (EAPMethod *method,
                                               NMConnection *connection,
diff --git a/src/wireless-security/wireless-security.c b/src/wireless-security/wireless-security.c
index 2af073c1..eafbee39 100644
--- a/src/wireless-security/wireless-security.c
+++ b/src/wireless-security/wireless-security.c
@@ -36,6 +36,7 @@
 
 #include "wireless-security.h"
 #include "eap-method.h"
+#include "utils.h"
 
 G_DEFINE_BOXED_TYPE (WirelessSecurity, wireless_security, wireless_security_ref, wireless_security_unref)
 
@@ -68,12 +69,18 @@ wireless_security_changed_cb (GtkWidget *ignored, gpointer user_data)
 }
 
 gboolean
-wireless_security_validate (WirelessSecurity *sec)
+wireless_security_validate (WirelessSecurity *sec, GError **error)
 {
+	gboolean result;
+
 	g_return_val_if_fail (sec != NULL, FALSE);
+	g_return_val_if_fail (!error || !*error, FALSE);
 
 	g_assert (sec->validate);
-	return (*(sec->validate)) (sec);
+	result = (*(sec->validate)) (sec, error);
+	if (!result && error && !error)
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("Unknown error validating 802.1x security"));
+	return result;
 }
 
 void
@@ -293,7 +300,7 @@ ws_802_1x_add_to_size_group (WirelessSecurity *sec,
 }
 
 gboolean
-ws_802_1x_validate (WirelessSecurity *sec, const char *combo_name)
+ws_802_1x_validate (WirelessSecurity *sec, const char *combo_name, GError **error)
 {
 	GtkWidget *widget;
 	GtkTreeModel *model;
@@ -308,7 +315,7 @@ ws_802_1x_validate (WirelessSecurity *sec, const char *combo_name)
 	gtk_combo_box_get_active_iter (GTK_COMBO_BOX (widget), &iter);
 	gtk_tree_model_get (model, &iter, AUTH_METHOD_COLUMN, &eap, -1);
 	g_assert (eap);
-	valid = eap_method_validate (eap);
+	valid = eap_method_validate (eap, error);
 	eap_method_unref (eap);
 	return valid;
 }
diff --git a/src/wireless-security/wireless-security.h b/src/wireless-security/wireless-security.h
index 4aac30a6..d5c83619 100644
--- a/src/wireless-security/wireless-security.h
+++ b/src/wireless-security/wireless-security.h
@@ -36,7 +36,7 @@ typedef void (*WSAddToSizeGroupFunc) (WirelessSecurity *sec, GtkSizeGroup *group
 typedef void (*WSFillConnectionFunc) (WirelessSecurity *sec, NMConnection *connection);
 typedef void (*WSUpdateSecretsFunc)  (WirelessSecurity *sec, NMConnection *connection);
 typedef void (*WSDestroyFunc)        (WirelessSecurity *sec);
-typedef gboolean (*WSValidateFunc)   (WirelessSecurity *sec);
+typedef gboolean (*WSValidateFunc)   (WirelessSecurity *sec, GError **error);
 typedef GtkWidget * (*WSNagUserFunc) (WirelessSecurity *sec);
 
 struct _WirelessSecurity {
@@ -68,7 +68,7 @@ void wireless_security_set_changed_notify (WirelessSecurity *sec,
                                            WSChangedFunc func,
                                            gpointer user_data);
 
-gboolean wireless_security_validate (WirelessSecurity *sec);
+gboolean wireless_security_validate (WirelessSecurity *sec, GError **error);
 
 void wireless_security_add_to_size_group (WirelessSecurity *sec,
                                           GtkSizeGroup *group);
@@ -133,7 +133,7 @@ void ws_802_1x_auth_combo_changed (GtkWidget *combo,
                                    const char *vbox_name,
                                    GtkSizeGroup *size_group);
 
-gboolean ws_802_1x_validate (WirelessSecurity *sec, const char *combo_name);
+gboolean ws_802_1x_validate (WirelessSecurity *sec, const char *combo_name, GError **error);
 
 void ws_802_1x_add_to_size_group (WirelessSecurity *sec,
                                   GtkSizeGroup *size_group,
diff --git a/src/wireless-security/ws-dynamic-wep.c b/src/wireless-security/ws-dynamic-wep.c
index e224277b..e2dd4e18 100644
--- a/src/wireless-security/ws-dynamic-wep.c
+++ b/src/wireless-security/ws-dynamic-wep.c
@@ -44,9 +44,9 @@ destroy (WirelessSecurity *parent)
 }
 
 static gboolean
-validate (WirelessSecurity *parent)
+validate (WirelessSecurity *parent, GError **error)
 {
-	return ws_802_1x_validate (parent, "dynamic_wep_auth_combo");
+	return ws_802_1x_validate (parent, "dynamic_wep_auth_combo", error);
 }
 
 static void
diff --git a/src/wireless-security/ws-leap.c b/src/wireless-security/ws-leap.c
index 8a4d76e8..af4baaf4 100644
--- a/src/wireless-security/ws-leap.c
+++ b/src/wireless-security/ws-leap.c
@@ -21,11 +21,14 @@
  */
 
 #include <string.h>
+#include <glib/gi18n.h>
+
 #include <nm-setting-wireless.h>
 
 #include "wireless-security.h"
 #include "helpers.h"
 #include "nm-ui-utils.h"
+#include "utils.h"
 
 struct _WirelessSecurityLEAP {
 	WirelessSecurity parent;
@@ -47,7 +50,7 @@ show_toggled_cb (GtkCheckButton *button, WirelessSecurity *sec)
 }
 
 static gboolean
-validate (WirelessSecurity *parent)
+validate (WirelessSecurity *parent, GError **error)
 {
 	GtkWidget *entry;
 	const char *text;
@@ -55,14 +58,18 @@ validate (WirelessSecurity *parent)
 	entry = GTK_WIDGET (gtk_builder_get_object (parent->builder, "leap_username_entry"));
 	g_assert (entry);
 	text = gtk_entry_get_text (GTK_ENTRY (entry));
-	if (!text || !strlen (text))
+	if (!text || !strlen (text)) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing leap-username"));
 		return FALSE;
+	}
 
 	entry = GTK_WIDGET (gtk_builder_get_object (parent->builder, "leap_password_entry"));
 	g_assert (entry);
 	text = gtk_entry_get_text (GTK_ENTRY (entry));
-	if (!text || !strlen (text))
+	if (!text || !strlen (text)) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing leap-password"));
 		return FALSE;
+	}
 
 	return TRUE;
 }
diff --git a/src/wireless-security/ws-wep-key.c b/src/wireless-security/ws-wep-key.c
index ba1676fa..cdbf1156 100644
--- a/src/wireless-security/ws-wep-key.c
+++ b/src/wireless-security/ws-wep-key.c
@@ -22,6 +22,7 @@
 
 #include <string.h>
 #include <glib.h>
+#include <glib/gi18n.h>
 
 #include <nm-setting-wireless.h>
 #include <nm-setting-wireless-security.h>
@@ -92,7 +93,7 @@ destroy (WirelessSecurity *parent)
 }
 
 static gboolean
-validate (WirelessSecurity *parent)
+validate (WirelessSecurity *parent, GError **error)
 {
 	WirelessSecurityWEPKey *sec = (WirelessSecurityWEPKey *) parent;
 	GtkWidget *entry;
@@ -103,26 +104,38 @@ validate (WirelessSecurity *parent)
 	g_assert (entry);
 
 	key = gtk_entry_get_text (GTK_ENTRY (entry));
-	if (!key)
+	if (!key) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing wep-key"));
 		return FALSE;
+	}
 
 	if (sec->type == NM_WEP_KEY_TYPE_KEY) {
 		if ((strlen (key) == 10) || (strlen (key) == 26)) {
 			for (i = 0; i < strlen (key); i++) {
-				if (!g_ascii_isxdigit (key[i]))
+				if (!g_ascii_isxdigit (key[i])) {
+					g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid wep-key: key with a length of %zu must contain only hex-digits"), strlen (key));
 					return FALSE;
+				}
 			}
 		} else if ((strlen (key) == 5) || (strlen (key) == 13)) {
 			for (i = 0; i < strlen (key); i++) {
-				if (!utils_char_is_ascii_print (key[i]))
+				if (!utils_char_is_ascii_print (key[i])) {
+					g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid wep-key: key with a length of %zu must contain only ascii characters"), strlen (key));
 					return FALSE;
+				}
 			}
 		} else {
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid wep-key: wrong key length %zu. A key must be either of length 5/13 (ascii) or 10/26 (hex)"), strlen (key));
 			return FALSE;
 		}
 	} else if (sec->type == NM_WEP_KEY_TYPE_PASSPHRASE) {
-		if (!strlen (key) || (strlen (key) > 64))
+		if (!*key || (strlen (key) > 64)) {
+			if (!*key)
+				g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid wep-key: passphrase must be non-empty"));
+			else
+				g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid wep-key: passphrase must be shorter then 64 characters"));
 			return FALSE;
+		}
 	}
 
 	return TRUE;
diff --git a/src/wireless-security/ws-wpa-eap.c b/src/wireless-security/ws-wpa-eap.c
index f4789ad0..63e69570 100644
--- a/src/wireless-security/ws-wpa-eap.c
+++ b/src/wireless-security/ws-wpa-eap.c
@@ -45,9 +45,9 @@ destroy (WirelessSecurity *parent)
 }
 
 static gboolean
-validate (WirelessSecurity *parent)
+validate (WirelessSecurity *parent, GError **error)
 {
-	return ws_802_1x_validate (parent, "wpa_eap_auth_combo");
+	return ws_802_1x_validate (parent, "wpa_eap_auth_combo", error);
 }
 
 static void
diff --git a/src/wireless-security/ws-wpa-psk.c b/src/wireless-security/ws-wpa-psk.c
index e2fca374..1495707f 100644
--- a/src/wireless-security/ws-wpa-psk.c
+++ b/src/wireless-security/ws-wpa-psk.c
@@ -22,11 +22,14 @@
 
 #include <ctype.h>
 #include <string.h>
+#include <glib/gi18n.h>
+
 #include <nm-setting-wireless.h>
 
 #include "wireless-security.h"
 #include "helpers.h"
 #include "nm-ui-utils.h"
+#include "utils.h"
 
 #define WPA_PMK_LEN 32
 
@@ -51,26 +54,30 @@ show_toggled_cb (GtkCheckButton *button, WirelessSecurity *sec)
 }
 
 static gboolean
-validate (WirelessSecurity *parent)
+validate (WirelessSecurity *parent, GError **error)
 {
 	GtkWidget *entry;
 	const char *key;
-	guint32 len;
+	gsize len;
 	int i;
 
 	entry = GTK_WIDGET (gtk_builder_get_object (parent->builder, "wpa_psk_entry"));
 	g_assert (entry);
 
 	key = gtk_entry_get_text (GTK_ENTRY (entry));
-	len = strlen (key);
-	if ((len < 8) || (len > 64))
+	len = key ? strlen (key) : 0;
+	if ((len < 8) || (len > 64)) {
+		g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid wpa-psk: invalid key-length %zu. Must be [8,63] bytes or 64 hex digits"), len);
 		return FALSE;
+	}
 
 	if (len == 64) {
 		/* Hex PSK */
 		for (i = 0; i < len; i++) {
-			if (!isxdigit (key[i]))
+			if (!isxdigit (key[i])) {
+				g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid wpa-psk: cannot interpret key with 64 bytes as hex"));
 				return FALSE;
+			}
 		}
 	}