c-e: forward the validation error to print more sensible error message to stdout

When a connection doesn't verify, the "Save" dialog stays desensitized.
Even for an advanced user it's not immediately clear what causes the
valdation failure.

We already print a message like "Invalid setting Ethernet" to stdout.
Extend the message to also print an more detailed error that gets propagated
from the validation.

This later should be improved further to indicating the failure reason
in the UI too.

30 files changed, 252 insertions, 138 deletions

diff --git a/src/connection-editor/ce-page.c b/src/connection-editor/ce-page.c
index 5c75e35a..2a2cf515 100644
--- a/src/connection-editor/ce-page.c
+++ b/src/connection-editor/ce-page.c
@@ -128,8 +128,13 @@ ce_page_validate (CEPage *self, NMConnection *connection, GError **error)
 	g_return_val_if_fail (CE_IS_PAGE (self), FALSE);
 	g_return_val_if_fail (NM_IS_CONNECTION (connection), FALSE);
 
-	if (CE_PAGE_GET_CLASS (self)->ce_page_validate_v)
-		return CE_PAGE_GET_CLASS (self)->ce_page_validate_v (self, connection, error);
+	if (CE_PAGE_GET_CLASS (self)->ce_page_validate_v) {
+		if (!CE_PAGE_GET_CLASS (self)->ce_page_validate_v (self, connection, error)) {
+			if (error && !*error)
+				g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("unspecified error"));
+			return FALSE;
+		}
+	}
 
 	return TRUE;
 }
@@ -210,18 +215,51 @@ ce_page_setup_mac_combo (CEPage *self, GtkComboBox *combo,
 }
 
 gboolean
-ce_page_mac_entry_valid (GtkEntry *entry, int type)
+ce_page_mac_entry_valid (GtkEntry *entry, int type, const char *property_name, GError **error)
 {
 	const char *mac;
 
-	g_return_val_if_fail (entry != NULL, FALSE);
 	g_return_val_if_fail (GTK_IS_ENTRY (entry), FALSE);
 
 	mac = gtk_entry_get_text (entry);
-	if (!mac || !*mac)
-		return TRUE;
+	if (mac && *mac) {
+		if (!nm_utils_hwaddr_valid (mac, nm_utils_hwaddr_len (type))) {
+			const char *addr_type;
+
+			addr_type = type == ARPHRD_ETHER ? _("MAC address") : _("HW addreess");
+			if (property_name) {
+				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC,
+				             _("invalid %s for %s (%s)"),
+				             addr_type, property_name, mac);
+			} else {
+				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC,
+				             _("invalid %s (%s)"),
+				             addr_type, mac);
+			}
+			return FALSE;
+		}
+	}
+	return TRUE;
+}
 
-	return nm_utils_hwaddr_valid (mac, nm_utils_hwaddr_len (type));
+gboolean
+ce_page_interface_name_valid (const char *iface, const char *property_name, GError **error)
+{
+	if (iface && *iface) {
+		if (!nm_utils_iface_valid_name (iface)) {
+			if (property_name) {
+				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC,
+				             _("invalid interface-name for %s (%s)"),
+				             property_name, iface);
+			} else {
+				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC,
+				             _("invalid interface-name (%s)"),
+				             iface);
+			}
+			return FALSE;
+		}
+	}
+	return TRUE;
 }
 
 static char **
@@ -376,16 +414,19 @@ ce_page_setup_device_combo (CEPage *self,
 }
 
 gboolean
-ce_page_device_entry_get (GtkEntry *entry, int type, char **ifname, char **mac)
+ce_page_device_entry_get (GtkEntry *entry, int type, char **ifname, char **mac, const char *device_name, GError **error)
 {
 	char *first, *second;
 	const char *ifname_tmp = NULL, *mac_tmp = NULL;
 	gboolean valid = TRUE;
+	const char *str;
 
 	g_return_val_if_fail (entry != NULL, FALSE);
 	g_return_val_if_fail (GTK_IS_ENTRY (entry), FALSE);
 
-	valid = _device_entry_parse (gtk_entry_get_text (entry), &first, &second);
+	str = gtk_entry_get_text (entry);
+
+	valid = _device_entry_parse (str, &first, &second);
 
 	if (first) {
 		if (nm_utils_hwaddr_valid (first, nm_utils_hwaddr_len (type)))
@@ -418,6 +459,13 @@ ce_page_device_entry_get (GtkEntry *entry, int type, char **ifname, char **mac)
 	g_free (first);
 	g_free (second);
 
+	if (!valid) {
+		g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC,
+		             _("invalid %s (%s)"),
+		             device_name ? device_name : _("device"),
+		             str);
+	}
+
 	return valid;
 }
 
diff --git a/src/connection-editor/ce-page.h b/src/connection-editor/ce-page.h
index 758e3421..2c115142 100644
--- a/src/connection-editor/ce-page.h
+++ b/src/connection-editor/ce-page.h
@@ -114,9 +114,12 @@ void ce_page_setup_device_combo (CEPage *self,
                                  const char *mac,
                                  const char *mac_property,
                                  gboolean ifname_first);
-gboolean ce_page_mac_entry_valid (GtkEntry *entry, int type);
+gboolean ce_page_mac_entry_valid (GtkEntry *entry, int type, const char *property_name, GError **error);
+gboolean ce_page_interface_name_valid (const char *iface, const char *property_name, GError **error);
 gboolean ce_page_device_entry_get (GtkEntry *entry, int type,
-                                   char **ifname, char **mac);
+                                   char **ifname, char **mac,
+                                   const char *device_name,
+                                   GError **error);
 
 void ce_page_changed (CEPage *self);
 
diff --git a/src/connection-editor/page-8021x-security.c b/src/connection-editor/page-8021x-security.c
index f8895d61..f484a5d2 100644
--- a/src/connection-editor/page-8021x-security.c
+++ b/src/connection-editor/page-8021x-security.c
@@ -143,8 +143,7 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 		NMConnection *tmp_connection;
 		NMSetting *s_8021x;
 
-		/* FIXME: get failed property and error out of wireless security objects */
-		valid = wireless_security_validate (priv->security);
+		valid = wireless_security_validate (priv->security, error);
 		if (valid) {
 			NMSetting *s_con;
 
@@ -164,8 +163,7 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 			nm_connection_add_setting (connection, NM_SETTING (g_object_ref (s_8021x)));
 
 			g_object_unref (tmp_connection);
-		} else
-			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, "Invalid 802.1x security");
+		}
 	} else {
 		nm_connection_remove_setting (connection, NM_TYPE_SETTING_802_1X);
 		valid = TRUE;
diff --git a/src/connection-editor/page-bluetooth.c b/src/connection-editor/page-bluetooth.c
index b7a19601..23ec596a 100644
--- a/src/connection-editor/page-bluetooth.c
+++ b/src/connection-editor/page-bluetooth.c
@@ -145,7 +145,7 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 	CEPageBluetooth *self = CE_PAGE_BLUETOOTH (page);
 	CEPageBluetoothPrivate *priv = CE_PAGE_BLUETOOTH_GET_PRIVATE (self);
 
-	if (!ce_page_mac_entry_valid (priv->bdaddr, ARPHRD_ETHER))
+	if (!ce_page_mac_entry_valid (priv->bdaddr, ARPHRD_ETHER, _("bdaddr"), error))
 		return FALSE;
 
 	ui_to_setting (self);
diff --git a/src/connection-editor/page-bond.c b/src/connection-editor/page-bond.c
index 6ef5ac7a..9d3b7898 100644
--- a/src/connection-editor/page-bond.c
+++ b/src/connection-editor/page-bond.c
@@ -558,13 +558,12 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 {
 	CEPageBond *self = CE_PAGE_BOND (page);
 	CEPageBondPrivate *priv = CE_PAGE_BOND_GET_PRIVATE (self);
-	const char *primary;
 
 	if (!CE_PAGE_CLASS (ce_page_bond_parent_class)->ce_page_validate_v (page, connection, error))
 		return FALSE;
 
-	primary = gtk_entry_get_text (priv->primary);
-	if (primary && *primary && !nm_utils_iface_valid_name (primary))
+	if (!ce_page_interface_name_valid (gtk_entry_get_text (priv->primary),
+	                                   _("primary"), error))
 		return FALSE;
 
 	ui_to_setting (self);
diff --git a/src/connection-editor/page-ethernet.c b/src/connection-editor/page-ethernet.c
index 7134f009..d52e00cf 100644
--- a/src/connection-editor/page-ethernet.c
+++ b/src/connection-editor/page-ethernet.c
@@ -304,7 +304,7 @@ ui_to_setting (CEPageEthernet *self)
 
 	entry = gtk_bin_get_child (GTK_BIN (priv->device_combo));
 	if (entry)
-		ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, &ifname, &device_mac);
+		ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, &ifname, &device_mac, NULL, NULL);
 	cloned_mac = gtk_entry_get_text (priv->cloned_mac);
 
 	g_object_set (s_con,
@@ -333,11 +333,11 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 
 	entry = gtk_bin_get_child (GTK_BIN (priv->device_combo));
 	if (entry) {
-		if (!ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, NULL, NULL))
+		if (!ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, NULL, NULL, _("Ethernet device"), error))
 			return FALSE;
 	}
 
-	if (!ce_page_mac_entry_valid (priv->cloned_mac, ARPHRD_ETHER))
+	if (!ce_page_mac_entry_valid (priv->cloned_mac, ARPHRD_ETHER, _("cloned MAC"), error))
 		return FALSE;
 
 	ui_to_setting (self);
diff --git a/src/connection-editor/page-infiniband.c b/src/connection-editor/page-infiniband.c
index 06db6f0c..09c9b8f9 100644
--- a/src/connection-editor/page-infiniband.c
+++ b/src/connection-editor/page-infiniband.c
@@ -190,7 +190,7 @@ ui_to_setting (CEPageInfiniband *self)
 
 	entry = gtk_bin_get_child (GTK_BIN (priv->device_combo));
 	if (entry)
-		ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_INFINIBAND, &ifname, &device_mac);
+		ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_INFINIBAND, &ifname, &device_mac, NULL, NULL);
 
 	g_object_set (s_con,
 	              NM_SETTING_CONNECTION_INTERFACE_NAME, ifname,
@@ -214,7 +214,7 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 
 	entry = gtk_bin_get_child (GTK_BIN (priv->device_combo));
 	if (entry) {
-		if (!ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_INFINIBAND, NULL, NULL))
+		if (!ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_INFINIBAND, NULL, NULL, _("infiniband device"), error))
 			return FALSE;
 	}
 
diff --git a/src/connection-editor/page-ip4.c b/src/connection-editor/page-ip4.c
index aaad004b..48d6041f 100644
--- a/src/connection-editor/page-ip4.c
+++ b/src/connection-editor/page-ip4.c
@@ -1174,7 +1174,7 @@ free_one_addr (gpointer data)
 }
 
 static gboolean
-ui_to_setting (CEPageIP4 *self)
+ui_to_setting (CEPageIP4 *self, GError **error)
 {
 	CEPageIP4Private *priv = CE_PAGE_IP4_GET_PRIVATE (self);
 	GtkTreeModel *model;
@@ -1239,8 +1239,7 @@ ui_to_setting (CEPageIP4 *self)
 		if (   !addr
 		    || !nm_utils_ipaddr_valid (AF_INET, addr)
 		    || is_address_unspecified (addr)) {
-			g_warning ("%s: IPv4 address '%s' missing or invalid!",
-			           __func__, addr ? addr : "<none>");
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv4 address \"%s\" invalid"), addr ? addr : "");
 			g_free (addr);
 			g_free (netmask);
 			g_free (addr_gw);
@@ -1248,8 +1247,7 @@ ui_to_setting (CEPageIP4 *self)
 		}
 
 		if (!parse_netmask (netmask, &prefix)) {
-			g_warning ("%s: IPv4 prefix '%s' missing or invalid!",
-			           __func__, netmask ? netmask : "<none>");
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv4 address netmask \"%s\" invalid"), netmask ? netmask : "");
 			g_free (addr);
 			g_free (netmask);
 			g_free (addr_gw);
@@ -1258,8 +1256,7 @@ ui_to_setting (CEPageIP4 *self)
 
 		/* Gateway is optional... */
 		if (addr_gw && *addr_gw && !nm_utils_ipaddr_valid (AF_INET, addr_gw)) {
-			g_warning ("%s: IPv4 gateway '%s' invalid!",
-			           __func__, addr_gw);
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv4 gateway \"%s\" invalid"), addr_gw);
 			g_free (addr);
 			g_free (netmask);
 			g_free (addr_gw);
@@ -1302,6 +1299,7 @@ ui_to_setting (CEPageIP4 *self)
 			if (inet_pton (AF_INET, stripped, &tmp_addr))
 				g_ptr_array_add (tmp_array, g_strdup (stripped));
 			else {
+				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv4 DNS server \"%s\" invalid"), stripped);
 				g_strfreev (items);
 				g_ptr_array_free (tmp_array, TRUE);
 				goto out;
@@ -1369,7 +1367,7 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 	CEPageIP4 *self = CE_PAGE_IP4 (page);
 	CEPageIP4Private *priv = CE_PAGE_IP4_GET_PRIVATE (self);
 
-	if (!ui_to_setting (self))
+	if (!ui_to_setting (self, error))
 		return FALSE;
 	return nm_setting_verify (NM_SETTING (priv->setting), NULL, error);
 }
diff --git a/src/connection-editor/page-ip6.c b/src/connection-editor/page-ip6.c
index 5f3abe56..439858ab 100644
--- a/src/connection-editor/page-ip6.c
+++ b/src/connection-editor/page-ip6.c
@@ -1176,7 +1176,7 @@ ce_page_ip6_new (NMConnection *connection,
 }
 
 static gboolean
-ui_to_setting (CEPageIP6 *self)
+ui_to_setting (CEPageIP6 *self, GError **error)
 {
 	CEPageIP6Private *priv = CE_PAGE_IP6_GET_PRIVATE (self);
 	GtkTreeModel *model;
@@ -1245,8 +1245,7 @@ ui_to_setting (CEPageIP6 *self)
 		if (   !addr_str
 		    || !nm_utils_ipaddr_valid (AF_INET6, addr_str)
 		    || is_address_unspecified (addr_str)) {
-			g_warning ("%s: IPv6 address '%s' missing or invalid!",
-			           __func__, addr_str ? addr_str : "<none>");
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv6 address \"%s\" invalid"), addr_str ? addr_str : "");
 			g_free (addr_str);
 			g_free (prefix_str);
 			g_free (addr_gw_str);
@@ -1254,10 +1253,7 @@ ui_to_setting (CEPageIP6 *self)
 		}
 
 		if (!is_prefix_valid (prefix_str, &prefix)) {
-			if (!prefix_str)
-				g_warning ("%s: IPv6 prefix missing!", __func__);
-			else
-				g_warning ("%s: IPv6 prefix '%s' invalid!", __func__, prefix_str);
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv6 prefix \"%s\" invalid"), prefix_str ? prefix_str : "");
 			g_free (addr_str);
 			g_free (prefix_str);
 			g_free (addr_gw_str);
@@ -1266,8 +1262,7 @@ ui_to_setting (CEPageIP6 *self)
 
 		/* Gateway is optional... */
 		if (addr_gw_str && *addr_gw_str && !nm_utils_ipaddr_valid (AF_INET6, addr_gw_str)) {
-			g_warning ("%s: IPv6 gateway '%s' invalid!",
-			           __func__, addr_gw_str);
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv6 gateway \"%s\" invalid"), addr_gw_str);
 			g_free (addr_str);
 			g_free (prefix_str);
 			g_free (addr_gw_str);
@@ -1309,6 +1304,7 @@ ui_to_setting (CEPageIP6 *self)
 			if (inet_pton (AF_INET6, stripped, &tmp_addr)) {
 				nm_setting_ip_config_add_dns (priv->setting, stripped);
 			} else {
+				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("IPv6 DNS server \"%s\" invalid"), stripped);
 				g_strfreev (items);
 				goto out;
 			}
@@ -1366,7 +1362,7 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 	CEPageIP6 *self = CE_PAGE_IP6 (page);
 	CEPageIP6Private *priv = CE_PAGE_IP6_GET_PRIVATE (self);
 
-	if (!ui_to_setting (self))
+	if (!ui_to_setting (self, error))
 		return FALSE;
 	return nm_setting_verify (NM_SETTING (priv->setting), NULL, error);
 }
diff --git a/src/connection-editor/page-vlan.c b/src/connection-editor/page-vlan.c
index c088cf62..5df091c4 100644
--- a/src/connection-editor/page-vlan.c
+++ b/src/connection-editor/page-vlan.c
@@ -722,17 +722,16 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 	char *parent_iface;
 
 	if (gtk_combo_box_get_active (GTK_COMBO_BOX (priv->parent)) == -1) {
-		gboolean valid;
-
 		parent = gtk_entry_get_text (priv->parent_entry);
 		parent_iface = g_strndup (parent, strcspn (parent, " "));
-		valid = nm_utils_iface_valid_name (parent_iface);
-		g_free (parent_iface);
-		if (!valid)
+		if (!ce_page_interface_name_valid (parent_iface, _("vlan parent"), error)) {
+			g_free (parent_iface);
 			return FALSE;
+		}
+		g_free (parent_iface);
 	}
 
-	if (!ce_page_mac_entry_valid (priv->cloned_mac, ARPHRD_ETHER))
+	if (!ce_page_mac_entry_valid (priv->cloned_mac, ARPHRD_ETHER, _("cloned MAC"), error))
 		return FALSE;
 
 	ui_to_setting (self);
diff --git a/src/connection-editor/page-wifi-security.c b/src/connection-editor/page-wifi-security.c
index 73c85ca3..67611a9e 100644
--- a/src/connection-editor/page-wifi-security.c
+++ b/src/connection-editor/page-wifi-security.c
@@ -475,20 +475,17 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 		GBytes *ssid = nm_setting_wireless_get_ssid (s_wireless);
 
 		if (ssid) {
-			/* FIXME: get failed property and error out of wifi security objects */
-			valid = wireless_security_validate (sec);
+			valid = wireless_security_validate (sec, error);
 			if (valid)
 				wireless_security_fill_connection (sec, connection);
-			else
-				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, "Invalid Wi-Fi security");
 		} else {
-			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, "Missing SSID");
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing SSID"));
 			valid = FALSE;
 		}
 
 		if (priv->adhoc) {
 			if (!wireless_security_adhoc_compatible (sec)) {
-				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, "Security not compatible with Ad-Hoc mode");
+				g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("Security not compatible with Ad-Hoc mode"));
 				valid = FALSE;
 			}
 		}
diff --git a/src/connection-editor/page-wifi.c b/src/connection-editor/page-wifi.c
index 4f09cda0..b0455ff7 100644
--- a/src/connection-editor/page-wifi.c
+++ b/src/connection-editor/page-wifi.c
@@ -529,7 +529,7 @@ ui_to_setting (CEPageWifi *self)
 		bssid = gtk_entry_get_text (GTK_ENTRY (entry));
 	entry = gtk_bin_get_child (GTK_BIN (priv->device_combo));
 	if (entry)
-		ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, &ifname, &device_mac);
+		ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, &ifname, &device_mac, NULL, NULL);
 	cloned_mac = gtk_entry_get_text (priv->cloned_mac);
 
 	g_object_set (s_con,
@@ -563,17 +563,17 @@ ce_page_validate_v (CEPage *page, NMConnection *connection, GError **error)
 
 	entry = gtk_bin_get_child (GTK_BIN (priv->bssid));
 	if (entry) {
-		if (!ce_page_mac_entry_valid (GTK_ENTRY (entry), ARPHRD_ETHER))
+		if (!ce_page_mac_entry_valid (GTK_ENTRY (entry), ARPHRD_ETHER, _("bssid"), error))
 			return FALSE;
 	}
 
 	entry = gtk_bin_get_child (GTK_BIN (priv->device_combo));
 	if (entry) {
-		if (!ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, NULL, NULL))
+		if (!ce_page_device_entry_get (GTK_ENTRY (entry), ARPHRD_ETHER, NULL, NULL, _("Wi-Fi device"), error))
 			return FALSE;
 	}
 
-	if (!ce_page_mac_entry_valid (priv->cloned_mac, ARPHRD_ETHER))
+	if (!ce_page_mac_entry_valid (priv->cloned_mac, ARPHRD_ETHER, _("cloned MAC"), error))
 		return FALSE;
 
 	ui_to_setting (self);
diff --git a/src/ethernet-dialog.c b/src/ethernet-dialog.c
index a35ae61b..03ded50a 100644
--- a/src/ethernet-dialog.c
+++ b/src/ethernet-dialog.c
@@ -36,8 +36,8 @@ static void
 stuff_changed_cb (WirelessSecurity *sec, gpointer user_data)
 {
 	GtkWidget *button = GTK_WIDGET (user_data);
-	
-	gtk_widget_set_sensitive (button, wireless_security_validate (sec));
+
+	gtk_widget_set_sensitive (button, wireless_security_validate (sec, NULL));
 }
 
 static void
diff --git a/src/libnm-gtk/nm-wifi-dialog.c b/src/libnm-gtk/nm-wifi-dialog.c
index aef1bc32..396217ba 100644
--- a/src/libnm-gtk/nm-wifi-dialog.c
+++ b/src/libnm-gtk/nm-wifi-dialog.c
@@ -276,7 +276,7 @@ stuff_changed_cb (WirelessSecurity *sec, gpointer user_data)
 	GByteArray *ssid = NULL;
 	gboolean free_ssid = TRUE;
 	gboolean valid = FALSE;
-	
+
 	if (priv->connection) {
 		NMSettingWireless *s_wireless;
 		s_wireless = nm_connection_get_setting_wireless (priv->connection);
@@ -288,7 +288,7 @@ stuff_changed_cb (WirelessSecurity *sec, gpointer user_data)
 	}
 
 	if (ssid) {
-		valid = wireless_security_validate (sec);
+		valid = wireless_security_validate (sec, NULL);
 		if (free_ssid)
 			g_byte_array_free (ssid, TRUE);
 	}
@@ -328,7 +328,7 @@ ssid_entry_changed (GtkWidget *entry, gpointer user_data)
 		gtk_tree_model_get (model, &iter, S_SEC_COLUMN, &sec, -1);
 
 	if (sec) {
-		valid = wireless_security_validate (sec);
+		valid = wireless_security_validate (sec, NULL);
 		wireless_security_unref (sec);
 	} else {
 		valid = TRUE;
diff --git a/src/libnma/nma-wifi-dialog.c b/src/libnma/nma-wifi-dialog.c
index f760bedc..9b49fa16 100644
--- a/src/libnma/nma-wifi-dialog.c
+++ b/src/libnma/nma-wifi-dialog.c
@@ -248,7 +248,7 @@ validate_dialog_ssid (NMAWifiDialog *self)
 	widget = GTK_WIDGET (gtk_builder_get_object (priv->builder, "network_name_entry"));
 
 	ssid = gtk_entry_get_text (GTK_ENTRY (widget));
-	
+
 	if (!ssid || strlen (ssid) == 0 || strlen (ssid) > 32)
 		return NULL;
 
@@ -264,7 +264,7 @@ stuff_changed_cb (WirelessSecurity *sec, gpointer user_data)
 	GBytes *ssid = NULL;
 	gboolean free_ssid = TRUE;
 	gboolean valid = FALSE;
-	
+
 	if (priv->connection) {
 		NMSettingWireless *s_wireless;
 		s_wireless = nm_connection_get_setting_wireless (priv->connection);
@@ -276,7 +276,7 @@ stuff_changed_cb (WirelessSecurity *sec, gpointer user_data)
 	}
 
 	if (ssid) {
-		valid = wireless_security_validate (sec);
+		valid = wireless_security_validate (sec, NULL);
 		if (free_ssid)
 			g_bytes_unref (ssid);
 	}
@@ -316,7 +316,7 @@ ssid_entry_changed (GtkWidget *entry, gpointer user_data)
 		gtk_tree_model_get (model, &iter, S_SEC_COLUMN, &sec, -1);
 
 	if (sec) {
-		valid = wireless_security_validate (sec);
+		valid = wireless_security_validate (sec, NULL);
 		wireless_security_unref (sec);
 	} else {
 		valid = TRUE;
diff --git a/src/wireless-security/eap-method-fast.c b/src/wireless-security/eap-method-fast.c
index 1071e767..d9b0d8c8 100644
--- a/src/wireless-security/eap-method-fast.c
+++ b/src/wireless-security/eap-method-fast.c
@@ -28,6 +28,7 @@
 
 #include "eap-method.h"
 #include "wireless-security.h"
+#include "utils.h"
 
 #define I_NAME_COLUMN   0
 #define I_METHOD_COLUMN 1
@@ -50,7 +51,7 @@ destroy (EAPMethod *parent)
 }
 
 static gboolean
-validate (EAPMethod *parent)
+validate (EAPMethod *parent, GError **error)
 {
 	GtkWidget *widget;
 	GtkTreeModel *model;
@@ -66,8 +67,10 @@ validate (EAPMethod *parent)
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_fast_pac_file_button"));
 	g_assert (widget);
 	file = gtk_file_chooser_get_filename (GTK_FILE_CHOOSER (widget));
-	if (!provisioning && !file)
+	if (!provisioning && !file) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP-FAST PAC file"));
 		return FALSE;
+	}
 
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_fast_inner_auth_combo"));
 	g_assert (widget);
@@ -75,7 +78,7 @@ validate (EAPMethod *parent)
 	gtk_combo_box_get_active_iter (GTK_COMBO_BOX (widget), &iter);
 	gtk_tree_model_get (model, &iter, I_METHOD_COLUMN, &eap, -1);
 	g_assert (eap);
-	valid = eap_method_validate (eap);
+	valid = eap_method_validate (eap, error);
 	eap_method_unref (eap);
 	return valid;
 }
diff --git a/src/wireless-security/eap-method-leap.c b/src/wireless-security/eap-method-leap.c
index e8b12fd0..599f80fe 100644
--- a/src/wireless-security/eap-method-leap.c
+++ b/src/wireless-security/eap-method-leap.c
@@ -22,11 +22,13 @@
 
 #include <ctype.h>
 #include <string.h>
+#include <glib/gi18n.h>
 
 #include "eap-method.h"
 #include "wireless-security.h"
 #include "helpers.h"
 #include "nma-ui-utils.h"
+#include "utils.h"
 
 struct _EAPMethodLEAP {
 	EAPMethod parent;
@@ -50,18 +52,22 @@ show_toggled_cb (GtkToggleButton *button, EAPMethodLEAP *method)
 }
 
 static gboolean
-validate (EAPMethod *parent)
+validate (EAPMethod *parent, GError **error)
 {
 	EAPMethodLEAP *method = (EAPMethodLEAP *)parent;
 	const char *text;
 
 	text = gtk_entry_get_text (method->username_entry);
-	if (!text || !strlen (text))
+	if (!text || !strlen (text)) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP-LEAP username"));
 		return FALSE;
+	}
 
-	text = gtk_entry_get_text (method->password_entry);
+	text = gtk_entry_get_text (method->password_entry); {
 	if (!text || !strlen (text))
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP-LEAP password"));
 		return FALSE;
+	}
 
 	return TRUE;
 }
diff --git a/src/wireless-security/eap-method-peap.c b/src/wireless-security/eap-method-peap.c
index 623f854b..85416331 100644
--- a/src/wireless-security/eap-method-peap.c
+++ b/src/wireless-security/eap-method-peap.c
@@ -28,6 +28,7 @@
 
 #include "eap-method.h"
 #include "wireless-security.h"
+#include "utils.h"
 
 #define I_NAME_COLUMN   0
 #define I_METHOD_COLUMN 1
@@ -50,18 +51,24 @@ destroy (EAPMethod *parent)
 }
 
 static gboolean
-validate (EAPMethod *parent)
+validate (EAPMethod *parent, GError **error)
 {
 	GtkWidget *widget;
 	GtkTreeModel *model;
 	GtkTreeIter iter;
 	EAPMethod *eap = NULL;
 	gboolean valid = FALSE;
+	GError *local = NULL;
 
-	if (!eap_method_validate_filepicker (parent->builder, "eap_peap_ca_cert_button", TYPE_CA_CERT, NULL, NULL))
+	if (!eap_method_validate_filepicker (parent->builder, "eap_peap_ca_cert_button", TYPE_CA_CERT, NULL, NULL, &local)) {
+		g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-PEAP CA certificate: %s"), local->message);
+		g_clear_error (&local);
 		return FALSE;
-	if (eap_method_ca_cert_required (parent->builder, "eap_peap_ca_cert_not_required_checkbox", "eap_peap_ca_cert_button") )
+	}
+	if (eap_method_ca_cert_required (parent->builder, "eap_peap_ca_cert_not_required_checkbox", "eap_peap_ca_cert_button")) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-PEAP CA ertificate: no certificate specified"));
 		return FALSE;
+	}
 
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_peap_inner_auth_combo"));
 	g_assert (widget);
@@ -70,7 +77,7 @@ validate (EAPMethod *parent)
 	gtk_combo_box_get_active_iter (GTK_COMBO_BOX (widget), &iter);
 	gtk_tree_model_get (model, &iter, I_METHOD_COLUMN, &eap, -1);
 	g_assert (eap);
-	valid = eap_method_validate (eap);
+	valid = eap_method_validate (eap, error);
 	eap_method_unref (eap);
 	return valid;
 }
diff --git a/src/wireless-security/eap-method-simple.c b/src/wireless-security/eap-method-simple.c
index 05679d74..b13062f5 100644
--- a/src/wireless-security/eap-method-simple.c
+++ b/src/wireless-security/eap-method-simple.c
@@ -22,11 +22,13 @@
 
 #include <ctype.h>
 #include <string.h>
+#include <glib/gi18n.h>
 
 #include "eap-method.h"
 #include "wireless-security.h"
 #include "helpers.h"
 #include "nma-ui-utils.h"
+#include "utils.h"
 
 struct _EAPMethodSimple {
 	EAPMethod parent;
@@ -59,22 +61,26 @@ always_ask_selected (GtkEntry *passwd_entry)
 }
 
 static gboolean
-validate (EAPMethod *parent)
+validate (EAPMethod *parent, GError **error)
 {
 	EAPMethodSimple *method = (EAPMethodSimple *)parent;
 	const char *text;
 
 	text = gtk_entry_get_text (method->username_entry);
-	if (!text || !strlen (text))
+	if (!text || !strlen (text)) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP username"));
 		return FALSE;
+	}
 
 	/* Check if the password should always be requested */
 	if (always_ask_selected (method->password_entry))
 		return TRUE;
 
 	text = gtk_entry_get_text (method->password_entry);
-	if (!text || !strlen (text))
+	if (!text || !strlen (text)) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP password"));
 		return FALSE;
+	}
 
 	return TRUE;
 }
diff --git a/src/wireless-security/eap-method-tls.c b/src/wireless-security/eap-method-tls.c
index 723c2de8..b778f85e 100644
--- a/src/wireless-security/eap-method-tls.c
+++ b/src/wireless-security/eap-method-tls.c
@@ -30,6 +30,7 @@
 #include "wireless-security.h"
 #include "helpers.h"
 #include "nma-ui-utils.h"
+#include "utils.h"
 
 struct _EAPMethodTLS {
 	EAPMethod parent;
@@ -52,40 +53,56 @@ show_toggled_cb (GtkCheckButton *button, EAPMethod *method)
 }
 
 static gboolean
-validate (EAPMethod *parent)
+validate (EAPMethod *parent, GError **error)
 {
 	NMSetting8021xCKFormat format = NM_SETTING_802_1X_CK_FORMAT_UNKNOWN;
 	GtkWidget *widget;
 	const char *password, *identity;
+	GError *local = NULL;
 
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_tls_identity_entry"));
 	g_assert (widget);
 	identity = gtk_entry_get_text (GTK_ENTRY (widget));
-	if (!identity || !strlen (identity))
+	if (!identity || !strlen (identity)) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP-TLS identity"));
 		return FALSE;
+	}
 
-	if (!eap_method_validate_filepicker (parent->builder, "eap_tls_ca_cert_button", TYPE_CA_CERT, NULL, NULL))
+	if (!eap_method_validate_filepicker (parent->builder, "eap_tls_ca_cert_button", TYPE_CA_CERT, NULL, NULL, &local)) {
+		g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-TLS CA certificate: %s"), local->message);
+		g_clear_error (&local);
 		return FALSE;
-	if (eap_method_ca_cert_required (parent->builder, "eap_tls_ca_cert_not_required_checkbox", "eap_tls_ca_cert_button") )
+	}
+	if (eap_method_ca_cert_required (parent->builder, "eap_tls_ca_cert_not_required_checkbox", "eap_tls_ca_cert_button")) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-TLS CA certificate: no certificate specified"));
 		return FALSE;
-
+	}
 
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_tls_private_key_password_entry"));
 	g_assert (widget);
 	password = gtk_entry_get_text (GTK_ENTRY (widget));
-	if (!password || !strlen (password))
+	if (!password || !strlen (password)) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-TLS password: missing"));
 		return FALSE;
+	}
 
 	if (!eap_method_validate_filepicker (parent->builder,
 	                                     "eap_tls_private_key_button",
 	                                     TYPE_PRIVATE_KEY,
 	                                     password,
-	                                     &format))
+	                                     &format,
+	                                     &local)) {
+		g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-TLS private-key: %s"), local->message);
+		g_clear_error (&local);
 		return FALSE;
+	}
 
 	if (format != NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
-		if (!eap_method_validate_filepicker (parent->builder, "eap_tls_user_cert_button", TYPE_CLIENT_CERT, NULL, NULL))
+		if (!eap_method_validate_filepicker (parent->builder, "eap_tls_user_cert_button", TYPE_CLIENT_CERT, NULL, NULL, &local)) {
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-TLS user-certificate: %s"), local->message);
+			g_clear_error (&local);
 			return FALSE;
+		}
 	}
 
 	return TRUE;
diff --git a/src/wireless-security/eap-method-ttls.c b/src/wireless-security/eap-method-ttls.c
index d0043730..9a76f78c 100644
--- a/src/wireless-security/eap-method-ttls.c
+++ b/src/wireless-security/eap-method-ttls.c
@@ -28,6 +28,7 @@
 
 #include "eap-method.h"
 #include "wireless-security.h"
+#include "utils.h"
 
 #define I_NAME_COLUMN   0
 #define I_METHOD_COLUMN 1
@@ -50,18 +51,24 @@ destroy (EAPMethod *parent)
 }
 
 static gboolean
-validate (EAPMethod *parent)
+validate (EAPMethod *parent, GError **error)
 {
 	GtkWidget *widget;
 	GtkTreeModel *model;
 	GtkTreeIter iter;
 	EAPMethod *eap = NULL;
 	gboolean valid = FALSE;
+	GError *local = NULL;
 
-	if (!eap_method_validate_filepicker (parent->builder, "eap_ttls_ca_cert_button", TYPE_CA_CERT, NULL, NULL))
+	if (!eap_method_validate_filepicker (parent->builder, "eap_ttls_ca_cert_button", TYPE_CA_CERT, NULL, NULL, &local)) {
+		g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-TTLS CA certificate: %s"), local->message);
+		g_clear_error (&local);
 		return FALSE;
-	if (eap_method_ca_cert_required (parent->builder, "eap_ttls_ca_cert_not_required_checkbox", "eap_ttls_ca_cert_button") )
+	}
+	if (eap_method_ca_cert_required (parent->builder, "eap_ttls_ca_cert_not_required_checkbox", "eap_ttls_ca_cert_button")) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid EAP-TTLS CA certificate: no certificate specified"));
 		return FALSE;
+	}
 
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_ttls_inner_auth_combo"));
 	g_assert (widget);
@@ -70,7 +77,7 @@ validate (EAPMethod *parent)
 	gtk_combo_box_get_active_iter (GTK_COMBO_BOX (widget), &iter);
 	gtk_tree_model_get (model, &iter, I_METHOD_COLUMN, &eap, -1);
 	g_assert (eap);
-	valid = eap_method_validate (eap);
+	valid = eap_method_validate (eap, error);
 	eap_method_unref (eap);
 	return valid;
 }
diff --git a/src/wireless-security/eap-method.c b/src/wireless-security/eap-method.c
index 2218353c..978e0deb 100644
--- a/src/wireless-security/eap-method.c
+++ b/src/wireless-security/eap-method.c
@@ -34,6 +34,7 @@
 
 #include "eap-method.h"
 #include "nm-utils.h"
+#include "utils.h"
 
 G_DEFINE_BOXED_TYPE (EAPMethod, eap_method, eap_method_ref, eap_method_unref)
 
@@ -46,12 +47,17 @@ eap_method_get_widget (EAPMethod *method)
 }
 
 gboolean
-eap_method_validate (EAPMethod *method)
+eap_method_validate (EAPMethod *method, GError **error)
 {
+	gboolean result;
+
 	g_return_val_if_fail (method != NULL, FALSE);
 
 	g_assert (method->validate);
-	return (*(method->validate)) (method);
+	result = (*(method->validate)) (method, error);
+	if (!result && error && !*error)
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("undefined error in 802.1x security (wpa-eap)"));
+	return result;
 }
 
 void
@@ -207,13 +213,13 @@ eap_method_validate_filepicker (GtkBuilder *builder,
                                 const char *name,
                                 guint32 item_type,
                                 const char *password,
-                                NMSetting8021xCKFormat *out_format)
+                                NMSetting8021xCKFormat *out_format,
+                                GError **error)
 {
 	GtkWidget *widget;
 	char *filename;
 	NMSetting8021x *setting;
 	gboolean success = FALSE;
-	GError *error = NULL;
 
 	if (item_type == TYPE_PRIVATE_KEY) {
 		g_return_val_if_fail (password != NULL, FALSE);
@@ -232,25 +238,13 @@ eap_method_validate_filepicker (GtkBuilder *builder,
 	setting = (NMSetting8021x *) nm_setting_802_1x_new ();
 
 	if (item_type == TYPE_PRIVATE_KEY) {
-		if (!nm_setting_802_1x_set_private_key (setting, filename, password, NM_SETTING_802_1X_CK_SCHEME_PATH, out_format, &error)) {
-			g_warning ("Error: couldn't verify private key: %d %s",
-			           error ? error->code : -1, error ? error->message : "(none)");
-			g_clear_error (&error);
-		} else
+		if (nm_setting_802_1x_set_private_key (setting, filename, password, NM_SETTING_802_1X_CK_SCHEME_PATH, out_format, error))
 			success = TRUE;
 	} else if (item_type == TYPE_CLIENT_CERT) {
-		if (!nm_setting_802_1x_set_client_cert (setting, filename, NM_SETTING_802_1X_CK_SCHEME_PATH, out_format, &error)) {
-			g_warning ("Error: couldn't verify client certificate: %d %s",
-			           error ? error->code : -1, error ? error->message : "(none)");
-			g_clear_error (&error);
-		} else
+		if (nm_setting_802_1x_set_client_cert (setting, filename, NM_SETTING_802_1X_CK_SCHEME_PATH, out_format, error))
 			success = TRUE;
 	} else if (item_type == TYPE_CA_CERT) {
-		if (!nm_setting_802_1x_set_ca_cert (setting, filename, NM_SETTING_802_1X_CK_SCHEME_PATH, out_format, &error)) {
-			g_warning ("Error: couldn't verify CA certificate: %d %s",
-			           error ? error->code : -1, error ? error->message : "(none)");
-			g_clear_error (&error);
-		} else
+		if (nm_setting_802_1x_set_ca_cert (setting, filename, NM_SETTING_802_1X_CK_SCHEME_PATH, out_format, error))
 			success = TRUE;
 	} else
 		g_warning ("%s: invalid item type %d.", __func__, item_type);
@@ -259,6 +253,9 @@ eap_method_validate_filepicker (GtkBuilder *builder,
 
 out:
 	g_free (filename);
+
+	if (!success && error && !*error)
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("unspecified error validating eap-method file"));
 	return success;
 }
 
diff --git a/src/wireless-security/eap-method.h b/src/wireless-security/eap-method.h
index e2ceb0a9..84c1c788 100644
--- a/src/wireless-security/eap-method.h
+++ b/src/wireless-security/eap-method.h
@@ -41,7 +41,7 @@ typedef void        (*EMAddToSizeGroupFunc) (EAPMethod *method, GtkSizeGroup *gr
 typedef void        (*EMFillConnectionFunc) (EAPMethod *method, NMConnection *connection, NMSettingSecretFlags flags);
 typedef void        (*EMUpdateSecretsFunc)  (EAPMethod *method, NMConnection *connection);
 typedef void        (*EMDestroyFunc)        (EAPMethod *method);
-typedef gboolean    (*EMValidateFunc)       (EAPMethod *method);
+typedef gboolean    (*EMValidateFunc)       (EAPMethod *method, GError **error);
 
 struct _EAPMethod {
 	guint32 refcount;
@@ -68,7 +68,7 @@ struct _EAPMethod {
 
 GtkWidget *eap_method_get_widget (EAPMethod *method);
 
-gboolean eap_method_validate (EAPMethod *method);
+gboolean eap_method_validate (EAPMethod *method, GError **error);
 
 void eap_method_add_to_size_group (EAPMethod *method, GtkSizeGroup *group);
 
@@ -116,7 +116,8 @@ gboolean eap_method_validate_filepicker (GtkBuilder *builder,
                                          const char *name,
                                          guint32 item_type,
                                          const char *password,
-                                         NMSetting8021xCKFormat *out_format);
+                                         NMSetting8021xCKFormat *out_format,
+                                         GError **error);
 
 void eap_method_phase2_update_secrets_helper (EAPMethod *method,
                                               NMConnection *connection,
diff --git a/src/wireless-security/wireless-security.c b/src/wireless-security/wireless-security.c
index 12fee1eb..8c4e798f 100644
--- a/src/wireless-security/wireless-security.c
+++ b/src/wireless-security/wireless-security.c
@@ -30,6 +30,7 @@
 
 #include "wireless-security.h"
 #include "eap-method.h"
+#include "utils.h"
 
 G_DEFINE_BOXED_TYPE (WirelessSecurity, wireless_security, wireless_security_ref, wireless_security_unref)
 
@@ -62,12 +63,18 @@ wireless_security_changed_cb (GtkWidget *ignored, gpointer user_data)
 }
 
 gboolean
-wireless_security_validate (WirelessSecurity *sec)
+wireless_security_validate (WirelessSecurity *sec, GError **error)
 {
+	gboolean result;
+
 	g_return_val_if_fail (sec != NULL, FALSE);
+	g_return_val_if_fail (!error || !*error, FALSE);
 
 	g_assert (sec->validate);
-	return (*(sec->validate)) (sec);
+	result = (*(sec->validate)) (sec, error);
+	if (!result && error && !error)
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("Unknown error validating 802.1x security"));
+	return result;
 }
 
 void
@@ -287,7 +294,7 @@ ws_802_1x_add_to_size_group (WirelessSecurity *sec,
 }
 
 gboolean
-ws_802_1x_validate (WirelessSecurity *sec, const char *combo_name)
+ws_802_1x_validate (WirelessSecurity *sec, const char *combo_name, GError **error)
 {
 	GtkWidget *widget;
 	GtkTreeModel *model;
@@ -302,7 +309,7 @@ ws_802_1x_validate (WirelessSecurity *sec, const char *combo_name)
 	gtk_combo_box_get_active_iter (GTK_COMBO_BOX (widget), &iter);
 	gtk_tree_model_get (model, &iter, AUTH_METHOD_COLUMN, &eap, -1);
 	g_assert (eap);
-	valid = eap_method_validate (eap);
+	valid = eap_method_validate (eap, error);
 	eap_method_unref (eap);
 	return valid;
 }
diff --git a/src/wireless-security/wireless-security.h b/src/wireless-security/wireless-security.h
index 93a53a33..2cd845e4 100644
--- a/src/wireless-security/wireless-security.h
+++ b/src/wireless-security/wireless-security.h
@@ -42,7 +42,7 @@ typedef void (*WSAddToSizeGroupFunc) (WirelessSecurity *sec, GtkSizeGroup *group
 typedef void (*WSFillConnectionFunc) (WirelessSecurity *sec, NMConnection *connection);
 typedef void (*WSUpdateSecretsFunc)  (WirelessSecurity *sec, NMConnection *connection);
 typedef void (*WSDestroyFunc)        (WirelessSecurity *sec);
-typedef gboolean (*WSValidateFunc)   (WirelessSecurity *sec);
+typedef gboolean (*WSValidateFunc)   (WirelessSecurity *sec, GError **error);
 typedef GtkWidget * (*WSNagUserFunc) (WirelessSecurity *sec);
 
 struct _WirelessSecurity {
@@ -74,7 +74,7 @@ void wireless_security_set_changed_notify (WirelessSecurity *sec,
                                            WSChangedFunc func,
                                            gpointer user_data);
 
-gboolean wireless_security_validate (WirelessSecurity *sec);
+gboolean wireless_security_validate (WirelessSecurity *sec, GError **error);
 
 void wireless_security_add_to_size_group (WirelessSecurity *sec,
                                           GtkSizeGroup *group);
@@ -139,7 +139,7 @@ void ws_802_1x_auth_combo_changed (GtkWidget *combo,
                                    const char *vbox_name,
                                    GtkSizeGroup *size_group);
 
-gboolean ws_802_1x_validate (WirelessSecurity *sec, const char *combo_name);
+gboolean ws_802_1x_validate (WirelessSecurity *sec, const char *combo_name, GError **error);
 
 void ws_802_1x_add_to_size_group (WirelessSecurity *sec,
                                   GtkSizeGroup *size_group,
diff --git a/src/wireless-security/ws-dynamic-wep.c b/src/wireless-security/ws-dynamic-wep.c
index a450edbb..a5431adc 100644
--- a/src/wireless-security/ws-dynamic-wep.c
+++ b/src/wireless-security/ws-dynamic-wep.c
@@ -43,9 +43,9 @@ destroy (WirelessSecurity *parent)
 }
 
 static gboolean
-validate (WirelessSecurity *parent)
+validate (WirelessSecurity *parent, GError **error)
 {
-	return ws_802_1x_validate (parent, "dynamic_wep_auth_combo");
+	return ws_802_1x_validate (parent, "dynamic_wep_auth_combo", error);
 }
 
 static void
diff --git a/src/wireless-security/ws-leap.c b/src/wireless-security/ws-leap.c
index 194571b3..b247e31b 100644
--- a/src/wireless-security/ws-leap.c
+++ b/src/wireless-security/ws-leap.c
@@ -21,10 +21,12 @@
  */
 
 #include <string.h>
+#include <glib/gi18n.h>
 
 #include "wireless-security.h"
 #include "helpers.h"
 #include "nma-ui-utils.h"
+#include "utils.h"
 
 struct _WirelessSecurityLEAP {
 	WirelessSecurity parent;
@@ -46,7 +48,7 @@ show_toggled_cb (GtkCheckButton *button, WirelessSecurity *sec)
 }
 
 static gboolean
-validate (WirelessSecurity *parent)
+validate (WirelessSecurity *parent, GError **error)
 {
 	GtkWidget *entry;
 	const char *text;
@@ -54,14 +56,18 @@ validate (WirelessSecurity *parent)
 	entry = GTK_WIDGET (gtk_builder_get_object (parent->builder, "leap_username_entry"));
 	g_assert (entry);
 	text = gtk_entry_get_text (GTK_ENTRY (entry));
-	if (!text || !strlen (text))
+	if (!text || !strlen (text)) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing leap-username"));
 		return FALSE;
+	}
 
 	entry = GTK_WIDGET (gtk_builder_get_object (parent->builder, "leap_password_entry"));
 	g_assert (entry);
 	text = gtk_entry_get_text (GTK_ENTRY (entry));
-	if (!text || !strlen (text))
+	if (!text || !strlen (text)) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing leap-password"));
 		return FALSE;
+	}
 
 	return TRUE;
 }
diff --git a/src/wireless-security/ws-wep-key.c b/src/wireless-security/ws-wep-key.c
index 57021ca6..14db35ef 100644
--- a/src/wireless-security/ws-wep-key.c
+++ b/src/wireless-security/ws-wep-key.c
@@ -22,6 +22,7 @@
 
 #include <string.h>
 #include <glib.h>
+#include <glib/gi18n.h>
 
 #include "wireless-security.h"
 #include "utils.h"
@@ -89,7 +90,7 @@ destroy (WirelessSecurity *parent)
 }
 
 static gboolean
-validate (WirelessSecurity *parent)
+validate (WirelessSecurity *parent, GError **error)
 {
 	WirelessSecurityWEPKey *sec = (WirelessSecurityWEPKey *) parent;
 	GtkWidget *entry;
@@ -100,26 +101,38 @@ validate (WirelessSecurity *parent)
 	g_assert (entry);
 
 	key = gtk_entry_get_text (GTK_ENTRY (entry));
-	if (!key)
+	if (!key) {
+		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing wep-key"));
 		return FALSE;
+	}
 
 	if (sec->type == NM_WEP_KEY_TYPE_KEY) {
 		if ((strlen (key) == 10) || (strlen (key) == 26)) {
 			for (i = 0; i < strlen (key); i++) {
-				if (!g_ascii_isxdigit (key[i]))
+				if (!g_ascii_isxdigit (key[i])) {
+					g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid wep-key: key with a length of %zu must contain only hex-digits"), strlen (key));
 					return FALSE;
+				}
 			}
 		} else if ((strlen (key) == 5) || (strlen (key) == 13)) {
 			for (i = 0; i < strlen (key); i++) {
-				if (!utils_char_is_ascii_print (key[i]))
+				if (!utils_char_is_ascii_print (key[i])) {
+					g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid wep-key: key with a length of %zu must contain only ascii characters"), strlen (key));
 					return FALSE;
+				}
 			}
 		} else {
+			g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid wep-key: wrong key length %zu. A key must be either of length 5/13 (ascii) or 10/26 (hex)"), strlen (key));
 			return FALSE;
 		}
 	} else if (sec->type == NM_WEP_KEY_TYPE_PASSPHRASE) {
-		if (!strlen (key) || (strlen (key) > 64))
+		if (!*key || (strlen (key) > 64)) {
+			if (!*key)
+				g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid wep-key: passphrase must be non-empty"));
+			else
+				g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid wep-key: passphrase must be shorter then 64 characters"));
 			return FALSE;
+		}
 	}
 
 	return TRUE;
diff --git a/src/wireless-security/ws-wpa-eap.c b/src/wireless-security/ws-wpa-eap.c
index 3f888082..273479f3 100644
--- a/src/wireless-security/ws-wpa-eap.c
+++ b/src/wireless-security/ws-wpa-eap.c
@@ -44,9 +44,9 @@ destroy (WirelessSecurity *parent)
 }
 
 static gboolean
-validate (WirelessSecurity *parent)
+validate (WirelessSecurity *parent, GError **error)
 {
-	return ws_802_1x_validate (parent, "wpa_eap_auth_combo");
+	return ws_802_1x_validate (parent, "wpa_eap_auth_combo", error);
 }
 
 static void
diff --git a/src/wireless-security/ws-wpa-psk.c b/src/wireless-security/ws-wpa-psk.c
index aed1f6ef..11a2752d 100644
--- a/src/wireless-security/ws-wpa-psk.c
+++ b/src/wireless-security/ws-wpa-psk.c
@@ -22,10 +22,12 @@
 
 #include <ctype.h>
 #include <string.h>
+#include <glib/gi18n.h>
 
 #include "wireless-security.h"
 #include "helpers.h"
 #include "nma-ui-utils.h"
+#include "utils.h"
 
 #define WPA_PMK_LEN 32
 
@@ -50,26 +52,30 @@ show_toggled_cb (GtkCheckButton *button, WirelessSecurity *sec)
 }
 
 static gboolean
-validate (WirelessSecurity *parent)
+validate (WirelessSecurity *parent, GError **error)
 {
 	GtkWidget *entry;
 	const char *key;
-	guint32 len;
+	gsize len;
 	int i;
 
 	entry = GTK_WIDGET (gtk_builder_get_object (parent->builder, "wpa_psk_entry"));
 	g_assert (entry);
 
 	key = gtk_entry_get_text (GTK_ENTRY (entry));
-	len = strlen (key);
-	if ((len < 8) || (len > 64))
+	len = key ? strlen (key) : 0;
+	if ((len < 8) || (len > 64)) {
+		g_set_error (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid wpa-psk: invalid key-length %zu. Must be [8,63] bytes or 64 hex digits"), len);
 		return FALSE;
+	}
 
 	if (len == 64) {
 		/* Hex PSK */
 		for (i = 0; i < len; i++) {
-			if (!isxdigit (key[i]))
+			if (!isxdigit (key[i])) {
+				g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("invalid wpa-psk: cannot interpret key with 64 bytes as hex"));
 				return FALSE;
+			}
 		}
 	}