Merge tag 'debian/1.40.8-1' into debian/bullseye-backports

network-manager Debian release 1.40.8-1

30 files changed, 124 insertions, 77 deletions

diff --git a/src/core/devices/nm-device-bond.c b/src/core/devices/nm-device-bond.c
index 3e083de4..10765b60 100644
--- a/src/core/devices/nm-device-bond.c
+++ b/src/core/devices/nm-device-bond.c
@@ -492,7 +492,7 @@ act_stage1_prepare(NMDevice *device, NMDeviceStateReason *out_failure_reason)
     /* This is a workaround because netlink do not support ifname as primary */
     set_bond_attr_or_default(device, s_bond, NM_SETTING_BOND_OPTION_PRIMARY);
 
-    nm_device_bring_up(device, TRUE, NULL);
+    nm_device_bring_up(device);
 
     return ret;
 }
@@ -540,7 +540,7 @@ attach_port(NMDevice                  *device,
         success = nm_platform_link_enslave(nm_device_get_platform(device),
                                            nm_device_get_ip_ifindex(device),
                                            nm_device_get_ip_ifindex(port));
-        nm_device_bring_up(port, TRUE, NULL);
+        nm_device_bring_up(port);
 
         if (!success) {
             _LOGI(LOGD_BOND, "attaching bond port %s: failed", nm_device_get_ip_iface(port));
@@ -613,7 +613,7 @@ detach_port(NMDevice *device, NMDevice *port, gboolean configure)
          * other state is noticed by the now-released slave.
          */
         if (ifindex_slave > 0) {
-            if (!nm_device_bring_up(port, TRUE, NULL))
+            if (!nm_device_bring_up(port))
                 _LOGW(LOGD_BOND, "detached bond port could not be brought up.");
         }
     } else {
diff --git a/src/core/devices/nm-device-infiniband.c b/src/core/devices/nm-device-infiniband.c
index aef61222..6b6aef86 100644
--- a/src/core/devices/nm-device-infiniband.c
+++ b/src/core/devices/nm-device-infiniband.c
@@ -89,7 +89,7 @@ act_stage1_prepare(NMDevice *device, NMDeviceStateReason *out_failure_reason)
     ok = nm_platform_sysctl_set(nm_device_get_platform(device),
                                 NMP_SYSCTL_PATHID_NETDIR(dirfd, ifname_verified, "mode"),
                                 transport_mode);
-    nm_device_bring_up(device, TRUE, NULL);
+    nm_device_bring_up(device);
 
     if (!ok) {
         NM_SET_OUT(out_failure_reason, NM_DEVICE_STATE_REASON_CONFIG_FAILED);
diff --git a/src/core/devices/nm-device-macsec.c b/src/core/devices/nm-device-macsec.c
index 5cc0b8da..5b1f5fdc 100644
--- a/src/core/devices/nm-device-macsec.c
+++ b/src/core/devices/nm-device-macsec.c
@@ -187,8 +187,7 @@ update_properties(NMDevice *device)
 
     g_object_freeze_notify((GObject *) device);
 
-    if (priv->props.parent_ifindex != props->parent_ifindex)
-        nm_device_parent_set_ifindex(device, props->parent_ifindex);
+    nm_device_parent_set_ifindex(device, plink->parent);
 
 #define CHECK_PROPERTY_CHANGED(field, prop)      \
     G_STMT_START                                 \
@@ -402,7 +401,7 @@ supplicant_iface_state_is_completed(NMDeviceMacsec *self, NMSupplicantInterfaceS
         nm_clear_g_source(&priv->supplicant.lnk_timeout_id);
         nm_clear_g_source(&priv->supplicant.con_timeout_id);
 
-        nm_device_bring_up(NM_DEVICE(self), TRUE, NULL);
+        nm_device_bring_up(NM_DEVICE(self));
 
         /* If this is the initial association during device activation,
          * schedule the next activation stage.
diff --git a/src/core/devices/nm-device-private.h b/src/core/devices/nm-device-private.h
index 31424d5c..c597e052 100644
--- a/src/core/devices/nm-device-private.h
+++ b/src/core/devices/nm-device-private.h
@@ -37,7 +37,11 @@ gboolean nm_device_set_ip_ifindex(NMDevice *self, int ifindex);
 
 gboolean nm_device_set_ip_iface(NMDevice *self, const char *iface);
 
-gboolean nm_device_bring_up(NMDevice *self, gboolean wait, gboolean *no_firmware);
+gboolean nm_device_bring_up(NMDevice *self);
+gboolean nm_device_bring_up_full(NMDevice *self,
+                                 gboolean  block,
+                                 gboolean  update_carrier,
+                                 gboolean *no_firmware);
 
 void nm_device_take_down(NMDevice *self, gboolean block);
 
diff --git a/src/core/devices/nm-device-vrf.c b/src/core/devices/nm-device-vrf.c
index 2aef0e3d..91eb195a 100644
--- a/src/core/devices/nm-device-vrf.c
+++ b/src/core/devices/nm-device-vrf.c
@@ -226,7 +226,7 @@ attach_port(NMDevice                  *device,
         success = nm_platform_link_enslave(nm_device_get_platform(device),
                                            nm_device_get_ip_ifindex(device),
                                            nm_device_get_ip_ifindex(port));
-        nm_device_bring_up(port, TRUE, NULL);
+        nm_device_bring_up(port);
 
         if (!success)
             return FALSE;
diff --git a/src/core/devices/nm-device-wpan.c b/src/core/devices/nm-device-wpan.c
index f7b712ea..ecb5ee23 100644
--- a/src/core/devices/nm-device-wpan.c
+++ b/src/core/devices/nm-device-wpan.c
@@ -176,10 +176,10 @@ act_stage1_prepare(NMDevice *device, NMDeviceStateReason *out_failure_reason)
     ret = NM_ACT_STAGE_RETURN_SUCCESS;
 
 out:
-    nm_device_bring_up(device, TRUE, NULL);
+    nm_device_bring_up(device);
 
     if (lowpan_device)
-        nm_device_bring_up(lowpan_device, TRUE, NULL);
+        nm_device_bring_up(lowpan_device);
 
     return ret;
 }
diff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c
index 2cda9b0d..059e31f2 100644
--- a/src/core/devices/nm-device.c
+++ b/src/core/devices/nm-device.c
@@ -4838,6 +4838,7 @@ get_ip_iface_identifier(NMDevice *self, NMUtilsIPv6IfaceId *out_iid)
     NMDevicePrivate      *priv     = NM_DEVICE_GET_PRIVATE(self);
     NMPlatform           *platform = nm_device_get_platform(self);
     const NMPlatformLink *pllink;
+    NMLinkType            link_type;
     const guint8         *hwaddr;
     guint8                pseudo_hwaddr[ETH_ALEN];
     gsize                 hwaddr_len;
@@ -4856,6 +4857,8 @@ get_ip_iface_identifier(NMDevice *self, NMUtilsIPv6IfaceId *out_iid)
     if (hwaddr_len <= 0)
         return FALSE;
 
+    link_type = pllink->type;
+
     if (pllink->type == NM_LINK_TYPE_6LOWPAN) {
         /* If the underlying IEEE 802.15.4 device has a short address we generate
          * a "pseudo 48-bit address" that's to be used in the same fashion as a
@@ -4876,10 +4879,11 @@ get_ip_iface_identifier(NMDevice *self, NMUtilsIPv6IfaceId *out_iid)
 
             hwaddr     = pseudo_hwaddr;
             hwaddr_len = G_N_ELEMENTS(pseudo_hwaddr);
+            link_type  = NM_LINK_TYPE_ETHERNET;
         }
     }
 
-    success = nm_utils_get_ipv6_interface_identifier(pllink->type,
+    success = nm_utils_get_ipv6_interface_identifier(link_type,
                                                      hwaddr,
                                                      hwaddr_len,
                                                      priv->dev_id,
@@ -6828,7 +6832,7 @@ device_link_changed(gpointer user_data)
          * bring it up probably has failed because of the
          * invalid hardware address; try again.
          */
-        nm_device_bring_up(self, TRUE, NULL);
+        nm_device_bring_up(self);
         nm_device_queue_recheck_available(self,
                                           NM_DEVICE_STATE_REASON_NONE,
                                           NM_DEVICE_STATE_REASON_NONE);
@@ -9719,7 +9723,7 @@ activate_stage2_device_config(NMDevice *self)
     _routing_rules_sync(self, NM_TERNARY_TRUE);
 
     if (!nm_device_sys_iface_state_is_external_or_assume(self)) {
-        if (!nm_device_bring_up(self, FALSE, &no_firmware)) {
+        if (!nm_device_bring_up_full(self, FALSE, TRUE, &no_firmware)) {
             nm_device_state_changed(self,
                                     NM_DEVICE_STATE_FAILED,
                                     no_firmware ? NM_DEVICE_STATE_REASON_FIRMWARE_MISSING
@@ -13994,7 +13998,10 @@ carrier_detect_wait(NMDevice *self)
 }
 
 gboolean
-nm_device_bring_up(NMDevice *self, gboolean block, gboolean *no_firmware)
+nm_device_bring_up_full(NMDevice *self,
+                        gboolean  block,
+                        gboolean  update_carrier,
+                        gboolean *no_firmware)
 {
     gboolean             device_is_up = FALSE;
     NMDeviceCapabilities capabilities;
@@ -14021,8 +14028,8 @@ nm_device_bring_up(NMDevice *self, gboolean block, gboolean *no_firmware)
             return FALSE;
     }
 
-    /* Store carrier immediately. */
-    nm_device_set_carrier_from_platform(self);
+    if (update_carrier)
+        nm_device_set_carrier_from_platform(self);
 
     device_is_up = nm_device_is_up(self);
     if (block && !device_is_up) {
@@ -14061,6 +14068,12 @@ nm_device_bring_up(NMDevice *self, gboolean block, gboolean *no_firmware)
     return TRUE;
 }
 
+gboolean
+nm_device_bring_up(NMDevice *self)
+{
+    return nm_device_bring_up_full(self, TRUE, TRUE, NULL);
+}
+
 void
 nm_device_take_down(NMDevice *self, gboolean block)
 {
@@ -15814,7 +15827,7 @@ _set_state_full(NMDevice *self, NMDeviceState state, NMDeviceStateReason reason,
 
         if (priv->sys_iface_state == NM_DEVICE_SYS_IFACE_STATE_MANAGED) {
             if (old_state == NM_DEVICE_STATE_UNMANAGED || priv->firmware_missing) {
-                if (!nm_device_bring_up(self, TRUE, &no_firmware) && no_firmware)
+                if (!nm_device_bring_up_full(self, TRUE, FALSE, &no_firmware) && no_firmware)
                     _LOGW(LOGD_PLATFORM, "firmware may be missing.");
                 nm_device_set_firmware_missing(self, no_firmware ? TRUE : FALSE);
             }
@@ -16574,7 +16587,7 @@ handle_fail:
     }
 
     if (was_taken_down) {
-        if (!nm_device_bring_up(self, TRUE, NULL))
+        if (!nm_device_bring_up(self))
             return FALSE;
     }
 
@@ -17832,7 +17845,7 @@ dispose(GObject *object)
         priv->sriov.next = NULL;
     }
 
-    g_clear_object(&priv->l3cfg);
+    g_clear_object(&priv->l3cfg_);
     g_clear_object(&priv->l3ipdata_4.ip_config);
     g_clear_object(&priv->l3ipdata_6.ip_config);
 
diff --git a/src/core/devices/ovs/nm-device-ovs-interface.c b/src/core/devices/ovs/nm-device-ovs-interface.c
index 1f531a6f..711f65cb 100644
--- a/src/core/devices/ovs/nm-device-ovs-interface.c
+++ b/src/core/devices/ovs/nm-device-ovs-interface.c
@@ -132,7 +132,7 @@ link_changed(NMDevice *device, const NMPlatformLink *pllink)
             nm_device_devip_set_failed(device, AF_INET6, NM_DEVICE_STATE_REASON_CONFIG_FAILED);
             return;
         }
-        nm_device_bring_up(device, TRUE, NULL);
+        nm_device_bring_up(device);
 
         nm_device_devip_set_state(device, AF_INET, NM_DEVICE_IP_STATE_PENDING, NULL);
         nm_device_devip_set_state(device, AF_INET6, NM_DEVICE_IP_STATE_PENDING, NULL);
diff --git a/src/core/devices/team/nm-device-team.c b/src/core/devices/team/nm-device-team.c
index 4e073ddf..9eca008a 100644
--- a/src/core/devices/team/nm-device-team.c
+++ b/src/core/devices/team/nm-device-team.c
@@ -884,7 +884,7 @@ attach_port(NMDevice                  *device,
         success = nm_platform_link_enslave(nm_device_get_platform(device),
                                            nm_device_get_ip_ifindex(device),
                                            nm_device_get_ip_ifindex(port));
-        nm_device_bring_up(port, TRUE, NULL);
+        nm_device_bring_up(port);
 
         if (!success)
             return FALSE;
@@ -934,7 +934,7 @@ detach_port(NMDevice *device, NMDevice *port, gboolean configure)
          * IFF_UP), so we must bring it back up here to ensure carrier changes and
          * other state is noticed by the now-released port.
          */
-        if (!nm_device_bring_up(port, TRUE, NULL)) {
+        if (!nm_device_bring_up(port)) {
             _LOGW(LOGD_TEAM, "detached team port %s could not be brought up", port_iface);
         }
 
diff --git a/src/core/devices/wifi/nm-device-olpc-mesh.c b/src/core/devices/wifi/nm-device-olpc-mesh.c
index fd851ebc..4705f75c 100644
--- a/src/core/devices/wifi/nm-device-olpc-mesh.c
+++ b/src/core/devices/wifi/nm-device-olpc-mesh.c
@@ -198,7 +198,7 @@ act_stage2_config(NMDevice *device, NMDeviceStateReason *out_failure_reason)
                                         nm_device_get_ifindex(device),
                                         g_bytes_get_data(ssid, NULL),
                                         g_bytes_get_size(ssid));
-    nm_device_bring_up(NM_DEVICE(self), TRUE, NULL);
+    nm_device_bring_up(NM_DEVICE(self));
     if (!success) {
         _LOGW(LOGD_WIFI, "Unable to set the mesh ID");
         return NM_ACT_STAGE_RETURN_FAILURE;
diff --git a/src/core/devices/wifi/nm-device-wifi.c b/src/core/devices/wifi/nm-device-wifi.c
index 43798b85..8af974d0 100644
--- a/src/core/devices/wifi/nm-device-wifi.c
+++ b/src/core/devices/wifi/nm-device-wifi.c
@@ -960,7 +960,7 @@ deactivate(NMDevice *device)
         != _NM_802_11_MODE_INFRA) {
         nm_device_take_down(NM_DEVICE(self), TRUE);
         nm_platform_wifi_set_mode(nm_device_get_platform(device), ifindex, _NM_802_11_MODE_INFRA);
-        nm_device_bring_up(NM_DEVICE(self), TRUE, NULL);
+        nm_device_bring_up(NM_DEVICE(self));
     }
 
     if (priv->mode != _NM_802_11_MODE_INFRA) {
@@ -3586,7 +3586,7 @@ set_enabled(NMDevice *device, gboolean enabled)
         if (state != NM_DEVICE_STATE_UNAVAILABLE)
             _LOGW(LOGD_CORE, "not in expected unavailable state!");
 
-        if (!nm_device_bring_up(NM_DEVICE(self), TRUE, &no_firmware)) {
+        if (!nm_device_bring_up_full(NM_DEVICE(self), TRUE, TRUE, &no_firmware)) {
             _LOGD(LOGD_WIFI, "enable blocked by failure to bring device up");
 
             if (no_firmware)
diff --git a/src/core/devices/wwan/nm-modem-broadband.c b/src/core/devices/wwan/nm-modem-broadband.c
index 997fe727..db4fb29f 100644
--- a/src/core/devices/wwan/nm-modem-broadband.c
+++ b/src/core/devices/wwan/nm-modem-broadband.c
@@ -1123,8 +1123,8 @@ stage3_ip_config_start(NMModem *modem, int addr_family, NMModemIPMethod ip_metho
         address.plen = mm_bearer_ip_config_get_prefix(self->_priv.ipv6_config);
         if (address.plen <= 128) {
             if (IN6_IS_ADDR_LINKLOCAL(&address.address)) {
-                iid_data.id = ((guint64 *) (&address.address.s6_addr))[1];
-                iid         = &iid_data;
+                nm_utils_ipv6_interface_identifier_get_from_addr(&iid_data, &address.address);
+                iid = &iid_data;
             } else
                 do_auto = FALSE;
             nm_l3_config_data_add_address_6(l3cd, &address);
diff --git a/src/core/dhcp/nm-dhcp-helper.c b/src/core/dhcp/nm-dhcp-helper.c
index 78db617c..213d9496 100644
--- a/src/core/dhcp/nm-dhcp-helper.c
+++ b/src/core/dhcp/nm-dhcp-helper.c
@@ -252,7 +252,7 @@ do_notify:
     success = FALSE;
 
 out:
-    if (!g_dbus_connection_flush_sync(connection, NULL, &error_flush)) {
+    if (connection && !g_dbus_connection_flush_sync(connection, NULL, &error_flush)) {
         _LOGE("could not flush D-Bus connection: %s", error_flush->message);
         /* if we considered this a success so far, don't fail because of this. */
     }
diff --git a/src/core/ndisc/nm-ndisc.c b/src/core/ndisc/nm-ndisc.c
index 04b673e5..9a6038d4 100644
--- a/src/core/ndisc/nm-ndisc.c
+++ b/src/core/ndisc/nm-ndisc.c
@@ -1609,27 +1609,27 @@ calc_pre_expiry_rs_msec(NMNDisc *ndisc)
         _calc_pre_expiry_rs_msec_worker(
             &expiry_msec,
             priv->last_rs_msec,
-            g_array_index(rdata->addresses, NMNDiscAddress, 0).expiry_msec);
+            g_array_index(rdata->addresses, NMNDiscAddress, i).expiry_msec);
     }
 
     for (i = 0; i < rdata->routes->len; i++) {
         _calc_pre_expiry_rs_msec_worker(&expiry_msec,
                                         priv->last_rs_msec,
-                                        g_array_index(rdata->routes, NMNDiscRoute, 0).expiry_msec);
+                                        g_array_index(rdata->routes, NMNDiscRoute, i).expiry_msec);
     }
 
     for (i = 0; i < rdata->dns_servers->len; i++) {
         _calc_pre_expiry_rs_msec_worker(
             &expiry_msec,
             priv->last_rs_msec,
-            g_array_index(rdata->dns_servers, NMNDiscDNSServer, 0).expiry_msec);
+            g_array_index(rdata->dns_servers, NMNDiscDNSServer, i).expiry_msec);
     }
 
     for (i = 0; i < rdata->dns_domains->len; i++) {
         _calc_pre_expiry_rs_msec_worker(
             &expiry_msec,
             priv->last_rs_msec,
-            g_array_index(rdata->dns_domains, NMNDiscDNSDomain, 0).expiry_msec);
+            g_array_index(rdata->dns_domains, NMNDiscDNSDomain, i).expiry_msec);
     }
 
     return expiry_msec - solicit_retransmit_time_jitter(NM_NDISC_PRE_EXPIRY_TIME_MSEC);
diff --git a/src/core/nm-core-utils.c b/src/core/nm-core-utils.c
index 480e9b28..4aad9414 100644
--- a/src/core/nm-core-utils.c
+++ b/src/core/nm-core-utils.c
@@ -3265,25 +3265,32 @@ nm_utils_get_ipv6_interface_identifier(NMLinkType          link_type,
          * making sure to set the 'u' bit to 1.  The GUID is the lower 64 bits
          * of the IPoIB interface's hardware address.
          */
-        g_return_val_if_fail(hwaddr_len == INFINIBAND_ALEN, FALSE);
-        memcpy(out_iid->id_u8, hwaddr + INFINIBAND_ALEN - 8, 8);
-        out_iid->id_u8[0] |= 0x02;
-        return TRUE;
+        if (hwaddr_len == INFINIBAND_ALEN) {
+            memcpy(out_iid->id_u8, hwaddr + INFINIBAND_ALEN - 8, 8);
+            out_iid->id_u8[0] |= 0x02;
+            return TRUE;
+        }
+        break;
     case NM_LINK_TYPE_GRE:
         /* Hardware address is the network-endian IPv4 address */
-        g_return_val_if_fail(hwaddr_len == 4, FALSE);
-        addr              = *(guint32 *) hwaddr;
-        out_iid->id_u8[0] = get_gre_eui64_u_bit(addr);
-        out_iid->id_u8[1] = 0x00;
-        out_iid->id_u8[2] = 0x5E;
-        out_iid->id_u8[3] = 0xFE;
-        memcpy(out_iid->id_u8 + 4, &addr, 4);
-        return TRUE;
+        if (hwaddr_len == 4) {
+            addr              = unaligned_read_ne32(hwaddr);
+            out_iid->id_u8[0] = get_gre_eui64_u_bit(addr);
+            out_iid->id_u8[1] = 0x00;
+            out_iid->id_u8[2] = 0x5E;
+            out_iid->id_u8[3] = 0xFE;
+            memcpy(out_iid->id_u8 + 4, &addr, 4);
+            return TRUE;
+        }
+        break;
     case NM_LINK_TYPE_6LOWPAN:
         /* The hardware address is already 64-bit. This is the case for
          * IEEE 802.15.4 networks. */
-        memcpy(out_iid->id_u8, hwaddr, sizeof(out_iid->id_u8));
-        return TRUE;
+        if (hwaddr_len == sizeof(out_iid->id_u8)) {
+            memcpy(out_iid->id_u8, hwaddr, sizeof(out_iid->id_u8));
+            return TRUE;
+        }
+        break;
     default:
         if (hwaddr_len == ETH_ALEN) {
             /* Translate 48-bit MAC address to a 64-bit Modified EUI-64.  See
diff --git a/src/core/nm-netns.c b/src/core/nm-netns.c
index 5ee63152..859dbb21 100644
--- a/src/core/nm-netns.c
+++ b/src/core/nm-netns.c
@@ -129,13 +129,16 @@ NML3Cfg *
 nm_netns_l3cfg_get(NMNetns *self, int ifindex)
 {
     NMNetnsPrivate *priv;
+    L3CfgData      *l3cfg_data;
 
     g_return_val_if_fail(NM_IS_NETNS(self), NULL);
     g_return_val_if_fail(ifindex > 0, NULL);
 
     priv = NM_NETNS_GET_PRIVATE(self);
 
-    return g_hash_table_lookup(priv->l3cfgs, &ifindex);
+    l3cfg_data = g_hash_table_lookup(priv->l3cfgs, &ifindex);
+
+    return l3cfg_data ? l3cfg_data->l3cfg : NULL;
 }
 
 NML3Cfg *
diff --git a/src/core/supplicant/nm-supplicant-config.c b/src/core/supplicant/nm-supplicant-config.c
index 22c422a2..bd48ed92 100644
--- a/src/core/supplicant/nm-supplicant-config.c
+++ b/src/core/supplicant/nm-supplicant-config.c
@@ -403,6 +403,7 @@ nm_supplicant_config_add_setting_macsec(NMSupplicantConfig *self,
     const char *value;
     char        buf[32];
     int         port;
+    gsize       key_len;
 
     g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
     g_return_val_if_fail(setting != NULL, FALSE);
@@ -446,7 +447,16 @@ nm_supplicant_config_add_setting_macsec(NMSupplicantConfig *self,
             return FALSE;
 
         value = nm_setting_macsec_get_mka_ckn(setting);
-        if (!value || !nm_utils_hexstr2bin_buf(value, FALSE, FALSE, NULL, buffer_ckn)) {
+        if (!value
+            || !nm_utils_hexstr2bin_full(value,
+                                         FALSE,
+                                         FALSE,
+                                         FALSE,
+                                         NULL,
+                                         0,
+                                         buffer_ckn,
+                                         G_N_ELEMENTS(buffer_ckn),
+                                         &key_len)) {
             g_set_error_literal(error,
                                 NM_SUPPLICANT_ERROR,
                                 NM_SUPPLICANT_ERROR_CONFIG,
@@ -456,7 +466,7 @@ nm_supplicant_config_add_setting_macsec(NMSupplicantConfig *self,
         if (!nm_supplicant_config_add_option(self,
                                              "mka_ckn",
                                              (char *) buffer_ckn,
-                                             sizeof(buffer_ckn),
+                                             key_len,
                                              value,
                                              error))
             return FALSE;
diff --git a/src/libnm-base/nm-ethtool-base.c b/src/libnm-base/nm-ethtool-base.c
index 78e9fbc1..a75df8a0 100644
--- a/src/libnm-base/nm-ethtool-base.c
+++ b/src/libnm-base/nm-ethtool-base.c
@@ -271,7 +271,7 @@ nm_ethtool_data_get_by_optname(const char *optname)
 
     _ASSERT_data();
 
-    idx = nm_utils_array_find_binary_search((gconstpointer *) _by_name,
+    idx = nm_utils_array_find_binary_search(_by_name,
                                             sizeof(_by_name[0]),
                                             _NM_ETHTOOL_ID_NUM,
                                             optname,
diff --git a/src/libnm-client-impl/nm-settings-docs-gir.xml b/src/libnm-client-impl/nm-settings-docs-gir.xml
index eef7de67..78dc852c 100644
--- a/src/libnm-client-impl/nm-settings-docs-gir.xml
+++ b/src/libnm-client-impl/nm-settings-docs-gir.xml
@@ -285,7 +285,7 @@
 
  If the table setting is left at zero, it is eligible to be overwritten via global configuration. If the property is zero even after applying the global configuration value, policy routing is disabled for the address family of this connection.
 
- Policy routing disabled means that NetworkManager will add all routes to the main table (except static routes that explicitly configure a different table). Additionally, NetworkManager will not delete any extraneous routes from tables except the main table. This is to preserve backward compatibility for users who manage routing tables outside of NetworkManager.</description><description-docbook><para> Enable policy routing (source routing) and set the routing table used when adding routes.</para><para> This affects all routes, including device-routes, IPv4LL, DHCP, SLAAC, default-routes and static routes. But note that static routes can individually overwrite the setting by explicitly specifying a non-zero routing table.</para><para> If the table setting is left at zero, it is eligible to be overwritten via global configuration. If the property is zero even after applying the global configuration value, policy routing is disabled for the address family of this connection.</para><para> Policy routing disabled means that NetworkManager will add all routes to the main table (except static routes that explicitly configure a different table). Additionally, NetworkManager will not delete any extraneous routes from tables except the main table. This is to preserve backward compatibility for users who manage routing tables outside of NetworkManager.</para></description-docbook></property><property name="routes" name_upper="ROUTES" type="array of legacy IPv6 route struct"><description> Array of IP routes.</description><description-docbook><para> Array of IP routes.</para></description-docbook></property><property name="token" name_upper="TOKEN" type="string"><description> Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.</description><description-docbook><para> Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.</para></description-docbook></property></setting><setting name="ip-tunnel" description=" IP Tunneling Settings" name_upper="IP_TUNNEL"><property name="encapsulation-limit" name_upper="ENCAPSULATION_LIMIT" type="uint32" default="0"><description> How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.</description><description-docbook><para> How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.</para></description-docbook></property><property name="flags" name_upper="FLAGS" type="uint32" default="0"><description> Tunnel flags. Currently, the following values are supported: NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY (0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only for IPv6 tunnels.</description><description-docbook><para> Tunnel flags. Currently, the following values are supported: NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY (0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only for IPv6 tunnels.</para></description-docbook></property><property name="flow-label" name_upper="FLOW_LABEL" type="uint32" default="0"><description> The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.</description><description-docbook><para> The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.</para></description-docbook></property><property name="input-key" name_upper="INPUT_KEY" type="string"><description> The key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</description><description-docbook><para> The key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</para></description-docbook></property><property name="local" name_upper="LOCAL" type="string"><description> The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.</description><description-docbook><para> The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.</para></description-docbook></property><property name="mode" name_upper="MODE" type="uint32" default="0"><description> The tunneling mode, for example NM_IP_TUNNEL_MODE_IPIP (1) or NM_IP_TUNNEL_MODE_GRE (2).</description><description-docbook><para> The tunneling mode, for example NM_IP_TUNNEL_MODE_IPIP (1) or NM_IP_TUNNEL_MODE_GRE (2).</para></description-docbook></property><property name="mtu" name_upper="MTU" type="uint32" default="0"><description> If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments.</description><description-docbook><para> If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments.</para></description-docbook></property><property name="output-key" name_upper="OUTPUT_KEY" type="string"><description> The key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</description><description-docbook><para> The key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</para></description-docbook></property><property name="parent" name_upper="PARENT" type="string"><description> If given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.</description><description-docbook><para> If given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.</para></description-docbook></property><property name="path-mtu-discovery" name_upper="PATH_MTU_DISCOVERY" type="boolean" default="TRUE"><description> Whether to enable Path MTU Discovery on this tunnel.</description><description-docbook><para> Whether to enable Path MTU Discovery on this tunnel.</para></description-docbook></property><property name="remote" name_upper="REMOTE" type="string"><description> The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.</description><description-docbook><para> The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.</para></description-docbook></property><property name="tos" name_upper="TOS" type="uint32" default="0"><description> The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.</description><description-docbook><para> The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.</para></description-docbook></property><property name="ttl" name_upper="TTL" type="uint32" default="0"><description> The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.</description><description-docbook><para> The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.</para></description-docbook></property></setting><setting name="macsec" description=" MACSec Settings" name_upper="MACSEC"><property name="encrypt" name_upper="ENCRYPT" type="boolean" default="TRUE"><description> Whether the transmitted traffic must be encrypted.</description><description-docbook><para> Whether the transmitted traffic must be encrypted.</para></description-docbook></property><property name="mka-cak" name_upper="MKA_CAK" type="string"><description> The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement.</description><description-docbook><para> The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement.</para></description-docbook></property><property name="mka-cak-flags" name_upper="MKA_CAK_FLAGS" type="NMSettingSecretFlags (uint32)"><description> Flags indicating how to handle the "mka-cak" property.</description><description-docbook><para> Flags indicating how to handle the "mka-cak" property.</para></description-docbook></property><property name="mka-ckn" name_upper="MKA_CKN" type="string"><description> The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement.</description><description-docbook><para> The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement.</para></description-docbook></property><property name="mode" name_upper="MODE" type="int32" default="0"><description> Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.</description><description-docbook><para> Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.</para></description-docbook></property><property name="parent" name_upper="PARENT" type="string"><description> If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</description><description-docbook><para> If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</para></description-docbook></property><property name="port" name_upper="PORT" type="int32" default="1"><description> The port component of the SCI (Secure Channel Identifier), between 1 and 65534.</description><description-docbook><para> The port component of the SCI (Secure Channel Identifier), between 1 and 65534.</para></description-docbook></property><property name="send-sci" name_upper="SEND_SCI" type="boolean" default="TRUE"><description> Specifies whether the SCI (Secure Channel Identifier) is included in every packet.</description><description-docbook><para> Specifies whether the SCI (Secure Channel Identifier) is included in every packet.</para></description-docbook></property><property name="validation" name_upper="VALIDATION" type="int32" default="2"><description> Specifies the validation mode for incoming frames.</description><description-docbook><para> Specifies the validation mode for incoming frames.</para></description-docbook></property></setting><setting name="macvlan" description=" MAC VLAN Settings" name_upper="MACVLAN"><property name="mode" name_upper="MODE" type="uint32" default="0"><description> The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.</description><description-docbook><para> The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.</para></description-docbook></property><property name="parent" name_upper="PARENT" type="string"><description> If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</description><description-docbook><para> If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</para></description-docbook></property><property name="promiscuous" name_upper="PROMISCUOUS" type="boolean" default="TRUE"><description> Whether the interface should be put in promiscuous mode.</description><description-docbook><para> Whether the interface should be put in promiscuous mode.</para></description-docbook></property><property name="tap" name_upper="TAP" type="boolean" default="FALSE"><description> Whether the interface should be a MACVTAP.</description><description-docbook><para> Whether the interface should be a MACVTAP.</para></description-docbook></property></setting><setting name="match" description=" Match settings" name_upper="MATCH"><property name="driver" name_upper="DRIVER" type="array of string"><description> A list of driver names to match. Each element is a shell wildcard pattern.
+ Policy routing disabled means that NetworkManager will add all routes to the main table (except static routes that explicitly configure a different table). Additionally, NetworkManager will not delete any extraneous routes from tables except the main table. This is to preserve backward compatibility for users who manage routing tables outside of NetworkManager.</description><description-docbook><para> Enable policy routing (source routing) and set the routing table used when adding routes.</para><para> This affects all routes, including device-routes, IPv4LL, DHCP, SLAAC, default-routes and static routes. But note that static routes can individually overwrite the setting by explicitly specifying a non-zero routing table.</para><para> If the table setting is left at zero, it is eligible to be overwritten via global configuration. If the property is zero even after applying the global configuration value, policy routing is disabled for the address family of this connection.</para><para> Policy routing disabled means that NetworkManager will add all routes to the main table (except static routes that explicitly configure a different table). Additionally, NetworkManager will not delete any extraneous routes from tables except the main table. This is to preserve backward compatibility for users who manage routing tables outside of NetworkManager.</para></description-docbook></property><property name="routes" name_upper="ROUTES" type="array of legacy IPv6 route struct"><description> Array of IP routes.</description><description-docbook><para> Array of IP routes.</para></description-docbook></property><property name="token" name_upper="TOKEN" type="string"><description> Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.</description><description-docbook><para> Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.</para></description-docbook></property></setting><setting name="ip-tunnel" description=" IP Tunneling Settings" name_upper="IP_TUNNEL"><property name="encapsulation-limit" name_upper="ENCAPSULATION_LIMIT" type="uint32" default="0"><description> How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.</description><description-docbook><para> How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.</para></description-docbook></property><property name="flags" name_upper="FLAGS" type="uint32" default="0"><description> Tunnel flags. Currently, the following values are supported: NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY (0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only for IPv6 tunnels.</description><description-docbook><para> Tunnel flags. Currently, the following values are supported: NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY (0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only for IPv6 tunnels.</para></description-docbook></property><property name="flow-label" name_upper="FLOW_LABEL" type="uint32" default="0"><description> The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.</description><description-docbook><para> The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.</para></description-docbook></property><property name="input-key" name_upper="INPUT_KEY" type="string"><description> The key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</description><description-docbook><para> The key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</para></description-docbook></property><property name="local" name_upper="LOCAL" type="string"><description> The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.</description><description-docbook><para> The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.</para></description-docbook></property><property name="mode" name_upper="MODE" type="uint32" default="0"><description> The tunneling mode, for example NM_IP_TUNNEL_MODE_IPIP (1) or NM_IP_TUNNEL_MODE_GRE (2).</description><description-docbook><para> The tunneling mode, for example NM_IP_TUNNEL_MODE_IPIP (1) or NM_IP_TUNNEL_MODE_GRE (2).</para></description-docbook></property><property name="mtu" name_upper="MTU" type="uint32" default="0"><description> If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments.</description><description-docbook><para> If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments.</para></description-docbook></property><property name="output-key" name_upper="OUTPUT_KEY" type="string"><description> The key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</description><description-docbook><para> The key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</para></description-docbook></property><property name="parent" name_upper="PARENT" type="string"><description> If given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.</description><description-docbook><para> If given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.</para></description-docbook></property><property name="path-mtu-discovery" name_upper="PATH_MTU_DISCOVERY" type="boolean" default="TRUE"><description> Whether to enable Path MTU Discovery on this tunnel.</description><description-docbook><para> Whether to enable Path MTU Discovery on this tunnel.</para></description-docbook></property><property name="remote" name_upper="REMOTE" type="string"><description> The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.</description><description-docbook><para> The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.</para></description-docbook></property><property name="tos" name_upper="TOS" type="uint32" default="0"><description> The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.</description><description-docbook><para> The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.</para></description-docbook></property><property name="ttl" name_upper="TTL" type="uint32" default="0"><description> The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.</description><description-docbook><para> The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.</para></description-docbook></property></setting><setting name="macsec" description=" MACSec Settings" name_upper="MACSEC"><property name="encrypt" name_upper="ENCRYPT" type="boolean" default="TRUE"><description> Whether the transmitted traffic must be encrypted.</description><description-docbook><para> Whether the transmitted traffic must be encrypted.</para></description-docbook></property><property name="mka-cak" name_upper="MKA_CAK" type="string"><description> The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.</description><description-docbook><para> The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.</para></description-docbook></property><property name="mka-cak-flags" name_upper="MKA_CAK_FLAGS" type="NMSettingSecretFlags (uint32)"><description> Flags indicating how to handle the "mka-cak" property.</description><description-docbook><para> Flags indicating how to handle the "mka-cak" property.</para></description-docbook></property><property name="mka-ckn" name_upper="MKA_CKN" type="string"><description> The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.</description><description-docbook><para> The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.</para></description-docbook></property><property name="mode" name_upper="MODE" type="int32" default="0"><description> Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.</description><description-docbook><para> Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.</para></description-docbook></property><property name="parent" name_upper="PARENT" type="string"><description> If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</description><description-docbook><para> If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</para></description-docbook></property><property name="port" name_upper="PORT" type="int32" default="1"><description> The port component of the SCI (Secure Channel Identifier), between 1 and 65534.</description><description-docbook><para> The port component of the SCI (Secure Channel Identifier), between 1 and 65534.</para></description-docbook></property><property name="send-sci" name_upper="SEND_SCI" type="boolean" default="TRUE"><description> Specifies whether the SCI (Secure Channel Identifier) is included in every packet.</description><description-docbook><para> Specifies whether the SCI (Secure Channel Identifier) is included in every packet.</para></description-docbook></property><property name="validation" name_upper="VALIDATION" type="int32" default="2"><description> Specifies the validation mode for incoming frames.</description><description-docbook><para> Specifies the validation mode for incoming frames.</para></description-docbook></property></setting><setting name="macvlan" description=" MAC VLAN Settings" name_upper="MACVLAN"><property name="mode" name_upper="MODE" type="uint32" default="0"><description> The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.</description><description-docbook><para> The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.</para></description-docbook></property><property name="parent" name_upper="PARENT" type="string"><description> If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</description><description-docbook><para> If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</para></description-docbook></property><property name="promiscuous" name_upper="PROMISCUOUS" type="boolean" default="TRUE"><description> Whether the interface should be put in promiscuous mode.</description><description-docbook><para> Whether the interface should be put in promiscuous mode.</para></description-docbook></property><property name="tap" name_upper="TAP" type="boolean" default="FALSE"><description> Whether the interface should be a MACVTAP.</description><description-docbook><para> Whether the interface should be a MACVTAP.</para></description-docbook></property></setting><setting name="match" description=" Match settings" name_upper="MATCH"><property name="driver" name_upper="DRIVER" type="array of string"><description> A list of driver names to match. Each element is a shell wildcard pattern.
 
  See NMSettingMatch:interface-name for how special characters '|', '&amp;', '!' and '\\' are used for optional and mandatory matches and inverting the pattern.</description><description-docbook><para> A list of driver names to match. Each element is a shell wildcard pattern.</para><para> See NMSettingMatch:interface-name for how special characters '|', '&amp;', '!' and '\\' are used for optional and mandatory matches and inverting the pattern.</para></description-docbook></property><property name="interface-name" name_upper="INTERFACE_NAME" type="array of string"><description> A list of interface names to match. Each element is a shell wildcard pattern.
 
diff --git a/src/libnm-core-impl/nm-setting-macsec.c b/src/libnm-core-impl/nm-setting-macsec.c
index 85271214..1463fd92 100644
--- a/src/libnm-core-impl/nm-setting-macsec.c
+++ b/src/libnm-core-impl/nm-setting-macsec.c
@@ -236,7 +236,7 @@ need_secrets(NMSetting *setting)
 static gboolean
 verify_macsec_key(const char *key, gboolean cak, GError **error)
 {
-    int req_len;
+    size_t len;
 
     /* CAK is a connection secret and can be NULL for various
      * reasons (agent-owned, no permissions to get secrets, etc.)
@@ -252,14 +252,25 @@ verify_macsec_key(const char *key, gboolean cak, GError **error)
         return FALSE;
     }
 
-    req_len = cak ? NM_SETTING_MACSEC_MKA_CAK_LENGTH : NM_SETTING_MACSEC_MKA_CKN_LENGTH;
-    if (strlen(key) != (gsize) req_len) {
-        g_set_error(error,
-                    NM_CONNECTION_ERROR,
-                    NM_CONNECTION_ERROR_INVALID_PROPERTY,
-                    _("the key must be %d characters"),
-                    req_len);
-        return FALSE;
+    len = strlen(key);
+    if (cak) {
+        if (len != NM_SETTING_MACSEC_MKA_CAK_LENGTH) {
+            g_set_error(error,
+                        NM_CONNECTION_ERROR,
+                        NM_CONNECTION_ERROR_INVALID_PROPERTY,
+                        _("the key must be %d characters"),
+                        NM_SETTING_MACSEC_MKA_CAK_LENGTH);
+            return FALSE;
+        }
+    } else {
+        if (len < 2 || len > 64 || len % 2 != 0) {
+            g_set_error_literal(
+                error,
+                NM_CONNECTION_ERROR,
+                NM_CONNECTION_ERROR_INVALID_PROPERTY,
+                _("the key must have an even number of characters between 2 and 64"));
+            return FALSE;
+        }
     }
 
     if (!NM_STRCHAR_ALL(key, ch, g_ascii_isxdigit(ch))) {
@@ -490,7 +501,7 @@ nm_setting_macsec_class_init(NMSettingMacsecClass *klass)
      * NMSettingMacsec:mka-cak:
      *
      * The pre-shared CAK (Connectivity Association Key) for MACsec
-     * Key Agreement.
+     * Key Agreement. Must be a string of 32 hexadecimal characters.
      *
      * Since: 1.6
      **/
@@ -521,7 +532,8 @@ nm_setting_macsec_class_init(NMSettingMacsecClass *klass)
      * NMSettingMacsec:mka-ckn:
      *
      * The pre-shared CKN (Connectivity-association Key Name) for
-     * MACsec Key Agreement.
+     * MACsec Key Agreement. Must be a string of hexadecimal characters
+     * with a even length between 2 and 64.
      *
      * Since: 1.6
      **/
diff --git a/src/libnm-core-public/nm-setting-macsec.h b/src/libnm-core-public/nm-setting-macsec.h
index 52e4313d..c2662b1f 100644
--- a/src/libnm-core-public/nm-setting-macsec.h
+++ b/src/libnm-core-public/nm-setting-macsec.h
@@ -73,6 +73,8 @@ typedef enum {
 } NMSettingMacsecValidation;
 
 #define NM_SETTING_MACSEC_MKA_CAK_LENGTH 32
+
+/* Deprecated. The CKN can be between 2 and 64 characters. */
 #define NM_SETTING_MACSEC_MKA_CKN_LENGTH 64
 
 NM_AVAILABLE_IN_1_6
diff --git a/src/libnm-core-public/nm-version-macros.h b/src/libnm-core-public/nm-version-macros.h
index 04fce5df..2b5bc67e 100644
--- a/src/libnm-core-public/nm-version-macros.h
+++ b/src/libnm-core-public/nm-version-macros.h
@@ -30,7 +30,7 @@
  * Evaluates to the micro version number of NetworkManager which this source
  * compiled against.
  */
-#define NM_MICRO_VERSION (6)
+#define NM_MICRO_VERSION (8)
 
 /**
  * NM_CHECK_VERSION:
diff --git a/src/libnm-glib-aux/nm-test-utils.h b/src/libnm-glib-aux/nm-test-utils.h
index 83702070..d338d0af 100644
--- a/src/libnm-glib-aux/nm-test-utils.h
+++ b/src/libnm-glib-aux/nm-test-utils.h
@@ -2141,7 +2141,7 @@ _nmtst_connection_normalize_v(NMConnection *connection, va_list args)
     while ((p_name = va_arg(args, const char *))) {
         if (!parameters)
             parameters = g_hash_table_new(g_str_hash, g_str_equal);
-        g_hash_table_insert(parameters, (gpointer *) p_name, va_arg(args, gpointer));
+        g_hash_table_insert(parameters, (gpointer) p_name, va_arg(args, gpointer));
     }
 
     success = nm_connection_normalize(connection, parameters, &was_modified, &error);
diff --git a/src/libnm-platform/nm-platform.c b/src/libnm-platform/nm-platform.c
index 7d82083c..198e5f0a 100644
--- a/src/libnm-platform/nm-platform.c
+++ b/src/libnm-platform/nm-platform.c
@@ -8249,7 +8249,6 @@ void
 nm_platform_lnk_macsec_hash_update(const NMPlatformLnkMacsec *obj, NMHashState *h)
 {
     nm_hash_update_vals(h,
-                        obj->parent_ifindex,
                         obj->sci,
                         obj->cipher_suite,
                         obj->window,
@@ -8269,7 +8268,6 @@ int
 nm_platform_lnk_macsec_cmp(const NMPlatformLnkMacsec *a, const NMPlatformLnkMacsec *b)
 {
     NM_CMP_SELF(a, b);
-    NM_CMP_FIELD(a, b, parent_ifindex);
     NM_CMP_FIELD(a, b, sci);
     NM_CMP_FIELD(a, b, icv_length);
     NM_CMP_FIELD(a, b, cipher_suite);
diff --git a/src/libnm-platform/nm-platform.h b/src/libnm-platform/nm-platform.h
index 7792bbf5..30d0b506 100644
--- a/src/libnm-platform/nm-platform.h
+++ b/src/libnm-platform/nm-platform.h
@@ -980,7 +980,6 @@ typedef struct {
 } NMPlatformLnkIpIp;
 
 typedef struct {
-    int     parent_ifindex;
     guint64 sci; /* host byte order */
     guint64 cipher_suite;
     guint32 window;
diff --git a/src/libnmc-setting/settings-docs-input.xml b/src/libnmc-setting/settings-docs-input.xml
index 77643955..39bfb540 100644
--- a/src/libnmc-setting/settings-docs-input.xml
+++ b/src/libnmc-setting/settings-docs-input.xml
@@ -440,7 +440,7 @@ fixed priority.
 </para>
 <para>
 Example: <literal>priority 5 from 1:2:3::5/128 table 45</literal>
-</para></description-docbook><description>A comma separated list of routing rules for policy routing.</description></property><property name="token" name_upper="TOKEN" type="string"><description-docbook><para> Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.</para></description-docbook><description> Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.</description></property></setting><setting name="ip-tunnel" description=" IP Tunneling Settings" name_upper="IP_TUNNEL"><property name="encapsulation-limit" name_upper="ENCAPSULATION_LIMIT" type="uint32" default="0"><description-docbook><para> How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.</para></description-docbook><description> How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.</description></property><property name="flags" name_upper="FLAGS" type="uint32" default="0"><description-docbook><para> Tunnel flags. Currently, the following values are supported: NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY (0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only for IPv6 tunnels.</para></description-docbook><description> Tunnel flags. Currently, the following values are supported: NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY (0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only for IPv6 tunnels.</description></property><property name="flow-label" name_upper="FLOW_LABEL" type="uint32" default="0"><description-docbook><para> The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.</para></description-docbook><description> The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.</description></property><property name="input-key" name_upper="INPUT_KEY" type="string"><description-docbook><para> The key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</para></description-docbook><description> The key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</description></property><property name="local" name_upper="LOCAL" type="string"><description-docbook><para> The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.</para></description-docbook><description> The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.</description></property><property name="mode" name_upper="MODE" type="uint32" default="0"><description-docbook><para> The tunneling mode, for example NM_IP_TUNNEL_MODE_IPIP (1) or NM_IP_TUNNEL_MODE_GRE (2).</para></description-docbook><description> The tunneling mode, for example NM_IP_TUNNEL_MODE_IPIP (1) or NM_IP_TUNNEL_MODE_GRE (2).</description></property><property name="mtu" name_upper="MTU" type="uint32" default="0"><description-docbook><para> If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments.</para></description-docbook><description> If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments.</description></property><property name="output-key" name_upper="OUTPUT_KEY" type="string"><description-docbook><para> The key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</para></description-docbook><description> The key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</description></property><property name="parent" name_upper="PARENT" type="string"><description-docbook><para> If given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.</para></description-docbook><description> If given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.</description></property><property name="path-mtu-discovery" name_upper="PATH_MTU_DISCOVERY" type="boolean" default="TRUE"><description-docbook><para> Whether to enable Path MTU Discovery on this tunnel.</para></description-docbook><description> Whether to enable Path MTU Discovery on this tunnel.</description></property><property name="remote" name_upper="REMOTE" type="string"><description-docbook><para> The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.</para></description-docbook><description> The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.</description></property><property name="tos" name_upper="TOS" type="uint32" default="0"><description-docbook><para> The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.</para></description-docbook><description> The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.</description></property><property name="ttl" name_upper="TTL" type="uint32" default="0"><description-docbook><para> The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.</para></description-docbook><description> The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.</description></property></setting><setting name="macsec" description=" MACSec Settings" name_upper="MACSEC"><property name="encrypt" name_upper="ENCRYPT" type="boolean" default="TRUE"><description-docbook><para> Whether the transmitted traffic must be encrypted.</para></description-docbook><description> Whether the transmitted traffic must be encrypted.</description></property><property name="mka-cak" name_upper="MKA_CAK" type="string"><description-docbook><para> The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement.</para></description-docbook><description> The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement.</description></property><property name="mka-cak-flags" name_upper="MKA_CAK_FLAGS" type="NMSettingSecretFlags (uint32)"><description-docbook><para> Flags indicating how to handle the "mka-cak" property.</para></description-docbook><description> Flags indicating how to handle the "mka-cak" property.</description></property><property name="mka-ckn" name_upper="MKA_CKN" type="string"><description-docbook><para> The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement.</para></description-docbook><description> The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement.</description></property><property name="mode" name_upper="MODE" type="int32" default="0"><description-docbook><para> Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.</para></description-docbook><description> Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.</description></property><property name="parent" name_upper="PARENT" type="string"><description-docbook><para> If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</para></description-docbook><description> If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</description></property><property name="port" name_upper="PORT" type="int32" default="1"><description-docbook><para> The port component of the SCI (Secure Channel Identifier), between 1 and 65534.</para></description-docbook><description> The port component of the SCI (Secure Channel Identifier), between 1 and 65534.</description></property><property name="send-sci" name_upper="SEND_SCI" type="boolean" default="TRUE"><description-docbook><para> Specifies whether the SCI (Secure Channel Identifier) is included in every packet.</para></description-docbook><description> Specifies whether the SCI (Secure Channel Identifier) is included in every packet.</description></property><property name="validation" name_upper="VALIDATION" type="int32" default="2"><description-docbook><para> Specifies the validation mode for incoming frames.</para></description-docbook><description> Specifies the validation mode for incoming frames.</description></property></setting><setting name="macvlan" description=" MAC VLAN Settings" name_upper="MACVLAN"><property name="mode" name_upper="MODE" type="uint32" default="0"><description-docbook><para> The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.</para></description-docbook><description> The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.</description></property><property name="parent" name_upper="PARENT" type="string"><description-docbook><para> If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</para></description-docbook><description> If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</description></property><property name="promiscuous" name_upper="PROMISCUOUS" type="boolean" default="TRUE"><description-docbook><para> Whether the interface should be put in promiscuous mode.</para></description-docbook><description> Whether the interface should be put in promiscuous mode.</description></property><property name="tap" name_upper="TAP" type="boolean" default="FALSE"><description-docbook><para> Whether the interface should be a MACVTAP.</para></description-docbook><description> Whether the interface should be a MACVTAP.</description></property></setting><setting name="match" description=" Match settings" name_upper="MATCH"><property name="driver" name_upper="DRIVER" type="array of string"><description-docbook><para> A list of driver names to match. Each element is a shell wildcard pattern.</para><para> See NMSettingMatch:interface-name for how special characters '|', '&amp;', '!' and '\\' are used for optional and mandatory matches and inverting the pattern.</para></description-docbook><description> A list of driver names to match. Each element is a shell wildcard pattern.
+</para></description-docbook><description>A comma separated list of routing rules for policy routing.</description></property><property name="token" name_upper="TOKEN" type="string"><description-docbook><para> Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.</para></description-docbook><description> Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.</description></property></setting><setting name="ip-tunnel" description=" IP Tunneling Settings" name_upper="IP_TUNNEL"><property name="encapsulation-limit" name_upper="ENCAPSULATION_LIMIT" type="uint32" default="0"><description-docbook><para> How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.</para></description-docbook><description> How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.</description></property><property name="flags" name_upper="FLAGS" type="uint32" default="0"><description-docbook><para> Tunnel flags. Currently, the following values are supported: NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY (0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only for IPv6 tunnels.</para></description-docbook><description> Tunnel flags. Currently, the following values are supported: NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY (0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only for IPv6 tunnels.</description></property><property name="flow-label" name_upper="FLOW_LABEL" type="uint32" default="0"><description-docbook><para> The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.</para></description-docbook><description> The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.</description></property><property name="input-key" name_upper="INPUT_KEY" type="string"><description-docbook><para> The key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</para></description-docbook><description> The key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</description></property><property name="local" name_upper="LOCAL" type="string"><description-docbook><para> The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.</para></description-docbook><description> The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.</description></property><property name="mode" name_upper="MODE" type="uint32" default="0"><description-docbook><para> The tunneling mode, for example NM_IP_TUNNEL_MODE_IPIP (1) or NM_IP_TUNNEL_MODE_GRE (2).</para></description-docbook><description> The tunneling mode, for example NM_IP_TUNNEL_MODE_IPIP (1) or NM_IP_TUNNEL_MODE_GRE (2).</description></property><property name="mtu" name_upper="MTU" type="uint32" default="0"><description-docbook><para> If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments.</para></description-docbook><description> If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments.</description></property><property name="output-key" name_upper="OUTPUT_KEY" type="string"><description-docbook><para> The key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</para></description-docbook><description> The key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</description></property><property name="parent" name_upper="PARENT" type="string"><description-docbook><para> If given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.</para></description-docbook><description> If given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.</description></property><property name="path-mtu-discovery" name_upper="PATH_MTU_DISCOVERY" type="boolean" default="TRUE"><description-docbook><para> Whether to enable Path MTU Discovery on this tunnel.</para></description-docbook><description> Whether to enable Path MTU Discovery on this tunnel.</description></property><property name="remote" name_upper="REMOTE" type="string"><description-docbook><para> The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.</para></description-docbook><description> The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.</description></property><property name="tos" name_upper="TOS" type="uint32" default="0"><description-docbook><para> The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.</para></description-docbook><description> The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.</description></property><property name="ttl" name_upper="TTL" type="uint32" default="0"><description-docbook><para> The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.</para></description-docbook><description> The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.</description></property></setting><setting name="macsec" description=" MACSec Settings" name_upper="MACSEC"><property name="encrypt" name_upper="ENCRYPT" type="boolean" default="TRUE"><description-docbook><para> Whether the transmitted traffic must be encrypted.</para></description-docbook><description> Whether the transmitted traffic must be encrypted.</description></property><property name="mka-cak" name_upper="MKA_CAK" type="string"><description-docbook><para> The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.</para></description-docbook><description> The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.</description></property><property name="mka-cak-flags" name_upper="MKA_CAK_FLAGS" type="NMSettingSecretFlags (uint32)"><description-docbook><para> Flags indicating how to handle the "mka-cak" property.</para></description-docbook><description> Flags indicating how to handle the "mka-cak" property.</description></property><property name="mka-ckn" name_upper="MKA_CKN" type="string"><description-docbook><para> The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.</para></description-docbook><description> The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.</description></property><property name="mode" name_upper="MODE" type="int32" default="0"><description-docbook><para> Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.</para></description-docbook><description> Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.</description></property><property name="parent" name_upper="PARENT" type="string"><description-docbook><para> If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</para></description-docbook><description> If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</description></property><property name="port" name_upper="PORT" type="int32" default="1"><description-docbook><para> The port component of the SCI (Secure Channel Identifier), between 1 and 65534.</para></description-docbook><description> The port component of the SCI (Secure Channel Identifier), between 1 and 65534.</description></property><property name="send-sci" name_upper="SEND_SCI" type="boolean" default="TRUE"><description-docbook><para> Specifies whether the SCI (Secure Channel Identifier) is included in every packet.</para></description-docbook><description> Specifies whether the SCI (Secure Channel Identifier) is included in every packet.</description></property><property name="validation" name_upper="VALIDATION" type="int32" default="2"><description-docbook><para> Specifies the validation mode for incoming frames.</para></description-docbook><description> Specifies the validation mode for incoming frames.</description></property></setting><setting name="macvlan" description=" MAC VLAN Settings" name_upper="MACVLAN"><property name="mode" name_upper="MODE" type="uint32" default="0"><description-docbook><para> The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.</para></description-docbook><description> The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.</description></property><property name="parent" name_upper="PARENT" type="string"><description-docbook><para> If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</para></description-docbook><description> If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</description></property><property name="promiscuous" name_upper="PROMISCUOUS" type="boolean" default="TRUE"><description-docbook><para> Whether the interface should be put in promiscuous mode.</para></description-docbook><description> Whether the interface should be put in promiscuous mode.</description></property><property name="tap" name_upper="TAP" type="boolean" default="FALSE"><description-docbook><para> Whether the interface should be a MACVTAP.</para></description-docbook><description> Whether the interface should be a MACVTAP.</description></property></setting><setting name="match" description=" Match settings" name_upper="MATCH"><property name="driver" name_upper="DRIVER" type="array of string"><description-docbook><para> A list of driver names to match. Each element is a shell wildcard pattern.</para><para> See NMSettingMatch:interface-name for how special characters '|', '&amp;', '!' and '\\' are used for optional and mandatory matches and inverting the pattern.</para></description-docbook><description> A list of driver names to match. Each element is a shell wildcard pattern.
 
  See NMSettingMatch:interface-name for how special characters '|', '&amp;', '!' and '\\' are used for optional and mandatory matches and inverting the pattern.</description></property><property name="interface-name" name_upper="INTERFACE_NAME" type="array of string"><description-docbook><para> A list of interface names to match. Each element is a shell wildcard pattern.</para><para> An element can be prefixed with a pipe symbol (|) or an ampersand (&amp;). The former means that the element is optional and the latter means that it is mandatory. If there are any optional elements, than the match evaluates to true if at least one of the optional element matches (logical OR). If there are any mandatory elements, then they all must match (logical AND). By default, an element is optional. This means that an element "foo" behaves the same as "|foo". An element can also be inverted with exclamation mark (!) between the pipe symbol (or the ampersand) and before the pattern. Note that "!foo" is a shortcut for the mandatory match "&amp;!foo". Finally, a backslash can be used at the beginning of the element (after the optional special characters) to escape the start of the pattern. For example, "&amp;\\!a" is an mandatory match for literally "!a".</para></description-docbook><description> A list of interface names to match. Each element is a shell wildcard pattern.
 
diff --git a/src/libnmc-setting/settings-docs.h b/src/libnmc-setting/settings-docs.h
index 934ddff9..208cad86 100644
--- a/src/libnmc-setting/settings-docs.h
+++ b/src/libnmc-setting/settings-docs.h
@@ -226,9 +226,9 @@
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_TOS N_("The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.")
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_TTL N_("The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_ENCRYPT N_("Whether the transmitted traffic must be encrypted.")
-#define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CAK N_("The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement.")
+#define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CAK N_("The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CAK_FLAGS N_("Flags indicating how to handle the \"mka-cak\" property.")
-#define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CKN N_("The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement.")
+#define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CKN N_("The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MODE N_("Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_PARENT N_("If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an \"802-3-ethernet\" setting with a \"mac-address\" property.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_PORT N_("The port component of the SCI (Secure Channel Identifier), between 1 and 65534.")
diff --git a/src/libnmc-setting/settings-docs.h.in b/src/libnmc-setting/settings-docs.h.in
index 934ddff9..208cad86 100644
--- a/src/libnmc-setting/settings-docs.h.in
+++ b/src/libnmc-setting/settings-docs.h.in
@@ -226,9 +226,9 @@
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_TOS N_("The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.")
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_TTL N_("The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_ENCRYPT N_("Whether the transmitted traffic must be encrypted.")
-#define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CAK N_("The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement.")
+#define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CAK N_("The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CAK_FLAGS N_("Flags indicating how to handle the \"mka-cak\" property.")
-#define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CKN N_("The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement.")
+#define DESCRIBE_DOC_NM_SETTING_MACSEC_MKA_CKN N_("The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_MODE N_("Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_PARENT N_("If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an \"802-3-ethernet\" setting with a \"mac-address\" property.")
 #define DESCRIBE_DOC_NM_SETTING_MACSEC_PORT N_("The port component of the SCI (Secure Channel Identifier), between 1 and 65534.")
diff --git a/src/nmcli/generate-docs-nm-settings-nmcli.xml b/src/nmcli/generate-docs-nm-settings-nmcli.xml
index 5da5c979..f78c5f42 100644
--- a/src/nmcli/generate-docs-nm-settings-nmcli.xml
+++ b/src/nmcli/generate-docs-nm-settings-nmcli.xml
@@ -774,12 +774,12 @@
                   description="Whether the transmitted traffic must be encrypted." />
         <property name="mka-cak"
                   alias="cak"
-                  description="The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement." />
+                  description="The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters." />
         <property name="mka-cak-flags"
                   description="Flags indicating how to handle the &quot;mka-cak&quot; property." />
         <property name="mka-ckn"
                   alias="ckn"
-                  description="The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement." />
+                  description="The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64." />
         <property name="port"
                   alias="port"
                   description="The port component of the SCI (Secure Channel Identifier), between 1 and 65534." />
diff --git a/src/nmcli/generate-docs-nm-settings-nmcli.xml.in b/src/nmcli/generate-docs-nm-settings-nmcli.xml.in
index 5da5c979..f78c5f42 100644
--- a/src/nmcli/generate-docs-nm-settings-nmcli.xml.in
+++ b/src/nmcli/generate-docs-nm-settings-nmcli.xml.in
@@ -774,12 +774,12 @@
                   description="Whether the transmitted traffic must be encrypted." />
         <property name="mka-cak"
                   alias="cak"
-                  description="The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement." />
+                  description="The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters." />
         <property name="mka-cak-flags"
                   description="Flags indicating how to handle the &quot;mka-cak&quot; property." />
         <property name="mka-ckn"
                   alias="ckn"
-                  description="The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement." />
+                  description="The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64." />
         <property name="port"
                   alias="port"
                   description="The port component of the SCI (Secure Channel Identifier), between 1 and 65534." />