// SPDX-License-Identifier: GPL-2.0+

/*

 * Copyright (C) 2005 - 2014 Red Hat, Inc.

 * Copyright (C) 2006 - 2008 Novell, Inc.

 */

#include "nm-default.h"

#include "nm-device-ethernet.h"

#include <netinet/in.h>

#include <stdlib.h>

#include <unistd.h>

#include <libudev.h>

#include "nm-device-private.h"

#include "nm-act-request.h"

#include "nm-ip4-config.h"

#include "NetworkManagerUtils.h"

#include "supplicant/nm-supplicant-manager.h"

#include "supplicant/nm-supplicant-interface.h"

#include "supplicant/nm-supplicant-config.h"

#include "ppp/nm-ppp-manager.h"

#include "ppp/nm-ppp-manager-call.h"

#include "ppp/nm-ppp-status.h"

#include "platform/nm-platform.h"

#include "platform/nm-platform-utils.h"

#include "nm-dcb.h"

#include "settings/nm-settings-connection.h"

#include "nm-config.h"

#include "nm-device-ethernet-utils.h"

#include "settings/nm-settings.h"

#include "nm-device-factory.h"

#include "nm-core-internal.h"

#include "NetworkManagerUtils.h"

#include "nm-udev-aux/nm-udev-utils.h"

#include "nm-device-logging.h"

_LOG_DECLARE_SELF(NMDeviceEthernet);

/*****************************************************************************/

#define PPPOE_RECONNECT_DELAY 7

#define PPPOE_ENCAP_OVERHEAD  8 /* 2 bytes for PPP, 6 for PPPoE */

#define SUPPLICANT_LNK_TIMEOUT_SEC 15

/*****************************************************************************/

typedef enum {

	DCB_WAIT_UNKNOWN = 0,

	/* Ensure carrier is up before enabling DCB */

	DCB_WAIT_CARRIER_PREENABLE_UP,

	/* Wait for carrier down when device starts enabling */

	DCB_WAIT_CARRIER_PRECONFIG_DOWN,

	/* Wait for carrier up when device has finished enabling */

	DCB_WAIT_CARRIER_PRECONFIG_UP,

	/* Wait carrier down when device starts configuring */

	DCB_WAIT_CARRIER_POSTCONFIG_DOWN,

	/* Wait carrier up when device has finished configuring */

	DCB_WAIT_CARRIER_POSTCONFIG_UP,

} DcbWait;

typedef struct _NMDeviceEthernetPrivate {

	/* s390 */

	char *              subchan1;

	char *              subchan2;

	char *              subchan3;

	char *              subchannels; /* Composite used for checking unmanaged specs */

	char **             subchannels_dbus; /* Array exported on D-Bus */

	char *              s390_nettype;

	GHashTable *        s390_options;

	guint32             speed;

	gulong              carrier_id;

	struct {

		NMSupplicantManager *mgr;

		NMSupplMgrCreateIfaceHandle *create_handle;

		NMSupplicantInterface *iface;

		gulong iface_state_id;

		gulong auth_state_id;

		guint con_timeout_id;

		guint lnk_timeout_id;

		bool is_associated:1;

	} supplicant;

	NMActRequestGetSecretsCallId *wired_secrets_id;

	/* PPPoE */

	NMPPPManager *ppp_manager;

	gint32        last_pppoe_time;

	guint         pppoe_wait_id;

	/* DCB */

	DcbWait       dcb_wait;

	guint         dcb_timeout_id;

	guint32       ethtool_prev_speed;

	NMPlatformLinkDuplexType ethtool_prev_duplex:3;

	bool          dcb_handle_carrier_changes:1;

	bool          ethtool_prev_set:1;

	bool          ethtool_prev_autoneg:1;

} NMDeviceEthernetPrivate;

NM_GOBJECT_PROPERTIES_DEFINE (NMDeviceEthernet,

	PROP_SPEED,

	PROP_S390_SUBCHANNELS,

);

/*****************************************************************************/

G_DEFINE_TYPE (NMDeviceEthernet, nm_device_ethernet, NM_TYPE_DEVICE)

#define NM_DEVICE_ETHERNET_GET_PRIVATE(self) _NM_GET_PRIVATE_PTR(self, NMDeviceEthernet, NM_IS_DEVICE_ETHERNET, NMDevice)

/*****************************************************************************/

static void wired_secrets_cancel (NMDeviceEthernet *self);

/*****************************************************************************/

static char *

get_link_basename (const char *parent_path, const char *name, GError **error)

{

	char *link_dest, *path;

	char *result = NULL;

	path = g_strdup_printf ("%s/%s", parent_path, name);

	link_dest = g_file_read_link (path, error);

	if (link_dest) {

		result = g_path_get_basename (link_dest);

		g_free (link_dest);

	}

	g_free (path);

	return result;

}

static void

_update_s390_subchannels (NMDeviceEthernet *self)

{

	NMDeviceEthernetPrivate *priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);

	struct udev_device *dev = NULL;

	struct udev_device *parent = NULL;

	const char *parent_path, *item;

	int ifindex;

	GDir *dir;

	GError *error = NULL;

	if (priv->subchannels) {

		/* only read the subchannels once. For one, we don't expect them to change

		 * on multiple invocations. Second, we didn't implement proper reloading.

		 * Proper reloading might also be complicated, because the subchannels are

		 * used to match on devices based on a device-spec. Thus, it's not clear

		 * what it means to change afterwards. */

		return;

	}

	ifindex = nm_device_get_ifindex ((NMDevice *) self);

	dev = nm_platform_link_get_udev_device (nm_device_get_platform (NM_DEVICE (self)), ifindex);

	if (!dev)

		return;

	/* Try for the "ccwgroup" parent */

	parent = udev_device_get_parent_with_subsystem_devtype (dev, "ccwgroup", NULL);

	if (!parent) {

		/* FIXME: whatever 'lcs' devices' subsystem is here... */

		/* Not an s390 device */

		return;

	}

	parent_path = udev_device_get_syspath (parent);

	dir = g_dir_open (parent_path, 0, &error);

	if (!dir) {

		_LOGW (LOGD_DEVICE | LOGD_PLATFORM, "update-s390: failed to open directory '%s': %s",

		       parent_path, error->message);

		g_clear_error (&error);

		return;

	}

	while ((item = g_dir_read_name (dir))) {

		if (!strcmp (item, "cdev0")) {

			priv->subchan1 = get_link_basename (parent_path, "cdev0", &error);

		} else if (!strcmp (item, "cdev1")) {

			priv->subchan2 = get_link_basename (parent_path, "cdev1", &error);

		} else if (!strcmp (item, "cdev2")) {

			priv->subchan3 = get_link_basename (parent_path, "cdev2", &error);

		} else if (!strcmp (item, "driver")) {

			priv->s390_nettype = get_link_basename (parent_path, "driver", &error);

		} else if (   !strcmp (item, "layer2")

		           || !strcmp (item, "portname")

		           || !strcmp (item, "portno")) {

			gs_free char *path = NULL, *value = NULL;

			path = g_strdup_printf ("%s/%s", parent_path, item);

			value = nm_platform_sysctl_get (nm_device_get_platform (NM_DEVICE (self)), NMP_SYSCTL_PATHID_ABSOLUTE (path));

			if (   !strcmp (item, "portname")

			    && !g_strcmp0 (value, "no portname required")) {

				/* Do nothing */

			} else if (value && *value) {

				g_hash_table_insert (priv->s390_options, g_strdup (item), value);

				value = NULL;

			} else

				_LOGW (LOGD_DEVICE | LOGD_PLATFORM, "update-s390: error reading %s", path);

		}

		if (error) {

			_LOGW (LOGD_DEVICE | LOGD_PLATFORM, "update-s390: failed reading sysfs for %s (%s)", item, error->message);

			g_clear_error (&error);

		}

	}

	g_dir_close (dir);

	if (priv->subchan3) {

		priv->subchannels = g_strdup_printf ("%s,%s,%s",

		                                     priv->subchan1,

		                                     priv->subchan2,

		                                     priv->subchan3);

	} else if (priv->subchan2) {

		priv->subchannels = g_strdup_printf ("%s,%s",

		                                     priv->subchan1,

		                                     priv->subchan2);

	} else

		priv->subchannels = g_strdup (priv->subchan1);

	priv->subchannels_dbus = g_new (char *, 3 + 1);

	priv->subchannels_dbus[0] = g_strdup (priv->subchan1);

	priv->subchannels_dbus[1] = g_strdup (priv->subchan2);

	priv->subchannels_dbus[2] = g_strdup (priv->subchan3);

	priv->subchannels_dbus[3] = NULL;

	_LOGI (LOGD_DEVICE | LOGD_PLATFORM, "update-s390: found s390 '%s' subchannels [%s]",

	       nm_device_get_driver ((NMDevice *) self) ?: "(unknown driver)",

	       priv->subchannels);

	_notify (self, PROP_S390_SUBCHANNELS);

}

static void

device_state_changed (NMDevice *device,

                      NMDeviceState new_state,

                      NMDeviceState old_state,

                      NMDeviceStateReason reason)

{

	if (new_state > NM_DEVICE_STATE_ACTIVATED)

		wired_secrets_cancel (NM_DEVICE_ETHERNET (device));

}

static void

nm_device_ethernet_init (NMDeviceEthernet *self)

{

	NMDeviceEthernetPrivate *priv;

	priv = G_TYPE_INSTANCE_GET_PRIVATE (self, NM_TYPE_DEVICE_ETHERNET, NMDeviceEthernetPrivate);

	self->_priv = priv;

	priv->s390_options = g_hash_table_new_full (nm_str_hash, g_str_equal, g_free, g_free);

}

static NMDeviceCapabilities

get_generic_capabilities (NMDevice *device)

{

	NMDeviceEthernet *self = NM_DEVICE_ETHERNET (device);

	int ifindex = nm_device_get_ifindex (device);

	if (ifindex > 0) {

		if (nm_platform_link_supports_carrier_detect (nm_device_get_platform (device), ifindex))

			return NM_DEVICE_CAP_CARRIER_DETECT;

		else {

			_LOGI (LOGD_PLATFORM, "driver '%s' does not support carrier detection.",

			       nm_device_get_driver (device));

		}

	}

	return NM_DEVICE_CAP_NONE;

}

static guint32

_subchannels_count_num (const char * const *array)

{

	int i;

	if (!array)

		return 0;

	for (i = 0; array[i]; i++)

		/* NOP */;

	return i;

}

static gboolean

match_subchans (NMDeviceEthernet *self, NMSettingWired *s_wired, gboolean *try_mac)

{

	NMDeviceEthernetPrivate *priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);

	const char * const *subchans;

	guint32 num1, num2;

	int i;

	*try_mac = TRUE;

	subchans = nm_setting_wired_get_s390_subchannels (s_wired);

	num1 = _subchannels_count_num (subchans);

	num2 = _subchannels_count_num ((const char * const *) priv->subchannels_dbus);

	/* connection has no subchannels */

	if (num1 == 0)

		return TRUE;

	/* connection requires subchannels but the device has none */

	if (num2 == 0)

		return FALSE;

	/* number of subchannels differ */

	if (num1 != num2)

		return FALSE;

	/* Make sure each subchannel in the connection is a subchannel of this device */

	for (i = 0; subchans[i]; i++) {

		const char *candidate = subchans[i];

		if (   (priv->subchan1 && !strcmp (priv->subchan1, candidate))

		    || (priv->subchan2 && !strcmp (priv->subchan2, candidate))

		    || (priv->subchan3 && !strcmp (priv->subchan3, candidate)))

			continue;

		return FALSE;  /* a subchannel was not found */

	}

	*try_mac = FALSE;

	return TRUE;

}

static gboolean

check_connection_compatible (NMDevice *device, NMConnection *connection, GError **error)

{

	NMDeviceEthernet *self = NM_DEVICE_ETHERNET (device);

	NMSettingWired *s_wired;

	if (!NM_DEVICE_CLASS (nm_device_ethernet_parent_class)->check_connection_compatible (device, connection, error))

		return FALSE;

	if (nm_connection_is_type (connection, NM_SETTING_PPPOE_SETTING_NAME)) {

		s_wired = nm_connection_get_setting_wired (connection);

	} else {

		s_wired = _nm_connection_check_main_setting (connection, NM_SETTING_WIRED_SETTING_NAME, error);

		if (!s_wired)

			return FALSE;

	}

	if (s_wired) {

		const char *mac, *perm_hw_addr;

		gboolean try_mac = TRUE;

		const char * const *mac_blacklist;

		int i;

		if (!match_subchans (self, s_wired, &try_mac)) {

			nm_utils_error_set_literal (error, NM_UTILS_ERROR_CONNECTION_AVAILABLE_TEMPORARY,

			                            "s390 subchannels don't match");

			return FALSE;

		}

		perm_hw_addr = nm_device_get_permanent_hw_address (device);

		mac = nm_setting_wired_get_mac_address (s_wired);

		if (perm_hw_addr) {

			if (   try_mac

			    && mac

			    && !nm_utils_hwaddr_matches (mac, -1, perm_hw_addr, -1)) {

				nm_utils_error_set_literal (error, NM_UTILS_ERROR_CONNECTION_AVAILABLE_TEMPORARY,

				                            "permanent MAC address doesn't match");

				return FALSE;

			}

			/* Check for MAC address blacklist */

			mac_blacklist = nm_setting_wired_get_mac_address_blacklist (s_wired);

			for (i = 0; mac_blacklist[i]; i++) {

				if (!nm_utils_hwaddr_valid (mac_blacklist[i], ETH_ALEN)) {

					nm_utils_error_set_literal (error, NM_UTILS_ERROR_CONNECTION_AVAILABLE_TEMPORARY,

					                            "invalid MAC in blacklist");

					return FALSE;

				}

				if (nm_utils_hwaddr_matches (mac_blacklist[i], -1, perm_hw_addr, -1)) {

					nm_utils_error_set_literal (error, NM_UTILS_ERROR_CONNECTION_AVAILABLE_TEMPORARY,

					                            "permanent MAC address of device blacklisted");

					return FALSE;

				}

			}

		} else if (mac) {

			nm_utils_error_set_literal (error, NM_UTILS_ERROR_CONNECTION_AVAILABLE_TEMPORARY,

			                            "device has no permanent MAC address to match");

			return FALSE;

		}

	}

	return TRUE;

}

/*****************************************************************************/

/* 802.1X */

static void

supplicant_interface_release (NMDeviceEthernet *self)

{

	NMDeviceEthernetPrivate *priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);

	nm_clear_pointer (&priv->supplicant.create_handle, nm_supplicant_manager_create_interface_cancel);

	nm_clear_g_source (&priv->supplicant.lnk_timeout_id);

	nm_clear_g_source (&priv->supplicant.con_timeout_id);

	nm_clear_g_signal_handler (priv->supplicant.iface, &priv->supplicant.iface_state_id);

	nm_clear_g_signal_handler (priv->supplicant.iface, &priv->supplicant.auth_state_id);

	if (priv->supplicant.iface) {

		nm_supplicant_interface_disconnect (priv->supplicant.iface);

		g_clear_object (&priv->supplicant.iface);

	}

}

static void

supplicant_auth_state_changed (NMSupplicantInterface *iface,

                               GParamSpec *pspec,

                               NMDeviceEthernet *self)

{

	NMDeviceEthernetPrivate *priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);

	NMSupplicantAuthState state;

	state = nm_supplicant_interface_get_auth_state (priv->supplicant.iface);

	_LOGD (LOGD_CORE, "supplicant auth state changed to %u", (unsigned) state);

	if (state == NM_SUPPLICANT_AUTH_STATE_SUCCESS) {

		nm_clear_g_signal_handler (priv->supplicant.iface, &priv->supplicant.iface_state_id);

		nm_device_update_dynamic_ip_setup (NM_DEVICE (self));

	}

}

static gboolean

wired_auth_is_optional (NMDeviceEthernet *self)

{

	NMSetting8021x *s_8021x;

	s_8021x = nm_device_get_applied_setting (NM_DEVICE (self), NM_TYPE_SETTING_802_1X);

	g_return_val_if_fail (s_8021x, FALSE);

	return nm_setting_802_1x_get_optional (s_8021x);

}

static void

wired_auth_cond_fail (NMDeviceEthernet *self, NMDeviceStateReason reason)

{

	NMDeviceEthernetPrivate *priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);

	NMDevice *device = NM_DEVICE (self);

	if (wired_auth_is_optional (self)) {

		_LOGI (LOGD_DEVICE | LOGD_ETHER,

		       "Activation: (ethernet) 802.1X authentication is optional, continuing after a failure");

		if (NM_IN_SET (nm_device_get_state (device),

		               NM_DEVICE_STATE_CONFIG,

		               NM_DEVICE_STATE_NEED_AUTH))

			nm_device_activate_schedule_stage3_ip_config_start (device);

		if (!priv->supplicant.auth_state_id) {

			priv->supplicant.auth_state_id = g_signal_connect (priv->supplicant.iface,

			                                                   "notify::" NM_SUPPLICANT_INTERFACE_AUTH_STATE,

			                                                   G_CALLBACK (supplicant_auth_state_changed),

			                                                   self);

		}

		return;

	}

	supplicant_interface_release (self);

	nm_device_state_changed (NM_DEVICE (self),

	                         NM_DEVICE_STATE_FAILED,

	                         reason);

}

static void

wired_secrets_cb (NMActRequest *req,

                  NMActRequestGetSecretsCallId *call_id,

                  NMSettingsConnection *connection,

                  GError *error,

                  gpointer user_data)

{

	NMDeviceEthernet *self = user_data;

	NMDevice *device = user_data;

	NMDeviceEthernetPrivate *priv;

	g_return_if_fail (NM_IS_DEVICE_ETHERNET (self));

	g_return_if_fail (NM_IS_ACT_REQUEST (req));

	priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);

	g_return_if_fail (priv->wired_secrets_id == call_id);

	priv->wired_secrets_id = NULL;

	if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED))

		return;

	g_return_if_fail (req == nm_device_get_act_request (device));

	g_return_if_fail (nm_device_get_state (device) == NM_DEVICE_STATE_NEED_AUTH);

	g_return_if_fail (nm_act_request_get_settings_connection (req) == connection);

	if (error) {

		_LOGW (LOGD_ETHER, "%s", error->message);

		wired_auth_cond_fail (self, NM_DEVICE_STATE_REASON_NO_SECRETS);

		return;

	}

	supplicant_interface_release (self);

	nm_device_activate_schedule_stage1_device_prepare (device, FALSE);

}

static void

wired_secrets_cancel (NMDeviceEthernet *self)

{

	NMDeviceEthernetPrivate *priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);

	if (priv->wired_secrets_id)

		nm_act_request_cancel_secrets (NULL, priv->wired_secrets_id);

	nm_assert (!priv->wired_secrets_id);

}

static void

wired_secrets_get_secrets (NMDeviceEthernet *self,

                           const char *setting_name,

                           NMSecretAgentGetSecretsFlags flags)

{

	NMDeviceEthernetPrivate *priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);

	NMActRequest *req;

	wired_secrets_cancel (self);

	req = nm_device_get_act_request (NM_DEVICE (self));

	g_return_if_fail (NM_IS_ACT_REQUEST (req));

	priv->wired_secrets_id = nm_act_request_get_secrets (req,

	                                                     TRUE,

	                                                     setting_name,

	                                                     flags,

	                                                     NULL,

	                                                     wired_secrets_cb,

	                                                     self);

	g_return_if_fail (priv->wired_secrets_id);

}

static gboolean

supplicant_lnk_timeout_cb (gpointer user_data)

{

	NMDeviceEthernet *self = NM_DEVICE_ETHERNET (user_data);

	NMDeviceEthernetPrivate *priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);

	NMDevice *device = NM_DEVICE (self);

	NMActRequest *req;

	NMConnection *applied_connection;

	const char *setting_name;

	priv->supplicant.lnk_timeout_id = 0;

	req = nm_device_get_act_request (device);

	if (nm_device_get_state (device) == NM_DEVICE_STATE_ACTIVATED) {

		wired_auth_cond_fail (self, NM_DEVICE_STATE_REASON_SUPPLICANT_TIMEOUT);

		return G_SOURCE_REMOVE;

	}

	/* Disconnect event during initial authentication and credentials

	 * ARE checked - we are likely to have wrong key.  Ask the user for

	 * another one.

	 */

	if (nm_device_get_state (device) != NM_DEVICE_STATE_CONFIG)

		goto time_out;

	nm_active_connection_clear_secrets (NM_ACTIVE_CONNECTION (req));

	applied_connection = nm_act_request_get_applied_connection (req);

	setting_name = nm_connection_need_secrets (applied_connection, NULL);

	if (!setting_name)

		goto time_out;

	_LOGI (LOGD_DEVICE | LOGD_ETHER,

	       "Activation: (ethernet) disconnected during authentication, asking for new key.");

	if (!wired_auth_is_optional (self))

		supplicant_interface_release (self);

	nm_device_state_changed (device, NM_DEVICE_STATE_NEED_AUTH, NM_DEVICE_STATE_REASON_SUPPLICANT_DISCONNECT);

	wired_secrets_get_secrets (self, setting_name, NM_SECRET_AGENT_GET_SECRETS_FLAG_REQUEST_NEW);

	return G_SOURCE_REMOVE;

time_out:

	_LOGW (LOGD_DEVICE | LOGD_ETHER, "link timed out.");

	wired_auth_cond_fail (self, NM_DEVICE_STATE_REASON_SUPPLICANT_DISCONNECT);

	return G_SOURCE_REMOVE;

}

static NMSupplicantConfig *

build_supplicant_config (NMDeviceEthernet *self,

                         GError **error)

{

	const char *con_uuid;

	NMSupplicantConfig *config = NULL;

	NMSetting8021x *security;

	NMConnection *connection;

	guint32 mtu;

	connection = nm_device_get_applied_connection (NM_DEVICE (self));

	g_return_val_if_fail (connection, NULL);

	con_uuid = nm_connection_get_uuid (connection);

	mtu = nm_platform_link_get_mtu (nm_device_get_platform (NM_DEVICE (self)),

	                                nm_device_get_ifindex (NM_DEVICE (self)));

	config = nm_supplicant_config_new (NM_SUPPL_CAP_MASK_NONE);

	security = nm_connection_get_setting_802_1x (connection);

	if (!nm_supplicant_config_add_setting_8021x (config, security, con_uuid, mtu, TRUE, error)) {

		g_prefix_error (error, "802-1x-setting: ");

		g_clear_object (&config);

	}

	return config;

}

static void

supplicant_iface_state_is_completed (NMDeviceEthernet *self,

                                     NMSupplicantInterfaceState state)

{

	NMDeviceEthernetPrivate *priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);

	if (state == NM_SUPPLICANT_INTERFACE_STATE_COMPLETED) {

		nm_clear_g_source (&priv->supplicant.lnk_timeout_id);

		nm_clear_g_source (&priv->supplicant.con_timeout_id);

		/* If this is the initial association during device activation,

		 * schedule the next activation stage.

		 */

		if (nm_device_get_state (NM_DEVICE (self)) == NM_DEVICE_STATE_CONFIG) {

			_LOGI (LOGD_DEVICE | LOGD_ETHER,

			       "Activation: (ethernet) Stage 2 of 5 (Device Configure) successful.");

			nm_device_activate_schedule_stage3_ip_config_start (NM_DEVICE (self));

		}

		return;

	}

	if (   !priv->supplicant.lnk_timeout_id

	    && !priv->supplicant.con_timeout_id)

		priv->supplicant.lnk_timeout_id = g_timeout_add_seconds (SUPPLICANT_LNK_TIMEOUT_SEC, supplicant_lnk_timeout_cb, self);

}

static void

supplicant_iface_assoc_cb (NMSupplicantInterface *iface,

                           GError *error,

                           gpointer user_data)

{

	NMDeviceEthernet *self;

	NMDeviceEthernetPrivate *priv;

	if (nm_utils_error_is_cancelled_or_disposing (error))

		return;

	self = NM_DEVICE_ETHERNET (user_data);

	priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);

	if (error) {

		supplicant_interface_release (self);

		nm_device_queue_state (NM_DEVICE (self),

		                       NM_DEVICE_STATE_FAILED,

		                       NM_DEVICE_STATE_REASON_SUPPLICANT_CONFIG_FAILED);

		return;

	}

	nm_assert (!priv->supplicant.lnk_timeout_id);

	nm_assert (!priv->supplicant.is_associated);

	priv->supplicant.is_associated = TRUE;

	supplicant_iface_state_is_completed (self,

	                                     nm_supplicant_interface_get_state (priv->supplicant.iface));

}

static gboolean

supplicant_iface_start (NMDeviceEthernet *self)

{

	NMDeviceEthernetPrivate *priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);

	gs_unref_object NMSupplicantConfig *config = NULL;

	gs_free_error GError *error = NULL;

	config = build_supplicant_config (self, &error);

	if (!config) {

		_LOGE (LOGD_DEVICE | LOGD_ETHER,

		       "Activation: (ethernet) couldn't build security configuration: %s",

		       error->message);

		supplicant_interface_release (self);

		nm_device_state_changed (NM_DEVICE (self),

		                         NM_DEVICE_STATE_FAILED,

		                         NM_DEVICE_STATE_REASON_SUPPLICANT_CONFIG_FAILED);

		return FALSE;

	}

	nm_supplicant_interface_disconnect (priv->supplicant.iface);

	nm_supplicant_interface_assoc (priv->supplicant.iface,

	                               config,

	                               supplicant_iface_assoc_cb,

	                               self);

	return TRUE;

}

static void

supplicant_iface_state_cb (NMSupplicantInterface *iface,

                           int new_state_i,

                           int old_state_i,

                           int disconnect_reason,

                           gpointer user_data)

{

	NMDeviceEthernet *self = NM_DEVICE_ETHERNET (user_data);

	NMDeviceEthernetPrivate *priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);

	NMSupplicantInterfaceState new_state = new_state_i;

	NMSupplicantInterfaceState old_state = old_state_i;

	_LOGI (LOGD_DEVICE | LOGD_ETHER, "supplicant interface state: %s -> %s",

	       nm_supplicant_interface_state_to_string (old_state),

	       nm_supplicant_interface_state_to_string (new_state));

	if (new_state == NM_SUPPLICANT_INTERFACE_STATE_DOWN) {

		supplicant_interface_release (self);

		wired_auth_cond_fail (self, NM_DEVICE_STATE_REASON_SUPPLICANT_FAILED);

		return;

	}

	if (old_state == NM_SUPPLICANT_INTERFACE_STATE_STARTING) {

		if (!supplicant_iface_start (self))

			return;

	}

	if (priv->supplicant.is_associated)

		supplicant_iface_state_is_completed (self, new_state);

}

static gboolean

handle_auth_or_fail (NMDeviceEthernet *self,

                     NMActRequest *req,

                     gboolean new_secrets)

{

	const char *setting_name;

	NMConnection *applied_connection;

	if (!nm_device_auth_retries_try_next (NM_DEVICE (self)))

		return FALSE;

	nm_device_state_changed (NM_DEVICE (self), NM_DEVICE_STATE_NEED_AUTH, NM_DEVICE_STATE_REASON_NONE);

	nm_active_connection_clear_secrets (NM_ACTIVE_CONNECTION (req));

	applied_connection = nm_act_request_get_applied_connection (req);

	setting_name = nm_connection_need_secrets (applied_connection, NULL);

	if (!setting_name) {

		_LOGI (LOGD_DEVICE, "Cleared secrets, but setting didn't need any secrets.");

		return FALSE;

	}

	_LOGI (LOGD_DEVICE | LOGD_ETHER, "Activation: (ethernet) asking for new secrets");

	/* Don't tear down supplicant if the authentication is optional

	 * because in case of a failure in getting new secrets we want to

	 * keep the supplicant alive.

	 */

	if (!wired_auth_is_optional (self))

		supplicant_interface_release (self);

	wired_secrets_get_secrets (self, setting_name,

	                             NM_SECRET_AGENT_GET_SECRETS_FLAG_ALLOW_INTERACTION

	                           | (new_secrets ? NM_SECRET_AGENT_GET_SECRETS_FLAG_REQUEST_NEW : 0));

	return TRUE;

}

static gboolean

supplicant_connection_timeout_cb (gpointer user_data)

{

	NMDeviceEthernet *self = NM_DEVICE_ETHERNET (user_data);

	NMDeviceEthernetPrivate *priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);

	NMDevice *device = NM_DEVICE (self);

	NMActRequest *req;

	NMSettingsConnection *connection;

	guint64 timestamp = 0;

	gboolean new_secrets = TRUE;

	priv->supplicant.con_timeout_id = 0;

	/* Authentication failed; either driver problems, the encryption key is

	 * wrong, the passwords or certificates were wrong or the Ethernet switch's

	 * port is not configured for 802.1x. */

	_LOGW (LOGD_DEVICE | LOGD_ETHER,

	       "Activation: (ethernet) association took too long.");

	req = nm_device_get_act_request (device);

	connection = nm_act_request_get_settings_connection (req);

	/* Ask for new secrets only if we've never activated this connection

	 * before.  If we've connected before, don't bother the user with dialogs,

	 * just retry or fail, and if we never connect the user can fix the

	 * password somewhere else. */

	if (nm_settings_connection_get_timestamp (connection, &timestamp))

		new_secrets = !timestamp;

	if (!handle_auth_or_fail (self, req, new_secrets)) {

		wired_auth_cond_fail (self, NM_DEVICE_STATE_REASON_NO_SECRETS);

		return G_SOURCE_REMOVE;

	}

	if (   !priv->supplicant.lnk_timeout_id

	    && priv->supplicant.iface) {

		NMSupplicantInterfaceState state;

		state = nm_supplicant_interface_get_state (priv->supplicant.iface);

		if (state != NM_SUPPLICANT_INTERFACE_STATE_COMPLETED

		    && nm_supplicant_interface_state_is_operational (state))

			priv->supplicant.lnk_timeout_id = g_timeout_add_seconds (SUPPLICANT_LNK_TIMEOUT_SEC, supplicant_lnk_timeout_cb, self);

	}

	return G_SOURCE_REMOVE;

}

static void

supplicant_interface_create_cb (NMSupplicantManager *supplicant_manager,

                                NMSupplMgrCreateIfaceHandle *handle,

                                NMSupplicantInterface *iface,

                                GError *error,

                                gpointer user_data)

{

	NMDeviceEthernet *self;

	NMDeviceEthernetPrivate *priv;

	guint timeout;

	if (nm_utils_error_is_cancelled (error))

		return;

	self = user_data;

	priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);

	nm_assert (priv->supplicant.create_handle == handle);

	priv->supplicant.create_handle = NULL;

	if (error) {

		_LOGE (LOGD_DEVICE | LOGD_ETHER,

		       "Couldn't initialize supplicant interface: %s",

		       error->message);

		supplicant_interface_release (self);

		nm_device_state_changed (NM_DEVICE (self),

		                         NM_DEVICE_STATE_FAILED,

		                         NM_DEVICE_STATE_REASON_SUPPLICANT_FAILED);

		return;

	}

	priv->supplicant.iface = g_object_ref (iface);

	priv->supplicant.is_associated = FALSE;

	priv->supplicant.iface_state_id = g_signal_connect (priv->supplicant.iface,

	                                                    NM_SUPPLICANT_INTERFACE_STATE,

	                                                    G_CALLBACK (supplicant_iface_state_cb),

	                                                    self);

	timeout = nm_device_get_supplicant_timeout (NM_DEVICE (self));

	priv->supplicant.con_timeout_id = g_timeout_add_seconds (timeout,

	                                                         supplicant_connection_timeout_cb,

	                                                         self);

	if (nm_supplicant_interface_state_is_operational (nm_supplicant_interface_get_state (iface)))

		supplicant_iface_start (self);

}

static NMPlatformLinkDuplexType

link_duplex_to_platform (const char *duplex)

{

	if (!duplex)