Skip to content

Commit 4bf3d61

Browse files
qbdwlrqbdwlr
authored
[macsecmgrd] MACsec XPN changes (sonic-net#1821)
* MACsec XPN changes * MACsec XPN changes
1 parent 756471a commit 4bf3d61

File tree

4 files changed

+82
-26
lines changed

4 files changed

+82
-26
lines changed

‎cfgmgr/macsecmgr.cpp

+40
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,32 @@ static void lexical_convert(const std::string &policy_str, MACsecMgr::MACsecProf
5252
}
5353
}
5454

55+
static void lexical_convert(const std::string &cipher_str, MACsecMgr::MACsecProfile::CipherSuite & cipher_suite)
56+
{
57+
SWSS_LOG_ENTER();
58+
59+
if (boost::iequals(cipher_str, "GCM-AES-128"))
60+
{
61+
cipher_suite = MACsecMgr::MACsecProfile::CipherSuite::GCM_AES_128;
62+
}
63+
else if (boost::iequals(cipher_str, "GCM-AES-256"))
64+
{
65+
cipher_suite = MACsecMgr::MACsecProfile::CipherSuite::GCM_AES_256;
66+
}
67+
else if (boost::iequals(cipher_str, "GCM-AES-XPN-128"))
68+
{
69+
cipher_suite = MACsecMgr::MACsecProfile::CipherSuite::GCM_AES_XPN_128;
70+
}
71+
else if (boost::iequals(cipher_str, "GCM-AES-XPN-256"))
72+
{
73+
cipher_suite = MACsecMgr::MACsecProfile::CipherSuite::GCM_AES_XPN_256;
74+
}
75+
else
76+
{
77+
throw std::invalid_argument("Invalid cipher_suite : " + cipher_str);
78+
}
79+
}
80+
5581
template<class T>
5682
static bool get_value(
5783
const MACsecMgr::TaskArgs & ta,
@@ -686,6 +712,20 @@ bool MACsecMgr::configureMACsec(
686712
"mka_priority",
687713
profile.priority);
688714

715+
wpa_cli_exec_and_check(
716+
session.sock,
717+
port_name,
718+
network_id,
719+
"macsec_ciphersuite",
720+
profile.cipher_suite);
721+
722+
wpa_cli_exec_and_check(
723+
session.sock,
724+
port_name,
725+
network_id,
726+
"macsec_include_sci",
727+
(profile.send_sci ? 1 : 0));
728+
689729
wpa_cli_exec_and_check(
690730
session.sock,
691731
port_name,

‎cfgmgr/macsecmgr.h

+7-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,13 @@ class MACsecMgr : public Orch
2828
struct MACsecProfile
2929
{
3030
std::uint32_t priority;
31-
std::string cipher_suite;
31+
enum CipherSuite
32+
{
33+
GCM_AES_128,
34+
GCM_AES_256,
35+
GCM_AES_XPN_128,
36+
GCM_AES_XPN_256,
37+
} cipher_suite;
3238
std::string primary_cak;
3339
std::string primary_ckn;
3440
std::string fallback_cak;

‎orchagent/macsecorch.cpp

+4-2
Original file line numberDiff line numberDiff line change
@@ -219,7 +219,7 @@ class MACsecOrchContext
219219

220220
sai_object_id_t *get_port_id()
221221
{
222-
if(m_port_id == nullptr)
222+
if (m_port_id == nullptr)
223223
{
224224
auto port = get_port();
225225
if (port == nullptr)
@@ -2231,7 +2231,9 @@ bool MACsecOrch::createMACsecACLDataEntry(
22312231
if (sci_in_sectag)
22322232
{
22332233
attr.id = SAI_ACL_ENTRY_ATTR_FIELD_MACSEC_SCI;
2234-
attr.value.u64 = sci;
2234+
attr.value.aclfield.enable = true;
2235+
attr.value.aclfield.mask.u64 = 0xFFFFFFFFFFFFFFFF;
2236+
attr.value.aclfield.data.u64 = sci;
22352237
attrs.push_back(attr);
22362238
}
22372239

‎tests/test_macsec.py

+31-23
Original file line numberDiff line numberDiff line change
@@ -102,34 +102,34 @@ def gen_sci(macsec_system_identifier: str, macsec_port_identifier: int) -> str:
102102

103103

104104
def gen_sc_key(
105-
seperator: str,
105+
separator: str,
106106
port_name: str,
107107
macsec_system_identifier: str,
108108
macsec_port_identifier: int) -> str:
109109
sci = gen_sci(macsec_system_identifier, macsec_port_identifier)
110110
key = "{}{}{}".format(
111111
port_name,
112-
seperator,
112+
separator,
113113
sci)
114114
return key
115115

116116

117117
def gen_sa_key(
118-
seperator: str,
118+
separator: str,
119119
port_name: str,
120120
macsec_system_identifier: str,
121121
macsec_port_identifier: int,
122122
an: int):
123123
sc_key = gen_sc_key(
124-
seperator,
124+
separator,
125125
port_name,
126126
macsec_system_identifier,
127127
macsec_port_identifier)
128-
key = "{}{}{}".format(sc_key, seperator, an)
128+
key = "{}{}{}".format(sc_key, separator, an)
129129
return key
130130

131131

132-
def macsec_sc(seperator: str = AppDBTable.SEPARATOR):
132+
def macsec_sc(separator: str = AppDBTable.SEPARATOR):
133133
def inner(func: typing.Callable) -> typing.Callable:
134134
@functools.wraps(func)
135135
def wrap_func(
@@ -140,7 +140,7 @@ def wrap_func(
140140
*args,
141141
**kwargs) -> typing.Any:
142142
key = gen_sc_key(
143-
seperator,
143+
separator,
144144
port_name,
145145
macsec_system_identifier,
146146
macsec_port_identifier)
@@ -149,7 +149,7 @@ def wrap_func(
149149
return inner
150150

151151

152-
def macsec_sa(seperator: str = AppDBTable.SEPARATOR):
152+
def macsec_sa(separator: str = AppDBTable.SEPARATOR):
153153
def inner(func: typing.Callable) -> typing.Callable:
154154
@functools.wraps(func)
155155
def wrap_func(
@@ -161,7 +161,7 @@ def wrap_func(
161161
*args,
162162
**kwargs) -> typing.Any:
163163
key = gen_sa_key(
164-
seperator,
164+
separator,
165165
port_name,
166166
macsec_system_identifier,
167167
macsec_port_identifier,
@@ -216,8 +216,8 @@ def set_macsec_control(self, port_name: str, enable: bool):
216216
self.app_port_table[port_name] = {"enable": True}
217217

218218
@macsec_sc()
219-
def create_receive_sc(self, sci: str, ssci: int):
220-
self.app_receive_sc_table[sci] = {"ssci": ssci}
219+
def create_receive_sc(self, sci: str):
220+
self.app_receive_sc_table[sci] = {"NULL": "NULL"}
221221
self.state_receive_sc_table.wait(sci)
222222

223223
@macsec_sc()
@@ -226,8 +226,8 @@ def delete_receive_sc(self, sci: str):
226226
self.state_receive_sc_table.wait_delete(sci)
227227

228228
@macsec_sc()
229-
def create_transmit_sc(self, sci: str, ssci: int):
230-
self.app_transmit_sc_table[sci] = {"sci": sci, "encoding_an": 0}
229+
def create_transmit_sc(self, sci: str):
230+
self.app_transmit_sc_table[sci] = {"encoding_an": 0}
231231
self.state_transmit_sc_table.wait(sci)
232232

233233
@macsec_sc()
@@ -240,6 +240,7 @@ def check_valid_sa_parameter(
240240
sak: str,
241241
auth_key: str,
242242
lowest_acceptable_pn: int,
243+
ssci: int,
243244
salt: str) -> bool:
244245
# Check SAK is hex string
245246
int(sak, 16)
@@ -268,17 +269,20 @@ def create_receive_sa(
268269
sak: str,
269270
auth_key: str,
270271
lowest_acceptable_pn: int,
272+
ssci: int,
271273
salt: str):
272274
assert(
273275
self.check_valid_sa_parameter(
274276
sak,
275277
auth_key,
276278
lowest_acceptable_pn,
279+
ssci,
277280
salt),
278281
"Wrong parameter to MACsec receive SA")
279282
self.app_receive_sa_table[sai] = {
280283
"active": False, "sak": sak, "auth_key": auth_key,
281-
"lowest_acceptable_pn": lowest_acceptable_pn, "salt": salt}
284+
"lowest_acceptable_pn": lowest_acceptable_pn,
285+
"ssci": ssci, "salt": salt}
282286

283287
@macsec_sa()
284288
def delete_receive_sa(self, sai: str):
@@ -298,17 +302,19 @@ def create_transmit_sa(
298302
sak: str,
299303
auth_key: str,
300304
init_pn: int,
305+
ssci: int,
301306
salt: str):
302307
assert(
303308
self.check_valid_sa_parameter(
304309
sak,
305310
auth_key,
306311
init_pn,
312+
ssci,
307313
salt),
308314
"Wrong parameter to MACsec receive SA")
309315
self.app_transmit_sa_table[sai] = {
310316
"sak": sak, "auth_key": auth_key,
311-
"next_pn": init_pn, "salt": salt}
317+
"next_pn": init_pn, "ssci": ssci, "salt": salt}
312318

313319
@macsec_sa()
314320
def delete_transmit_sa(self, sai: str):
@@ -388,8 +394,7 @@ def init_macsec(
388394
wpa: WPASupplicantMock,
389395
port_name: str,
390396
local_mac_address: str,
391-
macsec_port_identifier: int,
392-
ssci: int):
397+
macsec_port_identifier: int):
393398
wpa.init_macsec_port(port_name)
394399
wpa.config_macsec_port(port_name, {"enable_protect": True})
395400
wpa.config_macsec_port(port_name, {"enable_encrypt": True})
@@ -403,8 +408,7 @@ def init_macsec(
403408
wpa.create_transmit_sc(
404409
port_name,
405410
local_mac_address,
406-
macsec_port_identifier,
407-
ssci)
411+
macsec_port_identifier)
408412

409413
def establish_macsec(
410414
self,
@@ -422,8 +426,7 @@ def establish_macsec(
422426
wpa.create_receive_sc(
423427
port_name,
424428
peer_mac_address,
425-
macsec_port_identifier,
426-
ssci)
429+
macsec_port_identifier)
427430
wpa.create_receive_sa(
428431
port_name,
429432
peer_mac_address,
@@ -432,6 +435,7 @@ def establish_macsec(
432435
sak,
433436
auth_key,
434437
packet_number,
438+
ssci,
435439
salt)
436440
wpa.create_transmit_sa(
437441
port_name,
@@ -441,6 +445,7 @@ def establish_macsec(
441445
sak,
442446
auth_key,
443447
packet_number,
448+
ssci,
444449
salt)
445450
wpa.set_enable_receive_sa(
446451
port_name,
@@ -468,6 +473,7 @@ def rekey_macsec(
468473
sak: str,
469474
packet_number: int,
470475
auth_key: str,
476+
ssci: int,
471477
salt: str):
472478
wpa.create_receive_sa(
473479
port_name,
@@ -477,6 +483,7 @@ def rekey_macsec(
477483
sak,
478484
auth_key,
479485
packet_number,
486+
ssci,
480487
salt)
481488
wpa.create_transmit_sa(
482489
port_name,
@@ -486,6 +493,7 @@ def rekey_macsec(
486493
sak,
487494
auth_key,
488495
packet_number,
496+
ssci,
489497
salt)
490498
wpa.set_enable_receive_sa(
491499
port_name,
@@ -606,8 +614,7 @@ def test_macsec_term_orch(self, dvs: conftest.DockerVirtualSwitch, testlog):
606614
wpa,
607615
port_name,
608616
local_mac_address,
609-
macsec_port_identifier,
610-
ssci)
617+
macsec_port_identifier)
611618
self.establish_macsec(
612619
wpa,
613620
port_name,
@@ -654,6 +661,7 @@ def test_macsec_term_orch(self, dvs: conftest.DockerVirtualSwitch, testlog):
654661
sak,
655662
packet_number,
656663
auth_key,
664+
ssci,
657665
salt)
658666
assert(
659667
inspector.get_macsec_sa(

0 commit comments

Comments
 (0)