Update macsec CAK keys in profile for tests to change to type7 encoded format (#16388) (#16626)

mssonicbld · judyjoseph · web-flow · commit 1726eb3eb794 · 2023-09-21T20:39:01.000+08:00
* Change the CAK key length check in config plugin, macsec test profile changes * Fix the format in add_profile api The changes needed in various macsec unit tests and config plugin when we move to accept the type 7 encoded key format for macsec. This goes along with PR : sonic-net/sonic-swss#2892 raised earlier. Co-authored-by: judyjoseph <53951155+judyjoseph@users.noreply.github.com>
diff --git a/dockers/docker-macsec/cli-plugin-tests/config_db.json b/dockers/docker-macsec/cli-plugin-tests/config_db.json
@@ -2,7 +2,7 @@
     "MACSEC_PROFILE|macsec_profile": {
             "cipher_suite": "GCM-AES-XPN-256",
             "policy": "security",
-            "primary_cak": "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF",
+            "primary_cak": "5207554155500e5d5157786d6c2a3d2031425a5e577e7e727f6b6c03312432262706080a00005b554f4e007975707670725b0a54540c0252445e5d7a29252b046a",
             "primary_ckn": "6162636465666768696A6B6C6D6E6F707172737475767778797A303132333435",
             "priority": "0",
             "rekey_period": "900",
diff --git a/dockers/docker-macsec/cli-plugin-tests/test_config_macsec.py b/dockers/docker-macsec/cli-plugin-tests/test_config_macsec.py
@@ -8,7 +8,7 @@
 
 
 profile_name = "test"
-primary_cak = "01234567890123456789012345678912"
+primary_cak = "2363647040534355560e000802065d574d400e000e030307075f0e5050000e5541"
 primary_ckn = "01234567890123456789012345678912"
 
 
@@ -48,7 +48,7 @@ def test_macsec_valid_profile(self, mock_cfgdb):
 
         profile_name = "test"
         profile_map = {
-            "primary_cak": "0123456789012345678901234567891201234567890123456789012345678912",
+            "primary_cak": "3946080a0407070303530256560a04504650530352565e731f1a5c4f524f4b5a5e547b79777c6663754b5e465253050d0d0503565a48470b0b030604020c520a54",
             "primary_ckn": "01234567890123456789012345678912",
             "priority": 64,
             "cipher_suite": "GCM-AES-XPN-256",
@@ -109,7 +109,7 @@ def test_macsec_port(self, mock_cfgdb):
         runner = CliRunner()
 
         result = runner.invoke(macsec.macsec, ["profile", "add", "test",
-                "--primary_cak=01234567890123456789012345678912","--primary_ckn=01234567890123456789012345678912"],
+                "--primary_cak=2363647040534355560e000802065d574d400e000e030307075f0e5050000e5541","--primary_ckn=01234567890123456789012345678912"],
                 obj=cfgdb)
         assert result.exit_code == 0, "exit code: {}, Exception: {}, Traceback: {}".format(result.exit_code, result.exception, result.exc_info)
         result = runner.invoke(macsec.macsec, ["port", "add", "Ethernet0", "test"], obj=cfgdb)
@@ -141,8 +141,8 @@ def test_macsec_invalid_operation(self, mock_cfgdb):
         result = runner.invoke(macsec.macsec, ["profile", "del", "test"], obj=cfgdb)
         assert result.exit_code != 0
 
-        result = runner.invoke(macsec.macsec, ["profile", "add", "test", "--primary_cak=01234567890123456789012345678912","--primary_ckn=01234567890123456789012345678912"], obj=cfgdb)
+        result = runner.invoke(macsec.macsec, ["profile", "add", "test", "--primary_cak=2363647040534355560e000802065d574d400e000e030307075f0e5050000e5541","--primary_ckn=01234567890123456789012345678912"], obj=cfgdb)
         assert result.exit_code == 0, "exit code: {}, Exception: {}, Traceback: {}".format(result.exit_code, result.exception, result.exc_info)
         # Repeat add profile
-        result = runner.invoke(macsec.macsec, ["profile", "add", "test", "--primary_cak=01234567890123456789012345678912","--primary_ckn=01234567890123456789012345678912"], obj=cfgdb)
+        result = runner.invoke(macsec.macsec, ["profile", "add", "test", "--primary_cak=2363647040534355560e000802065d574d400e000e030307075f0e5050000e5541","--primary_ckn=01234567890123456789012345678912"], obj=cfgdb)
         assert result.exit_code != 0
diff --git a/dockers/docker-macsec/cli/config/plugins/macsec.py b/dockers/docker-macsec/cli/config/plugins/macsec.py
@@ -137,11 +137,11 @@ def add_profile(profile, priority, cipher_suite, primary_cak, primary_ckn, polic
     profile_table["cipher_suite"] = cipher_suite
 
     if "128" in cipher_suite:
-        if len(primary_cak) != 32:
-            ctx.fail("Expect the length of CAK is 32, but got {}".format(len(primary_cak)))
+        if len(primary_cak) != 66:
+            ctx.fail("Expect the length of CAK is 66, but got {}".format(len(primary_cak)))
     elif "256" in cipher_suite:
-        if len(primary_cak) != 64:
-            ctx.fail("Expect the length of CAK is 64, but got {}".format(len(primary_cak)))
+        if len(primary_cak) != 130:
+            ctx.fail("Expect the length of CAK is 130, but got {}".format(len(primary_cak)))
     if not is_hexstring(primary_cak):
         ctx.fail("Expect the primary_cak is valid hex string")
     if not is_hexstring(primary_ckn):
diff --git a/src/sonic-config-engine/tests/macsec_profile.json b/src/sonic-config-engine/tests/macsec_profile.json
@@ -2,18 +2,18 @@
     "MACSEC_PROFILE":{
         "macsec-profile": {
             "cipher_suite": "GCM-AES-XPN-256",
-            "primary_cak": "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF",
+            "primary_cak": "5207554155500e5d5157786d6c2a3d2031425a5e577e7e727f6b6c03312432262706080a00005b554f4e007975707670725b0a54540c0252445e5d7a29252b046a",
             "primary_ckn": "6162636465666768696A6B6C6D6E6F707172737475767778797A303132333435",
-            "fallback_cak": "0000000000000000000000000000000000000000000000000000000000000000",
+            "fallback_cak": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
             "fallback_ckn": "1111111111111111111111111111111111111111111111111111111111111111",
             "priority": "0",
             "rekey_period": "60"
         },
         "macsec-profile2": {
             "cipher_suite": "GCM-AES-XPN-256",
-            "primary_cak": "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF",
+            "primary_cak": "5207554155500e5d5157786d6c2a3d2031425a5e577e7e727f6b6c03312432262706080a00005b554f4e007975707670725b0a54540c0252445e5d7a29252b046a",
             "primary_ckn": "6162636465666768696A6B6C6D6E6F707172737475767778797A303132333435",
-            "fallback_cak": "0000000000000000000000000000000000000000000000000000000000000000",
+            "fallback_cak": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
             "fallback_ckn": "1111111111111111111111111111111111111111111111111111111111111111",
             "priority": "0",
             "rekey_period": "60"
diff --git a/src/sonic-yang-models/tests/files/sample_config_db.json b/src/sonic-yang-models/tests/files/sample_config_db.json
@@ -2258,9 +2258,9 @@
             "test": {
                 "priority": "64",
                 "cipher_suite": "GCM-AES-128",
-                "primary_cak": "0123456789ABCDEF0123456789ABCDEF",
+                "primary_cak": "1159485744465e5a537272050a1011073557475152020c0e040c57223a357d7d71",
                 "primary_ckn": "6162636465666768696A6B6C6D6E6F70",
-                "fallback_cak": "00000000000000000000000000000000",
+                "fallback_cak": "000000000000000000000000000000000000000000000000000000000000000000",
                 "fallback_ckn": "11111111111111111111111111111111",
                 "policy": "security",
                 "enable_replay_protect": "true",
diff --git a/src/sonic-yang-models/tests/yang_model_tests/tests_config/macsec.json b/src/sonic-yang-models/tests/yang_model_tests/tests_config/macsec.json
@@ -7,9 +7,9 @@
                         "name": "test32",
                         "priority": 64,
                         "cipher_suite": "GCM-AES-128",
-                        "primary_cak": "0123456789ABCDEF0123456789ABCDEF",
+                        "primary_cak": "1159485744465e5a537272050a1011073557475152020c0e040c57223a357d7d71",
                         "primary_ckn": "6162636465666768696A6B6C6D6E6F70",
-                        "fallback_cak": "00000000000000000000000000000000",
+                        "fallback_cak": "000000000000000000000000000000000000000000000000000000000000000000",
                         "fallback_ckn": "11111111111111111111111111111111",
                         "policy": "security",
                         "enable_replay_protect": "true",
@@ -21,9 +21,9 @@
                         "name": "test64",
                         "priority": 64,
                         "cipher_suite": "GCM-AES-XPN-256",
-                        "primary_cak": "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF",
+                        "primary_cak": "5207554155500e5d5157786d6c2a3d2031425a5e577e7e727f6b6c03312432262706080a00005b554f4e007975707670725b0a54540c0252445e5d7a29252b046a",
                         "primary_ckn": "6162636465666768696A6B6C6D6E6F706162636465666768696A6B6C6D6E6F70",
-                        "fallback_cak": "0000000000000000000000000000000000000000000000000000000000000000",
+                        "fallback_cak": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
                         "fallback_ckn": "1111111111111111111111111111111111111111111111111111111111111111",
                         "policy": "security",
                         "enable_replay_protect": "true",
@@ -61,7 +61,7 @@
                     {
                         "name": "test",
                         "cipher_suite": "gcm-aes-128",
-                        "primary_cak": "0123456789ABCDEF0123456789ABCDEF",
+                        "primary_cak": "1159485744465e5a537272050a1011073557475152020c0e040c57223a357d7d71",
                         "primary_ckn": "6162636465666768696A6B6C6D6E6F70"
                     }
                 ]
@@ -74,9 +74,9 @@
                 "MACSEC_PROFILE_LIST": [
                     {
                         "name": "test",
-                        "primary_cak": "0123456789ABCDEF0123456789ABCDEF",
+                        "primary_cak": "1159485744465e5a537272050a1011073557475152020c0e040c57223a357d7d71",
                         "primary_ckn": "6162636465666768696A6B6C6D6E6F70",
-                        "fallback_cak": "0123456789ABCDEF0123456789ABCDEF",
+                        "fallback_cak": "1159485744465e5a537272050a1011073557475152020c0e040c57223a357d7d71",
                         "fallback_ckn": "6162636465666768696A6B6C6D6E6F70"
                     }
                 ]
@@ -89,7 +89,7 @@
                 "MACSEC_PROFILE_LIST": [
                     {
                         "name": "test",
-                        "primary_cak": "0123456789ABCDEF0123456789ABCDEFA",
+                        "primary_cak": "1159485744465e5a537272050a1011073557475152020c0e040c57223a357d7d7",
                         "primary_ckn": "6162636465666768696A6B6C6D6E6F70A"
                     }
                 ]
@@ -115,9 +115,9 @@
                 "MACSEC_PROFILE_LIST": [
                     {
                         "name": "test",
-                        "primary_cak": "0123456789ABCDEF0123456789ABCDEF",
+                        "primary_cak": "1159485744465e5a537272050a1011073557475152020c0e040c57223a357d7d71",
                         "primary_ckn": "6162636465666768696A6B6C6D6E6F70",
-                        "fallback_cak": "0000000000000000000000000000000000000000000000000000000000000000",
+                        "fallback_cak": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
                         "fallback_ckn": "1111111111111111111111111111111111111111111111111111111111111111"
                     }
                 ]
@@ -130,7 +130,7 @@
                 "MACSEC_PROFILE_LIST": [
                     {
                         "name": "test",
-                        "primary_cak": "0123456789ABCDEF0123456789ABCDEF",
+                        "primary_cak": "1159485744465e5a537272050a1011073557475152020c0e040c57223a357d7d71",
                         "primary_ckn": "6162636465666768696A6B6C6D6E6F70",
                         "replay_window": 64
                     }
diff --git a/src/sonic-yang-models/yang-models/sonic-macsec.yang b/src/sonic-yang-models/yang-models/sonic-macsec.yang
@@ -46,7 +46,7 @@ module sonic-macsec {
 
                 leaf primary_cak {
                     type string {
-                        pattern "[0-9a-fA-F]{32}|[0-9a-fA-F]{64}";
+                        pattern "[0-9a-fA-F]{66}|[0-9a-fA-F]{130}";
                     }
                     mandatory true;
                 }
@@ -60,7 +60,7 @@ module sonic-macsec {
 
                 leaf fallback_cak {
                     type string {
-                        pattern "[0-9a-fA-F]{32}|[0-9a-fA-F]{64}";
+                        pattern "[0-9a-fA-F]{66}|[0-9a-fA-F]{130}";
                     }
                 }
 
@@ -70,10 +70,6 @@ module sonic-macsec {
                     }
                 }
 
-                must "string-length(primary_cak) = string-length(primary_ckn)";
-
-                must "string-length(fallback_cak) = string-length(fallback_ckn)";
-
                 must "string-length(fallback_cak) = string-length(primary_cak)";
 
                 must "primary_ckn != fallback_ckn";

Original file line number	Diff line number	Diff line change
`@@ -7,9 +7,9 @@`
`7`	`7`	`"name": "test32",`
`8`	`8`	`"priority": 64,`
`9`	`9`	`"cipher_suite": "GCM-AES-128",`
`10`		`- "primary_cak": "0123456789ABCDEF0123456789ABCDEF",`
	`10`	`+ "primary_cak": "1159485744465e5a537272050a1011073557475152020c0e040c57223a357d7d71",`
`11`	`11`	`"primary_ckn": "6162636465666768696A6B6C6D6E6F70",`
`12`		`- "fallback_cak": "00000000000000000000000000000000",`
	`12`	`+ "fallback_cak": "000000000000000000000000000000000000000000000000000000000000000000",`
`13`	`13`	`"fallback_ckn": "11111111111111111111111111111111",`
`14`	`14`	`"policy": "security",`
`15`	`15`	`"enable_replay_protect": "true",`
`@@ -21,9 +21,9 @@`
`21`	`21`	`"name": "test64",`
`22`	`22`	`"priority": 64,`
`23`	`23`	`"cipher_suite": "GCM-AES-XPN-256",`
`24`		`- "primary_cak": "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF",`
	`24`	`+ "primary_cak": "5207554155500e5d5157786d6c2a3d2031425a5e577e7e727f6b6c03312432262706080a00005b554f4e007975707670725b0a54540c0252445e5d7a29252b046a",`
`25`	`25`	`"primary_ckn": "6162636465666768696A6B6C6D6E6F706162636465666768696A6B6C6D6E6F70",`
`26`		`- "fallback_cak": "0000000000000000000000000000000000000000000000000000000000000000",`
	`26`	`+ "fallback_cak": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",`
`27`	`27`	`"fallback_ckn": "1111111111111111111111111111111111111111111111111111111111111111",`
`28`	`28`	`"policy": "security",`
`29`	`29`	`"enable_replay_protect": "true",`
`@@ -61,7 +61,7 @@`
`61`	`61`	`{`
`62`	`62`	`"name": "test",`
`63`	`63`	`"cipher_suite": "gcm-aes-128",`
`64`		`- "primary_cak": "0123456789ABCDEF0123456789ABCDEF",`
	`64`	`+ "primary_cak": "1159485744465e5a537272050a1011073557475152020c0e040c57223a357d7d71",`
`65`	`65`	`"primary_ckn": "6162636465666768696A6B6C6D6E6F70"`
`66`	`66`	`}`
`67`	`67`	`]`
`@@ -74,9 +74,9 @@`
`74`	`74`	`"MACSEC_PROFILE_LIST": [`
`75`	`75`	`{`
`76`	`76`	`"name": "test",`
`77`		`- "primary_cak": "0123456789ABCDEF0123456789ABCDEF",`
	`77`	`+ "primary_cak": "1159485744465e5a537272050a1011073557475152020c0e040c57223a357d7d71",`
`78`	`78`	`"primary_ckn": "6162636465666768696A6B6C6D6E6F70",`
`79`		`- "fallback_cak": "0123456789ABCDEF0123456789ABCDEF",`
	`79`	`+ "fallback_cak": "1159485744465e5a537272050a1011073557475152020c0e040c57223a357d7d71",`
`80`	`80`	`"fallback_ckn": "6162636465666768696A6B6C6D6E6F70"`
`81`	`81`	`}`
`82`	`82`	`]`
`@@ -89,7 +89,7 @@`
`89`	`89`	`"MACSEC_PROFILE_LIST": [`
`90`	`90`	`{`
`91`	`91`	`"name": "test",`
`92`		`- "primary_cak": "0123456789ABCDEF0123456789ABCDEFA",`
	`92`	`+ "primary_cak": "1159485744465e5a537272050a1011073557475152020c0e040c57223a357d7d7",`
`93`	`93`	`"primary_ckn": "6162636465666768696A6B6C6D6E6F70A"`
`94`	`94`	`}`
`95`	`95`	`]`
`@@ -115,9 +115,9 @@`
`115`	`115`	`"MACSEC_PROFILE_LIST": [`
`116`	`116`	`{`
`117`	`117`	`"name": "test",`
`118`		`- "primary_cak": "0123456789ABCDEF0123456789ABCDEF",`
	`118`	`+ "primary_cak": "1159485744465e5a537272050a1011073557475152020c0e040c57223a357d7d71",`
`119`	`119`	`"primary_ckn": "6162636465666768696A6B6C6D6E6F70",`
`120`		`- "fallback_cak": "0000000000000000000000000000000000000000000000000000000000000000",`
	`120`	`+ "fallback_cak": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",`
`121`	`121`	`"fallback_ckn": "1111111111111111111111111111111111111111111111111111111111111111"`
`122`	`122`	`}`
`123`	`123`	`]`
`@@ -130,7 +130,7 @@`
`130`	`130`	`"MACSEC_PROFILE_LIST": [`
`131`	`131`	`{`
`132`	`132`	`"name": "test",`
`133`		`- "primary_cak": "0123456789ABCDEF0123456789ABCDEF",`
	`133`	`+ "primary_cak": "1159485744465e5a537272050a1011073557475152020c0e040c57223a357d7d71",`
`134`	`134`	`"primary_ckn": "6162636465666768696A6B6C6D6E6F70",`
`135`	`135`	`"replay_window": 64`
`136`	`136`	`}`
Original file line number	Diff line number	Diff line change
`@@ -46,7 +46,7 @@ module sonic-macsec {`
`46`	`46`
`47`	`47`	`leaf primary_cak {`
`48`	`48`	`type string {`
`49`		`- pattern "[0-9a-fA-F]{32}\|[0-9a-fA-F]{64}";`
	`49`	`+ pattern "[0-9a-fA-F]{66}\|[0-9a-fA-F]{130}";`
`50`	`50`	`}`
`51`	`51`	`mandatory true;`
`52`	`52`	`}`
`@@ -60,7 +60,7 @@ module sonic-macsec {`
`60`	`60`
`61`	`61`	`leaf fallback_cak {`
`62`	`62`	`type string {`
`63`		`- pattern "[0-9a-fA-F]{32}\|[0-9a-fA-F]{64}";`
	`63`	`+ pattern "[0-9a-fA-F]{66}\|[0-9a-fA-F]{130}";`
`64`	`64`	`}`
`65`	`65`	`}`
`66`	`66`
`@@ -70,10 +70,6 @@ module sonic-macsec {`
`70`	`70`	`}`
`71`	`71`	`}`
`72`	`72`
`73`		`- must "string-length(primary_cak) = string-length(primary_ckn)";`
`74`		`-`
`75`		`- must "string-length(fallback_cak) = string-length(fallback_ckn)";`
`76`		`-`
`77`	`73`	`must "string-length(fallback_cak) = string-length(primary_cak)";`
`78`	`74`
`79`	`75`	`must "primary_ckn != fallback_ckn";`