Feat(plugins): Add ISIS support to encrypt and decrypt filters

[ClausHolbechArista]

Change Summary

Add ISIS support to encrypt and decrypt filters

Related Issue(s)

Fixes #3624

Component(s) name

arista.avd.eos_designs

Proposed changes

• Add passwd_type: isis option to arista.avd.encrypt and arista.avd.decrypt filters.
• Requires key: <isis_instance_name> and mode: <none | text | md5 | sha | sha-1 | sha-224 | sha-256 | sha-384 | sha1-512>

How to test

• Added unit tests
• Added integration tests

Checklist

User Checklist

• N/A

Repository Checklist

• My code has been rebased from devel before I start
• I have read the CONTRIBUTING document.
• My change requires a change to the documentation and documentation have been updated accordingly.
• I have updated molecule CI testing accordingly. (check the box if not applicable)

[gmuloc]

LGTM

[carlbuchmann]

@dgonzalez85 - please test and review this PR!

[dgonzalez85]

Hi, i have done a bit of testing around this, enabling authentication between a couple of links:

1. note in eos_cli_config_gen we support today text and md5 authentication only according to docs. The plugin function supports addtional hashing methods:
   https://avd.arista.com/4.6/roles/eos_cli_config_gen/docs/input-variables.html#ethernet-interfaces

2. Just a note regarding probably old comments in this issue, decrypt plugin parameter is "mode" and no "isis_mode"

3. I used the following configuration to test md5 auth and works great

---
custom_structured_configuration_ethernet_interfaces:
  - name: "Ethernet1"
    isis_authentication_mode: "md5"
    isis_authentication_key: "{{ isis_peerings.password | arista.avd.encrypt(passwd_type='isis', mode='md5', key='EVPN_UNDERLAY') }}"

Which worked fine i could generate the configurations and session is up and MD5 auth enabled:

DC1-CL1#show run int et1
interface Ethernet1
   description P2P_LINK_TO_DC1-SP1_Ethernet1
   no shutdown
   mtu 1500
   speed forced 100gfull
   no switchport
   ip address 192.168.1.1/31
   isis enable EVPN_UNDERLAY
   isis circuit-type level-2
   isis metric 50
   isis network point-to-point
   isis authentication mode md5
   isis authentication key 7 $1c$b5bHgaRyiaJARvaJb6EneQ==
   
DC1-CL1#show isis int et1

IS-IS Instance: EVPN_UNDERLAY VRF: default

  Interface Ethernet1:
    Index: 48 SNPA: P2P
    MTU: 1497 Type: point-to-point
    Supported address families: IPv4
    Area proxy boundary is disabled
    Speed: 100000 mbps
    BFD IPv4 is disabled
    BFD IPv6 is disabled
    Hello padding is enabled
    Level 2:
      Metric: 50, Number of adjacencies: 1
      Link-ID: 30
      Authentication mode: MD5
      TI-LFA protection is disabled for IPv4
      TI-LFA protection is disabled for IPv6
	  
DC1-CL1#show isis nei
 
Instance  VRF      System Id        Type Interface          SNPA              State Hold time   Circuit Id          
EVPN_UNDE default  DC1-SP1          L2   Ethernet1          P2P               UP    25          34                  
EVPN_UNDE default  DC1-SP2          L2   Ethernet2          P2P               UP    24          2C                  
EVPN_UNDE default  DC1-CL2          L2   Vlan4093           P2P               UP    24          24                  

4. I used the following configuration to test text auth and also all good:

---
custom_structured_configuration_ethernet_interfaces:
  - name: "Ethernet1"
    isis_authentication_mode: "text"
    isis_authentication_key: "{{ isis_peerings.password | arista.avd.encrypt(passwd_type='isis', mode='text', key='EVPN_UNDERLAY') }}"

DC1-SP1#show isis int et1

IS-IS Instance: EVPN_UNDERLAY VRF: default

  Interface Ethernet1:
    Index: 52 SNPA: P2P
    MTU: 1497 Type: point-to-point
    Supported address families: IPv4
    Area proxy boundary is disabled
    Speed: 100000 mbps
    BFD IPv4 is disabled
    BFD IPv6 is disabled
    Hello padding is enabled
    Level 2:
      Metric: 50, Number of adjacencies: 1
      Link-ID: 34
      Authentication mode: Text
      TI-LFA protection is disabled for IPv4
      TI-LFA protection is disabled for IPv6

DC1-SP1#show run int et1
interface Ethernet1
   description P2P_LINK_TO_DC1-CL1_Ethernet1
   no shutdown
   mtu 1500
   speed forced 100gfull
   no switchport
   ip address 192.168.1.0/31
   isis enable EVPN_UNDERLAY
   isis circuit-type level-2
   isis metric 50
   isis network point-to-point
   isis authentication mode text
   isis authentication key 7 2ewYXSX6oRxJvMW6Qzn1fA==

[dgonzalez85]

Tested md5 and text authentication and looking good!