[docker-macsec]: MACsec CLI Plugin #9390

Pterosaur · 2021-11-29T09:18:59Z

Why I did it

To provide MACsec config and show CLI for manipulating MACsec

How I did it

Add config macsec and show macsec.

How to verify it

This PR includes unittest for MACsec CLI, check Azp status.

Add MACsec profile

admin@sonic:~$ sudo config macsec profile add --help
Usage: config macsec profile add [OPTIONS] <profile_name>

  Add MACsec profile

Options:
  --priority <priority>           For Key server election. In 0-255 range with
                                  0 being the highest priority.  [default:
                                  255]
  --cipher_suite <cipher_suite>   The cipher suite for MACsec.  [default: GCM-
                                  AES-128]
  --primary_cak <primary_cak>     Primary Connectivity Association Key.
                                  [required]
  --primary_ckn <primary_cak>     Primary CAK Name.  [required]
  --policy <policy>               MACsec policy. INTEGRITY_ONLY: All traffic,
                                  except EAPOL, will be converted to MACsec
                                  packets without encryption.  SECURITY: All
                                  traffic, except EAPOL, will be encrypted by
                                  SecY.  [default: security]
  --enable_replay_protect / --disable_replay_protect
                                  Whether enable replay protect.  [default:
                                  False]
  --replay_window <enable_replay_protect>
                                  Replay window size that is the number of
                                  packets that could be out of order. This
                                  field works only if ENABLE_REPLAY_PROTECT is
                                  true.  [default: 0]
  --send_sci / --no_send_sci      Send SCI in SecTAG field of MACsec header.
                                  [default: True]
  --rekey_period <rekey_period>   The period of proactively refresh (Unit
                                  second).  [default: 0]
  -?, -h, --help                  Show this message and exit.

Delete MACsec profile

admin@sonic:~$ sudo config macsec profile del --help
Usage: config macsec profile del [OPTIONS] <profile_name>

  Delete MACsec profile

Options:
  -?, -h, --help  Show this message and exit.

Enable MACsec on the port

admin@sonic:~$ sudo config macsec port add --help
Usage: config macsec port add [OPTIONS] <port_name> <profile_name>

  Add MACsec port

Options:
  -?, -h, --help  Show this message and exit.

Disable MACsec on the port

admin@sonic:~$ sudo config macsec port del --help
Usage: config macsec port del [OPTIONS] <port_name>

  Delete MACsec port

Options:
  -?, -h, --help  Show this message and exit.

Show MACsec

MACsec port(Ethernet0)
---------------------  -----------
cipher_suite           GCM-AES-256
enable                 true
enable_encrypt         true
enable_protect         true
enable_replay_protect  false
replay_window          0
send_sci               true
---------------------  -----------
	MACsec Egress SC (5254008f4f1c0001)
	-----------  -
	encoding_an  2
	-----------  -
		MACsec Egress SA (1)
		-------------------------------------  ----------------------------------------------------------------
		auth_key                               849B69D363E2B0AA154BEBBD7C1D9487
		next_pn                                1
		sak                                    AE8C9BB36EA44B60375E84BC8E778596289E79240FDFA6D7BA33D3518E705A5E
		salt                                   000000000000000000000000
		ssci                                   0
		SAI_MACSEC_SA_ATTR_CURRENT_XPN         179
		SAI_MACSEC_SA_STAT_OCTETS_ENCRYPTED    0
		SAI_MACSEC_SA_STAT_OCTETS_PROTECTED    0
		SAI_MACSEC_SA_STAT_OUT_PKTS_ENCRYPTED  0
		SAI_MACSEC_SA_STAT_OUT_PKTS_PROTECTED  0
		-------------------------------------  ----------------------------------------------------------------
		MACsec Egress SA (2)
		-------------------------------------  ----------------------------------------------------------------
		auth_key                               5A8B8912139551D3678B43DD0F10FFA5
		next_pn                                1
		sak                                    7F2651140F12C434F782EF9AD7791EE2CFE2BF315A568A48785E35FC803C9DB6
		salt                                   000000000000000000000000
		ssci                                   0
		SAI_MACSEC_SA_ATTR_CURRENT_XPN         87185
		SAI_MACSEC_SA_STAT_OCTETS_ENCRYPTED    0
		SAI_MACSEC_SA_STAT_OCTETS_PROTECTED    0
		SAI_MACSEC_SA_STAT_OUT_PKTS_ENCRYPTED  0
		SAI_MACSEC_SA_STAT_OUT_PKTS_PROTECTED  0
		-------------------------------------  ----------------------------------------------------------------
	MACsec Ingress SC (525400edac5b0001)
		MACsec Ingress SA (1)
		---------------------------------------  ----------------------------------------------------------------
		active                                   true
		auth_key                                 849B69D363E2B0AA154BEBBD7C1D9487
		lowest_acceptable_pn                     1
		sak                                      AE8C9BB36EA44B60375E84BC8E778596289E79240FDFA6D7BA33D3518E705A5E
		salt                                     000000000000000000000000
		ssci                                     0
		SAI_MACSEC_SA_ATTR_CURRENT_XPN           103
		SAI_MACSEC_SA_STAT_IN_PKTS_DELAYED       0
		SAI_MACSEC_SA_STAT_IN_PKTS_INVALID       0
		SAI_MACSEC_SA_STAT_IN_PKTS_LATE          0
		SAI_MACSEC_SA_STAT_IN_PKTS_NOT_USING_SA  0
		SAI_MACSEC_SA_STAT_IN_PKTS_NOT_VALID     0
		SAI_MACSEC_SA_STAT_IN_PKTS_OK            0
		SAI_MACSEC_SA_STAT_IN_PKTS_UNCHECKED     0
		SAI_MACSEC_SA_STAT_IN_PKTS_UNUSED_SA     0
		SAI_MACSEC_SA_STAT_OCTETS_ENCRYPTED      0
		SAI_MACSEC_SA_STAT_OCTETS_PROTECTED      0
		---------------------------------------  ----------------------------------------------------------------
		MACsec Ingress SA (2)
		---------------------------------------  ----------------------------------------------------------------
		active                                   true
		auth_key                                 5A8B8912139551D3678B43DD0F10FFA5
		lowest_acceptable_pn                     1
		sak                                      7F2651140F12C434F782EF9AD7791EE2CFE2BF315A568A48785E35FC803C9DB6
		salt                                     000000000000000000000000
		ssci                                     0
		SAI_MACSEC_SA_ATTR_CURRENT_XPN           91824
		SAI_MACSEC_SA_STAT_IN_PKTS_DELAYED       0
		SAI_MACSEC_SA_STAT_IN_PKTS_INVALID       0
		SAI_MACSEC_SA_STAT_IN_PKTS_LATE          0
		SAI_MACSEC_SA_STAT_IN_PKTS_NOT_USING_SA  0
		SAI_MACSEC_SA_STAT_IN_PKTS_NOT_VALID     0
		SAI_MACSEC_SA_STAT_IN_PKTS_OK            0
		SAI_MACSEC_SA_STAT_IN_PKTS_UNCHECKED     0
		SAI_MACSEC_SA_STAT_IN_PKTS_UNUSED_SA     0
		SAI_MACSEC_SA_STAT_OCTETS_ENCRYPTED      0
		SAI_MACSEC_SA_STAT_OCTETS_PROTECTED      0
		---------------------------------------  ----------------------------------------------------------------
MACsec port(Ethernet1)
---------------------  -----------
cipher_suite           GCM-AES-256
enable                 true
enable_encrypt         true
enable_protect         true
enable_replay_protect  false
replay_window          0
send_sci               true
---------------------  -----------
	MACsec Egress SC (5254008f4f1c0001)
	-----------  -
	encoding_an  1
	-----------  -
		MACsec Egress SA (1)
		-------------------------------------  ----------------------------------------------------------------
		auth_key                               35FC8F2C81BCA28A95845A4D2A1EE6EF
		next_pn                                1
		sak                                    1EC8572B75A840BA6B3833DC550C620D2C65BBDDAD372D27A1DFEB0CD786671B
		salt                                   000000000000000000000000
		ssci                                   0
		SAI_MACSEC_SA_ATTR_CURRENT_XPN         4809
		SAI_MACSEC_SA_STAT_OCTETS_ENCRYPTED    0
		SAI_MACSEC_SA_STAT_OCTETS_PROTECTED    0
		SAI_MACSEC_SA_STAT_OUT_PKTS_ENCRYPTED  0
		SAI_MACSEC_SA_STAT_OUT_PKTS_PROTECTED  0
		-------------------------------------  ----------------------------------------------------------------
	MACsec Ingress SC (525400edac5b0001)
		MACsec Ingress SA (1)
		---------------------------------------  ----------------------------------------------------------------
		active                                   true
		auth_key                                 35FC8F2C81BCA28A95845A4D2A1EE6EF
		lowest_acceptable_pn                     1
		sak                                      1EC8572B75A840BA6B3833DC550C620D2C65BBDDAD372D27A1DFEB0CD786671B
		salt                                     000000000000000000000000
		ssci                                     0
		SAI_MACSEC_SA_ATTR_CURRENT_XPN           5033
		SAI_MACSEC_SA_STAT_IN_PKTS_DELAYED       0
		SAI_MACSEC_SA_STAT_IN_PKTS_INVALID       0
		SAI_MACSEC_SA_STAT_IN_PKTS_LATE          0
		SAI_MACSEC_SA_STAT_IN_PKTS_NOT_USING_SA  0
		SAI_MACSEC_SA_STAT_IN_PKTS_NOT_VALID     0
		SAI_MACSEC_SA_STAT_IN_PKTS_OK            0
		SAI_MACSEC_SA_STAT_IN_PKTS_UNCHECKED     0
		SAI_MACSEC_SA_STAT_IN_PKTS_UNUSED_SA     0
		SAI_MACSEC_SA_STAT_OCTETS_ENCRYPTED      0
		SAI_MACSEC_SA_STAT_OCTETS_PROTECTED      0
		---------------------------------------  ----------------------------------------------------------------

Which release branch to backport (provide reason below if selected)

Description for the changelog

A picture of a cute animal (not mandatory but encouraged)

…nic-net#9218) Signed-off-by: Ze Gan <ganze718@gmail.com>

Signed-off-by: Ze Gan <ganze718@gmail.com>

lgtm-com · 2022-04-29T11:11:01Z

This pull request introduces 1 alert when merging 5b8606e into d258db8 - view on LGTM.com

new alerts:

1 for Unused import

lgtm-com · 2022-04-29T12:33:34Z

This pull request introduces 1 alert when merging 01b4b41bc43af5474cc041ed2da17e4350aa300d into d258db8 - view on LGTM.com

new alerts:

1 for Unused import

lgtm-com · 2022-05-05T02:15:18Z

This pull request introduces 1 alert when merging 2d899bb6eb6947f27a76170f354936c20fcd037c into 7c4ee43 - view on LGTM.com

new alerts:

1 for Unused import

Signed-off-by: Ze Gan <ganze718@gmail.com>

lgtm-com · 2022-05-05T04:14:01Z

This pull request introduces 1 alert when merging 137e64b into 7c4ee43 - view on LGTM.com

new alerts:

1 for Unused import

Signed-off-by: Ze Gan <ganze718@gmail.com>

lgtm-com · 2022-05-05T17:30:32Z

This pull request introduces 2 alerts when merging 6d53214 into 7c4ee43 - view on LGTM.com

new alerts:

2 for Unused import

Signed-off-by: Ze Gan <ganze718@gmail.com>

lgtm-com · 2022-05-06T04:27:11Z

This pull request introduces 2 alerts when merging 125eb78 into 9ae17e6 - view on LGTM.com

new alerts:

2 for Unused import

Signed-off-by: Ze Gan <ganze718@gmail.com>

lguohan · 2022-05-10T19:00:24Z

dockers/docker-macsec/cli-plugin-tests/test_config_macsec.py

@@ -0,0 +1,146 @@
+import sys


are these tests running in the build process?

Yes, they are.

jimmyzhai · 2022-05-17T09:14:20Z

dockers/docker-macsec/cli-plugin-tests/appl_db.json

+    "ttl": -0.001,
+    "expireat": 1651807960.2302043
+  },
+  "MACSEC_EGRESS_SC_TABLE:Ethernet1:72088722065085522": {


SCI is hex string now. Please update it

jimmyzhai · 2022-05-17T09:15:47Z

dockers/docker-macsec/cli/show/plugins/show_macsec.py

+        return buffer
+
+    def get_header(self):
+        return "MACsec Egress SC ({})\n".format(format(int(self.sci), 'x'))


Update get_header for hex string sci

dockers/docker-macsec/cli/show/plugins/show_macsec.py

Signed-off-by: Ze Gan <ganze718@gmail.com>

jimmyzhai

Per discussion, later it's better to add other show commands for macsec counter, etc, instead of show all with one command.

…anch Related work items: #52, #71, #73, #75, #77, sonic-net#1306, sonic-net#1588, sonic-net#1991, sonic-net#2031, sonic-net#2040, sonic-net#2053, sonic-net#2066, sonic-net#2069, sonic-net#2087, sonic-net#2107, sonic-net#2110, sonic-net#2112, sonic-net#2113, sonic-net#2117, sonic-net#2124, sonic-net#2125, sonic-net#2126, sonic-net#2128, sonic-net#2130, sonic-net#2131, sonic-net#2132, sonic-net#2133, sonic-net#2134, sonic-net#2135, sonic-net#2136, sonic-net#2137, sonic-net#2138, sonic-net#2139, sonic-net#2140, sonic-net#2143, sonic-net#2158, sonic-net#2161, sonic-net#2233, sonic-net#2243, sonic-net#2250, sonic-net#2254, sonic-net#2260, sonic-net#2261, sonic-net#2267, sonic-net#2278, sonic-net#2282, sonic-net#2285, sonic-net#2288, sonic-net#2289, sonic-net#2292, sonic-net#2294, sonic-net#8887, sonic-net#9279, sonic-net#9390, sonic-net#9511, sonic-net#9700, sonic-net#10025, sonic-net#10322, sonic-net#10479, sonic-net#10484, sonic-net#10493, sonic-net#10500, sonic-net#10580, sonic-net#10595, sonic-net#10628, sonic-net#10634, sonic-net#10635, sonic-net#10644, sonic-net#10670, sonic-net#10691, sonic-net#10716, sonic-net#10731, sonic-net#10750, sonic-net#10751, sonic-net#10752, sonic-net#10761, sonic-net#10769, sonic-net#10775, sonic-net#10776, sonic-net#10779, sonic-net#10786, sonic-net#10792, sonic-net#10793, sonic-net#10800, sonic-net#10806, sonic-net#10826, sonic-net#10839, sonic-net#10840, sonic-net#10842, sonic-net#10844, sonic-net#10847, sonic-net#10849, sonic-net#10852, sonic-net#10865, sonic-net#10872, sonic-net#10877, sonic-net#10886, sonic-net#10889, sonic-net#10903, sonic-net#10904, sonic-net#10905, sonic-net#10913, sonic-net#10914, sonic-net#10916, sonic-net#10919, sonic-net#10925, sonic-net#10926, sonic-net#10929, sonic-net#10933, sonic-net#10934, sonic-net#10937, sonic-net#10941, sonic-net#10947, sonic-net#10952, sonic-net#10953, sonic-net#10957, sonic-net#10959, sonic-net#10971, sonic-net#10972, sonic-net#10980

ArunSaravananBalachandran and others added 5 commits November 29, 2021 09:17

DellEMC: Z9332f - Fix error message during Chassis initialization (so…

bd3aa96

…nic-net#9218) Signed-off-by: Ze Gan <ganze718@gmail.com>

Merge branch 'master' into macsec_cli

0f2d4e8

init macsec cli

dfe86dd

Signed-off-by: Ze Gan <ganze718@gmail.com>

Merge branch 'master' into macsec_cli

c5e0a48

Add config test

5b8606e

Signed-off-by: Ze Gan <ganze718@gmail.com>

Pterosaur force-pushed the macsec_cli branch from 2854b7e to 5b8606e Compare April 29, 2022 10:45

Pterosaur force-pushed the macsec_cli branch from 01b4b41 to 2d899bb Compare May 5, 2022 01:53

Fix docker-macsec.mk

137e64b

Signed-off-by: Ze Gan <ganze718@gmail.com>

Pterosaur force-pushed the macsec_cli branch from 2d899bb to 137e64b Compare May 5, 2022 03:50

add show macsec

6d53214

Signed-off-by: Ze Gan <ganze718@gmail.com>

Add show command

125eb78

Signed-off-by: Ze Gan <ganze718@gmail.com>

Pterosaur changed the title ~~Macsec cli~~ [docker-macsec]: MACsec CLI Plugin May 6, 2022

Pterosaur marked this pull request as ready for review May 6, 2022 04:09

Pterosaur requested review from qiluo-msft, xumia and lguohan as code owners May 6, 2022 04:09

Pterosaur requested review from judyjoseph and jimmyzhai May 6, 2022 04:09

Pterosaur added 2 commits May 6, 2022 05:43

Remove useless import

0181702

Signed-off-by: Ze Gan <ganze718@gmail.com>

Remove useless comment

c4017df

Signed-off-by: Ze Gan <ganze718@gmail.com>

This comment was marked as resolved.

Sign in to view

lguohan reviewed May 10, 2022

View reviewed changes

jimmyzhai reviewed May 17, 2022

View reviewed changes

Pterosaur commented May 17, 2022

View reviewed changes

dockers/docker-macsec/cli/show/plugins/show_macsec.py Outdated Show resolved Hide resolved

Polish code

261d627

Signed-off-by: Ze Gan <ganze718@gmail.com>

sonic-net deleted a comment from lgtm-com bot May 17, 2022

jimmyzhai approved these changes May 17, 2022

View reviewed changes

Pterosaur mentioned this pull request May 19, 2022

config MACsec CLI sonic-net/sonic-utilities#1895

Closed

Pterosaur merged commit 910e1c6 into sonic-net:master May 19, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[docker-macsec]: MACsec CLI Plugin #9390

[docker-macsec]: MACsec CLI Plugin #9390

Pterosaur commented Nov 29, 2021 •

edited

Loading

lgtm-com bot commented Apr 29, 2022

lgtm-com bot commented Apr 29, 2022

lgtm-com bot commented May 5, 2022

lgtm-com bot commented May 5, 2022

lgtm-com bot commented May 5, 2022

lgtm-com bot commented May 6, 2022

This comment was marked as resolved.

lguohan May 10, 2022

Pterosaur May 11, 2022

jimmyzhai May 17, 2022

Pterosaur May 17, 2022

jimmyzhai May 17, 2022

Pterosaur May 17, 2022

jimmyzhai left a comment

[docker-macsec]: MACsec CLI Plugin #9390

[docker-macsec]: MACsec CLI Plugin #9390

Conversation

Pterosaur commented Nov 29, 2021 • edited Loading

Why I did it

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Description for the changelog

A picture of a cute animal (not mandatory but encouraged)

lgtm-com bot commented Apr 29, 2022

lgtm-com bot commented Apr 29, 2022

lgtm-com bot commented May 5, 2022

lgtm-com bot commented May 5, 2022

lgtm-com bot commented May 5, 2022

lgtm-com bot commented May 6, 2022

This comment was marked as resolved.

lguohan May 10, 2022

Choose a reason for hiding this comment

Pterosaur May 11, 2022

Choose a reason for hiding this comment

jimmyzhai May 17, 2022

Choose a reason for hiding this comment

Pterosaur May 17, 2022

Choose a reason for hiding this comment

jimmyzhai May 17, 2022

Choose a reason for hiding this comment

Pterosaur May 17, 2022

Choose a reason for hiding this comment

jimmyzhai left a comment

Choose a reason for hiding this comment

Pterosaur commented Nov 29, 2021 •

edited

Loading