networkd: Introduce MACsec

[ssahani]

This work introduces MACsec to networkd.

Media Access Control Security (MACsec) is an 802.1AE IEEE
industry-standard security technology that provides secure
communication for all traffic on Ethernet links.
MACsec provides point-to-point security on Ethernet links between
directly connected nodes and is capable of identifying and preventing
most security threats, including denial of service, intrusion,
man-in-the-middle, masquerading, passive wiretapping, and playback attacks.

11-macsec.netdev

File Edit Options Buffers Tools Help                                                                                                                                                          
[NetDev]
Name=macsec-test
Kind=macsec

[MACsec]
Port=11


[MACsecReceiveChannel]
Port=1234
MACAddress=c6:19:52:8f:e6:a0

[MACsecReceiveChannel]
Port=21
MACAddress=8c:16:45:6c:83:a9

[MACsecTransmitAssociation]
PacketNumber=1024
KeyId=01
Key=81818181818181818181818181818181

[MACsecReceiveAssociation]
Port=1234
MACAddress=c6:19:52:8f:e6:a0
PacketNumber=1
KeyId=00
Key=82828282828282828282828282828282

closes #5754

Please see https://developers.redhat.com/blog/2016/10/14/macsec-a-different-solution-to-encrypt-network-traffic/

https://www.linux.org/docs/man8/ip-macsec.html

[yuwata]

Superficially good. But not tested. I've commented several minor points.

I will test this later.

[ssahani]

Updated thanks for the review @yuwata

[topimiettinen]

Keys could be seen as secrets that should not be accessible to unprivileged users, so later it would be nice to add a way to use a key file (preferably in such a format that it can be shared with all hosts in the network). The administrator could chmod the netdev file to 0700, but the contents would still be visible to unprivileged users with systemctl show.

[topimiettinen]

Please also wrap the long lines to make it easier to review in GitHub.

[ssahani]

@poettering Please take a look.

[ssahani]

Keys could be seen as secrets that should not be accessible to unprivileged users, so later it would be nice to add a way to use a key file (preferably in such a format that it can be shared with all hosts in the network). The administrator could chmod the netdev file to 0700, but the contents would still be visible to unprivileged users with systemctl show.

yes taken.

[yuwata]

@ssahani So, as usual, can I continue your work? Or are you still working on this? I'd like to implement KeyFile= to hide key from .netdev files, as similar to WireGuard.PrivateKeyFile=. And I'd like to add testcases for this.

Anyway, I will start to test this PR tomorrow, about 10h later :-)

[ssahani]

If you interested please do it. I like this mixed contribution. Feels like a team.

[ssahani]

@yuwata I have addressed what were remaining. Please take it from here. thanks. I am going to work on tc now.

[yuwata]

OK, I will start to test this PR from this state.

[yuwata]

I've opened #12222, which contains a revised version of this PR. Let's close this.