Skip to content

Commit 740a2d1

Browse files
sasubrataactions-user
sasubrata
and
actions-user
authored
MACsec/ MKA model reworked (on dev_macsec branch) based on review comments from PR #408 (on macsec branch) (#412)
* MACsec OTG model reworked based on review of model from macsec branch * Update auto generated content * More rework based on review comments * Add missing file * Update auto generated content * Fix secure channels * Update auto generated content * Fix secure channels * Update auto generated content * Fix secure channels * Update auto generated content * Fix secure channels * Update auto generated content * Correct min and max length of hex fields * Update auto generated content * Update key time descriptions * Update auto generated content * Add MACsec and MKA metrics * Update auto generated content * More rework based on review * Update auto generated content * Split time offset and key chain start time into subfields * Update auto generated content * Fix time fields * Update auto generated content * Fix time fields * Update auto generated content * Add integer format to time subfields * Change class name from Macsec to SecureEntity to match field name secure_entity * Update auto generated content * Change description of psk_chain_start_time * Update auto generated content * Try to set psk chain start time description from the field description itself * Update auto generated content * Move re-shared key(PSK) chain start time description * Update auto generated content * Add lifetime validity information * Update auto generated content * add required fields * Update auto generated content * Minutes field max limit set to 59 * Remove encrypt_decrypt engine type from the model as of now as it is not implemented/ tested yet. * Update auto generated content * Some change in description to reflect previus change in redocly view * Update auto generated content --------- Co-authored-by: Github Actions Bot <[email protected]>
1 parent db62db0 commit 740a2d1

File tree

22 files changed

+3966
-168
lines changed

22 files changed

+3966
-168
lines changed

‎artifacts/openapi.html‎

Lines changed: 8 additions & 6 deletions
Large diffs are not rendered by default.

‎artifacts/openapi.yaml‎

Lines changed: 1631 additions & 162 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎artifacts/otg.proto‎

Lines changed: 909 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎device/device.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,11 @@ components:
7777
Configuration for OSPFv2 router.
7878
$ref: './ospfv2/router.yaml#/components/schemas/Device.Ospfv2Router'
7979
x-field-uid: 10
80+
macsec:
81+
description: >-
82+
Configuration of MACsec device.
83+
$ref: './macsec/macsec.yaml#/components/schemas/Device.Macsec'
84+
x-field-uid: 11
8085
required: [name]
8186
Protocol.Options:
8287
description: >-

‎device/macsec/dataplane/cryptoengine.yaml‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
components:
2+
schemas:
3+
SecureEntity.CryptoEngine:
4+
description: >-
5+
A container of crypto engine properties of a SecY.
6+
type: object
7+
properties:
8+
choice:
9+
description: >-
10+
Engine type based on encryption and/ or decryption capability. Supported types: encrypt_only - engine can only encrypt transmitted packets but it cannot decrypt packets upon arrival. As the packets cannot be decrypted on arrival, such packets cannot be delivered to the receiving device. Hence only stateless traffic can be sent.
11+
type: string
12+
default: encrypt_only
13+
x-field-uid: 1
14+
x-enum:
15+
encrypt_only:
16+
x-field-uid: 1
17+
encrypt_only:
18+
$ref: '#/components/schemas/SecureEntity.CryptoEngine.EncryptOnly'
19+
x-field-uid: 2
20+
SecureEntity.CryptoEngine.EncryptOnly:
21+
description: >-
22+
The container for encrypt only engine configuration.
23+
type: object
24+
properties:
25+
secure_channels:
26+
type: array
27+
items:
28+
$ref: '#/components/schemas/SecureEntity.CryptoEngine.EncryptOnly.TxSc'
29+
x-field-uid: 1
30+
traffic_options:
31+
$ref: '#/components/schemas/SecureEntity.CryptoEngine.EncryptOnly.TrafficOptions'
32+
x-field-uid: 2
33+
SecureEntity.CryptoEngine.EncryptOnly.TxSc:
34+
description: >-
35+
The container for Tx secure channel configuration.
36+
type: object
37+
properties:
38+
tx_pn:
39+
$ref: '#/components/schemas/SecureEntity.CryptoEngine.EncryptOnly.TxSc.TxPn'
40+
x-field-uid: 1
41+
SecureEntity.CryptoEngine.EncryptOnly.TxSc.TxPn:
42+
description: >-
43+
Tx packet number(PN) configuration.
44+
type: object
45+
properties:
46+
choice:
47+
description: >-
48+
Types of Tx packet number(PN) series. Supported choices: 1) fixed PN - MACsec packets will be sent out with the configured fixed PN or lower half of configured fixed XPN. 2) incrementing PN - MACsec packets will be sent out by single device with an incrementing PN or XPN.
49+
type: string
50+
default: fixed_pn
51+
x-field-uid: 1
52+
x-enum:
53+
fixed_pn:
54+
x-field-uid: 1
55+
incrementing_pn:
56+
x-field-uid: 2
57+
fixed:
58+
$ref: '#/components/schemas/SecureEntity.CryptoEngine.EncryptOnly.FixedPn'
59+
x-field-uid: 2
60+
incrementing:
61+
$ref: '#/components/schemas/SecureEntity.CryptoEngine.EncryptOnly.IncrementingPn'
62+
x-field-uid: 3
63+
SecureEntity.CryptoEngine.EncryptOnly.FixedPn:
64+
description: >-
65+
Fixed packet number(PN) configuration.
66+
type: object
67+
properties:
68+
pn:
69+
description: >-
70+
Fixed Tx packet number(PN). 4 bytes PN with which all packets will be sent out.
71+
type: integer
72+
format: uint32
73+
minimum: 1
74+
maximum: 4294967295
75+
default: 6
76+
x-field-uid: 1
77+
xpn:
78+
description: >-
79+
Fixed Tx extended packet number(XPN). 8 bytes XPN with which all packets will be sent out.
80+
type: string
81+
format: hex
82+
minLength: 1
83+
maxLength: 16
84+
minimum: 1
85+
default: "0x0000000000000006"
86+
x-field-uid: 2
87+
SecureEntity.CryptoEngine.EncryptOnly.IncrementingPn:
88+
description: >-
89+
Incrementing packet number(PN) configuration.
90+
type: object
91+
properties:
92+
count:
93+
description: >-
94+
Count of packet numbers in series.
95+
type: integer
96+
format: uint32
97+
minimum: 2
98+
maximum: 1000000
99+
default: 100
100+
x-field-uid: 1
101+
starting_pn:
102+
description: >-
103+
The starting packet number(PN).
104+
type: integer
105+
format: uint32
106+
minimum: 1
107+
default: 10000
108+
x-field-uid: 2
109+
starting_xpn:
110+
description: >-
111+
The starting extended packet number(XPN).
112+
type: string
113+
format: hex
114+
minLength: 1
115+
maxLength: 16
116+
minimum: 1
117+
default: "0x0000000000010000"
118+
x-field-uid: 3
119+
SecureEntity.CryptoEngine.EncryptOnly.TrafficOptions:
120+
description: >-
121+
Encrypt only traffic options.
122+
type: object
123+
properties:
124+
send_gratuitous_arp:
125+
description: >-
126+
Send gratuitous ARP or not.
127+
type: boolean
128+
default: true
129+
x-field-uid: 1

‎device/macsec/dataplane/dataplane.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
components:
2+
schemas:
3+
SecureEntity.DataPlane:
4+
description: >-
5+
A container of data plane properties.
6+
type: object
7+
properties:
8+
choice:
9+
description: >-
10+
Choose "encapsulation" so that data packets are sent with MACsec encapsulation. Choose "no_encapsulation" so that data packets are sent without MACsec encapsulation.
11+
type: string
12+
default: encapsulation
13+
x-field-uid: 1
14+
x-enum:
15+
encapsulation:
16+
x-field-uid: 1
17+
no_encapsulation:
18+
x-field-uid: 2
19+
encapsulation:
20+
description: >-
21+
A container of encapsulation properties for a secure entity(SecY).
22+
$ref: './tx.yaml#/components/schemas/SecureEntity.DataPlane.Encapsulation'
23+
x-field-uid: 2
24+
25+
SecureEntity.DataPlane.Encapsulation:
26+
description: >-
27+
A container of encapsulation properties for a secure entity(SecY).
28+
type: object
29+
required: [crypto_engine]
30+
properties:
31+
tx:
32+
description: >-
33+
Tx properties of SecY.
34+
$ref: './tx.yaml#/components/schemas/SecureEntity.DataPlane.Tx'
35+
x-field-uid: 1
36+
rx:
37+
description: >-
38+
Rx properties of SecY.
39+
$ref: './rx.yaml#/components/schemas/SecureEntity.DataPlane.Rx'
40+
x-field-uid: 2
41+
crypto_engine:
42+
description: >-
43+
Crypto engine properties of SecY.
44+
$ref: './cryptoengine.yaml#/components/schemas/SecureEntity.CryptoEngine'
45+
x-field-uid: 3

‎device/macsec/dataplane/rx.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
components:
2+
schemas:
3+
SecureEntity.DataPlane.Rx:
4+
description: >-
5+
A container for Rx settings of SecY.
6+
type: object
7+
properties:
8+
replay_protection:
9+
description: |-
10+
Enable replay protection on not.
11+
type: boolean
12+
default: false
13+
x-field-uid: 1
14+
replay_window:
15+
description: |-
16+
Replay window size.
17+
type: integer
18+
format: uint32
19+
minimum: 1
20+
default: 1
21+
x-field-uid: 2

‎device/macsec/dataplane/tx.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
components:
2+
schemas:
3+
SecureEntity.DataPlane.Tx:
4+
description: >-
5+
A container of Tx properties of SecY.
6+
type: object
7+
properties:
8+
end_station:
9+
description: |-
10+
End station on not.
11+
type: boolean
12+
default: false
13+
x-field-uid: 1
14+
include_sci:
15+
description: |-
16+
Include SCI on not.
17+
type: boolean
18+
default: false
19+
x-field-uid: 2

‎device/macsec/macsec.yaml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
components:
2+
schemas:
3+
Device.Macsec:
4+
description: >-
5+
A container of properties for a MACsec capable device. Reference https://1.ieee802.org/security/802-1ae/.
6+
type: object
7+
required: [ethernet_interfaces]
8+
properties:
9+
ethernet_interfaces:
10+
description: |-
11+
Ethernet Interfaces
12+
type: array
13+
items:
14+
$ref: '#/components/schemas/Device.Macsec.EthernetInterface'
15+
x-field-uid: 1
16+
Device.Macsec.EthernetInterface:
17+
description: >-
18+
Configuration for single MACsec interface.
19+
type: object
20+
required: [eth_name, secure_entity]
21+
properties:
22+
eth_name:
23+
description: >-
24+
The unique name of the Ethernet interface on which MACsec
25+
is enabled.
26+
type: string
27+
x-constraint:
28+
- '/components/schemas/Device.Ethernet/properties/name'
29+
x-field-uid: 1
30+
secure_entity:
31+
description: >-
32+
This contains the properties of Secure Entity (SecY).
33+
$ref: '#/components/schemas/SecureEntity'
34+
x-field-uid: 2
35+
36+
SecureEntity:
37+
description: >-
38+
Configuration of a Secure Entity (SecY).
39+
type: object
40+
required: [name, key_generation_protocol]
41+
properties:
42+
name:
43+
x-include: ../../common/common.yaml#/components/schemas/Named.Object/properties/name
44+
x-field-uid: 1
45+
key_generation_protocol:
46+
description: >-
47+
This contains the properties of key generation protocol of Secure Entity (SecY).
48+
$ref: '#/components/schemas/SecureEntity.KeyGenerationProtocol'
49+
x-field-uid: 2
50+
data_plane:
51+
description: >-
52+
This contains the properties of data plane of Secure Entity (SecY).
53+
$ref: './dataplane/dataplane.yaml#/components/schemas/SecureEntity.DataPlane'
54+
x-field-uid: 3
55+
56+
SecureEntity.KeyGenerationProtocol:
57+
description: >-
58+
Container of Key generation protocol configuration.
59+
type: object
60+
properties:
61+
choice:
62+
description: >-
63+
Key generation protocol choices. Choose "mka" for dynamic key distribution using MACsec key agreement(MKA) protocol. Choose "static_key" for static configuration of secure association key(SAK).
64+
type: string
65+
default: mka
66+
x-field-uid: 1
67+
x-enum:
68+
mka:
69+
x-field-uid: 1
70+
static_key:
71+
x-field-uid: 2
72+
mka:
73+
description: |-
74+
This contains the properties of Key Agreement Entity (KaY) in MKA supplicant.
75+
x-field-uid: 2
76+
$ref: './mka/mka.yaml#/components/schemas/Mka'
77+
78+
static_key:
79+
description: >-
80+
Static key properties properties of SecY. Static key is used in absence MKA.
81+
$ref: './statickey/statickey.yaml#/components/schemas/SecureEntity.StaticKey'
82+
x-field-uid: 3

0 commit comments

Comments
 (0)