---
###############################################################################
# This is intended to be used as an example yaml for loading a MACsec 
#   configuration to ICS SFP-MV2221M-B1 module
#
# MACsec configuration:
#  tx:
#    rule:
#      - MAC SA = 00:FC:70:XX:XX:XX (IntrepidCS OUI) packets authenticated and encrypted
#      - other packets dropped
#    map:
#      - Map Rule 0 to SecY 0 and SC 0
#      - Use SCI = 0xAFAFAFAFAFAFFFFF
#    secy:
#      - Cipher = GCM_AES_128
#      - Always Authenticate, Replay Protect, and Encrypt/Decrypt
#      - Include the MAC DA and SA in the ICV
#    sc:
#      - Assign 2 x SA's
#      - SA 0 is Active
#      - Enable auto rekey
#    2 x sa:
#      - Define Keys
#      - Assign indices 0,1
#      - Next PN = 1
#  rx:
#    rule:
#      - MAC SA = 00:FC:70:XX:XX:XX (IntrepidCS OUI) packets authenticated, replay protected, and decrypted
#      - other packets dropped
#    map:
#      - Map Rule 0 to SecY 0 and SC 0
#      - Check SCI = 0xAFAFAFAFAFAFFFFF
#    secy:
#      - Cipher = GCM_AES_128
#      - Drop invalid frames
#      - Always Authenticate, Replay Protect, and Decrypt User Data
#      - Strip ICV and SecTag from incoming frames
#      - Include the MAC DA and SA in the ICV
#    sc:
#      - Assign 2 x SA's
#      - SA 0 is Active
#      - Enable auto rekey
#    2 x sa:
#      - Define Keys
#      - Assign indices 0,1
#      - Next PN = 1
############################################################################### 
tx:
  rule:
    index: 0
    key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
    mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_MAC_SA: [ 0x00, 0xFC, 0x70, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
    mask_MAC_SA: [ 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
    mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
      vlanTag:
        VID: 0xFFFF
        PRI_CFI: 0xFF
      mpls:
        MPLS_label: 0xFFFFFFFF
        exp: 0xFF
    mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
      vlanTag:
        VID: 0xFFFF
        PRI_CFI: 0xFF
      mpls:
        MPLS_label: 0xFFFFFFFF
        exp: 0xFF
    key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
      vlanTag:
        VID: 0xFFFF
        PRI_CFI: 0xFF
      mpls:
        MPLS_label: 0xFFFFFFFF
        exp: 0xFF
    mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
      vlanTag:
        VID: 0xFFFF
        PRI_CFI: 0xFF
      mpls:
        MPLS_label: 0xFFFFFFFF
        exp: 0xFF
    key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
    mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
    mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
    mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
    mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
    mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
    mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_express: 0xFF # 1 bits. Express packet
    mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    isMPLS: False
    reserved: [ 0, 0, 0, 0, 0 ]
    enable: True
  map:
    index: 0
    sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
    secYIndex: 0x00 # Index for entry in Egress secY Policy
    isControlPacket: False # Identifies all packets matching this index lookup as control packets
    scIndex: 0x00 # Identifies the SC for this Flow
    auxiliary_plcy: False # Auxiliary policy bits
    ruleId: 0x00 # Identifies the Rule for this Flow
    reserved: [ 0, 0, 0, 0, 0 ]
    enable: True
  secy:
    index: 0x00 # Identifies the SecY for this Flow
    controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
    validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
    strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
    cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
    confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
    icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
    replay_protect: True # Enables Anti-Replay protection
    replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
    protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
    sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
    sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table; 
    mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
    reserved: [ 0, 0, 0, 0, 0, 0 ]
    enable: True
  sc:
    index: 0x00 # SC index
    secYIndex: 0x00 # SecY associated with this packet
    sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
    sa_index0: 0x00 # Define the 1st SA to use
    sa_index1: 0x01 # Define the 2nd SA to use
    sa_index0_in_use: True # Specifies whether 1st SA is in use or not
    sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
    enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
    isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
    reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
    enable: True
  sa0:
    index: 0x00 # SA index
    sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
    hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
    salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
    ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
    AN: 0x00 # 2b SecTag Association Number (AN)
    nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
    reserved: [ 0, 0, 0, 0, 0 ]
    enable: True
  sa1:
    index: 0x01 # SA index
    sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
    hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
    salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
    ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
    AN: 0x01 # 2b SecTag Association Number (AN)
    nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
    reserved: [ 0, 0, 0, 0, 0 ]
    enable: True
rx:
  rule:
    index: 0
    key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
    mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_MAC_SA: [ 0x00, 0xFC, 0x70, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
    mask_MAC_SA: [ 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
    mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
      vlanTag:
        VID: 0xFFFF
        PRI_CFI: 0xFF
      mpls:
        MPLS_label: 0xFFFFFFFF
        exp: 0xFF
    mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
      vlanTag:
        VID: 0xFFFF
        PRI_CFI: 0xFF
      mpls:
        MPLS_label: 0xFFFFFFFF
        exp: 0xFF
    key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
      vlanTag:
        VID: 0xFFFF
        PRI_CFI: 0xFF
      mpls:
        MPLS_label: 0xFFFFFFFF
        exp: 0xFF
    mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
      vlanTag:
        VID: 0xFFFF
        PRI_CFI: 0xFF
      mpls:
        MPLS_label: 0xFFFFFFFF
        exp: 0xFF
    key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
    mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
    mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
    mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
    mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
    mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
    mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    key_express: 0xFF # 1 bits. Express packet
    mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
    isMPLS: False
    reserved: [ 0, 0, 0, 0, 0 ]
    enable: True
  map:
    index: 0
    sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
    secYIndex: 0x00 # Index for entry in Egress secY Policy
    isControlPacket: False # Identifies all packets matching this index lookup as control packets
    scIndex: 0x00 # Identifies the SC for this Flow
    auxiliary_plcy: False # Auxiliary policy bits
    ruleId: 0x00 # Identifies the Rule for this Flow
    reserved: [ 0, 0, 0, 0, 0 ]
    enable: True
  secy:
    index: 0x00 # Identifies the SecY for this Flow
    controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
    validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
    strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
    cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
    confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
    icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
    replay_protect: True # Enables Anti-Replay protection
    replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
    protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
    sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
    sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table; 
    mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
    reserved: [ 0, 0, 0, 0, 0, 0 ]
    enable: True
  sc:
    index: 0x00 # SC index
    secYIndex: 0x00 # SecY associated with this packet
    sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
    sa_index0: 0x00 # Define the 1st SA to use
    sa_index1: 0x01 # Define the 2nd SA to use
    sa_index0_in_use: True # Specifies whether 1st SA is in use or not
    sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
    enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
    isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
    reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
    enable: True
  sa0:
    index: 0x00 # SA index
    sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
    hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
    salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
    ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
    AN: 0x00 # 2b SecTag Association Number (AN)
    nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
    reserved: [ 0, 0, 0, 0, 0 ]
    enable: True
  sa1:
    index: 0x01 # SA index
    sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
    hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
    salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
    ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
    AN: 0x01 # 2b SecTag Association Number (AN)
    nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
    reserved: [ 0, 0, 0, 0, 0 ]
    enable: True