Initial commit - moved from https://git.intrepidcs.de/Andreas/Demos
This commit is contained in:
+271
@@ -0,0 +1,271 @@
|
||||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - MAC DA = 00:FC:70:XX:XX:XX (IntrepidCS OUI) packets authenticated and encrypted
|
||||
# - other packets dropped
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Always Authenticate, Replay Protect, and Encrypt/Decrypt
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - MAC DA = 00:FC:70:XX:XX:XX (IntrepidCS OUI) packets authenticated, replay protected, and decrypted
|
||||
# - other packets dropped
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Drop invalid frames
|
||||
# - Always Authenticate, Replay Protect, and Decrypt User Data
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0x00, 0xFC, 0x70, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0x00, 0xFC, 0x70, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
+271
@@ -0,0 +1,271 @@
|
||||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - MAC SA = 00:FC:70:XX:XX:XX (IntrepidCS OUI) packets authenticated and encrypted
|
||||
# - other packets dropped
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Always Authenticate, Replay Protect, and Encrypt/Decrypt
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - MAC SA = 00:FC:70:XX:XX:XX (IntrepidCS OUI) packets authenticated, replay protected, and decrypted
|
||||
# - other packets dropped
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Drop invalid frames
|
||||
# - Always Authenticate, Replay Protect, and Decrypt User Data
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0x00, 0xFC, 0x70, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0x00, 0xFC, 0x70, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
+271
@@ -0,0 +1,271 @@
|
||||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - MAC SA = 00:FC:70:XX:XX:XX (IntrepidCS OUI) packets authenticated and encrypted
|
||||
# - other packets dropped
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Always Authenticate, Replay Protect, and Encrypt/Decrypt
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - MAC DA = 00:FC:70:XX:XX:XX (IntrepidCS OUI) packets authenticated, replay protected, and decrypted
|
||||
# - other packets dropped
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Drop invalid frames
|
||||
# - Always Authenticate, Replay Protect, and Decrypt User Data
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0x00, 0xFC, 0x70, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0x00, 0xFC, 0x70, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
+269
@@ -0,0 +1,269 @@
|
||||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated and encrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Always Authenticate, Replay Protect, and Encrypt/Decrypt
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated, replay protected, and decrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Drop invalid frames
|
||||
# - Always Authenticate, Replay Protect, and Decrypt User Data
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
+269
@@ -0,0 +1,269 @@
|
||||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated and encrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Always Authenticate, Replay Protect, and Encrypt/Decrypt
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated, replay protected, and decrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Drop invalid frames
|
||||
# - Always Authenticate, Replay Protect, and Decrypt User Data
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 8 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 9, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 9 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 8 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 9, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 9 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
+269
@@ -0,0 +1,269 @@
|
||||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated and encrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_256
|
||||
# - No Encryption, Only Authenticate and Replay Protect
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated, replay protected, and decrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_256
|
||||
# - No Decryption, Only Authenticate and Replay Protect
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV\
|
||||
# - Non-strict validation
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 1 # Validate Frame = CHECK; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 1 # GCM_AES_256 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x08 # SCI included, auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 1 # Validate Frame = CHECK; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 1 # GCM_AES_256 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x08 # SCI included, auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
+269
@@ -0,0 +1,269 @@
|
||||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated and encrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_256
|
||||
# - No Encryption, Only Authenticate and Replay Protect
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated, replay protected, and decrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_256
|
||||
# - No Decryption, Only Authenticate and Replay Protect
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV\
|
||||
# - Non-strict validation
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 1 # Validate Frame = CHECK; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 1 # GCM_AES_256 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x08 # SCI included, auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 8 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 8 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 8 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 8, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 8 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 8, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 8 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 8, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 8 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 1 # Validate Frame = CHECK; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 1 # GCM_AES_256 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x08 # SCI included, auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 8 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 8 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 8 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 8, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 8 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 8, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 8 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 8, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 8 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
+269
@@ -0,0 +1,269 @@
|
||||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated and encrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_256
|
||||
# - Always Authenticate, Replay Protect, and Encrypt/Decrypt
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated, replay protected, and decrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_256
|
||||
# - Drop invalid frames
|
||||
# - Always Authenticate, Replay Protect, and Decrypt User Data
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 1 # GCM_AES_256 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 1 # GCM_AES_256 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
Reference in New Issue
Block a user