Initial commit - moved from https://git.intrepidcs.de/Andreas/Demos
commit
1b9f39910b
Binary file not shown.
|
|
@ -0,0 +1,32 @@
|
|||
Installing Dependencies
|
||||
The following dependencies are required:
|
||||
- python_ics
|
||||
- pyyaml
|
||||
|
||||
# Running MACSec utility
|
||||
|
||||
Provide arguments for:
|
||||
- RADGigastar serial number
|
||||
- sfp
|
||||
- config_netid
|
||||
- `NETID_I2C2` for RADGigastar SFP1 port
|
||||
- `NETID_I2C3` for RADGigastar SFP2 port
|
||||
- 'NETID_MDIO_02' for RAD-Comet2 Ethernet1
|
||||
- yaml
|
||||
- MACsec configuration yaml file name
|
||||
- *Assumes .yml is located in "/yaml/" directory
|
||||
|
||||
See `-h` for help text.
|
||||
|
||||
Example:
|
||||
```
|
||||
python test_sfp_macsec_util.py GS0694 --sfp --config_netid NETID_I2C2 --yaml test_sfp_macsec_Rule_wildcard_SecY_256_strip_noEncrypt_onlyCheck_sci_SA_sak0.yml
|
||||
```
|
||||
|
||||
# Reset/Clear the MACsec configuration
|
||||
Add `--reset` argument. Any MACsec configuration will be cleared and MACsec will be disabled on the device/port.
|
||||
*Make sure to remove `--reset` argument before configuring MACsec on the module again.
|
||||
|
||||
# New MACsec configuration
|
||||
"/yaml/" folder contains 8 existing MACsec yaml configurations to showcase specific use cases of MACsec.
|
||||
To add a new/custom MACsec configuration, add a new .yml file to the "/yaml/" folder in the same format as any of the existing files and edit the MACsec parameters.
|
||||
|
|
@ -0,0 +1 @@
|
|||
python test_sfp_macsec_util.py GS0728 --sfp --config_netid NETID_I2C2 --reset
|
||||
|
|
@ -0,0 +1 @@
|
|||
python test_sfp_macsec_util.py GS0733 --sfp --config_netid NETID_I2C2 --reset
|
||||
|
|
@ -0,0 +1 @@
|
|||
python test_sfp_macsec_util.py GS0728 --sfp --config_netid NETID_I2C3 --reset
|
||||
|
|
@ -0,0 +1 @@
|
|||
python test_sfp_macsec_util.py GS0733 --sfp --config_netid NETID_I2C3 --reset
|
||||
|
|
@ -0,0 +1 @@
|
|||
python test_sfp_macsec_util.py GS0733 --sfp --config_netid NETID_I2C2 --yaml test_sfp_macsec_Rule_macda_SecY_128_strip_strict_sci_SA_sak0.yml
|
||||
|
|
@ -0,0 +1 @@
|
|||
python test_sfp_macsec_util.py GS0733 --sfp --config_netid NETID_I2C3 --yaml test_sfp_macsec_Rule_macda_SecY_128_strip_strict_sci_SA_sak0.yml
|
||||
|
|
@ -0,0 +1,133 @@
|
|||
from util import (
|
||||
MyArgParseHelpFormatter,
|
||||
open_device,
|
||||
get_hwnetid,
|
||||
dict_align_str,
|
||||
)
|
||||
|
||||
from util_eth import (
|
||||
load_macsec_from_yaml,
|
||||
)
|
||||
|
||||
from util_sfp import (
|
||||
read_macsec_rx_secy_stats,
|
||||
read_macsec_tx_secy_stats,
|
||||
read_macsec_rx_sc_stats,
|
||||
read_macsec_tx_sc_stats,
|
||||
sfp_query_verify_macsec_support,
|
||||
)
|
||||
|
||||
import ics
|
||||
import argparse
|
||||
|
||||
###############################################################################
|
||||
# This loads a single macsec configuration from selected yaml into supported
|
||||
# devices and exits
|
||||
###############################################################################
|
||||
|
||||
|
||||
DESCRIPTION = "MACSec utility"
|
||||
|
||||
|
||||
def main():
|
||||
parser = get_parser()
|
||||
args = parser.parse_args()
|
||||
run_test(args, None)
|
||||
|
||||
|
||||
def run_test(args, power_supply):
|
||||
print(f"Attempting to load {args.yaml}...")
|
||||
|
||||
fail = 0
|
||||
|
||||
# connect to test device1 and set network settings for the macsec test
|
||||
with open_device(args.serial_number) as device:
|
||||
# Just load default every time in case we get some crazy stuff
|
||||
ics.load_default_settings(device)
|
||||
|
||||
# if sfp module, query for mdio i2c address
|
||||
if args.sfp:
|
||||
sfp_i2c_mdio_address = sfp_query_verify_macsec_support(
|
||||
device, args.config_netid, args.reset
|
||||
)
|
||||
# if we only want reset, exit here
|
||||
if args.reset:
|
||||
exit(0)
|
||||
|
||||
# if we only want the phy macsec counters, read then exit
|
||||
if args.counters:
|
||||
# Read secy, sc stats
|
||||
print("\nReading PHY MACsec rx/tx stats...\n")
|
||||
rx_secy_stats = read_macsec_rx_secy_stats(
|
||||
device, get_hwnetid(args.config_netid), sfp_i2c_mdio_address
|
||||
)
|
||||
tx_secy_stats = read_macsec_tx_secy_stats(
|
||||
device, get_hwnetid(args.config_netid), sfp_i2c_mdio_address
|
||||
)
|
||||
rx_sc_stats = read_macsec_rx_sc_stats(
|
||||
device, get_hwnetid(args.config_netid), sfp_i2c_mdio_address
|
||||
)
|
||||
tx_sc_stats = read_macsec_tx_sc_stats(
|
||||
device, get_hwnetid(args.config_netid), sfp_i2c_mdio_address
|
||||
)
|
||||
# print non-zero macsec counts
|
||||
print("rx_secy_stats:\n")
|
||||
print(dict_align_str(rx_secy_stats, False, True))
|
||||
print("tx_secy_stats:\n")
|
||||
print(dict_align_str(tx_secy_stats, False, True))
|
||||
print("rx_sc_stats:\n")
|
||||
print(dict_align_str(rx_sc_stats, False, True))
|
||||
print("tx_sc_stats:\n")
|
||||
print(dict_align_str(tx_sc_stats, False, True))
|
||||
exit(0)
|
||||
|
||||
# load yaml macsec config
|
||||
load_macsec_from_yaml(device, args.config_netid, args.yaml, args.sfp)
|
||||
|
||||
if fail: # bail out if something fails
|
||||
print(f"{fail} tests failed.")
|
||||
exit(1)
|
||||
|
||||
|
||||
def get_parser():
|
||||
parser = argparse.ArgumentParser(
|
||||
description="MACsec utility script",
|
||||
formatter_class=MyArgParseHelpFormatter,
|
||||
)
|
||||
parser.add_argument(
|
||||
"serial_number",
|
||||
help="The serial number of the device to connect to",
|
||||
)
|
||||
parser.add_argument(
|
||||
"--yaml",
|
||||
help="yaml file name to be loaded/configured.",
|
||||
default="test_sfp_macsec_Rule_wildcard_SecY_128_strip_strict_sci_SA_sak0.yml",
|
||||
)
|
||||
parser.add_argument(
|
||||
"--sfp",
|
||||
help="sfp module.",
|
||||
default=False,
|
||||
action="store_true",
|
||||
)
|
||||
parser.add_argument(
|
||||
"--config_netid",
|
||||
help="netid to config the sfp module.",
|
||||
default="NETID_I2C2",
|
||||
)
|
||||
parser.add_argument(
|
||||
"--reset",
|
||||
help="Only reset and clear and disable macsec on the device, then exit.",
|
||||
default=False,
|
||||
action="store_true",
|
||||
)
|
||||
parser.add_argument(
|
||||
"--counters",
|
||||
help="Only read the phy macsec counters, then exit.",
|
||||
default=False,
|
||||
action="store_true",
|
||||
)
|
||||
return parser
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
|
|
@ -0,0 +1,289 @@
|
|||
from contextlib import contextmanager
|
||||
import ics
|
||||
import time
|
||||
import argparse
|
||||
|
||||
|
||||
def serial_base36enc(ser_no):
|
||||
"""
|
||||
Encode serial as base36 if needed and return the string representation of the serial number
|
||||
|
||||
Args:
|
||||
ser_no: Serial number integer
|
||||
"""
|
||||
if int("AA0000", 36) < ser_no < int("ZZZZZZ", 36):
|
||||
return ics.base36enc(ser_no)
|
||||
else:
|
||||
return str(ser_no) # Old devices don't do base36
|
||||
|
||||
|
||||
def serial_base36dec(ser_no):
|
||||
"""
|
||||
Decode serial as base36 if needed and return the integer representation of the serial number
|
||||
|
||||
Args:
|
||||
ser_no: Serial number string
|
||||
"""
|
||||
serial36 = int(ser_no, 36)
|
||||
if int("AA0000", 36) < serial36 < int("ZZZZZZ", 36):
|
||||
return serial36
|
||||
else:
|
||||
return int(ser_no, 10) # Old devices don't do base36
|
||||
|
||||
|
||||
def filter_by_netid(msgs, netid):
|
||||
"""
|
||||
Filters the list of messages by netid
|
||||
|
||||
Args:
|
||||
msgs: A list of spy messages, likely from ics.get_messages
|
||||
netid: The desired netid
|
||||
|
||||
Returns:
|
||||
The filtered message list
|
||||
|
||||
"""
|
||||
netids = [netid]
|
||||
return filter_by_netids(msgs, netids)
|
||||
|
||||
|
||||
def filter_by_netids(msgs, netids):
|
||||
"""
|
||||
Filters the provided messages by those that match the provided netids
|
||||
|
||||
Args:
|
||||
msgs: The messages to filter
|
||||
netids: The valid netids to keep
|
||||
|
||||
Returns:
|
||||
All messages with the provided netids
|
||||
|
||||
"""
|
||||
ret = [msg for msg in msgs if get_netid(msg) in netids]
|
||||
return ret
|
||||
|
||||
|
||||
def get_netid(msg):
|
||||
"""
|
||||
Gets the netid for the message
|
||||
|
||||
Args:
|
||||
msg: The message to check
|
||||
|
||||
Returns:
|
||||
The netid (the number) for the message
|
||||
|
||||
"""
|
||||
netid = (msg.NetworkID2 << 8) | (msg.NetworkID & 0xFF)
|
||||
return netid
|
||||
|
||||
|
||||
@contextmanager
|
||||
def open_device(ser_no, tries=10, delay=1.0):
|
||||
"""
|
||||
Context manager for a neovi device. Opens the device, then auto-closes
|
||||
once the context manager falls out of scope
|
||||
|
||||
Args:
|
||||
ser_no: Serial number string of a connected device, will be validated
|
||||
|
||||
Yields:
|
||||
an open device
|
||||
|
||||
Examples:
|
||||
with open("GS0137") as device:
|
||||
ics_do_stuff(device)
|
||||
|
||||
"""
|
||||
device = None
|
||||
serial = serial_base36dec(ser_no)
|
||||
|
||||
for i in range(tries):
|
||||
try:
|
||||
found = False
|
||||
# work around for supporting neovi server connections
|
||||
# ics.open_device will not work if already open in Vspy with server
|
||||
devices = ics.find_devices()
|
||||
for d in devices:
|
||||
if d.SerialNumber == serial:
|
||||
device = ics.open_device(d)
|
||||
found = True
|
||||
break
|
||||
if found:
|
||||
# successfully opened
|
||||
break
|
||||
else:
|
||||
raise Exception(f"Could not find device to open {ser_no}")
|
||||
except Exception:
|
||||
device = None
|
||||
print(f"Failed to Open {ser_no}, Trying again... ({i+1}/{tries})")
|
||||
time.sleep(delay)
|
||||
|
||||
if device is None:
|
||||
# could not find device and multiple retries
|
||||
devices = ics.find_devices()
|
||||
print("ERROR: Device not found. Known devices are:")
|
||||
print([serial_base36enc(dev.SerialNumber) for dev in devices])
|
||||
exit(1)
|
||||
|
||||
try:
|
||||
yield device
|
||||
except Exception as e:
|
||||
print("ERROR: Open device succeeded, but yielding failed?")
|
||||
raise e
|
||||
finally:
|
||||
if device is not None:
|
||||
ics.close_device(device)
|
||||
|
||||
|
||||
def get_hwnetid(name):
|
||||
"""
|
||||
Get hardware network ID from string name in one of the following forms:
|
||||
COREMINI_NETWORK_ETHERNET, NETID_ETHERNET, or ETHERNET
|
||||
|
||||
Args:
|
||||
name: Network name
|
||||
|
||||
Returns:
|
||||
Hardware network ID
|
||||
"""
|
||||
# NETID_XXX, use as is
|
||||
if name.startswith("NETID_"):
|
||||
if hasattr(ics, name):
|
||||
return getattr(ics, name)
|
||||
|
||||
# COREMINI_NETWORK_XXX, convert
|
||||
if name.startswith("COREMINI_NETWORK_"):
|
||||
newname = "NETID_" + name[len("COREMINI_NETWORK_") :]
|
||||
if hasattr(ics, newname):
|
||||
return getattr(ics, newname)
|
||||
|
||||
# assume no prefix, so try adding it
|
||||
newname = "NETID_" + name
|
||||
if hasattr(ics, newname):
|
||||
return getattr(ics, newname)
|
||||
|
||||
raise AttributeError(f"Could not match network for {name}")
|
||||
|
||||
|
||||
class MyArgParseHelpFormatter(argparse.ArgumentDefaultsHelpFormatter):
|
||||
def _split_lines(self, text, width):
|
||||
if text.startswith("R|"):
|
||||
lines = text.splitlines()[1:]
|
||||
return lines
|
||||
return super()._split_lines(text, width)
|
||||
|
||||
|
||||
def set_process_priority(pid=None, priority=2):
|
||||
"""
|
||||
Set The Priority of a Process. Priority is a value between 0-5 where
|
||||
2 is normal priority, 5 is highest priority. Default sets the priority of the current
|
||||
python process but can take any valid process ID.
|
||||
"""
|
||||
import sys
|
||||
|
||||
try:
|
||||
sys.getwindowsversion()
|
||||
except AttributeError:
|
||||
isWindows = False
|
||||
else:
|
||||
isWindows = True
|
||||
|
||||
if isWindows:
|
||||
# Based on:
|
||||
# "Recipe 496767: Set Process Priority In Windows" on ActiveState
|
||||
# http://code.activestate.com/recipes/496767/
|
||||
import win32api
|
||||
import win32process
|
||||
import win32con
|
||||
|
||||
priorityclasses = [
|
||||
win32process.IDLE_PRIORITY_CLASS,
|
||||
win32process.BELOW_NORMAL_PRIORITY_CLASS,
|
||||
win32process.NORMAL_PRIORITY_CLASS,
|
||||
win32process.ABOVE_NORMAL_PRIORITY_CLASS,
|
||||
win32process.HIGH_PRIORITY_CLASS,
|
||||
win32process.REALTIME_PRIORITY_CLASS,
|
||||
]
|
||||
if pid is None:
|
||||
pid = win32api.GetCurrentProcessId()
|
||||
handle = win32api.OpenProcess(win32con.PROCESS_ALL_ACCESS, True, pid)
|
||||
win32process.SetPriorityClass(handle, priorityclasses[priority])
|
||||
else:
|
||||
# untested!
|
||||
import os
|
||||
|
||||
nice_levels = [19, 9, 0, -7, -14, -20]
|
||||
os.nice(nice_levels[priority])
|
||||
|
||||
|
||||
def dict_align_str(d, sort=False, nz=False):
|
||||
"""
|
||||
Prints a dict nicely and key value pairs in aligned rows
|
||||
Primarily limited to simple "a": "b" dicts, might not look nice for complex value types
|
||||
|
||||
Args:
|
||||
d: Some dictionary
|
||||
sort: Sort dictionary items
|
||||
nz: Excludes key value pairs with int value = 0
|
||||
|
||||
Returns:
|
||||
A string that looks like this:
|
||||
aardvark: banana
|
||||
monkey: apple
|
||||
ant: pear
|
||||
"""
|
||||
strings = []
|
||||
longest_key_len = len(max(d.keys(), key=len))
|
||||
if sort:
|
||||
d = dict(sorted(d.items()))
|
||||
for k, v in d.items():
|
||||
key_len = len(k)
|
||||
diff = longest_key_len - key_len
|
||||
spaces = " " * diff
|
||||
string = f"{k}:{spaces} {v}"
|
||||
if nz:
|
||||
if not isinstance(v, int) or v > 0:
|
||||
strings.append(string)
|
||||
else:
|
||||
strings.append(string)
|
||||
ret = "\n".join(strings) + "\n"
|
||||
return ret
|
||||
|
||||
|
||||
# Print iterations progress
|
||||
# https://stackoverflow.com/questions/3173320/text-progress-bar-in-terminal-with-block-characters
|
||||
def print_progress_bar(
|
||||
iteration,
|
||||
total,
|
||||
prefix="",
|
||||
suffix="",
|
||||
decimals=1,
|
||||
length=100,
|
||||
fill="█",
|
||||
printEnd="\r",
|
||||
start=None,
|
||||
):
|
||||
"""
|
||||
Call in a loop to create terminal progress bar
|
||||
@params:
|
||||
iteration - Required : current iteration (Int)
|
||||
total - Required : total iterations (Int)
|
||||
prefix - Optional : prefix string (Str)
|
||||
suffix - Optional : suffix string (Str)
|
||||
decimals - Optional : positive number of decimals in percent complete (Int)
|
||||
length - Optional : character length of bar (Int)
|
||||
fill - Optional : bar fill character (Str)
|
||||
printEnd - Optional : end character (e.g. "\r", "\r\n") (Str)
|
||||
"""
|
||||
percent = ("{0:." + str(decimals) + "f}").format(100 * (iteration / float(total)))
|
||||
filledLength = int(length * iteration // total)
|
||||
bar = fill * filledLength + "-" * (length - filledLength)
|
||||
if iteration == total:
|
||||
if start is not None:
|
||||
timestr = str(timedelta(seconds=time.time() - start))
|
||||
suffix = f"{suffix} -- {timestr}"
|
||||
print(f"\r{prefix} |{bar}| {percent}% {suffix}", end=printEnd)
|
||||
# Print New Line on Complete
|
||||
if iteration == total:
|
||||
print()
|
||||
|
|
@ -0,0 +1,180 @@
|
|||
from util import (
|
||||
get_hwnetid,
|
||||
)
|
||||
from util_sfp import (
|
||||
sfp_ics_send_macsec_rule,
|
||||
sfp_ics_send_macsec_map,
|
||||
sfp_ics_send_macsec_secy,
|
||||
sfp_ics_send_macsec_sc,
|
||||
sfp_ics_send_macsec_sa,
|
||||
sfp_ics_update_macsec,
|
||||
)
|
||||
|
||||
import time
|
||||
import yaml
|
||||
|
||||
ETH_SPEED_STRINGS = [
|
||||
"ETH_SPEED_10",
|
||||
"ETH_SPEED_100",
|
||||
"ETH_SPEED_1000",
|
||||
"ETH_SPEED_2500",
|
||||
"ETH_SPEED_5000",
|
||||
"ETH_SPEED_10000",
|
||||
"ETH_SPEED_AUTO",
|
||||
]
|
||||
|
||||
ETH_DUPLEX_STRINGS = [
|
||||
"ETH_DUPLEX_FULL",
|
||||
"ETH_DUPLEX_HALF",
|
||||
]
|
||||
|
||||
ETH_MODE_STRINGS = [
|
||||
"ETH_MODE_MASTER",
|
||||
"ETH_MODE_SLAVE",
|
||||
"ETH_MODE_AUTO",
|
||||
]
|
||||
|
||||
ETH_REPORT_LINK_UP_IDX = 0
|
||||
ETH_REPORT_SPEED_IDX = 1
|
||||
ETH_REPORT_DUPLEX_IDX = 2
|
||||
ETH_REPORT_NETID_LSB_IDX = 3
|
||||
ETH_REPORT_NETID_MSB_IDX = 4
|
||||
ETH_REPORT_MODE_IDX = 5
|
||||
|
||||
|
||||
def load_macsec_from_yaml(device, netid_name, yml, sfp):
|
||||
netid = get_hwnetid(netid_name)
|
||||
with open("yaml/" + yml, "r") as file:
|
||||
macsec_cfg = yaml.safe_load(file) # read macsec configuration from yaml
|
||||
if sfp: # ics sfp module - load over i2c with ics config subcommands
|
||||
en = 1
|
||||
rx = 0
|
||||
rule = 0
|
||||
map = 0
|
||||
secy = 0
|
||||
sc = 0
|
||||
sa = 0
|
||||
nvm = 1
|
||||
clr = 0
|
||||
rst = 1
|
||||
# clear/reset any current macsec configuration
|
||||
sfp_ics_update_macsec(
|
||||
device, netid, rx, rule, map, secy, sc, sa, nvm, en, clr, rst
|
||||
)
|
||||
time.sleep(
|
||||
1
|
||||
) # allow time for sfp to write macsec configuration to phy over mdio
|
||||
# tx config
|
||||
if macsec_cfg["tx"]:
|
||||
rx = 0
|
||||
rst = 0
|
||||
if macsec_cfg["tx"]["rule"]:
|
||||
rule = 1
|
||||
sfp_ics_send_macsec_rule(
|
||||
device, netid, macsec_cfg["tx"]["rule"]
|
||||
) # write macsec rule to sfp
|
||||
if macsec_cfg["tx"]["map"]:
|
||||
map = 1
|
||||
sfp_ics_send_macsec_map(
|
||||
device, netid, macsec_cfg["tx"]["map"]
|
||||
) # write macsec map to sfp
|
||||
if macsec_cfg["tx"]["secy"]:
|
||||
secy = 1
|
||||
sfp_ics_send_macsec_secy(
|
||||
device, netid, macsec_cfg["tx"]["secy"]
|
||||
) # write macsec secy to sfp
|
||||
if macsec_cfg["tx"]["sc"]:
|
||||
sc = 1
|
||||
sfp_ics_send_macsec_sc(
|
||||
device, netid, macsec_cfg["tx"]["sc"]
|
||||
) # write macsec sc to sfp
|
||||
if macsec_cfg["tx"]["sa0"] and macsec_cfg["tx"]["sa1"]:
|
||||
sa = 1
|
||||
sfp_ics_send_macsec_sa(
|
||||
device, netid, macsec_cfg["tx"]["sa0"]
|
||||
) # write macsec sa0 to sfp
|
||||
sfp_ics_update_macsec(
|
||||
device, netid, rx, 0, 0, 0, 0, sa, 0, en, clr, rst
|
||||
) # push macsec sa config to phy
|
||||
time.sleep(
|
||||
0.5
|
||||
) # allow time for sfp to write macsec configuration to phy over mdio
|
||||
sfp_ics_send_macsec_sa(
|
||||
device, netid, macsec_cfg["tx"]["sa1"]
|
||||
) # write macsec sa1 to sfp
|
||||
sfp_ics_update_macsec(
|
||||
device,
|
||||
netid,
|
||||
rx,
|
||||
rule,
|
||||
map,
|
||||
secy,
|
||||
sc,
|
||||
sa,
|
||||
nvm,
|
||||
en,
|
||||
clr,
|
||||
rst,
|
||||
) # push entire macsec config to phy
|
||||
time.sleep(
|
||||
1
|
||||
) # allow time for sfp to write entire macsec configuration to phy over mdio
|
||||
# rx config
|
||||
if macsec_cfg["rx"]:
|
||||
rx = 1
|
||||
rst = 0
|
||||
if macsec_cfg["rx"]["rule"]:
|
||||
rule = 1
|
||||
sfp_ics_send_macsec_rule(
|
||||
device, netid, macsec_cfg["rx"]["rule"]
|
||||
) # write macsec rule to sfp
|
||||
if macsec_cfg["rx"]["map"]:
|
||||
map = 1
|
||||
sfp_ics_send_macsec_map(
|
||||
device, netid, macsec_cfg["rx"]["map"]
|
||||
) # write macsec map to sfp
|
||||
if macsec_cfg["rx"]["secy"]:
|
||||
secy = 1
|
||||
sfp_ics_send_macsec_secy(
|
||||
device, netid, macsec_cfg["rx"]["secy"]
|
||||
) # write macsec secy to sfp
|
||||
if macsec_cfg["rx"]["sc"]:
|
||||
sc = 1
|
||||
sfp_ics_send_macsec_sc(
|
||||
device, netid, macsec_cfg["rx"]["sc"]
|
||||
) # write macsec sc to sfp
|
||||
if macsec_cfg["rx"]["sa0"] and macsec_cfg["rx"]["sa1"]:
|
||||
sa = 1
|
||||
sfp_ics_send_macsec_sa(
|
||||
device, netid, macsec_cfg["rx"]["sa0"]
|
||||
) # write macsec sa0 to sfp
|
||||
sfp_ics_update_macsec(
|
||||
device, netid, rx, 0, 0, 0, 0, sa, 0, en, clr, rst
|
||||
) # push macsec sa config to phy
|
||||
time.sleep(
|
||||
0.5
|
||||
) # allow time for sfp to write macsec configuration to phy over mdio
|
||||
sfp_ics_send_macsec_sa(
|
||||
device, netid, macsec_cfg["rx"]["sa1"]
|
||||
) # write macsec sa1 to sfp
|
||||
sfp_ics_update_macsec(
|
||||
device,
|
||||
netid,
|
||||
rx,
|
||||
rule,
|
||||
map,
|
||||
secy,
|
||||
sc,
|
||||
sa,
|
||||
nvm,
|
||||
en,
|
||||
clr,
|
||||
rst,
|
||||
) # push entire macsec config to phy
|
||||
time.sleep(
|
||||
1
|
||||
) # allow time for sfp to write entire macsec configuration to phy over mdio
|
||||
else: # non-sfp module
|
||||
pass # TODO write device settings with the macsec config
|
||||
# print macsec confirmation
|
||||
print(f"\nSuccessfully configured MACsec on {netid_name}.")
|
||||
|
|
@ -0,0 +1,108 @@
|
|||
import ics
|
||||
import time
|
||||
|
||||
|
||||
def transmit_i2c(
|
||||
device, netid, read, slave_addr, control_len, controldata, data_len, data
|
||||
):
|
||||
msg = ics.SpyMessage()
|
||||
msg.NetworkID = netid & 0xFF
|
||||
msg.NetworkID2 = (netid >> 8) & 0xFF
|
||||
msg.Protocol = ics.SPY_PROTOCOL_I2C
|
||||
msg.StatusBitField = 0
|
||||
msg.StatusBitField2 = 0
|
||||
msg.StatusBitField |= ics.SPY_STATUS_NETWORK_MESSAGE_TYPE
|
||||
msg.StatusBitField |= ics.SPY_STATUS_TX_MSG
|
||||
if slave_addr & 0x380: # if 10-bit address
|
||||
msg.StatusBitField |= ics.SPY_STATUS_XTD_FRAME
|
||||
if read:
|
||||
msg.StatusBitField2 |= ics.SPY_STATUS2_I2C_DIR_READ
|
||||
msg.ArbIDOrHeader = 0x10000000
|
||||
msg.DescriptionID = 0x6869 # arbitrary tx msg "key"
|
||||
msg.NodeID = 0
|
||||
msg.ArbIDOrHeader |= slave_addr
|
||||
msg.NumberBytesHeader = control_len
|
||||
msg.MiscData = (data_len >> 8) & 0xFF
|
||||
msg.NumberBytesData = data_len & 0xFF
|
||||
if data_len:
|
||||
for x in data[:data_len]:
|
||||
controldata.append(x)
|
||||
msg.ExtraDataPtr = tuple(controldata)
|
||||
msg.ExtraDataPtrEnabled = 1
|
||||
ics.transmit_messages(device, msg)
|
||||
return msg
|
||||
|
||||
|
||||
def are_errors_present(msg):
|
||||
error_flags = 0
|
||||
error_flags |= ics.SPY_STATUS_GLOBAL_ERR
|
||||
error_flags |= ics.SPY_STATUS_CRC_ERROR
|
||||
error_flags |= ics.SPY_STATUS_CAN_ERROR_PASSIVE
|
||||
error_flags |= ics.SPY_STATUS_HEADERCRC_ERROR
|
||||
error_flags |= ics.SPY_STATUS_INCOMPLETE_FRAME
|
||||
error_flags |= ics.SPY_STATUS_LOST_ARBITRATION
|
||||
error_flags |= ics.SPY_STATUS_UNDEFINED_ERROR
|
||||
error_flags |= ics.SPY_STATUS_CAN_BUS_OFF
|
||||
error_flags |= ics.SPY_STATUS_BUS_RECOVERED
|
||||
error_flags |= ics.SPY_STATUS_BUS_SHORTED_PLUS
|
||||
error_flags |= ics.SPY_STATUS_BUS_SHORTED_GND
|
||||
error_flags |= ics.SPY_STATUS_CHECKSUM_ERROR
|
||||
error_flags |= ics.SPY_STATUS_BAD_MESSAGE_BIT_TIME_ERROR
|
||||
error_flags |= ics.SPY_STATUS_TX_NOMATCH
|
||||
error_flags |= ics.SPY_STATUS_COMM_IN_OVERFLOW
|
||||
error_flags |= ics.SPY_STATUS_EXPECTED_LEN_MISMATCH
|
||||
error_flags |= ics.SPY_STATUS_MSG_NO_MATCH
|
||||
error_flags |= ics.SPY_STATUS_BREAK
|
||||
error_flags |= ics.SPY_STATUS_AVSI_REC_OVERFLOW
|
||||
if (msg.StatusBitField & error_flags) != 0:
|
||||
return True
|
||||
error_flags = 0
|
||||
error_flags |= ics.SPY_STATUS2_I2C_ERR_TIMEOUT
|
||||
error_flags |= ics.SPY_STATUS2_I2C_ERR_NACK
|
||||
if (msg.StatusBitField2 & error_flags) != 0:
|
||||
return True
|
||||
return False
|
||||
|
||||
|
||||
def find_i2c_message(msg, msgs):
|
||||
for msg_rx in msgs:
|
||||
if msg.NetworkID == msg_rx.NetworkID and msg.NetworkID2 == msg_rx.NetworkID2:
|
||||
# check for any possible errors
|
||||
if are_errors_present(msg_rx):
|
||||
return None
|
||||
|
||||
data = msg_rx.ExtraDataPtr
|
||||
return data
|
||||
|
||||
return None
|
||||
|
||||
|
||||
def wait_for_i2c_msg(device, msg, timeout=2):
|
||||
start = time.time()
|
||||
|
||||
while time.time() - start <= timeout:
|
||||
time.sleep(0.01)
|
||||
msgs, errors = ics.get_messages(device)
|
||||
data = find_i2c_message(msg, msgs)
|
||||
if data is not None:
|
||||
return data
|
||||
|
||||
return None
|
||||
|
||||
|
||||
def i2c_read(
|
||||
device, netid, slave_addr, control_len, controldata, data_len, data, timeout=2
|
||||
):
|
||||
msg = transmit_i2c(
|
||||
device, netid, 1, slave_addr, control_len, controldata, data_len, data
|
||||
)
|
||||
return wait_for_i2c_msg(device, msg, timeout)
|
||||
|
||||
|
||||
def i2c_write(
|
||||
device, netid, slave_addr, control_len, controldata, data_len, data, timeout=2
|
||||
):
|
||||
msg = transmit_i2c(
|
||||
device, netid, 0, slave_addr, control_len, controldata, data_len, data
|
||||
)
|
||||
return wait_for_i2c_msg(device, msg, timeout)
|
||||
|
|
@ -0,0 +1,888 @@
|
|||
from util import (
|
||||
get_hwnetid,
|
||||
dict_align_str,
|
||||
)
|
||||
from util_i2c import (
|
||||
i2c_read,
|
||||
i2c_write,
|
||||
)
|
||||
|
||||
import time
|
||||
import datetime
|
||||
import struct
|
||||
from collections import namedtuple
|
||||
from enum import Enum
|
||||
|
||||
# ICS SFP MODULE SLAVE ADDRESSES
|
||||
ICS_SFP_SLAVE_ADDR_MSA = 0x50
|
||||
ICS_SFP_SLAVE_ADDR_DMI = 0x51
|
||||
ICS_SFP_SLAVE_ADDR_MDIO_BRIDGE = 0x56
|
||||
ICS_SFP_SLAVE_ADDR_MDIO_BRIDGE_TECHNICA = 0x40
|
||||
ICS_SFP_SLAVE_ADDR_ICS_CONTROL = 0x1C
|
||||
ICS_SFP_SLAVE_ADDR_ICS_BOOTLOADER = 0x57
|
||||
# ICS SFP MODULE BOOTLOADER COMMANDS
|
||||
ICS_SFP_BL_GET_STATUS = 0x00
|
||||
ICS_SFP_BL_GET_VERSION = 0x12
|
||||
ICS_SFP_BL_SEND_FW = 0x14
|
||||
ICS_SFP_BL_RESET_TO_BL = 0x15
|
||||
ICS_SFP_BL_FLASH_VALIDATE = 0x16
|
||||
ICS_SFP_BL_FLASH_INIT = 0x17
|
||||
ICS_SFP_BL_FLASH_START = 0x18
|
||||
ICS_SFP_BL_FLASH_ERASE = 0x20
|
||||
ICS_SFP_BL_RESET_TO_APP = 0x21
|
||||
ICS_SFP_BL_VALIDATE_SW_VERS = 0x27
|
||||
ICS_SFP_BL_GET_ERROR = 0x28
|
||||
# ICS SFP MODULE ICS CONTROL BYTE OFFSETS
|
||||
ICS_SFP_CONFIG_REG_SLEEP_OFFSET = 0
|
||||
ICS_SFP_CONFIG_REG_BL_OFFSET = 1
|
||||
ICS_SFP_CONFIG_REG_MDIO_SPEED_OFFSET = 2
|
||||
ICS_SFP_CONFIG_REG_MDIO_LINKMODE_OFFSET = 3
|
||||
ICS_SFP_CONFIG_REG_MDIO_PHYMODE_OFFSET = 4
|
||||
ICS_SFP_CONFIG_REG_MDIO_AUTONEG_OFFSET = 5
|
||||
ICS_SFP_CONFIG_REG_MDIO_ENABLE_OFFSET = 6
|
||||
ICS_SFP_CONFIG_REG_PHY_TEMPERATURE_OFFSET = 7
|
||||
ICS_SFP_CONFIG_REG_FW_MINOR_VERS_OFFSET = 8
|
||||
ICS_SFP_CONFIG_REG_FW_MAJOR_VERS_OFFSET = 9
|
||||
ICS_SFP_CONFIG_REG_WRITE_MACSEC_CFG_OFFSET = 10
|
||||
ICS_SFP_CONFIG_REG_CONFIGURE_MACSEC_RULE_OFFSET = 11
|
||||
ICS_SFP_CONFIG_REG_CONFIGURE_MACSEC_MAP_OFFSET = 12
|
||||
ICS_SFP_CONFIG_REG_CONFIGURE_MACSEC_SECY_OFFSET = 13
|
||||
ICS_SFP_CONFIG_REG_CONFIGURE_MACSEC_SC_OFFSET = 14
|
||||
ICS_SFP_CONFIG_REG_CONFIGURE_MACSEC_SA_OFFSET = 15
|
||||
# vendor fields in MSA table
|
||||
ICS_SFP_VENDOR_BRIDGE_ADDR_OVERRIDE_N_MASK = 0x01
|
||||
ICS_SFP_VENDOR_SOFT_OPTIONS_OVERRIDE_N_MASK = 0x02
|
||||
ICS_SFP_VENDOR_ROTARY_SWITCH_OVERRIDE_N_MASK = 0x04
|
||||
|
||||
# MACsec definitions
|
||||
MRVL_Q222X_MAC_DEV = 0x1F
|
||||
MRVL_Q222X_MMAC_READ_LOW = 0x97FE
|
||||
MRVL_Q222X_MMAC_READ_HIGH = 0x97FF
|
||||
MRVL_Q222X_MSEC_CSE_CLR_ON_RD = 0x588
|
||||
MRVL_Q222X_MSEC_CSE_CLR_ON_RD_Tx = 0x5A0
|
||||
|
||||
MRVL_Q222X_MSEC_IN_OCETS_SECY_DECRYPTED = 0x3400
|
||||
MRVL_Q222X_MSEC_IN_OCETS_SECY_VALIDATE = 0x33F0
|
||||
MRVL_Q222X_MSEC_IN_PKTS_SECY_NO_SA = 0x33D0
|
||||
MRVL_Q222X_MSEC_IN_PKTS_SECY_NO_SA_ERROR = 0x33E0
|
||||
MRVL_Q222X_MSEC_IN_PKTS_SECY_BAD_TAG = 0x33C0
|
||||
MRVL_Q222X_MSEC_IN_PKTS_SECY_NO_TAG = 0x33B0
|
||||
MRVL_Q222X_MSEC_IN_PKTS_SECY_UNTAGGED = 0x33A0
|
||||
MRVL_Q222X_MSEC_IN_PKTS_CTRL_PORT_DISABLE = 0x3390
|
||||
MRVL_Q222X_MSEC_IN_CTRL_PORT_OCETS = 0x3300
|
||||
MRVL_Q222X_MSEC_IN_CTRL_PORT_UC_PKTS = 0x3310
|
||||
MRVL_Q222X_MSEC_IN_CTRL_PORT_MC_PKTS = 0x3320
|
||||
MRVL_Q222X_MSEC_IN_CTRL_PORT_BC_PKTS = 0x3330
|
||||
MRVL_Q222X_MSEC_IN_UNCTRL_PORT_OCETS = 0x3340
|
||||
MRVL_Q222X_MSEC_IN_UNCTRL_PORT_UC_PKTS = 0x3350
|
||||
MRVL_Q222X_MSEC_IN_UNCTRL_PORT_MC_PKTS = 0x3360
|
||||
MRVL_Q222X_MSEC_IN_UNCTRL_PORT_BC_PKTS = 0x3370
|
||||
|
||||
MRVL_Q222X_MSEC_OUT_PKTS_CTRL_PORT_DISABLE = 0x3520
|
||||
MRVL_Q222X_MSEC_OUT_PKTS_SECY_UNTAGGED = 0x3530
|
||||
MRVL_Q222X_MSEC_OUT_PKTS_SECY_NO_ACTIVE_SA = 0x3540
|
||||
MRVL_Q222X_MSEC_OUT_PKTS_SECY_TOO_LONG = 0x3550
|
||||
MRVL_Q222X_MSEC_OUT_OCETS_SECY_PROTECTED = 0x3560
|
||||
MRVL_Q222X_MSEC_OUT_OCETS_SECY_ENCRYPTED = 0x3570
|
||||
MRVL_Q222X_MSEC_OUT_CTRL_PORT_OCETS = 0x34A0
|
||||
MRVL_Q222X_MSEC_OUT_CTRL_PORT_UC_PKTS = 0x34B0
|
||||
MRVL_Q222X_MSEC_OUT_CTRL_PORT_MC_PKTS = 0x34C0
|
||||
MRVL_Q222X_MSEC_OUT_CTRL_PORT_BC_PKTS = 0x34D0
|
||||
MRVL_Q222X_MSEC_OUT_UNCTRL_PORT_OCETS = 0x34E0
|
||||
MRVL_Q222X_MSEC_OUT_UNCTRL_PORT_UC_PKTS = 0x34F0
|
||||
MRVL_Q222X_MSEC_OUT_UNCTRL_PORT_MC_PKTS = 0x3500
|
||||
MRVL_Q222X_MSEC_OUT_UNCTRL_PORT_BC_PKTS = 0x3510
|
||||
|
||||
MRVL_Q222X_MSEC_IN_PKTS_SC_CAM_HIT = 0x3620
|
||||
MRVL_Q222X_MSEC_IN_PKTS_SC_LATE = 0x3420
|
||||
MRVL_Q222X_MSEC_IN_PKTS_SC_NOT_VALID = 0x3430
|
||||
MRVL_Q222X_MSEC_IN_PKTS_SC_INVALID = 0x3440
|
||||
MRVL_Q222X_MSEC_IN_PKTS_SC_DELAYED = 0x3450
|
||||
MRVL_Q222X_MSEC_IN_PKTS_SC_UNCHECKED = 0x3460
|
||||
MRVL_Q222X_MSEC_IN_PKTS_SC_OK = 0x3470
|
||||
|
||||
MRVL_Q222X_MSEC_OUT_PKTS_SC_PROTECTED = 0x3580
|
||||
MRVL_Q222X_MSEC_OUT_PKTS_SC_ENCRYPTED = 0x3590
|
||||
|
||||
|
||||
class MRVL_Q222X_MSEC_PACKET_TYPE(Enum):
|
||||
MRVL_Q222X_MSEC_PACKET_NO_VLAN_OR_MPLS = 0
|
||||
MRVL_Q222X_MSEC_PACKET_SINGLE_VLAN = 1
|
||||
MRVL_Q222X_MSEC_PACKET_DUAL_VLAN = 2
|
||||
MRVL_Q222X_MSEC_PACKET_MPLS = 3
|
||||
MRVL_Q222X_MSEC_PACKET_SINGLE_VLAN_FOLLOW_BY_MPLS = 4
|
||||
MRVL_Q222X_MSEC_PACKET_DUAL_VLAN_FOLLOW_BY_MPLS = 5
|
||||
MRVL_Q222X_MSEC_PACKET_UNSUPPORTED_TYPE = 6
|
||||
|
||||
|
||||
class MRVL_Q222X_MSEC_VALIDATEFRAME(Enum):
|
||||
MRVL_Q222X_MSEC_VF_DISABLED = 0
|
||||
MRVL_Q222X_MSEC_VF_CHECK = 1
|
||||
MRVL_Q222X_MSEC_VF_STRICT = 2
|
||||
MRVL_Q222X_MSEC_VF_NA = 3
|
||||
|
||||
|
||||
class MRVL_Q222X_MSEC_STRIP_SECTAG_ICV(Enum):
|
||||
MRVL_Q222X_MSEC_SECTAG_ICV_BOTH_STRIP = 0
|
||||
MRVL_Q222X_MSEC_SECTAG_ICV_RESERVED = 1
|
||||
MRVL_Q222X_MSEC_SECTAG_ICV_STRIP_ICV_ONLY = 2
|
||||
MRVL_Q222X_MSEC_SECTAG_ICV_NO_STRIP = 3
|
||||
|
||||
|
||||
class MRVL_Q222X_MSEC_CIPHER_SUITE(Enum):
|
||||
MRVL_Q222X_MSEC_CIPHER_GCM_AES_128 = 0
|
||||
MRVL_Q222X_MSEC_CIPHER_GCM_AES_256 = 1
|
||||
MRVL_Q222X_MSEC_CIPHER_GCM_AES_128_XPN = 2
|
||||
MRVL_Q222X_MSEC_CIPHER_GCM_AES_256_XPN = 3
|
||||
|
||||
|
||||
class SFP_ICS_CONFIG_SUBCOMMANDS(Enum):
|
||||
CMD_WRITE_SLEEP = 0
|
||||
CMD_WRITE_BOOTLOADER = 1
|
||||
CMD_WRITE_MDIO_PHY_UPDATE = 2
|
||||
CMD_WRITE_TC10_WAKEUP = 3
|
||||
CMD_RESERVED_4 = 4
|
||||
CMD_RESERVED_5 = 5
|
||||
CMD_RESERVED_6 = 6
|
||||
CMD_READ_PHY_TEMPERATURE = 7
|
||||
CMD_READ_FW_MINOR = 8
|
||||
CMD_READ_FW_MAJOR = 9
|
||||
CMD_WRITE_MACSEC_UPDATE = 10
|
||||
CMD_WRITE_MACSEC_CFG_RULE = 11
|
||||
CMD_WRITE_MACSEC_CFG_MAP = 12
|
||||
CMD_WRITE_MACSEC_CFG_SECY = 13
|
||||
CMD_WRITE_MACSEC_CFG_SC = 14
|
||||
CMD_WRITE_MACSEC_CFG_SA = 15
|
||||
|
||||
|
||||
def transmit_i2c_ICSSFP_UPDATE_MACSEC(device, netid, data):
|
||||
return i2c_write(
|
||||
device,
|
||||
netid,
|
||||
ICS_SFP_SLAVE_ADDR_ICS_CONTROL,
|
||||
1,
|
||||
[SFP_ICS_CONFIG_SUBCOMMANDS.CMD_WRITE_MACSEC_UPDATE.value],
|
||||
2,
|
||||
data,
|
||||
)
|
||||
|
||||
|
||||
def transmit_i2c_ICSSFP_CONFIG_MACSEC_RULE(device, netid, len, data):
|
||||
return i2c_write(
|
||||
device,
|
||||
netid,
|
||||
ICS_SFP_SLAVE_ADDR_ICS_CONTROL,
|
||||
1,
|
||||
[SFP_ICS_CONFIG_SUBCOMMANDS.CMD_WRITE_MACSEC_CFG_RULE.value],
|
||||
len,
|
||||
data,
|
||||
)
|
||||
|
||||
|
||||
def transmit_i2c_ICSSFP_CONFIG_MACSEC_MAP(device, netid, len, data):
|
||||
return i2c_write(
|
||||
device,
|
||||
netid,
|
||||
ICS_SFP_SLAVE_ADDR_ICS_CONTROL,
|
||||
1,
|
||||
[SFP_ICS_CONFIG_SUBCOMMANDS.CMD_WRITE_MACSEC_CFG_MAP.value],
|
||||
len,
|
||||
data,
|
||||
)
|
||||
|
||||
|
||||
def transmit_i2c_ICSSFP_CONFIG_MACSEC_SECY(device, netid, len, data):
|
||||
return i2c_write(
|
||||
device,
|
||||
netid,
|
||||
ICS_SFP_SLAVE_ADDR_ICS_CONTROL,
|
||||
1,
|
||||
[SFP_ICS_CONFIG_SUBCOMMANDS.CMD_WRITE_MACSEC_CFG_SECY.value],
|
||||
len,
|
||||
data,
|
||||
)
|
||||
|
||||
|
||||
def transmit_i2c_ICSSFP_CONFIG_MACSEC_SC(device, netid, len, data):
|
||||
return i2c_write(
|
||||
device,
|
||||
netid,
|
||||
ICS_SFP_SLAVE_ADDR_ICS_CONTROL,
|
||||
1,
|
||||
[SFP_ICS_CONFIG_SUBCOMMANDS.CMD_WRITE_MACSEC_CFG_SC.value],
|
||||
len,
|
||||
data,
|
||||
)
|
||||
|
||||
|
||||
def transmit_i2c_ICSSFP_CONFIG_MACSEC_SA(device, netid, len, data):
|
||||
return i2c_write(
|
||||
device,
|
||||
netid,
|
||||
ICS_SFP_SLAVE_ADDR_ICS_CONTROL,
|
||||
1,
|
||||
[SFP_ICS_CONFIG_SUBCOMMANDS.CMD_WRITE_MACSEC_CFG_SA.value],
|
||||
len,
|
||||
data,
|
||||
)
|
||||
|
||||
|
||||
def transmit_i2c_ICSSFP_READ_MACSEC_32B_REG(
|
||||
device, netid, data, i2c_mdio_addr, regaddr
|
||||
):
|
||||
data_lower16b = None
|
||||
data_upper16b = None
|
||||
while data_lower16b is None or data_upper16b is None:
|
||||
# load macsec read reg addr
|
||||
i2c_read(
|
||||
device,
|
||||
netid,
|
||||
i2c_mdio_addr,
|
||||
3,
|
||||
[
|
||||
((0x1 << 5) | MRVL_Q222X_MAC_DEV),
|
||||
((regaddr & 0xFF00) >> 8),
|
||||
(regaddr & 0xFF),
|
||||
],
|
||||
2,
|
||||
[0, 0],
|
||||
)
|
||||
# read out lower 16b
|
||||
data_lower16b = i2c_read(
|
||||
device,
|
||||
netid,
|
||||
i2c_mdio_addr,
|
||||
3,
|
||||
[
|
||||
((0x1 << 5) | MRVL_Q222X_MAC_DEV),
|
||||
((MRVL_Q222X_MMAC_READ_LOW & 0xFF00) >> 8),
|
||||
(MRVL_Q222X_MMAC_READ_LOW & 0xFF),
|
||||
],
|
||||
2,
|
||||
[0, 0],
|
||||
)
|
||||
# read out upper 16b
|
||||
data_upper16b = i2c_read(
|
||||
device,
|
||||
netid,
|
||||
i2c_mdio_addr,
|
||||
3,
|
||||
[
|
||||
((0x1 << 5) | MRVL_Q222X_MAC_DEV),
|
||||
((MRVL_Q222X_MMAC_READ_HIGH & 0xFF00) >> 8),
|
||||
(MRVL_Q222X_MMAC_READ_HIGH & 0xFF),
|
||||
],
|
||||
2,
|
||||
[0, 0],
|
||||
)
|
||||
# return 32b reg data
|
||||
data.append(data_upper16b[3])
|
||||
data.append(data_upper16b[4])
|
||||
data.append(data_lower16b[3])
|
||||
data.append(data_lower16b[4])
|
||||
return data
|
||||
|
||||
|
||||
def transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_addr, regaddr
|
||||
):
|
||||
# read out upper 32b
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_32B_REG(
|
||||
device, netid, data, i2c_mdio_addr, regaddr + 2
|
||||
)
|
||||
# read out lower 32b
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_32B_REG(device, netid, data, i2c_mdio_addr, regaddr)
|
||||
|
||||
|
||||
def transmit_i2c_ICSSFP_WRITE_MACSEC_32B_REG(
|
||||
device, netid, data, i2c_mdio_addr, regaddr
|
||||
):
|
||||
# write lower 16b
|
||||
i2c_write(
|
||||
device,
|
||||
netid,
|
||||
i2c_mdio_addr,
|
||||
3,
|
||||
[MRVL_Q222X_MAC_DEV, ((regaddr & 0xFF00) >> 8), (regaddr & 0xFF)],
|
||||
2,
|
||||
[(data & 0xFF00) >> 8, data & 0xFF],
|
||||
)
|
||||
regaddr += 1
|
||||
# write upper 16b
|
||||
i2c_write(
|
||||
device,
|
||||
netid,
|
||||
i2c_mdio_addr,
|
||||
3,
|
||||
[MRVL_Q222X_MAC_DEV, ((regaddr & 0xFF00) >> 8), (regaddr & 0xFF)],
|
||||
2,
|
||||
[(data & 0xFF000000) >> 24, (data & 0xFF0000) >> 16],
|
||||
)
|
||||
|
||||
|
||||
def sfp_msa_decode(data):
|
||||
table = namedtuple(
|
||||
"msa",
|
||||
"identifier ext_identifier connector transceiver encoding br_nominal l1 l2 l3 l4 l5 vendor_name vendor_oui vendor_pn vendor_rev cc_base options br_max br_min vendor_sn date_year date_month date_day date_lot diag_mon_type enh_options sff8472_compl cc_ext ics_mdio_bridge_addr vendor_data ics_pcb_serial ics_app_id ics_overrides",
|
||||
)
|
||||
data = bytes(data)
|
||||
x = struct.unpack(
|
||||
">BBBQBB1xBBBBB1x16s1x3s16s4s3xBHBB16s2s2s2s2sBBBBB13s16sBB", data
|
||||
)
|
||||
n = 16 * 2
|
||||
hex_str = data.hex()
|
||||
hex_str = "\n".join(hex_str[i : i + n] for i in range(0, len(hex_str), n))
|
||||
print("MSA table raw:\n" + hex_str)
|
||||
table = table._asdict(table._make(x))
|
||||
try:
|
||||
# verify CC_BASE, 8-bit sum of bytes 64-94
|
||||
cc_base = 0
|
||||
for i in range(0, 63):
|
||||
cc_base += data[i]
|
||||
table["cc_base_valid"] = 1 if (cc_base & 0xFF) == table["cc_base"] else 0
|
||||
# verify CC_EXT, 8-bit sum of bytes 64-94
|
||||
cc_ext = 0
|
||||
for i in range(64, 95):
|
||||
cc_ext += data[i]
|
||||
table["cc_ext_valid"] = 1 if (cc_ext & 0xFF) == table["cc_ext"] else 0
|
||||
# convert types of some items
|
||||
table["vendor_name"] = (
|
||||
table["vendor_name"].decode("utf-8", errors="ignore").strip()
|
||||
)
|
||||
table["vendor_pn"] = table["vendor_pn"].decode("utf-8", errors="ignore").strip()
|
||||
table["vendor_rev"] = (
|
||||
table["vendor_rev"].decode("utf-8", errors="ignore").strip()
|
||||
)
|
||||
table["vendor_sn"] = table["vendor_sn"].decode("utf-8", errors="ignore").strip()
|
||||
table["ics_pcb_serial"] = (
|
||||
table["ics_pcb_serial"].decode("utf-8", errors="ignore").strip()
|
||||
)
|
||||
year = table["date_year"].decode("utf-8", errors="ignore").strip()
|
||||
if year.isdigit():
|
||||
table["date_year"] = int(year) + 2000
|
||||
month = table["date_month"].decode("utf-8", errors="ignore").strip()
|
||||
if month.isdigit():
|
||||
table["date_month"] = int(month)
|
||||
day = table["date_day"].decode("utf-8", errors="ignore").strip()
|
||||
if day.isdigit():
|
||||
table["date_day"] = int(day)
|
||||
except Exception:
|
||||
pass
|
||||
return table
|
||||
|
||||
|
||||
def i2c_read_macsec_rx_secy_stats(device, netid, i2c_mdio_address):
|
||||
data = []
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_OCETS_SECY_DECRYPTED
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_OCETS_SECY_VALIDATE
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_PKTS_SECY_NO_SA
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_PKTS_SECY_NO_SA_ERROR
|
||||
)
|
||||
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_PKTS_SECY_BAD_TAG
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_PKTS_SECY_NO_TAG
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_PKTS_SECY_UNTAGGED
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_PKTS_CTRL_PORT_DISABLE
|
||||
)
|
||||
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_CTRL_PORT_OCETS
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_CTRL_PORT_UC_PKTS
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_CTRL_PORT_MC_PKTS
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_CTRL_PORT_BC_PKTS
|
||||
)
|
||||
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_UNCTRL_PORT_OCETS
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_UNCTRL_PORT_UC_PKTS
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_UNCTRL_PORT_MC_PKTS
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_UNCTRL_PORT_BC_PKTS
|
||||
)
|
||||
|
||||
table = namedtuple(
|
||||
"rx_secy_stats",
|
||||
"inOctetsSecYDecrypted inOctetsSecYValidate inPktsSecYNoSAError inPktsSecYNoSA inPktsSecYBadTag inPktsSecYNoTag inPktsSecYUntagged inPktsCtrlPortDisable inCtrlPortOctets inCtrlPortUCPkts inCtrlPortMCPkts inCtrlPortBCPkts inUnCtrlPortOctets inUnCtrlPortUCPkts inUnCtrlPortMCPkts inUnCtrlPortBCPkts",
|
||||
)
|
||||
data = bytes(data)
|
||||
x = struct.unpack(">QQQQQQQQQQQQQQQQ", data)
|
||||
table = table._asdict(table._make(x))
|
||||
return table
|
||||
|
||||
|
||||
def read_macsec_rx_secy_stats(device, netid, i2c_mdio_address):
|
||||
data = i2c_read_macsec_rx_secy_stats(device, netid, i2c_mdio_address)
|
||||
if data is None:
|
||||
return None
|
||||
return data
|
||||
|
||||
|
||||
def i2c_read_macsec_tx_secy_stats(device, netid, i2c_mdio_address):
|
||||
data = []
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device,
|
||||
netid,
|
||||
data,
|
||||
i2c_mdio_address,
|
||||
MRVL_Q222X_MSEC_OUT_PKTS_CTRL_PORT_DISABLE,
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_OUT_PKTS_SECY_UNTAGGED
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device,
|
||||
netid,
|
||||
data,
|
||||
i2c_mdio_address,
|
||||
MRVL_Q222X_MSEC_OUT_PKTS_SECY_NO_ACTIVE_SA,
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_OUT_PKTS_SECY_TOO_LONG
|
||||
)
|
||||
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_OUT_OCETS_SECY_PROTECTED
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_OUT_OCETS_SECY_ENCRYPTED
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_OUT_CTRL_PORT_OCETS
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_OUT_CTRL_PORT_UC_PKTS
|
||||
)
|
||||
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_OUT_CTRL_PORT_MC_PKTS
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_OUT_CTRL_PORT_BC_PKTS
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_OUT_UNCTRL_PORT_OCETS
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_OUT_UNCTRL_PORT_UC_PKTS
|
||||
)
|
||||
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_OUT_UNCTRL_PORT_MC_PKTS
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_OUT_UNCTRL_PORT_BC_PKTS
|
||||
)
|
||||
|
||||
table = namedtuple(
|
||||
"tx_secy_stats",
|
||||
"outPktsCtrlPortDisable outPktsSecYUntagged outPktsSecYNoActiveSA outPktSecYTooLong outOCTETSSecYProtected outOCTETSSecYEncrypted outCtrlPortOctets outCtrlPortUCPkts outCtrlPortMCPkts outCtrlPortBCPkts outUnCtrlPortOctets outUnCtrlPortUCPkts outUnCtrlPortMCPkts outUnCtrlPortBCPkts",
|
||||
)
|
||||
data = bytes(data)
|
||||
x = struct.unpack(">QQQQQQQQQQQQQQ", data)
|
||||
table = table._asdict(table._make(x))
|
||||
return table
|
||||
|
||||
|
||||
def read_macsec_tx_secy_stats(device, netid, i2c_mdio_address):
|
||||
data = i2c_read_macsec_tx_secy_stats(device, netid, i2c_mdio_address)
|
||||
if data is None:
|
||||
return None
|
||||
return data
|
||||
|
||||
|
||||
def i2c_read_macsec_rx_sc_stats(device, netid, i2c_mdio_address):
|
||||
data = []
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_PKTS_SC_CAM_HIT
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_PKTS_SC_LATE
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_PKTS_SC_NOT_VALID
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_PKTS_SC_INVALID
|
||||
)
|
||||
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_PKTS_SC_DELAYED
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_PKTS_SC_UNCHECKED
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_IN_PKTS_SC_OK
|
||||
)
|
||||
|
||||
table = namedtuple(
|
||||
"rx_sc_stats",
|
||||
"inPktsSCCamHit inPktsSCLate inPktsSCNotValid inPktsSCInvalid inPktsSCDelayed inPktsSCUnchecked inPktsSCOK",
|
||||
)
|
||||
data = bytes(data)
|
||||
x = struct.unpack(">QQQQQQQ", data)
|
||||
table = table._asdict(table._make(x))
|
||||
return table
|
||||
|
||||
|
||||
def read_macsec_rx_sc_stats(device, netid, i2c_mdio_address):
|
||||
data = i2c_read_macsec_rx_sc_stats(device, netid, i2c_mdio_address)
|
||||
if data is None:
|
||||
return None
|
||||
return data
|
||||
|
||||
|
||||
def i2c_read_macsec_tx_sc_stats(device, netid, i2c_mdio_address):
|
||||
data = []
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_OUT_PKTS_SC_PROTECTED
|
||||
)
|
||||
transmit_i2c_ICSSFP_READ_MACSEC_64B_REG(
|
||||
device, netid, data, i2c_mdio_address, MRVL_Q222X_MSEC_OUT_PKTS_SC_ENCRYPTED
|
||||
)
|
||||
|
||||
table = namedtuple(
|
||||
"tx_sc_stats",
|
||||
"outPktsProtected outPktsEncrypted",
|
||||
)
|
||||
data = bytes(data)
|
||||
x = struct.unpack(">QQ", data)
|
||||
table = table._asdict(table._make(x))
|
||||
return table
|
||||
|
||||
|
||||
def read_macsec_tx_sc_stats(device, netid, i2c_mdio_address):
|
||||
data = i2c_read_macsec_tx_sc_stats(device, netid, i2c_mdio_address)
|
||||
if data is None:
|
||||
return None
|
||||
return data
|
||||
|
||||
|
||||
def write_macsec_stats_clear_on_read(device, netid, i2c_mdio_address):
|
||||
transmit_i2c_ICSSFP_WRITE_MACSEC_32B_REG(
|
||||
device, netid, 1, i2c_mdio_address, MRVL_Q222X_MSEC_CSE_CLR_ON_RD
|
||||
)
|
||||
transmit_i2c_ICSSFP_WRITE_MACSEC_32B_REG(
|
||||
device, netid, 1, i2c_mdio_address, MRVL_Q222X_MSEC_CSE_CLR_ON_RD_Tx
|
||||
)
|
||||
|
||||
|
||||
def write_macsec_stats_reinit(device, netid, i2c_mdio_address):
|
||||
transmit_i2c_ICSSFP_WRITE_MACSEC_32B_REG(
|
||||
device, netid, 0, i2c_mdio_address, MRVL_Q222X_MSEC_CSE_CLR_ON_RD
|
||||
)
|
||||
transmit_i2c_ICSSFP_WRITE_MACSEC_32B_REG(
|
||||
device, netid, 0, i2c_mdio_address, MRVL_Q222X_MSEC_CSE_CLR_ON_RD_Tx
|
||||
)
|
||||
|
||||
|
||||
def macsec_clear_phy_counters(device, netid, i2c_mdio_address):
|
||||
# Set counters to clear on read
|
||||
write_macsec_stats_clear_on_read(device, netid, i2c_mdio_address)
|
||||
write_macsec_stats_clear_on_read(device, netid, i2c_mdio_address)
|
||||
time.sleep(0.1)
|
||||
# Read secy, sc stats
|
||||
read_macsec_rx_secy_stats(device, netid, i2c_mdio_address)
|
||||
read_macsec_tx_secy_stats(device, netid, i2c_mdio_address)
|
||||
read_macsec_rx_sc_stats(device, netid, i2c_mdio_address)
|
||||
read_macsec_tx_sc_stats(device, netid, i2c_mdio_address)
|
||||
read_macsec_rx_secy_stats(device, netid, i2c_mdio_address)
|
||||
read_macsec_tx_secy_stats(device, netid, i2c_mdio_address)
|
||||
read_macsec_rx_sc_stats(device, netid, i2c_mdio_address)
|
||||
read_macsec_tx_sc_stats(device, netid, i2c_mdio_address)
|
||||
time.sleep(0.1)
|
||||
# Re-init counters
|
||||
write_macsec_stats_reinit(device, netid, i2c_mdio_address)
|
||||
write_macsec_stats_reinit(device, netid, i2c_mdio_address)
|
||||
|
||||
|
||||
def sfp_query_module(device, netid):
|
||||
"""
|
||||
Look for an SFP module on an I2C network.
|
||||
"""
|
||||
data = i2c_read(device, netid, ICS_SFP_SLAVE_ADDR_MSA, 1, [0x00], 128, [0] * 128)
|
||||
if data is None:
|
||||
return None
|
||||
|
||||
msa = sfp_msa_decode(data[1:])
|
||||
return msa
|
||||
|
||||
|
||||
BL_FLAGS_FW_VALID_OFFSET = 0
|
||||
BL_FLAGS_APP_ERROR_OFFSET = 1
|
||||
BL_FLAGS_ERASE_IN_PROGRESS_OFFSET = 2
|
||||
BL_FLAGS_FLASH_IN_PROGRESS_OFFSET = 3
|
||||
BL_FLAGS_RESET_IN_PROGRESS_OFFSET = 4
|
||||
BL_FLAGS_BL_READY_OFFSET = 5
|
||||
BL_FLAGS_FLASH_READY_OFFSET = 6
|
||||
BL_FLAGS_ENABLE_XTEA_OFFSET = 7
|
||||
|
||||
|
||||
def sfp_ics_send_macsec_rule(device, netid, rule):
|
||||
data = []
|
||||
data.append(rule["index"])
|
||||
for x in range(6):
|
||||
data.append(rule["key_MAC_DA"][x])
|
||||
for x in range(6):
|
||||
data.append(rule["mask_MAC_DA"][x])
|
||||
for x in range(6):
|
||||
data.append(rule["key_MAC_SA"][x])
|
||||
for x in range(6):
|
||||
data.append(rule["mask_MAC_SA"][x])
|
||||
for x in bytearray(rule["key_Ethertype"].to_bytes(2, "little")):
|
||||
data.append(x)
|
||||
for x in bytearray(rule["mask_Ethertype"].to_bytes(2, "little")):
|
||||
data.append(x)
|
||||
for x in bytearray(rule["key_outer1"]["vlanTag"]["VID"].to_bytes(2, "little")):
|
||||
data.append(x)
|
||||
data.append(rule["key_outer1"]["vlanTag"]["PRI_CFI"])
|
||||
for x in bytearray(rule["key_outer1"]["mpls"]["MPLS_label"].to_bytes(4, "little")):
|
||||
data.append(x)
|
||||
data.append(rule["key_outer1"]["mpls"]["exp"])
|
||||
for x in bytearray(rule["mask_outer1"]["vlanTag"]["VID"].to_bytes(2, "little")):
|
||||
data.append(x)
|
||||
data.append(rule["mask_outer1"]["vlanTag"]["PRI_CFI"])
|
||||
for x in bytearray(rule["mask_outer1"]["mpls"]["MPLS_label"].to_bytes(4, "little")):
|
||||
data.append(x)
|
||||
data.append(rule["mask_outer1"]["mpls"]["exp"])
|
||||
for x in bytearray(rule["key_outer2"]["vlanTag"]["VID"].to_bytes(2, "little")):
|
||||
data.append(x)
|
||||
data.append(rule["key_outer2"]["vlanTag"]["PRI_CFI"])
|
||||
for x in bytearray(rule["key_outer2"]["mpls"]["MPLS_label"].to_bytes(4, "little")):
|
||||
data.append(x)
|
||||
data.append(rule["key_outer2"]["mpls"]["exp"])
|
||||
for x in bytearray(rule["mask_outer2"]["vlanTag"]["VID"].to_bytes(2, "little")):
|
||||
data.append(x)
|
||||
data.append(rule["mask_outer2"]["vlanTag"]["PRI_CFI"])
|
||||
for x in bytearray(rule["mask_outer2"]["mpls"]["MPLS_label"].to_bytes(4, "little")):
|
||||
data.append(x)
|
||||
data.append(rule["mask_outer2"]["mpls"]["exp"])
|
||||
for x in bytearray(rule["key_bonus_data"].to_bytes(2, "little")):
|
||||
data.append(x)
|
||||
for x in bytearray(rule["mask_bonus_data"].to_bytes(2, "little")):
|
||||
data.append(x)
|
||||
data.append(rule["key_tag_match_bitmap"])
|
||||
data.append(rule["mask_tag_match_bitmap"])
|
||||
data.append(rule["key_packet_type"])
|
||||
data.append(rule["mask_packet_type"])
|
||||
for x in bytearray(rule["key_inner_vlan_type"].to_bytes(2, "little")):
|
||||
data.append(x)
|
||||
for x in bytearray(rule["mask_inner_vlan_type"].to_bytes(2, "little")):
|
||||
data.append(x)
|
||||
for x in bytearray(rule["key_outer_vlan_type"].to_bytes(2, "little")):
|
||||
data.append(x)
|
||||
for x in bytearray(rule["mask_outer_vlan_type"].to_bytes(2, "little")):
|
||||
data.append(x)
|
||||
data.append(rule["key_num_tags"])
|
||||
data.append(rule["mask_num_tags"])
|
||||
data.append(rule["key_express"])
|
||||
data.append(rule["mask_express"])
|
||||
for x in bytearray(rule["isMPLS"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
for x in range(5):
|
||||
data.append(rule["reserved"][x])
|
||||
for x in bytearray(rule["enable"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
transmit_i2c_ICSSFP_CONFIG_MACSEC_RULE(device, netid, len(data), data)
|
||||
|
||||
|
||||
def sfp_ics_send_macsec_map(device, netid, map):
|
||||
data = []
|
||||
data.append(map["index"])
|
||||
for x in bytearray(map["sectag_sci"].to_bytes(8, "little")):
|
||||
data.append(x)
|
||||
data.append(map["secYIndex"])
|
||||
for x in bytearray(map["isControlPacket"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
data.append(map["scIndex"])
|
||||
for x in bytearray(map["auxiliary_plcy"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
data.append(map["ruleId"])
|
||||
for x in range(5):
|
||||
data.append(map["reserved"][x])
|
||||
for x in bytearray(map["enable"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
transmit_i2c_ICSSFP_CONFIG_MACSEC_MAP(device, netid, len(data), data)
|
||||
|
||||
|
||||
def sfp_ics_send_macsec_secy(device, netid, secy):
|
||||
data = []
|
||||
data.append(secy["index"])
|
||||
for x in bytearray(secy["controlled_port_enabled"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
data.append(secy["validate_frames"])
|
||||
data.append(secy["strip_sectag_icv"])
|
||||
data.append(secy["cipher"])
|
||||
data.append(secy["confidential_offset"])
|
||||
for x in bytearray(secy["icv_includes_da_sa"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
for x in bytearray(secy["replay_protect"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
for x in bytearray(secy["replay_window"].to_bytes(4, "little")):
|
||||
data.append(x)
|
||||
for x in bytearray(secy["protect_frames"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
data.append(secy["sectag_offset"])
|
||||
data.append(secy["sectag_tci"])
|
||||
for x in bytearray(secy["mtu"].to_bytes(2, "little")):
|
||||
data.append(x)
|
||||
for x in range(6):
|
||||
data.append(secy["reserved"][x])
|
||||
for x in bytearray(secy["enable"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
transmit_i2c_ICSSFP_CONFIG_MACSEC_SECY(device, netid, len(data), data)
|
||||
|
||||
|
||||
def sfp_ics_send_macsec_sc(device, netid, sc):
|
||||
data = []
|
||||
data.append(sc["index"])
|
||||
data.append(sc["secYIndex"])
|
||||
for x in bytearray(sc["sci"].to_bytes(8, "little")):
|
||||
data.append(x)
|
||||
data.append(sc["sa_index0"])
|
||||
data.append(sc["sa_index1"])
|
||||
for x in bytearray(sc["sa_index0_in_use"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
for x in bytearray(sc["sa_index1_in_use"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
for x in bytearray(sc["enable_auto_rekey"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
for x in bytearray(sc["isActiveSA1"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
for x in range(7):
|
||||
data.append(sc["reserved"][x])
|
||||
for x in bytearray(sc["enable"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
transmit_i2c_ICSSFP_CONFIG_MACSEC_SC(device, netid, len(data), data)
|
||||
|
||||
|
||||
def sfp_ics_send_macsec_sa(device, netid, sa):
|
||||
data = []
|
||||
data.append(sa["index"])
|
||||
for x in range(32):
|
||||
data.append(sa["sak"][x])
|
||||
for x in range(16):
|
||||
data.append(sa["hashKey"][x])
|
||||
for x in range(12):
|
||||
data.append(sa["salt"][x])
|
||||
for x in bytearray(sa["ssci"].to_bytes(4, "little")):
|
||||
data.append(x)
|
||||
data.append(sa["AN"])
|
||||
for x in bytearray(sa["nextPN"].to_bytes(8, "little")):
|
||||
data.append(x)
|
||||
for x in range(5):
|
||||
data.append(sa["reserved"][x])
|
||||
for x in bytearray(sa["enable"].to_bytes(1, "little")):
|
||||
data.append(x)
|
||||
transmit_i2c_ICSSFP_CONFIG_MACSEC_SA(device, netid, len(data), data)
|
||||
|
||||
|
||||
def sfp_ics_update_macsec(
|
||||
device, netid, rx, rule, map, secy, sc, sa, nvm, en, clr, rst
|
||||
):
|
||||
data = []
|
||||
byte0 = rule << 0
|
||||
byte0 |= map << 1
|
||||
byte0 |= secy << 2
|
||||
byte0 |= sc << 3
|
||||
byte0 |= sa << 4
|
||||
byte0 |= rx << 5
|
||||
byte0 |= nvm << 6
|
||||
byte0 |= en << 7
|
||||
data.append(byte0)
|
||||
byte1 = clr << 0
|
||||
byte1 |= rst << 1
|
||||
data.append(byte1)
|
||||
transmit_i2c_ICSSFP_UPDATE_MACSEC(device, netid, data)
|
||||
|
||||
|
||||
def sfp_query_verify_macsec_support(device, netid_config, reset):
|
||||
netid = get_hwnetid(netid_config)
|
||||
# query for MACSec supproted SFP module
|
||||
print("Checking for SFP modules...")
|
||||
msa = sfp_query_module(device, netid)
|
||||
if msa is None:
|
||||
print(f"\nNo SFP module found on port {netid_config}... exiting.")
|
||||
if not reset: # dont exit if we only want to reset
|
||||
exit(1)
|
||||
|
||||
# add information to dictionary
|
||||
d = {}
|
||||
d["Vendor PN"] = msa["vendor_pn"]
|
||||
d["Vendor"] = msa["vendor_name"]
|
||||
d["Vendor Revision"] = msa["vendor_rev"]
|
||||
d["Vendor SN"] = msa["vendor_sn"]
|
||||
try:
|
||||
man_date = datetime.date(msa["date_year"], msa["date_month"], msa["date_day"])
|
||||
x = man_date.strftime("%Y/%m/%d")
|
||||
except Exception:
|
||||
x = f"{msa['date_year']}/{msa['date_month']}/{msa['date_day']} -- invalid"
|
||||
|
||||
d["Manufacture date"] = f"{x}"
|
||||
d["Supports LOS Pin"] = 1 if msa["options"] & 0x02 else 0
|
||||
d["Supports LOS Pin (inverted)"] = 1 if (msa["options"] & 0x04) else 0
|
||||
d["Supports TX Fault Pin"] = 1 if msa["options"] & 0x08 else 0
|
||||
d["Supports TX Disable Pin"] = 1 if msa["options"] & 0x10 else 0
|
||||
d["Supports Rate Select Pin"] = 1 if msa["options"] & 0x20 else 0
|
||||
|
||||
d["Supports Soft LOS"] = 1 if msa["enh_options"] & 0x10 else 0
|
||||
d["Supports Soft TX Fault"] = 1 if msa["enh_options"] & 0x20 else 0
|
||||
d["Supports Soft TX Disable"] = 1 if msa["enh_options"] & 0x40 else 0
|
||||
d["Supports Soft Rate Select"] = 1 if msa["enh_options"] & 0x08 else 0
|
||||
d["Supports Soft Alarm/Warning Flags"] = 1 if msa["enh_options"] & 0x80 else 0
|
||||
d["Supports Diagnostic Monitoring Interface"] = (
|
||||
1 if msa["diag_mon_type"] & 0x40 else 0
|
||||
)
|
||||
if not msa["cc_base_valid"]:
|
||||
d["Check Code"] = hex(msa["cc_base"]) + " -- invalid"
|
||||
if not msa["cc_ext_valid"]:
|
||||
d["Check Code"] = hex(msa["cc_ext"]) + " -- invalid"
|
||||
|
||||
i2c_mdio_address = 0x40
|
||||
if not (msa["ics_overrides"] & 0x1): # MDIO address override
|
||||
i2c_mdio_address = msa["ics_mdio_bridge_addr"]
|
||||
|
||||
# print all information
|
||||
print(dict_align_str(d))
|
||||
|
||||
# verify macsec supported part
|
||||
if d["Vendor PN"] != "SFP-MV2221M-B1":
|
||||
print(f"\nNo SFP-MV2221M-B1 module found on port {netid_config}... exiting.")
|
||||
exit(1)
|
||||
|
||||
if reset: # clear macsec config for this module
|
||||
print(
|
||||
f"\nClearing and Disabling MACSec on SFP module found on port {netid_config}..."
|
||||
)
|
||||
# clear/reset any current macsec configuration
|
||||
sfp_ics_update_macsec(device, netid, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1)
|
||||
time.sleep(1)
|
||||
print(
|
||||
f"\nCleared and Disabled MACSec on SFP module found on port {netid_config}..."
|
||||
)
|
||||
return i2c_mdio_address
|
||||
Binary file not shown.
|
|
@ -0,0 +1,271 @@
|
|||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - MAC DA = 00:FC:70:XX:XX:XX (IntrepidCS OUI) packets authenticated and encrypted
|
||||
# - other packets dropped
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Always Authenticate, Replay Protect, and Encrypt/Decrypt
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - MAC DA = 00:FC:70:XX:XX:XX (IntrepidCS OUI) packets authenticated, replay protected, and decrypted
|
||||
# - other packets dropped
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Drop invalid frames
|
||||
# - Always Authenticate, Replay Protect, and Decrypt User Data
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0x00, 0xFC, 0x70, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0x00, 0xFC, 0x70, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
|
|
@ -0,0 +1,271 @@
|
|||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - MAC SA = 00:FC:70:XX:XX:XX (IntrepidCS OUI) packets authenticated and encrypted
|
||||
# - other packets dropped
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Always Authenticate, Replay Protect, and Encrypt/Decrypt
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - MAC SA = 00:FC:70:XX:XX:XX (IntrepidCS OUI) packets authenticated, replay protected, and decrypted
|
||||
# - other packets dropped
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Drop invalid frames
|
||||
# - Always Authenticate, Replay Protect, and Decrypt User Data
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0x00, 0xFC, 0x70, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0x00, 0xFC, 0x70, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
|
|
@ -0,0 +1,271 @@
|
|||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - MAC SA = 00:FC:70:XX:XX:XX (IntrepidCS OUI) packets authenticated and encrypted
|
||||
# - other packets dropped
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Always Authenticate, Replay Protect, and Encrypt/Decrypt
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - MAC DA = 00:FC:70:XX:XX:XX (IntrepidCS OUI) packets authenticated, replay protected, and decrypted
|
||||
# - other packets dropped
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Drop invalid frames
|
||||
# - Always Authenticate, Replay Protect, and Decrypt User Data
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0x00, 0xFC, 0x70, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0x00, 0xFC, 0x70, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
|
|
@ -0,0 +1,269 @@
|
|||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated and encrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Always Authenticate, Replay Protect, and Encrypt/Decrypt
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated, replay protected, and decrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Drop invalid frames
|
||||
# - Always Authenticate, Replay Protect, and Decrypt User Data
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
|
|
@ -0,0 +1,269 @@
|
|||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated and encrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Always Authenticate, Replay Protect, and Encrypt/Decrypt
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated, replay protected, and decrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_128
|
||||
# - Drop invalid frames
|
||||
# - Always Authenticate, Replay Protect, and Decrypt User Data
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 8 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 9, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 9 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 0 # GCM_AES_128 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 8 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 9, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 9 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
|
|
@ -0,0 +1,269 @@
|
|||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated and encrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_256
|
||||
# - No Encryption, Only Authenticate and Replay Protect
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated, replay protected, and decrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_256
|
||||
# - No Decryption, Only Authenticate and Replay Protect
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV\
|
||||
# - Non-strict validation
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 1 # Validate Frame = CHECK; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 1 # GCM_AES_256 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x08 # SCI included, auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 1 # Validate Frame = CHECK; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 1 # GCM_AES_256 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x08 # SCI included, auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
|
|
@ -0,0 +1,269 @@
|
|||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated and encrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_256
|
||||
# - No Encryption, Only Authenticate and Replay Protect
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated, replay protected, and decrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_256
|
||||
# - No Decryption, Only Authenticate and Replay Protect
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV\
|
||||
# - Non-strict validation
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 1 # Validate Frame = CHECK; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 1 # GCM_AES_256 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x08 # SCI included, auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 8 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 8 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 8 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 8, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 8 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 8, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 8 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 8, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 8 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 1 # Validate Frame = CHECK; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 1 # GCM_AES_256 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x08 # SCI included, auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 8 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 8 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 8, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 8 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 8, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 8 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 8, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 8 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 8, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 8 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
|
|
@ -0,0 +1,269 @@
|
|||
---
|
||||
###############################################################################
|
||||
# This is intended to be used as an example yaml for loading a MACsec
|
||||
# configuration to ICS SFP-MV2221M-B1 module
|
||||
#
|
||||
# MACsec configuration:
|
||||
# tx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated and encrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Use SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_256
|
||||
# - Always Authenticate, Replay Protect, and Encrypt/Decrypt
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
# rx:
|
||||
# rule:
|
||||
# - wildcard / all packets authenticated, replay protected, and decrypted
|
||||
# map:
|
||||
# - Map Rule 0 to SecY 0 and SC 0
|
||||
# - Check SCI = 0xAFAFAFAFAFAFFFFF
|
||||
# secy:
|
||||
# - Cipher = GCM_AES_256
|
||||
# - Drop invalid frames
|
||||
# - Always Authenticate, Replay Protect, and Decrypt User Data
|
||||
# - Strip ICV and SecTag from incoming frames
|
||||
# - Include the MAC DA and SA in the ICV
|
||||
# sc:
|
||||
# - Assign 2 x SA's
|
||||
# - SA 0 is Active
|
||||
# - Enable auto rekey
|
||||
# 2 x sa:
|
||||
# - Define Keys
|
||||
# - Assign indices 0,1
|
||||
# - Next PN = 1
|
||||
###############################################################################
|
||||
tx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 1 # GCM_AES_256 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
rx:
|
||||
rule:
|
||||
index: 0
|
||||
key_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC DA field extracted from the packet
|
||||
mask_MAC_DA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # MAC SA field extracted from the packet
|
||||
mask_MAC_SA: [ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ] # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_Ethertype: 0xFFFF # First E-Type found in the packet that doesn't match one of the preconfigured custom tag
|
||||
mask_Ethertype: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer1: # outermost/1st VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer1: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_outer2: # 2nd outermost VLAN ID {8'd0, VLAN_ID[11:0]}, or 20-bit MPLS label
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
mask_outer2: # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
vlanTag:
|
||||
VID: 0xFFFF
|
||||
PRI_CFI: 0xFF
|
||||
mpls:
|
||||
MPLS_label: 0xFFFFFFFF
|
||||
exp: 0xFF
|
||||
key_bonus_data: 0xFFFF # 2 bytes of additional bonus data extracted from one of the custom tags
|
||||
mask_bonus_data: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_tag_match_bitmap: 0xFF # 8 bits total. Maps 1 to 1 bitwise with the set of custom tags. (set bit[N]=1 if check Nth custom tag)
|
||||
mask_tag_match_bitmap: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_packet_type: 0 # Encoded Packet Type = NO_VLAN_OR_MPLS; see MRVL_Q222X_MSEC_PACKET_TYPE
|
||||
mask_packet_type: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_inner_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the second outermost VLAN Tag
|
||||
mask_inner_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_outer_vlan_type: 0xFFFF # 3 bits total. Encoded value indicating which VLAN TPID value matched for the outermost VLAN Tag
|
||||
mask_outer_vlan_type: 0xFFFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_num_tags: 0xFF # 7 bits total. Number of VLAN/custom tags or MPLS lables detected. Ingress: before SecTag; Egress: total detected
|
||||
mask_num_tags: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
key_express: 0xFF # 1 bits. Express packet
|
||||
mask_express: 0xFF # Set bits to 1 to mask/exclude corresponding flowid_tcam_data bit from compare
|
||||
isMPLS: False
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
map:
|
||||
index: 0
|
||||
sectag_sci: 0xAFAFAFAFAFAFFFFF # Identifies the SecTAG SCI for this Flow
|
||||
secYIndex: 0x00 # Index for entry in Egress secY Policy
|
||||
isControlPacket: False # Identifies all packets matching this index lookup as control packets
|
||||
scIndex: 0x00 # Identifies the SC for this Flow
|
||||
auxiliary_plcy: False # Auxiliary policy bits
|
||||
ruleId: 0x00 # Identifies the Rule for this Flow
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
secy:
|
||||
index: 0x00 # Identifies the SecY for this Flow
|
||||
controlled_port_enabled: True # Enable (or disable) operation of the Controlled port associated with this SecY
|
||||
validate_frames: 2 # Validate Frame = STRICT; see MRVL_Q222X_MSEC_VALIDATEFRAME
|
||||
strip_sectag_icv: 0 # Strip SecTag and ICV; see MRVL_Q222X_MSEC_STRIP_SECTAG_ICV
|
||||
cipher: 1 # GCM_AES_256 = Cipher suite to use for this SecY; see MRVL_Q222X_MSEC_CIPHER_SUITE
|
||||
confidential_offset: 0x00 # Define the number of bytes that are unencrypted following the SecTag
|
||||
icv_includes_da_sa: True # When set, the outer DA/SA bytes are included in the authentication GHASH calculation
|
||||
replay_protect: True # Enables Anti-Replay protection
|
||||
replay_window: 0xFFFFFFFF # Unsigned value indicating the size of the anti-replay window
|
||||
protect_frames: True # 0 = do not encrypt or authenticate this packet; 1 = always Authenticate frame and if SecTag.TCI.E = 1 encrypt the packet as well
|
||||
sectag_offset: 12 # 12B = sizeof(DA) + sizeof(SA); offset in bytes from either the start of the packet or a matching Etype depending on SecTag_Insertion_Mode
|
||||
sectag_tci: 0x0B # SCI included, encrypt and auth user data; Tag Control Information excluding the AN field which originates from the SA Policy table;
|
||||
mtu: 0xFFFF # Specifies the outgoing MTU for this SecY
|
||||
reserved: [ 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sc:
|
||||
index: 0x00 # SC index
|
||||
secYIndex: 0x00 # SecY associated with this packet
|
||||
sci: 0xAFAFAFAFAFAFFFFF # The Secure Channel Identifier
|
||||
sa_index0: 0x00 # Define the 1st SA to use
|
||||
sa_index1: 0x01 # Define the 2nd SA to use
|
||||
sa_index0_in_use: True # Specifies whether 1st SA is in use or not
|
||||
sa_index1_in_use: True # Specifies whether 2nd SA is in use or not
|
||||
enable_auto_rekey: True # If enabled, then once the pn_threshold is reached, auto rekey will happen
|
||||
isActiveSA1: False # If set, then sa_index1 is the currently active SA index. If cleared, the sa_index0 is the currently active SA index
|
||||
reserved: [ 0, 0, 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa0:
|
||||
index: 0x00 # SA index
|
||||
sak: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0, 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x00 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
sa1:
|
||||
index: 0x01 # SA index
|
||||
sak: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0, 6, 0, 0, 0, 9, 0, 0, 0, 8, 0, 0, 0, 11, 0, 0, 0 ] # 256b SAK: Define the encryption key to be used to encrypte this packet. The lower 128 bits are used for 128-bit ciphers
|
||||
hashKey: [ 3, 0, 0, 0, 5, 0, 0, 0, 4, 0, 0, 0, 7, 0, 0, 0 ] # 128b Hash Key: Key used for authentication
|
||||
salt: [ 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0 ] # 96b Salt value: Salt value used in XPN ciphers
|
||||
ssci: 0xFFFFFFFF # 32b SSCI value: Short Secure Channel Identifier, used in XPN ciphers
|
||||
AN: 0x01 # 2b SecTag Association Number (AN)
|
||||
nextPN: 0x0000000000000001 # 64b next_pn value: Next packet number to insert into outgoing packet on a particular SA
|
||||
reserved: [ 0, 0, 0, 0, 0 ]
|
||||
enable: True
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
# <u>MACsec and TC10 demo</u>
|
||||
## Show case
|
||||
The demo should show:
|
||||
1. MACsec secured datastream - only one Module is MACsec configured, modules might be swapped for showcasing
|
||||
2. TC10 controlled SFP plugs
|
||||
|
||||
<u>Needed equipment:</u>
|
||||
* GigaStar
|
||||
* 2 SFP: MV2221M 1000-Base-T1 modules, enabled for TC10/MACsec
|
||||
## 1. Preparation
|
||||
* If SFP module MV2221M 1000-Base-T1 is not yet flashed to support MACsec,\
|
||||
[RGS_ICS_SFP_FLASHER_REV1_4.vs3](.\SFP_Flasher\v1.4\RGS_ICS_SFP_FLASHER_REV1_4.vs3) is needed to flash the module.
|
||||
Take care that also the binary [sfp_mv2221m_b1_mchip.msgbin](.\SFP_Flasher\v1.4\sfp_mv2221m_b1_mchip.msgbin) is available.
|
||||
* To download a MACsec configuration, actually you will need a small python script you find in the [MACsec_Utilities folder](.\MACsec_Utilitie) (see **2.**)\
|
||||
In this case you might have to install [python](https://www.python.org/downloads/) onto the PC\
|
||||
Also you will need python_ics ``` pip instal python_ics ``` and ``` pip install pyyaml ```
|
||||
|
||||
|
||||
## 2. Downloading MACsec configuration to SFP module
|
||||
If the SFP module is ready for MACsec en- and decryption, you can download one of the [Example YAML-Files](.\MACsec_Utilitie\yaml)\
|
||||
e.g.\
|
||||
<b>programming SFP01 of device <i>GS0728</i>:</b>
|
||||
python test_sfp_macsec_util.py <i><b>GS0728</b></i> --sfp --config_netid <b>NETID_I2C2</b> --yaml test_sfp_macsec_Rule_wildcard_SecY_256_strip_noEncrypt_onlyCheck_sci_SA_sak0.yml\
|
||||
<b>programming SFP02 of device <i>GS0728</i>:</b> python test_sfp_macsec_util.py <i><b>GS0728</b></i> --sfp --config_netid <b>NETID_I2C3</b> --yaml test_sfp_macsec_Rule_wildcard_SecY_256_strip_noEncrypt_onlyCheck_sci_SA_sak0.yml\
|
||||
<b>clearing SFP02 of device <i>GS0728</i>:</b> python test_sfp_macsec_util.py <i><b>GS0728</b></i> --sfp --config_netid <b>NETID_I2C3</b> --yaml test_sfp_macsec_Rule_wildcard_SecY_256_strip_noEncrypt_onlyCheck_sci_SA_sak0.yml --reset\
|
||||
or just\
|
||||
python test_sfp_macsec_util.py <i><b>GS0728</b></i> --sfp --config_netid <b>NETID_I2C3</b> --reset\
|
||||
\
|
||||
There are four example <b>batch-files</b> available to set and reset SFP01 and SFP02 modules. Device SN has to be adjusted.
|
||||
|
||||
## 3. Demosetup TC10_MACsec Demo.vs3
|
||||
\
|
||||
|
||||
If SFP modules are swapped direction of encryption will change
|
||||
|
|
@ -0,0 +1,75 @@
|
|||
@mainpage README.md
|
||||
|
||||
# ICS SFP RESOURCES RELEASE NOTES
|
||||
> Copyright (c) 2023 Intrepid Control Systems, Inc.
|
||||
|
||||
|
||||
---
|
||||
|
||||
## General Information
|
||||
|
||||
### ICS SFP Resources include latest Release firmware and VSpy .vs3 files for module interfacing, and includes the following:
|
||||
- sfp_mv2221m_b1_mchip.msgbin
|
||||
- Latest Release Firmware for SFP-MV2221M module
|
||||
- sfp_mv2112_a2_mchip.msgbin
|
||||
- Latest Release Firmware for SFP-MV2112 module
|
||||
- RGS_ICS_SFP_FLASHER_REV1_4.vs3
|
||||
- VSpy .vs3 for flashing ICS SFP module firmware
|
||||
- ICS_SFP_MV2221M_TC10.vs3
|
||||
- VSpy .vs3 for interfacing examples with ICS SFP modules via I2C
|
||||
- /MACsec/
|
||||
- Python src files for loading a MACsec configuration to the device
|
||||
|
||||
### Instructions:
|
||||
- ICS SFP Firmware Flashing:
|
||||
- Copy "sfp_mv2221m_b1_mchip.msgbin" and "sfp_mv2112_a2_mchip.msgbin" to directory "<VSPY_INSTALL_DIR>\Data Directory\Default"
|
||||
- Run VSpy
|
||||
- Load "RGS_ICS_SFP_FLASHER_REV1_4.vs3"
|
||||
- Go online with RADGigastar
|
||||
- Make sure an SFP module is plugged into a RADGigastar SFP port
|
||||
- Click the "Flash Firmware" button on the displayed Graphical Panel
|
||||
- Wait for indicater "Flashing Completed"
|
||||
- Limitations:
|
||||
- This .vs3 only supports flashing 1 SFP port at a time (RADGigastar SFP1 port is prioritized)
|
||||
- May need to plug cycle the device after successful flashing for the RADgigastar to detect the module
|
||||
- ICS SFP module interfacing examples:
|
||||
- Run VSpy
|
||||
- Load "ICS_SFP_MV2221M_TC10.vs3"
|
||||
- Go online with RADGigastar
|
||||
- Make sure an ICS SFP module is plugged into a RADGigstar SFP port
|
||||
- Transmit I2C messages for Read/Write examples
|
||||
- NOTES
|
||||
- I2C2 messages correlate with SFP1 port on the RADgigastar
|
||||
- I2C3 messages correlate with SFP2 port on the RADgigastar
|
||||
- All TC10 example messages are only supported on the SFP-MV2221M module (PHY limitation)
|
||||
- MACsec
|
||||
- See "/MACsec/README.md"
|
||||
---
|
||||
|
||||
## Version History
|
||||
- (11/27/2023)
|
||||
- Added "MACsec" folder with python src files for loading a MACsec configuration to the device
|
||||
- /yaml/ folder containing 8 MACsec configurations
|
||||
- test_sfp_macsec_util.py
|
||||
- util_eth.py
|
||||
- util_sfp.py
|
||||
- util.py
|
||||
- README.md
|
||||
- (9/5/2023)
|
||||
- Fix ICS SFP flasher textbox and led indicaters:
|
||||
- RGS_ICS_SFP_FLASHER_REV1_4.vs3
|
||||
- (9/5/2023)
|
||||
- Fix ICS SFP flasher binary size errors:
|
||||
- RGS_ICS_SFP_FLASHER_REV1_3.vs3
|
||||
- (8/9/2023)
|
||||
- Update Release firwmare:
|
||||
- sfp_mv2221m_b1_mchip.msgbin
|
||||
- sfp_mv2112_a2_mchip.msgbin
|
||||
- (6/29/2023)
|
||||
- First draft of the following files:
|
||||
- sfp_mv2221m_b1_mchip.msgbin
|
||||
- sfp_mv2112_a2_mchip.msgbin
|
||||
- ICS_SFP_FLASHER.vs3
|
||||
- ICS_SFP_MV2221M_TC10.vs3
|
||||
|
||||
---
|
||||
File diff suppressed because one or more lines are too long
Binary file not shown.
Binary file not shown.
File diff suppressed because it is too large
Load Diff
Binary file not shown.
|
After Width: | Height: | Size: 659 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 818 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 748 KiB |
Loading…
Reference in New Issue