Message: Validate PHY register batches

CMakeLists.txt

@@ -570,9 +570,11 @@ if(LIBICSNEO_BUILD_UNIT_TESTS)
 		test/unit/a2bencoderdecodertest.cpp
 		test/unit/mdioencoderdecodertest.cpp
 		test/unit/livedataencoderdecodertest.cpp
+		test/unit/macsectest.cpp
 		test/unit/ringbuffertest.cpp
 		test/unit/apperrordecodertest.cpp
 		test/unit/icsneoc2.cpp
+		test/unit/ethphyregistertest.cpp
 		test/unit/windowsstrings.cpp
 		test/unit/periodictest.cpp
 	)

api/icsneocpp/eventmanager.cpp

@@ -65,7 +65,6 @@ void EventManager::add(APIEvent event) {
 				std::lock_guard<std::mutex> eventsLock(eventsMutex);
 				addEventInternal(event);
 			} // free the lock so that callbacks may modify events
-			runCallbacks(event);
 		} else {
 			std::lock_guard<std::mutex> errorsLock(errorsMutex);
 			lastUserErrors[std::this_thread::get_id()] = event;
@@ -75,8 +74,8 @@ void EventManager::add(APIEvent event) {
 			std::lock_guard<std::mutex> eventsLock(eventsMutex);
 			addEventInternal(event);
 		} // free the lock so that callbacks may modify events
-		runCallbacks(event);
 	}
+	runCallbacks(event);
 }
 
 void EventManager::addEventInternal(APIEvent event) {

bindings/python/icsneopy/core/macseccfg.cpp

@@ -154,7 +154,6 @@ void init_macsecconfig(pybind11::module_ & m)
 		.def("set_storage", &MACsecConfig::setStorage, pybind11::call_guard<pybind11::gil_scoped_release>())
 		.def("clear", &MACsecConfig::clear, pybind11::call_guard<pybind11::gil_scoped_release>())
 		.def("serialize", &MACsecConfig::serialize, pybind11::call_guard<pybind11::gil_scoped_release>())
-		.def("get_bin_index", &MACsecConfig::getBinIndex, pybind11::call_guard<pybind11::gil_scoped_release>())
 		.def("get_type", &MACsecConfig::getType, pybind11::call_guard<pybind11::gil_scoped_release>())
 		.def("get_max_num_rule", &MACsecConfig::getMaxNumRule, pybind11::call_guard<pybind11::gil_scoped_release>())
 		.def("get_max_num_secy", &MACsecConfig::getMaxNumSecY, pybind11::call_guard<pybind11::gil_scoped_release>())

bindings/python/icsneopy/device/device.cpp

@@ -34,6 +34,7 @@ void init_device(pybind11::module_& m) {
 		.def("get_serial", &Device::getSerial)
 		.def("get_pcb_serial", &Device::getPCBSerial, pybind11::call_guard<pybind11::gil_scoped_release>())
 		.def("get_mac_addresses", &Device::getMACAddresses, pybind11::call_guard<pybind11::gil_scoped_release>())
+		.def("get_macsec_networks", &Device::getMACsecNetworks)
 		.def("get_supported_rx_networks", &Device::getSupportedRXNetworks, pybind11::return_value_policy::reference)
 		.def("get_supported_tx_networks", &Device::getSupportedTXNetworks, pybind11::return_value_policy::reference)
 		.def("get_tc10_status", &Device::getTC10Status, pybind11::call_guard<pybind11::gil_scoped_release>())
@@ -64,7 +65,7 @@ void init_device(pybind11::module_& m) {
 		.def("set_value_live_data", &Device::setValueLiveData, pybind11::arg("message"), pybind11::call_guard<pybind11::gil_scoped_release>())
 		.def("transmit", pybind11::overload_cast<std::shared_ptr<Frame>>(&Device::transmit), pybind11::call_guard<pybind11::gil_scoped_release>())
 		.def("upload_coremini", [](Device& device, std::string& path, Disk::MemoryType memType) { std::ifstream ifs(path, std::ios::binary); return device.uploadCoremini(ifs, memType); }, pybind11::call_guard<pybind11::gil_scoped_release>())
-		.def("write_macsec_config", &Device::writeMACsecConfig, pybind11::call_guard<pybind11::gil_scoped_release>())
+		.def("write_macsec_config", &Device::writeMACsecConfig, pybind11::arg("config"), pybind11::arg("network"), pybind11::call_guard<pybind11::gil_scoped_release>())
 		.def("send_eth_phy_msg", &Device::sendEthPhyMsg, pybind11::arg("message"), pybind11::arg("timeout") = std::chrono::milliseconds(50), pybind11::call_guard<pybind11::gil_scoped_release>())
 		.def("get_chip_versions", &Device::getChipVersions, pybind11::arg("refreshComponents") = true, pybind11::call_guard<pybind11::gil_scoped_release>())
 		.def("supports_disk_formatting", &Device::supportsDiskFormatting, pybind11::call_guard<pybind11::gil_scoped_release>())

communication/packet/ethphyregpacket.cpp

@@ -20,7 +20,7 @@ std::shared_ptr<EthPhyMessage> HardwareEthernetPhyRegisterPacket::DecodeToMessag
 	if(
 		(PhyPacketVersion == pHeader->version) &&
 		(sizeof(PhyRegisterPacket_t) == pHeader->entryBytes) &&
-		(numEntries <= MaxPhyEntries) &&
+		(numEntries > 0 && numEntries <= MaxPhyEntries) &&
 		((bytestream.size() - sizeof(PhyRegisterHeader_t))
 			== (sizeof(PhyRegisterPacket_t) * numEntries))
 	)
@@ -30,6 +30,10 @@ std::shared_ptr<EthPhyMessage> HardwareEthernetPhyRegisterPacket::DecodeToMessag
 		for(size_t entryIdx{0}; entryIdx < numEntries; ++entryIdx)
 		{
 			const PhyRegisterPacket_t* pEntry = (pFirstEntry + entryIdx);
+			if(pEntry->version != PhyPacketVersion) {
+				report(APIEvent::Type::ParameterOutOfRange, APIEvent::Severity::Error);
+				return nullptr;
+			}
 			auto phyMessage = std::make_shared<PhyMessage>();
 			phyMessage->Enabled = (pEntry->Enabled != 0u);
 			phyMessage->WriteEnable = (pEntry->WriteEnable != 0u);
@@ -43,6 +47,10 @@ std::shared_ptr<EthPhyMessage> HardwareEthernetPhyRegisterPacket::DecodeToMessag
 			msg->messages.push_back(phyMessage);
 		}
 	}
+	else {
+		report(APIEvent::Type::ParameterOutOfRange, APIEvent::Severity::Error);
+		return nullptr;
+	}
 	return msg;
 }
 
@@ -59,7 +67,20 @@ bool HardwareEthernetPhyRegisterPacket::EncodeFromMessage(const EthPhyMessage& m
 		report(APIEvent::Type::MessageMaxLengthExceeded, APIEvent::Severity::Error);
 		return false;
 	}
-	auto byteSize = (messageCount * sizeof(PhyRegisterPacket_t)) + sizeof(PhyRegisterHeader_t);
+	// Validate every entry before touching the caller's output or submitting a command.
+	for(const auto& entry : message.messages) {
+		if(!entry) {
+			report(APIEvent::Type::RequiredParameterNull, APIEvent::Severity::Error);
+			return false;
+		}
+		if(entry->BusIndex > 15 || entry->Version != PhyPacketVersion ||
+			(entry->Clause45Enable ? (entry->Clause45.port > FiveBits || entry->Clause45.device > FiveBits) :
+			(entry->Clause22.phyAddr > FiveBits || entry->Clause22.regAddr > FiveBits))) {
+			report(APIEvent::Type::ParameterOutOfRange, APIEvent::Severity::Error);
+			return false;
+		}
+	}
+	auto byteSize = bytestream.size() + (messageCount * sizeof(PhyRegisterPacket_t)) + sizeof(PhyRegisterHeader_t);
 	bytestream.reserve(byteSize);
 	bytestream.push_back(static_cast<uint8_t>(messageCount & 0xFF));
 	bytestream.push_back(static_cast<uint8_t>((messageCount >> 8) & 0xFF));
@@ -67,7 +88,7 @@ bool HardwareEthernetPhyRegisterPacket::EncodeFromMessage(const EthPhyMessage& m
 	bytestream.push_back(static_cast<uint8_t>(sizeof(PhyRegisterPacket_t)));
 	for(auto& phyMessage : message.messages)
 	{
-		PhyRegisterPacket_t tempPacket;
+		PhyRegisterPacket_t tempPacket{};
 		tempPacket.Enabled = phyMessage->Enabled ? 0x1u : 0x0u;
 		tempPacket.WriteEnable = phyMessage->WriteEnable ? 0x1u : 0x0u;
 		tempPacket.BusIndex = (phyMessage->BusIndex & 0xF);

core/macseccfg.cpp

@@ -231,16 +231,16 @@ MACsecConfig::MACsecConfig(const DeviceType& deviceType) : type(deviceType) {
 		case icsneo::DeviceType::Enum::RADMoon3:
 		case icsneo::DeviceType::Enum::RADEpsilon:
 		case icsneo::DeviceType::Enum::RADGigastar2:
+		case icsneo::DeviceType::Enum::RADComet2:
+		case icsneo::DeviceType::Enum::RADComet3:
 			maxSecY = 2;
 			maxRule = 2;
 			maxSa = 4;
-			binIndex = 0;
 			break;
 		default:
 			maxSecY = 0;
 			maxSa = 0;
 			maxRule = 0;
-			binIndex = 0;
 			ReportEvent(APIEvent::Type::MACsecNotSupported, APIEvent::Severity::Error);
 			return;
 	}
@@ -515,10 +515,6 @@ MACsecConfig::operator bool() const {
 	return (maxSa != 0) || (maxSecY != 0) || (maxRule != 0);
 }
 
-uint16_t MACsecConfig::getBinIndex() const {
-	return binIndex;
-}
-
 DeviceType MACsecConfig::getType() const {
 	return type;
 }

device/device.cpp

@@ -2053,7 +2053,12 @@ std::optional<EthPhyMessage> Device::sendEthPhyMsg(const EthPhyMessage& message,
 	}
 
 	std::vector<uint8_t> bytes;
-	HardwareEthernetPhyRegisterPacket::EncodeFromMessage(message, bytes, report);
+	if(timeout.count() <= 0) {
+		report(APIEvent::Type::ParameterOutOfRange, APIEvent::Severity::Error);
+		return std::nullopt;
+	}
+	if(!HardwareEthernetPhyRegisterPacket::EncodeFromMessage(message, bytes, report))
+		return std::nullopt;
 	std::shared_ptr<Message> response = com->waitForMessageSync(
 		[this, bytes](){ return com->sendCommand(Command::PHYControlRegisters, bytes); },
 		std::make_shared<MessageFilter>(Message::Type::EthernetPhyRegister), timeout);
@@ -3761,7 +3766,15 @@ std::optional<GPTPStatus> Device::getGPTPStatus(std::chrono::milliseconds timeou
 	return *retMsg;
 }
 
-bool Device::writeMACsecConfig(const MACsecConfig& cfg) {
+std::vector<Network> Device::getMACsecNetworks() const {
+	std::vector<Network> networks;
+	for(const auto& network : getMACsecNetworkMap()) {
+		networks.emplace_back(network.first);
+	}
+	return networks;
+}
+
+bool Device::writeMACsecConfig(const MACsecConfig& cfg, Network::NetID network) {
 	if(!cfg) {
 		report(APIEvent::Type::MACsecNotSupported, APIEvent::Severity::Error);
 		return false;
@@ -3772,8 +3785,15 @@ bool Device::writeMACsecConfig(const MACsecConfig& cfg) {
 		return false;
 	}
 
+	const auto& networks = getMACsecNetworkMap();
+	const auto binaryIndex = networks.find(network);
+	if(binaryIndex == networks.end()) {
+		report(APIEvent::Type::MACsecNotSupported, APIEvent::Severity::Error);
+		return false;
+	}
+
 	std::vector<uint8_t> raw = cfg.serialize();
-	return writeBinaryFile(raw, cfg.getBinIndex());
+	return writeBinaryFile(raw, binaryIndex->second);
 }
 
 bool Device::enableNetworkCommunication(bool enable, uint32_t timeout) {

examples/cpp/macsec/src/macsec.cpp

@@ -77,7 +77,7 @@ int main(int, char**) {
 	cfg.setTxEnable(true);
 
 	// Write config to the device
-	if(!device->writeMACsecConfig(cfg)) {
+	if(!device->writeMACsecConfig(cfg, icsneo::Network::NetID::AE_01)) {
 		std::cout << "Failed to write MACsec config" << std::endl;
 		std::cout << icsneo::GetLastError() << std::endl;
 		return -1;

include/icsneo/communication/message/ethphymessage.h

@@ -17,13 +17,13 @@ namespace icsneo {
 #endif
 
 struct PhyMessage {
-	bool Enabled;
-	bool WriteEnable;
-	bool Clause45Enable;
-	uint8_t BusIndex;
-	uint8_t Version;
+	bool Enabled = false;
+	bool WriteEnable = false;
+	bool Clause45Enable = false;
+	uint8_t BusIndex = 0;
+	uint8_t Version = PhyPacketVersion;
 	union {
-		Clause22Message Clause22;
+		Clause22Message Clause22{};
 		Clause45Message Clause45;
 	};
 };

include/icsneo/communication/packet/ethphyregpacket.h

@@ -65,7 +65,7 @@ struct PhyRegisterPacket_t {
 #pragma pack(pop)
 
 static constexpr size_t MaxPhyEntries = 128u;
-static constexpr size_t MaxBytesPhyEntries = MaxPhyEntries * sizeof(PhyRegisterHeader_t);
+static constexpr size_t MaxBytesPhyEntries = MaxPhyEntries * sizeof(PhyRegisterPacket_t);
 static constexpr uint8_t PhyPacketVersion = 1u;
 static constexpr uint8_t FiveBits = 0x1Fu;
 

include/icsneo/core/macseccfg.h

@@ -150,7 +150,6 @@ private:
 	uint8_t maxSecY;
 	uint8_t maxSa;
 	uint8_t maxRule;
-	uint16_t binIndex;
 	DeviceType type;
 
 	std::vector<MACsecRxRule> rxRule;
@@ -205,7 +204,6 @@ public:
 	void clear();
 	std::vector<uint8_t> serialize() const;
 	operator bool() const;
-	uint16_t getBinIndex() const;
 	DeviceType getType() const;
 	uint8_t getMaxNumRule() const;
 	uint8_t getMaxNumSecY() const;

include/icsneo/device/device.h

@@ -12,6 +12,7 @@
 #include <type_traits>
 #include <optional>
 #include <unordered_map>
+#include <map>
 #include <set>
 #include <unordered_set>
 #include <chrono>
@@ -897,7 +898,8 @@ public:
 	std::optional<GPTPStatus> getGPTPStatus(std::chrono::milliseconds timeout = std::chrono::milliseconds(100));
 
 	/* MACsec support */
-	virtual bool writeMACsecConfig(const MACsecConfig& cfg);
+	std::vector<Network> getMACsecNetworks() const;
+	bool writeMACsecConfig(const MACsecConfig& cfg, Network::NetID network);
 
 	std::shared_ptr<DeviceExtension> getExtension(const std::string& name) const;
 	
@@ -917,6 +919,13 @@ public:
 	bool iso15765SetupRxFlowControl(const Network& network, const Iso15765MessageArgs& msg);
 
 protected:
+	using MACsecNetworkMap = std::map<Network::NetID, uint16_t>;
+
+	virtual const MACsecNetworkMap& getMACsecNetworkMap() const {
+		static const MACsecNetworkMap networks;
+		return networks;
+	}
+
 	bool online = false;
 	int messagePollingCallbackID = 0;
 	int internalHandlerCallbackID = 0;

include/icsneo/device/tree/radcomet2/radcomet2.h

@@ -70,6 +70,13 @@ public:
 	}
 
 protected:
+	const MACsecNetworkMap& getMACsecNetworkMap() const override {
+		static const MACsecNetworkMap networks = {
+			{Network::NetID::AE_01, 0},
+		};
+		return networks;
+	}
+
 	RADComet2(neodevice_t neodevice, const driver_factory_t& makeDriver) : Device(neodevice) {
 		initialize<RADComet2Settings, Disk::NeoMemoryDiskDriver, Disk::NeoMemoryDiskDriver>(makeDriver);
 	}

include/icsneo/device/tree/radcomet3/radcomet3.h

@@ -77,6 +77,13 @@ public:
 	}
 
 protected:
+	const MACsecNetworkMap& getMACsecNetworkMap() const override {
+		static const MACsecNetworkMap networks = {
+			{Network::NetID::AE_01, 0},
+		};
+		return networks;
+	}
+
 	RADComet3(neodevice_t neodevice, const driver_factory_t& makeDriver) : Device(neodevice) {
 		initialize<RADComet3Settings, Disk::NeoMemoryDiskDriver, Disk::NeoMemoryDiskDriver>(makeDriver);
 	}

include/icsneo/device/tree/radgigastar2/radgigastar2.h

@@ -217,6 +217,14 @@ public:
 		return chipVersions;
 	}
 protected:
+	const MACsecNetworkMap& getMACsecNetworkMap() const override {
+		static const MACsecNetworkMap networks = {
+			{Network::NetID::AE_01, 0},
+			{Network::NetID::AE_02, 1},
+		};
+		return networks;
+	}
+
 	RADGigastar2(neodevice_t neodevice, const driver_factory_t &makeDriver) : Device(neodevice)
 	{
 		initialize<RADGigastar2Settings, Disk::ExtExtractorDiskReadDriver, Disk::NeoMemoryDiskDriver>(makeDriver);

include/icsneo/device/tree/radmoon2/radmoon2zl.h

@@ -38,6 +38,13 @@ public:
 			.add<ReconnectPhase>();
 	}
 protected:
+	const MACsecNetworkMap& getMACsecNetworkMap() const override {
+		static const MACsecNetworkMap networks = {
+			{Network::NetID::AE_01, 0},
+		};
+		return networks;
+	}
+
 	RADMoon2ZL(neodevice_t neodevice, const driver_factory_t& makeDriver) : RADMoon2Base(neodevice) {
 		initialize<RADMoon2Settings>(makeDriver);
 	}

include/icsneo/device/tree/radmoon3/radmoon3.h

@@ -52,6 +52,14 @@ public:
 			.add<ReconnectPhase>();
 	}
 protected:
+	const MACsecNetworkMap& getMACsecNetworkMap() const override {
+		static const MACsecNetworkMap networks = {
+			{Network::NetID::AE_01, 0},
+			{Network::NetID::ETHERNET_01, 1},
+		};
+		return networks;
+	}
+
 	RADMoon3(neodevice_t neodevice, const driver_factory_t& makeDriver) : Device(neodevice) {
 		initialize<RADMoon3Settings>(makeDriver);
 	}

test/unit/ethphyregistertest.cpp

@@ -0,0 +1,103 @@
+#include "icsneo/communication/message/ethphymessage.h"
+#include "icsneo/communication/packet/ethphyregpacket.h"
+#include "gtest/gtest.h"
+#include "icsneo/device/tree/radjupiter/radjupiter.h"
+using namespace icsneo;
+namespace {
+const device_eventhandler_t ignore = [](APIEvent::Type, APIEvent::Severity) {};
+EthPhyMessage request(bool clause45 = false, bool write = false) {
+	EthPhyMessage msg;
+	msg.appendPhyMessage(write, clause45, 31, clause45 ? 31 : 255, clause45 ? 65535 : 31, 0x1234);
+	msg.messages[0]->BusIndex = 15;
+	return msg;
+}
+std::vector<uint8_t> encode(const EthPhyMessage& msg) {
+	std::vector<uint8_t> bytes;
+	EXPECT_TRUE(HardwareEthernetPhyRegisterPacket::EncodeFromMessage(msg, bytes, ignore));
+	return bytes;
+}
+}
+TEST(EthPhyRegister, KnownWireBytes) {
+	for(bool clause45 : {false, true}) {
+		auto msg = request(clause45, true);
+		auto bytes = encode(msg);
+		EXPECT_EQ(bytes, (std::vector<uint8_t>{1, 0, 1, 8, static_cast<uint8_t>(clause45 ? 7 : 3), 0x1f,
+			31, static_cast<uint8_t>(clause45 ? 31 : 255), static_cast<uint8_t>(clause45 ? 255 : 31),
+			static_cast<uint8_t>(clause45 ? 255 : 0), 0x34, 0x12}));
+	}
+}
+TEST(EthPhyRegister, InvalidRequestsLeaveOutputUntouched) {
+	for(int invalid = 0; invalid < 8; ++invalid) {
+		auto msg = request();
+		switch(invalid) {
+		case 0: msg.messages.clear(); break;
+		case 1: msg.messages.resize(129, msg.messages[0]); break;
+		case 2: msg.messages.push_back(nullptr); break;
+		case 3: msg.messages[0]->BusIndex = 16; break;
+		case 4: msg.messages[0]->Version = 0; break;
+		case 5: msg.messages[0]->Clause22.phyAddr = 32; break;
+		case 6: msg.messages[0]->Clause22.regAddr = 32; break;
+		case 7: msg.messages = request(true).messages; msg.messages[0]->Clause45.device = 32; break;
+		}
+		std::vector<uint8_t> bytes{0xaa};
+		EXPECT_FALSE(HardwareEthernetPhyRegisterPacket::EncodeFromMessage(msg, bytes, ignore));
+		EXPECT_EQ(bytes, (std::vector<uint8_t>{0xaa}));
+	}
+	auto msg = request(); msg.messages.resize(128, msg.messages[0]);
+	EXPECT_EQ(encode(msg).size(), 1028u);
+}
+TEST(EthPhyRegister, RejectMalformedResponses) {
+	const auto valid = encode(request());
+	for(size_t size = 0; size < valid.size(); ++size)
+		EXPECT_EQ(HardwareEthernetPhyRegisterPacket::DecodeToMessage({valid.begin(), valid.begin() + size}, ignore), nullptr);
+	for(size_t index : {0u, 2u, 3u, 5u}) {
+		auto bytes = valid; bytes[index] = 0;
+		EXPECT_EQ(HardwareEthernetPhyRegisterPacket::DecodeToMessage(bytes, ignore), nullptr);
+	}
+	auto extra = valid; extra.push_back(0);
+	EXPECT_EQ(HardwareEthernetPhyRegisterPacket::DecodeToMessage(extra, ignore), nullptr);
+}
+
+namespace {
+class PhyTestDriver : public Driver {
+public:
+	explicit PhyTestDriver(const device_eventhandler_t& report) : Driver(report) {}
+	bool open() override { return false; }
+	bool isOpen() override { return opened; }
+	bool opened = true;
+	bool close() override { opened = false; return true; }
+	driver_finder_t getFinder() override { return [](std::vector<FoundDevice>&) {}; }
+	int writes = 0;
+protected:
+	bool writeInternal(const std::vector<uint8_t>&) override { ++writes; return false; }
+};
+class PhyTestJupiter : public RADJupiter {
+public:
+	explicit PhyTestJupiter(const FoundDevice& found) : RADJupiter(found) {}
+	~PhyTestJupiter() override { com->driver->close(); }
+	bool isOpen() const override { return true; } // Exercise the native send path, without hardware.
+};
+}
+TEST(EthPhyRegister, DeviceDoesNotSendInvalidRequests) {
+	PhyTestDriver* driver = nullptr;
+	FoundDevice found;
+	found.makeDriver = [&driver](device_eventhandler_t report, neodevice_t&) {
+		auto result = std::make_unique<PhyTestDriver>(report);
+		driver = result.get();
+		return result;
+	};
+	PhyTestJupiter device(found);
+	auto msg = request();
+	msg.messages.push_back(nullptr);
+	EXPECT_FALSE(device.sendEthPhyMsg(msg).has_value());
+	EXPECT_EQ(driver->writes, 0);
+	msg.messages = request().messages; msg.messages[0]->BusIndex = 16;
+	EXPECT_FALSE(device.sendEthPhyMsg(msg).has_value());
+	EXPECT_EQ(driver->writes, 0);
+	msg.messages = request().messages;
+	EXPECT_FALSE(device.sendEthPhyMsg(msg, std::chrono::milliseconds(0)).has_value());
+	EXPECT_EQ(driver->writes, 0);
+	// The valid request reaches the fake driver's explicit send failure.
+	EXPECT_FALSE(device.sendEthPhyMsg(msg).has_value());
+	EXPECT_EQ(driver->writes, 1);
+}

test/unit/macsectest.cpp

@@ -0,0 +1,84 @@
+#include <gtest/gtest.h>
+
+#include <cstring>
+
+#include "icsneo/communication/driver.h"
+#include "icsneo/core/macseccfg.h"
+#include "icsneo/disk/neomemorydiskdriver.h"
+#include "icsneo/device/tree/radcomet2/radcomet2.h"
+#include "icsneo/device/tree/radcomet3/radcomet3.h"
+#include "icsneo/device/tree/radgigastar2/radgigastar2.h"
+#include "icsneo/device/tree/radmoon2/radmoon2.h"
+#include "icsneo/device/tree/radmoon2/radmoon2zl.h"
+#include "icsneo/device/tree/radmoon3/radmoon3.h"
+
+using namespace icsneo;
+
+namespace {
+
+class MACsecTestDriver : public Driver {
+public:
+	MACsecTestDriver(const device_eventhandler_t& handler) : Driver(handler) {}
+
+	bool open() override { return true; }
+	bool isOpen() override { return true; }
+	bool close() override { return true; }
+	driver_finder_t getFinder() override {
+		return [](std::vector<FoundDevice>&) {};
+	}
+};
+
+FoundDevice makeFoundDevice(const char* serial) {
+	FoundDevice found;
+	std::memcpy(found.serial, serial, sizeof(found.serial) - 1);
+	found.serial[sizeof(found.serial) - 1] = '\0';
+	found.makeDriver = [](device_eventhandler_t handler, neodevice_t&) {
+		return std::make_unique<MACsecTestDriver>(handler);
+	};
+	return found;
+}
+
+std::vector<Network::NetID> getMACsecNetIDs(const Device& device) {
+	std::vector<Network::NetID> netIDs;
+	for(const auto& network : device.getMACsecNetworks())
+		netIDs.push_back(network.getNetID());
+	return netIDs;
+}
+
+TEST(MACsec, RADMoon2ZLOnlyMapsAutomotiveEthernet) {
+	RADMoon2 moon2(makeFoundDevice("RM0001"));
+	RADMoon2ZL moon2zl(makeFoundDevice("RN0001"));
+
+	EXPECT_TRUE(getMACsecNetIDs(moon2).empty());
+	EXPECT_EQ(getMACsecNetIDs(moon2zl), std::vector<Network::NetID>({Network::NetID::AE_01}));
+}
+
+TEST(MACsec, RADMoon3MapsIndependentPHYs) {
+	RADMoon3 moon3(makeFoundDevice("R30001"));
+
+	EXPECT_EQ(
+		getMACsecNetIDs(moon3),
+		std::vector<Network::NetID>({Network::NetID::AE_01, Network::NetID::ETHERNET_01})
+	);
+}
+
+TEST(MACsec, RADGigastar2MapsBothMACsecPorts) {
+	RADGigastar2 gigastar2(makeFoundDevice("GT0001"));
+
+	EXPECT_EQ(
+		getMACsecNetIDs(gigastar2),
+		std::vector<Network::NetID>({Network::NetID::AE_01, Network::NetID::AE_02})
+	);
+}
+
+TEST(MACsec, RADCometsMapOneMACsecPort) {
+	RADComet2 comet2(makeFoundDevice("RC0300"));
+	RADComet3 comet3(makeFoundDevice("C30001"));
+
+	EXPECT_EQ(getMACsecNetIDs(comet2), std::vector<Network::NetID>({Network::NetID::AE_01}));
+	EXPECT_EQ(getMACsecNetIDs(comet3), std::vector<Network::NetID>({Network::NetID::AE_01}));
+	EXPECT_TRUE(MACsecConfig(comet2.getType()));
+	EXPECT_TRUE(MACsecConfig(comet3.getType()));
+}
+
+} // namespace