Macsec High level design #652

Pterosaur · 2020-07-22T15:26:32Z

PR title	state	context
Add MACsec schema
Add wpa supplicant build tool
MACsec container and wpa_supplicant component
Add debian rule for wpa_supplicant
[SONiC plugin]: Add SONiC WPA_Supplicant Plugin
Move SSCI from SC to SA and change packet number field name to adapt sai 1.7.1
Add utility for string and redis
[MACsecMgr]: Add MACsec Manager
[orchagent]: Add MACsec Orchagent
[vslib]Add MACsec Filters
[vslib]Add MACsec Forwarder
[vslib]Add MACsec Manager
[vslib]Add helper functions, findObjects and dumpObject
[vslib] Add StateBase function for MACsec
[vslib]Add MACsec forward and filters to HostInterfaceInfo
Add MACsec meta methods
Add FlexCounter for MACsec SA
[vslib]: Add MACsec state to state base
[vslib]: adapt macsec sai 1.7.1

Signed-off-by: Ze Gan <[email protected]>

Signed-off-by: zegan <[email protected]>

doc/macsec/MACsec_hld.md

prsunny · 2020-07-23T22:08:47Z

doc/macsec/MACsec_hld.md

+| ------------ | ---------------------------------------- |
+| CA           | Secure Connectivity Association          |
+| CAK          | Secure Connectivity Association Key      |
+| CAN          | Secure Connectivity Association Key Name |


CKN -> Connectivity Association Key Name

Done, please review it.

prsunny · 2020-07-23T23:28:41Z

doc/macsec/MACsec_hld.md

+
+Virtual switch use the Linux MACsec driver to support the functionality of MACsec and the MACsec interface is imposed on Ethernet interface.
+
+Real switch use the ASIC chip as the MACsec Security Entity(SecY) which will be imposed on physic interface. And the ethernet port will be above the SecY.


physical - typo

Done, please review it.

doc/macsec/MACsec_hld.md

prsunny · 2020-07-24T00:11:28Z

doc/macsec/MACsec_hld.md

+
+- Delete SA
+  1. Monitor the DEL message from the MACsec SA Table
+  2. Collect SA Stats


Is this intended in Delete SA?

Yes, we need to finally collect SA stats from counter DB when we delete it.

prsunny · 2020-07-24T00:12:31Z

doc/macsec/MACsec_hld.md

+
+Wpa_supplicant need to monitor the packet number for SAK refreshing. But if a copy of packet number delayed more than the preparation time of SAK, the requirement of SAK refreshing may not be realized by wpa_supplicant, which will cause the packet number to be exhausted.
+
+- MPN=maximal packet number, which indicates the maximal packet number, it should be 4,294,967,295 if packet number is 32bit


Done, please review it.

prsunny · 2020-07-24T00:13:14Z

doc/macsec/MACsec_hld.md

+- MPN=maximal packet number, which indicates the maximal packet number, it should be 4,294,967,295 if packet number is 32bit
+- RT=refresh threshold, which indicates that the SAK should be refreshed if the packet number increases to a threshold. This number is about 75% of MPN.
+- MPB=maximal port bandwidth, which indicates the maximal bandwidth at the port
+- MMPS=minimal MACsec packet size, which indicates the minimal packet size of MACsec, it should be 44 bytes


Done, please review it.

prsunny · 2020-07-24T00:18:39Z

doc/macsec/MACsec_hld.md

+
+#### Phase I
+
+- MACsec should be supported on physical port


May be we should also provide a reference to PortChannels

Done, please review it.

prsunny · 2020-07-24T00:20:45Z

doc/macsec/MACsec_hld.md

+
+## 2 Architecture Design
+
+This chapter shows the MACsec interface stack of virtual switch and real switch.


Some of the container parts are missing in design. We should provide some details on the following:

When will the container be running

Is the FEATURE disabled/enabled by default

When will the container be running
Add the information at : https://github.com/Azure/SONiC/pull/652/files#diff-600ad1f148d06a6c05f027cd045d6c4fR122
Is the FEATURE disabled/enabled by default
Add the information at : https://github.com/Azure/SONiC/pull/652/files#diff-600ad1f148d06a6c05f027cd045d6c4fR198-R199

doc/macsec/MACsec_hld.md

Signed-off-by: zegan <[email protected]>

Signed-off-by: Ze Gan <[email protected]>

qiluo-msft · 2020-09-25T23:16:37Z

doc/macsec/MACsec_hld.md

+- The green means these components are in SWSS container. This container uses the SAI APIs to control the MACsec security entities(SecY) according to databases entries and to synchronize the statistics from SecY to COUNTERS_DB.
+  - **MACsecOrch** is a module of orchagent, that uses SAI APIs to manage the SecY according to messages from databases and synchronized the statistics of SecY to COUNTERS_DB.
+
+- The blue one is MACsecSAI in SYNCD container. MACsecSAI is a set of APIs that are defined to communicate with the SecY. In the virtual switch, the SecY is Linux MACsec driver and MACsecSAI will use the ip commands to manage them. But in the real switch, the SecY is the MACsec cipher chip and the implementation of MACsecSAI will be provided by the vendor of the cipher chip.


The blue one is MACsecSAI in SYNCD container [](start = 2, length = 44)

The MACsecSAI box in the diagram is confusing. All other boxes are representing processes. And audience keep asking how many syncd processes in your design. You may draw syncd1/sync2 process as boxes, and MACsecSAI/SAI as internal boxes (like the plugin).

The blue one is MACsecSAI in SYNCD container [](start = 2, length = 44)

The MACsecSAI box in the diagram is confusing. All other boxes are representing processes. And audience keep asking how many syncd processes in your design. You may draw syncd1/sync2 process as boxes, and MACsecSAI/SAI as internal boxes (like the plugin).

Fixed, please review it.

qiluo-msft · 2020-09-25T23:18:41Z

doc/macsec/MACsec_hld.md

+
+This chapter shows the MACsec interface stack of virtual switch and real switch.
+
+Virtual switch use the Linux MACsec driver as the MACsec Security Entity(SecY) to support the functionality of MACsec and the SecY is imposed on the physical port.


Virtual switch [](start = 0, length = 14)

I know you are talking about SONiC. But it is easy to mislead to the virtual switch between VMs on a physical server. And in SONiC terminology, we already have a 'Virtual Switch SAI', I think your term means total different thing.

Virtual switch [](start = 0, length = 14)

I know you are talking about SONiC. But it is easy to mislead to the virtual switch between VMs on a physical server. And in SONiC terminology, we already have a 'Virtual Switch SAI', I think your term means total different thing.

I discussed with Guohan and change it to SAI virtual switch, please review whether it makes sense.

Signed-off-by: Ze Gan <[email protected]>

caizhenghui-juniper · 2020-10-21T18:22:15Z

Juniper Networks has already implemented very similar Macsec support using wpa_supplicant, and want to contribute to the community on this feature. We believe from our work, we can accelerate development on the following items.

Enable wpa_supplicant supporting different Ciphersuite: GCM-AES-128, GCM-AES-256, GCM-AES-XPN-128 and GCM-AES-XPN-256
XPN feature support in wpa_supplicant.
CLI commands to configure MACsec (other than enable/disable)
Using libnl to pass macsec messages instead of ip command.

We can discuss in detail during HLD review.

lguohan · 2020-10-22T14:53:33Z

@caizhenghui, how to contact you let's have some discussion first?

caizhenghui-juniper · 2020-10-22T15:02:58Z

Hi, Guohan Please use my company address [email protected]<mailto:[email protected]>.. We can have offline discussion. Thanks Zhenghui From: lguohan <[email protected]> Reply-To: Azure/SONiC <[email protected]> Date: Thursday, October 22, 2020 at 10:53 AM To: Azure/SONiC <[email protected]> Cc: Zhenghui Cai <[email protected]>, Mention <[email protected]> Subject: Re: [Azure/SONiC] Macsec High level design (#652) [External Email. Be cautious of content] @caizhenghui<https://github.com/caizhenghui>, how to contact you let's have some discussion first? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#652 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AKDUQJRX36LWBT6K6SK62BDSMBBQBANCNFSM4PE2LP6A>. Juniper Business Use Only

Signed-off-by: Ze Gan <[email protected]>

Signed-off-by: zegan <[email protected]>

Signed-off-by: Ze Gan <[email protected]>

Signed-off-by: zegan <[email protected]>

doc/macsec/MACsec_hld.md

Signed-off-by: Ze Gan <[email protected]>

Add MACsec schema according to SONiC MACsec HLD: sonic-net/SONiC#652 Signed-off-by: Ze Gan <[email protected]>

qbdwlr · 2020-11-17T19:27:33Z

As part of this MACsec effort, has there been any consideration for including a modified version of tcpdump that is capable of parsing the EAPOL exchange?

Pterosaur · 2020-11-18T09:55:31Z

As part of this MACsec effort, has there been any consideration for including a modified version of tcpdump that is capable of parsing the EAPOL exchange?

Hi Ann, I believe Wireshark can parse the EAPOL traffic so right now, we don't have plan to modify tcpdump.

Signed-off-by: Ze Gan <[email protected]>

Signed-off-by: zegan <[email protected]>

Pterosaur added 6 commits July 22, 2020 11:37

Init MACsec HLD

318cefb

Signed-off-by: Ze Gan <[email protected]>

MACsec HLD Draft

fc19b8a

Signed-off-by: zegan <[email protected]>

Polish doc

fcceaa6

Signed-off-by: zegan <[email protected]>

Fix typo

a727a41

Signed-off-by: zegan <[email protected]>

Add the evaluation about the scalability of wpa_supplicant

0ce6181

Signed-off-by: zegan <[email protected]>

Polish the format

3e491d6

Signed-off-by: zegan <[email protected]>

prsunny reviewed Jul 24, 2020

View reviewed changes

lguohan reviewed Jul 24, 2020

View reviewed changes

doc/macsec/MACsec_hld.md Outdated Show resolved Hide resolved

Pterosaur added 22 commits July 28, 2020 18:36

Polish the content according to comments

b924034

Signed-off-by: zegan <[email protected]>

Fix typo

a570a76

Signed-off-by: zegan <[email protected]>

Fix typo

a79bace

Signed-off-by: zegan <[email protected]>

Fix typo

4dbda8a

Signed-off-by: zegan <[email protected]>

Update sequence charts

551f8ac

Signed-off-by: zegan <[email protected]>

Make SONiC MACsec Plugin clearer

50246a8

Signed-off-by: zegan <[email protected]>

Add flow charts

2d3f70e

Signed-off-by: zegan <[email protected]>

Fix wrong lable

e4b507d

Signed-off-by: zegan <[email protected]>

Revise Disable and Remove and Ingress/Egress SA flow charts

385a29e

Signed-off-by: zegan <[email protected]>

Fix wrong lables

2abf533

Signed-off-by: zegan <[email protected]>

Remove useless and correct wrong instructions of SONiC MACsec Plugin

3bff09d

Signed-off-by: zegan <[email protected]>

Update the flow charts and rephrase paragraph

347503d

Signed-off-by: zegan <[email protected]>

Fix typo

96e3d8d

Signed-off-by: zegan <[email protected]>

lowercase DB filed

7c109ff

Signed-off-by: zegan <[email protected]>

Add confidentiality offset support

1a0cdd7

Signed-off-by: zegan <[email protected]>

Change wpa_supplicant solution

8dc4a20

Signed-off-by: zegan <[email protected]>

Change wpa_supplicant solution

9794669

Signed-off-by: zegan <[email protected]>

Fix typo

e271372

Signed-off-by: zegan <[email protected]>

Fix wrong sequence chart

51391f3

Signed-off-by: zegan <[email protected]>

Fix wrong sequence chart

a55e7e3

Signed-off-by: zegan <[email protected]>

Fix sequence chart

6f31c53

Signed-off-by: zegan <[email protected]>

Fix typo and wrong chart

a8c8cc6

Signed-off-by: Ze Gan <[email protected]>

Pterosaur added 2 commits September 24, 2020 11:20

Polish format

758fabf

Signed-off-by: Ze Gan <[email protected]>

Fix typo

729a5b2

Signed-off-by: Ze Gan <[email protected]>

Pterosaur marked this pull request as ready for review September 25, 2020 02:21

qiluo-msft reviewed Sep 25, 2020

View reviewed changes

fix syncd to gbsyncd and virtual switch to SAI virtual switch

dbf75cf

Signed-off-by: Ze Gan <[email protected]>

Pterosaur added 6 commits October 23, 2020 14:47

Revise module design to involve gearbox scenario

cc3c3a6

Signed-off-by: Ze Gan <[email protected]>

Add virtual MACsec SAI

c781742

Signed-off-by: Ze Gan <[email protected]>

Remove Phase 4

2bb06f8

Signed-off-by: zegan <[email protected]>

Revise virtual MACsec SAI picture

4e396fe

Signed-off-by: Ze Gan <[email protected]>

revise virtual MACsec SAI description

77998f4

Signed-off-by: Ze Gan <[email protected]>

Rename virtual switch to SAI virtual switch

11fa312

Signed-off-by: zegan <[email protected]>

heidinet2007 reviewed Oct 27, 2020

View reviewed changes

doc/macsec/MACsec_hld.md Show resolved Hide resolved

heidinet2007 reviewed Oct 27, 2020

View reviewed changes

doc/macsec/MACsec_hld.md Show resolved Hide resolved

Remove Bypass mode

9edcf67

Signed-off-by: Ze Gan <[email protected]>

Pterosaur mentioned this pull request Oct 29, 2020

Add MACsec schema sonic-net/sonic-swss-common#403

Merged

lguohan pushed a commit to sonic-net/sonic-swss-common that referenced this pull request Oct 29, 2020

[schema]: Add MACsec support (#403)

9b0e955

Add MACsec schema according to SONiC MACsec HLD: sonic-net/SONiC#652 Signed-off-by: Ze Gan <[email protected]>

Revise MACsec virtual SAI section

cef64db

Signed-off-by: Ze Gan <[email protected]>

Pterosaur force-pushed the macsec_hld branch from 88c7ada to cef64db Compare November 19, 2020 05:31

Pterosaur added 4 commits November 26, 2020 01:48

Polish the section of MACsec virtual SAI

6dd83e8

Signed-off-by: zegan <[email protected]>

init_pn->next_pn

1acc267

Signed-off-by: zegan <[email protected]>

Add default value of priority and policy in MACSEC_PROFILE

0efd2c7

Signed-off-by: zegan <[email protected]>

Adapater SAI 1.7.1

fdbaa11

Signed-off-by: zegan <[email protected]>

lguohan merged commit e8a636e into sonic-net:master Jan 10, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Macsec High level design #652

Macsec High level design #652

Pterosaur commented Jul 22, 2020 •

edited

Loading

prsunny Jul 23, 2020

Pterosaur Jul 28, 2020

prsunny Jul 23, 2020

Pterosaur Jul 28, 2020

prsunny Jul 24, 2020

Pterosaur Jul 28, 2020

prsunny Jul 24, 2020

Pterosaur Jul 28, 2020

prsunny Jul 24, 2020

Pterosaur Jul 28, 2020

prsunny Jul 24, 2020

Pterosaur Jul 28, 2020

prsunny Jul 24, 2020

Pterosaur Jul 28, 2020

qiluo-msft Sep 25, 2020

Pterosaur Sep 27, 2020

qiluo-msft Sep 25, 2020

Pterosaur Sep 27, 2020

caizhenghui-juniper commented Oct 21, 2020

lguohan commented Oct 22, 2020

caizhenghui-juniper commented Oct 22, 2020 via email

qbdwlr commented Nov 17, 2020

Pterosaur commented Nov 18, 2020


		Virtual switch use the Linux MACsec driver to support the functionality of MACsec and the MACsec interface is imposed on Ethernet interface.

		Real switch use the ASIC chip as the MACsec Security Entity(SecY) which will be imposed on physic interface. And the ethernet port will be above the SecY.


		Wpa_supplicant need to monitor the packet number for SAK refreshing. But if a copy of packet number delayed more than the preparation time of SAK, the requirement of SAK refreshing may not be realized by wpa_supplicant, which will cause the packet number to be exhausted.

		- MPN=maximal packet number, which indicates the maximal packet number, it should be 4,294,967,295 if packet number is 32bit


		## 2 Architecture Design

		This chapter shows the MACsec interface stack of virtual switch and real switch.

Macsec High level design #652

Macsec High level design #652

Conversation

Pterosaur commented Jul 22, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

caizhenghui-juniper commented Oct 21, 2020

lguohan commented Oct 22, 2020

caizhenghui-juniper commented Oct 22, 2020 via email

qbdwlr commented Nov 17, 2020

Pterosaur commented Nov 18, 2020

Pterosaur commented Jul 22, 2020 •

edited

Loading