Merge branch 'macsec-t2023' of github.com:c-po/vyos-1x into current

* 'macsec-t2023' of github.com:c-po/vyos-1x:
  macsec: T2023: cleanup wpa_supplicant config file name
  macsec: T2023: improve verify() when encryption is enabled
  macsec: T2023: support MACsec Key Agreement protocol actor priority
  macsec: T2023: rename "security key" node to "security mka"
  macsec: T2023: use wpa_supplicant for key management
  macsec: T2023: cli: move "cipher" and "encryption" under new "secutiry" node
  macsec: T2023: extend key generator for CAK and CKN in operation mode
  macsec: T2023: remove gcm-aes-256 cipher type
  macsec: T2023: cipher suite is mandatory
  macsec: T2023: use list when working with Config()
  macsec: T2023: add 'show interfaces macsec' op-mode tree
  macsec: T2023: add optional encryption command
  macsec: T2023: generate secure channel keys in operation mode
  macsec: T2023: add initial XML and Python interfaces
  ifconfig: T2023: add initial MACsec abstraction
  interface: T2023: adopt _delete() to common style
  interface: T2023: remove superfluous at end of list
  macvlan: T2023: prepare common source interface include file

1 files changed, 91 insertions, 0 deletions

diff --git a/interface-definitions/interfaces-macsec.xml.in b/interface-definitions/interfaces-macsec.xml.in
new file mode 100644
index 000000000..af3971595
--- /dev/null
+++ b/interface-definitions/interfaces-macsec.xml.in
@@ -0,0 +1,91 @@
+<?xml version="1.0"?>
+<interfaceDefinition>
+  <node name="interfaces">
+    <children>
+      <tagNode name="macsec" owner="${vyos_conf_scripts_dir}/interfaces-macsec.py">
+        <properties>
+          <help>MACsec Interface (802.1ae)</help>
+          <priority>319</priority>
+          <constraint>
+            <regex>^macsec[0-9]+$</regex>
+          </constraint>
+          <constraintErrorMessage>MACsec interface must be named macsecN</constraintErrorMessage>
+          <valueHelp>
+            <format>macsecN</format>
+            <description>MACsec interface name</description>
+          </valueHelp>
+        </properties>
+        <children>
+          #include <include/address-ipv4-ipv6.xml.i>
+          <node name="security">
+            <properties>
+              <help>Security/Encryption Settings</help>
+            </properties>
+            <children>
+              <leafNode name="cipher">
+                <properties>
+                  <help>Cipher suite used</help>
+                  <completionHelp>
+                    <list>gcm-aes-128</list>
+                  </completionHelp>
+                  <valueHelp>
+                    <format>gcm-aes-128</format>
+                    <description>Galois/Counter Mode of AES cipher with 128-bit key (default)</description>
+                  </valueHelp>
+                  <constraint>
+                    <regex>(gcm-aes-128)</regex>
+                  </constraint>
+                </properties>
+              </leafNode>
+              <leafNode name="encrypt">
+                <properties>
+                  <help>Enable optional MACsec encryption</help>
+                  <valueless/>
+                </properties>
+              </leafNode>
+              <node name="mka">
+                <properties>
+                  <help>MACsec Key Agreement protocol (MKA)</help>
+                </properties>
+                <children>
+                  <leafNode name="cak">
+                    <properties>
+                      <help>Secure Connectivity Association Key</help>
+                      <constraint>
+                        <regex>^[A-Fa-f0-9]{32}$</regex>
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="ckn">
+                    <properties>
+                      <help>Secure Connectivity Association Key Name</help>
+                      <constraint>
+                        <regex>^[A-Fa-f0-9]{64}$</regex>
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="priority">
+                    <properties>
+                      <help>Priority of MACsec Key Agreement protocol (MKA) actor (default: 255)</help>
+                      <valueHelp>
+                        <format>0-255</format>
+                        <description>MACsec Key Agreement protocol (MKA) priority</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="numeric" argument="--range 0-255" />
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                </children>
+              </node>
+            </children>
+          </node>
+          #include <include/interface-description.xml.i>
+          #include <include/interface-disable.xml.i>
+          #include <include/interface-vrf.xml.i>
+          #include <include/source-interface-ethernet.xml.i>
+        </children>
+      </tagNode>
+    </children>
+  </node>
+</interfaceDefinition>