Merge branch 'macsec-t2023' of github.com:c-po/vyos-1x into current

* 'macsec-t2023' of github.com:c-po/vyos-1x:
  macsec: T2023: cleanup wpa_supplicant config file name
  macsec: T2023: improve verify() when encryption is enabled
  macsec: T2023: support MACsec Key Agreement protocol actor priority
  macsec: T2023: rename "security key" node to "security mka"
  macsec: T2023: use wpa_supplicant for key management
  macsec: T2023: cli: move "cipher" and "encryption" under new "secutiry" node
  macsec: T2023: extend key generator for CAK and CKN in operation mode
  macsec: T2023: remove gcm-aes-256 cipher type
  macsec: T2023: cipher suite is mandatory
  macsec: T2023: use list when working with Config()
  macsec: T2023: add 'show interfaces macsec' op-mode tree
  macsec: T2023: add optional encryption command
  macsec: T2023: generate secure channel keys in operation mode
  macsec: T2023: add initial XML and Python interfaces
  ifconfig: T2023: add initial MACsec abstraction
  interface: T2023: adopt _delete() to common style
  interface: T2023: remove superfluous at end of list
  macvlan: T2023: prepare common source interface include file

3 files changed, 104 insertions, 12 deletions

diff --git a/interface-definitions/include/source-interface-ethernet.xml.i b/interface-definitions/include/source-interface-ethernet.xml.i
new file mode 100644
index 000000000..ad90bc4ac
--- /dev/null
+++ b/interface-definitions/include/source-interface-ethernet.xml.i
@@ -0,0 +1,12 @@
+<leafNode name="source-interface">
+  <properties>
+    <help>Physical interface the traffic will go through</help>
+    <valueHelp>
+      <format>interface</format>
+      <description>Physical interface used for traffic forwarding</description>
+    </valueHelp>
+    <completionHelp>
+      <script>${vyos_completion_dir}/list_interfaces.py -t ethernet</script>
+    </completionHelp>
+  </properties>
+</leafNode>
diff --git a/interface-definitions/interfaces-macsec.xml.in b/interface-definitions/interfaces-macsec.xml.in
new file mode 100644
index 000000000..af3971595
--- /dev/null
+++ b/interface-definitions/interfaces-macsec.xml.in
@@ -0,0 +1,91 @@
+<?xml version="1.0"?>
+<interfaceDefinition>
+  <node name="interfaces">
+    <children>
+      <tagNode name="macsec" owner="${vyos_conf_scripts_dir}/interfaces-macsec.py">
+        <properties>
+          <help>MACsec Interface (802.1ae)</help>
+          <priority>319</priority>
+          <constraint>
+            <regex>^macsec[0-9]+$</regex>
+          </constraint>
+          <constraintErrorMessage>MACsec interface must be named macsecN</constraintErrorMessage>
+          <valueHelp>
+            <format>macsecN</format>
+            <description>MACsec interface name</description>
+          </valueHelp>
+        </properties>
+        <children>
+          #include <include/address-ipv4-ipv6.xml.i>
+          <node name="security">
+            <properties>
+              <help>Security/Encryption Settings</help>
+            </properties>
+            <children>
+              <leafNode name="cipher">
+                <properties>
+                  <help>Cipher suite used</help>
+                  <completionHelp>
+                    <list>gcm-aes-128</list>
+                  </completionHelp>
+                  <valueHelp>
+                    <format>gcm-aes-128</format>
+                    <description>Galois/Counter Mode of AES cipher with 128-bit key (default)</description>
+                  </valueHelp>
+                  <constraint>
+                    <regex>(gcm-aes-128)</regex>
+                  </constraint>
+                </properties>
+              </leafNode>
+              <leafNode name="encrypt">
+                <properties>
+                  <help>Enable optional MACsec encryption</help>
+                  <valueless/>
+                </properties>
+              </leafNode>
+              <node name="mka">
+                <properties>
+                  <help>MACsec Key Agreement protocol (MKA)</help>
+                </properties>
+                <children>
+                  <leafNode name="cak">
+                    <properties>
+                      <help>Secure Connectivity Association Key</help>
+                      <constraint>
+                        <regex>^[A-Fa-f0-9]{32}$</regex>
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="ckn">
+                    <properties>
+                      <help>Secure Connectivity Association Key Name</help>
+                      <constraint>
+                        <regex>^[A-Fa-f0-9]{64}$</regex>
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="priority">
+                    <properties>
+                      <help>Priority of MACsec Key Agreement protocol (MKA) actor (default: 255)</help>
+                      <valueHelp>
+                        <format>0-255</format>
+                        <description>MACsec Key Agreement protocol (MKA) priority</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="numeric" argument="--range 0-255" />
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                </children>
+              </node>
+            </children>
+          </node>
+          #include <include/interface-description.xml.i>
+          #include <include/interface-disable.xml.i>
+          #include <include/interface-vrf.xml.i>
+          #include <include/source-interface-ethernet.xml.i>
+        </children>
+      </tagNode>
+    </children>
+  </node>
+</interfaceDefinition>
diff --git a/interface-definitions/interfaces-pseudo-ethernet.xml.in b/interface-definitions/interfaces-pseudo-ethernet.xml.in
index 61fd6c9fd..d5f9ca661 100644
--- a/interface-definitions/interfaces-pseudo-ethernet.xml.in
+++ b/interface-definitions/interfaces-pseudo-ethernet.xml.in
@@ -41,18 +41,7 @@
               #include <include/ipv6-dup-addr-detect-transmits.xml.i>
             </children>
           </node>
-          <leafNode name="source-interface">
-            <properties>
-              <help>Physical Interface used for this device</help>
-              <valueHelp>
-                <format>interface</format>
-                <description>Physical interface used for this pseudo device</description>
-              </valueHelp>
-              <completionHelp>
-                <script>${vyos_completion_dir}/list_interfaces.py -t ethernet</script>
-              </completionHelp>
-            </properties>
-          </leafNode>
+          #include <include/source-interface-ethernet.xml.i>
           #include <include/interface-mac.xml.i>
           <leafNode name="mode">
             <properties>