diff options
| -rw-r--r-- | data/templates/macsec/wpa_supplicant.conf.tmpl | 12 | ||||
| -rw-r--r-- | interface-definitions/interfaces-macsec.xml.in | 4 | ||||
| -rw-r--r-- | op-mode-definitions/generate-macsec-key.xml | 8 | ||||
| -rwxr-xr-x | src/conf_mode/interfaces-macsec.py | 13 |
4 files changed, 23 insertions, 14 deletions
diff --git a/data/templates/macsec/wpa_supplicant.conf.tmpl b/data/templates/macsec/wpa_supplicant.conf.tmpl index b73d4b863..df7b6f153 100644 --- a/data/templates/macsec/wpa_supplicant.conf.tmpl +++ b/data/templates/macsec/wpa_supplicant.conf.tmpl @@ -47,7 +47,15 @@ network={ # 1: Integrity only macsec_integ_only={{ '0' if security_encrypt else '1' }} - mka_cak={{ security_key_cak }} - mka_ckn={{ security_key_ckn }} + # mka_cak, mka_ckn, and mka_priority: IEEE 802.1X/MACsec pre-shared key mode + # This allows to configure MACsec with a pre-shared key using a (CAK,CKN) pair. + # In this mode, instances of wpa_supplicant can act as MACsec peers. The peer + # with lower priority will become the key server and start distributing SAKs. + # mka_cak (CAK = Secure Connectivity Association Key) takes a 16-byte (128-bit) + # hex-string (32 hex-digits) or a 32-byte (256-bit) hex-string (64 hex-digits) + # mka_ckn (CKN = CAK Name) takes a 1..32-bytes (8..256 bit) hex-string + # (2..64 hex-digits) + mka_cak={{ security_mka_cak }} + mka_ckn={{ security_mka_ckn }} } diff --git a/interface-definitions/interfaces-macsec.xml.in b/interface-definitions/interfaces-macsec.xml.in index f76fef298..02e6e7b3f 100644 --- a/interface-definitions/interfaces-macsec.xml.in +++ b/interface-definitions/interfaces-macsec.xml.in @@ -43,9 +43,9 @@ <valueless/> </properties> </leafNode> - <node name="key"> + <node name="mka"> <properties> - <help>Encryption keys</help> + <help>MACsec Key Agreement protocol (MKA)</help> </properties> <children> <leafNode name="cak"> diff --git a/op-mode-definitions/generate-macsec-key.xml b/op-mode-definitions/generate-macsec-key.xml index 003669827..40d2b9061 100644 --- a/op-mode-definitions/generate-macsec-key.xml +++ b/op-mode-definitions/generate-macsec-key.xml @@ -2,18 +2,18 @@ <interfaceDefinition> <node name="generate"> <children> - <node name="macsec-key"> + <node name="macsec"> <properties> - <help>Generate MACsec secure channel key</help> + <help>Generate MACsec Key</help> </properties> <children> - <node name="cak"> + <node name="mka-cak"> <properties> <help>Generate MACsec connectivity association key (CAK)</help> </properties> <command>/usr/bin/hexdump -n 16 -e '4/4 "%08x" 1 "\n"' /dev/random</command> </node> - <node name="ckn"> + <node name="mka-ckn"> <properties> <help>Generate MACsec connectivity association name (CKN)</help> </properties> diff --git a/src/conf_mode/interfaces-macsec.py b/src/conf_mode/interfaces-macsec.py index e59df6f90..79c57d978 100755 --- a/src/conf_mode/interfaces-macsec.py +++ b/src/conf_mode/interfaces-macsec.py @@ -36,8 +36,9 @@ default_config_data = { 'disable': False, 'security_cipher': '', 'security_encrypt': False, - 'security_key_cak': '', - 'security_key_ckn': '', + 'security_mka_cak': '', + 'security_mka_ckn': '', + 'security_mka_priority': '255', 'intf': '', 'source_interface': '', 'is_bridge_member': False, @@ -87,12 +88,12 @@ def get_config(): macsec['security_encrypt'] = True # Secure Connectivity Association Key - if conf.exists(['security', 'key', 'cak']): - macsec['security_key_cak'] = conf.return_value(['security', 'key', 'cak']) + if conf.exists(['security', 'mka', 'cak']): + macsec['security_mka_cak'] = conf.return_value(['security', 'mka', 'cak']) # Secure Connectivity Association Name - if conf.exists(['security', 'key', 'ckn']): - macsec['security_key_ckn'] = conf.return_value(['security', 'key', 'ckn']) + if conf.exists(['security', 'mka', 'ckn']): + macsec['security_mka_ckn'] = conf.return_value(['security', 'mka', 'ckn']) # Physical interface if conf.exists(['source-interface']): |