summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--data/templates/macsec/wpa_supplicant.conf.tmpl12
-rw-r--r--interface-definitions/interfaces-macsec.xml.in4
-rw-r--r--op-mode-definitions/generate-macsec-key.xml8
-rwxr-xr-xsrc/conf_mode/interfaces-macsec.py13
4 files changed, 23 insertions, 14 deletions
diff --git a/data/templates/macsec/wpa_supplicant.conf.tmpl b/data/templates/macsec/wpa_supplicant.conf.tmpl
index b73d4b863..df7b6f153 100644
--- a/data/templates/macsec/wpa_supplicant.conf.tmpl
+++ b/data/templates/macsec/wpa_supplicant.conf.tmpl
@@ -47,7 +47,15 @@ network={
# 1: Integrity only
macsec_integ_only={{ '0' if security_encrypt else '1' }}
- mka_cak={{ security_key_cak }}
- mka_ckn={{ security_key_ckn }}
+ # mka_cak, mka_ckn, and mka_priority: IEEE 802.1X/MACsec pre-shared key mode
+ # This allows to configure MACsec with a pre-shared key using a (CAK,CKN) pair.
+ # In this mode, instances of wpa_supplicant can act as MACsec peers. The peer
+ # with lower priority will become the key server and start distributing SAKs.
+ # mka_cak (CAK = Secure Connectivity Association Key) takes a 16-byte (128-bit)
+ # hex-string (32 hex-digits) or a 32-byte (256-bit) hex-string (64 hex-digits)
+ # mka_ckn (CKN = CAK Name) takes a 1..32-bytes (8..256 bit) hex-string
+ # (2..64 hex-digits)
+ mka_cak={{ security_mka_cak }}
+ mka_ckn={{ security_mka_ckn }}
}
diff --git a/interface-definitions/interfaces-macsec.xml.in b/interface-definitions/interfaces-macsec.xml.in
index f76fef298..02e6e7b3f 100644
--- a/interface-definitions/interfaces-macsec.xml.in
+++ b/interface-definitions/interfaces-macsec.xml.in
@@ -43,9 +43,9 @@
<valueless/>
</properties>
</leafNode>
- <node name="key">
+ <node name="mka">
<properties>
- <help>Encryption keys</help>
+ <help>MACsec Key Agreement protocol (MKA)</help>
</properties>
<children>
<leafNode name="cak">
diff --git a/op-mode-definitions/generate-macsec-key.xml b/op-mode-definitions/generate-macsec-key.xml
index 003669827..40d2b9061 100644
--- a/op-mode-definitions/generate-macsec-key.xml
+++ b/op-mode-definitions/generate-macsec-key.xml
@@ -2,18 +2,18 @@
<interfaceDefinition>
<node name="generate">
<children>
- <node name="macsec-key">
+ <node name="macsec">
<properties>
- <help>Generate MACsec secure channel key</help>
+ <help>Generate MACsec Key</help>
</properties>
<children>
- <node name="cak">
+ <node name="mka-cak">
<properties>
<help>Generate MACsec connectivity association key (CAK)</help>
</properties>
<command>/usr/bin/hexdump -n 16 -e '4/4 "%08x" 1 "\n"' /dev/random</command>
</node>
- <node name="ckn">
+ <node name="mka-ckn">
<properties>
<help>Generate MACsec connectivity association name (CKN)</help>
</properties>
diff --git a/src/conf_mode/interfaces-macsec.py b/src/conf_mode/interfaces-macsec.py
index e59df6f90..79c57d978 100755
--- a/src/conf_mode/interfaces-macsec.py
+++ b/src/conf_mode/interfaces-macsec.py
@@ -36,8 +36,9 @@ default_config_data = {
'disable': False,
'security_cipher': '',
'security_encrypt': False,
- 'security_key_cak': '',
- 'security_key_ckn': '',
+ 'security_mka_cak': '',
+ 'security_mka_ckn': '',
+ 'security_mka_priority': '255',
'intf': '',
'source_interface': '',
'is_bridge_member': False,
@@ -87,12 +88,12 @@ def get_config():
macsec['security_encrypt'] = True
# Secure Connectivity Association Key
- if conf.exists(['security', 'key', 'cak']):
- macsec['security_key_cak'] = conf.return_value(['security', 'key', 'cak'])
+ if conf.exists(['security', 'mka', 'cak']):
+ macsec['security_mka_cak'] = conf.return_value(['security', 'mka', 'cak'])
# Secure Connectivity Association Name
- if conf.exists(['security', 'key', 'ckn']):
- macsec['security_key_ckn'] = conf.return_value(['security', 'key', 'ckn'])
+ if conf.exists(['security', 'mka', 'ckn']):
+ macsec['security_mka_ckn'] = conf.return_value(['security', 'mka', 'ckn'])
# Physical interface
if conf.exists(['source-interface']):