From 68d54d8d79f257497c884b392a7e316e9a8e7d21 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Thu, 21 May 2020 15:04:24 +0200
Subject: macsec: T2023: rename "security key" node to "security mka"

MACsec always talks about MKA (MACsec Key Agreement protocol) thus the node
should reflect that.
---
 data/templates/macsec/wpa_supplicant.conf.tmpl | 12 ++++++++++--
 interface-definitions/interfaces-macsec.xml.in |  4 ++--
 op-mode-definitions/generate-macsec-key.xml    |  8 ++++----
 src/conf_mode/interfaces-macsec.py             | 13 +++++++------
 4 files changed, 23 insertions(+), 14 deletions(-)

diff --git a/data/templates/macsec/wpa_supplicant.conf.tmpl b/data/templates/macsec/wpa_supplicant.conf.tmpl
index b73d4b863..df7b6f153 100644
--- a/data/templates/macsec/wpa_supplicant.conf.tmpl
+++ b/data/templates/macsec/wpa_supplicant.conf.tmpl
@@ -47,7 +47,15 @@ network={
     # 1: Integrity only
     macsec_integ_only={{ '0' if security_encrypt else '1' }}
 
-    mka_cak={{ security_key_cak }}
-    mka_ckn={{ security_key_ckn }}
+    # mka_cak, mka_ckn, and mka_priority: IEEE 802.1X/MACsec pre-shared key mode
+    # This allows to configure MACsec with a pre-shared key using a (CAK,CKN) pair.
+    # In this mode, instances of wpa_supplicant can act as MACsec peers. The peer
+    # with lower priority will become the key server and start distributing SAKs.
+    # mka_cak (CAK = Secure Connectivity Association Key) takes a 16-byte (128-bit)
+    # hex-string (32 hex-digits) or a 32-byte (256-bit) hex-string (64 hex-digits)
+    # mka_ckn (CKN = CAK Name) takes a 1..32-bytes (8..256 bit) hex-string
+    # (2..64 hex-digits)
+    mka_cak={{ security_mka_cak }}
+    mka_ckn={{ security_mka_ckn }}
 }
 
diff --git a/interface-definitions/interfaces-macsec.xml.in b/interface-definitions/interfaces-macsec.xml.in
index f76fef298..02e6e7b3f 100644
--- a/interface-definitions/interfaces-macsec.xml.in
+++ b/interface-definitions/interfaces-macsec.xml.in
@@ -43,9 +43,9 @@
                   <valueless/>
                 </properties>
               </leafNode>
-              <node name="key">
+              <node name="mka">
                 <properties>
-                  <help>Encryption keys</help>
+                  <help>MACsec Key Agreement protocol (MKA)</help>
                 </properties>
                 <children>
                   <leafNode name="cak">
diff --git a/op-mode-definitions/generate-macsec-key.xml b/op-mode-definitions/generate-macsec-key.xml
index 003669827..40d2b9061 100644
--- a/op-mode-definitions/generate-macsec-key.xml
+++ b/op-mode-definitions/generate-macsec-key.xml
@@ -2,18 +2,18 @@
 <interfaceDefinition>
   <node name="generate">
     <children>
-      <node name="macsec-key">
+      <node name="macsec">
         <properties>
-          <help>Generate MACsec secure channel key</help>
+          <help>Generate MACsec Key</help>
         </properties>
         <children>
-          <node name="cak">
+          <node name="mka-cak">
             <properties>
               <help>Generate MACsec connectivity association key (CAK)</help>
             </properties>
             <command>/usr/bin/hexdump -n 16 -e '4/4 "%08x" 1 "\n"' /dev/random</command>
           </node>
-          <node name="ckn">
+          <node name="mka-ckn">
             <properties>
               <help>Generate MACsec connectivity association name (CKN)</help>
             </properties>
diff --git a/src/conf_mode/interfaces-macsec.py b/src/conf_mode/interfaces-macsec.py
index e59df6f90..79c57d978 100755
--- a/src/conf_mode/interfaces-macsec.py
+++ b/src/conf_mode/interfaces-macsec.py
@@ -36,8 +36,9 @@ default_config_data = {
     'disable': False,
     'security_cipher': '',
     'security_encrypt': False,
-    'security_key_cak': '',
-    'security_key_ckn': '',
+    'security_mka_cak': '',
+    'security_mka_ckn': '',
+    'security_mka_priority': '255',
     'intf': '',
     'source_interface': '',
     'is_bridge_member': False,
@@ -87,12 +88,12 @@ def get_config():
         macsec['security_encrypt'] = True
 
     # Secure Connectivity Association Key
-    if conf.exists(['security', 'key', 'cak']):
-        macsec['security_key_cak'] = conf.return_value(['security', 'key', 'cak'])
+    if conf.exists(['security', 'mka', 'cak']):
+        macsec['security_mka_cak'] = conf.return_value(['security', 'mka', 'cak'])
 
     # Secure Connectivity Association Name
-    if conf.exists(['security', 'key', 'ckn']):
-        macsec['security_key_ckn'] = conf.return_value(['security', 'key', 'ckn'])
+    if conf.exists(['security', 'mka', 'ckn']):
+        macsec['security_mka_ckn'] = conf.return_value(['security', 'mka', 'ckn'])
 
     # Physical interface
     if conf.exists(['source-interface']):
-- 
cgit v1.2.3