[orchagent]: Add MACsec Orchagent #1474

Pterosaur · 2020-10-22T14:25:59Z

What I did
Add MACsec orchagent for MACsec feature.
The MACsecOrch is introduced in the Orchagent to handle configuration requests. It monitors MACsec related tables in APP DB and convert those messages to SAI commands to manage the MACsec object.
The main functions are defined in class MACsecOrch as follow

    task_process_status taskUpdateMACsecPort(const std::string & port_name, const TaskArgs & port_attr);
    task_process_status taskDisableMACsecPort(const std::string & port_name, const TaskArgs & port_attr);
    task_process_status taskUpdateEgressSC(const std::string & port_sci, const TaskArgs & sc_attr);
    task_process_status taskDeleteEgressSC(const std::string & port_sci, const TaskArgs & sc_attr);
    task_process_status taskUpdateIngressSC(const std::string & port_sci, const TaskArgs & sc_attr);
    task_process_status taskDeleteIngressSC(const std::string & port_sci, const TaskArgs & sc_attr);
    task_process_status taskUpdateEgressSA(const std::string & port_sci_an, const TaskArgs & sa_attr);
    task_process_status taskDeleteEgressSA(const std::string & port_sci_an, const TaskArgs & sa_attr);
    task_process_status taskUpdateIngressSA(const std::string & port_sci_an, const TaskArgs & sa_attr);
    task_process_status taskDeleteIngressSA(const std::string & port_sci_an, const TaskArgs & sa_attr);

The HLD of MACsec orchagent is at MACsec HLD

Why I did it
MACsec orchagent is needed to transfer MACsec management message from wpa_supplicant to SAI.

How I verified it
Following the verification at #1475 . The macsec device should be created and you can obverse whether the MACsec configuration is correct by command ip macsec show

Details if related
This PR depends on :
sonic-net/sonic-wpa-supplicant#16
sonic-net/sonic-buildimage#5700
#1475
sonic-net/sonic-sairedis#691
sonic-net/sonic-swss-common#434
sonic-net/sonic-sairedis#770

Signed-off-by: Ze Gan <[email protected]>

…thub.com/Azure/sonic-swss into macsecorch

Signed-off-by: Ze Gan <[email protected]>

lguohan · 2020-11-20T02:26:28Z

orchagent/port.h

@@ -114,6 +114,8 @@ class Port

    std::unordered_set<sai_object_id_t> m_ingress_acl_tables_uset;
    std::unordered_set<sai_object_id_t> m_egress_acl_tables_uset;
+
+    sai_object_id_t     m_line_port_id = 0;


remove this one since this pr does not support gearbox

lguohan · 2020-11-20T02:28:07Z

orchagent/macsecorch.h

+    void uninstallCounter(const std::string &obj_name, sai_object_id_t obj_id);
+
+    /* ACL */
+    bool initACLTable(


-> initMacsecAclTable

Pterosaur · 2020-11-20T02:28:49Z

Add test

Signed-off-by: Ze Gan <[email protected]>

Pterosaur · 2020-11-27T15:09:16Z

retest vs please

caizhenghui-juniper · 2020-12-15T22:04:15Z

orchagent/macsecorch.cpp

+        "SAI_MACSEC_SA_ATTR_MINIMUM_XPN",
+};
+
+/* Helpers */


can helper functions be in swss-common?

qbdwlr

Is this going to be committed before latest saimacsec.h changes are integrated?

qbdwlr · 2020-12-20T23:17:32Z

orchagent/macsecorch.cpp

+            auto sc = scs.find(*m_sci);
+            if (sc == scs.end())
+            {
+                SWSS_LOG_INFO("Cannot find the MACsec SC %lu at the port %s.", *m_sci, m_port_name->c_str());


Use PRIx64 instead of lu for SCI for easier debugging.

qbdwlr · 2020-12-20T23:18:41Z

orchagent/macsecorch.cpp

+    auto macsec_obj = m_macsec_objs.emplace(switch_id, MACsecObject());
+    if (!macsec_obj.second)
+    {
+        SWSS_LOG_INFO("The MACsec has been initialized at the switch %lu", switch_id);


Use PRIx64 instead of lu for consistent OID display in syslog.

qbdwlr · 2020-12-20T23:22:33Z

orchagent/saihelper.cpp

@@ -197,6 +199,7 @@ void initSaiApi()
    sai_log_set(SAI_API_SAMPLEPACKET,           SAI_LOG_LEVEL_NOTICE);
    sai_log_set(SAI_API_DEBUG_COUNTER,          SAI_LOG_LEVEL_NOTICE);
    sai_log_set((sai_api_t)SAI_API_NAT,         SAI_LOG_LEVEL_NOTICE);
+    sai_log_set(SAI_API_NAT,                    SAI_LOG_LEVEL_NOTICE);


Copy-n-paste error.

qbdwlr · 2020-12-20T23:45:01Z

orchagent/macsecorch.cpp

+extern sai_port_api_t *sai_port_api;
+extern sai_switch_api_t *sai_switch_api;
+
+static const std::vector<std::string> macsec_egress_sa_stats =


When you add support for MACSEC_SA_STATS, this will need to be renamed since it is not a vector of stats but attrs.

Signed-off-by: Ze Gan <[email protected]>

caizhenghui-juniper · 2020-12-18T16:21:48Z

orchagent/macsecorch.cpp

+        SWSS_LOG_WARN("Cannot initialize MACsec egress object at the switch %lu", switch_id);
+        return false;
+    }
+    recover.add_action([&]() { sai_macsec_api->remove_macsec_port(macsec_obj.first->second.m_egress_id); });


Is this correct?

caizhenghui-juniper · 2020-12-18T20:25:19Z

orchagent/macsecorch.cpp

+                *ctx.get_port_id());
+        });
+    }
+    if (!updateMACsecPort(*ctx.get_macsec_port(), port_attr))


what's this doing?

caizhenghui-juniper · 2020-12-18T20:38:25Z

orchagent/macsecorch.cpp

+        macsec_port.m_ingress_port_id = SAI_NULL_OBJECT_ID;
+    });
+
+    macsec_port.m_enable_encrypt = true;


are these always fixed? There might be integrity only mode?

Pterosaur · 2020-12-21T15:16:56Z

orchagent/macsecorch.cpp

+    });
+
+    macsec_port.m_enable_encrypt = true;
+    macsec_port.m_sci_in_sectag = true;


SAI it's false by default.

Pterosaur · 2020-12-21T15:18:15Z

orchagent/macsecorch.cpp

+        SWSS_LOG_WARN("Cannot initialize MACsec ingress object at the switch 0x%" PRIx64, switch_id);
+        return false;
+    }
+    recover.add_action([&]() { sai_macsec_api->remove_macsec_port(macsec_obj.first->second.m_ingress_id); });


remove macsec()

Pterosaur · 2020-12-21T15:21:52Z

orchagent/macsecorch.cpp

+        const std::string &,
+        const TaskArgs &);
+    const static std::map<TaskType, TaskFunc> TaskMap = {
+        {{APP_MACSEC_PORT_TABLE_NAME, SET_COMMAND},


Rename these functions' names

Signed-off-by: Ze Gan <[email protected]>

Pterosaur · 2021-01-24T02:28:53Z

retest vs please

Signed-off-by: Ze Gan <[email protected]>

Add MACsec orchagent for MACsec feature. The MACsecOrch is introduced in the Orchagent to handle configuration requests. It monitors MACsec related tables in APP DB and convert those messages to SAI commands to manage the MACsec object. The main functions are defined in class MACsecOrch as follow ``` task_process_status taskUpdateMACsecPort(const std::string & port_name, const TaskArgs & port_attr); task_process_status taskDisableMACsecPort(const std::string & port_name, const TaskArgs & port_attr); task_process_status taskUpdateEgressSC(const std::string & port_sci, const TaskArgs & sc_attr); task_process_status taskDeleteEgressSC(const std::string & port_sci, const TaskArgs & sc_attr); task_process_status taskUpdateIngressSC(const std::string & port_sci, const TaskArgs & sc_attr); task_process_status taskDeleteIngressSC(const std::string & port_sci, const TaskArgs & sc_attr); task_process_status taskUpdateEgressSA(const std::string & port_sci_an, const TaskArgs & sa_attr); task_process_status taskDeleteEgressSA(const std::string & port_sci_an, const TaskArgs & sa_attr); task_process_status taskUpdateIngressSA(const std::string & port_sci_an, const TaskArgs & sa_attr); task_process_status taskDeleteIngressSA(const std::string & port_sci_an, const TaskArgs & sa_attr); ``` The HLD of MACsec orchagent is at [MACsec HLD](https://github.com/Azure/SONiC/blob/master/doc/macsec/MACsec_hld.md#344-macsec-orch) Signed-off-by: Ze Gan <[email protected]>

Pterosaur added 18 commits August 27, 2020 20:46

MACsec Orch init

28072f7

Signed-off-by: Ze Gan <[email protected]>

Add flex counter and ACL table

8023b21

Signed-off-by: Ze Gan <[email protected]>

Add Debugging information

23335e0

Signed-off-by: Ze Gan <[email protected]>

Fix bug

17d40af

Signed-off-by: Ze Gan <[email protected]>

Refactor context fetch

0c2e766

Signed-off-by: Ze Gan <[email protected]>

Polish flex counter name

47d8fac

Signed-off-by: Ze Gan <[email protected]>

Polish flex counter name

8b8c7ee

Signed-off-by: Ze Gan <[email protected]>

Polish flex counter name

2a53cb5

Signed-off-by: Ze Gan <[email protected]>

add macsecorch to Makefile

5637850

Signed-off-by: Ze Gan <[email protected]>

Merge commit '65f63c1647f59b75b3d06b1cb293efbbc5472012' of https://gi…

750c2a1

…thub.com/Azure/sonic-swss into macsecorch

Fix uninstall macsec counter

8474ad4

Signed-off-by: Ze Gan <[email protected]>

Integrate with Redis SAI

d7d4878

Signed-off-by: Ze Gan <[email protected]>

fix typo bug

6ef8bf6

Signed-off-by: Ze Gan <[email protected]>

Remove gearbox

cedf185

Signed-off-by: Ze Gan <[email protected]>

polish macro

a065524

Signed-off-by: Ze Gan <[email protected]>

Merge commit 'e4df' into macsecorch

3fa3b13

Add auth key support

3ec4815

Signed-off-by: Ze Gan <[email protected]>

Add SEND_SCI to MACsec SC

89012eb

Signed-off-by: Ze Gan <[email protected]>

Pterosaur changed the title ~~Macsecorch~~ MACsecOrch Oct 22, 2020

Pterosaur marked this pull request as draft October 22, 2020 14:30

Remove debuging code

9ab3e21

Signed-off-by: Ze Gan <[email protected]>

Pterosaur force-pushed the macsecorch branch from ca86455 to 9ab3e21 Compare November 3, 2020 16:10

Pterosaur changed the title ~~MACsecOrch~~ [orchagent]: Add MACsec Orchagent Nov 3, 2020

Pterosaur added 2 commits November 4, 2020 00:41

Merge branch 'master' into macsecorch

57eef12

Update to support the latest SWSS library

bb608b7

Signed-off-by: Ze Gan <[email protected]>

Pterosaur marked this pull request as ready for review November 4, 2020 01:18

Pterosaur mentioned this pull request Nov 18, 2020

Macsec High level design sonic-net/SONiC#652

Merged

Fixbug: Duplicate set ACL Entry

a0397b4

Signed-off-by: Ze Gan <[email protected]>

lguohan reviewed Nov 20, 2020

View reviewed changes

Pterosaur added 6 commits November 20, 2020 17:02

Clean modification about MACsec gearbox

52d7e35

Signed-off-by: Ze Gan <[email protected]>

Rename ACL to MACsec ACL

897bdff

Signed-off-by: Ze Gan <[email protected]>

Polish function getAclPriority

d7409ac

[tests]: test_macsec_term_orch (#3)

f5c9cbf

Signed-off-by: Ze Gan <[email protected]>

Merge branch 'master' into macsecorch

787b699

Change the name for clarity

d9d583c

Signed-off-by: Ze Gan <[email protected]>

caizhenghui-juniper reviewed Dec 15, 2020

View reviewed changes

qbdwlr reviewed Dec 20, 2020

View reviewed changes

Fix copy-n-paste error and polish print format

a1e7d80

Signed-off-by: Ze Gan <[email protected]>

caizhenghui-juniper reviewed Dec 21, 2020

View reviewed changes

Pterosaur commented Dec 21, 2020

View reviewed changes

Pterosaur commented Dec 22, 2020

View reviewed changes

Pterosaur added 3 commits December 23, 2020 01:32

Fix default value and typo

142d20a

Signed-off-by: Ze Gan <[email protected]>

rename task functions

24a7b3a

Signed-off-by: Ze Gan <[email protected]>

Adapt MACsec SAI 1.7.1

497b72d

Signed-off-by: Ze Gan <[email protected]>

caizhenghui-juniper previously approved these changes Dec 22, 2020

View reviewed changes

Move common functions to swss-common

e1da4a5

Signed-off-by: Ze Gan <[email protected]>

Pterosaur dismissed caizhenghui-juniper’s stale review via e1da4a5 December 30, 2020 15:42

Pterosaur added 3 commits December 30, 2020 23:43

Merge branch 'master' into macsecorch

03a404a

Fix test script

abd4068

Signed-off-by: Ze Gan <[email protected]>

Merge branch 'master' into macsecorch

04f94b6

Trigger CI

a035ec4

Signed-off-by: Ze Gan <[email protected]>

lguohan approved these changes Jan 25, 2021

View reviewed changes

lguohan merged commit 832815e into sonic-net:master Jan 29, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[orchagent]: Add MACsec Orchagent #1474

[orchagent]: Add MACsec Orchagent #1474

Pterosaur commented Oct 22, 2020 •

edited

Loading

lguohan Nov 20, 2020

lguohan Nov 20, 2020

Pterosaur commented Nov 20, 2020

Pterosaur commented Nov 27, 2020

caizhenghui-juniper Dec 15, 2020

qbdwlr left a comment

qbdwlr Dec 20, 2020

qbdwlr Dec 20, 2020

qbdwlr Dec 20, 2020

qbdwlr Dec 20, 2020

caizhenghui-juniper Dec 18, 2020

caizhenghui-juniper Dec 18, 2020

caizhenghui-juniper Dec 18, 2020

Pterosaur Dec 21, 2020

Pterosaur Dec 21, 2020

Pterosaur Dec 21, 2020

Pterosaur commented Jan 24, 2021

[orchagent]: Add MACsec Orchagent #1474

[orchagent]: Add MACsec Orchagent #1474

Conversation

Pterosaur commented Oct 22, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Pterosaur commented Nov 20, 2020

Pterosaur commented Nov 27, 2020

Choose a reason for hiding this comment

qbdwlr left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Pterosaur commented Jan 24, 2021

Pterosaur commented Oct 22, 2020 •

edited

Loading