support for macsec #130

felbinger commented 2025年10月31日 18:49:43 +01:00

It would be nice if IfState would be capable of macsec. ifstatecli show already shows an interface of kind macsec, but thats it. The schema neither supports kind macsec, nor other configuration elements (like sci, encrypt, cipher, ...) yet.

It would be nice if IfState would be capable of macsec. `ifstatecli show` already shows an interface of kind macsec, but thats it. The schema neither supports kind macsec, nor other configuration elements (like sci, encrypt, cipher, ...) yet.

liske commented 2025年11月08日 12:58:35 +01:00

I've added basic schema support allowing to create macsec links. Due to missing support in pyroute2 it is currently not possible to set any macsec related settings 🫤

# ip netns exec ms1 ifstatecli shell
Links:
 1: lo
 2: eth1
 3: eth0
 8: macsec0
Symbols:
 ipr = pyroute2.IPRoute()
ifstate 2.0.2; pyroute2 0.9.4
>>> pprint(ipr.get_link(index=8))
{'__align': (),
 'attrs': [('IFLA_IFNAME', 'macsec0'),
 ('IFLA_TXQLEN', 1000),
 ('IFLA_OPERSTATE', 'DOWN'),
 ('IFLA_LINKMODE', 0),
 ('IFLA_MTU', 1468),
 ('IFLA_MIN_MTU', 0),
 ('IFLA_MAX_MTU', 65535),
 ('IFLA_GROUP', 0),
 ('IFLA_PROMISCUITY', 0),
 ('UNKNOWN', {'header': {'length': 8, 'type': 61}}),
 ('IFLA_NUM_TX_QUEUES', 1),
 ('IFLA_GSO_MAX_SEGS', 65535),
 ('IFLA_GSO_MAX_SIZE', 65536),
 ('IFLA_GRO_MAX_SIZE', 65536),
 ('UNKNOWN', {'header': {'length': 8, 'type': 63}}),
 ('UNKNOWN', {'header': {'length': 8, 'type': 64}}),
 ('IFLA_TSO_MAX_SIZE', 65536),
 ('IFLA_TSO_MAX_SEGS', 65535),
 ('IFLA_NUM_RX_QUEUES', 1),
 ('IFLA_CARRIER', 0),
 ('IFLA_CARRIER_CHANGES', 1),
 ('IFLA_CARRIER_UP_COUNT', 0),
 ('IFLA_CARRIER_DOWN_COUNT', 1),
 ('IFLA_PROTO_DOWN', 0),
 ('IFLA_ADDRESS', '6a:12:27:b6:f9:d5'),
 ('IFLA_BROADCAST', 'ff:ff:ff:ff:ff:ff'),
 ('IFLA_STATS64', {'rx_packets': 0, 'tx_packets': 0, 'rx_bytes': 0, 'tx_bytes': 0, 'rx_errors': 0, 'tx_errors': 0, 'rx_dropped': 0, 'tx_dropped': 0, 'multicast': 0, 'collisions': 0, 'rx_length_errors': 0, 'rx_over_errors': 0, 'rx_crc_errors': 0, 'rx_frame_errors': 0, 'rx_fifo_errors': 0, 'rx_missed_errors': 0, 'tx_aborted_errors': 0, 'tx_carrier_errors': 0, 'tx_fifo_errors': 0, 'tx_heartbeat_errors': 0, 'tx_window_errors': 0, 'rx_compressed': 0, 'tx_compressed': 0}),
 ('IFLA_STATS', {'rx_packets': 0, 'tx_packets': 0, 'rx_bytes': 0, 'tx_bytes': 0, 'rx_errors': 0, 'tx_errors': 0, 'rx_dropped': 0, 'tx_dropped': 0, 'multicast': 0, 'collisions': 0, 'rx_length_errors': 0, 'rx_over_errors': 0, 'rx_crc_errors': 0, 'rx_frame_errors': 0, 'rx_fifo_errors': 0, 'rx_missed_errors': 0, 'tx_aborted_errors': 0, 'tx_carrier_errors': 0, 'tx_fifo_errors': 0, 'tx_heartbeat_errors': 0, 'tx_window_errors': 0, 'rx_compressed': 0, 'tx_compressed': 0}),
 ('IFLA_XDP', {'attrs': [('IFLA_XDP_ATTACHED', None)]}),
 ('IFLA_LINKINFO', {'attrs': [('IFLA_INFO_KIND', 'macsec'), ('IFLA_INFO_DATA', '0c:00:01:00:6a:12:27:b6:f9:d5:00:01:05:00:03:00:10:00:00:00:0c:00:04:00:02:00:00:01:00:c2:80:00:05:00:06:00:00:00:00:00:05:00:07:00:01:00:00:00:05:00:08:00:01:00:00:00:05:00:09:00:01:00:00:00:05:00:0a:00:01:00:00:00:05:00:0b:00:00:00:00:00:05:00:0c:00:01:00:00:00:05:00:0d:00:02:00:00:00:05:00:0f:00:00:00:00:00:08:00:05:00:8e:00:00:00')]}),

(There is no decoding for the IFLA_INFO_DATA attribute.)

I've added basic schema support allowing to create macsec links. Due to missing support in pyroute2 it is currently not possible to set any macsec related settings 🫤 ```python # ip netns exec ms1 ifstatecli shell Links: 1: lo 2: eth1 3: eth0 8: macsec0 Symbols: ipr = pyroute2.IPRoute() ifstate 2.0.2; pyroute2 0.9.4 >>> pprint(ipr.get_link(index=8)) {'__align': (), 'attrs': [('IFLA_IFNAME', 'macsec0'), ('IFLA_TXQLEN', 1000), ('IFLA_OPERSTATE', 'DOWN'), ('IFLA_LINKMODE', 0), ('IFLA_MTU', 1468), ('IFLA_MIN_MTU', 0), ('IFLA_MAX_MTU', 65535), ('IFLA_GROUP', 0), ('IFLA_PROMISCUITY', 0), ('UNKNOWN', {'header': {'length': 8, 'type': 61}}), ('IFLA_NUM_TX_QUEUES', 1), ('IFLA_GSO_MAX_SEGS', 65535), ('IFLA_GSO_MAX_SIZE', 65536), ('IFLA_GRO_MAX_SIZE', 65536), ('UNKNOWN', {'header': {'length': 8, 'type': 63}}), ('UNKNOWN', {'header': {'length': 8, 'type': 64}}), ('IFLA_TSO_MAX_SIZE', 65536), ('IFLA_TSO_MAX_SEGS', 65535), ('IFLA_NUM_RX_QUEUES', 1), ('IFLA_CARRIER', 0), ('IFLA_CARRIER_CHANGES', 1), ('IFLA_CARRIER_UP_COUNT', 0), ('IFLA_CARRIER_DOWN_COUNT', 1), ('IFLA_PROTO_DOWN', 0), ('IFLA_ADDRESS', '6a:12:27:b6:f9:d5'), ('IFLA_BROADCAST', 'ff:ff:ff:ff:ff:ff'), ('IFLA_STATS64', {'rx_packets': 0, 'tx_packets': 0, 'rx_bytes': 0, 'tx_bytes': 0, 'rx_errors': 0, 'tx_errors': 0, 'rx_dropped': 0, 'tx_dropped': 0, 'multicast': 0, 'collisions': 0, 'rx_length_errors': 0, 'rx_over_errors': 0, 'rx_crc_errors': 0, 'rx_frame_errors': 0, 'rx_fifo_errors': 0, 'rx_missed_errors': 0, 'tx_aborted_errors': 0, 'tx_carrier_errors': 0, 'tx_fifo_errors': 0, 'tx_heartbeat_errors': 0, 'tx_window_errors': 0, 'rx_compressed': 0, 'tx_compressed': 0}), ('IFLA_STATS', {'rx_packets': 0, 'tx_packets': 0, 'rx_bytes': 0, 'tx_bytes': 0, 'rx_errors': 0, 'tx_errors': 0, 'rx_dropped': 0, 'tx_dropped': 0, 'multicast': 0, 'collisions': 0, 'rx_length_errors': 0, 'rx_over_errors': 0, 'rx_crc_errors': 0, 'rx_frame_errors': 0, 'rx_fifo_errors': 0, 'rx_missed_errors': 0, 'tx_aborted_errors': 0, 'tx_carrier_errors': 0, 'tx_fifo_errors': 0, 'tx_heartbeat_errors': 0, 'tx_window_errors': 0, 'rx_compressed': 0, 'tx_compressed': 0}), ('IFLA_XDP', {'attrs': [('IFLA_XDP_ATTACHED', None)]}), ('IFLA_LINKINFO', {'attrs': [('IFLA_INFO_KIND', 'macsec'), ('IFLA_INFO_DATA', '0c:00:01:00:6a:12:27:b6:f9:d5:00:01:05:00:03:00:10:00:00:00:0c:00:04:00:02:00:00:01:00:c2:80:00:05:00:06:00:00:00:00:00:05:00:07:00:01:00:00:00:05:00:08:00:01:00:00:00:05:00:09:00:01:00:00:00:05:00:0a:00:01:00:00:00:05:00:0b:00:00:00:00:00:05:00:0c:00:01:00:00:00:05:00:0d:00:02:00:00:00:05:00:0f:00:00:00:00:00:08:00:05:00:8e:00:00:00')]}), ``` (There is no decoding for the `IFLA_INFO_DATA` attribute.)