4068944202
1. Add supervisord as the entrypoint of docker-macsec
2. Add wpa_supplicant conf into docker-macsec
3. Set the macsecmgrd as the critical_process
4. Configure supervisor to monitor macsecmgrd
5. Set macsec in the features list
6. Add config variable `INCLUDE_MACSEC`
7. Add macsec.service
**- How to verify it**
Change the `/etc/sonic/config_db.json` as follow
```
{
"PORT": {
"Ethernet0": {
...
"macsec": "test"
}
}
...
"MACSEC_PROFILE": {
"test": {
"priority": 64,
"cipher_suite": "GCM-AES-128",
"primary_cak": "0123456789ABCDEF0123456789ABCDEF",
"primary_ckn": "6162636465666768696A6B6C6D6E6F707172737475767778797A303132333435",
"policy": "security"
}
}
}
```
To execute `sudo config reload -y`, We should find the following new items were inserted in app_db of redis
```
127.0.0.1:6379> keys *MAC*
1) "MACSEC_EGRESS_SC_TABLE:Ethernet0:72152375678227538"
2) "MACSEC_PORT_TABLE:Ethernet0"
127.0.0.1:6379> hgetall "MACSEC_EGRESS_SC_TABLE:Ethernet0:72152375678227538"
1) "ssci"
2) ""
3) "encoding_an"
4) "0"
127.0.0.1:6379> hgetall "MACSEC_PORT_TABLE:Ethernet0"
1) "enable"
2) "false"
3) "cipher_suite"
4) "GCM-AES-128"
5) "enable_protect"
6) "true"
7) "enable_encrypt"
8) "true"
9) "enable_replay_protect"
10) "false"
11) "replay_window"
12) "0"
```
Signed-off-by: Ze Gan <ganze718@gmail.com>
57 lines
3.3 KiB
Django/Jinja
57 lines
3.3 KiB
Django/Jinja
{
|
|
"DEVICE_METADATA": {
|
|
"localhost": {
|
|
"buffer_model": {% if default_buffer_model == "dynamic" %}"dynamic"{% else %}"traditional"{% endif %},
|
|
"default_bgp_status": {% if shutdown_bgp_on_start == "y" %}"down"{% else %}"up"{% endif %},
|
|
"default_pfcwd_status": {% if enable_pfcwd_on_start == "y" %}"enable"{% else %}"disable"{% endif %}
|
|
}
|
|
},
|
|
"CRM": {
|
|
"Config": {
|
|
"polling_interval": "300",
|
|
{%- for crm_res in ["ipv4_route", "ipv6_route", "ipv4_nexthop", "ipv6_nexthop", "ipv4_neighbor",
|
|
"ipv6_neighbor", "nexthop_group_member", "nexthop_group", "acl_table",
|
|
"acl_group", "acl_entry", "acl_counter", "fdb_entry", "snat_entry", "dnat_entry", "ipmc_entry"] %}
|
|
"{{crm_res}}_threshold_type": "percentage",
|
|
"{{crm_res}}_low_threshold": "70",
|
|
"{{crm_res}}_high_threshold": "85"{% if not loop.last %},{% endif -%}
|
|
{% endfor %}
|
|
}
|
|
},
|
|
{%- set features = [("bgp", "enabled", false, "enabled"),
|
|
("database", "always_enabled", false, "always_enabled"),
|
|
("dhcp_relay", "enabled", false, "enabled"),
|
|
("lldp", "enabled", false, "enabled"),
|
|
("pmon", "enabled", false, "enabled"),
|
|
("radv", "enabled", false, "enabled"),
|
|
("snmp", "enabled", true, "enabled"),
|
|
("swss", "enabled", false, "enabled"),
|
|
("syncd", "enabled", false, "enabled"),
|
|
("teamd", "enabled", false, "enabled")] %}
|
|
{%- if sonic_asic_platform == "vs" %}{% do features.append(("gbsyncd", "enabled", false, "enabled")) %}{% endif %}
|
|
{%- if include_iccpd == "y" %}{% do features.append(("iccpd", "disabled", false, "enabled")) %}{% endif %}
|
|
{%- if include_mgmt_framework == "y" %}{% do features.append(("mgmt-framework", "enabled", true, "enabled")) %}{% endif %}
|
|
{%- if include_nat == "y" %}{% do features.append(("nat", "disabled", false, "enabled")) %}{% endif %}
|
|
{%- if include_restapi == "y" %}{% do features.append(("restapi", "enabled", false, "enabled")) %}{% endif %}
|
|
{%- if include_sflow == "y" %}{% do features.append(("sflow", "disabled", false, "enabled")) %}{% endif %}
|
|
{%- if include_macsec == "y" %}{% do features.append(("macsec", "disabled", false, "enabled")) %}{% endif %}
|
|
{%- if include_system_telemetry == "y" %}{% do features.append(("telemetry", "enabled", true, "enabled")) %}{% endif %}
|
|
"FEATURE": {
|
|
{# has_timer field if set, will start the feature systemd .timer unit instead of .service unit #}
|
|
{%- for feature, state, has_timer, autorestart in features %}
|
|
"{{feature}}": {
|
|
"state": "{{state}}",
|
|
"has_timer" : {{has_timer | lower()}},
|
|
"has_global_scope": {% if feature + '.service' in installer_services.split(' ') %}true{% else %}false{% endif %},
|
|
"has_per_asic_scope": {% if feature + '@.service' in installer_services.split(' ') %}true{% else %}false{% endif %},
|
|
"auto_restart": "{{autorestart}}",
|
|
{%- if include_kubernetes == "y" %}
|
|
{%- if feature in ["dhcp_relay", "lldp", "pmon", "radv", "snmp", "telemetry"] %}
|
|
"set_owner": "kube", {% else %}
|
|
"set_owner": "local", {% endif %} {% endif %}
|
|
"high_mem_alert": "disabled"
|
|
}{% if not loop.last %},{% endif -%}
|
|
{% endfor %}
|
|
}
|
|
}
|