MACsec/ MKA model reworked (on dev_macsec branch) based on review comments from PR #408 (on macsec branch)

[sasubrata]

MACsec/ MKA model reworked (on dev_macsec brnach ) based on review comments from PR #408 (on macsec branch)

Redocli view : https://redocly.github.io/redoc/?url=https://raw.githubusercontent.com/open-traffic-generator/models/dev_macsec/artifacts/openapi.yaml&nocors#tag/Configuration/operation/set_config

Config Changes:

• MKA

  • moved inside MACsec
  • Tx SC property restuctured
  • kay name changed to mka for easy understanding
  • eapol ethernet type, PSK key chain start time added to basic

• MACsec

  • encapsulation choice in MACsec:
  • secy renamed to secure_channel
  • crypto engine type names changed to: encrypt_only and encrypt_decrypt
  • all hex string min/ max lengths corrected

Metric: changes:

• MACsec

  • secy_names renamed to secure_entity_names

• MKA

  • kay_names renamed to peer_names

Changes not done

• key start time field string format HH:MM kept as it is instead of splitting into sub fields hh and mm
• PSK key chain start time field kept as DD-MM-YYYY HH:MM:SS. Shall we split into 6 sub fields - dd, mm, yyyy, hh, mm, ss too?

Open items:

1. How do we add IP over MACsec?

   • This is allowed only for encrypt_decrypt crypto engine type.
   • If MACsec is configured on an emulated ethernet interface, any protocol (e.g. IP) except (MKA) configured on the ethernet will be added on MACsec.

2. Can we add IP over ethernet and IP over MACsec for same emulated ethernet interface?

• No, we cannot do. It will always be IP over MACsec as mentioned in item 1) above.
• We cannot send mix of MACsec and non-MACsec IP packets from same ethernet address.
• However we can send non-MACsec IP packet from one ethernet address and MACsec IP packet from another ethernet address.

3. Additional metrics for hardware acceleration

• One set of stats will include stats for all crypo engine variants. snappi or other model user should validate if unsupported stat is fetched for a variant i.e. hardware acceleration specific metric e.g. multicast MACsec bytes/ packets Tx cannot be fetched when hardware acceleration is off.