DO NOT MERGE: CBMA code and test scripts #337

SelinaTII · 2023-11-17T14:21:55Z

This is an initial PR for CBMA code and test scripts

CBMA for an inteface can be setup by calling the cbma() function in https://github.com/tiiuae/mesh_com/blob/cbma/modules/sc-mesh-secure-deployment/src/2_0/features/cbma/setup_cbma.py
The cbma() function calls setup_macsec() and setup_batman()
An example of setting up cbma for wlp1s0 and eth1 is given in the main function of setup_cbma.py (steps to generate test certificates are also mentioned there)
The code requires pyOpenSSL package (@dania-tii is integrating the build root package in tc_distro)
The code has been tested for wlp1s0 and eth1 interfaces on CSLs (will perform further tests with other radios on comms module 2.0 devices)
There are some improvements and bug fixes that will come up in later PRs

* CBMA files in 2_0/features/cbma/ * CBMA unit tests in 2_0/test_features/cbma/ Jira_Id : MSS20-173 Signed-off-by: Selina Shrestha <[email protected]>

Signed-off-by: Selina Shrestha <[email protected]>

* CBMA files in 2_0/features/cbma/ * CBMA unit tests in 2_0/test_features/cbma/ Jira_Id : MSS20-173 Signed-off-by: Selina Shrestha <[email protected]>

Signed-off-by: Selina Shrestha <[email protected]>

…terface Signed-off-by: Selina Shrestha <[email protected]>

# Conflicts: # modules/sc-mesh-secure-deployment/src/2_0/features/cbma/multicast/multicast.py

Signed-off-by: Selina Shrestha <[email protected]>

…s can be specified as necessary Signed-off-by: Selina Shrestha <[email protected]>

Signed-off-by: Selina Shrestha <[email protected]>

… in order to generate certificates for different interfaces. Signed-off-by: Selina Shrestha <[email protected]>

* Sample code (main of setup_cbma.py) performs cbma for wlp1s0 and eth1 * In tools.utils, fixed mac_to_ipv6() and get_mac_from_ipv6() Signed-off-by: Selina Shrestha <[email protected]>

… to clean up threads, macsec links, batman interfaces and bridges created from cbma Signed-off-by: Selina Shrestha <[email protected]>

Signed-off-by: Selina Shrestha <[email protected]>

TIISR · 2023-11-17T16:36:07Z

Context: Selina's code creates the lower/upper MACsec stacks (one interface per peer plus a bridge to aggregate them and give them as one to the batman-adv specified as parameter) visible in the diagram hereby attached.

The idea is for CommsController to call Selina's code with configurations provided by MDM or by the default principle of bat0 as white and all physical(ish) interfaces as black.

modules/sc-mesh-secure-deployment/src/2_0/features/cbma/macsec/macsec.py

modules/sc-mesh-secure-deployment/src/2_0/features/cbma/tools/utils.py

modules/sc-mesh-secure-deployment/src/2_0/features/cbma/auth/authClient.py

modules/sc-mesh-secure-deployment/src/2_0/features/cbma/auth/authServer.py

CBMA changes requested in #337

CBMA fixes in #337

fix: Temporarily revert ebtables rules to reduce frame broadcasting

Allow the peer with higher mac address to initiate authentication as client in order to avoid simultaneous client-server, server-client connections between two peers. Jira_Id : MSS20-205 Signed-off-by: Selina Shrestha <[email protected]>

Signed-off-by: Selina Shrestha <[email protected]>

SelinaTII added 16 commits November 7, 2023 14:00

Added CBMA files

b9ec282

* CBMA files in 2_0/features/cbma/ * CBMA unit tests in 2_0/test_features/cbma/ Jira_Id : MSS20-173 Signed-off-by: Selina Shrestha <[email protected]>

Changes for lower cbma

5be702a

Signed-off-by: Selina Shrestha <[email protected]>

Removing old main

bcf6d4a

Signed-off-by: Selina Shrestha <[email protected]>

Added CBMA files

e8ce890

* CBMA files in 2_0/features/cbma/ * CBMA unit tests in 2_0/test_features/cbma/ Jira_Id : MSS20-173 Signed-off-by: Selina Shrestha <[email protected]>

Changes for lower cbma

f2f34a0

Signed-off-by: Selina Shrestha <[email protected]>

Removing old main

1c887c1

Signed-off-by: Selina Shrestha <[email protected]>

Added option to bind socket listening for multicasts to particular in…

e3fff61

…terface Signed-off-by: Selina Shrestha <[email protected]>

Merge remote-tracking branch 'origin/cbma' into cbma

b2364ed

# Conflicts: # modules/sc-mesh-secure-deployment/src/2_0/features/cbma/multicast/multicast.py

Changes to call lower and upper cbma

b0cd121

Signed-off-by: Selina Shrestha <[email protected]>

Added comments for cbma() arguments in setup_cbma.py

3a3322c

Signed-off-by: Selina Shrestha <[email protected]>

Added path_to_ca parameter in cbma() so that different ca certificate…

fb785c0

…s can be specified as necessary Signed-off-by: Selina Shrestha <[email protected]>

Separated cbma() into setup_macsec() and setup_batman()

a0636d3

Signed-off-by: Selina Shrestha <[email protected]>

Changed cert_generation/client_side.py to take interface as parameter…

d769f70

… in order to generate certificates for different interfaces. Signed-off-by: Selina Shrestha <[email protected]>

Changes to call cbma for multiple interfaces

e3604fa

* Sample code (main of setup_cbma.py) performs cbma for wlp1s0 and eth1 * In tools.utils, fixed mac_to_ipv6() and get_mac_from_ipv6() Signed-off-by: Selina Shrestha <[email protected]>

Added macsec_encryption parameter in cbma() and added stop() function…

3e901b2

… to clean up threads, macsec links, batman interfaces and bridges created from cbma Signed-off-by: Selina Shrestha <[email protected]>

Added functional test scripts for cbma

2a11f1c

Signed-off-by: Selina Shrestha <[email protected]>

SelinaTII requested review from govindsi, joenpera, martin-tii, saauvine, TIISR and pentestiing November 17, 2023 14:21

martin-tii approved these changes Nov 17, 2023

View reviewed changes

TIISR reviewed Nov 18, 2023

View reviewed changes

modules/sc-mesh-secure-deployment/src/2_0/features/cbma/macsec/macsec.py Show resolved Hide resolved

TIISR suggested changes Nov 18, 2023

View reviewed changes

modules/sc-mesh-secure-deployment/src/2_0/features/cbma/macsec/macsec.py Outdated Show resolved Hide resolved

TIISR suggested changes Nov 18, 2023

View reviewed changes

modules/sc-mesh-secure-deployment/src/2_0/features/cbma/tools/utils.py Show resolved Hide resolved

modules/sc-mesh-secure-deployment/src/2_0/features/cbma/tools/utils.py Show resolved Hide resolved

TIISR reviewed Nov 18, 2023

View reviewed changes

modules/sc-mesh-secure-deployment/src/2_0/features/cbma/auth/authClient.py Outdated Show resolved Hide resolved

TIISR suggested changes Nov 18, 2023

View reviewed changes

modules/sc-mesh-secure-deployment/src/2_0/features/cbma/auth/authClient.py Show resolved Hide resolved

TIISR reviewed Nov 18, 2023

View reviewed changes

modules/sc-mesh-secure-deployment/src/2_0/features/cbma/auth/authServer.py Outdated Show resolved Hide resolved

pentestiing added 7 commits November 21, 2023 08:40

Add and cleanup ebtables rules to reduce frame broadcasting

472d024

Use TLS 1.3 in auth client and server

9fab980

Retry connection on generic exception

8cbb092

Remove unused main code from auth client and server

07cca84

Fix access to undeclared variable

04987f1

Use a reasonable timeout when handling client sockets

8ce76aa

Use sendall instead of send for sockets

a782d17

pentestiing mentioned this pull request Nov 22, 2023

CBMA changes requested in #337 #339

Merged

Merge pull request #339 from pentestiing/cbma

1972b89

CBMA changes requested in #337

pentestiing requested review from joenpera and TIISR November 22, 2023 06:39

pentestiing and others added 8 commits November 29, 2023 12:40

Fix ebtables rules to reduce frame broadcasting

6a8e5ed

Allow reusing address on server socket bind

71e364e

Disable check hostname for TLS 1.3

18c955e

Increase client socket timeout at the authentication phase

a398d59

fix: Temporarily revert SCI changes to make macsec work

516429d

Merge pull request #343 from pentestiing/cbma

9d56e4c

CBMA fixes in #337

fix: Temporarily revert ebtables rules to reduce frame broadcasting

b7edf50

Merge pull request #345 from pentestiing/cbma

7473499

fix: Temporarily revert ebtables rules to reduce frame broadcasting

pentestiing force-pushed the cbma branch 2 times, most recently from 677ead9 to b7edf50 Compare December 1, 2023 11:07

pentestiing mentioned this pull request Dec 1, 2023

CBMA code and test scripts - Original Changes #348

Merged

SelinaTII added 2 commits December 1, 2023 15:37

Avoid duplicate macsec key agreements

58ab068

Allow the peer with higher mac address to initiate authentication as client in order to avoid simultaneous client-server, server-client connections between two peers. Jira_Id : MSS20-205 Signed-off-by: Selina Shrestha <[email protected]>

Updated test_secchannel.py to use socket.sendall instead of send

fc89cea

Signed-off-by: Selina Shrestha <[email protected]>

martin-tii approved these changes Dec 1, 2023

View reviewed changes

DamienDeMayaTII changed the title ~~CBMA code and test scripts~~ DO NOT MERGE: CBMA code and test scripts Dec 8, 2023

pentestiing marked this pull request as draft December 11, 2023 11:11

pentestiing closed this Jan 9, 2024

pentestiing mentioned this pull request Jan 10, 2024

CBMA MDM Multiprocessing #377

Merged

pentestiing deleted the cbma branch January 17, 2024 06:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

DO NOT MERGE: CBMA code and test scripts #337

DO NOT MERGE: CBMA code and test scripts #337

SelinaTII commented Nov 17, 2023

TIISR commented Nov 17, 2023

DO NOT MERGE: CBMA code and test scripts #337

DO NOT MERGE: CBMA code and test scripts #337

Conversation

SelinaTII commented Nov 17, 2023

TIISR commented Nov 17, 2023