Skip to content

ISS-3102 FIPS POST validation for MACsec control plane crypto. #3907

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 15 commits into
base: master
Choose a base branch
from
Open

ISS-3102 FIPS POST validation for MACsec control plane crypto. #3907

wants to merge 15 commits into from
+138 −0

Conversation

@vikram-nexthop
Copy link

@vikram-nexthop vikram-nexthop commented Sep 25, 2025 •
edited
Loading

What I did

  • Query control plane (wpa_supplicant) crypto POST status check in macsecmgrd main, when FIPS mode is enabled
  • Record status in FIPS_MACSEC_POST_TABLE.
  • Implemented fail-secure behavior where macsecmgrd is forced to get into an infinite loop, if the POST validation fails.

Why I did it
MACsec control plane FIPS POST validation is required to ensure the cryptographic backend has passed self-tests before enabling MACsec operations. This is to ensure MACsec control plane fails securely if crypto backend POST validation fails in FIPS environments.

How I verified it
Enabled MACsec service with and without SymCrypt FIPS provider.

Details if related
related PR: sonic-net/sonic-wpa-supplicant#99

@mssonicbld
Copy link
Collaborator

mssonicbld commented Sep 25, 2025

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Sep 25, 2025

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link
Collaborator

mssonicbld commented Sep 25, 2025

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Sep 25, 2025

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link
Collaborator

mssonicbld commented Sep 25, 2025

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Sep 25, 2025

Azure Pipelines successfully started running 1 pipeline(s).

@vikram-nexthop vikram-nexthop marked this pull request as ready for review September 25, 2025 16:33
@vikram-nexthop
- wpa_supplicant/SymCrypt-Provider init may block if there is a POST …
0fa7181 
…failure.

- update FIPS_MACSEC_POST_TABLE even if "wpa_supplicant -F" command fails due to timeout.
@mssonicbld
Copy link
Collaborator

mssonicbld commented Sep 30, 2025

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Sep 30, 2025

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link
Collaborator

mssonicbld commented Sep 30, 2025

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Sep 30, 2025

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link
Collaborator

mssonicbld commented Oct 7, 2025

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Oct 7, 2025

Azure Pipelines successfully started running 1 pipeline(s).

This was referenced Oct 8, 2025
Open
Open
wumiaont
wumiaont reviewed Oct 9, 2025
View reviewed changes
@mssonicbld
Copy link
Collaborator

mssonicbld commented Oct 13, 2025

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Oct 13, 2025

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link
Collaborator

mssonicbld commented Oct 13, 2025

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Oct 13, 2025

Azure Pipelines successfully started running 1 pipeline(s).

wumiaont
wumiaont approved these changes Oct 13, 2025
View reviewed changes
Copy link

@wumiaont wumiaont left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@vikram-nexthop
Copy link
Author

vikram-nexthop commented Oct 17, 2025

@prsunny Could you please review this PR for approval when convenient? All the review comments have been addressed.

@mssonicbld
Copy link
Collaborator

mssonicbld commented Oct 19, 2025

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Oct 19, 2025

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link
Collaborator

mssonicbld commented Oct 21, 2025

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Oct 21, 2025

Azure Pipelines successfully started running 1 pipeline(s).

@vikram-nexthop
Copy link
Author

vikram-nexthop commented Oct 29, 2025

@prsunny Could you please review this PR for approval when convenient? All the review comments have been addressed.

gentle reminder to complete the review.

@judyjoseph
Copy link
Contributor

judyjoseph commented Oct 29, 2025 •
edited
Loading

@vikram-nexthop we already stop the configs in macsecmgrd in PR : #3836 , macsecmgrd. Please share more details on this PR

@vikram-nexthop
Copy link
Author

vikram-nexthop commented Oct 29, 2025

@judyjoseph PR #3836 handles the data plane POST (SAI/hardware crypto engines), while this PR addresses control plane POST (wpa_supplicant crypto module for MKA protocol). Both are separate cryptographic modules and therefore require independent FIPS validation.

Complete MACsec FIPS compliance requires both POST validations to pass. So, both POST validations must pass before enabling MACsec configuration processing.

@mssonicbld
Copy link
Collaborator

mssonicbld commented Oct 30, 2025

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Oct 30, 2025

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link
Collaborator

mssonicbld commented Nov 4, 2025

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Nov 4, 2025

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link
Collaborator

mssonicbld commented Nov 11, 2025

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Nov 11, 2025

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link
Collaborator

mssonicbld commented Nov 12, 2025

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Nov 12, 2025

Azure Pipelines successfully started running 1 pipeline(s).

@prsunny prsunny requested a review from judyjoseph November 14, 2025 22:50
@mssonicbld
Copy link
Collaborator

mssonicbld commented Nov 15, 2025

/azp run

@azure-pipelines
Copy link

azure-pipelines bot commented Nov 15, 2025

Azure Pipelines successfully started running 1 pipeline(s).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@prsunny prsunny Awaiting requested review from prsunny prsunny is a code owner

@judyjoseph judyjoseph Awaiting requested review from judyjoseph

1 more reviewer

@wumiaont wumiaont wumiaont approved these changes

Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@vikram-nexthop @mssonicbld @judyjoseph @wumiaont