Update and rename SONiC-SAI-POST.md #2083
Conversation
- include Control Plane POST. - CLI to fetch the POST status.
|
/azp run |
|
No pipelines are associated with this pull request. |
|
@vikram-nexthop Can you share more details on "Control Plane POST" ? I understand the SAI POST to check the ASIC/SecY -- but no so clear on the requirements on control plane POST |
|
@judyjoseph Control plane POST validates the cryptographic module used by wpa_supplicant for MKA operations, which is separate from the SAI/ASIC crypto engines, and requires independent FIPS validation too. |
- Added sample MACsec POST status output for single and multi ASIC scenarios. - Added CLI to ToC.
|
/azp run |
|
No pipelines are associated with this pull request. |
|
|
||
| The design must meet the following requirements: | ||
| - In order to accommodate different forwarding ASIC architecture or SAI implementation, the design should support enabling POST at either switch level (during switch init) or at MACSec engine level (during MACSec engine init). | ||
| - Should enable control plane POST at the MACSec level. |
There was a problem hiding this comment.
Is this a must for FIPS compliance?
There was a problem hiding this comment.
I can't say if it is a must(couldn't find a direct reference to control plane POST validation in the official FIPS documentation), but I do consider it necessary for SONiC MACsec FIPS compliance due to the following:
- These libraries (FIPS-certified OpenSSL FIPS Provider, SymCrypt) are not part of the SONiC repository but are critical to the security model - they handle authentication, data plane key generation, etc. Independent validation ensures their integrity and expected operational status (FIPS mode).
- Provides initialization-time detection of configuration errors, self-test failures, library corruption, etc enabling graceful service disabling rather than runtime failures.
- A one-time validation that reduces the attack surface by ensuring cryptographic libraries are in a known-good state.
This could prove redundant if the entire system (SONiC + 3rd party crypto libraries) is under a common FIPS boundary.
|
/azp run |
|
No pipelines are associated with this pull request. |
5 participants
Implementation PRs:
sonic-net/sonic-buildimage#24067
sonic-net/sonic-swss#3907
sonic-net/sonic-wpa-supplicant#99