accesspoints: initial tests with 802.11r

4 files changed, 57 insertions, 2 deletions

diff --git a/chaos-at-home/group_vars/chaos-at-home-ap.yml b/chaos-at-home/group_vars/chaos-at-home-ap.yml
new file mode 100644
index 00000000..3d179c52
--- /dev/null
+++ b/chaos-at-home/group_vars/chaos-at-home-ap.yml
@@ -0,0 +1,9 @@
+$ANSIBLE_VAULT;1.2;AES256;chaos-at-home
+34343266646162383261313564646365393233643565356364386134663862646534383562336666
+6639633332613539663132383336343436396636306161370a323231653336376533636631373363
+36373865653863363338663762623164626631623739386561653935316430666132356662383863
+3666343965333939310a303530373037363636346639356561333264346466383462633533306538
+63373532636563333530333339306331343933383038633638346636326332366565306638376164
+65343761363162386331353731383437613462656538643638353464306230316662643366643561
+31623731366234666364343432373062336266336334366263333938623538393163333131636633
+65346230623634306362
diff --git a/filter_plugins/crypto.py b/filter_plugins/crypto.py
index b3dc32c4..54547a34 100644
--- a/filter_plugins/crypto.py
+++ b/filter_plugins/crypto.py
@@ -2,6 +2,7 @@ from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
 import hashlib
+from binascii import hexlify
 from passlib.utils.binary import Base64Engine, HASH64_CHARS, BCRYPT_CHARS
 from ansible.module_utils._text import to_bytes, to_text
 from ansible import errors
@@ -41,6 +42,17 @@ def bcrypt_salt(seed):
         raise errors.AnsibleFilterError("bcrypt_salt(): %s" % str(e))
 
 
+def wifi_80211r_key(seed):
+    ''' generate keys 802.11r r0kh and r1kh keys based on seed-value '''
+    try:
+        h = hashlib.new('sha256')
+        h.update(to_bytes(seed, errors='surrogate_or_strict'))
+        return to_text(hexlify(h.digest()))
+
+    except Exception as e:
+        raise errors.AnsibleFilterError("wifi_80211r_key(): %s" % str(e))
+
+
 class FilterModule(object):
 
     ''' crypto helpers '''
@@ -49,6 +61,7 @@ class FilterModule(object):
         'sha256_salt': sha2_crypt_salt,
         'sha512_salt': sha2_crypt_salt,
         'bcrypt_salt': bcrypt_salt,
+        'wifi_80211r_key': wifi_80211r_key,
     }
 
     def filters(self):
diff --git a/inventory/group_vars/accesspoints/vars.yml b/inventory/group_vars/accesspoints/vars.yml
index 7abe0582..3a11205c 100644
--- a/inventory/group_vars/accesspoints/vars.yml
+++ b/inventory/group_vars/accesspoints/vars.yml
@@ -91,22 +91,39 @@ accesspoint_wireless_devices_yaml: |
 accesspoint_wireless_ifaces: "{{ accesspoint_wireless_ifaces_yaml | from_yaml }}"
 accesspoint_wireless_ifaces_yaml: |
   {% for zone in accesspoint_zones.keys() %}
+  {%   set outer_loop = loop %}
   {%   for band in accesspoint_wireless_frequency_bands %}
   - name: wifi-iface '{{ zone }}{{ band }}'
     options:
       device: 'radio{{ band }}'
       network: '{{ zone }}'
       mode: 'ap'
-      disassoc_low_ack: '1'
-      rsn_preauth: '1'
       ssid: '{{ accesspoint_zones[zone].ssid }}'
       encryption: '{{ accesspoint_zones[zone].encryption }}'
       key: '{{ accesspoint_zones[zone].key }}'
+      disassoc_low_ack: '1'
+      rsn_preauth: '1'
+  {%     if accesspoint_80211r is defined %}
+      ieee80211r: '1'
+      mobility_domain: '{{ '%04x' % (accesspoint_80211r.mobility_domain_base[band] + outer_loop.index0) }}'
+      nasid: '{{ accesspoint_wifi_mac_addr[band][inventory_hostname] | replace(':', '') }}'
+      ft_psk_generate_local: '0'
+      r1_key_holder: '{{ accesspoint_wifi_mac_addr[band][inventory_hostname] }}'
+      r0kh:
+  {%       for ap in accesspoint_wifi_mac_addr[band] %}
+      - '{{ accesspoint_wifi_mac_addr[band][ap] }},{{ accesspoint_wifi_mac_addr[band][ap] | replace(':', '') }},{{ [accesspoint_80211r.key_seed,band,zone] | join(':') | wifi_80211r_key }}'
+  {%       endfor %}
+      r1kh:
+  {%       for ap in accesspoint_wifi_mac_addr[band] %}
+      - '{{ accesspoint_wifi_mac_addr[band][ap] }},{{ accesspoint_wifi_mac_addr[band][ap] }},{{ [accesspoint_80211r.key_seed,band,zone] | join(':') | wifi_80211r_key }}'
+  {%       endfor %}
+  {%     endif %}
   {%   endfor %}
   {% endfor %}
 
 
 
+
 openwrt_arch: ath79
 openwrt_target: generic
 openwrt_profile: ubnt_unifiac-lite
diff --git a/inventory/group_vars/chaos-at-home-ap/vars.yml b/inventory/group_vars/chaos-at-home-ap/vars.yml
index 83925639..c36ab953 100644
--- a/inventory/group_vars/chaos-at-home-ap/vars.yml
+++ b/inventory/group_vars/chaos-at-home-ap/vars.yml
@@ -10,6 +10,22 @@ accesspoint_wifi_channels:
     ch-ap1: 48
     ch-ap2: 40
 
+accesspoint_wifi_mac_addr:
+  2g:
+    ch-ap0: 18:e8:29:aa:43:c2
+    ch-ap1: 18:e8:29:aa:44:07
+  5g:
+    ch-ap0: 18:e8:29:ab:43:c2
+    ch-ap1: 18:e8:29:ab:44:07
+    ch-ap2: 80:2a:a8:ee:f6:d5
+
+accesspoint_80211r:
+  mobility_domain_base:
+    2g: 0x2400
+    5g: 0x5000
+  key_seed: "{{ vault_accesspoint_80211r.key_seed }}"
+
+
 accesspoint_zones:
   lan: "{{ network_zones.lan.wifi }}"
   iot: "{{ network_zones.iot.wifi }}"