homelab/tests/radius

FreeRADIUS functional test

tests/radius/run.sh

Runs the production FreeRADIUS config from kubernetes/apps/authentik/freeradius-config.yaml (rendered through the projected volume in freeradius.yaml, same image, args and secret env names) in Docker against a mock authentik outpost, and drives it with eapol_test (EAP-TTLS, inner PAP) as a NAS in the test client ranges 10.2.50.0/24 and fd02:50::/64. The v6 cases (v6-*) hit the IPv6 listeners and client test6.

Case	Expected
vlan-tunnel (outpost sends Tunnel-* and Cisco-AV-Pair)	SUCCESS, Tunnel-* VLAN 50, no Cisco-AV-Pair
vlan-avpair (outpost sends only Cisco-AV-Pair = "dot1x-vlan=50")	SUCCESS, Tunnel-* VLAN 50, no Cisco-AV-Pair
novlan (Accept without VLAN)	FAILURE (Access-Reject)
wrong password / unknown user (Reject without Message-Authenticator)	FAILURE (Access-Reject) within 1 s
Accounting-Request	answered locally, nothing sent to the outpost

Pieces:

• mock_outpost.py: stand-in outpost on UDP 1812, reachable under the outpost Service FQDN through a Docker network alias.
• eapol.Dockerfile: eapol_test from Debian eapoltest.
• Docker network radtest: internal bridge on 10.2.50.0/24 and fd02:50::/64 with no host address (inhibit_ipv4, gateway_mode_ipv6=isolated), so the workstation LAN routes are untouched.

Requires Docker, openssl and yq (the jq wrapper). Secrets, password and certificates are generated dummies. RADTEST_DEBUG=1 runs radiusd with -xx and prints all logs. Containers, network and temp files are removed on exit.

live.sh logs in against the deployed FreeRADIUS instead; usage in docs/radius/dot1x.md ("Live login check").