claude-botandClaude Opus 5.5
d42862e2d8
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
78 lines
2.6 KiB
Bash
Executable File
78 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Live EAP-TTLS/PAP login against the deployed FreeRADIUS from a test client
|
|
# (10.2.50.0/24 / fd02:50::/64, client "test"/"test6").
|
|
#
|
|
# Usage: tests/radius/live.sh <server-ip> <identity> <password-file> <secret-file> [count]
|
|
# password-file: the password on the first line, or `export NAME=value` lines
|
|
# (LIVE_PASSWORD_VAR selects the variable, default CLAUDE_BOT_TOKEN)
|
|
# secret-file: `bao kv get` output of apps/radius, or the bare
|
|
# DOT1X_TEST_SECRET on the first line
|
|
# count: number of logins (default 1)
|
|
# LIVE_SOURCE: optional local address for eapol_test -A (must be in a
|
|
# test client range)
|
|
# Prints one line per login: result, duration, VLAN. Secrets are never printed.
|
|
set -euo pipefail
|
|
|
|
server="$1"
|
|
identity="$2"
|
|
password_file="$3"
|
|
secret_file="$4"
|
|
count="${5:-1}"
|
|
password_var="${LIVE_PASSWORD_VAR:-CLAUDE_BOT_TOKEN}"
|
|
|
|
read_password() {
|
|
local line
|
|
line=$(grep -m1 -E "^export ${password_var}=" "$password_file" || true)
|
|
if [ -n "$line" ]; then
|
|
line="${line#*=}"
|
|
line="${line#\"}"; line="${line%\"}"
|
|
line="${line#\'}"; line="${line%\'}"
|
|
printf '%s' "$line"
|
|
else
|
|
head -n1 "$password_file"
|
|
fi
|
|
}
|
|
|
|
read_secret() {
|
|
local s
|
|
s=$(sed -n 's/.*DOT1X_TEST_SECRET:\([^] ]*\).*/\1/p' "$secret_file")
|
|
if [ -n "$s" ]; then printf '%s' "$s"; else head -n1 "$secret_file"; fi
|
|
}
|
|
|
|
work=$(mktemp -d)
|
|
trap 'rm -rf "$work"' EXIT
|
|
chmod 700 "$work"
|
|
|
|
password=$(read_password)
|
|
secret=$(read_secret)
|
|
[ -n "$password" ] || { echo "no password found in $password_file" >&2; exit 2; }
|
|
[ -n "$secret" ] || { echo "no DOT1X_TEST_SECRET found in $secret_file" >&2; exit 2; }
|
|
|
|
umask 077
|
|
cat > "$work/eapol.conf" <<EOF
|
|
network={
|
|
ssid="Renner Test"
|
|
key_mgmt=WPA-EAP
|
|
eap=TTLS
|
|
identity="${identity}"
|
|
anonymous_identity="anonymous"
|
|
ca_cert="/etc/ssl/certs/ca-certificates.crt"
|
|
domain_suffix_match="radius.renner.uno"
|
|
phase2="auth=PAP"
|
|
password="${password}"
|
|
}
|
|
EOF
|
|
|
|
for i in $(seq 1 "$count"); do
|
|
start=$(date +%s%N)
|
|
out=$(eapol_test -c "$work/eapol.conf" -a "$server" ${LIVE_SOURCE:+-A "$LIVE_SOURCE"} -s "$secret" -t 10 2>&1 || true)
|
|
end=$(date +%s%N)
|
|
ms=$(( (end - start) / 1000000 ))
|
|
result=$(tail -n1 <<<"$out")
|
|
case "$result" in SUCCESS|FAILURE) ;; *) result="NO-RESULT" ;; esac
|
|
# Attribute lines of the Access-Accept as the NAS received it (hex values).
|
|
attrs=$(awk '/RADIUS message: code=2 /{f=1; next} f && /^ /{print; next} f{f=0}' <<<"$out")
|
|
attr() { awk -v a="Attribute $1 " 'index($0, a){getline; sub(/^ *Value: /, ""); print; exit}' <<<"$attrs"; }
|
|
echo "login $i: $result ${ms}ms tunnel-type=[$(attr 64)] medium=[$(attr 65)] group-id=[$(attr 81)]"
|
|
done
|