# Multi-stage build — first stage compiles `eapol_test` from the upstream
# wpa_supplicant 2.10 source. Debian's `wpasupplicant` package ships the
# daemon but not the eapol_test binary; it's a separate utility from the
# wpa_supplicant test-tree that VL-E2E-04 / 42 / 43 / 44 (and the radius
# repo's K8sSupplicantPassthrough.radtest_eap_tls()) require for raw
# EAP-TLS / PEAP-EAP-TLS RADIUS frames without spinning up the full
# daemon.
FROM debian:bookworm-slim AS eapol-test-builder

RUN apt-get update && apt-get install -y --no-install-recommends \
        build-essential \
        libssl-dev \
        libnl-3-dev \
        libnl-genl-3-dev \
        pkg-config \
        wget \
        ca-certificates \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /build
RUN wget -q https://w1.fi/releases/wpa_supplicant-2.10.tar.gz \
    && tar xf wpa_supplicant-2.10.tar.gz \
    && rm wpa_supplicant-2.10.tar.gz

WORKDIR /build/wpa_supplicant-2.10/wpa_supplicant
# Minimal .config for eapol_test — enable IEEE 802.1X EAPOL, OpenSSL TLS,
# and the EAP methods VL-E2E tests exercise (TLS / PEAP / MSCHAPv2 / TTLS).
RUN cat > .config <<'EOF'
CONFIG_DRIVER_WIRED=y
CONFIG_TLS=openssl
CONFIG_IEEE8021X_EAPOL=y
CONFIG_EAP_TLS=y
CONFIG_EAP_PEAP=y
CONFIG_EAP_MSCHAPV2=y
CONFIG_EAP_TTLS=y
CONFIG_EAP_MD5=y
CONFIG_EAPOL_TEST=y
CONFIG_CTRL_IFACE=unix
EOF
# Debian 12 ships GCC 12, which promotes -Wuse-after-free in wpa_supplicant
# 2.10's bss.c to an error. Relax that and other newer-compiler warnings.
# Don't pipe through tail — that swallows make's exit code.
RUN EXTRA_CFLAGS="-Wno-error=use-after-free -Wno-error=stringop-overflow -Wno-error=array-bounds -Wno-error=dangling-pointer -Wno-error=deprecated-declarations" \
    make eapol_test
RUN test -x ./eapol_test && ls -la eapol_test

# ── Final image ─────────────────────────────────────────────────────────
FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
        freeradius-utils \
        wpasupplicant \
        iproute2 \
        iputils-ping \
        curl \
        ca-certificates \
        python3 \
        python3-pip \
        libssl3 \
        libnl-3-200 \
        libnl-genl-3-200 \
    && rm -rf /var/lib/apt/lists/*

RUN pip3 install --no-cache-dir paramiko --break-system-packages 2>/dev/null || \
    pip3 install --no-cache-dir paramiko

# Drop the freshly-built eapol_test binary into PATH.
COPY --from=eapol-test-builder /build/wpa_supplicant-2.10/wpa_supplicant/eapol_test \
                                /usr/local/bin/eapol_test

RUN mkdir -p /etc/wpa_supplicant /etc/ssl/certs /etc/ssl/private /var/log

CMD ["sh", "-c", "tail -f /dev/null"]
