Fix the FreeRADIUS-verifiable audit findings: retransmits, one shared probe, honest latency and cert verdicts

[utarafdar]

From a full static review of the probe against the FreeRADIUS 3.2.x source. Every item here is verified by unit tests and the FreeRADIUS Docker smoke test. The NPS-dependent questions are tracked separately and are not answered by this PR.

Transport

• UDP retransmits (RFC 5080 §2.2.1). The same datagram is re-sent from the same socket at 40% and 70% of the timeout, never before 1.5 s so a FreeRADIUS reject_delay reply is not duplicated. A single lost packet is now a WARN "answered after N retransmit(s)" with a retransmits field, instead of "No reply — server down" plus the full registration hint. This was the most likely source of false pages in a scheduled --strict run.
• Stray datagrams carrying a foreign Identifier are ignored rather than failing the exchange.

Fewer requests, fewer failed-auth log lines

• reachability, shared-secret and blastradius-posture now ride on one PAP-shaped Access-Request (RFC 2865 §4.1 compliant, unlike the old credential-less reachability packet). One rejected login in the server's log per run instead of three; 50 instead of 150 under --count 50.
• When that request gets no reply, the auth, certificate and MTU checks skip immediately (still marked as timeouts for --count) instead of each waiting out the full timeout.

Honest readings

• Latency. Reachability reports the Status-Server round trip when the server answers one (rtt_source=status-server); otherwise it states that the figure includes FreeRADIUS's reject_delay, which is 1 s by default. Previously every LAN server "answered in ~1000ms".
• Certificate chain. A leaf issued straight from a private root (single-tier AD CS, FreeRADIUS's own CA) is no longer reported as an incomplete chain — there is no intermediate to send. The WARN now fires only when the missing issuer is demonstrably an intermediate (an AIA CA-Issuers URL, or an intermediate-style name). CA certificates the server does send are checked for expiry, which was never done before.
• CN-only certificates. A match by Common Name with no SAN is a WARN, not a FAIL: Windows supplicants accept it, Android 11+ and iOS do not.
• PEAP. An outer Access-Reject / EAP-Failure after the MSCHAPv2 response is reported as a credential reject, not "the exchange did not complete, the server may not offer PEAP-MSCHAPv2".
• EAP-TLS. A handshake aborted before the server ever requested a client certificate is no longer blamed on the certificate; it names the real candidates (no common TLS version or cipher, or an up-front policy reject).

Safety

• --count stops after the first iteration in which the server rejected the test credentials, and says so (repeat.stopped_early in --json). Repeating a rejected password up to 50 times is how a test account trips the domain lockout threshold, after which the aggregate would report a self-inflicted lockout as a "consistent configuration failure".

Protocol

• The PEAP Result-TLV acknowledgement carries only a Result TLV and no longer echoes the server's TLV payload. Windows NPS sends a Crypto-Binding TLV alongside the Result TLV; echoing the server's own binding back is an invalid response, and NPS reason code 301 is "cryptobinding TLV that is not valid ... a MITM attack is in progress". FreeRADIUS only inspects one byte of the ack, which is why this was never visible in the smoke test. NPS behaviour still has to be verified in a lab.
• The failure-path TLV acknowledgement is now shipped, so the server closes the session instead of waiting for it.
• TTLS inner PAP pads the password to a multiple of 16 octets (RFC 5281 §11.2.5), as wpa_supplicant does.

Flags and input

• --called-station-id and --calling-station-id. Target already had the fields but nothing set them, so the probe could land on a different policy than real clients (NPS conditions and FreeRADIUS unlang routinely match the SSID or MAC).
• Bare and bracketed IPv6 literals in --server.
• A note when --timeout is under 2 s, since reject_delay can then look like packet loss.

Also

• No more empty Vendor-311 line on EAP accepts (the MPPE key attributes are skipped, and the placeholder they left behind is gone).
• The smoke test regenerates the FreeRADIUS image's test certificates at container start. They are valid for 60 days from the image build and had expired on 2026-08-02, so EAP-TLS and the certificate check were failing for a reason unrelated to the probe.

Verification

go vet ./..., go test ./... and ./test/freeradius-smoke.sh all pass. New tests cover the retransmit path and schedule, the Result-TLV-only acknowledgement, the shared base exchange (asserting the server sees exactly one request for three checks), the Status-Server latency source, the repeat lockout guard, and four certificate cases (private-root leaf, missing intermediate, CN-only, expired intermediate).

🤖 Generated with Claude Code