v0.5.0

Fewer false alarms, fewer failed-logon lines in your server's log, and verdicts that say what the probe actually checked. Every change here was verified against a real FreeRADIUS server (unit tests plus the repo's Docker smoke test).

Fixed: false alarms

• Retransmits. A request that gets no answer is re-sent from the same socket the way a real switch or AP does (RFC 5080 §2.2.1), before "no reply" is declared. One dropped packet used to produce FAIL No reply plus the whole registration snippet; it is now WARN ... answered after 1 retransmit(s), which tells you the path is lossy without failing a scheduled --strict run. Retransmits never fire inside FreeRADIUS's one-second reject_delay window, so a normal delayed reject is not duplicated.
• --count no longer locks out your test account. If the server rejects the credentials, the loop stops after that iteration instead of replaying a bad password up to 50 times. --json records it as repeat.stopped_early.
• Certificates issued by a single-tier private CA. A server certificate issued straight from a private root your clients trust is no longer reported as an "incomplete intermediate chain" — there is no intermediate to send. The warning now fires only when the missing issuer is demonstrably an intermediate (an AIA CA-Issuers URL, or an intermediate-style name).
• Common-Name-only certificates are a warning, not a failure: Windows supplicants accept a CN match, Android 11+ and iOS do not, and the output says exactly that.

Fixed: misleading output

• Latency. The round-trip figure comes from the Status-Server reply when the server answers one. Otherwise the output states that it includes FreeRADIUS's reject_delay, which is one second by default — previously every healthy LAN server appeared to "answer in ~1000ms". A new rtt_source field says which measurement you are looking at.
• A wrong PEAP password is reported as a credential reject, not "the exchange did not complete, the server may not offer PEAP-MSCHAPv2".
• EAP-TLS handshakes that failed before the server ever asked for a client certificate are no longer blamed on the certificate; the output names the real candidates (no common TLS version or cipher suite, or an up-front policy reject).
• CA certificates sent with the server certificate are now checked for expiry. An expired intermediate breaks clients exactly like an expired leaf and was previously invisible.
• No more empty Vendor-311 line on EAP accepts.

Quieter on your server

Reachability, shared secret and BlastRADIUS posture now share one Access-Request, so a run leaves one rejected test login in the server's log instead of three (50 instead of 150 under --count 50). That request is also RFC 2865 §4.1 compliant, unlike the credential-less packet it replaces. When it gets no reply, the auth, certificate and MTU checks skip immediately rather than each waiting out the full timeout.

New flags

Flag	Why
--called-station-id	The SSID that wireless policies match on, e.g. AA-BB-CC-DD-EE-FF:CorpWiFi. Without it the probe can hit a different policy than your real clients: a different VLAN, or a "did not match any network policy" reject.
--calling-station-id	The client MAC, for MAC-based policy rules.

--server also accepts bare and bracketed IPv6 literals, and a --timeout under 2 s now prints a note (a delayed Access-Reject can otherwise look like a lost packet).

Protocol

The PEAP Result-TLV acknowledgement now carries only a Result TLV. It previously echoed the server's whole TLV payload; Windows NPS sends a Crypto-Binding TLV alongside the Result TLV, and echoing the server's own binding back is an invalid response (NPS reason code 301 reads it as a man-in-the-middle attempt). FreeRADIUS inspects a single byte of that acknowledgement, which is why this was never visible in testing. NPS behaviour remains unverified in a lab — that work is tracked separately, and no claim here is based on an observed NPS run.

EAP-TTLS inner PAP pads the password to a multiple of 16 octets (RFC 5281 §11.2.5), matching wpa_supplicant.

Upgrading

Drop-in: no flags were removed or renamed, and the --json schema stays at major version 1 (rtt_source, retransmits, credential_rejected, chain, name_validation: "cn-only" and repeat.stopped_early are additive). Scheduled runs may go from failing to warning on a lossy path, and from warning to passing where a single-tier CA was being flagged.

---

Verify your download

See the "Verify your download" section of the README for copy-paste cosign + sha256sum verification commands.