Freeradius 3.2.x TEAP Support for Machine Only Authentication

[Suriya Shankar]

Hi Alan,

With the current EAP-TEAP implementation, we don't have the option to
support devices that only want to use Machine Auth. I implemented and
tested this on my machine and it works as expected. The changes I made as
follows


diff --git a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c
b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c
index b30ab7e3d3..36b2dbdfa3 100644
--- a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c
+++ b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c
@@ -1217,6 +1217,7 @@ static PW_CODE eap_teap_phase2(REQUEST *request,
eap_handler_t *eap_session,
 {
  PW_CODE code = PW_CODE_ACCESS_REJECT;
  rlm_rcode_t rcode;
+ bool machine_only = false;
  VALUE_PAIR *tvp;
  teap_tunnel_t *t = (teap_tunnel_t *)tls_session->opaque;
  int eap_method = 0;
@@ -1253,6 +1254,17 @@ static PW_CODE eap_teap_phase2(REQUEST *request,
eap_handler_t *eap_session,

  RDEBUG("Phase 2: Got tunneled identity of %s", t->username->vp_strvalue);

+ } else if (tvp &&
+    (tvp->vp_length == EAP_HEADER_LEN + 1) &&
+    (tvp->vp_strvalue[0] == PW_EAP_RESPONSE) &&
+    (tvp->vp_strvalue[EAP_HEADER_LEN] == PW_EAP_IDENTITY)) {
+ /*
+ * Empty inner EAP-Identity indicates machine-only auth: finish
+ * with final TEAP Result TLV, then wait for client Result echo.
+ */
+ RDEBUG2("Phase 2: Received empty inner EAP-Identity; treating as
machine-only TEAP completion");
+ machine_only = true;
+
  } else if (!fake->username) {
  /*
  * Don't reject the request outright,
@@ -1556,12 +1568,14 @@ done:
  * Call authentication recursively, which will
  * do PAP, CHAP, MS-CHAP, etc.
  */
- rad_virtual_server(fake, true);
+ if (!machine_only) {
+ rad_virtual_server(fake, true);
+ }

  /*
  * Decide what to do with the reply.
  */
- switch (fake->reply->code) {
+ switch (machine_only ? PW_CODE_ACCESS_CHALLENGE : fake->reply->code) {
  case 0:
  tvp = fr_pair_find_by_num(fake->config, PW_RESPONSE_PACKET_TYPE, 0,
TAG_ANY);
  if (tvp && (tvp->vp_integer == PW_CODE_ACCESS_CHALLENGE)) {
@@ -1573,6 +1587,15 @@ done:
  code = PW_CODE_ACCESS_REJECT;
  break;

+ case PW_CODE_ACCESS_CHALLENGE:
+ if (machine_only) {
+ t->result_final = true;
+ eap_teap_append_result(request, tls_session, PW_CODE_ACCESS_ACCEPT);
+ code = PW_CODE_ACCESS_CHALLENGE;
+ break;
+ }
+ /* FALL-THROUGH */
+
  case PW_CODE_ACCESS_ACCEPT:
  tvp = fr_pair_find_by_num(fake->packet->vps, PW_EAP_TYPE, 0, TAG_ANY);
  if (tvp) {





*And the logs from my testing *


*From the client we received after authenticating the Machine Certificate*
Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Session established.
Proceeding to decode tunneled attributes
Mon Jun 15 22:14:10 2026 : Debug:   TEAP tunnel data total 101
  TEAP tunnel data in 00: 80 0c 00 4c 00 01 01 21 9a 89 af 0a 7d e6 5d b1
  TEAP tunnel data in 10: 22 9b 2a eb ad 14 80 9a 0b 72 1f a4 87 6b 65 a3
  TEAP tunnel data in 20: 22 3b 6e c8 31 c8 9b e5 00 00 00 00 00 00 00 00
  TEAP tunnel data in 30: 00 00 00 00 00 00 00 00 00 00 00 00 b6 0e 4f 32
  TEAP tunnel data in 40: 5f ab f5 f7 28 37 3d cd 9e 1c ee 0b 6a ab c8 05
  TEAP tunnel data in 50: 80 0a 00 02 00 01 00 02 00 02 00 01 80 09 00 05
  TEAP tunnel data in 60: 02 82 00 05 01
Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Got Tunneled TEAP TLVs
Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap:  Found the pair by
TEAP_TLV_IDENTITY copying the value to t->identity
Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap:
FreeRADIUS-EAP-TEAP-Crypto-Binding =
0x000101219a89af0a7de65db1229b2aebad14809a0b721fa4876b65a3223b6ec831c89be50000000000000000000000000000000000000000b60e4f325fabf5f728373dcd9e1cee0b6aabc805
Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap:
FreeRADIUS-EAP-TEAP-Intermediate-Result = Success
Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap:
FreeRADIUS-EAP-TEAP-EAP-Payload = 0x0282000501
Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: BUFFER for Compound MAC
calculation - hexdump(len=123): 80 0c 00 4c 00 01 01 21 9a 89 af 0a 7d e6
5d b1 22 9b 2a eb ad 14 80 9a 0b 72 1f a4 87 6b 65 a3 22 3b 6e c8 31 c8 9b
e5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 37 00 01 00 26 53 5f 39 34
64 65 36 36 65 38 2d 35 35 36 61 2d 34 64 35 36 2d 38 37 38 30 2d 61 31 31
34 36 32 30 61 35 63 34 32
Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: S-IMCK[j] -
hexdump(len=40): 68 d4 a1 17 ad bb de f1 4b fb cb 4c 94 71 95 63 60 b2 f7
91 24 c4 6d ca ef 7d c8 13 56 a5 47 d4 b3 fd 0a 0a 18 ad 68 4d
Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Derived key (MSK) -
hexdump(len=64): f3 93 64 e5 bd 76 78 39 ff c6 b6 8f 85 ad 95 ff 56 9e 60
ae 4e c9 51 c1 8b 55 20 5b 4a 59 ec a9 9e 58 9c d8 63 1c 4a b6 f4 3d cb f5
6f 07 14 13 ea 91 ff fb 7c b8 52 89 fd fa 5a f9 b5 ff 3f 9e
Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Derived key (EMSK) -
hexdump(len=64): 9b e4 9d 86 ff c5 f1 fa f0 16 62 11 ca 09 ed d7 39 6b c0
90 03 22 ac bd d4 6b b9 35 eb 26 5c b9 9f 20 c0 6b f7 a8 ec 5b 7f a7 4e 14
97 86 95 9e de 9f c4 e5 04 dc 85 dd 96 0f 8d 6e 68 27 30 56




02 82 00 05 01 -> Sending the identity packet without any username for the
client preferring Machine Only Authentication.



*When challenged by Accept as the changes shown in the diff, client accepts
the connection*
Debug:   TEAP tunnel data total 6
  TEAP tunnel data in 00: 80 03 00 02 00 01
Mon Jun 15 22:14:10 2026 : Debug: (136) eap_teap: Got Tunneled TEAP TLVs
Mon Jun 15 22:14:10 2026 : Debug: (136) eap_teap:
FreeRADIUS-EAP-TEAP-Result = Success
Mon Jun 15 22:14:10 2026 : Debug: (136)
eap_S_94de66e8-556a-4d56-8780-a114620a5c42: Sending


If you find this good, I would like to raise a PR. If any changes required
or if it's not the way as expected, will update it accordingly

Thanks,
Suriya