Re: Freeradius 3.2.x TEAP Support for Machine Only Authentication

--===============4193539932160686749==
Content-Type: multipart/signed;
	boundary="Apple-Mail=_BD1EB982-A794-41D9-8575-C4EB693B805F";
	protocol="application/pgp-signature";
	micalg=pgp-sha256


--Apple-Mail=_BD1EB982-A794-41D9-8575-C4EB693B805F
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

  This looks interesting.  Please submit a PR, and we will take a look =
at it.

  Alan DeKok.

> On Jun 15, 2026, at 7:43=E2=80=AFPM, Suriya Shankar =
<[email protected]> wrote:
>=20
> Hi Alan,
>=20
> With the current EAP-TEAP implementation, we don't have the option to
> support devices that only want to use Machine Auth. I implemented and
> tested this on my machine and it works as expected. The changes I made =
as
> follows
>=20
>=20
> diff --git a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c
> b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c
> index b30ab7e3d3..36b2dbdfa3 100644
> --- a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c
> +++ b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c
> @@ -1217,6 +1217,7 @@ static PW_CODE eap_teap_phase2(REQUEST *request,
> eap_handler_t *eap_session,
> {
>  PW_CODE code =3D PW_CODE_ACCESS_REJECT;
>  rlm_rcode_t rcode;
> + bool machine_only =3D false;
>  VALUE_PAIR *tvp;
>  teap_tunnel_t *t =3D (teap_tunnel_t *)tls_session->opaque;
>  int eap_method =3D 0;
> @@ -1253,6 +1254,17 @@ static PW_CODE eap_teap_phase2(REQUEST =
*request,
> eap_handler_t *eap_session,
>=20
>  RDEBUG("Phase 2: Got tunneled identity of %s", =
t->username->vp_strvalue);
>=20
> + } else if (tvp &&
> +    (tvp->vp_length =3D=3D EAP_HEADER_LEN + 1) &&
> +    (tvp->vp_strvalue[0] =3D=3D PW_EAP_RESPONSE) &&
> +    (tvp->vp_strvalue[EAP_HEADER_LEN] =3D=3D PW_EAP_IDENTITY)) {
> + /*
> + * Empty inner EAP-Identity indicates machine-only auth: finish
> + * with final TEAP Result TLV, then wait for client Result echo.
> + */
> + RDEBUG2("Phase 2: Received empty inner EAP-Identity; treating as
> machine-only TEAP completion");
> + machine_only =3D true;
> +
>  } else if (!fake->username) {
>  /*
>  * Don't reject the request outright,
> @@ -1556,12 +1568,14 @@ done:
>  * Call authentication recursively, which will
>  * do PAP, CHAP, MS-CHAP, etc.
>  */
> - rad_virtual_server(fake, true);
> + if (!machine_only) {
> + rad_virtual_server(fake, true);
> + }
>=20
>  /*
>  * Decide what to do with the reply.
>  */
> - switch (fake->reply->code) {
> + switch (machine_only ? PW_CODE_ACCESS_CHALLENGE : fake->reply->code) =
{
>  case 0:
>  tvp =3D fr_pair_find_by_num(fake->config, PW_RESPONSE_PACKET_TYPE, 0,
> TAG_ANY);
>  if (tvp && (tvp->vp_integer =3D=3D PW_CODE_ACCESS_CHALLENGE)) {
> @@ -1573,6 +1587,15 @@ done:
>  code =3D PW_CODE_ACCESS_REJECT;
>  break;
>=20
> + case PW_CODE_ACCESS_CHALLENGE:
> + if (machine_only) {
> + t->result_final =3D true;
> + eap_teap_append_result(request, tls_session, PW_CODE_ACCESS_ACCEPT);
> + code =3D PW_CODE_ACCESS_CHALLENGE;
> + break;
> + }
> + /* FALL-THROUGH */
> +
>  case PW_CODE_ACCESS_ACCEPT:
>  tvp =3D fr_pair_find_by_num(fake->packet->vps, PW_EAP_TYPE, 0, =
TAG_ANY);
>  if (tvp) {
>=20
>=20
>=20
>=20
>=20
> *And the logs from my testing *
>=20
>=20
> *=46rom the client we received after authenticating the Machine =
Certificate*
> Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Session established.
> Proceeding to decode tunneled attributes
> Mon Jun 15 22:14:10 2026 : Debug:   TEAP tunnel data total 101
>  TEAP tunnel data in 00: 80 0c 00 4c 00 01 01 21 9a 89 af 0a 7d e6 5d =
b1
>  TEAP tunnel data in 10: 22 9b 2a eb ad 14 80 9a 0b 72 1f a4 87 6b 65 =
a3
>  TEAP tunnel data in 20: 22 3b 6e c8 31 c8 9b e5 00 00 00 00 00 00 00 =
00
>  TEAP tunnel data in 30: 00 00 00 00 00 00 00 00 00 00 00 00 b6 0e 4f =
32
>  TEAP tunnel data in 40: 5f ab f5 f7 28 37 3d cd 9e 1c ee 0b 6a ab c8 =
05
>  TEAP tunnel data in 50: 80 0a 00 02 00 01 00 02 00 02 00 01 80 09 00 =
05
>  TEAP tunnel data in 60: 02 82 00 05 01
> Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Got Tunneled TEAP =
TLVs
> Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap:  Found the pair by
> TEAP_TLV_IDENTITY copying the value to t->identity
> Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap:
> FreeRADIUS-EAP-TEAP-Crypto-Binding =3D
> =
0x000101219a89af0a7de65db1229b2aebad14809a0b721fa4876b65a3223b6ec831c89be5=
0000000000000000000000000000000000000000b60e4f325fabf5f728373dcd9e1cee0b6a=
abc805
> Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap:
> FreeRADIUS-EAP-TEAP-Intermediate-Result =3D Success
> Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap:
> FreeRADIUS-EAP-TEAP-EAP-Payload =3D 0x0282000501
> Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: BUFFER for Compound =
MAC
> calculation - hexdump(len=3D123): 80 0c 00 4c 00 01 01 21 9a 89 af 0a =
7d e6
> 5d b1 22 9b 2a eb ad 14 80 9a 0b 72 1f a4 87 6b 65 a3 22 3b 6e c8 31 =
c8 9b
> e5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =
00 00
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 37 00 01 00 26 53 5f =
39 34
> 64 65 36 36 65 38 2d 35 35 36 61 2d 34 64 35 36 2d 38 37 38 30 2d 61 =
31 31
> 34 36 32 30 61 35 63 34 32
> Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: S-IMCK[j] -
> hexdump(len=3D40): 68 d4 a1 17 ad bb de f1 4b fb cb 4c 94 71 95 63 60 =
b2 f7
> 91 24 c4 6d ca ef 7d c8 13 56 a5 47 d4 b3 fd 0a 0a 18 ad 68 4d
> Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Derived key (MSK) -
> hexdump(len=3D64): f3 93 64 e5 bd 76 78 39 ff c6 b6 8f 85 ad 95 ff 56 =
9e 60
> ae 4e c9 51 c1 8b 55 20 5b 4a 59 ec a9 9e 58 9c d8 63 1c 4a b6 f4 3d =
cb f5
> 6f 07 14 13 ea 91 ff fb 7c b8 52 89 fd fa 5a f9 b5 ff 3f 9e
> Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Derived key (EMSK) -
> hexdump(len=3D64): 9b e4 9d 86 ff c5 f1 fa f0 16 62 11 ca 09 ed d7 39 =
6b c0
> 90 03 22 ac bd d4 6b b9 35 eb 26 5c b9 9f 20 c0 6b f7 a8 ec 5b 7f a7 =
4e 14
> 97 86 95 9e de 9f c4 e5 04 dc 85 dd 96 0f 8d 6e 68 27 30 56
>=20
>=20
>=20
>=20
> 02 82 00 05 01 -> Sending the identity packet without any username for =
the
> client preferring Machine Only Authentication.
>=20
>=20
>=20
> *When challenged by Accept as the changes shown in the diff, client =
accepts
> the connection*
> Debug:   TEAP tunnel data total 6
>  TEAP tunnel data in 00: 80 03 00 02 00 01
> Mon Jun 15 22:14:10 2026 : Debug: (136) eap_teap: Got Tunneled TEAP =
TLVs
> Mon Jun 15 22:14:10 2026 : Debug: (136) eap_teap:
> FreeRADIUS-EAP-TEAP-Result =3D Success
> Mon Jun 15 22:14:10 2026 : Debug: (136)
> eap_S_94de66e8-556a-4d56-8780-a114620a5c42: Sending
>=20
>=20
> If you find this good, I would like to raise a PR. If any changes =
required
> or if it's not the way as expected, will update it accordingly
>=20
> Thanks,
> Suriya
> -
> List info/subscribe/unsubscribe? See =
http://www.freeradius.org/list/users.html


--Apple-Mail=_BD1EB982-A794-41D9-8575-C4EB693B805F
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEIUl02elqcIsf1zM0v3SJ0h7dTTMFAmoxc24ACgkQv3SJ0h7d
TTOcNhAAlfctKTQIx93BuzVLuKmTYzsvBgQGWZMzawJ2tB0AVTK00niaOusVKeBY
LPsAOKJKXdfjsYVPUHcHchS4YO90tyfQEEHToaKug/fM0aVWBM/UUPjfQdVr4zrw
CU5crD/+47zfm/dxzzj41kgysr9wDTqf6GZre2TcEMEEElpRm4jnfEAIPz7Twz2x
444/ZKDhOcadLWxWbkcWCPFFfV/Q6PrU2mIcyIJY09ACYJC7G1b8h8ymTjj/fCvX
5tE1HHlI2UTsDOqVv+Hbhp5SNvff94/5J4i9D+DQSNJyWISB1UfN227Iev5ps5S8
D0b/nC5ZPdutxK/AeVAgIIiYMGxVxkvv7CrkzPxEw7qlaV+718OejixvcfuZIMZ8
IcmJGpzp/94sOKk/7x3JbA9DV4HCWjBLGYtqfoHg0rkq6C/537oCokDM2vkHnMMC
rlooLgvB07EMRNTodoO4OYOTWuIyYMjGDenoS1eargrQerX8R1C61UebLR/In+Po
ocF8LkpdD5eGJqaj20aj3WurcXW58TEzC1hIpBrOaOjvZ5/9G2PWWYkxdMYRRNth
Dn7M7VKkOjT9FIfnTLCAquAJESmOF243ZgXJs2idK/PuS5agxNA9Ep3wzXPB7UMg
LWUpIHniK4elS/aW45sA1dtCDjnYgJxerr3+akq9TOsmWtlJEy0=
=wHH2
-----END PGP SIGNATURE-----

--Apple-Mail=_BD1EB982-A794-41D9-8575-C4EB693B805F--

--===============4193539932160686749==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

--===============4193539932160686749==--