net/freeradius: Some Cleartext-Password values containing % fail PAP authentication

[fgrueau]

Environment

• OPNsense 26.1.x
• FreeRADIUS plugin
• Authentication method: PAP
• Password type: Cleartext-Password
• Users configured through the OPNsense FreeRADIUS plugin

Problem

Some passwords containing % followed by specific characters are accepted by the OPNsense FreeRADIUS user configuration and are correctly written to the generated authorize file, but authentication fails.

FreeRADIUS reports:

Login incorrect (pap: Cleartext password does not match "known good" password)

The password entered by the client is identical to the password configured in OPNsense.

Steps to reproduce

1. Create a FreeRADIUS user in OPNsense.
2. Set Password Encryption to Cleartext-Password.
3. Use the following password:

AA%cAAAA

4. Apply the FreeRADIUS configuration.
5. Verify the generated configuration:

grep 'user@example.com' /usr/local/etc/raddb/mods-config/files/authorize

The resulting entry is correct, for example:

user@example.com Cleartext-Password := "AA%cAAAA", Simultaneous-Use := "3"

6. Try to authenticate the user using PAP.

Authentication fails with:

Login incorrect (pap: Cleartext password does not match "known good" password)

Reproducible test results

The following passwords fail:

AA%cAAAA    FAIL
AA%dAAAA    FAIL
AA%eAAAA    FAIL

The following passwords authenticate successfully:

AA%aAAAA    OK
AA%bAAAA    OK
AA%fAAAA    OK
AA%iAAAA    OK
AA%oAAAA    OK
AA%pAAAA    OK
AA%sAAAA    OK
AA%uAAAA    OK
AA%xAAAA    OK
AA%1AAAA    OK
AA%$AAAA    OK

A real randomly generated password containing %c also exhibited the issue:

WX%ci$9k    FAIL

Other randomly generated passwords containing % but not one of the problematic sequences authenticate successfully.

Expected behavior

Any password accepted as valid by the OPNsense FreeRADIUS user model and written unchanged as a Cleartext-Password should authenticate successfully with PAP.

Actual behavior

Certain sequences beginning with %, reproducibly %c, %d and %e, cause PAP authentication to fail even though the generated authorize entry contains the expected password.

The FreeRADIUS log reports a mismatch between the supplied password and the "known good" cleartext password.

Additional information

The issue does not appear to affect % characters in general. It depends on the character following %.

As a workaround, I have removed % from the character set used by my password generator.

This may be related to interpretation/expansion of some % sequences somewhere between the generated FreeRADIUS configuration and PAP password comparison.

[OPNsense-bot]

Thank you for creating an issue.
Since the ticket doesn't seem to be using one of our templates, we're marking this issue as low priority until further notice.

For more information about the policies for this repository,
please read https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md for further details.

The easiest option to gain traction is to close this ticket and open a new one using one of our templates.