net/freeradius: Some Cleartext-Password values containing % fail PAP authentication

Environment

• OPNsense 26.1.x
• FreeRADIUS plugin
• Authentication method: PAP
• Password type: Cleartext-Password
• Users configured through the OPNsense FreeRADIUS plugin

Problem

Some passwords containing % followed by specific characters are accepted by the OPNsense FreeRADIUS user configuration and are correctly written to the generated authorize file, but authentication fails.

FreeRADIUS reports:

Login incorrect (pap: Cleartext password does not match "known good" password)

The password entered by the client is identical to the password configured in OPNsense.

Steps to reproduce

1. Create a FreeRADIUS user in OPNsense.
2. Set Password Encryption to Cleartext-Password.
3. Use the following password:

AA%cAAAA

4. Apply the FreeRADIUS configuration.
5. Verify the generated configuration:

grep 'user@example.com' /usr/local/etc/raddb/mods-config/files/authorize

The resulting entry is correct, for example:

user@example.com Cleartext-Password := "AA%cAAAA", Simultaneous-Use := "3"

6. Try to authenticate the user using PAP.

Authentication fails with:

Login incorrect (pap: Cleartext password does not match "known good" password)

Reproducible test results

The following passwords fail:

AA%cAAAA    FAIL
AA%dAAAA    FAIL
AA%eAAAA    FAIL

The following passwords authenticate successfully:

AA%aAAAA    OK
AA%bAAAA    OK
AA%fAAAA    OK
AA%iAAAA    OK
AA%oAAAA    OK
AA%pAAAA    OK
AA%sAAAA    OK
AA%uAAAA    OK
AA%xAAAA    OK
AA%1AAAA    OK
AA%$AAAA    OK

A real randomly generated password containing %c also exhibited the issue:

WX%ci$9k    FAIL

Other randomly generated passwords containing % but not one of the problematic sequences authenticate successfully.

Expected behavior

Any password accepted as valid by the OPNsense FreeRADIUS user model and written unchanged as a Cleartext-Password should authenticate successfully with PAP.

Actual behavior

Certain sequences beginning with %, reproducibly %c, %d and %e, cause PAP authentication to fail even though the generated authorize entry contains the expected password.

The FreeRADIUS log reports a mismatch between the supplied password and the "known good" cleartext password.

Additional information

The issue does not appear to affect % characters in general. It depends on the character following %.

As a workaround, I have removed % from the character set used by my password generator.

This may be related to interpretation/expansion of some % sequences somewhere between the generated FreeRADIUS configuration and PAP password comparison.

Start by tracing the OPNsense FreeRADIUS plugin code that generates /usr/local/etc/raddb/mods-config/files/authorize, then reproduce the PAP failure with the listed passwords, especially AA%cAAAA, AA%dAAAA, and AA%eAAAA. Determine where these percent sequences are interpreted and verify the fix by confirming that valid Cleartext-Password values authenticate unchanged while the generated authorize entry remains correct.