[defect]: can't set Attr-26 in post-auth

[d1nuc0m]

What type of defect/bug is this?

Unexpected behaviour (obvious or verified by project member)

How can the issue be reproduced?

Disclaimer - I already asked on the mailing list (see all the thread). Now I made a proper test on Rocky Linux 9 with upstream packages.

I am trying to append an Attr-26 upon successful user authentication (because of old Supermicro BMCs).
Every attempt results in a different error.

Attempt 1

/etc/raddb/sites-available/default

(...)
post-auth {
     update {
         reply:Attr-26 := "1A1200002A7C483D342C20493D34"
     }
(...)
}

Attempt 2

/etc/raddb/sites-available/default

(...)
post-auth {
     update {
         reply:Attr-26 := "0x483D342C20493D34"
         # Also tried 0x483D342C20493D34 without quotes, 0x1A1200002A7C483D342C20493D34 with and without quotes
     }
(...)
}

Attempt 3

/etc/raddb/dictionary

VENDOR  SUPERMICRO      10876   format=1,0
 
BEGIN-VENDOR    SUPERMICRO
ATTRIBUTE       Foo     72      octets
END-VENDOR      SUPERMICRO

Same results as above. It "works" using Attr-26.10876.72 := 0x3D342C20493D34, but the answer differs from the one when using a user in the users file.

with post auth

(0) # Executing section post-auth from file /etc/raddb/sites-enabled/default
(0)   post-auth {
(0)     update {
(0)       reply::Foo := 0x483d342c20493d34
(0)     } # update = noop
(0)     if (session-state:User-Name && reply:User-Name && 
request:User-Name && (reply:User-Name == request:User-Name)) {
(0)     if (session-state:User-Name && reply:User-Name && 
request:User-Name && (reply:User-Name == request:User-Name))  -> FALSE
(0)     update {
(0)       No attributes updated for RHS &session-state:
(0)     } # update = noop
(0)   } # post-auth = noop
(0) Sent Access-Accept Id 0 from XXX:1812 to XXX:59903 length 53
(0)   Foo := 0x483d342c20493d34

with users file

(0) # Executing section post-auth from file /etc/raddb/sites-enabled/default
(0)   post-auth {
(0)     if (session-state:User-Name && reply:User-Name && 
request:User-Name && (reply:User-Name == request:User-Name)) {
(0)     if (session-state:User-Name && reply:User-Name && 
request:User-Name && (reply:User-Name == request:User-Name))  -> FALSE
(0)     update {
(0)       No attributes updated for RHS &session-state:
(0)     } # update = noop
(0)     [exec] = noop
(0)     policy remove_reply_message_if_eap {
(0)       if (&reply:EAP-Message && &reply:Reply-Message) {
(0)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(0)       else {
(0)         [noop] = noop
(0)       } # else = noop
(0)     } # policy remove_reply_message_if_eap = noop
(0)     if (EAP-Key-Name && &reply:EAP-Session-Id) {
(0)     if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE
(0)   } # post-auth = noop
(0) Sent Access-Accept Id 0 from XXX:1812 to XXX:58921 length 48
(0)   Attr-26 = 0x483d342c20493d34

The BMC treats them differently.

Log output from the FreeRADIUS daemon

Attempt 1

Even if I'm explicitly using Attr-26 instead of Vendor-Specific (deprecated)

 # Loading preacct {...}
 # Loading accounting {...}
 # Loading post-auth {...}
/etc/raddb/sites-enabled/default[786]: Must use 'Attr-26 = ...' instead of 'Vendor-Specific = ...'
/etc/raddb/sites-enabled/default[784]: Errors parsing post-auth section.

Attempt 2

 # Loading accounting {...}
 # Loading post-auth {...}
/etc/raddb/sites-enabled/default[786]: Cannot parse RHS hex as the data type of the attribute Vendor-Specific
/etc/raddb/sites-enabled/default[784]: Errors parsing post-auth section.

Relevant log output from client utilities

No response

Backtrace from LLDB or GDB