Dear Maintainer,

The freeradius binary package for trixie (and confirmed still present
in current unstable/testing, 3.2.10+dfsg-1) is built without PCRE2
support. debian/control for these source versions lists no
libpcre2-dev (nor the deprecated libpcre3-dev) in Build-Depends.

FreeRADIUS's own configure step auto-detects available regex libraries
and silently disables PCRE support if the dev headers aren't present
at build time (documented behavior, not a build failure). As a result
this package falls back to the system's POSIX extended regex
implementation instead of PCRE2.

This is a silent regression with no warning or error at build time,
package install time, or daemon startup. It's only visible via:

  freeradius -Xxv | grep -A6 -i regex

  Debug:   regex-pcre                : no
  Debug:   regex-posix               : yes
  Debug:   regex-posix-extended      : yes

Compare against the bookworm build (3.2.1+dfsg-4+deb12u1), which
correctly links PCRE:

  Debug:   regex-pcre                : yes
  Debug:   regex-posix               : no
  Debug:   regex-posix-extended      : no

Impact: POSIX ERE does not support Perl-style character classes
(\w, \d, \W, \s, etc.) used ubiquitously in real-world FreeRADIUS
unlang policy files. Any site-configured unlang regex relying on
these classes silently fails to match, with no indication why. In
our case this broke identity/realm-stripping logic used to route
EAP/MAB/hostname authentication to the correct backend, causing
legitimate devices to fall through to a guest/fallback VLAN.

Steps to reproduce:

  1. Install freeradius on trixie (apt install freeradius).
  2. Add a policy rule using a \w-class regex, e.g.:
       if ("%{request:User-Name}" =~ /^host\/([\w\-]+)\.(.+)$/) { ... }
  3. Run freeradius -X and send an Access-Request with a matching
     User-Name.
  4. Observe the condition evaluates FALSE even though the string
     visibly matches the pattern.
  5. Confirm with freeradius -Xxv | grep -A6 -i regex as above.

Suggested fix: add libpcre2-dev to Build-Depends in debian/control.
Confirmed the same gap persists in 3.2.10+dfsg-1 (current
unstable/testing) via the .dsc Build-Depends field directly, so this
is not a stable-only regression needing only a deb13u backport — it
needs fixing at the source-package level so it doesn't ride forward
into the next stable release as well.

Workaround in use: pinning to the bookworm build
(3.2.1+dfsg-4+deb12u1) via apt preferences, which was correctly
linked against PCRE.

Hi,

thanks for the report.

Right, pcre3 was dropped due to

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1000031

That bug is linked against

https://github.com/FreeRADIUS/freeradius-server/issues/2315

which is closed and states that "We're not going to add pcre2 support
for v3". So yes, PCRE support was dropped from FreeRADIUS completely.

It looks like upstream has changed their mind though, there is a commit
from 2025 that adds pcre2.

https://github.com/FreeRADIUS/freeradius-server/commit/430ed115ca58b0b99f6ea372d4e32b573aa5d0fd

That has been included in FreeRADIUS 3.2.8

I will test and enable it with the next upload.

It will be. However, there will be no backport of that to Trixie. It's a
new build dependency, it might alter behaviour with a stable update (as
you demonstrated, just the other way around) and it needs a large patch
(+800 lines, and there are quite a few more in FreeRADIUS upstream that
touch that code, I'm not going to backport all of them.

I'm considering a trixie-backports upload though.

Bernhard

We believe that the bug you reported is fixed in the latest version of
freeradius, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1147278@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bernhard Schmidt <berni@debian.org> (supplier of updated freeradius package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 10 Sep 2026 12:10:38 +0200
Source: freeradius
Architecture: source
Version: 3.2.10+dfsg-2
Distribution: unstable
Urgency: medium
Maintainer: Debian FreeRADIUS Packaging Team <pkg-freeradius-maintainers@lists.alioth.debian.org>
Changed-By: Bernhard Schmidt <berni@debian.org>
Closes: 1147278
Changes:
 freeradius (3.2.10+dfsg-2) unstable; urgency=medium
 .
   * Re-enable PCRE support (add build-dep libpcre2-dev) (Closes: #1147278)
Checksums-Sha1:
 d1c875a06d823b513527d54b41676c50c7dc9bf5 3630 freeradius_3.2.10+dfsg-2.dsc
 8e3becb57e4e1662ebf3da09d1cd48b4a1d92b50 62372 freeradius_3.2.10+dfsg-2.debian.tar.xz
 4c21b132ab8d9fefe263f784157ac2b2a342d571 19542 freeradius_3.2.10+dfsg-2_amd64.buildinfo
Checksums-Sha256:
 44970f7e84c6a675814e93990bf2cb333e2dc93914542cb0d5e716fbc307649a 3630 freeradius_3.2.10+dfsg-2.dsc
 4ec6e9c9e1ff04a7d0c45da981cb1d97c4ec3abe2a67f3e5738aab66985b90e0 62372 freeradius_3.2.10+dfsg-2.debian.tar.xz
 d199bb70ddb80f0f3110792958ced69915ed88dfda73af511bbde8c5d76f331b 19542 freeradius_3.2.10+dfsg-2_amd64.buildinfo
Files:
 dc07a4ccf5234e10b0a781c74d534f26 3630 net optional freeradius_3.2.10+dfsg-2.dsc
 5f7883c984c7b72a623a65a1c5d19f74 62372 net optional freeradius_3.2.10+dfsg-2.debian.tar.xz
 9ab3ddd4eb5962c6d06d74af6c0bbd99 19542 net optional freeradius_3.2.10+dfsg-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEE1uAexRal3873GVbTd1B55bhQvJMFAmqik40RHGJlcm5pQGRl
Ymlhbi5vcmcACgkQd1B55bhQvJM8KhAAgkfq2NBkjPtjWKvBsQWd6kxYdHtDjtqv
MtJf8kuPBr/ihLI2O11oCEzaxiUf80qz6+KAE8Ykky+p51yZtd7neYA1Fcx+ZQW9
2UBSpVpFUkxlkOSWPI8mZ7B4YHaaDQiV/f9eGkAiLCi0hNjVxcBqwwiPiKOczOAo
ncefcrSjvVmFfyk5BJrz+G8vzTgMawlPiHQRav5ytDwxAnDqTH3Yu2Bo749eCojj
5njwlNXaRnCrhjtJeTiij2I4Mdt4qovLQSz56zoQ7FqT8httguqMtCKYQrMbD2br
UrUwbk3aGuNECh73Crk80K8JaBGbgNtHspGfsziJqBs1dhli0q4WYYyCRwPUtb5l
pMCfFi0pqLPAzWXK3feL5eME376ZQdhORpY2zEtodroy+Evs+I6IKziREbdI/Fjt
eNnzhjqSw/4Y6ZwE7ZS8ocESHQqIsPBfbHJLmJfgfp+xVkqkyqRh/VlXISaT0lCi
NWJuHZZs+Qo+y8e/Pm3R2XFlNa8lUiPEj5T2ZmlRyAzCnoC1WUwc91R2q7eeTGXZ
yKOuiWS2QAoOOJU/6F6wWDCjGnVXCc2RWWGWvB3gbLxCpHiqXPHaBMMRpwM06ls1
KyriLN1xLMzHL2+hQ6BEA3ZyXgIcEWS5ahS89J1ZtMyfgfTownbdDaDKidtDsMDp
ZPwBqxZ8ov4=
=9uZw
-----END PGP SIGNATURE-----