Your message dated Thu, 10 Sep 2026 11:48:53 +0000
with message-id <[email protected]>
and subject line Bug#1147278: fixed in freeradius 3.2.10+dfsg-2
has caused the Debian Bug report #1147278,
regarding freeradius built without PCRE2 support, silently falls back to POSIX
regex (\w etc. broken)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1147278: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147278
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: freeradius
Version: 3.2.7+dfsg-1+deb13u2
Severity: important
Dear Maintainer,
The freeradius binary package for trixie (and confirmed still present
in current unstable/testing, 3.2.10+dfsg-1) is built without PCRE2
support. debian/control for these source versions lists no
libpcre2-dev (nor the deprecated libpcre3-dev) in Build-Depends.
FreeRADIUS's own configure step auto-detects available regex libraries
and silently disables PCRE support if the dev headers aren't present
at build time (documented behavior, not a build failure). As a result
this package falls back to the system's POSIX extended regex
implementation instead of PCRE2.
This is a silent regression with no warning or error at build time,
package install time, or daemon startup. It's only visible via:
freeradius -Xxv | grep -A6 -i regex
Debug: regex-pcre : no
Debug: regex-posix : yes
Debug: regex-posix-extended : yes
Compare against the bookworm build (3.2.1+dfsg-4+deb12u1), which
correctly links PCRE:
Debug: regex-pcre : yes
Debug: regex-posix : no
Debug: regex-posix-extended : no
Impact: POSIX ERE does not support Perl-style character classes
(\w, \d, \W, \s, etc.) used ubiquitously in real-world FreeRADIUS
unlang policy files. Any site-configured unlang regex relying on
these classes silently fails to match, with no indication why. In
our case this broke identity/realm-stripping logic used to route
EAP/MAB/hostname authentication to the correct backend, causing
legitimate devices to fall through to a guest/fallback VLAN.
Steps to reproduce:
1. Install freeradius on trixie (apt install freeradius).
2. Add a policy rule using a \w-class regex, e.g.:
if ("%{request:User-Name}" =~ /^host\/([\w\-]+)\.(.+)$/) { ... }
3. Run freeradius -X and send an Access-Request with a matching
User-Name.
4. Observe the condition evaluates FALSE even though the string
visibly matches the pattern.
5. Confirm with freeradius -Xxv | grep -A6 -i regex as above.
Suggested fix: add libpcre2-dev to Build-Depends in debian/control.
Confirmed the same gap persists in 3.2.10+dfsg-1 (current
unstable/testing) via the .dsc Build-Depends field directly, so this
is not a stable-only regression needing only a deb13u backport — it
needs fixing at the source-package level so it doesn't ride forward
into the next stable release as well.
Workaround in use: pinning to the bookworm build
(3.2.1+dfsg-4+deb12u1) via apt preferences, which was correctly
linked against PCRE.
-- System Information:
Debian Release: 13.6
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.107+deb13-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages freeradius depends on:
ii freeradius-common 3.2.7+dfsg-1+deb13u2
ii freeradius-config 3.2.7+dfsg-1+deb13u2
ii libc6 2.41-12+deb13u3
ii libcrypt1 1:4.4.38-1
ii libct4 1.3.17+ds-2+deb13u1
ii libfreeradius3 3.2.7+dfsg-1+deb13u2
ii libgdbm6t64 1.24-2
ii libjson-c5 0.18+ds-1
ii libpam0g 1.7.0-5
ii libperl5.40 5.40.1-6
ii libreadline8t64 8.2-6
ii libsqlite3-0 3.46.1-7+deb13u1
ii libssl3t64 3.5.7-1~deb13u2
ii libsystemd0 257.13-1~deb13u1
ii libtalloc2 2:2.4.3+samba4.22.10+dfsg-0+deb13u2
ii libwbclient0 2:4.22.10+dfsg-0+deb13u2
ii perl 5.40.1-6
Versions of packages freeradius recommends:
ii freeradius-utils 3.2.7+dfsg-1+deb13u2
Versions of packages freeradius suggests:
ii freeradius-krb5 3.2.7+dfsg-1+deb13u2
ii freeradius-ldap 3.2.7+dfsg-1+deb13u2
ii freeradius-mysql 3.2.7+dfsg-1+deb13u2
ii freeradius-postgresql 3.2.7+dfsg-1+deb13u2
pn freeradius-python3 <none>
pn snmp <none>
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: freeradius
Source-Version: 3.2.10+dfsg-2
Done: Bernhard Schmidt <[email protected]>
We believe that the bug you reported is fixed in the latest version of
freeradius, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bernhard Schmidt <[email protected]> (supplier of updated freeradius package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 10 Sep 2026 12:10:38 +0200
Source: freeradius
Architecture: source
Version: 3.2.10+dfsg-2
Distribution: unstable
Urgency: medium
Maintainer: Debian FreeRADIUS Packaging Team
<[email protected]>
Changed-By: Bernhard Schmidt <[email protected]>
Closes: 1147278
Changes:
freeradius (3.2.10+dfsg-2) unstable; urgency=medium
.
* Re-enable PCRE support (add build-dep libpcre2-dev) (Closes: #1147278)
Checksums-Sha1:
d1c875a06d823b513527d54b41676c50c7dc9bf5 3630 freeradius_3.2.10+dfsg-2.dsc
8e3becb57e4e1662ebf3da09d1cd48b4a1d92b50 62372
freeradius_3.2.10+dfsg-2.debian.tar.xz
4c21b132ab8d9fefe263f784157ac2b2a342d571 19542
freeradius_3.2.10+dfsg-2_amd64.buildinfo
Checksums-Sha256:
44970f7e84c6a675814e93990bf2cb333e2dc93914542cb0d5e716fbc307649a 3630
freeradius_3.2.10+dfsg-2.dsc
4ec6e9c9e1ff04a7d0c45da981cb1d97c4ec3abe2a67f3e5738aab66985b90e0 62372
freeradius_3.2.10+dfsg-2.debian.tar.xz
d199bb70ddb80f0f3110792958ced69915ed88dfda73af511bbde8c5d76f331b 19542
freeradius_3.2.10+dfsg-2_amd64.buildinfo
Files:
dc07a4ccf5234e10b0a781c74d534f26 3630 net optional freeradius_3.2.10+dfsg-2.dsc
5f7883c984c7b72a623a65a1c5d19f74 62372 net optional
freeradius_3.2.10+dfsg-2.debian.tar.xz
9ab3ddd4eb5962c6d06d74af6c0bbd99 19542 net optional
freeradius_3.2.10+dfsg-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEE1uAexRal3873GVbTd1B55bhQvJMFAmqik40RHGJlcm5pQGRl
Ymlhbi5vcmcACgkQd1B55bhQvJM8KhAAgkfq2NBkjPtjWKvBsQWd6kxYdHtDjtqv
MtJf8kuPBr/ihLI2O11oCEzaxiUf80qz6+KAE8Ykky+p51yZtd7neYA1Fcx+ZQW9
2UBSpVpFUkxlkOSWPI8mZ7B4YHaaDQiV/f9eGkAiLCi0hNjVxcBqwwiPiKOczOAo
ncefcrSjvVmFfyk5BJrz+G8vzTgMawlPiHQRav5ytDwxAnDqTH3Yu2Bo749eCojj
5njwlNXaRnCrhjtJeTiij2I4Mdt4qovLQSz56zoQ7FqT8httguqMtCKYQrMbD2br
UrUwbk3aGuNECh73Crk80K8JaBGbgNtHspGfsziJqBs1dhli0q4WYYyCRwPUtb5l
pMCfFi0pqLPAzWXK3feL5eME376ZQdhORpY2zEtodroy+Evs+I6IKziREbdI/Fjt
eNnzhjqSw/4Y6ZwE7ZS8ocESHQqIsPBfbHJLmJfgfp+xVkqkyqRh/VlXISaT0lCi
NWJuHZZs+Qo+y8e/Pm3R2XFlNa8lUiPEj5T2ZmlRyAzCnoC1WUwc91R2q7eeTGXZ
yKOuiWS2QAoOOJU/6F6wWDCjGnVXCc2RWWGWvB3gbLxCpHiqXPHaBMMRpwM06ls1
KyriLN1xLMzHL2+hQ6BEA3ZyXgIcEWS5ahS89J1ZtMyfgfTownbdDaDKidtDsMDp
ZPwBqxZ8ov4=
=9uZw
-----END PGP SIGNATURE-----
pgpAxZr9zpPnl.pgp
Description: PGP signature
--- End Message ---
