Bug 2416728

Summary:	Unbound fails to start in FIPS mode on Fedora 43 due to unconditional QUIC (DoQ) crypto initialization (ngtcp2_crypto_ossl_init failure)
Product:	[Fedora] Fedora	Reporter:	Pranav Thube <pthube>
Component:	unbound	Assignee:	Petr Menšík <pemensik>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	43	CC:	dns-sig, minfrin, paul.wouters, pemensik, pj.pandit, tkorbar
Target Milestone:	---	Flags:	pemensik: mirror+
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	unbound-1.24.1-5.fc44 unbound-1.24.2-1.fc43	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-11-24 16:25:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2404703
Bug Blocks:

Description Pranav Thube 2025-11-24 11:15:23 UTC

On Fedora 43, Unbound (unbound-1.24.x) fails to start when running under FIPS crypto policy because QUIC/DoQ crypto initialization (ngtcp2_crypto_ossl_init()) fails. This prevents FreeIPA installation from completing, as FreeIPA attempts to restart Unbound during DNS-over-TLS (DoT) configuration.

Unbound initializes the QUIC (DoQ) backend even when DoQ is not enabled in the configuration.
Under FIPS or DEFAULT-FIPS crypto policy, the ChaCha20-Poly1305 cipher is disallowed, causing ngtcp2_crypto_ossl_init() to fail and Unbound to abort.

This issue does not occur in Fedora 42 (Unbound 1.22.x) where QUIC support was not integrated.





Reproducible: Always

Steps to Reproduce:
Use Fedora 43 with FIPS or DEFAULT-FIPS system crypto policy.
1. Install Unbound 1.24.x.

2.Start or restart Unbound:
systemctl restart unbound

OR run FreeIPA installation with DoT which triggers:
systemctl restart unbound.service

Observe service failure.
Actual Results:
Unbound crashes during startup:

error: ngtcp2_crypto_ossl_init failed
fatal error: could not create doq_table: out of memory
unbound.service: Main process exited, status=1/FAILURE

Expected Results:
Unbound should start successfully under FIPS crypto policy.

QUIC/DoQ crypto (ngtcp2) should not be initialized unless DoQ is explicitly enabled in the configuration.

A crypto policy failure should not abort the service when QUIC is unused.

Comment 1 Petr Menšík 2025-11-24 13:43:02 UTC

Created proposal at: https://github.com/NLnetLabs/unbound/pull/1381

This does not seem to be reproducible by just setting FIPS policy. It seems enforcement by kernel fips=1 parameter should happen.

Comment 2 Fedora Update System 2025-11-24 15:34:00 UTC

FEDORA-2025-742ec282bf (unbound-1.24.1-5.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-742ec282bf

Comment 3 Fedora Update System 2025-11-24 15:35:27 UTC

FEDORA-2025-f5f66984a9 (unbound-1.24.1-5.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-f5f66984a9

Comment 4 Fedora Update System 2025-11-24 16:25:15 UTC

FEDORA-2025-742ec282bf (unbound-1.24.1-5.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 5 Petr Menšík 2025-11-24 19:36:26 UTC

In addition, this problem is fixed also in new ngtcp2 version. That does not fail anymore on crypto failures. Bug #2404703.

Comment 6 Fedora Update System 2025-11-25 01:59:57 UTC

FEDORA-2025-f5f66984a9 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-f5f66984a9`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-f5f66984a9

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2025-11-27 01:37:29 UTC

FEDORA-2025-90281e4554 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-90281e4554`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-90281e4554

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2025-11-29 16:48:34 UTC

FEDORA-2025-90281e4554 (unbound-1.24.2-1.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.