Bug 2416728 - Unbound fails to start in FIPS mode on Fedora 43 due to unconditional QUIC (DoQ) crypto initialization (ngtcp2_crypto_ossl_init failure)
Summary: Unbound fails to start in FIPS mode on Fedora 43 due to unconditional QUIC (D...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: unbound
Version: 43
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Petr Menšík
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On: 2404703
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-11-24 11:15 UTC by Pranav Thube
Modified: 2025-12-12 04:09 UTC (History)
6 users (show)

Fixed In Version: unbound-1.24.1-5.fc44 unbound-1.24.2-1.fc43
Clone Of:
Environment:
Last Closed: 2025-11-24 16:25:15 UTC
Type: ---
Embargoed:
pemensik: mirror+


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Fedora Package Sources unbound pull-request 30 0 None None None 2025-11-24 13:59:08 UTC
Github NLnetLabs unbound pull 1381 0 None open Do not initialize quic_table unless it is enabled 2025-11-24 13:43:02 UTC
Github ngtcp2 ngtcp2 pull 1898 0 None Merged crypto/ossl: Exclude chacha-poly if openssl disables it 2025-11-24 16:16:39 UTC
Gitlab redhat/centos-stream/tests unbound merge_requests 20 0 None opened More checks with crypto-policy 2025-11-24 14:58:32 UTC
Red Hat Issue Tracker FC-2700 0 None None None 2025-12-12 04:09:32 UTC

Description Pranav Thube 2025-11-24 11:15:23 UTC
On Fedora 43, Unbound (unbound-1.24.x) fails to start when running under FIPS crypto policy because QUIC/DoQ crypto initialization (ngtcp2_crypto_ossl_init()) fails. This prevents FreeIPA installation from completing, as FreeIPA attempts to restart Unbound during DNS-over-TLS (DoT) configuration.

Unbound initializes the QUIC (DoQ) backend even when DoQ is not enabled in the configuration.
Under FIPS or DEFAULT-FIPS crypto policy, the ChaCha20-Poly1305 cipher is disallowed, causing ngtcp2_crypto_ossl_init() to fail and Unbound to abort.

This issue does not occur in Fedora 42 (Unbound 1.22.x) where QUIC support was not integrated.





Reproducible: Always

Steps to Reproduce:
Use Fedora 43 with FIPS or DEFAULT-FIPS system crypto policy.
1. Install Unbound 1.24.x.

2.Start or restart Unbound:
systemctl restart unbound

OR run FreeIPA installation with DoT which triggers:
systemctl restart unbound.service

Observe service failure.
Actual Results:
Unbound crashes during startup:

error: ngtcp2_crypto_ossl_init failed
fatal error: could not create doq_table: out of memory
unbound.service: Main process exited, status=1/FAILURE

Expected Results:
Unbound should start successfully under FIPS crypto policy.

QUIC/DoQ crypto (ngtcp2) should not be initialized unless DoQ is explicitly enabled in the configuration.

A crypto policy failure should not abort the service when QUIC is unused.

Comment 1 Petr Menšík 2025-11-24 13:43:02 UTC
Created proposal at: https://github.com/NLnetLabs/unbound/pull/1381

This does not seem to be reproducible by just setting FIPS policy. It seems enforcement by kernel fips=1 parameter should happen.

Comment 2 Fedora Update System 2025-11-24 15:34:00 UTC
FEDORA-2025-742ec282bf (unbound-1.24.1-5.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-742ec282bf

Comment 3 Fedora Update System 2025-11-24 15:35:27 UTC
FEDORA-2025-f5f66984a9 (unbound-1.24.1-5.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-f5f66984a9

Comment 4 Fedora Update System 2025-11-24 16:25:15 UTC
FEDORA-2025-742ec282bf (unbound-1.24.1-5.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 5 Petr Menšík 2025-11-24 19:36:26 UTC
In addition, this problem is fixed also in new ngtcp2 version. That does not fail anymore on crypto failures. Bug #2404703.

Comment 6 Fedora Update System 2025-11-25 01:59:57 UTC
FEDORA-2025-f5f66984a9 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-f5f66984a9`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-f5f66984a9

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2025-11-27 01:37:29 UTC
FEDORA-2025-90281e4554 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-90281e4554`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-90281e4554

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2025-11-29 16:48:34 UTC
FEDORA-2025-90281e4554 (unbound-1.24.2-1.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.