freeipa

#9877 Unbound fails to start on Fedora 43 due to ngtcp2 DoQ crypto policy restriction during FreeIPA DoT setup
Opened by pthube. Modified

Open
Close Issue

Issue

On Fedora 43, FreeIPA installation fails when Unbound is restarted during the DNS-over-TLS (DoT) configuration phase.
Unbound immediately crashes with:

error: ngtcp2_crypto_oss_init failed
fatal error: could not create doq_table: out of memory

This happens even though FreeIPA is not using DNS-over-QUIC (DoQ).
The failure appears to be triggered by ngtcp2 QUIC crypto initialization failing under the Fedora 43 system crypto policy.

This issue does not occur on Fedora 42, only Fedora 43 with the newer Unbound (1.24.1) + ngtcp2 crypto integration.

Based on upstream discussion, the QUIC crypto backend uses ciphers that are disallowed by Fedora 43’s crypto policy, causing ngtcp2_crypto_oss_init() to fail and Unbound to abort.

Steps to Reproduce

Install Ipa-server with DoT enabled with relaxed policy on f43.

Actual behavior

Unbound fails during startup:
unbound[56268]: error: ngtcp2_crypto_oss_init failed
unbound[56268]: fatal error: could not create doq_table: out of memory
systemd: unbound.service: Main process exited, status=1/FAILURE

FreeIPA installer aborts:
CalledProcessError: systemctl restart unbound.service failed

Unbound can never start unless QUIC initialization is disabled in its configuration or the crypto policy allows the required ciphers.

Expected behavior

Unbound should start normally when DoT is configured.
DoQ/QUIC initialization should not break DoT when QUIC is not enabled.
IPA-Server installation should complete successfully on Fedora 43.

Version/Release/Distribution

freeipa-server-4.13.0.dev202511130555+gite0b9ad0ae-0.fc43.x86_64
freeipa-server-encrypted-dns-4.13.0.dev202511130555+gite0b9ad0ae-0.fc43.x86_64
unbound-1.24.1-1.fc43.x86_64
unbound-anchor-1.24.1-1.fc43.x86_64

Additional info:

Unbound startup failure:
unbound-checkconf: no errors in /etc/unbound/unbound.conf
error: ngtcp2_crypto_oss_init failed
fatal error: could not create doq_table: out of memory

Ipa-server-install-logs:
/usr/lib/python3.14/site-packages/ipaserver/install/dns.py:196 in _setup_dns_over_tls
systemctl restart unbound.service → exit 1

ngtcp2_crypto_oss_init() fails because some QUIC ciphers are blocked by Fedora’s system crypto policy (FIPS/DEFAULT).

Metadata Update from @frenaud:
- Issue tagged with: test-failure

Failed Testcases: test_integration/test_edns.py::TestDNS_DoT::test_check_dot_forwarder_added_in_ipa_conf::setup
test_integration/test_edns.py::TestDNS_DoT::test_check_dot_forwarder_added_in_ipa_conf::setup
test_integration/test_edns.py::TestDNS_DoT::test_check_dot_forwarder_added_in_ipa_conf::teardown
test_integration/test_edns.py::TestDNSOverTLS_RelaxedPolicy::test_dot_relaxed_dns_policy_with_IPA_CA
test_integration/test_edns.py::TestDNSOverTLS_RelaxedPolicy::test_uninstall_all
test_integration/test_edns.py::TestDNSOverTLS_RelaxedPolicy::test_dot_relaxed_dns_policy_with_external_ca

I have created simple test for unbound: https://gitlab.com/redhat/centos-stream/tests/unbound/-/merge_requests/18

Basic TLS forwarding seems to work both on rawhide and f43. Pure unbound does not seem to be affected. It might be something else required. Does IPA client install change crypto policy to something specific?

Oh, your failure happens because crypto policy FIPS is used. It fails to locate EVP_CIPHER ChaCha20-Poly1305 and terminates it.

Created unbound upstream PR: https://github.com/NLnetLabs/unbound/pull/1381

I have tested it on broken installation. It seems it helps even on proper FIPS mode:
https://src.fedoraproject.org/rpms/unbound/pull-request/30
Metadata
None

test-failure

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.