25 Led
2017
25 Led
'17
21:25
Hello Bastien,
The origin of the \x06policy string comes from obsolete policy
configuration detection.
So don't worry about the value. Unfortunately, I don't understand why
the backward compatibility
doesn't work in your case. I guess, you haven't migrated to the new
DNSSEC configuration yet.
I would recommend you to do it now. Just create equivalent policies
configuration as you have
in the policy JSON files (see
https://www.knot-dns.cz/docs/2.4/html/configuration.html#automatic-key-mana…)
and assign them to corresponding zones. The policy item in zone JSON
files is no longer used.
If the migration is not possible now, please send me your configuration
and policy files and I
will deeply analyse the problem.
Regards,
Daniel
On 2017-01-25 15:47, Bastien Durel wrote:
Hello,
I've tried to upgrade from knot 2.3.3 to 2.4.0, but ran into a DNSSEC
related error, invalidating my DNSSEC-enabled zones :
2017-01-25T15:33:42 notice: [geekwu.org.] journal, obsolete exists,
file '/var/lib/knot/external/geekwu.org.db'
2017-01-25T15:33:42 error: [geekwu.org.] DNSSEC, failed to initialize
(not found)
2017-01-25T15:33:42 error: [geekwu.org.] zone event 'load' failed (not
found)
stracing the error leads to this :
[pid 16787]
open("/var/lib/knot/external/keys/policy_\\x06policy.json", O_RDONLY)
= -1 ENOENT (No such file or directory)
I have some policy files in /var/lib/knot/external/keys:
-rw-r--r-- 1 knot knot 320 janv. 26 2016 policy_default.json
-rw-r--r-- 1 knot knot 320 janv. 26 2016 policy_default_rsa.json
-rw-r--r-- 1 knot knot 320 juin 14 2016 policy_ecdsa.json
From where these \\x06policy may come ?
Thanks,