[GH-ISSUE #212] [Server] Can't sign while recovering from journal because keys are not loaded at this point #98

New issue

Closed

opened 2026-03-07 22:18:49 +03:00 by kerem · 1 comment

kerem commented

2026-03-07 22:18:49 +03:00

Owner

Originally created by @Darkspirit on GitHub (Sep 27, 2017).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/212

Seen in https://github.com/bluejekyll/trust-dns/issues/209#issuecomment-332607425
This also happens when signing works. (the RSASHA256 case)

On the second run (recovering from journal) we get:
"attempt to sign_zone for dnssec, but no keys available!"
this is because of the following sequence:

fn load_zone

Recover from journal (and sign the zone at the end)
https://github.com/bluejekyll/trust-dns/blob/master/server/src/named.rs#L147
try!(authority.recover_with_journal(

https://github.com/bluejekyll/trust-dns/blob/master/server/src/authority/authority.rs#L141
fn recover_with_journal contains:
self.sign_zone()

https://github.com/bluejekyll/trust-dns/blob/master/server/src/authority/authority.rs#L1130
fn sign_zone contains:
if self.secure_keys.is_empty() {
warn!("attempt to sign_zone for dnssec, but no keys available!")

Afterwards load the keys for signing
https://github.com/bluejekyll/trust-dns/blob/master/server/src/named.rs#L230
authority.add_secure_key(

https://github.com/bluejekyll/trust-dns/blob/master/server/src/authority/authority.rs#L106
fn add_secure_key contains:
self.secure_keys.push(signer);

Because of the following line, this might be only a "cosmetic" bug:
https://github.com/bluejekyll/trust-dns/blob/master/server/src/named.rs#L236
authority.secure_zone()

Originally created by @Darkspirit on GitHub (Sep 27, 2017). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/212 * Seen in https://github.com/bluejekyll/trust-dns/issues/209#issuecomment-332607425 * This also happens when signing works. (the RSASHA256 case) On the second run (recovering from journal) we get: "attempt to sign_zone for dnssec, but no keys available!" this is because of the following sequence: fn load_zone > **Recover from journal (and sign the zone at the end)** > https://github.com/bluejekyll/trust-dns/blob/master/server/src/named.rs#L147 > try!(authority.recover_with_journal( > > > https://github.com/bluejekyll/trust-dns/blob/master/server/src/authority/authority.rs#L141 > > fn recover_with_journal contains: > > self.sign_zone() > > > > > > https://github.com/bluejekyll/trust-dns/blob/master/server/src/authority/authority.rs#L1130 > > > fn sign_zone contains: > > > if self.secure_keys.is_empty() { > > > warn!("attempt to sign_zone for dnssec, but no keys available!") > > **Afterwards load the keys for signing** > https://github.com/bluejekyll/trust-dns/blob/master/server/src/named.rs#L230 > authority.add_secure_key( > > > > https://github.com/bluejekyll/trust-dns/blob/master/server/src/authority/authority.rs#L106 > > fn add_secure_key contains: > > self.secure_keys.push(signer); > > **Because of the following line, this might be only a "cosmetic" bug:** > https://github.com/bluejekyll/trust-dns/blob/master/server/src/named.rs#L236 > authority.secure_zone()

kerem

2026-03-07 22:18:49 +03:00

closed this issue
added the
bug

crate:server

cleanup
labels

kerem commented

2026-03-07 22:18:51 +03:00

Author

Owner

@bluejekyll commented on GitHub (Sep 27, 2017):

Yeah, this is cosmetic. I wanted to get the "fix" to you quickly to unblock you. I should add some additional logging and remove the line that is still attempting to sign after journal recovery.

It still should be fixed.

@bluejekyll commented on GitHub (Sep 27, 2017): Yeah, this is cosmetic. I wanted to get the "fix" to you quickly to unblock you. I should add some additional logging and remove the line that is still attempting to sign after journal recovery. It still should be fixed.

kerem referenced this issue

2026-03-15 22:05:00 +03:00

[GH-ISSUE #98] [Server] Support DNS64 (RFC 6147) #347