From 36a885a9ab34c124e20f3e2f4c9647aa617204b8 Mon Sep 17 00:00:00 2001
From: Peter van Dijk <peter.van.dijk@powerdns.com>
Date: Tue, 22 Dec 2015 11:26:13 +0100
Subject: [PATCH] refactor

---
 pdns/pdnsutil.cc | 31 +++++++++++++++----------------
 1 file changed, 15 insertions(+), 16 deletions(-)

diff --git a/pdns/pdnsutil.cc b/pdns/pdnsutil.cc
index 7b46c5d9a..f32c03fe1 100644
--- a/pdns/pdnsutil.cc
+++ b/pdns/pdnsutil.cc
@@ -1228,15 +1228,24 @@ bool secureZone(DNSSECKeeper& dk, const DNSName& zone)
   else
     cout << "Securing zone with " << k_algos[0] << " algorithm with default key size" << endl;
 
-  // run secure-zone with first default algorith, then add keys
-  if(!dk.addKey(zone, true, shorthand2algorithm(k_algos[0]), k_size)) {
-    cerr<<"No backend was able to secure '"<<zone.toString()<<"', most likely because no DNSSEC"<<endl;
-    cerr<<"capable backends are loaded, or because the backends have DNSSEC disabled."<<endl;
-    cerr<<"For the Generic SQL backends, set the 'gsqlite3-dnssec', 'gmysql-dnssec' or"<<endl;
-    cerr<<"'gpgsql-dnssec' flag. Also make sure the schema has been updated for DNSSEC!"<<endl;
+
+  DNSSECKeeper::keyset_t zskset=dk.getKeys(zone, false);
+
+  if(!zskset.empty())  {
+    cerr<<"There were ZSKs already for zone '"<<zone.toString()<<"', no need to add more"<<endl;
     return false;
   }
 
+  for(vector<string>::iterator i = k_algos.begin(); i != k_algos.end(); i++) {
+    if(!dk.addKey(zone, true, shorthand2algorithm(k_algos[0]), k_size, true)) {
+      cerr<<"No backend was able to secure '"<<zone.toString()<<"', most likely because no DNSSEC"<<endl;
+      cerr<<"capable backends are loaded, or because the backends have DNSSEC disabled."<<endl;
+      cerr<<"For the Generic SQL backends, set the 'gsqlite3-dnssec', 'gmysql-dnssec' or"<<endl;
+      cerr<<"'gpgsql-dnssec' flag. Also make sure the schema has been updated for DNSSEC!"<<endl;
+      return false;
+    }
+  }
+
   if(!dk.isSecuredZone(zone)) {
     cerr<<"Failed to secure zone. Is your backend dnssec enabled? (set "<<endl;
     cerr<<"gsqlite3-dnssec, or gmysql-dnssec etc). Check this first."<<endl;
@@ -1246,16 +1255,6 @@ bool secureZone(DNSSECKeeper& dk, const DNSName& zone)
     return false;
   }
 
-  DNSSECKeeper::keyset_t zskset=dk.getKeys(zone, false);
-
-  if(!zskset.empty())  {
-    cerr<<"There were ZSKs already for zone '"<<zone.toString()<<"', no need to add more"<<endl;
-    return false;
-  }
-  
-  for(vector<string>::iterator i = k_algos.begin()+1; i != k_algos.end(); i++)
-    dk.addKey(zone, true, shorthand2algorithm(*i), k_size, true); // obvious errors will have been caught above
-
   for(string z_algo :  z_algos)
   {
     int algo = shorthand2algorithm(z_algo);
-- 
2.40.0