From 7649cd7144da861f9b335d44a912d8dc830a6bfc Mon Sep 17 00:00:00 2001
From: Kees Monshouwer <mind04@monshouwer.org>
Date: Tue, 24 Mar 2015 14:29:22 +0100
Subject: [PATCH] allow "pdnssec set-nsec3 ZONE" for insecure zones this saves
 on one rectify when securing a NSEC3 zone

---
 pdns/pdnssec.cc                       | 22 ++++++++++++++--------
 regression-tests/backends/gsql-common |  4 +---
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/pdns/pdnssec.cc b/pdns/pdnssec.cc
index 8470c7e4f..120f787dc 100644
--- a/pdns/pdnssec.cc
+++ b/pdns/pdnssec.cc
@@ -1673,18 +1673,24 @@ try
     string nsec3params =  cmds.size() > 2 ? cmds[2] : "1 0 1 ab";
     bool narrow = cmds.size() > 3 && cmds[3]=="narrow";
     NSEC3PARAMRecordContent ns3pr(nsec3params);
-    
+
     DNSName zone(cmds[1]);
-    if(!dk.isSecuredZone(zone)) {
-      cerr<<"Zone '"<<zone.toString()<<"' is not secured, can't set NSEC3 parameters"<<endl;
-      exit(EXIT_FAILURE);
+    if (! dk.setNSEC3PARAM(zone, ns3pr, narrow)) {
+      cerr<<"Cannot set NSEC3 param for " << zone.toString() << endl;
+      return 1;
     }
-    dk.setNSEC3PARAM(zone, ns3pr, narrow);
-    
+
     if (!ns3pr.d_flags)
-      cerr<<"NSEC3 set, please rectify-zone if your backend needs it"<<endl;
+      cerr<<"NSEC3 set, ";
     else
-      cerr<<"NSEC3 (opt-out) set, please rectify-zone if your backend needs it"<<endl;
+      cerr<<"NSEC3 (opt-out) set, ";
+
+    if(dk.isSecuredZone(zone))
+      cerr<<"please rectify your zone if your backend needs it"<<endl;
+    else
+      cerr<<"please secure and rectify your zone."<<endl;
+
+    return 0;
   }
   else if(cmds[0]=="set-presigned") {
     if(cmds.size() < 2) {
diff --git a/regression-tests/backends/gsql-common b/regression-tests/backends/gsql-common
index e1f0f1bff..d7d4167f8 100644
--- a/regression-tests/backends/gsql-common
+++ b/regression-tests/backends/gsql-common
@@ -12,16 +12,14 @@ gsql-master()
 	do
 		if [ $context != ${backend}-nodnssec ]
 		then
-			securezone $zone ${backend}
 			if [ $context = ${backend}-nsec3 ] || [ $context = ${backend}-nsec3-optout ]
 			then
 				../pdns/pdnssec --config-dir=. --config-name=$backend set-nsec3 $zone "1 $optout 1 abcd" 2>&1
-				../pdns/pdnssec --config-dir=. --config-name=$backend rectify-zone $zone 2>&1
 			elif [ $context = ${backend}-nsec3-narrow ]
 			then
 				../pdns/pdnssec --config-dir=. --config-name=$backend set-nsec3 $zone '1 1 1 abcd' narrow 2>&1
-				../pdns/pdnssec --config-dir=. --config-name=$backend rectify-zone $zone 2>&1
 			fi
+			securezone $zone ${backend}
 		else
 			../pdns/pdnssec --config-dir=. --config-name=$backend rectify-zone $zone 2>&1
 		fi
-- 
2.40.0