allow "pdnssec set-nsec3 ZONE" for insecure zones

this saves on one rectify when securing a NSEC3 zone

diff --git a/pdns/pdnssec.cc b/pdns/pdnssec.cc
index 8470c7e4fe4e1da1c0cff349c285426078742aaa..120f787dc37436b17c747bd20dbb5d660503a38c 100644 (file)
--- a/pdns/pdnssec.cc
+++ b/pdns/pdnssec.cc
@@ -1673,18 +1673,24 @@ try
     string nsec3params =  cmds.size() > 2 ? cmds[2] : "1 0 1 ab";
     bool narrow = cmds.size() > 3 && cmds[3]=="narrow";
     NSEC3PARAMRecordContent ns3pr(nsec3params);
-    
+
     DNSName zone(cmds[1]);
-    if(!dk.isSecuredZone(zone)) {
-      cerr<<"Zone '"<<zone.toString()<<"' is not secured, can't set NSEC3 parameters"<<endl;
-      exit(EXIT_FAILURE);
+    if (! dk.setNSEC3PARAM(zone, ns3pr, narrow)) {
+      cerr<<"Cannot set NSEC3 param for " << zone.toString() << endl;
+      return 1;
     }
-    dk.setNSEC3PARAM(zone, ns3pr, narrow);
-    
+
     if (!ns3pr.d_flags)
-      cerr<<"NSEC3 set, please rectify-zone if your backend needs it"<<endl;
+      cerr<<"NSEC3 set, ";
     else
-      cerr<<"NSEC3 (opt-out) set, please rectify-zone if your backend needs it"<<endl;
+      cerr<<"NSEC3 (opt-out) set, ";
+
+    if(dk.isSecuredZone(zone))
+      cerr<<"please rectify your zone if your backend needs it"<<endl;
+    else
+      cerr<<"please secure and rectify your zone."<<endl;
+
+    return 0;
   }
   else if(cmds[0]=="set-presigned") {
     if(cmds.size() < 2) {

diff --git a/regression-tests/backends/gsql-common b/regression-tests/backends/gsql-common
index e1f0f1bff059cdd725996ed333c421438d87da51..d7d4167f88fae626abd6a43a3b303aa1a6d1e0a2 100644 (file)
--- a/regression-tests/backends/gsql-common
+++ b/regression-tests/backends/gsql-common
@@ -12,16 +12,14 @@ gsql-master()
        do
                if [ $context != ${backend}-nodnssec ]
                then
-                       securezone $zone ${backend}
                        if [ $context = ${backend}-nsec3 ] || [ $context = ${backend}-nsec3-optout ]
                        then
                                ../pdns/pdnssec --config-dir=. --config-name=$backend set-nsec3 $zone "1 $optout 1 abcd" 2>&1
-                               ../pdns/pdnssec --config-dir=. --config-name=$backend rectify-zone $zone 2>&1
                        elif [ $context = ${backend}-nsec3-narrow ]
                        then
                                ../pdns/pdnssec --config-dir=. --config-name=$backend set-nsec3 $zone '1 1 1 abcd' narrow 2>&1
-                               ../pdns/pdnssec --config-dir=. --config-name=$backend rectify-zone $zone 2>&1
                        fi
+                       securezone $zone ${backend}
                else
                        ../pdns/pdnssec --config-dir=. --config-name=$backend rectify-zone $zone 2>&1
                fi