Return error when CA does not hold resources for child.

src/commons/error.rs

@@ -115,7 +115,7 @@ pub enum Error {
     #[display(fmt = "CA '{}' already has a parent named '{}'", _0, _1)]
     CaParentDuplicate(Handle, ParentHandle),
 
-    #[display(fmt = "CA '{}' does not have parent named '{}'", _0, _1)]
+    #[display(fmt = "CA '{}' does not have a parent named '{}'", _0, _1)]
     CaParentUnknown(Handle, ParentHandle),
 
     #[display(fmt = "CA '{}' got error from parent '{}': {}", _0, _1, _2)]
@@ -143,12 +143,15 @@ pub enum Error {
     #[display(fmt = "CA '{}' already has a child named '{}'", _0, _1)]
     CaChildDuplicate(Handle, ChildHandle),
 
-    #[display(fmt = "CA '{}' does not have child named '{}'", _0, _1)]
+    #[display(fmt = "CA '{}' does not have a child named '{}'", _0, _1)]
     CaChildUnknown(Handle, ChildHandle),
 
     #[display(fmt = "Child '{}' for CA '{}' MUST have resources specified", _1, _0)]
     CaChildMustHaveResources(Handle, ChildHandle),
 
+    #[display(fmt = "Child '{}' cannot have resources not held by CA '{}'", _1, _0)]
+    CaChildExtraResources(Handle, ChildHandle),
+
     #[display(fmt = "CA '{}' does not know id certificate for child '{}'", _0, _1)]
     CaChildUnauthorised(Handle, ChildHandle),
 
@@ -438,6 +441,11 @@ impl Error {
                     .with_ca(ca)
                     .with_child(child)
             }
+            Error::CaChildExtraResources(ca, child) => {
+                ErrorResponse::new("ca-child-resources-extra", &self)
+                    .with_ca(ca)
+                    .with_child(child)
+            }
             Error::CaChildUnauthorised(ca, child) => {
                 ErrorResponse::new("ca-child-unauthorised", &self)
                     .with_ca(ca)
@@ -734,6 +742,10 @@ mod tests {
             include_str!("../../test-resources/errors/ca-child-resources-required.json"),
             Error::CaChildMustHaveResources(ca.clone(), child.clone()),
         );
+        verify(
+            include_str!("../../test-resources/errors/ca-child-resources-extra.json"),
+            Error::CaChildExtraResources(ca.clone(), child.clone()),
+        );
         verify(
             include_str!("../../test-resources/errors/ca-child-unauthorised.json"),
             Error::CaChildUnauthorised(ca.clone(), child),

src/daemon/ca/certauth.rs

@@ -667,6 +667,8 @@ impl<S: Signer> CertAuth<S> {
     ) -> KrillResult<Vec<Evt>> {
         if resources.is_empty() {
             Err(Error::CaChildMustHaveResources(self.handle.clone(), child))
+        } else if !self.all_resources().contains(&resources) {
+            Err(Error::CaChildExtraResources(self.handle.clone(), child))
         } else if self.has_child(&child) {
             Err(Error::CaChildDuplicate(self.handle.clone(), child))
         } else {

test-resources/errors/ca-child-resources-extra.json

@@ -0,0 +1 @@
+{"label":"ca-child-resources-extra","msg":"Child 'child' cannot have resources not held by CA 'ca'", "args":{"child":"child","ca":"ca"}}

test-resources/errors/ca-child-unknown.json

@@ -1 +1 @@
-{"label":"ca-child-unknown","msg":"CA 'ca' does not have child named 'child'","args":{"child":"child","ca":"ca"}}
+{"label":"ca-child-unknown","msg":"CA 'ca' does not have a child named 'child'","args":{"child":"child","ca":"ca"}}

test-resources/errors/ca-parent-unknown.json

@@ -1 +1 @@
-{"label":"ca-parent-unknown","msg":"CA 'ca' does not have parent named 'parent'","args":{"ca":"ca","parent":"parent"}}
+{"label":"ca-parent-unknown","msg":"CA 'ca' does not have a parent named 'parent'","args":{"ca":"ca","parent":"parent"}}