From a99daaa5a45ae1fe85630ed197d2490cfb87f5ca Mon Sep 17 00:00:00 2001
From: Tim Bruijnzeels <tim@nlnetlabs.nl>
Date: Sat, 5 Mar 2022 16:32:32 +0100
Subject: [PATCH] ROA / ASPA renewal should try *all* CAs #792

---
 src/daemon/ca/manager.rs | 14 +++++++++++---
 src/daemon/ca/rc.rs      | 38 +++++++++++++++++++++++++++-----------
 2 files changed, 38 insertions(+), 14 deletions(-)

diff --git a/src/daemon/ca/manager.rs b/src/daemon/ca/manager.rs
index 0341190e..40778226 100644
--- a/src/daemon/ca/manager.rs
+++ b/src/daemon/ca/manager.rs
@@ -1928,7 +1928,10 @@ impl CaManager {
                 CmdDet::RouteAuthorizationsRenew(self.config.clone(), self.signer.clone()),
                 actor,
             );
-            self.send_command(cmd).await?;
+
+            if let Err(e) = self.send_command(cmd).await {
+                error!("Renewing ROAs for CA '{}' failed with error: {}", ca, e);
+            }
 
             let cmd = Cmd::new(
                 &ca,
@@ -1936,7 +1939,10 @@ impl CaManager {
                 CmdDet::AspasRenew(self.config.clone(), self.signer.clone()),
                 actor,
             );
-            self.send_command(cmd).await?;
+
+            if let Err(e) = self.send_command(cmd).await {
+                error!("Renewing ASPAs for CA '{}' failed with error: {}", ca, e);
+            }
         }
         Ok(())
     }
@@ -1954,7 +1960,9 @@ impl CaManager {
                 CmdDet::RouteAuthorizationsForceRenew(self.config.clone(), self.signer.clone()),
                 actor,
             );
-            self.send_command(cmd).await?;
+            if let Err(e) = self.send_command(cmd).await {
+                error!("Renewing ROAs for CA '{}' failed with error: {}", ca, e);
+            }
         }
         Ok(())
     }
diff --git a/src/daemon/ca/rc.rs b/src/daemon/ca/rc.rs
index ad74b0d0..17edfdbb 100644
--- a/src/daemon/ca/rc.rs
+++ b/src/daemon/ca/rc.rs
@@ -652,8 +652,12 @@ impl ResourceClass {
         issuance_timing: &IssuanceTimingConfig,
         signer: &KrillSigner,
     ) -> KrillResult<RoaUpdates> {
-        let key = self.get_current_key()?;
-        self.roas.renew(force, key, issuance_timing, signer)
+        if let Ok(key) = self.get_current_key() {
+            self.roas.renew(force, key, issuance_timing, signer)
+        } else {
+            debug!("no ROAs to renew - resource class has no current key");
+            Ok(RoaUpdates::default())
+        }
     }
 
     /// Publish all ROAs under the new key
@@ -668,10 +672,14 @@ impl ResourceClass {
 
     /// Updates the ROAs in accordance with the current authorizations
     pub fn update_roas(&self, routes: &Routes, config: &Config, signer: &KrillSigner) -> KrillResult<RoaUpdates> {
-        let key = self.get_current_key()?;
-        let resources = key.incoming_cert().resources();
-        let routes = routes.filter(resources);
-        self.roas.update(&routes, key, config, signer)
+        if let Ok(key) = self.get_current_key() {
+            let resources = key.incoming_cert().resources();
+            let routes = routes.filter(resources);
+            self.roas.update(&routes, key, config, signer)
+        } else {
+            debug!("no ROAs to update - resource class has no current key");
+            Ok(RoaUpdates::default())
+        }
     }
 
     /// Marks the ROAs as updated from a RoaUpdated event.
@@ -690,9 +698,13 @@ impl ResourceClass {
         issuance_timing: &IssuanceTimingConfig,
         signer: &KrillSigner,
     ) -> KrillResult<AspaObjectsUpdates> {
-        let key = self.get_current_key()?;
-        let renew_threshold = Some(Time::now() + Duration::weeks(issuance_timing.timing_aspa_reissue_weeks_before));
-        self.aspas.renew(key, renew_threshold, issuance_timing, signer)
+        if let Ok(key) = self.get_current_key() {
+            let renew_threshold = Some(Time::now() + Duration::weeks(issuance_timing.timing_aspa_reissue_weeks_before));
+            self.aspas.renew(key, renew_threshold, issuance_timing, signer)
+        } else {
+            debug!("no ASPAs to renew - resource class has no current key");
+            Ok(AspaObjectsUpdates::default())
+        }
     }
 
     /// Updates the ASPA objects in accordance with the supplied definitions
@@ -702,8 +714,12 @@ impl ResourceClass {
         config: &Config,
         signer: &KrillSigner,
     ) -> KrillResult<AspaObjectsUpdates> {
-        let key = self.get_current_key()?;
-        self.aspas.update(all_aspas, key, config, signer)
+        if let Ok(key) = self.get_current_key() {
+            self.aspas.update(all_aspas, key, config, signer)
+        } else {
+            debug!("no ASPAs to update - resource class has no current key");
+            Ok(AspaObjectsUpdates::default())
+        }
     }
 
     /// Apply ASPA object changes from events