From 65cb5b2bd104d6faad9b7abbce82ba35ed6e1be1 Mon Sep 17 00:00:00 2001 From: Angelo De Caro Date: Fri, 11 Aug 2017 11:07:58 +0800 Subject: [PATCH] [FAB-5721] ACLProvider at LSCC This change-set does following: - It modifed the LSCC to use ACLProvider for access control. Tests have been updated to validate the changes. Use RegsiterACLProvider instead of SetACLProvider . use MockACLProvider (basically its Reset) to work the ACL system Change-Id: I09ff832730b22d64bf67416c9db9a3acab34ff4c Signed-off-by: Angelo De Caro Signed-off-by: Srinivasan Muralidharan --- core/scc/lscc/lscc.go | 17 +++++++---- core/scc/lscc/lscc_test.go | 58 ++++++++++++++++++++++++++++++++++---- 2 files changed, 64 insertions(+), 11 deletions(-) diff --git a/core/scc/lscc/lscc.go b/core/scc/lscc/lscc.go index 59734d20dac..eea5fb32665 100644 --- a/core/scc/lscc/lscc.go +++ b/core/scc/lscc/lscc.go @@ -23,7 +23,7 @@ import ( "github.com/golang/protobuf/proto" "github.com/hyperledger/fabric/common/cauthdsl" "github.com/hyperledger/fabric/common/flogging" - "github.com/hyperledger/fabric/common/policies" + "github.com/hyperledger/fabric/core/aclmgmt" "github.com/hyperledger/fabric/core/chaincode/shim" "github.com/hyperledger/fabric/core/common/ccprovider" "github.com/hyperledger/fabric/core/common/sysccprovider" @@ -849,10 +849,17 @@ func (lscc *LifeCycleSysCC) Invoke(stub shim.ChaincodeStubInterface) pb.Response ccname := string(args[2]) // 2. check local Channel Readers policy - // Notice that this information are already available on the ledger - // therefore we enforce here that the caller is reader of the channel. - if err = lscc.policyChecker.CheckPolicy(chain, policies.ChannelApplicationReaders, sp); err != nil { - return shim.Error(fmt.Sprintf("Authorization for %s on channel %s has been denied with error %s", function, args[1], err)) + var resource string + switch function { + case GETCCINFO: + resource = aclmgmt.LSCC_GETCCINFO + case GETDEPSPEC: + resource = aclmgmt.LSCC_GETDEPSPEC + case GETCCDATA: + resource = aclmgmt.LSCC_GETCCDATA + } + if err = aclmgmt.GetACLProvider().CheckACL(resource, chain, sp); err != nil { + return shim.Error(fmt.Sprintf("Authorization request failed %s: %s", chain, err)) } cdbytes, err := lscc.getCCInstance(stub, ccname) diff --git a/core/scc/lscc/lscc_test.go b/core/scc/lscc/lscc_test.go index 21c57e39f77..09d07b4c750 100644 --- a/core/scc/lscc/lscc_test.go +++ b/core/scc/lscc/lscc_test.go @@ -19,6 +19,7 @@ import ( "archive/tar" "bytes" "compress/gzip" + "errors" "fmt" "io/ioutil" "os" @@ -30,6 +31,8 @@ import ( "github.com/hyperledger/fabric/common/mocks/scc" "github.com/hyperledger/fabric/common/policies" "github.com/hyperledger/fabric/common/util" + "github.com/hyperledger/fabric/core/aclmgmt" + "github.com/hyperledger/fabric/core/aclmgmt/mocks" "github.com/hyperledger/fabric/core/chaincode/shim" "github.com/hyperledger/fabric/core/common/ccpackage" "github.com/hyperledger/fabric/core/common/ccprovider" @@ -139,6 +142,8 @@ func testInstall(t *testing.T, ccname string, version string, path string, expec } } + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETINSTALLEDCHAINCODES, "test", sProp).Return(nil) args = [][]byte{[]byte(GETINSTALLEDCHAINCODES)} sProp, _ = utils.MockSignedEndorserProposalOrPanic("", &pb.ChaincodeSpec{}, []byte("Alice"), []byte("msg1")) identityDeserializer.Msg = sProp.ProposalBytes @@ -323,6 +328,8 @@ func testDeploy(t *testing.T, ccname string, version string, path string, forceB t.FailNow() } + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETCCINFO, "test", sProp).Return(nil) args = [][]byte{[]byte(GETCCINFO), []byte("test"), []byte(cds.ChaincodeSpec.ChaincodeId.Name)} if res := stub.MockInvokeWithSignedProposal("1", args, sProp); res.Status != shim.OK { t.FailNow() @@ -414,6 +421,8 @@ func TestMultipleDeploy(t *testing.T) { t.FailNow() } + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETCCINFO, "test", sProp).Return(nil) args = [][]byte{[]byte(GETCCINFO), []byte("test"), []byte(cds.ChaincodeSpec.ChaincodeId.Name)} if res := stub.MockInvokeWithSignedProposal("1", args, sProp); res.Status != shim.OK { t.FailNow() @@ -429,11 +438,15 @@ func TestMultipleDeploy(t *testing.T) { t.FailNow() } + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETCCINFO, "test", sProp2).Return(nil) args = [][]byte{[]byte(DEPLOY), []byte("test"), b} if res := stub.MockInvokeWithSignedProposal("1", args, sProp2); res.Status != shim.OK { t.FailNow() } + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETCCINFO, "test", sProp).Return(nil) args = [][]byte{[]byte(GETCCINFO), []byte("test"), []byte(cds.ChaincodeSpec.ChaincodeId.Name)} if res := stub.MockInvokeWithSignedProposal("1", args, sProp); res.Status != shim.OK { t.FailNow() @@ -508,12 +521,16 @@ func TestRetryFailedDeploy(t *testing.T) { t.FailNow() } + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETDEPSPEC, "test", sProp2).Return(nil) //deploy correctly now args = [][]byte{[]byte(DEPLOY), []byte("test"), b} if res := stub.MockInvokeWithSignedProposal("1", args, sProp2); res.Status != shim.OK { t.FailNow() } + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETDEPSPEC, "test", sProp).Return(nil) //get the deploymentspec args = [][]byte{[]byte(GETDEPSPEC), []byte("test"), []byte(cds.ChaincodeSpec.ChaincodeId.Name)} if res := stub.MockInvokeWithSignedProposal("1", args, sProp); res.Status != shim.OK || res.Payload == nil { @@ -605,6 +622,8 @@ func TestTamperChaincode(t *testing.T) { } //get the deploymentspec + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETDEPSPEC, "test", sProp).Return(nil) args = [][]byte{[]byte(GETDEPSPEC), []byte("test"), []byte(cds.ChaincodeSpec.ChaincodeId.Name)} if res = stub.MockInvokeWithSignedProposal("1", args, sProp); res.Status == shim.OK { t.Logf("Expected error on tampering files but succeeded") @@ -724,6 +743,8 @@ func testIPolDeploy(t *testing.T, iPol string, successExpected bool) { } } + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETCCINFO, chainid, sProp).Return(nil) args = [][]byte{[]byte(GETCCINFO), []byte(chainid), []byte(cds.ChaincodeSpec.ChaincodeId.Name)} if res := stub.MockInvokeWithSignedProposal("1", args, sProp); res.Status != shim.OK { if successExpected { @@ -867,6 +888,8 @@ func testIPolUpgrade(t *testing.T, iPol string, successExpected bool) { if res := stub.MockInvokeWithSignedProposal("1", args, sProp2); res.Status != shim.OK { t.Fatalf("Deploy failed %s", res) } + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETCCINFO, chainid, sProp).Return(nil) args = [][]byte{[]byte(GETCCINFO), []byte(chainid), []byte(cds.ChaincodeSpec.ChaincodeId.Name)} if res := stub.MockInvokeWithSignedProposal("1", args, sProp); res.Status != shim.OK { t.Fatalf("GetCCInfo after deploy failed %s", res) @@ -950,18 +973,24 @@ func TestGetAPIsWithoutInstall(t *testing.T) { //Force remove CC os.Remove(lscctestpath + "/example02.0") + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETCCINFO, "test", sProp).Return(nil) //GETCCINFO should still work args = [][]byte{[]byte(GETCCINFO), []byte("test"), []byte(cds.ChaincodeSpec.ChaincodeId.Name)} if res := stub.MockInvokeWithSignedProposal("1", args, sProp); res.Status != shim.OK { t.FailNow() } + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETCCDATA, "test", sProp).Return(nil) //GETCCDATA should still work args = [][]byte{[]byte(GETCCDATA), []byte("test"), []byte(cds.ChaincodeSpec.ChaincodeId.Name)} if res := stub.MockInvokeWithSignedProposal("1", args, sProp); res.Status != shim.OK { t.FailNow() } + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETDEPSPEC, "test", sProp).Return(nil) //GETDEPSPEC should not work args = [][]byte{[]byte(GETDEPSPEC), []byte("test"), []byte(cds.ChaincodeSpec.ChaincodeId.Name)} if res := stub.MockInvokeWithSignedProposal("1", args, sProp); res.Status == shim.OK { @@ -1140,6 +1169,8 @@ func TestGetCCAccessRights(t *testing.T) { // Should pass args = [][]byte{[]byte(GETCCINFO), []byte("test"), []byte(cds.ChaincodeSpec.ChaincodeId.Name)} sProp, _ := utils.MockSignedEndorserProposalOrPanic("", &pb.ChaincodeSpec{}, []byte("Alice"), []byte("msg1")) + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETCCINFO, "test", sProp).Return(nil) identityDeserializer.Msg = sProp.ProposalBytes sProp.Signature = sProp.ProposalBytes res := stub.MockInvokeWithSignedProposal("1", args, sProp) @@ -1150,13 +1181,15 @@ func TestGetCCAccessRights(t *testing.T) { // Should fail sProp, _ = utils.MockSignedEndorserProposalOrPanic("", &pb.ChaincodeSpec{}, []byte("Bob"), []byte("msg1")) - identityDeserializer.Msg = sProp.ProposalBytes - sProp.Signature = sProp.ProposalBytes + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETCCINFO, "test", sProp).Return(errors.New("Failed access control")) res = stub.MockInvokeWithSignedProposal("1", args, sProp) if res.Status == shim.OK { t.Logf("This should fail [%s]", res.Message) t.FailNow() } + assert.Contains(t, res.Message, "Failed access control") + mockAclProvider.AssertExpectations(t) // GETDEPSPEC // Should pass @@ -1164,6 +1197,8 @@ func TestGetCCAccessRights(t *testing.T) { sProp, _ = utils.MockSignedEndorserProposalOrPanic("", &pb.ChaincodeSpec{}, []byte("Alice"), []byte("msg1")) identityDeserializer.Msg = sProp.ProposalBytes sProp.Signature = sProp.ProposalBytes + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETDEPSPEC, "test", sProp).Return(nil) res = stub.MockInvokeWithSignedProposal("1", args, sProp) if res.Status != shim.OK { t.Logf("This should pass [%s]", res.Message) @@ -1172,13 +1207,15 @@ func TestGetCCAccessRights(t *testing.T) { // Should fail sProp, _ = utils.MockSignedEndorserProposalOrPanic("", &pb.ChaincodeSpec{}, []byte("Bob"), []byte("msg1")) - identityDeserializer.Msg = sProp.ProposalBytes - sProp.Signature = sProp.ProposalBytes + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETDEPSPEC, "test", sProp).Return(errors.New("Failed access control")) res = stub.MockInvokeWithSignedProposal("1", args, sProp) if res.Status == shim.OK { t.Logf("This should fail [%s]", res.Message) t.FailNow() } + assert.Contains(t, res.Message, "Failed access control") + mockAclProvider.AssertExpectations(t) // GETCCDATA // Should pass @@ -1186,6 +1223,8 @@ func TestGetCCAccessRights(t *testing.T) { sProp, _ = utils.MockSignedEndorserProposalOrPanic("", &pb.ChaincodeSpec{}, []byte("Alice"), []byte("msg1")) identityDeserializer.Msg = sProp.ProposalBytes sProp.Signature = sProp.ProposalBytes + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETCCDATA, "test", sProp).Return(nil) res = stub.MockInvokeWithSignedProposal("1", args, sProp) if res.Status != shim.OK { t.Logf("This should pass [%s]", res.Message) @@ -1194,19 +1233,22 @@ func TestGetCCAccessRights(t *testing.T) { // Should fail sProp, _ = utils.MockSignedEndorserProposalOrPanic("", &pb.ChaincodeSpec{}, []byte("Bob"), []byte("msg1")) - identityDeserializer.Msg = sProp.ProposalBytes - sProp.Signature = sProp.ProposalBytes + mockAclProvider.Reset() + mockAclProvider.On("CheckACL", aclmgmt.LSCC_GETCCDATA, "test", sProp).Return(errors.New("Failed access control")) res = stub.MockInvokeWithSignedProposal("1", args, sProp) if res.Status == shim.OK { t.Logf("This should fail [%s]", res.Message) t.FailNow() } + assert.Contains(t, res.Message, "Failed access control") + mockAclProvider.AssertExpectations(t) } var id msp.SigningIdentity var sid []byte var mspid string var chainid string = util.GetTestChainID() +var mockAclProvider *mocks.MockACLProvider func TestMain(m *testing.M) { ccprovider.SetChaincodesPath(lscctestpath) @@ -1260,5 +1302,9 @@ func TestMain(m *testing.M) { // also set the MSP for the "test" chain mspmgmt.XXXSetMSPManager("test", mspmgmt.GetManagerForChain(util.GetTestChainID())) + mockAclProvider = &mocks.MockACLProvider{} + mockAclProvider.Reset() + + aclmgmt.RegisterACLProvider(mockAclProvider) os.Exit(m.Run()) }