[FAB-1528] Add block signature

https://jira.hyperledger.org/browse/FAB-1528

This changeset adds a signing interface which the MSP team has agreed to
implement.  It also adds a single signature for the block creation
(which will be adequate for Solo/Kafka but will need to be augmented for
SBFT).

It also adds the signature to the last configuration item.

Change-Id: I87f37b3e4ff523f7a32ccdf2e87a80cc9ca7f87a
Signed-off-by: Jason Yellick <jyellick@us.ibm.com>

orderer/mocks/multichain/multichain.go

@@ -83,3 +83,13 @@ func (mcs *ConsenterSupport) WriteBlock(block *cb.Block, _committers []filter.Co
 func (mcs *ConsenterSupport) ChainID() string {
 	return mcs.ChainIDVal
 }
+
+// Sign returns the bytes passed in
+func (mcs *ConsenterSupport) Sign(message []byte) []byte {
+	return message
+}
+
+// NewSignatureHeader returns an empty signature header
+func (mcs *ConsenterSupport) NewSignatureHeader() *cb.SignatureHeader {
+	return &cb.SignatureHeader{}
+}

orderer/multichain/chainsupport.go

@@ -58,6 +58,7 @@ type Chain interface {
 
 // ConsenterSupport provides the resources available to a Consenter implementation
 type ConsenterSupport interface {
+	Signer
 	BlockCutter() blockcutter.Receiver
 	SharedConfig() sharedconfig.Manager
 	CreateNextBlock(messages []*cb.Envelope) *cb.Block
@@ -83,6 +84,7 @@ type chainSupport struct {
 	sharedConfigManager sharedconfig.Manager
 	ledger              rawledger.ReadWriter
 	filters             *filter.RuleSet
+	signer              Signer
 	lastConfiguration   uint64
 	lastConfigSeq       uint64
 }
@@ -94,6 +96,7 @@ func newChainSupport(
 	backing rawledger.ReadWriter,
 	sharedConfigManager sharedconfig.Manager,
 	consenters map[string]Consenter,
+	signer Signer,
 ) *chainSupport {
 
 	cutter := blockcutter.NewReceiverImpl(sharedConfigManager, filters)
@@ -110,6 +113,7 @@ func newChainSupport(
 		cutter:              cutter,
 		filters:             filters,
 		ledger:              backing,
+		signer:              signer,
 	}
 
 	var err error
@@ -145,6 +149,14 @@ func (cs *chainSupport) start() {
 	cs.chain.Start()
 }
 
+func (cs *chainSupport) NewSignatureHeader() *cb.SignatureHeader {
+	return cs.signer.NewSignatureHeader()
+}
+
+func (cs *chainSupport) Sign(message []byte) []byte {
+	return cs.signer.Sign(message)
+}
+
 func (cs *chainSupport) SharedConfig() sharedconfig.Manager {
 	return cs.sharedConfigManager
 }
@@ -181,21 +193,70 @@ func (cs *chainSupport) CreateNextBlock(messages []*cb.Envelope) *cb.Block {
 	return rawledger.CreateNextBlock(cs.ledger, messages)
 }
 
-func (cs *chainSupport) WriteBlock(block *cb.Block, committers []filter.Committer) *cb.Block {
-	for _, committer := range committers {
-		committer.Commit()
+// TODO, factor this out into common util code
+func metadataSignatureBytes(value []byte, sigHeader []byte, blockHeader []byte) []byte {
+	result := make([]byte, len(value)+len(sigHeader)+len(blockHeader))
+	last := 0
+	for _, slice := range [][]byte{value, sigHeader, blockHeader} {
+		for i := range slice {
+			result[i+last] = slice[i]
+		}
+		last += len(slice)
 	}
+	return result
+}
+
+func (cs *chainSupport) addBlockSignature(block *cb.Block) {
+	logger.Debugf("%+v", cs)
+	logger.Debugf("%+v", cs.signer)
+	blockSignature := &cb.MetadataSignature{
+		SignatureHeader: utils.MarshalOrPanic(cs.signer.NewSignatureHeader()),
+	}
+
+	// Note, this value is intentionally nil, as this metadata is only about the signature, there is no additional metadata
+	// information required beyond the fact that the metadata item is signed.
+	blockSignatureValue := []byte(nil)
+
+	blockSignature.Signature = cs.signer.Sign(metadataSignatureBytes(blockSignatureValue, blockSignature.SignatureHeader, block.Header.Bytes()))
+
+	block.Metadata.Metadata[cb.BlockMetadataIndex_SIGNATURES] = utils.MarshalOrPanic(&cb.Metadata{
+		Value: blockSignatureValue,
+		Signatures: []*cb.MetadataSignature{
+			blockSignature,
+		},
+	})
+}
 
+func (cs *chainSupport) addLastConfigSignature(block *cb.Block) {
 	configSeq := cs.configManager.Sequence()
 	if configSeq > cs.lastConfigSeq {
 		cs.lastConfiguration = block.Header.Number
 		cs.lastConfigSeq = configSeq
 	}
 
+	lastConfigSignature := &cb.MetadataSignature{
+		SignatureHeader: utils.MarshalOrPanic(cs.signer.NewSignatureHeader()),
+	}
+
+	lastConfigValue := utils.MarshalOrPanic(&cb.LastConfiguration{Index: cs.lastConfiguration})
+
+	lastConfigSignature.Signature = cs.signer.Sign(metadataSignatureBytes(lastConfigValue, lastConfigSignature.SignatureHeader, block.Header.Bytes()))
+
 	block.Metadata.Metadata[cb.BlockMetadataIndex_LAST_CONFIGURATION] = utils.MarshalOrPanic(&cb.Metadata{
-		Value: utils.MarshalOrPanic(&cb.LastConfiguration{Index: cs.lastConfiguration}),
-		// XXX Add signature once signing is available
+		Value: lastConfigValue,
+		Signatures: []*cb.MetadataSignature{
+			lastConfigSignature,
+		},
 	})
+}
+
+func (cs *chainSupport) WriteBlock(block *cb.Block, committers []filter.Committer) *cb.Block {
+	for _, committer := range committers {
+		committer.Commit()
+	}
+
+	cs.addBlockSignature(block)
+	cs.addLastConfigSignature(block)
 
 	err := cs.ledger.Append(block)
 	if err != nil {

orderer/multichain/chainsupport_test.go

@@ -17,6 +17,7 @@ limitations under the License.
 package multichain
 
 import (
+	"bytes"
 	"reflect"
 	"testing"
 
@@ -64,7 +65,7 @@ func (mc *mockCommitter) Commit() {
 func TestCommitConfig(t *testing.T) {
 	ml := &mockLedgerReadWriter{}
 	cm := &mockconfigtx.Manager{}
-	cs := &chainSupport{ledger: ml, configManager: cm}
+	cs := &chainSupport{ledger: ml, configManager: cm, signer: &xxxCryptoHelper{}}
 	txs := []*cb.Envelope{makeNormalTx("foo", 0), makeNormalTx("bar", 1)}
 	committers := []filter.Committer{&mockCommitter{}, &mockCommitter{}}
 	block := cs.CreateNextBlock(txs)
@@ -86,10 +87,40 @@ func TestCommitConfig(t *testing.T) {
 	}
 }
 
+func TestMetadataSignatureBytes(t *testing.T) {
+	value := []byte("Value")
+	signatureHeader := []byte("SignatureHeader")
+	blockHeader := []byte("BlockHeader")
+
+	sigBytes := metadataSignatureBytes(value, signatureHeader, blockHeader)
+	expected := []byte("ValueSignatureHeaderBlockHeader")
+	if !bytes.Equal(sigBytes, expected) {
+		t.Errorf("Did not compute first signature bytes correctly, expected %s, got %s", expected, sigBytes)
+	}
+}
+
+func TestWriteBlockSignatures(t *testing.T) {
+	ml := &mockLedgerReadWriter{}
+	cm := &mockconfigtx.Manager{}
+	cs := &chainSupport{ledger: ml, configManager: cm, signer: &xxxCryptoHelper{}}
+
+	blockMetadata := func(block *cb.Block) *cb.Metadata {
+		metadata, err := utils.GetMetadataFromBlock(block, cb.BlockMetadataIndex_SIGNATURES)
+		if err != nil {
+			panic(err)
+		}
+		return metadata
+	}
+
+	if blockMetadata(cs.WriteBlock(cb.NewBlock(0, nil), nil)) == nil {
+		t.Fatalf("Block should have block signature")
+	}
+}
+
 func TestWriteLastConfiguration(t *testing.T) {
 	ml := &mockLedgerReadWriter{}
 	cm := &mockconfigtx.Manager{}
-	cs := &chainSupport{ledger: ml, configManager: cm}
+	cs := &chainSupport{ledger: ml, configManager: cm, signer: &xxxCryptoHelper{}}
 
 	lastConfig := func(block *cb.Block) uint64 {
 		index, err := utils.GetLastConfigurationIndexFromBlock(block)

orderer/multichain/manager.go

@@ -41,6 +41,23 @@ func (xxx xxxCryptoHelper) VerifySignature(sd *cb.SignedData) error {
 	return nil
 }
 
+func (xxx xxxCryptoHelper) NewSignatureHeader() *cb.SignatureHeader {
+	return &cb.SignatureHeader{}
+}
+
+func (xxx xxxCryptoHelper) Sign(message []byte) []byte {
+	return message
+}
+
+// Signer is a temporary stub interface which will be implemented by the local MSP
+type Signer interface {
+	// NewSignatureHeader creates a SignatureHeader with the correct signing identity and a valid nonce
+	NewSignatureHeader() *cb.SignatureHeader
+
+	// Sign a message which should embed a signature header created by NewSignatureHeader
+	Sign(message []byte) []byte
+}
+
 // Manager coordinates the creation and access of chains
 type Manager interface {
 	// GetChain retrieves the chain support for a chain (and whether it exists)
@@ -99,14 +116,14 @@ func NewManagerImpl(ledgerFactory rawledger.Factory, consenters map[string]Conse
 				logger.Fatalf("There appear to be two system chains %s and %s", ml.sysChain.support.ChainID(), chainID)
 			}
 			logger.Debugf("Starting with system chain: %s", chainID)
-			chain := newChainSupport(createSystemChainFilters(ml, configManager), configManager, policyManager, backingLedger, sharedConfigManager, consenters)
+			chain := newChainSupport(createSystemChainFilters(ml, configManager), configManager, policyManager, backingLedger, sharedConfigManager, consenters, &xxxCryptoHelper{})
 			ml.chains[string(chainID)] = chain
 			ml.sysChain = newSystemChain(chain)
 			// We delay starting this chain, as it might try to copy and replace the chains map via newChain before the map is fully built
 			defer chain.start()
 		} else {
 			logger.Debugf("Starting chain: %s", chainID)
-			chain := newChainSupport(createStandardFilters(configManager), configManager, policyManager, backingLedger, sharedConfigManager, consenters)
+			chain := newChainSupport(createStandardFilters(configManager), configManager, policyManager, backingLedger, sharedConfigManager, consenters, &xxxCryptoHelper{})
 			ml.chains[string(chainID)] = chain
 			chain.start()
 		}
@@ -208,7 +225,7 @@ func (ml *multiLedger) newChain(configtx *cb.Envelope) {
 		newChains[key] = value
 	}
 
-	cs := newChainSupport(createStandardFilters(configManager), configManager, policyManager, backingLedger, sharedConfig, ml.consenters)
+	cs := newChainSupport(createStandardFilters(configManager), configManager, policyManager, backingLedger, sharedConfig, ml.consenters, &xxxCryptoHelper{})
 	chainID := configManager.ChainID()
 
 	logger.Debugf("Created and starting new chain %s", chainID)

protos/common/block.go

@@ -34,13 +34,16 @@ func NewBlock(seqNum uint64, previousHash []byte) *Block {
 	return block
 }
 
-func (b *BlockHeader) Hash() []byte {
+func (b *BlockHeader) Bytes() []byte {
 	data, err := proto.Marshal(b) // XXX this is wrong, protobuf is not the right mechanism to serialize for a hash
 	if err != nil {
 		panic("This should never fail and is generally irrecoverable")
 	}
+	return data
+}
 
-	return util.ComputeCryptoHash(data)
+func (b *BlockHeader) Hash() []byte {
+	return util.ComputeCryptoHash(b.Bytes())
 }
 
 func (b *BlockData) Hash() []byte {

protos/utils/blockutils.go

@@ -48,10 +48,19 @@ func GetChainIDFromBlock(block *cb.Block) (string, error) {
 	return payload.Header.ChainHeader.ChainID, nil
 }
 
+// GetMetadataFromBlock retrieves metadata at the specified index
+func GetMetadataFromBlock(block *cb.Block, index cb.BlockMetadataIndex) (*cb.Metadata, error) {
+	md := &cb.Metadata{}
+	err := proto.Unmarshal(block.Metadata.Metadata[index], md)
+	if err != nil {
+		return nil, err
+	}
+	return md, nil
+}
+
 // GetLastConfigurationIndexFromBlock retrieves the index of the last configuration block as encoded in the block metadata
 func GetLastConfigurationIndexFromBlock(block *cb.Block) (uint64, error) {
-	md := &cb.Metadata{}
-	err := proto.Unmarshal(block.Metadata.Metadata[cb.BlockMetadataIndex_LAST_CONFIGURATION], md)
+	md, err := GetMetadataFromBlock(block, cb.BlockMetadataIndex_LAST_CONFIGURATION)
 	if err != nil {
 		return 0, err
 	}