[FAB-9473] Always enforce validation on initial cc

Currently, if a tx does not modify any data, all validation of that tx
is skipped.  This is usually not the application writer's intent, and
instead, the initially called chaincode should always have its EP
enforced, regardless of whether writes are made.

This also fixes the issue of enforcing endorsments for chaincode events.
Currently, only the initially invoked chaincode may include events in
the proposal results.  Therefore any chaincode events will be verified
using this EP.

Change-Id: I3c98e54be2ba4a53d26c8c13c0e243c6871aad34
Signed-off-by: Jason Yellick <jyellick@us.ibm.com>

Author: Jason Yellick

core/committer/txvalidator/validator_test.go

@@ -57,6 +57,10 @@ func signedByAnyMember(ids []string) []byte {
 }
 
 func setupLedgerAndValidator(t *testing.T) (ledger.PeerLedger, Validator) {
+	return setupLedgerAndValidatorExplicit(t, &mockconfig.MockApplicationCapabilities{})
+}
+
+func setupLedgerAndValidatorExplicit(t *testing.T, cpb *mockconfig.MockApplicationCapabilities) (ledger.PeerLedger, Validator) {
 	viper.Set("peer.fileSystemPath", "/tmp/fabric/validatortest")
 	ledgermgmt.InitializeTestEnv()
 	gb, err := ctxt.MakeGenesisBlock("TestLedger")
@@ -66,7 +70,7 @@ func setupLedgerAndValidator(t *testing.T) (ledger.PeerLedger, Validator) {
 	vcs := struct {
 		*mocktxvalidator.Support
 		*semaphore.Weighted
-	}{&mocktxvalidator.Support{LedgerVal: theLedger, ACVal: &mockconfig.MockApplicationCapabilities{}}, semaphore.NewWeighted(10)}
+	}{&mocktxvalidator.Support{LedgerVal: theLedger, ACVal: cpb}, semaphore.NewWeighted(10)}
 	theValidator := NewTxValidator(vcs)
 
 	return theLedger, theValidator
@@ -209,6 +213,46 @@ func TestInvokeOK(t *testing.T) {
 	assertValid(b, t)
 }
 
+func TestInvokeNoRWSet(t *testing.T) {
+	t.Run("Pre-1.2Capability", func(t *testing.T) {
+		l, v := setupLedgerAndValidator(t)
+		defer ledgermgmt.CleanupTestEnv()
+		defer l.Close()
+
+		ccID := "mycc"
+
+		putCCInfo(l, ccID, signedByAnyMember([]string{"SampleOrg"}), t)
+
+		tx := getEnv(ccID, createRWset(t), t)
+		b := &common.Block{Data: &common.BlockData{Data: [][]byte{utils.MarshalOrPanic(tx)}}}
+
+		v.(*txValidator).vscc.(*vsccValidatorImpl).ccprovider.(*ccprovider.MockCcProviderImpl).ExecuteResultProvider = nil
+		v.(*txValidator).vscc.(*vsccValidatorImpl).ccprovider.(*ccprovider.MockCcProviderImpl).ExecuteChaincodeResponse = &peer.Response{Status: shim.ERROR}
+		err := v.Validate(b)
+		assert.NoError(t, err)
+		assertValid(b, t)
+	})
+
+	t.Run("Post-1.2Capability", func(t *testing.T) {
+		l, v := setupLedgerAndValidatorExplicit(t, &mockconfig.MockApplicationCapabilities{V1_2ValidationRv: true})
+		defer ledgermgmt.CleanupTestEnv()
+		defer l.Close()
+
+		ccID := "mycc"
+
+		putCCInfo(l, ccID, signedByAnyMember([]string{"SampleOrg"}), t)
+
+		tx := getEnv(ccID, createRWset(t), t)
+		b := &common.Block{Data: &common.BlockData{Data: [][]byte{utils.MarshalOrPanic(tx)}}}
+
+		v.(*txValidator).vscc.(*vsccValidatorImpl).ccprovider.(*ccprovider.MockCcProviderImpl).ExecuteResultProvider = nil
+		v.(*txValidator).vscc.(*vsccValidatorImpl).ccprovider.(*ccprovider.MockCcProviderImpl).ExecuteChaincodeResponse = &peer.Response{Status: shim.ERROR}
+		err := v.Validate(b)
+		assert.NoError(t, err)
+		assertInvalid(b, t, peer.TxValidationCode_ENDORSEMENT_POLICY_FAILURE)
+	})
+}
+
 func TestInvokeOKPvtDataOnly(t *testing.T) {
 	l, v := setupLedgerAndValidator(t)
 	defer ledgermgmt.CleanupTestEnv()

core/committer/txvalidator/vscc_validator.go

@@ -73,7 +73,6 @@ func (v *vsccValidatorImpl) VSCCValidateTx(payload *common.Payload, envBytes []b
 	   1) which namespaces does it write to?
 	   2) does it write to LSCC's namespace?
 	   3) does it write to any cc that cannot be invoked? */
-	wrNamespace := []string{}
 	writesToLSCC := false
 	writesToNonInvokableSCC := false
 	respPayload, err := utils.GetActionFromEnvelope(envBytes)
@@ -84,23 +83,6 @@ func (v *vsccValidatorImpl) VSCCValidateTx(payload *common.Payload, envBytes []b
 	if err = txRWSet.FromProtoBytes(respPayload.Results); err != nil {
 		return errors.WithMessage(err, "txRWSet.FromProtoBytes failed"), peer.TxValidationCode_BAD_RWSET
 	}
-	for _, ns := range txRWSet.NsRwSets {
-		if v.txWritesToNamespace(ns) {
-			wrNamespace = append(wrNamespace, ns.NameSpace)
-
-			if !writesToLSCC && ns.NameSpace == "lscc" {
-				writesToLSCC = true
-			}
-
-			if !writesToNonInvokableSCC && v.sccprovider.IsSysCCAndNotInvokableCC2CC(ns.NameSpace) {
-				writesToNonInvokableSCC = true
-			}
-
-			if !writesToNonInvokableSCC && v.sccprovider.IsSysCCAndNotInvokableExternal(ns.NameSpace) {
-				writesToNonInvokableSCC = true
-			}
-		}
-	}
 
 	// Verify the header extension and response payload contain the ChaincodeId
 	if hdrExt.ChaincodeId == nil {
@@ -133,6 +115,36 @@ func (v *vsccValidatorImpl) VSCCValidateTx(payload *common.Payload, envBytes []b
 		return err, peer.TxValidationCode_INVALID_OTHER_REASON
 	}
 
+	var wrNamespace []string
+	alwaysEnforceOriginalNamespace := v.support.Capabilities().V1_2Validation()
+	if alwaysEnforceOriginalNamespace {
+		wrNamespace = append(wrNamespace, ccID)
+	}
+
+	for _, ns := range txRWSet.NsRwSets {
+		if !v.txWritesToNamespace(ns) {
+			continue
+		}
+
+		// Check to make sure we did not already populate this chaincode
+		// name to avoid checking the same namespace twice
+		if ns.NameSpace != ccID || !alwaysEnforceOriginalNamespace {
+			wrNamespace = append(wrNamespace, ns.NameSpace)
+		}
+
+		if !writesToLSCC && ns.NameSpace == "lscc" {
+			writesToLSCC = true
+		}
+
+		if !writesToNonInvokableSCC && v.sccprovider.IsSysCCAndNotInvokableCC2CC(ns.NameSpace) {
+			writesToNonInvokableSCC = true
+		}
+
+		if !writesToNonInvokableSCC && v.sccprovider.IsSysCCAndNotInvokableExternal(ns.NameSpace) {
+			writesToNonInvokableSCC = true
+		}
+	}
+
 	// we've gathered all the info required to proceed to validation;
 	// validation will behave differently depending on the type of
 	// chaincode (system vs. application)
@@ -252,6 +264,7 @@ func (v *vsccValidatorImpl) VSCCValidateTxForCC(envBytes []byte, txid, chid, vsc
 		msg := fmt.Sprintf("Invoke VSCC failed for transaction txid=%s, error: %s", txid, err)
 		return &commonerrors.VSCCExecutionFailureError{msg}
 	}
+
 	if res.Status != shim.OK {
 		return &commonerrors.VSCCEndorsementPolicyError{fmt.Sprintf("%s", res.Message)}
 	}