Skip to content

Commit 469dd2f

Browse files
wlahtiwlahti
committed
[FAB-10466] Function test for syscc ACL via query
This CR adds function tests for system chaincode ACL policies by querying. It also modifies a few of the returned error messages to make them consistent with the other system chaincode ACL error messages. Change-Id: I7c58ae779e531c7e98078e21796165df102abeb6 Signed-off-by: Will Lahti <wtlahti@us.ibm.com>
1 parent bfb4b0f commit 469dd2f

File tree

6 files changed

+190
-64
lines changed

6 files changed

+190
-64
lines changed

‎core/scc/cscc/configure.go

+5-6
Original file line numberDiff line numberDiff line change
@@ -142,8 +142,7 @@ func (e *PeerConfiger) InvokeNoShim(args [][]byte, sp *pb.SignedProposal) pb.Res
142142
// 2. check local MSP Admins policy
143143
// TODO: move to ACLProvider once it will support chainless ACLs
144144
if err = e.policyChecker.CheckPolicyNoChannel(mgmt.Admins, sp); err != nil {
145-
return shim.Error(fmt.Sprintf("\"JoinChain\" request failed authorization check "+
146-
"for channel [%s]: [%s]", cid, err))
145+
return shim.Error(fmt.Sprintf("access denied for [%s][%s]: [%s]", fname, cid, err))
147146
}
148147

149148
// Initialize txsFilter if it does not yet exist. We can do this safely since
@@ -159,28 +158,28 @@ func (e *PeerConfiger) InvokeNoShim(args [][]byte, sp *pb.SignedProposal) pb.Res
159158
case GetConfigBlock:
160159
// 2. check policy
161160
if err = e.aclProvider.CheckACL(resources.Cscc_GetConfigBlock, string(args[1]), sp); err != nil {
162-
return shim.Error(fmt.Sprintf("\"GetConfigBlock\" request failed authorization check for channel [%s]: [%s]", args[1], err))
161+
return shim.Error(fmt.Sprintf("access denied for [%s][%s]: %s", fname, args[1], err))
163162
}
164163

165164
return getConfigBlock(args[1])
166165
case GetConfigTree:
167166
// 2. check policy
168167
if err = e.aclProvider.CheckACL(resources.Cscc_GetConfigTree, string(args[1]), sp); err != nil {
169-
return shim.Error(fmt.Sprintf("\"GetConfigTree\" request failed authorization check for channel [%s]: [%s]", args[1], err))
168+
return shim.Error(fmt.Sprintf("access denied for [%s][%s]: %s", fname, args[1], err))
170169
}
171170

172171
return e.getConfigTree(args[1])
173172
case SimulateConfigTreeUpdate:
174173
// Check policy
175174
if err = e.aclProvider.CheckACL(resources.Cscc_SimulateConfigTreeUpdate, string(args[1]), sp); err != nil {
176-
return shim.Error(fmt.Sprintf("\"SimulateConfigTreeUpdate\" request failed authorization check for channel [%s]: [%s]", args[1], err))
175+
return shim.Error(fmt.Sprintf("access denied for [%s][%s]: %s", fname, args[1], err))
177176
}
178177
return e.simulateConfigTreeUpdate(args[1], args[2])
179178
case GetChannels:
180179
// 2. check local MSP Members policy
181180
// TODO: move to ACLProvider once it will support chainless ACLs
182181
if err = e.policyChecker.CheckPolicyNoChannel(mgmt.Members, sp); err != nil {
183-
return shim.Error(fmt.Sprintf("\"GetChannels\" request failed authorization check: [%s]", err))
182+
return shim.Error(fmt.Sprintf("access denied for [%s]: %s", fname, err))
184183
}
185184

186185
return getChannels()

‎core/scc/cscc/configure_test.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ func TestConfigerInvokeInvalidParameters(t *testing.T) {
136136
args := [][]byte{[]byte("GetChannels")}
137137
res = stub.MockInvokeWithSignedProposal("3", args, nil)
138138
assert.Equal(t, res.Status, int32(shim.ERROR), "CSCC invoke expected to fail no signed proposal provided")
139-
assert.Contains(t, res.Message, "failed authorization check")
139+
assert.Contains(t, res.Message, "access denied for [GetChannels]")
140140

141141
args = [][]byte{[]byte("fooFunction"), []byte("testChainID")}
142142
res = stub.MockInvoke("5", args)
@@ -301,7 +301,7 @@ func TestConfigerInvokeJoinChainCorrectParams(t *testing.T) {
301301
if res.Status == shim.OK {
302302
t.Fatalf("cscc invoke JoinChain must fail : %v", res.Message)
303303
}
304-
assert.Contains(t, res.Message, "\"JoinChain\" request failed authorization check for channel")
304+
assert.Contains(t, res.Message, "access denied for [JoinChain][mytestchainid]")
305305
sProp.Signature = sProp.ProposalBytes
306306

307307
// Query the configuration block
@@ -317,7 +317,7 @@ func TestConfigerInvokeJoinChainCorrectParams(t *testing.T) {
317317
args = [][]byte{[]byte("GetConfigBlock"), []byte(chainID)}
318318
res = stub.MockInvokeWithSignedProposal("2", args, sProp)
319319
if res.Status == shim.OK {
320-
t.Fatalf("cscc invoke GetConfigBlock shoulda have failed: %v", res.Message)
320+
t.Fatalf("cscc invoke GetConfigBlock should have failed: %v", res.Message)
321321
}
322322
assert.Contains(t, res.Message, "Failed authorization")
323323
mockAclProvider.AssertExpectations(t)
@@ -399,7 +399,7 @@ func TestGetConfigTree(t *testing.T) {
399399
aclProvider.CheckACLReturns(fmt.Errorf("fake-error"))
400400
res := pc.InvokeNoShim(args, nil)
401401
assert.NotEqual(t, int32(shim.OK), res.Status)
402-
assert.Equal(t, "\"GetConfigTree\" request failed authorization check for channel [testchan]: [fake-error]", res.Message)
402+
assert.Equal(t, "access denied for [GetConfigTree][testchan]: fake-error", res.Message)
403403
})
404404
}
405405

@@ -481,7 +481,7 @@ func TestSimulateConfigTreeUpdate(t *testing.T) {
481481
aclProvider.CheckACLReturns(fmt.Errorf("fake-error"))
482482
res := pc.InvokeNoShim(args, nil)
483483
assert.NotEqual(t, int32(shim.OK), res.Status)
484-
assert.Equal(t, "\"SimulateConfigTreeUpdate\" request failed authorization check for channel [testchan]: [fake-error]", res.Message)
484+
assert.Equal(t, "access denied for [SimulateConfigTreeUpdate][testchan]: fake-error", res.Message)
485485
})
486486
}
487487

‎core/scc/lscc/lscc.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -742,7 +742,7 @@ func (lscc *lifeCycleSysCC) Invoke(stub shim.ChaincodeStubInterface) pb.Response
742742

743743
// 2. check local MSP Admins policy
744744
if err = lscc.policyChecker.CheckPolicyNoChannel(mgmt.Admins, sp); err != nil {
745-
return shim.Error(fmt.Sprintf("Authorization for INSTALL has been denied (error-%s)", err))
745+
return shim.Error(fmt.Sprintf("access denied for [%s]: %s", function, err))
746746
}
747747

748748
depSpec := args[1]
@@ -849,12 +849,12 @@ func (lscc *lifeCycleSysCC) Invoke(stub shim.ChaincodeStubInterface) pb.Response
849849
resource = resources.Lscc_GetChaincodeData
850850
}
851851
if err = lscc.aclProvider.CheckACL(resource, channel, sp); err != nil {
852-
return shim.Error(fmt.Sprintf("Authorization request failed %s: %s", channel, err))
852+
return shim.Error(fmt.Sprintf("access denied for [%s][%s]: %s", function, channel, err))
853853
}
854854

855855
cdbytes, err := lscc.getCCInstance(stub, ccname)
856856
if err != nil {
857-
logger.Errorf("error getting chaincode %s on channel: %s(err:%s)", ccname, channel, err)
857+
logger.Errorf("error getting chaincode %s on channel [%s]: %s", ccname, channel, err)
858858
return shim.Error(err.Error())
859859
}
860860

@@ -880,7 +880,7 @@ func (lscc *lifeCycleSysCC) Invoke(stub shim.ChaincodeStubInterface) pb.Response
880880
}
881881

882882
if err = lscc.aclProvider.CheckACL(resources.Lscc_GetInstantiatedChaincodes, stub.GetChannelID(), sp); err != nil {
883-
return shim.Error(fmt.Sprintf("Authorization for GETCHAINCODES on channel %s has been denied with error %s", args[0], err))
883+
return shim.Error(fmt.Sprintf("access denied for [%s][%s]: %s", function, stub.GetChannelID(), err))
884884
}
885885

886886
return lscc.getChaincodes(stub)
@@ -891,7 +891,7 @@ func (lscc *lifeCycleSysCC) Invoke(stub shim.ChaincodeStubInterface) pb.Response
891891

892892
// 2. check local MSP Admins policy
893893
if err = lscc.policyChecker.CheckPolicyNoChannel(mgmt.Admins, sp); err != nil {
894-
return shim.Error(fmt.Sprintf("Authorization for GETINSTALLEDCHAINCODES on channel %s has been denied with error %s", args[0], err))
894+
return shim.Error(fmt.Sprintf("access denied for [%s]: %s", function, err))
895895
}
896896

897897
return lscc.getInstalledChaincodes()

‎core/scc/lscc/lscc_test.go

+18-16
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ func TestInstall(t *testing.T) {
124124
testInstall(t, "", "0", path, false, EmptyChaincodeNameErr("").Error(), "Alice", scc, stub)
125125
testInstall(t, "example02", "1{}0", path, false, InvalidVersionErr("1{}0").Error(), "Alice", scc, stub)
126126
testInstall(t, "example02", "0", path, true, InvalidStatedbArtifactsErr("").Error(), "Alice", scc, stub)
127-
testInstall(t, "example02", "0", path, false, "Authorization for INSTALL has been denied", "Bob", scc, stub)
127+
testInstall(t, "example02", "0", path, false, "access denied for [install]", "Bob", scc, stub)
128128
testInstall(t, "example02-2", "1.0-alpha+001", path, false, "", "Alice", scc, stub)
129129
testInstall(t, "example02-2", "1.0+sha.c0ffee", path, false, "", "Alice", scc, stub)
130130

@@ -640,21 +640,23 @@ func TestFunctionsWithAliases(t *testing.T) {
640640
sProp.Signature = sProp.ProposalBytes
641641

642642
testInvoke := func(function, resource string) {
643-
res = stub.MockInvokeWithSignedProposal("1", [][]byte{[]byte(function), []byte("testchannel1")}, nil)
644-
assert.NotEqual(t, int32(shim.OK), res.Status)
645-
assert.Equal(t, "invalid number of arguments to lscc: 2", res.Message)
643+
t.Run(function, func(t *testing.T) {
644+
res = stub.MockInvokeWithSignedProposal("1", [][]byte{[]byte(function), []byte("testchannel1")}, nil)
645+
assert.NotEqual(t, int32(shim.OK), res.Status)
646+
assert.Equal(t, "invalid number of arguments to lscc: 2", res.Message)
646647

647-
mockAclProvider.Reset()
648-
mockAclProvider.On("CheckACL", resource, "testchannel1", sProp).Return(errors.New("bonanza"))
649-
res = stub.MockInvokeWithSignedProposal("1", [][]byte{[]byte(function), []byte("testchannel1"), []byte("chaincode")}, sProp)
650-
assert.NotEqual(t, int32(shim.OK), res.Status, res.Message)
651-
assert.Contains(t, res.Message, "Authorization request failed testchannel1: bonanza")
648+
mockAclProvider.Reset()
649+
mockAclProvider.On("CheckACL", resource, "testchannel1", sProp).Return(errors.New("bonanza"))
650+
res = stub.MockInvokeWithSignedProposal("1", [][]byte{[]byte(function), []byte("testchannel1"), []byte("chaincode")}, sProp)
651+
assert.NotEqual(t, int32(shim.OK), res.Status, res.Message)
652+
assert.Equal(t, fmt.Sprintf("access denied for [%s][testchannel1]: bonanza", function), res.Message)
652653

653-
mockAclProvider.Reset()
654-
mockAclProvider.On("CheckACL", resource, "testchannel1", sProp).Return(nil)
655-
res = stub.MockInvokeWithSignedProposal("1", [][]byte{[]byte(function), []byte("testchannel1"), []byte("nonexistentchaincode")}, sProp)
656-
assert.NotEqual(t, int32(shim.OK), res.Status, res.Message)
657-
assert.Equal(t, res.Message, "could not find chaincode with name 'nonexistentchaincode'")
654+
mockAclProvider.Reset()
655+
mockAclProvider.On("CheckACL", resource, "testchannel1", sProp).Return(nil)
656+
res = stub.MockInvokeWithSignedProposal("1", [][]byte{[]byte(function), []byte("testchannel1"), []byte("nonexistentchaincode")}, sProp)
657+
assert.NotEqual(t, int32(shim.OK), res.Status, res.Message)
658+
assert.Equal(t, res.Message, "could not find chaincode with name 'nonexistentchaincode'")
659+
})
658660
}
659661

660662
testInvoke("getid", "lscc/ChaincodeExists")
@@ -686,7 +688,7 @@ func TestGetChaincodes(t *testing.T) {
686688
mockAclProvider.On("CheckACL", resources.Lscc_GetInstantiatedChaincodes, "test", sProp).Return(errors.New("coyote"))
687689
res = stub.MockInvokeWithSignedProposal("1", [][]byte{[]byte(function)}, sProp)
688690
assert.NotEqual(t, int32(shim.OK), res.Status)
689-
assert.Regexp(t, "Authorization for GETCHAINCODES on channel(.*)coyote", res.Message)
691+
assert.Regexp(t, `access denied for \[`+function+`\]\[test\](.*)coyote`, res.Message)
690692

691693
mockAclProvider.Reset()
692694
mockAclProvider.On("CheckACL", resources.Lscc_GetInstantiatedChaincodes, "test", sProp).Return(nil)
@@ -726,7 +728,7 @@ func TestGetInstalledChaincodes(t *testing.T) {
726728

727729
res = stub.MockInvokeWithSignedProposal("1", [][]byte{[]byte(function)}, sProp)
728730
assert.NotEqual(t, int32(shim.OK), res.Status)
729-
assert.Contains(t, res.Message, "Authorization for GETINSTALLEDCHAINCODES")
731+
assert.Contains(t, res.Message, "access denied for ["+function+"]")
730732

731733
sProp, _ = utils.MockSignedEndorserProposalOrPanic("", &pb.ChaincodeSpec{}, []byte("Alice"), []byte("msg1"))
732734
identityDeserializer.Msg = sProp.ProposalBytes

‎core/scc/qscc/query.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ func (e *LedgerQuerier) Invoke(stub shim.ChaincodeStubInterface) pb.Response {
9494
// 2. check the channel reader policy
9595
res := getACLResource(fname)
9696
if err = e.aclProvider.CheckACL(res, cid, sp); err != nil {
97-
return shim.Error(fmt.Sprintf("Authorization request for [%s][%s] failed: [%s]", fname, cid, err))
97+
return shim.Error(fmt.Sprintf("access denied for [%s][%s]: [%s]", fname, cid, err))
9898
}
9999

100100
switch fname {

0 commit comments

Comments
 (0)