Skip to content

Commit 99f788d

Browse files
author
Jason Yellick
committedMay 15, 2018
FAB-10046 Respect LSCC GETCHAINCODES ACL
The GETCHAINCODES call is currently erroneously using the local default ACL rather than the channel scoped ACL. This CR adds it to the configtx.yaml and fixes the LSCC code to respect it. Change-Id: Ic09d41df5f0124d7d6b36b4ad77faa711dfea43c Signed-off-by: Jason Yellick <jyellick@us.ibm.com>
1 parent 02963f0 commit 99f788d

File tree

3 files changed

+40
-39
lines changed

3 files changed

+40
-39
lines changed
 

‎core/scc/lscc/lscc.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -780,8 +780,7 @@ func (lscc *lifeCycleSysCC) Invoke(stub shim.ChaincodeStubInterface) pb.Response
780780
return shim.Error(InvalidArgsLenErr(len(args)).Error())
781781
}
782782

783-
// 2. check local MSP Admins policy
784-
if err = lscc.policyChecker.CheckPolicyNoChannel(mgmt.Admins, sp); err != nil {
783+
if err = lscc.aclProvider.CheckACL(resources.Lscc_GetInstantiatedChaincodes, stub.GetChannelID(), sp); err != nil {
785784
return shim.Error(fmt.Sprintf("Authorization for GETCHAINCODES on channel %s has been denied with error %s", args[0], err))
786785
}
787786

‎core/scc/lscc/lscc_test.go

+14-15
Original file line numberDiff line numberDiff line change
@@ -331,6 +331,7 @@ func testDeploy(t *testing.T, ccname string, version string, path string, forceB
331331
res := stub.MockInit("1", nil)
332332
assert.Equal(t, res.Status, int32(shim.OK), res.Message)
333333
}
334+
stub.ChannelID = chainid
334335

335336
identityDeserializer := &policymocks.MockIdentityDeserializer{[]byte("Alice"), []byte("msg1")}
336337
policyManagerGetter := &policymocks.MockChannelPolicyManagerGetter{
@@ -343,7 +344,7 @@ func testDeploy(t *testing.T, ccname string, version string, path string, forceB
343344
identityDeserializer,
344345
&policymocks.MockMSPPrincipalGetter{Principal: []byte("Alice")},
345346
)
346-
sProp, _ := utils.MockSignedEndorserProposalOrPanic("", &pb.ChaincodeSpec{}, []byte("Alice"), []byte("msg1"))
347+
sProp, _ := utils.MockSignedEndorserProposalOrPanic(chainid, &pb.ChaincodeSpec{}, []byte("Alice"), []byte("msg1"))
347348
identityDeserializer.Msg = sProp.ProposalBytes
348349
sProp.Signature = sProp.ProposalBytes
349350

@@ -374,6 +375,8 @@ func testDeploy(t *testing.T, ccname string, version string, path string, forceB
374375
if expectedErrorMsg == "" {
375376
assert.Equal(t, res.Status, int32(shim.OK), res.Message)
376377

378+
mockAclProvider.Reset()
379+
mockAclProvider.On("CheckACL", resources.Lscc_GetInstantiatedChaincodes, chainid, sProp).Return(nil)
377380
args = [][]byte{[]byte(GETCHAINCODES)}
378381
res = stub.MockInvokeWithSignedProposal("1", args, sProp)
379382
assert.Equal(t, res.Status, int32(shim.OK), res.Message)
@@ -649,29 +652,25 @@ func TestGETCHAINCODES(t *testing.T) {
649652
scc := New(NewMockProvider(), mockAclProvider)
650653
scc.support = &lscc.MockSupport{}
651654
stub := shim.NewMockStub("lscc", scc)
655+
stub.ChannelID = "test"
652656
res := stub.MockInit("1", nil)
653657
assert.Equal(t, res.Status, int32(shim.OK), res.Message)
654658

655659
res = stub.MockInvokeWithSignedProposal("1", [][]byte{[]byte(GETCHAINCODES), []byte("barf")}, nil)
656660
assert.NotEqual(t, res.Status, int32(shim.OK), res.Message)
657661

658-
identityDeserializer := &policymocks.MockIdentityDeserializer{[]byte("Alice"), []byte("msg1")}
659-
policyManagerGetter := &policymocks.MockChannelPolicyManagerGetter{
660-
Managers: map[string]policies.Manager{
661-
"test": &policymocks.MockChannelPolicyManager{MockPolicy: &policymocks.MockPolicy{Deserializer: identityDeserializer}},
662-
},
663-
}
664-
scc.policyChecker = policy.NewPolicyChecker(
665-
policyManagerGetter,
666-
identityDeserializer,
667-
&policymocks.MockMSPPrincipalGetter{Principal: []byte("Alice")},
668-
)
669-
sProp, _ := utils.MockSignedEndorserProposalOrPanic("", &pb.ChaincodeSpec{}, []byte("Bob"), []byte("msg1"))
670-
identityDeserializer.Msg = sProp.ProposalBytes
662+
sProp, _ := utils.MockSignedEndorserProposalOrPanic("test", &pb.ChaincodeSpec{}, []byte("Bob"), []byte("msg1"))
671663
sProp.Signature = sProp.ProposalBytes
672664

673-
res = stub.MockInvokeWithSignedProposal("1", [][]byte{[]byte(GETCHAINCODES)}, nil)
665+
mockAclProvider.Reset()
666+
mockAclProvider.On("CheckACL", resources.Lscc_GetInstantiatedChaincodes, "test", sProp).Return(errors.New("ACL Error"))
667+
res = stub.MockInvokeWithSignedProposal("1", [][]byte{[]byte(GETCHAINCODES)}, sProp)
674668
assert.NotEqual(t, res.Status, int32(shim.OK), res.Message)
669+
670+
mockAclProvider.Reset()
671+
mockAclProvider.On("CheckACL", resources.Lscc_GetInstantiatedChaincodes, "test", sProp).Return(nil)
672+
res = stub.MockInvokeWithSignedProposal("1", [][]byte{[]byte(GETCHAINCODES)}, sProp)
673+
assert.Equal(t, res.Status, int32(shim.OK), res.Message)
675674
}
676675

677676
func TestGETINSTALLEDCHAINCODES(t *testing.T) {

‎sampleconfig/configtx.yaml

+25-22
Original file line numberDiff line numberDiff line change
@@ -328,68 +328,71 @@ Orderer: &OrdererDefaults
328328
################################################################################
329329
Application: &ApplicationDefaults
330330
ACLs: &ACLsDefault
331-
#This section provides defaults for policies for various resources
332-
#in the system. These "resources" could be functions on system chaincodes
333-
#(e.g., "GetBlockByNumber" on the "qscc" system chaincode) or other resources
334-
#(e.g.,who can receive Block events). This section does NOT specify the resource's
335-
#definition or API, but just the ACL policy for it.
331+
# This section provides defaults for policies for various resources
332+
# in the system. These "resources" could be functions on system chaincodes
333+
# (e.g., "GetBlockByNumber" on the "qscc" system chaincode) or other resources
334+
# (e.g.,who can receive Block events). This section does NOT specify the resource's
335+
# definition or API, but just the ACL policy for it.
336336
#
337-
#User's can override these defaults with their own policy mapping by defining the
338-
#mapping under ACLs in their channel definition
337+
# User's can override these defaults with their own policy mapping by defining the
338+
# mapping under ACLs in their channel definition
339339

340340
#---Lifecycle System Chaincode (lscc) function to policy mapping for access control---#
341341

342-
#ACL policy for lscc's "getid" function
342+
# ACL policy for lscc's "getid" function
343343
lscc/ChaincodeExists: /Channel/Application/Readers
344344

345-
#ACL policy for lscc's "getdepspec" function
345+
# ACL policy for lscc's "getdepspec" function
346346
lscc/GetDeploymentSpec: /Channel/Application/Readers
347347

348-
#ACL policy for lscc's "getccdata" function
348+
# ACL policy for lscc's "getccdata" function
349349
lscc/GetChaincodeData: /Channel/Application/Readers
350350

351+
# ACL Policy for lscc's "getchaincodes" function
352+
lscc/GetInstantiatedChaincodes: /Channel/Application/Readers
353+
351354
#---Query System Chaincode (qscc) function to policy mapping for access control---#
352355

353-
#ACL policy for qscc's "GetChainInfo" function
356+
# ACL policy for qscc's "GetChainInfo" function
354357
qscc/GetChainInfo: /Channel/Application/Readers
355358

356-
#ACL policy for qscc's "GetBlockByNumber" function
359+
# ACL policy for qscc's "GetBlockByNumber" function
357360
qscc/GetBlockByNumber: /Channel/Application/Readers
358361

359-
#ACL policy for qscc's "GetBlockByHash" function
362+
# ACL policy for qscc's "GetBlockByHash" function
360363
qscc/GetBlockByHash: /Channel/Application/Readers
361364

362-
#ACL policy for qscc's "GetTransactionByID" function
365+
# ACL policy for qscc's "GetTransactionByID" function
363366
qscc/GetTransactionByID: /Channel/Application/Readers
364367

365-
#ACL policy for qscc's "GetBlockByTxID" function
368+
# ACL policy for qscc's "GetBlockByTxID" function
366369
qscc/GetBlockByTxID: /Channel/Application/Readers
367370

368371
#---Configuration System Chaincode (cscc) function to policy mapping for access control---#
369372

370-
#ACL policy for cscc's "GetConfigBlock" function
373+
# ACL policy for cscc's "GetConfigBlock" function
371374
cscc/GetConfigBlock: /Channel/Application/Readers
372375

373-
#ACL policy for cscc's "GetConfigTree" function
376+
# ACL policy for cscc's "GetConfigTree" function
374377
cscc/GetConfigTree: /Channel/Application/Readers
375378

376-
#ACL policy for cscc's "SimulateConfigTreeUpdate" function
379+
# ACL policy for cscc's "SimulateConfigTreeUpdate" function
377380
cscc/SimulateConfigTreeUpdate: /Channel/Application/Writers
378381

379382
#---Miscellanesous peer function to policy mapping for access control---#
380383

381-
#ACL policy for invoking chaincodes on peer
384+
# ACL policy for invoking chaincodes on peer
382385
peer/Propose: /Channel/Application/Writers
383386

384-
#ACL policy for chaincode to chaincode invocation
387+
# ACL policy for chaincode to chaincode invocation
385388
peer/ChaincodeToChaincode: /Channel/Application/Readers
386389

387390
#---Events resource to policy mapping for access control###---#
388391

389-
#ACL policy for sending block events
392+
# ACL policy for sending block events
390393
event/Block: /Channel/Application/Readers
391394

392-
#ACL policy for sending filtered block events
395+
# ACL policy for sending filtered block events
393396
event/FilteredBlock: /Channel/Application/Readers
394397

395398
# Organizations lists the orgs participating on the application side of the

0 commit comments

Comments
 (0)