[FAB-11769] validate cc ns change for meta writes

Currently, transactions are validated by a validation plugin for a namespace
if they write to keys into that namespace. More specifically, if the write
set is not the empty set for that namespace. With state-based endorsement,
this conditions should be changed to ensure that transactions that only modify
metadata in a namespace also undergo validation.

Change-Id: I89009ecb4a08510e9b1f2deb2c2b9b7ec7c9f7bf
Signed-off-by: Alessandro Sorniotti <ale.linux@sopit.net>
Signed-off-by: Matthias Neugschwandtner <eug@zurich.ibm.com>

Author: ale-linux

core/committer/txvalidator/validator_test.go

@@ -402,6 +402,77 @@ func TestInvokeOKPvtDataOnly(t *testing.T) {
 	assertInvalid(b, t, peer.TxValidationCode_ENDORSEMENT_POLICY_FAILURE)
 }
 
+func TestInvokeOKMetaUpdateOnly(t *testing.T) {
+	plugin := &mocks.Plugin{}
+	plugin.On("Init", mock.Anything, mock.Anything, mock.Anything).Return(nil)
+
+	l, v := setupLedgerAndValidatorExplicit(t, &mockconfig.MockApplicationCapabilities{}, plugin)
+	defer ledgermgmt.CleanupTestEnv()
+	defer l.Close()
+
+	v.(*txvalidator.TxValidator).Support.(struct {
+		*mocktxvalidator.Support
+		*semaphore.Weighted
+	}).ACVal = &mockconfig.MockApplicationCapabilities{KeyLevelEndorsementRv: true}
+
+	ccID := "mycc"
+
+	putCCInfo(l, ccID, signedByAnyMember([]string{"SampleOrg"}), t)
+
+	rwsetBuilder := rwsetutil.NewRWSetBuilder()
+	rwsetBuilder.AddToMetadataWriteSet(ccID, "somekey", map[string][]byte{})
+	rwset, err := rwsetBuilder.GetTxSimulationResults()
+	assert.NoError(t, err)
+	rwsetBytes, err := rwset.GetPubSimulationBytes()
+	assert.NoError(t, err)
+
+	tx := getEnv(ccID, nil, rwsetBytes, t)
+	b := &common.Block{Data: &common.BlockData{Data: [][]byte{utils.MarshalOrPanic(tx)}}}
+
+	plugin.On("Validate", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(errors.New("tx is invalid"))
+
+	err = v.Validate(b)
+	assert.NoError(t, err)
+	assertInvalid(b, t, peer.TxValidationCode_ENDORSEMENT_POLICY_FAILURE)
+}
+
+func TestInvokeOKPvtMetaUpdateOnly(t *testing.T) {
+	plugin := &mocks.Plugin{}
+	plugin.On("Init", mock.Anything, mock.Anything, mock.Anything).Return(nil)
+
+	l, v := setupLedgerAndValidatorExplicit(t, &mockconfig.MockApplicationCapabilities{}, plugin)
+	defer ledgermgmt.CleanupTestEnv()
+	defer l.Close()
+
+	v.(*txvalidator.TxValidator).Support.(struct {
+		*mocktxvalidator.Support
+		*semaphore.Weighted
+	}).ACVal = &mockconfig.MockApplicationCapabilities{
+		KeyLevelEndorsementRv: true,
+		PrivateChannelDataRv:  true,
+	}
+
+	ccID := "mycc"
+
+	putCCInfo(l, ccID, signedByAnyMember([]string{"SampleOrg"}), t)
+
+	rwsetBuilder := rwsetutil.NewRWSetBuilder()
+	rwsetBuilder.AddToHashedMetadataWriteSet(ccID, "mycollection", "somekey", map[string][]byte{})
+	rwset, err := rwsetBuilder.GetTxSimulationResults()
+	assert.NoError(t, err)
+	rwsetBytes, err := rwset.GetPubSimulationBytes()
+	assert.NoError(t, err)
+
+	tx := getEnv(ccID, nil, rwsetBytes, t)
+	b := &common.Block{Data: &common.BlockData{Data: [][]byte{utils.MarshalOrPanic(tx)}}}
+
+	plugin.On("Validate", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(errors.New("tx is invalid"))
+
+	err = v.Validate(b)
+	assert.NoError(t, err)
+	assertInvalid(b, t, peer.TxValidationCode_ENDORSEMENT_POLICY_FAILURE)
+}
+
 func TestInvokeOKSCC(t *testing.T) {
 	l, v := setupLedgerAndValidator(t)
 	defer ledgermgmt.CleanupTestEnv()

core/committer/txvalidator/vscc_validator.go

@@ -362,14 +362,28 @@ func (v *VsccValidatorImpl) txWritesToNamespace(ns *rwsetutil.NsRwSet) bool {
 		return true
 	}
 
-	// do not look at collection data if we don't support that capability
-	if !v.support.Capabilities().PrivateChannelData() {
-		return false
+	// only look at collection data if we support that capability
+	if v.support.Capabilities().PrivateChannelData() {
+		// check for private writes for all collections
+		for _, c := range ns.CollHashedRwSets {
+			if c.HashedRwSet != nil && len(c.HashedRwSet.HashedWrites) > 0 {
+				return true
+			}
+
+			// only look at private metadata writes if we support that capability
+			if v.support.Capabilities().KeyLevelEndorsement() {
+				// private metadata updates
+				if c.HashedRwSet != nil && len(c.HashedRwSet.MetadataWrites) > 0 {
+					return true
+				}
+			}
+		}
 	}
 
-	// check for private writes for all collections
-	for _, c := range ns.CollHashedRwSets {
-		if c.HashedRwSet != nil && len(c.HashedRwSet.HashedWrites) > 0 {
+	// only look at metadata writes if we support that capability
+	if v.support.Capabilities().KeyLevelEndorsement() {
+		// public metadata updates
+		if ns.KvRwSet != nil && len(ns.KvRwSet.MetadataWrites) > 0 {
 			return true
 		}
 	}