Skip to content

Commit 25f5be1

Browse files
author
Jason Yellick
committed
[FAB-9255] configtxgen encode policy specs
This CR modifies the encoder for `configtxgen` to generate policies as provided by configtx.yaml instead of the default policies. It also marks the default policy generation as deprecated and emits a warning when used. Change-Id: I7dc5524e3f34767acb06523068047d0ace7a22a4 Signed-off-by: Jason Yellick <jyellick@us.ibm.com>
1 parent f519714 commit 25f5be1

File tree

3 files changed

+120
-6
lines changed

3 files changed

+120
-6
lines changed

‎common/tools/configtxgen/encoder/encoder.go

Lines changed: 83 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,12 @@ const (
5151

5252
// OrdererAdminsPolicy is the absolute path to the orderer admins policy
5353
OrdererAdminsPolicy = "/Channel/Orderer/Admins"
54+
55+
// SignaturePolicyType is the 'Type' string for signature policies
56+
SignaturePolicyType = "Signature"
57+
58+
// ImplicitMetaPolicyType is the 'Type' string for implicit meta policies
59+
ImplicitMetaPolicyType = "ImplicitMeta"
5460
)
5561

5662
func addValue(cg *cb.ConfigGroup, value channelconfig.ConfigValue, modPolicy string) {
@@ -67,6 +73,40 @@ func addPolicy(cg *cb.ConfigGroup, policy policies.ConfigPolicy, modPolicy strin
6773
}
6874
}
6975

76+
func addPolicies(cg *cb.ConfigGroup, policyMap map[string]*genesisconfig.Policy, modPolicy string) error {
77+
for policyName, policy := range policyMap {
78+
switch policy.Type {
79+
case ImplicitMetaPolicyType:
80+
imp, err := policies.ImplicitMetaFromString(policy.Rule)
81+
if err != nil {
82+
return errors.Wrapf(err, "invalid implicit meta policy rule '%s'", policy.Rule)
83+
}
84+
cg.Policies[policyName] = &cb.ConfigPolicy{
85+
ModPolicy: modPolicy,
86+
Policy: &cb.Policy{
87+
Type: int32(cb.Policy_IMPLICIT_META),
88+
Value: utils.MarshalOrPanic(imp),
89+
},
90+
}
91+
case SignaturePolicyType:
92+
sp, err := cauthdsl.FromString(policy.Rule)
93+
if err != nil {
94+
return errors.Wrapf(err, "invalid signature policy rule '%s'", policy.Rule)
95+
}
96+
cg.Policies[policyName] = &cb.ConfigPolicy{
97+
ModPolicy: modPolicy,
98+
Policy: &cb.Policy{
99+
Type: int32(cb.Policy_SIGNATURE),
100+
Value: utils.MarshalOrPanic(sp),
101+
},
102+
}
103+
default:
104+
return errors.Errorf("unknown policy type: %s", policy.Type)
105+
}
106+
}
107+
return nil
108+
}
109+
70110
// addImplicitMetaPolicyDefaults adds the Readers/Writers/Admins policies, with Any/Any/Majority rules respectively.
71111
func addImplicitMetaPolicyDefaults(cg *cb.ConfigGroup) {
72112
addPolicy(cg, policies.ImplicitMetaMajorityPolicy(channelconfig.AdminsPolicyKey), channelconfig.AdminsPolicyKey)
@@ -79,6 +119,7 @@ func addImplicitMetaPolicyDefaults(cg *cb.ConfigGroup) {
79119
// the admin role principal.
80120
func addSignaturePolicyDefaults(cg *cb.ConfigGroup, mspID string, devMode bool) {
81121
if devMode {
122+
logger.Warningf("Specifying AdminPrincipal is deprecated and will be removed in a future release, override the admin principal with explicit policies.")
82123
addPolicy(cg, policies.SignaturePolicy(channelconfig.AdminsPolicyKey, cauthdsl.SignedByMspMember(mspID)), channelconfig.AdminsPolicyKey)
83124
} else {
84125
addPolicy(cg, policies.SignaturePolicy(channelconfig.AdminsPolicyKey, cauthdsl.SignedByMspAdmin(mspID)), channelconfig.AdminsPolicyKey)
@@ -98,7 +139,15 @@ func NewChannelGroup(conf *genesisconfig.Profile) (*cb.ConfigGroup, error) {
98139
}
99140

100141
channelGroup := cb.NewConfigGroup()
101-
addImplicitMetaPolicyDefaults(channelGroup)
142+
if len(conf.Policies) == 0 {
143+
logger.Warningf("Default policy emission is deprecated, please include policy specificiations for the channel group in configtx.yaml")
144+
addImplicitMetaPolicyDefaults(channelGroup)
145+
} else {
146+
if err := addPolicies(channelGroup, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {
147+
return nil, errors.Wrapf(err, "error adding policies to channel group")
148+
}
149+
}
150+
102151
addValue(channelGroup, channelconfig.HashingAlgorithmValue(), channelconfig.AdminsPolicyKey)
103152
addValue(channelGroup, channelconfig.BlockDataHashingStructureValue(), channelconfig.AdminsPolicyKey)
104153
addValue(channelGroup, channelconfig.OrdererAddressesValue(conf.Orderer.Addresses), ordererAdminsPolicyName)
@@ -140,7 +189,14 @@ func NewChannelGroup(conf *genesisconfig.Profile) (*cb.ConfigGroup, error) {
140189
// It sets the mod_policy of all elements to "Admins". This group is always present in any channel configuration.
141190
func NewOrdererGroup(conf *genesisconfig.Orderer) (*cb.ConfigGroup, error) {
142191
ordererGroup := cb.NewConfigGroup()
143-
addImplicitMetaPolicyDefaults(ordererGroup)
192+
if len(conf.Policies) == 0 {
193+
logger.Warningf("Default policy emission is deprecated, please include policy specificiations for the orderer group in configtx.yaml")
194+
addImplicitMetaPolicyDefaults(ordererGroup)
195+
} else {
196+
if err := addPolicies(ordererGroup, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {
197+
return nil, errors.Wrapf(err, "error adding policies to orderer group")
198+
}
199+
}
144200
ordererGroup.Policies[BlockValidationPolicyKey] = &cb.ConfigPolicy{
145201
Policy: policies.ImplicitMetaAnyPolicy(channelconfig.WritersPolicyKey).Value(),
146202
ModPolicy: channelconfig.AdminsPolicyKey,
@@ -187,7 +243,15 @@ func NewOrdererOrgGroup(conf *genesisconfig.Organization) (*cb.ConfigGroup, erro
187243
}
188244

189245
ordererOrgGroup := cb.NewConfigGroup()
190-
addSignaturePolicyDefaults(ordererOrgGroup, conf.ID, conf.AdminPrincipal != genesisconfig.AdminRoleAdminPrincipal)
246+
if len(conf.Policies) == 0 {
247+
logger.Warningf("Default policy emission is deprecated, please include policy specificiations for the orderer org group %s in configtx.yaml", conf.Name)
248+
addSignaturePolicyDefaults(ordererOrgGroup, conf.ID, conf.AdminPrincipal != genesisconfig.AdminRoleAdminPrincipal)
249+
} else {
250+
if err := addPolicies(ordererOrgGroup, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {
251+
return nil, errors.Wrapf(err, "error adding policies to orderer org group '%s'", conf.Name)
252+
}
253+
}
254+
191255
addValue(ordererOrgGroup, channelconfig.MSPValue(mspConfig), channelconfig.AdminsPolicyKey)
192256

193257
ordererOrgGroup.ModPolicy = channelconfig.AdminsPolicyKey
@@ -198,7 +262,14 @@ func NewOrdererOrgGroup(conf *genesisconfig.Organization) (*cb.ConfigGroup, erro
198262
// in application logic like chaincodes, and how these members may interact with the orderer. It sets the mod_policy of all elements to "Admins".
199263
func NewApplicationGroup(conf *genesisconfig.Application) (*cb.ConfigGroup, error) {
200264
applicationGroup := cb.NewConfigGroup()
201-
addImplicitMetaPolicyDefaults(applicationGroup)
265+
if len(conf.Policies) == 0 {
266+
logger.Warningf("Default policy emission is deprecated, please include policy specificiations for the application group in configtx.yaml")
267+
addImplicitMetaPolicyDefaults(applicationGroup)
268+
} else {
269+
if err := addPolicies(applicationGroup, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {
270+
return nil, errors.Wrapf(err, "error adding policies to application group")
271+
}
272+
}
202273

203274
if len(conf.Capabilities) > 0 {
204275
addValue(applicationGroup, channelconfig.CapabilitiesValue(conf.Capabilities), channelconfig.AdminsPolicyKey)
@@ -225,7 +296,14 @@ func NewApplicationOrgGroup(conf *genesisconfig.Organization) (*cb.ConfigGroup,
225296
}
226297

227298
applicationOrgGroup := cb.NewConfigGroup()
228-
addSignaturePolicyDefaults(applicationOrgGroup, conf.ID, conf.AdminPrincipal != genesisconfig.AdminRoleAdminPrincipal)
299+
if len(conf.Policies) == 0 {
300+
logger.Warningf("Default policy emission is deprecated, please include policy specificiations for the application org group %s in configtx.yaml", conf.Name)
301+
addSignaturePolicyDefaults(applicationOrgGroup, conf.ID, conf.AdminPrincipal != genesisconfig.AdminRoleAdminPrincipal)
302+
} else {
303+
if err := addPolicies(applicationOrgGroup, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {
304+
return nil, errors.Wrapf(err, "error adding policies to application org group %s", conf.Name)
305+
}
306+
}
229307
addValue(applicationOrgGroup, channelconfig.MSPValue(mspConfig), channelconfig.AdminsPolicyKey)
230308

231309
var anchorProtos []*pb.AnchorPeer

‎common/tools/configtxgen/encoder/encoder_test.go

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,17 @@ func TestNewApplicationGroup(t *testing.T) {
196196
assert.NotNil(t, group)
197197
})
198198

199+
t.Run("Application missing policies", func(t *testing.T) {
200+
config := genesisconfig.Load(genesisconfig.SampleSingleMSPChannelProfile)
201+
config.Application.Policies = nil
202+
for _, org := range config.Application.Organizations {
203+
org.Policies = nil
204+
}
205+
group, err := NewApplicationGroup(config.Application)
206+
assert.NoError(t, err)
207+
assert.NotNil(t, group)
208+
})
209+
199210
t.Run("Application unknown MSP", func(t *testing.T) {
200211
config := genesisconfig.Load(genesisconfig.SampleSingleMSPChannelProfile)
201212
config.Application.Organizations[0] = &genesisconfig.Organization{Name: "FakeOrg", ID: "FakeOrg"}
@@ -222,6 +233,14 @@ func TestNewChannelGroup(t *testing.T) {
222233
assert.NotNil(t, group)
223234
})
224235

236+
t.Run("Channel missing policies", func(t *testing.T) {
237+
config := genesisconfig.Load(genesisconfig.SampleDevModeSoloProfile)
238+
config.Policies = nil
239+
group, err := NewChannelGroup(config)
240+
assert.NoError(t, err)
241+
assert.NotNil(t, group)
242+
})
243+
225244
t.Run("Add application unknown MSP", func(t *testing.T) {
226245
config := genesisconfig.Load(genesisconfig.SampleDevModeSoloProfile)
227246
config.Application = &genesisconfig.Application{Organizations: []*genesisconfig.Organization{{Name: "FakeOrg"}}}
@@ -256,6 +275,17 @@ func TestNewOrdererGroup(t *testing.T) {
256275
assert.Nil(t, group)
257276
})
258277

278+
t.Run("Orderer missing policies", func(t *testing.T) {
279+
config := genesisconfig.Load(genesisconfig.SampleDevModeSoloProfile)
280+
config.Orderer.Policies = nil
281+
for _, org := range config.Orderer.Organizations {
282+
org.Policies = nil
283+
}
284+
group, err := NewOrdererGroup(config.Orderer)
285+
assert.NoError(t, err)
286+
assert.NotNil(t, group)
287+
})
288+
259289
t.Run("Unknown MSP org", func(t *testing.T) {
260290
config := genesisconfig.Load(genesisconfig.SampleDevModeSoloProfile)
261291
config.Orderer.Organizations[0] = &genesisconfig.Organization{Name: "FakeOrg", ID: "FakeOrg"}

‎sampleconfig/configtx.yaml

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ Profiles:
8080
Organizations:
8181
- <<: *SampleOrg
8282
Policies:
83+
<<: *SampleOrgPolicies
8384
Admins:
8485
Type: Signature
8586
Rule: "OR('SampleOrg.member')"
@@ -88,6 +89,7 @@ Profiles:
8889
Organizations:
8990
- <<: *SampleOrg
9091
Policies:
92+
<<: *SampleOrgPolicies
9193
Admins:
9294
Type: Signature
9395
Rule: "OR('SampleOrg.member')"
@@ -96,6 +98,7 @@ Profiles:
9698
Organizations:
9799
- <<: *SampleOrg
98100
Policies:
101+
<<: *SampleOrgPolicies
99102
Admins:
100103
Type: Signature
101104
Rule: "OR('SampleOrg.member')"
@@ -110,6 +113,7 @@ Profiles:
110113
Organizations:
111114
- <<: *SampleOrg
112115
Policies:
116+
<<: *SampleOrgPolicies
113117
Admins:
114118
Type: Signature
115119
Rule: "OR('SampleOrg.member')"
@@ -118,6 +122,7 @@ Profiles:
118122
Organizations:
119123
- <<: *SampleOrg
120124
Policies:
125+
<<: *SampleOrgPolicies
121126
Admins:
122127
Type: Signature
123128
Rule: "OR('SampleOrg.member')"
@@ -126,6 +131,7 @@ Profiles:
126131
Organizations:
127132
- <<: *SampleOrg
128133
Policies:
134+
<<: *SampleOrgPolicies
129135
Admins:
130136
Type: Signature
131137
Rule: "OR('SampleOrg.member')"
@@ -170,7 +176,7 @@ Organizations:
170176
# Policies defines the set of policies at this level of the config tree
171177
# For organization policies, their canonical path is usually
172178
# /Channel/<Application|Orderer>/<OrgName>/<PolicyName>
173-
Policies:
179+
Policies: &SampleOrgPolicies
174180
Readers:
175181
Type: Signature
176182
Rule: "OR('SampleOrg.member')"

0 commit comments

Comments
 (0)