LFD272 BUG: await ctx.stub.setStateValidationParameter() error. It freezes the channel.

davidfdr

Hi. I try to force an error to test the ctx.stub.setStateValidationParameter() using policy_chaincode from chapter 09 - Chaincode specifics - key level endorsement.

1 - First submit a transaction with the following endorsement policy:
- AND('Org1MSP.member', 'Org2MSP.member')

cli command:

peer chaincode invoke -o localhost:7050 --ordererTLSHostnameOverride orderer.example.com --tls --cafile ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem -C mychannel -n policy --peerAddresses localhost:7051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses localhost:9051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt -c '{"function":"put","Args":["id1000","1000","AND('Org1MSP.admin', 'Org2MSP.admin')"]}' --waitForEvent

2 - Second I check the key using get function and worked ok:

cli command:
peer chaincode query -C mychannel -n policy -c '{"Args":["get","id1000"]}'

3 - Last i try to update de key id1000 sending it only to one peer to force an endorsement error:
vagrant@vagrant:/vagrant/go/src/github.com/hyperledger/davidfdr/fabric-samples/test-network$ peer chaincode invoke -o localhost:7050 --ordererTLSHostnameOverride orderer.example.com --tls --cafile ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem -C mychannel -n policy --peerAddresses localhost:7051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt --peerAddresses localhost:9051 --tlsRootCertFiles ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt -c '{"function":"put","Args":["id1000","1000","AND('Org1MSP.admin', 'Org2MSP.admin')"]}' --waitForEvent
Error: timed out waiting for txid on all peers - proposal response:

4 - Error log after 30 seconds wait:

peer0.org2.example.com|2021-12-08 00:23:33.968 UTC [gossip.privdata] StoreBlock -> ERRO 072 Validation failed: unexpected EOF channel=mychannel
peer0.org2.example.com|2021-12-08 00:23:33.968 UTC [gossip.state] commitBlock -> ERRO 073 Got error while committing(unexpected EOF
peer0.org2.example.com|github.com/hyperledger/fabric/gossip/state.(GossipStateProviderImpl).commitBlock
peer0.org2.example.com| /go/src/github.com/hyperledger/fabric/gossip/state/state.go:805
peer0.org2.example.com|github.com/hyperledger/fabric/gossip/state.(GossipStateProviderImpl).deliverPayloads
peer0.org2.example.com| /go/src/github.com/hyperledger/fabric/gossip/state/state.go:577
peer0.org2.example.com|runtime.goexit
peer0.org2.example.com| /usr/local/go/src/runtime/asm_amd64.s:1374)
peer0.org2.example.com|2021-12-08 00:23:33.968 UTC [gossip.state] deliverPayloads -> ERRO 074 Failed executing VSCC due to unexpected EOF. Aborting chain processing

---

After that all write operations fails on the channel (Invoke or aproveformyorg). I have to bring the network down an up again

The network only created again after following commands:

docker system prune
docker volume prune
docker network prune

docker image prune

Tried the following versions:

1 - Hyperledger Fabric 2.2.2;
2 - Hyperledger Fabric 2.2.3;
3 - Hyperledger Fabric 2.3.3;

Bobbijn

@davidfdr, Great initiative. I am glad to see you testing the system. This forum is for questions regarding the Labs that accompany the courseware. A suggestion is to join the Fabric mailing list where you can ask the project to maintainers your questions and discuss your work in "forcing an error". Here is a link to a wiki page where you can join the mailing list:
https://lists.hyperledger.org/g/fabric

Keep on Learning ! Bobbi

davidfdr

Thank you. I already submitted it to the fabric list. I think it maybe was a problem with the example policy_chaincode from chapter 9.

Best regards.

David

davidfdr

Hello @Bobbijn, how are you.

There is a issue on Jira:
https://jira.hyperledger.org/browse/FAB-18090

But this issue do not tell the consequences of setting a wrong parameter on the method setStateValidationParameter().

From the Fabric List:

d_kelsey@uk.ibm.com - Dave Kelsey from IBM answered me:

Dave d_kelsey@uk.ibm.com 8 de dezembro de 2021 06:09
Para: fabric@lists.hyperledger.org
The problem here is that you aren't providing a correct endorsement policy format to the setStateValidationParameter call.

The format of AND(principle,...) etc is a format only understood by the peer cli command and is not the native format that fabric uses and is not the format required for the setStateValidationParameter. You can find more information about this here https://hyperledger-fabric.readthedocs.io/en/release-2.2/endorsement-policies.html#setting-key-level-endorsement-policies

The node sdk provides a starter helper class called KeyEndorsementPolicy to help with creating policies in the expected format for this call, however the best reference to using sbes in node chaincode is in fabric-samples https://github.com/hyperledger/fabric-samples/blob/main/asset-transfer-sbe/chaincode-typescript

This sample shows use of the helper class plus creating a more complex endorsement policy structure.

The other issue here would be around why you can set a validation parameter that isn't correct, there was an issue raised in jira here https://jira.hyperledger.org/browse/FAB-18090 but hasn't been moved over to github yet.

- Dave

Bobbijn

@davidfdr,

Thank you for the update, it will help other learners!

davidfdr

To help with the creation of endorsement policies, I have crated (based on asset transfer sbe fabric sample) the following Javascript:

const { KeyEndorsementPolicy } = require('fabric-shim');
const fabprotos = require('fabric-shim/bundle');

/**
 * Calculate endorsement Policy
 * @param {String[]} ownerOrgs
 * @returns {Uint8Array}
 */
const createEndorsementPolicyRuleOneOf = (ownerOrgs) => {
    const ep = new KeyEndorsementPolicy();
    ep.addOrgs('MEMBER', ...ownerOrgs);
    return ep.getPolicy();
};

// Create a policy that requires a given number (N) of Org principals signatures out of the provided list of Orgs
/**
 * Create a policy that requires a given number (N) of Org principals signatures out of the provided list of Orgs
 * @param {Number} nOrgs
 * @param {String[]} mspIds
 * @returns {Uint8Array}
 */
const createEndorsementPolicyRuleAllOf = (nOrgs, mspIds) => {
    const principals = [];
    const sigsPolicies = [];
    mspIds.forEach((mspId, i) => {
        const mspRole = {
            role: fabprotos.common.MSPRole.MSPRoleType.MEMBER,
            mspIdentifier: mspId
        };
        const principal = {
            principalClassification: fabprotos.common.MSPPrincipal.Classification.ROLE,
            principal: fabprotos.common.MSPRole.encode(mspRole).finish()
        };
        principals.push(principal);
        const signedBy = {
            signedBy: i,
        };
        sigsPolicies.push(signedBy);
    });

    // create the policy such that it requires any N signature's from all of the principals provided
    const allOf = {
        n: nOrgs,
        rules: sigsPolicies
    };
    const noutof = {
        nOutOf: allOf
    };
    const spe = {
        version: 0,
        rule: noutof,
        identities: principals
    };
    console.log(`===> ${JSON.stringify(spe)}`);
    return fabprotos.common.SignaturePolicyEnvelope.encode(spe).finish();
};

module.exports = { createEndorsementPolicyRuleAllOf, createEndorsementPolicyRuleOneOf };

basilky

@davidfdr Thanks for providing the code snippet. It worked for me also.
Github issue: https://github.com/hyperledger/fabric/issues/3105