Endorser

Endorser向client/SDK通过grpc提供 service ProcessProposal

// Endorser provides the Endorser service ProcessProposal
type Endorser struct {
    policyChecker policy.PolicyChecker
}

peer.proto内的grpc service定义

service Endorser {
    rpc ProcessProposal(SignedProposal) returns (ProposalResponse) {}
}

Endorser只是对policy.PolicyChecker的实例进行了封装。它提供给SDK的服务ProcessProposal主要做了以下事情:

1. 先验证SignedProposal的有效性
   1). 验证SignedProposal是否valid，主要是验证其中Proposal Header和签名的有效性，以及其中的txID的计算是否正确
   2). 如果调用的是System Chaincode,并且此SysCC设定为不可从外部调用，则停止处理
   3). txID不能为空
   4). SignedProposal里指定的chainID必须已经在Peer上存在
   5). 查询Ledger里是否已有相同的txID以防止重放攻击
   6). 如果不是SysCC, 查询application chaincode的ACL以验证SignedProposal的签名人是否被定义为channel的writter
2. 其次，处理Proposal
   1). 获得ledger.TxSimulator及ledger.HistoryQueryExecutor的实例用来模拟执行交易
   2). 模拟执行交易获得结果ReadWriteSet
   3). 返回结果
   • 如果是application chaincode,调用ESCC对结果进行endorse然后返回
   • 如果调用的是CSCC，直接返回结果不需要endorse

policy.PolicyChecker实例化

// NewEndorserServer creates and returns a new Endorser server instance.
func NewEndorserServer() pb.EndorserServer {
    e := new(Endorser)
    e.policyChecker = policy.NewPolicyChecker(
        peer.NewChannelPolicyManagerGetter(),
        mgmt.GetLocalMSP(),
        mgmt.NewLocalMSPPrincipalGetter(),
    )
    return e
}

policy.PolicyChecker接口

// PolicyChecker offers methods to check a signed proposal against a specific policy
// defined in a channel or not.
type PolicyChecker interface {
    // CheckPolicy checks that the passed signed proposal is valid with the respect to
    // passed policy on the passed channel.
    // If no channel is passed, CheckPolicyNoChannel is invoked directly.
    CheckPolicy(channelID, policyName string, signedProp *pb.SignedProposal) error

    // CheckPolicyBySignedData checks that the passed signed data is valid with the respect to
    // passed policy on the passed channel.
    // If no channel is passed, the method will fail.
    CheckPolicyBySignedData(channelID, policyName string, sd []*common.SignedData) error

    // CheckPolicyNoChannel checks that the passed signed proposal is valid with the respect to
    // passed policy on the local MSP.
    CheckPolicyNoChannel(policyName string, signedProp *pb.SignedProposal) error
}

policy.PolicyChecker的实现

type policyChecker struct {
    channelPolicyManagerGetter policies.ChannelPolicyManagerGetter
    localMSP                   msp.IdentityDeserializer
    principalGetter            mgmt.MSPPrincipalGetter
}