difftreelog
Merge pull request #1044 from UniqueNetwork/fix/forbid-relay-as-root
in: master
Forbid relay as root
5 files changed
js-packages/tests/sub/governance/electsudo.test.tsdiffbeforeafterbothno changes
js-packages/tests/xcm/lowLevelXcmQuartz.test.tsdiffbeforeafterboth--- a/js-packages/tests/xcm/lowLevelXcmQuartz.test.ts
+++ b/js-packages/tests/xcm/lowLevelXcmQuartz.test.ts
@@ -298,67 +298,3 @@
await testHelper.rejectReserveTransferUNQfrom('shiden', alice);
});
});
-
-describeXCM('[XCMLL] Integration test: The relay can do some root ops', () => {
- let sudoer: IKeyringPair;
-
- before(async function () {
- await usingRelayPlaygrounds(relayUrl, async (_, privateKey) => {
- sudoer = await privateKey('//Alice');
- });
- });
-
- // At the moment there is no reliable way
- // to establish the correspondence between the `ExecutedDownward` event
- // and the relay's sent message due to `SetTopic` instruction
- // containing an unpredictable topic silently added by the relay's messages on the router level.
- // This changes the message hash on arrival to our chain.
- //
- // See:
- // * The relay's router: https://github.com/paritytech/polkadot-sdk/blob/f60318f68687e601c47de5ad5ca88e2c3f8139a7/polkadot/runtime/westend/src/xcm_config.rs#L83
- // * The `WithUniqueTopic` helper: https://github.com/paritytech/polkadot-sdk/blob/945ebbbcf66646be13d5b1d1bc26c8b0d3296d9e/polkadot/xcm/xcm-builder/src/routing.rs#L36
- //
- // Because of this, we insert time gaps between tests so
- // different `ExecutedDownward` events won't interfere with each other.
- afterEach(async () => {
- await usingPlaygrounds(async (helper) => {
- await helper.wait.newBlocks(3);
- });
- });
-
- itSub('The relay can set storage', async () => {
- await testHelper.relayIsPermittedToSetStorage(sudoer, 'plain');
- });
-
- itSub('The relay can batch set storage', async () => {
- await testHelper.relayIsPermittedToSetStorage(sudoer, 'batch');
- });
-
- itSub('The relay can batchAll set storage', async () => {
- await testHelper.relayIsPermittedToSetStorage(sudoer, 'batchAll');
- });
-
- itSub('The relay can forceBatch set storage', async () => {
- await testHelper.relayIsPermittedToSetStorage(sudoer, 'forceBatch');
- });
-
- itSub('[negative] The relay cannot set balance', async () => {
- await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'plain');
- });
-
- itSub('[negative] The relay cannot set balance via batch', async () => {
- await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'batch');
- });
-
- itSub('[negative] The relay cannot set balance via batchAll', async () => {
- await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'batchAll');
- });
-
- itSub('[negative] The relay cannot set balance via forceBatch', async () => {
- await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'forceBatch');
- });
-
- itSub('[negative] The relay cannot set balance via dispatchAs', async () => {
- await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'dispatchAs');
- });
-});
js-packages/tests/xcm/lowLevelXcmUnique.test.tsdiffbeforeafterboth--- a/js-packages/tests/xcm/lowLevelXcmUnique.test.ts
+++ b/js-packages/tests/xcm/lowLevelXcmUnique.test.ts
@@ -364,67 +364,3 @@
await testHelper.rejectReserveTransferUNQfrom('astar', alice);
});
});
-
-describeXCM('[XCMLL] Integration test: The relay can do some root ops', () => {
- let sudoer: IKeyringPair;
-
- before(async function () {
- await usingRelayPlaygrounds(relayUrl, async (_, privateKey) => {
- sudoer = await privateKey('//Alice');
- });
- });
-
- // At the moment there is no reliable way
- // to establish the correspondence between the `ExecutedDownward` event
- // and the relay's sent message due to `SetTopic` instruction
- // containing an unpredictable topic silently added by the relay's messages on the router level.
- // This changes the message hash on arrival to our chain.
- //
- // See:
- // * The relay's router: https://github.com/paritytech/polkadot-sdk/blob/f60318f68687e601c47de5ad5ca88e2c3f8139a7/polkadot/runtime/westend/src/xcm_config.rs#L83
- // * The `WithUniqueTopic` helper: https://github.com/paritytech/polkadot-sdk/blob/945ebbbcf66646be13d5b1d1bc26c8b0d3296d9e/polkadot/xcm/xcm-builder/src/routing.rs#L36
- //
- // Because of this, we insert time gaps between tests so
- // different `ExecutedDownward` events won't interfere with each other.
- afterEach(async () => {
- await usingPlaygrounds(async (helper) => {
- await helper.wait.newBlocks(3);
- });
- });
-
- itSub('The relay can set storage', async () => {
- await testHelper.relayIsPermittedToSetStorage(sudoer, 'plain');
- });
-
- itSub('The relay can batch set storage', async () => {
- await testHelper.relayIsPermittedToSetStorage(sudoer, 'batch');
- });
-
- itSub('The relay can batchAll set storage', async () => {
- await testHelper.relayIsPermittedToSetStorage(sudoer, 'batchAll');
- });
-
- itSub('The relay can forceBatch set storage', async () => {
- await testHelper.relayIsPermittedToSetStorage(sudoer, 'forceBatch');
- });
-
- itSub('[negative] The relay cannot set balance', async () => {
- await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'plain');
- });
-
- itSub('[negative] The relay cannot set balance via batch', async () => {
- await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'batch');
- });
-
- itSub('[negative] The relay cannot set balance via batchAll', async () => {
- await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'batchAll');
- });
-
- itSub('[negative] The relay cannot set balance via forceBatch', async () => {
- await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'forceBatch');
- });
-
- itSub('[negative] The relay cannot set balance via dispatchAs', async () => {
- await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'dispatchAs');
- });
-});
js-packages/tests/xcm/xcm.types.tsdiffbeforeafterboth--- a/js-packages/tests/xcm/xcm.types.ts
+++ b/js-packages/tests/xcm/xcm.types.ts
@@ -505,117 +505,4 @@
await expectFailedToTransact(helper, messageSent);
});
}
-
- private async _relayXcmTransactSetStorage(variant: 'plain' | 'batch' | 'batchAll' | 'forceBatch') {
- // eslint-disable-next-line require-await
- return await usingPlaygrounds(async (helper) => {
- const relayForceKV = () => {
- const random = Math.random();
- const key = `relay-forced-key (instance: ${random})`;
- const val = `relay-forced-value (instance: ${random})`;
- const call = helper.constructApiCall('api.tx.system.setStorage', [[[key, val]]]).method.toHex();
-
- return {
- call,
- key,
- val,
- };
- };
-
- if(variant == 'plain') {
- const kv = relayForceKV();
- return {
- program: helper.arrange.makeUnpaidSudoTransactProgram({
- weightMultiplier: 1,
- call: kv.call,
- }),
- kvs: [kv],
- };
- } else {
- const kv0 = relayForceKV();
- const kv1 = relayForceKV();
-
- const batchCall = helper.constructApiCall(`api.tx.utility.${variant}`, [[kv0.call, kv1.call]]).method.toHex();
- return {
- program: helper.arrange.makeUnpaidSudoTransactProgram({
- weightMultiplier: 2,
- call: batchCall,
- }),
- kvs: [kv0, kv1],
- };
- }
- });
- }
-
- async relayIsPermittedToSetStorage(relaySudoer: IKeyringPair, variant: 'plain' | 'batch' | 'batchAll' | 'forceBatch') {
- const {program, kvs} = await this._relayXcmTransactSetStorage(variant);
-
- await usingRelayPlaygrounds(relayUrl, async (helper) => {
- await helper.getSudo().executeExtrinsic(relaySudoer, 'api.tx.xcmPallet.send', [
- this._uniqueChainMultilocationForRelay(),
- program,
- ]);
- });
-
- await usingPlaygrounds(async (helper) => {
- await expectDownwardXcmComplete(helper);
-
- for(const kv of kvs) {
- const forcedValue = await helper.callRpc('api.rpc.state.getStorage', [kv.key]);
- expect(hexToString(forcedValue.toHex())).to.be.equal(kv.val);
- }
- });
- }
-
- private async _relayXcmTransactSetBalance(variant: 'plain' | 'batch' | 'batchAll' | 'forceBatch' | 'dispatchAs') {
- // eslint-disable-next-line require-await
- return await usingPlaygrounds(async (helper) => {
- const emptyAccount = helper.arrange.createEmptyAccount().address;
-
- const forceSetBalanceCall = helper.constructApiCall('api.tx.balances.forceSetBalance', [emptyAccount, 10_000n]).method.toHex();
-
- let call;
-
- if(variant == 'plain') {
- call = forceSetBalanceCall;
-
- } else if(variant == 'dispatchAs') {
- call = helper.constructApiCall('api.tx.utility.dispatchAs', [
- {
- system: 'Root',
- },
- forceSetBalanceCall,
- ]).method.toHex();
- } else {
- call = helper.constructApiCall(`api.tx.utility.${variant}`, [[forceSetBalanceCall]]).method.toHex();
- }
-
- return {
- program: helper.arrange.makeUnpaidSudoTransactProgram({
- weightMultiplier: 1,
- call,
- }),
- emptyAccount,
- };
- });
- }
-
- async relayIsNotPermittedToSetBalance(
- relaySudoer: IKeyringPair,
- variant: 'plain' | 'batch' | 'batchAll' | 'forceBatch' | 'dispatchAs',
- ) {
- const {program, emptyAccount} = await this._relayXcmTransactSetBalance(variant);
-
- await usingRelayPlaygrounds(relayUrl, async (helper) => {
- await helper.getSudo().executeExtrinsic(relaySudoer, 'api.tx.xcmPallet.send', [
- this._uniqueChainMultilocationForRelay(),
- program,
- ]);
- });
-
- await usingPlaygrounds(async (helper) => {
- await expectDownwardXcmNoPermission(helper);
- expect(await helper.balance.getSubstrate(emptyAccount)).to.be.equal(0n);
- });
- }
}
runtime/common/config/xcm/mod.rsdiffbeforeafterboth--- a/runtime/common/config/xcm/mod.rs
+++ b/runtime/common/config/xcm/mod.rs
@@ -17,7 +17,7 @@
use cumulus_primitives_core::ParaId;
use frame_support::{
parameter_types,
- traits::{ConstU32, Contains, Everything, Get, Nothing, ProcessMessageError},
+ traits::{ConstU32, Everything, Get, Nothing, ProcessMessageError},
};
use frame_system::EnsureRoot;
use pallet_xcm::XcmPassthrough;
@@ -29,9 +29,9 @@
v3::Instruction,
};
use staging_xcm_builder::{
- AccountId32Aliases, EnsureXcmOrigin, FixedWeightBounds, ParentAsSuperuser, ParentIsPreset,
- RelayChainAsNative, SiblingParachainAsNative, SiblingParachainConvertsVia,
- SignedAccountId32AsNative, SignedToAccountId32, SovereignSignedViaLocation,
+ AccountId32Aliases, EnsureXcmOrigin, FixedWeightBounds, ParentIsPreset, RelayChainAsNative,
+ SiblingParachainAsNative, SiblingParachainConvertsVia, SignedAccountId32AsNative,
+ SignedToAccountId32, SovereignSignedViaLocation,
};
use staging_xcm_executor::{
traits::{Properties, ShouldExecute},
@@ -111,9 +111,6 @@
// Native converter for sibling Parachains; will convert to a `SiblingPara` origin when
// recognised.
SiblingParachainAsNative<cumulus_pallet_xcm::Origin, RuntimeOrigin>,
- // Superuser converter for the Relay-chain (Parent) location. This will allow it to issue a
- // transaction from the Root origin.
- ParentAsSuperuser<RuntimeOrigin>,
// Native signed account converter; this just converts an `AccountId32` origin into a normal
// `Origin::Signed` origin of the same 32-byte value.
SignedAccountId32AsNative<RelayNetwork, RuntimeOrigin>,
@@ -166,55 +163,7 @@
}
pub type Weigher = FixedWeightBounds<UnitWeightCost, RuntimeCall, MaxInstructions>;
-
-pub struct XcmCallFilter;
-impl XcmCallFilter {
- fn allow_gov_and_sys_call(call: &RuntimeCall) -> bool {
- match call {
- RuntimeCall::System(..) => true,
-
- #[cfg(feature = "governance")]
- RuntimeCall::Identity(..)
- | RuntimeCall::Preimage(..)
- | RuntimeCall::Democracy(..)
- | RuntimeCall::Council(..)
- | RuntimeCall::TechnicalCommittee(..)
- | RuntimeCall::CouncilMembership(..)
- | RuntimeCall::TechnicalCommitteeMembership(..)
- | RuntimeCall::FellowshipCollective(..)
- | RuntimeCall::FellowshipReferenda(..) => true,
- _ => false,
- }
- }
- fn allow_utility_call(call: &RuntimeCall) -> bool {
- match call {
- RuntimeCall::Utility(pallet_utility::Call::batch { calls, .. }) => {
- calls.iter().all(Self::allow_gov_and_sys_call)
- }
- RuntimeCall::Utility(pallet_utility::Call::batch_all { calls, .. }) => {
- calls.iter().all(Self::allow_gov_and_sys_call)
- }
- RuntimeCall::Utility(pallet_utility::Call::as_derivative { call, .. }) => {
- Self::allow_gov_and_sys_call(call)
- }
- RuntimeCall::Utility(pallet_utility::Call::dispatch_as { call, .. }) => {
- Self::allow_gov_and_sys_call(call)
- }
- RuntimeCall::Utility(pallet_utility::Call::force_batch { calls, .. }) => {
- calls.iter().all(Self::allow_gov_and_sys_call)
- }
- _ => false,
- }
- }
-}
-
-impl Contains<RuntimeCall> for XcmCallFilter {
- fn contains(call: &RuntimeCall) -> bool {
- Self::allow_gov_and_sys_call(call) || Self::allow_utility_call(call)
- }
-}
-
pub struct XcmExecutorConfig<T>(PhantomData<T>);
impl<T> staging_xcm_executor::Config for XcmExecutorConfig<T>
where
@@ -244,7 +193,7 @@
type MessageExporter = ();
type UniversalAliases = Nothing;
type CallDispatcher = RuntimeCall;
- type SafeCallFilter = XcmCallFilter;
+ type SafeCallFilter = Nothing;
type Aliasers = Nothing;
}