aura, babe: don't allow disabled validators to build blocks (#9414)

* frame-support: add trait for checking disabled validators

* pallet-session: implement DisabledValidators trait

* pallet-babe: check for disabled validators

* pallet-babe: add test for disabled validators

* pallet-aura: check for disabled validators

* pallet-aura: add test for disabled validators

* runtime: fix missing DisableValidator

* test-runtime: add missing DisabledValidators

* frame-support: clean up doc

Co-authored-by: Bastian Köcher <bkchr@users.noreply.github.com>

Co-authored-by: Bastian Köcher <bkchr@users.noreply.github.com>

substrate/frame/babe/src/lib.rs

@@ -24,7 +24,9 @@
 use codec::{Decode, Encode};
 use frame_support::{
 	dispatch::DispatchResultWithPostInfo,
-	traits::{FindAuthor, Get, KeyOwnerProofSystem, OnTimestampSet, OneSessionHandler},
+	traits::{
+		DisabledValidators, FindAuthor, Get, KeyOwnerProofSystem, OnTimestampSet, OneSessionHandler,
+	},
 	weights::{Pays, Weight},
 };
 use sp_application_crypto::Public;
@@ -137,6 +139,11 @@ pub mod pallet {
 		/// when no other module is responsible for changing authority set.
 		type EpochChangeTrigger: EpochChangeTrigger;
 
+		/// A way to check whether a given validator is disabled and should not be authoring blocks.
+		/// Blocks authored by a disabled validator will lead to a panic as part of this module's
+		/// initialization.
+		type DisabledValidators: DisabledValidators;
+
 		/// The proof of key ownership, used for validating equivocation reports.
 		/// The proof must include the session index and validator count of the
 		/// session at which the equivocation occurred.
@@ -678,6 +685,13 @@ impl<T: Config> Pallet<T> {
 
 			let authority_index = digest.authority_index();
 
+			if T::DisabledValidators::is_disabled(authority_index) {
+				panic!(
+					"Validator with index {:?} is disabled and should not be attempting to author blocks.",
+					authority_index,
+				);
+			}
+
 			// Extract out the VRF output if we have it
 			digest.vrf_output().and_then(|vrf_output| {
 				// Reconstruct the bytes of VRFInOut using the authority id.