Dispute distribution implementation (#3282)

* Dispute protocol. * Dispute distribution protocol. * Get network requests routed. * WIP: Basic dispute sender logic. * Basic validator determination logic. * WIP: Getting things to typecheck. * Slightly larger timeout. * More typechecking stuff. * Cleanup. * Finished most of the sending logic. * Handle active leaves updates - Cleanup dead disputes - Update sends for new sessions - Retry on errors * Pass sessions in already. * Startup dispute sending. * Provide incoming decoding facilities and use them in statement-distribution. * Relaxed runtime util requirements. We only need a `SubsystemSender` not a full `SubsystemContext`. * Better usability of incoming requests. Make it possible to consume stuff without clones. * Add basic receiver functionality. * Cleanup + fixes for sender. * One more sender fix. * Start receiver. * Make sure to send responses back. * WIP: Exposed authority discovery * Make tests pass. * Fully featured receiver. * Decrease cost of `NotAValidator`. * Make `RuntimeInfo` LRU cache size configurable. * Cache more sessions. * Fix collator protocol. * Disable metrics for now. * Make dispute-distribution a proper subsystem. * Fix naming. * Code style fixes. * Factored out 4x copied mock function. * WIP: Tests. * Whitespace cleanup. * Accessor functions. * More testing. * More Debug instances. * Fix busy loop. * Working tests. * More tests. * Cleanup. * Fix build. * Basic receiving test. * Non validator message gets dropped. * More receiving tests. * Test nested and subsequent imports. * Fix spaces. * Better formatted imports. * Import cleanup. * Metrics. * Message -> MuxedMessage * Message -> MuxedMessage * More review remarks. * Add missing metrics.rs. * Fix flaky test. * Dispute coordinator - deliver confirmations. * Send out `DisputeMessage` on issue local statement. * Unwire dispute distribution. * Review remarks. * Review remarks. * Better docs.
2026-06-13 05:51:02 +00:00 · 2021-07-09 04:29:53 +02:00
parent 20993b32b1
commit b5257b2407
52 changed files with 4040 additions and 407 deletions
@@ -0,0 +1,265 @@
+// Copyright 2021 Parity Technologies (UK) Ltd.
+// This file is part of Polkadot.
+
+// Polkadot is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Polkadot is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Polkadot.  If not, see <http://www.gnu.org/licenses/>.
+
+//! `DisputeMessage` and associated types.
+//!
+//! A `DisputeMessage` is a message that indicates a node participating in a dispute and is used
+//! for interfacing with `DisputeDistribution` to send out our vote in a spam detectable way.
+
+use thiserror::Error;
+
+use parity_scale_codec::{Decode, Encode};
+
+use polkadot_primitives::v1::{CandidateReceipt, DisputeStatement, SessionIndex, SessionInfo, ValidatorIndex};
+
+use super::{InvalidDisputeVote, SignedDisputeStatement, ValidDisputeVote};
+
+/// A dispute initiating/participtating message that is guaranteed to have been built from signed
+/// statements.
+///
+/// And most likely has been constructed correctly. This is used with
+/// `DisputeDistributionMessage::SendDispute` for sending out votes.
+#[derive(Debug, Clone)]
+pub struct DisputeMessage(UncheckedDisputeMessage);
+
+/// A `DisputeMessage` where signatures of statements have not yet been checked.
+#[derive(Clone, Encode, Decode, Debug)]
+pub struct UncheckedDisputeMessage {
+	/// The candidate being disputed.
+	pub candidate_receipt: CandidateReceipt,
+
+	/// The session the candidate appears in.
+	pub session_index: SessionIndex,
+
+	/// The invalid vote data that makes up this dispute.
+	pub invalid_vote: InvalidDisputeVote,
+
+	/// The valid vote that makes this dispute request valid.
+	pub valid_vote: ValidDisputeVote,
+}
+
+/// Things that can go wrong when constructing a `DisputeMessage`.
+#[derive(Error, Debug)]
+pub enum Error {
+	/// The statements concerned different candidates.
+	#[error("Candidate hashes of the two votes did not match up")]
+	CandidateHashMismatch,
+
+	/// The statements concerned different sessions.
+	#[error("Session indices of the two votes did not match up")]
+	SessionIndexMismatch,
+
+	/// The valid statement validator key did not correspond to passed in `SessionInfo`.
+	#[error("Valid statement validator key did not match session information")]
+	InvalidValidKey,
+
+	/// The invalid statement validator key did not correspond to passed in `SessionInfo`.
+	#[error("Invalid statement validator key did not match session information")]
+	InvalidInvalidKey,
+
+	/// Provided receipt had different hash than the `CandidateHash` in the signed statements.
+	#[error("Hash of candidate receipt did not match provided hash")]
+	InvalidCandidateReceipt,
+
+	/// Valid statement should have `ValidDisputeStatementKind`.
+	#[error("Valid statement has kind `invalid`")]
+	ValidStatementHasInvalidKind,
+
+	/// Invalid statement should have `InvalidDisputeStatementKind`.
+	#[error("Invalid statement has kind `valid`")]
+	InvalidStatementHasValidKind,
+
+	/// Provided index could not be found in `SessionInfo`.
+	#[error("The valid statement had an invalid validator index")]
+	ValidStatementInvalidValidatorIndex,
+
+	/// Provided index could not be found in `SessionInfo`.
+	#[error("The invalid statement had an invalid validator index")]
+	InvalidStatementInvalidValidatorIndex,
+}
+
+impl DisputeMessage {
+
+	/// Build a `SignedDisputeMessage` and check what can be checked.
+	///
+	/// This function checks that:
+	///
+	/// - both statements concern the same candidate
+	/// - both statements concern the same session
+	/// - the invalid statement is indeed an invalid one
+	/// - the valid statement is indeed a valid one
+	/// - The passed `CandidateReceipt` has the correct hash (as signed in the statements).
+	/// - the given validator indeces match with the given `ValidatorId`s in the statements,
+	///   given a `SessionInfo`.
+	///
+	/// We don't check whether the given `SessionInfo` matches the `SessionIndex` in the
+	/// statements, because we can't without doing a runtime query. Nevertheless this smart
+	/// constructor gives relative strong guarantees that the resulting `SignedDisputeStatement` is
+	/// valid and good.  Even the passed `SessionInfo` is most likely right if this function
+	/// returns `Some`, because otherwise the passed `ValidatorId`s in the `SessionInfo` at
+	/// their given index would very likely not match the `ValidatorId`s in the statements.
+	///
+	/// So in summary, this smart constructor should be smart enough to prevent from almost all
+	/// programming errors that one could realistically make here.
+	pub fn from_signed_statements(
+		valid_statement: SignedDisputeStatement,
+		valid_index: ValidatorIndex,
+		invalid_statement: SignedDisputeStatement,
+		invalid_index: ValidatorIndex,
+		candidate_receipt: CandidateReceipt,
+		session_info: &SessionInfo,
+	) -> Result<Self, Error> {
+		let candidate_hash = *valid_statement.candidate_hash();
+		// Check statements concern same candidate:
+		if candidate_hash != *invalid_statement.candidate_hash() {
+			return Err(Error::CandidateHashMismatch)
+		}
+
+		let session_index = valid_statement.session_index();
+		if session_index != invalid_statement.session_index() {
+			return Err(Error::SessionIndexMismatch)
+		}
+
+		let valid_id = session_info
+			.validators
+			.get(valid_index.0 as usize)
+			.ok_or(Error::ValidStatementInvalidValidatorIndex)?;
+		let invalid_id = session_info
+			.validators
+			.get(invalid_index.0 as usize)
+			.ok_or(Error::InvalidStatementInvalidValidatorIndex)?;
+
+		if valid_id != valid_statement.validator_public() {
+			return Err(Error::InvalidValidKey)
+		}
+
+		if invalid_id != invalid_statement.validator_public() {
+			return Err(Error::InvalidInvalidKey)
+		}
+
+		if candidate_receipt.hash() != candidate_hash {
+			return Err(Error::InvalidCandidateReceipt)
+		}
+
+		let valid_kind = match valid_statement.statement() {
+			DisputeStatement::Valid(v) => v,
+			_ => {
+				return Err(Error::ValidStatementHasInvalidKind)
+			}
+		};
+
+		let invalid_kind = match invalid_statement.statement() {
+			DisputeStatement::Invalid(v) => v,
+			_ => {
+				return Err(Error::InvalidStatementHasValidKind)
+			}
+		};
+
+		let valid_vote = ValidDisputeVote {
+			validator_index: valid_index,
+			signature: valid_statement.validator_signature().clone(),
+			kind: valid_kind.clone(),
+		};
+
+		let invalid_vote = InvalidDisputeVote {
+			validator_index: invalid_index,
+			signature: invalid_statement.validator_signature().clone(),
+			kind: invalid_kind.clone(),
+		};
+
+		Ok(DisputeMessage(UncheckedDisputeMessage {
+			candidate_receipt,
+			session_index,
+			valid_vote,
+			invalid_vote,
+		}))
+	}
+
+	/// Read only access to the candidate receipt.
+	pub fn candidate_receipt(&self) -> &CandidateReceipt {
+		&self.0.candidate_receipt
+	}
+
+	/// Read only access to the `SessionIndex`.
+	pub fn session_index(&self) -> SessionIndex {
+		self.0.session_index
+	}
+
+	/// Read only access to the invalid vote.
+	pub fn invalid_vote(&self) -> &InvalidDisputeVote {
+		&self.0.invalid_vote
+	}
+
+	/// Read only access to the valid vote.
+	pub fn valid_vote(&self) -> &ValidDisputeVote {
+		&self.0.valid_vote
+	}
+}
+
+impl UncheckedDisputeMessage {
+	/// Try to recover the two signed dispute votes from an UncheckedDisputeMessage.
+	pub fn try_into_signed_votes(self, session_info: &SessionInfo)
+		-> Result<(CandidateReceipt, (SignedDisputeStatement, ValidatorIndex), (SignedDisputeStatement, ValidatorIndex)), ()>
+	{
+		let Self {
+			candidate_receipt,
+			session_index,
+			valid_vote,
+			invalid_vote,
+		} = self;
+		let candidate_hash = candidate_receipt.hash();
+
+		let vote_valid = {
+			let ValidDisputeVote {
+				validator_index,
+				signature,
+				kind,
+			} = valid_vote;
+			let validator_public = session_info.validators.get(validator_index.0 as usize).ok_or(())?.clone();
+
+			(
+				SignedDisputeStatement::new_checked(
+					DisputeStatement::Valid(kind), candidate_hash, session_index, validator_public, signature
+				)?,
+				validator_index
+			)
+		};
+
+		let vote_invalid = {
+			let InvalidDisputeVote {
+				validator_index,
+				signature,
+				kind,
+			} = invalid_vote;
+			let validator_public = session_info.validators.get(validator_index.0 as usize).ok_or(())?.clone();
+
+			(
+				SignedDisputeStatement::new_checked(
+					DisputeStatement::Invalid(kind), candidate_hash, session_index, validator_public, signature
+				)?,
+				validator_index
+			)
+		};
+
+		Ok((candidate_receipt, vote_valid, vote_invalid))
+	}
+}
+
+impl From<DisputeMessage> for UncheckedDisputeMessage {
+	fn from(message: DisputeMessage) -> Self {
+		message.0
+	}
+}
@@ -0,0 +1,177 @@
+// Copyright 2021 Parity Technologies (UK) Ltd.
+// This file is part of Polkadot.
+
+// Polkadot is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Polkadot is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Polkadot.  If not, see <http://www.gnu.org/licenses/>.
+
+use std::convert::TryInto;
+
+use parity_scale_codec::{Decode, Encode};
+
+use sp_application_crypto::AppKey;
+use sp_keystore::{CryptoStore, SyncCryptoStorePtr, Error as KeystoreError};
+
+use polkadot_primitives::v1::{CandidateHash, CandidateReceipt, DisputeStatement, InvalidDisputeStatementKind, SessionIndex, ValidDisputeStatementKind, ValidatorId, ValidatorIndex, ValidatorSignature};
+
+/// `DisputeMessage` and related types.
+mod message;
+pub use message::{DisputeMessage, UncheckedDisputeMessage, Error as DisputeMessageCheckError};
+
+/// A checked dispute statement from an associated validator.
+#[derive(Debug, Clone)]
+pub struct SignedDisputeStatement {
+	dispute_statement: DisputeStatement,
+	candidate_hash: CandidateHash,
+	validator_public: ValidatorId,
+	validator_signature: ValidatorSignature,
+	session_index: SessionIndex,
+}
+
+/// Tracked votes on candidates, for the purposes of dispute resolution.
+#[derive(Debug, Clone)]
+pub struct CandidateVotes {
+	/// The receipt of the candidate itself.
+	pub candidate_receipt: CandidateReceipt,
+	/// Votes of validity, sorted by validator index.
+	pub valid: Vec<(ValidDisputeStatementKind, ValidatorIndex, ValidatorSignature)>,
+	/// Votes of invalidity, sorted by validator index.
+	pub invalid: Vec<(InvalidDisputeStatementKind, ValidatorIndex, ValidatorSignature)>,
+}
+
+impl CandidateVotes {
+	/// Get the set of all validators who have votes in the set, ascending.
+	pub fn voted_indices(&self) -> Vec<ValidatorIndex> {
+		let mut v: Vec<_> = self.valid.iter().map(|x| x.1).chain(
+			self.invalid.iter().map(|x| x.1)
+		).collect();
+
+		v.sort();
+		v.dedup();
+
+		v
+	}
+}
+
+impl SignedDisputeStatement {
+	/// Create a new `SignedDisputeStatement`, which is only possible by checking the signature.
+	pub fn new_checked(
+		dispute_statement: DisputeStatement,
+		candidate_hash: CandidateHash,
+		session_index: SessionIndex,
+		validator_public: ValidatorId,
+		validator_signature: ValidatorSignature,
+	) -> Result<Self, ()> {
+		dispute_statement.check_signature(
+			&validator_public,
+			candidate_hash,
+			session_index,
+			&validator_signature,
+		).map(|_| SignedDisputeStatement {
+			dispute_statement,
+			candidate_hash,
+			validator_public,
+			validator_signature,
+			session_index,
+		})
+	}
+
+	/// Sign this statement with the given keystore and key. Pass `valid = true` to
+	/// indicate validity of the candidate, and `valid = false` to indicate invalidity.
+	pub async fn sign_explicit(
+		keystore: &SyncCryptoStorePtr,
+		valid: bool,
+		candidate_hash: CandidateHash,
+		session_index: SessionIndex,
+		validator_public: ValidatorId,
+	) -> Result<Option<Self>, KeystoreError> {
+		let dispute_statement = if valid {
+			DisputeStatement::Valid(ValidDisputeStatementKind::Explicit)
+		} else {
+			DisputeStatement::Invalid(InvalidDisputeStatementKind::Explicit)
+		};
+
+		let data = dispute_statement.payload_data(candidate_hash, session_index);
+		let signature = CryptoStore::sign_with(
+			&**keystore,
+			ValidatorId::ID,
+			&validator_public.clone().into(),
+			&data,
+		).await?;
+
+		let signature = match signature {
+			Some(sig) => sig.try_into().map_err(|_| KeystoreError::KeyNotSupported(ValidatorId::ID))?,
+			None => return Ok(None),
+		};
+
+		Ok(Some(Self {
+			dispute_statement,
+			candidate_hash,
+			validator_public,
+			validator_signature: signature,
+			session_index,
+		}))
+	}
+
+	/// Access the underlying dispute statement
+	pub fn statement(&self) -> &DisputeStatement {
+		&self.dispute_statement
+	}
+
+	/// Access the underlying candidate hash.
+	pub fn candidate_hash(&self) -> &CandidateHash {
+		&self.candidate_hash
+	}
+
+	/// Access the underlying validator public key.
+	pub fn validator_public(&self) -> &ValidatorId {
+		&self.validator_public
+	}
+
+	/// Access the underlying validator signature.
+	pub fn validator_signature(&self) -> &ValidatorSignature {
+		&self.validator_signature
+	}
+
+	/// Access the underlying session index.
+	pub fn session_index(&self) -> SessionIndex {
+		self.session_index
+	}
+}
+
+/// Any invalid vote (currently only explicit).
+#[derive(Clone, Encode, Decode, Debug)]
+pub struct InvalidDisputeVote {
+	/// The voting validator index.
+	pub validator_index: ValidatorIndex,
+
+	/// The validator signature, that can be verified when constructing a
+	/// `SignedDisputeStatement`.
+	pub signature: ValidatorSignature,
+
+	/// Kind of dispute statement.
+	pub kind: InvalidDisputeStatementKind,
+}
+
+/// Any valid vote (backing, approval, explicit).
+#[derive(Clone, Encode, Decode, Debug)]
+pub struct ValidDisputeVote {
+	/// The voting validator index.
+	pub validator_index: ValidatorIndex,
+
+	/// The validator signature, that can be verified when constructing a
+	/// `SignedDisputeStatement`.
+	pub signature: ValidatorSignature,
+
+	/// Kind of dispute statement.
+	pub kind: ValidDisputeStatementKind,
+}
@@ -22,14 +22,12 @@

 #![deny(missing_docs)]

-use std::convert::TryInto;
+
 use std::pin::Pin;

 use serde::{Serialize, Deserialize};
 use futures::Future;
 use parity_scale_codec::{Decode, Encode};
-use sp_keystore::{CryptoStore, SyncCryptoStorePtr, Error as KeystoreError};
-use sp_application_crypto::AppKey;

 pub use sp_core::traits::SpawnNamed;
 pub use sp_consensus_babe::{
@@ -40,20 +38,32 @@ use polkadot_primitives::v1::{
 	BlakeTwo256, CandidateCommitments, CandidateHash, CollatorPair, CommittedCandidateReceipt,
 	CompactStatement, EncodeAs, Hash, HashT, HeadData, Id as ParaId, OutboundHrmpMessage,
 	PersistedValidationData, Signed, UncheckedSigned, UpwardMessage, ValidationCode,
-	ValidatorIndex, ValidatorSignature, ValidDisputeStatementKind, InvalidDisputeStatementKind,
-	CandidateReceipt, ValidatorId, SessionIndex, DisputeStatement, MAX_CODE_SIZE, MAX_POV_SIZE,
+	ValidatorIndex, SessionIndex, MAX_CODE_SIZE, MAX_POV_SIZE,
 };

 pub use polkadot_parachain::primitives::BlockData;

 pub mod approval;

+/// Disputes related types.
+pub mod disputes;
+pub use disputes::{
+	SignedDisputeStatement, UncheckedDisputeMessage, DisputeMessage, CandidateVotes, InvalidDisputeVote, ValidDisputeVote,
+	DisputeMessageCheckError,
+};
+
 /// The bomb limit for decompressing code blobs.
 pub const VALIDATION_CODE_BOMB_LIMIT: usize = (MAX_CODE_SIZE * 4u32) as usize;

 /// The bomb limit for decompressing PoV blobs.
 pub const POV_BOMB_LIMIT: usize = (MAX_POV_SIZE * 4u32) as usize;

+/// It would be nice to draw this from the chain state, but we have no tools for it right now.
+/// On Polkadot this is 1 day, and on Kusama it's 6 hours.
+///
+/// Number of sessions we want to consider in disputes.
+pub const DISPUTE_WINDOW: SessionIndex = 6;
+
 /// The cumulative weight of a block in a fork-choice rule.
 pub type BlockWeight = u32;

@@ -283,125 +293,3 @@ pub fn maybe_compress_pov(pov: PoV) -> PoV {
 	let pov = PoV { block_data: BlockData(raw) };
 	pov
 }
-
-/// Tracked votes on candidates, for the purposes of dispute resolution.
-#[derive(Debug, Clone)]
-pub struct CandidateVotes {
-	/// The receipt of the candidate itself.
-	pub candidate_receipt: CandidateReceipt,
-	/// Votes of validity, sorted by validator index.
-	pub valid: Vec<(ValidDisputeStatementKind, ValidatorIndex, ValidatorSignature)>,
-	/// Votes of invalidity, sorted by validator index.
-	pub invalid: Vec<(InvalidDisputeStatementKind, ValidatorIndex, ValidatorSignature)>,
-}
-
-impl CandidateVotes {
-	/// Get the set of all validators who have votes in the set, ascending.
-	pub fn voted_indices(&self) -> Vec<ValidatorIndex> {
-		let mut v: Vec<_> = self.valid.iter().map(|x| x.1).chain(
-			self.invalid.iter().map(|x| x.1)
-		).collect();
-
-		v.sort();
-		v.dedup();
-
-		v
-	}
-}
-
-
-/// A checked dispute statement from an associated validator.
-#[derive(Debug, Clone)]
-pub struct SignedDisputeStatement {
-	dispute_statement: DisputeStatement,
-	candidate_hash: CandidateHash,
-	validator_public: ValidatorId,
-	validator_signature: ValidatorSignature,
-	session_index: SessionIndex,
-}
-
-impl SignedDisputeStatement {
-	/// Create a new `SignedDisputeStatement`, which is only possible by checking the signature.
-	pub fn new_checked(
-		dispute_statement: DisputeStatement,
-		candidate_hash: CandidateHash,
-		session_index: SessionIndex,
-		validator_public: ValidatorId,
-		validator_signature: ValidatorSignature,
-	) -> Result<Self, ()> {
-		dispute_statement.check_signature(
-			&validator_public,
-			candidate_hash,
-			session_index,
-			&validator_signature,
-		).map(|_| SignedDisputeStatement {
-			dispute_statement,
-			candidate_hash,
-			validator_public,
-			validator_signature,
-			session_index,
-		})
-	}
-
-	/// Sign this statement with the given keystore and key. Pass `valid = true` to
-	/// indicate validity of the candidate, and `valid = false` to indicate invalidity.
-	pub async fn sign_explicit(
-		keystore: &SyncCryptoStorePtr,
-		valid: bool,
-		candidate_hash: CandidateHash,
-		session_index: SessionIndex,
-		validator_public: ValidatorId,
-	) -> Result<Option<Self>, KeystoreError> {
-		let dispute_statement = if valid {
-			DisputeStatement::Valid(ValidDisputeStatementKind::Explicit)
-		} else {
-			DisputeStatement::Invalid(InvalidDisputeStatementKind::Explicit)
-		};
-
-		let data = dispute_statement.payload_data(candidate_hash, session_index);
-		let signature = CryptoStore::sign_with(
-			&**keystore,
-			ValidatorId::ID,
-			&validator_public.clone().into(),
-			&data,
-		).await?;
-
-		let signature = match signature {
-			Some(sig) => sig.try_into().map_err(|_| KeystoreError::KeyNotSupported(ValidatorId::ID))?,
-			None => return Ok(None),
-		};
-
-		Ok(Some(Self {
-			dispute_statement,
-			candidate_hash,
-			validator_public,
-			validator_signature: signature,
-			session_index,
-		}))
-	}
-
-	/// Access the underlying dispute statement
-	pub fn statement(&self) -> &DisputeStatement {
-		&self.dispute_statement
-	}
-
-	/// Access the underlying candidate hash.
-	pub fn candidate_hash(&self) -> &CandidateHash {
-		&self.candidate_hash
-	}
-
-	/// Access the underlying validator public key.
-	pub fn validator_public(&self) -> &ValidatorId {
-		&self.validator_public
-	}
-
-	/// Access the underlying validator signature.
-	pub fn validator_signature(&self) -> &ValidatorSignature {
-		&self.validator_signature
-	}
-
-	/// Access the underlying session index.
-	pub fn session_index(&self) -> SessionIndex {
-		self.session_index
-	}
-}