Examples with Options org.apache.hadoop.crypto.key.KeyProvider.Options used on opensource projects

Example 1 with Options

use of org.apache.hadoop.crypto.key.KeyProvider.Options in project hadoop by apache.

the class TestLoadBalancingKMSClientProvider method testLoadBalancingWithFailure.

@Test
public void testLoadBalancingWithFailure() throws Exception {
    Configuration conf = new Configuration();
    KMSClientProvider p1 = mock(KMSClientProvider.class);
    when(p1.createKey(Mockito.anyString(), Mockito.any(Options.class))).thenReturn(new KMSClientProvider.KMSKeyVersion("p1", "v1", new byte[0]));
    when(p1.getKMSUrl()).thenReturn("p1");
    // This should not be retried
    KMSClientProvider p2 = mock(KMSClientProvider.class);
    when(p2.createKey(Mockito.anyString(), Mockito.any(Options.class))).thenThrow(new NoSuchAlgorithmException("p2"));
    when(p2.getKMSUrl()).thenReturn("p2");
    KMSClientProvider p3 = mock(KMSClientProvider.class);
    when(p3.createKey(Mockito.anyString(), Mockito.any(Options.class))).thenReturn(new KMSClientProvider.KMSKeyVersion("p3", "v3", new byte[0]));
    when(p3.getKMSUrl()).thenReturn("p3");
    // This should be retried
    KMSClientProvider p4 = mock(KMSClientProvider.class);
    when(p4.createKey(Mockito.anyString(), Mockito.any(Options.class))).thenThrow(new IOException("p4"));
    when(p4.getKMSUrl()).thenReturn("p4");
    KeyProvider kp = new LoadBalancingKMSClientProvider(new KMSClientProvider[] { p1, p2, p3, p4 }, 0, conf);
    assertEquals("p1", kp.createKey("test4", new Options(conf)).getName());
    // Exceptions other than IOExceptions will not be retried
    try {
        kp.createKey("test1", new Options(conf)).getName();
        fail("Should fail since its not an IOException");
    } catch (Exception e) {
        assertTrue(e instanceof NoSuchAlgorithmException);
    }
    assertEquals("p3", kp.createKey("test2", new Options(conf)).getName());
    // IOException will trigger retry in next provider
    assertEquals("p1", kp.createKey("test3", new Options(conf)).getName());
}

Example 2 with Options

use of org.apache.hadoop.crypto.key.KeyProvider.Options in project hadoop by apache.

the class TestKeyAuthorizationKeyProvider method newOptions.

private static KeyProvider.Options newOptions(Configuration conf) {
    KeyProvider.Options options = new KeyProvider.Options(conf);
    options.setCipher(CIPHER);
    options.setBitLength(128);
    return options;
}

Example 3 with Options

use of org.apache.hadoop.crypto.key.KeyProvider.Options in project hadoop by apache.

the class TestKeyAuthorizationKeyProvider method testDecryptWithKeyVersionNameKeyMismatch.

@Test(expected = IllegalArgumentException.class)
public void testDecryptWithKeyVersionNameKeyMismatch() throws Exception {
    final Configuration conf = new Configuration();
    KeyProvider kp = new UserProvider.Factory().createProvider(new URI("user:///"), conf);
    KeyACLs mock = mock(KeyACLs.class);
    when(mock.isACLPresent("testKey", KeyOpType.MANAGEMENT)).thenReturn(true);
    when(mock.isACLPresent("testKey", KeyOpType.GENERATE_EEK)).thenReturn(true);
    when(mock.isACLPresent("testKey", KeyOpType.DECRYPT_EEK)).thenReturn(true);
    when(mock.isACLPresent("testKey", KeyOpType.ALL)).thenReturn(true);
    UserGroupInformation u1 = UserGroupInformation.createRemoteUser("u1");
    UserGroupInformation u2 = UserGroupInformation.createRemoteUser("u2");
    UserGroupInformation u3 = UserGroupInformation.createRemoteUser("u3");
    UserGroupInformation sudo = UserGroupInformation.createRemoteUser("sudo");
    when(mock.hasAccessToKey("testKey", u1, KeyOpType.MANAGEMENT)).thenReturn(true);
    when(mock.hasAccessToKey("testKey", u2, KeyOpType.GENERATE_EEK)).thenReturn(true);
    when(mock.hasAccessToKey("testKey", u3, KeyOpType.DECRYPT_EEK)).thenReturn(true);
    when(mock.hasAccessToKey("testKey", sudo, KeyOpType.ALL)).thenReturn(true);
    final KeyProviderCryptoExtension kpExt = new KeyAuthorizationKeyProvider(KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp), mock);
    sudo.doAs(new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            Options opt = newOptions(conf);
            Map<String, String> m = new HashMap<String, String>();
            m.put("key.acl.name", "testKey");
            opt.setAttributes(m);
            KeyVersion kv = kpExt.createKey("foo", SecureRandom.getSeed(16), opt);
            kpExt.rollNewVersion(kv.getName());
            kpExt.rollNewVersion(kv.getName(), SecureRandom.getSeed(16));
            EncryptedKeyVersion ekv = kpExt.generateEncryptedKey(kv.getName());
            ekv = EncryptedKeyVersion.createForDecryption(ekv.getEncryptionKeyName() + "x", ekv.getEncryptionKeyVersionName(), ekv.getEncryptedKeyIv(), ekv.getEncryptedKeyVersion().getMaterial());
            kpExt.decryptEncryptedKey(ekv);
            return null;
        }
    });
}

Example 4 with Options

use of org.apache.hadoop.crypto.key.KeyProvider.Options in project hadoop by apache.

the class TestKMS method testKeyACLs.

@Test
@SuppressWarnings("checkstyle:methodlength")
public void testKeyACLs() throws Exception {
    Configuration conf = new Configuration();
    conf.set("hadoop.security.authentication", "kerberos");
    final File testDir = getTestDir();
    conf = createBaseKMSConf(testDir, conf);
    conf.set("hadoop.kms.authentication.type", "kerberos");
    conf.set("hadoop.kms.authentication.kerberos.keytab", keytab.getAbsolutePath());
    conf.set("hadoop.kms.authentication.kerberos.principal", "HTTP/localhost");
    conf.set("hadoop.kms.authentication.kerberos.name.rules", "DEFAULT");
    for (KMSACLs.Type type : KMSACLs.Type.values()) {
        conf.set(type.getAclConfigKey(), type.toString());
    }
    conf.set(KMSACLs.Type.CREATE.getAclConfigKey(), "CREATE,ROLLOVER,GET,SET_KEY_MATERIAL,GENERATE_EEK,DECRYPT_EEK");
    conf.set(KMSACLs.Type.ROLLOVER.getAclConfigKey(), "CREATE,ROLLOVER,GET,SET_KEY_MATERIAL,GENERATE_EEK,DECRYPT_EEK");
    conf.set(KMSACLs.Type.GENERATE_EEK.getAclConfigKey(), "CREATE,ROLLOVER,GET,SET_KEY_MATERIAL,GENERATE_EEK,DECRYPT_EEK");
    conf.set(KMSACLs.Type.DECRYPT_EEK.getAclConfigKey(), "CREATE,ROLLOVER,GET,SET_KEY_MATERIAL,GENERATE_EEK");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "test_key.MANAGEMENT", "CREATE");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "some_key.MANAGEMENT", "ROLLOVER");
    conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", "DECRYPT_EEK");
    conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "ALL", "DECRYPT_EEK");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "all_access.ALL", "GENERATE_EEK");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "all_access.DECRYPT_EEK", "ROLLOVER");
    conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "MANAGEMENT", "ROLLOVER");
    conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "GENERATE_EEK", "SOMEBODY");
    conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "ALL", "ROLLOVER");
    writeConf(testDir, conf);
    runServer(null, null, testDir, new KMSCallable<Void>() {

        @Override
        public Void call() throws Exception {
            final Configuration conf = new Configuration();
            conf.setInt(KeyProvider.DEFAULT_BITLENGTH_NAME, 128);
            final URI uri = createKMSUri(getKMSUrl());
            doAs("CREATE", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        Options options = new KeyProvider.Options(conf);
                        Map<String, String> attributes = options.getAttributes();
                        HashMap<String, String> newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "test_key");
                        options.setAttributes(newAttribs);
                        KeyProvider.KeyVersion kv = kp.createKey("k0", options);
                        Assert.assertNull(kv.getMaterial());
                        KeyVersion rollVersion = kp.rollNewVersion("k0");
                        Assert.assertNull(rollVersion.getMaterial());
                        KeyProviderCryptoExtension kpce = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                        try {
                            kpce.generateEncryptedKey("k0");
                            Assert.fail("User [CREATE] should not be allowed to generate_eek on k0");
                        } catch (Exception e) {
                        // Ignore
                        }
                        newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "all_access");
                        options.setAttributes(newAttribs);
                        try {
                            kp.createKey("kx", options);
                            Assert.fail("User [CREATE] should not be allowed to create kx");
                        } catch (Exception e) {
                        // Ignore
                        }
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            // Test whitelist key access..
            // DECRYPT_EEK is whitelisted for MANAGEMENT operations only
            doAs("DECRYPT_EEK", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        Options options = new KeyProvider.Options(conf);
                        Map<String, String> attributes = options.getAttributes();
                        HashMap<String, String> newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "some_key");
                        options.setAttributes(newAttribs);
                        KeyProvider.KeyVersion kv = kp.createKey("kk0", options);
                        Assert.assertNull(kv.getMaterial());
                        KeyVersion rollVersion = kp.rollNewVersion("kk0");
                        Assert.assertNull(rollVersion.getMaterial());
                        KeyProviderCryptoExtension kpce = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                        try {
                            kpce.generateEncryptedKey("kk0");
                            Assert.fail("User [DECRYPT_EEK] should not be allowed to generate_eek on kk0");
                        } catch (Exception e) {
                        // Ignore
                        }
                        newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "all_access");
                        options.setAttributes(newAttribs);
                        kp.createKey("kkx", options);
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            doAs("ROLLOVER", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        Options options = new KeyProvider.Options(conf);
                        Map<String, String> attributes = options.getAttributes();
                        HashMap<String, String> newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "test_key2");
                        options.setAttributes(newAttribs);
                        KeyProvider.KeyVersion kv = kp.createKey("k1", options);
                        Assert.assertNull(kv.getMaterial());
                        KeyVersion rollVersion = kp.rollNewVersion("k1");
                        Assert.assertNull(rollVersion.getMaterial());
                        try {
                            kp.rollNewVersion("k0");
                            Assert.fail("User [ROLLOVER] should not be allowed to rollover k0");
                        } catch (Exception e) {
                        // Ignore
                        }
                        KeyProviderCryptoExtension kpce = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                        try {
                            kpce.generateEncryptedKey("k1");
                            Assert.fail("User [ROLLOVER] should not be allowed to generate_eek on k1");
                        } catch (Exception e) {
                        // Ignore
                        }
                        newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "all_access");
                        options.setAttributes(newAttribs);
                        try {
                            kp.createKey("kx", options);
                            Assert.fail("User [ROLLOVER] should not be allowed to create kx");
                        } catch (Exception e) {
                        // Ignore
                        }
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            doAs("GET", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        Options options = new KeyProvider.Options(conf);
                        Map<String, String> attributes = options.getAttributes();
                        HashMap<String, String> newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "test_key");
                        options.setAttributes(newAttribs);
                        try {
                            kp.createKey("k2", options);
                            Assert.fail("User [GET] should not be allowed to create key..");
                        } catch (Exception e) {
                        // Ignore
                        }
                        newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "all_access");
                        options.setAttributes(newAttribs);
                        try {
                            kp.createKey("kx", options);
                            Assert.fail("User [GET] should not be allowed to create kx");
                        } catch (Exception e) {
                        // Ignore
                        }
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            final EncryptedKeyVersion ekv = doAs("GENERATE_EEK", new PrivilegedExceptionAction<EncryptedKeyVersion>() {

                @Override
                public EncryptedKeyVersion run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        Options options = new KeyProvider.Options(conf);
                        Map<String, String> attributes = options.getAttributes();
                        HashMap<String, String> newAttribs = new HashMap<String, String>(attributes);
                        newAttribs.put("key.acl.name", "all_access");
                        options.setAttributes(newAttribs);
                        kp.createKey("kx", options);
                        KeyProviderCryptoExtension kpce = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                        try {
                            return kpce.generateEncryptedKey("kx");
                        } catch (Exception e) {
                            Assert.fail("User [GENERATE_EEK] should be allowed to generate_eek on kx");
                        }
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            doAs("ROLLOVER", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        KeyProviderCryptoExtension kpce = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                        kpce.decryptEncryptedKey(ekv);
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            return null;
        }
    });
    conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "MANAGEMENT", "");
    conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "GENERATE_EEK", "*");
    writeConf(testDir, conf);
    runServer(null, null, testDir, new KMSCallable<Void>() {

        @Override
        public Void call() throws Exception {
            final Configuration conf = new Configuration();
            conf.setInt(KeyProvider.DEFAULT_BITLENGTH_NAME, 128);
            final URI uri = createKMSUri(getKMSUrl());
            doAs("GENERATE_EEK", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    KeyProviderCryptoExtension kpce = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                    EncryptedKeyVersion ekv = kpce.generateEncryptedKey("k1");
                    kpce.reencryptEncryptedKey(ekv);
                    return null;
                }
            });
            return null;
        }
    });
}

Example 5 with Options

use of org.apache.hadoop.crypto.key.KeyProvider.Options in project hadoop by apache.

the class KeyShell method init.

/**
   * Parse the command line arguments and initialize the data.
   * <pre>
   * % hadoop key create keyName [-size size] [-cipher algorithm]
   *    [-provider providerPath]
   * % hadoop key roll keyName [-provider providerPath]
   * % hadoop key list [-provider providerPath]
   * % hadoop key delete keyName [-provider providerPath] [-i]
   * % hadoop key invalidateCache keyName [-provider providerPath]
   * </pre>
   * @param args Command line arguments.
   * @return 0 on success, 1 on failure.
   * @throws IOException
   */
@Override
protected int init(String[] args) throws IOException {
    final Options options = KeyProvider.options(getConf());
    final Map<String, String> attributes = new HashMap<String, String>();
    for (int i = 0; i < args.length; i++) {
        // parse command line
        boolean moreTokens = (i < args.length - 1);
        if (args[i].equals("create")) {
            String keyName = "-help";
            if (moreTokens) {
                keyName = args[++i];
            }
            setSubCommand(new CreateCommand(keyName, options));
            if ("-help".equals(keyName)) {
                return 1;
            }
        } else if (args[i].equals("delete")) {
            String keyName = "-help";
            if (moreTokens) {
                keyName = args[++i];
            }
            setSubCommand(new DeleteCommand(keyName));
            if ("-help".equals(keyName)) {
                return 1;
            }
        } else if (args[i].equals("roll")) {
            String keyName = "-help";
            if (moreTokens) {
                keyName = args[++i];
            }
            setSubCommand(new RollCommand(keyName));
            if ("-help".equals(keyName)) {
                return 1;
            }
        } else if ("list".equals(args[i])) {
            setSubCommand(new ListCommand());
        } else if ("invalidateCache".equals(args[i])) {
            String keyName = "-help";
            if (moreTokens) {
                keyName = args[++i];
            }
            setSubCommand(new InvalidateCacheCommand(keyName));
            if ("-help".equals(keyName)) {
                return 1;
            }
        } else if ("-size".equals(args[i]) && moreTokens) {
            options.setBitLength(Integer.parseInt(args[++i]));
        } else if ("-cipher".equals(args[i]) && moreTokens) {
            options.setCipher(args[++i]);
        } else if ("-description".equals(args[i]) && moreTokens) {
            options.setDescription(args[++i]);
        } else if ("-attr".equals(args[i]) && moreTokens) {
            final String[] attrval = args[++i].split("=", 2);
            final String attr = attrval[0].trim();
            final String val = attrval[1].trim();
            if (attr.isEmpty() || val.isEmpty()) {
                getOut().println("\nAttributes must be in attribute=value form, " + "or quoted\nlike \"attribute = value\"\n");
                return 1;
            }
            if (attributes.containsKey(attr)) {
                getOut().println("\nEach attribute must correspond to only one " + "value:\natttribute \"" + attr + "\" was repeated\n");
                return 1;
            }
            attributes.put(attr, val);
        } else if ("-provider".equals(args[i]) && moreTokens) {
            userSuppliedProvider = true;
            getConf().set(KeyProviderFactory.KEY_PROVIDER_PATH, args[++i]);
        } else if ("-metadata".equals(args[i])) {
            getConf().setBoolean(LIST_METADATA, true);
        } else if ("-f".equals(args[i]) || ("-force".equals(args[i]))) {
            interactive = false;
        } else if (args[i].equals("-strict")) {
            strict = true;
        } else if ("-help".equals(args[i])) {
            return 1;
        } else {
            ToolRunner.printGenericCommandUsage(getErr());
            return 1;
        }
    }
    if (!attributes.isEmpty()) {
        options.setAttributes(attributes);
    }
    return 0;
}