Examples with Options org.apache.hadoop.crypto.key.KeyProvider.Options used on opensource projects

Example 6 with Options

use of org.apache.hadoop.crypto.key.KeyProvider.Options in project hadoop by apache.

the class TestLoadBalancingKMSClientProvider method testClassCastException.

@Test
public void testClassCastException() throws Exception {
    Configuration conf = new Configuration();
    KMSClientProvider p1 = new MyKMSClientProvider(new URI("kms://http@host1/kms/foo"), conf);
    LoadBalancingKMSClientProvider kp = new LoadBalancingKMSClientProvider(new KMSClientProvider[] { p1 }, 0, conf);
    try {
        kp.generateEncryptedKey("foo");
    } catch (IOException ioe) {
        assertTrue(ioe.getCause().getClass().getName().contains("AuthenticationException"));
    }
    try {
        final KeyProviderCryptoExtension.EncryptedKeyVersion encryptedKeyVersion = mock(KeyProviderCryptoExtension.EncryptedKeyVersion.class);
        kp.decryptEncryptedKey(encryptedKeyVersion);
    } catch (IOException ioe) {
        assertTrue(ioe.getCause().getClass().getName().contains("AuthenticationException"));
    }
    try {
        final KeyProvider.Options options = KeyProvider.options(conf);
        kp.createKey("foo", options);
    } catch (IOException ioe) {
        assertTrue(ioe.getCause().getClass().getName().contains("AuthenticationException"));
    }
    try {
        kp.rollNewVersion("foo");
    } catch (IOException ioe) {
        assertTrue(ioe.getCause().getClass().getName().contains("AuthenticationException"));
    }
}

Example 7 with Options

use of org.apache.hadoop.crypto.key.KeyProvider.Options in project hadoop by apache.

the class TestLoadBalancingKMSClientProvider method testLoadBalancing.

@Test
public void testLoadBalancing() throws Exception {
    Configuration conf = new Configuration();
    KMSClientProvider p1 = mock(KMSClientProvider.class);
    when(p1.createKey(Mockito.anyString(), Mockito.any(Options.class))).thenReturn(new KMSClientProvider.KMSKeyVersion("p1", "v1", new byte[0]));
    KMSClientProvider p2 = mock(KMSClientProvider.class);
    when(p2.createKey(Mockito.anyString(), Mockito.any(Options.class))).thenReturn(new KMSClientProvider.KMSKeyVersion("p2", "v2", new byte[0]));
    KMSClientProvider p3 = mock(KMSClientProvider.class);
    when(p3.createKey(Mockito.anyString(), Mockito.any(Options.class))).thenReturn(new KMSClientProvider.KMSKeyVersion("p3", "v3", new byte[0]));
    KeyProvider kp = new LoadBalancingKMSClientProvider(new KMSClientProvider[] { p1, p2, p3 }, 0, conf);
    assertEquals("p1", kp.createKey("test1", new Options(conf)).getName());
    assertEquals("p2", kp.createKey("test2", new Options(conf)).getName());
    assertEquals("p3", kp.createKey("test3", new Options(conf)).getName());
    assertEquals("p1", kp.createKey("test4", new Options(conf)).getName());
}

Example 8 with Options

use of org.apache.hadoop.crypto.key.KeyProvider.Options in project hadoop by apache.

the class TestLoadBalancingKMSClientProvider method testLoadBalancingWithAllBadNodes.

@Test
public void testLoadBalancingWithAllBadNodes() throws Exception {
    Configuration conf = new Configuration();
    KMSClientProvider p1 = mock(KMSClientProvider.class);
    when(p1.createKey(Mockito.anyString(), Mockito.any(Options.class))).thenThrow(new IOException("p1"));
    KMSClientProvider p2 = mock(KMSClientProvider.class);
    when(p2.createKey(Mockito.anyString(), Mockito.any(Options.class))).thenThrow(new IOException("p2"));
    KMSClientProvider p3 = mock(KMSClientProvider.class);
    when(p3.createKey(Mockito.anyString(), Mockito.any(Options.class))).thenThrow(new IOException("p3"));
    KMSClientProvider p4 = mock(KMSClientProvider.class);
    when(p4.createKey(Mockito.anyString(), Mockito.any(Options.class))).thenThrow(new IOException("p4"));
    when(p1.getKMSUrl()).thenReturn("p1");
    when(p2.getKMSUrl()).thenReturn("p2");
    when(p3.getKMSUrl()).thenReturn("p3");
    when(p4.getKMSUrl()).thenReturn("p4");
    KeyProvider kp = new LoadBalancingKMSClientProvider(new KMSClientProvider[] { p1, p2, p3, p4 }, 0, conf);
    try {
        kp.createKey("test3", new Options(conf)).getName();
        fail("Should fail since all providers threw an IOException");
    } catch (Exception e) {
        assertTrue(e instanceof IOException);
    }
}

Example 9 with Options

use of org.apache.hadoop.crypto.key.KeyProvider.Options in project hadoop by apache.

the class TestKMS method testKMSProvider.

@Test
@SuppressWarnings("checkstyle:methodlength")
public void testKMSProvider() throws Exception {
    Configuration conf = new Configuration();
    conf.set("hadoop.security.authentication", "kerberos");
    File confDir = getTestDir();
    conf = createBaseKMSConf(confDir, conf);
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k1.ALL", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k2.MANAGEMENT", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k2.READ", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k3.ALL", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k4.ALL", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k5.ALL", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k6.ALL", "*");
    writeConf(confDir, conf);
    runServer(null, null, confDir, new KMSCallable<Void>() {

        @Override
        public Void call() throws Exception {
            Date started = new Date();
            Configuration conf = new Configuration();
            URI uri = createKMSUri(getKMSUrl());
            KeyProvider kp = createProvider(uri, conf);
            // getKeys() empty
            Assert.assertTrue(kp.getKeys().isEmpty());
            // getKeysMetadata() empty
            Assert.assertEquals(0, kp.getKeysMetadata().length);
            // createKey()
            KeyProvider.Options options = new KeyProvider.Options(conf);
            options.setCipher("AES/CTR/NoPadding");
            options.setBitLength(128);
            options.setDescription("l1");
            KeyProvider.KeyVersion kv0 = kp.createKey("k1", options);
            Assert.assertNotNull(kv0);
            Assert.assertNotNull(kv0.getVersionName());
            Assert.assertNotNull(kv0.getMaterial());
            // getKeyVersion()
            KeyProvider.KeyVersion kv1 = kp.getKeyVersion(kv0.getVersionName());
            Assert.assertEquals(kv0.getVersionName(), kv1.getVersionName());
            Assert.assertNotNull(kv1.getMaterial());
            // getCurrent()
            KeyProvider.KeyVersion cv1 = kp.getCurrentKey("k1");
            Assert.assertEquals(kv0.getVersionName(), cv1.getVersionName());
            Assert.assertNotNull(cv1.getMaterial());
            // getKeyMetadata() 1 version
            KeyProvider.Metadata m1 = kp.getMetadata("k1");
            Assert.assertEquals("AES/CTR/NoPadding", m1.getCipher());
            Assert.assertEquals("AES", m1.getAlgorithm());
            Assert.assertEquals(128, m1.getBitLength());
            Assert.assertEquals(1, m1.getVersions());
            Assert.assertNotNull(m1.getCreated());
            Assert.assertTrue(started.before(m1.getCreated()));
            // getKeyVersions() 1 version
            List<KeyProvider.KeyVersion> lkv1 = kp.getKeyVersions("k1");
            Assert.assertEquals(1, lkv1.size());
            Assert.assertEquals(kv0.getVersionName(), lkv1.get(0).getVersionName());
            Assert.assertNotNull(kv1.getMaterial());
            // rollNewVersion()
            KeyProvider.KeyVersion kv2 = kp.rollNewVersion("k1");
            Assert.assertNotSame(kv0.getVersionName(), kv2.getVersionName());
            Assert.assertNotNull(kv2.getMaterial());
            // getKeyVersion()
            kv2 = kp.getKeyVersion(kv2.getVersionName());
            boolean eq = true;
            for (int i = 0; i < kv1.getMaterial().length; i++) {
                eq = eq && kv1.getMaterial()[i] == kv2.getMaterial()[i];
            }
            Assert.assertFalse(eq);
            // getCurrent()
            KeyProvider.KeyVersion cv2 = kp.getCurrentKey("k1");
            Assert.assertEquals(kv2.getVersionName(), cv2.getVersionName());
            Assert.assertNotNull(cv2.getMaterial());
            eq = true;
            for (int i = 0; i < kv1.getMaterial().length; i++) {
                eq = eq && cv2.getMaterial()[i] == kv2.getMaterial()[i];
            }
            Assert.assertTrue(eq);
            // getKeyVersions() 2 versions
            List<KeyProvider.KeyVersion> lkv2 = kp.getKeyVersions("k1");
            Assert.assertEquals(2, lkv2.size());
            Assert.assertEquals(kv1.getVersionName(), lkv2.get(0).getVersionName());
            Assert.assertNotNull(lkv2.get(0).getMaterial());
            Assert.assertEquals(kv2.getVersionName(), lkv2.get(1).getVersionName());
            Assert.assertNotNull(lkv2.get(1).getMaterial());
            // getKeyMetadata() 2 version
            KeyProvider.Metadata m2 = kp.getMetadata("k1");
            Assert.assertEquals("AES/CTR/NoPadding", m2.getCipher());
            Assert.assertEquals("AES", m2.getAlgorithm());
            Assert.assertEquals(128, m2.getBitLength());
            Assert.assertEquals(2, m2.getVersions());
            Assert.assertNotNull(m2.getCreated());
            Assert.assertTrue(started.before(m2.getCreated()));
            // getKeys() 1 key
            List<String> ks1 = kp.getKeys();
            Assert.assertEquals(1, ks1.size());
            Assert.assertEquals("k1", ks1.get(0));
            // getKeysMetadata() 1 key 2 versions
            KeyProvider.Metadata[] kms1 = kp.getKeysMetadata("k1");
            Assert.assertEquals(1, kms1.length);
            Assert.assertEquals("AES/CTR/NoPadding", kms1[0].getCipher());
            Assert.assertEquals("AES", kms1[0].getAlgorithm());
            Assert.assertEquals(128, kms1[0].getBitLength());
            Assert.assertEquals(2, kms1[0].getVersions());
            Assert.assertNotNull(kms1[0].getCreated());
            Assert.assertTrue(started.before(kms1[0].getCreated()));
            // test generate and decryption of EEK
            KeyProvider.KeyVersion kv = kp.getCurrentKey("k1");
            KeyProviderCryptoExtension kpExt = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
            EncryptedKeyVersion ek1 = kpExt.generateEncryptedKey(kv.getName());
            Assert.assertEquals(KeyProviderCryptoExtension.EEK, ek1.getEncryptedKeyVersion().getVersionName());
            Assert.assertNotNull(ek1.getEncryptedKeyVersion().getMaterial());
            Assert.assertEquals(kv.getMaterial().length, ek1.getEncryptedKeyVersion().getMaterial().length);
            KeyProvider.KeyVersion k1 = kpExt.decryptEncryptedKey(ek1);
            Assert.assertEquals(KeyProviderCryptoExtension.EK, k1.getVersionName());
            KeyProvider.KeyVersion k1a = kpExt.decryptEncryptedKey(ek1);
            Assert.assertArrayEquals(k1.getMaterial(), k1a.getMaterial());
            Assert.assertEquals(kv.getMaterial().length, k1.getMaterial().length);
            EncryptedKeyVersion ek2 = kpExt.generateEncryptedKey(kv.getName());
            KeyProvider.KeyVersion k2 = kpExt.decryptEncryptedKey(ek2);
            boolean isEq = true;
            for (int i = 0; isEq && i < ek2.getEncryptedKeyVersion().getMaterial().length; i++) {
                isEq = k2.getMaterial()[i] == k1.getMaterial()[i];
            }
            Assert.assertFalse(isEq);
            // test re-encrypt
            kpExt.rollNewVersion(ek1.getEncryptionKeyName());
            EncryptedKeyVersion ek1r = kpExt.reencryptEncryptedKey(ek1);
            assertEquals(KeyProviderCryptoExtension.EEK, ek1r.getEncryptedKeyVersion().getVersionName());
            assertFalse(Arrays.equals(ek1.getEncryptedKeyVersion().getMaterial(), ek1r.getEncryptedKeyVersion().getMaterial()));
            assertEquals(kv.getMaterial().length, ek1r.getEncryptedKeyVersion().getMaterial().length);
            assertEquals(ek1.getEncryptionKeyName(), ek1r.getEncryptionKeyName());
            assertArrayEquals(ek1.getEncryptedKeyIv(), ek1r.getEncryptedKeyIv());
            assertNotEquals(ek1.getEncryptionKeyVersionName(), ek1r.getEncryptionKeyVersionName());
            KeyProvider.KeyVersion k1r = kpExt.decryptEncryptedKey(ek1r);
            assertEquals(KeyProviderCryptoExtension.EK, k1r.getVersionName());
            assertArrayEquals(k1.getMaterial(), k1r.getMaterial());
            assertEquals(kv.getMaterial().length, k1r.getMaterial().length);
            // deleteKey()
            kp.deleteKey("k1");
            // Check decryption after Key deletion
            try {
                kpExt.decryptEncryptedKey(ek1);
                Assert.fail("Should not be allowed !!");
            } catch (Exception e) {
                Assert.assertTrue(e.getMessage().contains("'k1@1' not found"));
            }
            // getKey()
            Assert.assertNull(kp.getKeyVersion("k1"));
            // getKeyVersions()
            Assert.assertNull(kp.getKeyVersions("k1"));
            // getMetadata()
            Assert.assertNull(kp.getMetadata("k1"));
            // getKeys() empty
            Assert.assertTrue(kp.getKeys().isEmpty());
            // getKeysMetadata() empty
            Assert.assertEquals(0, kp.getKeysMetadata().length);
            // createKey() no description, no tags
            options = new KeyProvider.Options(conf);
            options.setCipher("AES/CTR/NoPadding");
            options.setBitLength(128);
            KeyVersion kVer2 = kp.createKey("k2", options);
            KeyProvider.Metadata meta = kp.getMetadata("k2");
            Assert.assertNull(meta.getDescription());
            Assert.assertEquals("k2", meta.getAttributes().get("key.acl.name"));
            // test key ACL.. k2 is granted only MANAGEMENT Op access
            try {
                kpExt = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                kpExt.generateEncryptedKey(kVer2.getName());
                Assert.fail("User should not be allowed to encrypt !!");
            } catch (Exception ex) {
            // 
            }
            // createKey() description, no tags
            options = new KeyProvider.Options(conf);
            options.setCipher("AES/CTR/NoPadding");
            options.setBitLength(128);
            options.setDescription("d");
            kp.createKey("k3", options);
            meta = kp.getMetadata("k3");
            Assert.assertEquals("d", meta.getDescription());
            Assert.assertEquals("k3", meta.getAttributes().get("key.acl.name"));
            Map<String, String> attributes = new HashMap<String, String>();
            attributes.put("a", "A");
            // createKey() no description, tags
            options = new KeyProvider.Options(conf);
            options.setCipher("AES/CTR/NoPadding");
            options.setBitLength(128);
            attributes.put("key.acl.name", "k4");
            options.setAttributes(attributes);
            kp.createKey("k4", options);
            meta = kp.getMetadata("k4");
            Assert.assertNull(meta.getDescription());
            Assert.assertEquals(attributes, meta.getAttributes());
            // createKey() description, tags
            options = new KeyProvider.Options(conf);
            options.setCipher("AES/CTR/NoPadding");
            options.setBitLength(128);
            options.setDescription("d");
            attributes.put("key.acl.name", "k5");
            options.setAttributes(attributes);
            kp.createKey("k5", options);
            meta = kp.getMetadata("k5");
            Assert.assertEquals("d", meta.getDescription());
            Assert.assertEquals(attributes, meta.getAttributes());
            // test rollover draining
            KeyProviderCryptoExtension kpce = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
            options = new KeyProvider.Options(conf);
            options.setCipher("AES/CTR/NoPadding");
            options.setBitLength(128);
            kpce.createKey("k6", options);
            EncryptedKeyVersion ekv1 = kpce.generateEncryptedKey("k6");
            kpce.rollNewVersion("k6");
            kpce.invalidateCache("k6");
            EncryptedKeyVersion ekv2 = kpce.generateEncryptedKey("k6");
            assertNotEquals("rollover did not generate a new key even after" + " queue is drained", ekv1.getEncryptionKeyVersionName(), ekv2.getEncryptionKeyVersionName());
            return null;
        }
    });
}

Example 10 with Options

use of org.apache.hadoop.crypto.key.KeyProvider.Options in project hadoop by apache.

the class TestKMS method testSpecialKeyNames.

@Test(timeout = 30000)
public void testSpecialKeyNames() throws Exception {
    final String specialKey = "key %^[\n{]}|\"<>\\";
    Configuration conf = new Configuration();
    conf.set("hadoop.security.authentication", "kerberos");
    File confDir = getTestDir();
    conf = createBaseKMSConf(confDir, conf);
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + specialKey + ".ALL", "*");
    writeConf(confDir, conf);
    runServer(null, null, confDir, new KMSCallable<Void>() {

        @Override
        public Void call() throws Exception {
            Configuration conf = new Configuration();
            URI uri = createKMSUri(getKMSUrl());
            KeyProvider kp = createProvider(uri, conf);
            Assert.assertTrue(kp.getKeys().isEmpty());
            Assert.assertEquals(0, kp.getKeysMetadata().length);
            KeyProvider.Options options = new KeyProvider.Options(conf);
            options.setCipher("AES/CTR/NoPadding");
            options.setBitLength(128);
            options.setDescription("l1");
            LOG.info("Creating key with name '{}'", specialKey);
            KeyProvider.KeyVersion kv0 = kp.createKey(specialKey, options);
            Assert.assertNotNull(kv0);
            Assert.assertEquals(specialKey, kv0.getName());
            Assert.assertNotNull(kv0.getVersionName());
            Assert.assertNotNull(kv0.getMaterial());
            return null;
        }
    });
}