Examples with Options org.apache.hadoop.crypto.key.KeyProvider.Options used on opensource projects

Example 11 with Options

use of org.apache.hadoop.crypto.key.KeyProvider.Options in project hadoop by apache.

the class TestKMS method testKMSProviderCaching.

@Test
public void testKMSProviderCaching() throws Exception {
    Configuration conf = new Configuration();
    File confDir = getTestDir();
    conf = createBaseKMSConf(confDir, conf);
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k1.ALL", "*");
    writeConf(confDir, conf);
    runServer(null, null, confDir, new KMSCallable<Void>() {

        @Override
        public Void call() throws Exception {
            final String keyName = "k1";
            final String mockVersionName = "mock";
            final Configuration conf = new Configuration();
            final URI uri = createKMSUri(getKMSUrl());
            KMSClientProvider kmscp = createKMSClientProvider(uri, conf);
            // get the reference to the internal cache, to test invalidation.
            ValueQueue vq = (ValueQueue) Whitebox.getInternalState(kmscp, "encKeyVersionQueue");
            LoadingCache<String, LinkedBlockingQueue<EncryptedKeyVersion>> kq = ((LoadingCache<String, LinkedBlockingQueue<EncryptedKeyVersion>>) Whitebox.getInternalState(vq, "keyQueues"));
            EncryptedKeyVersion mockEKV = Mockito.mock(EncryptedKeyVersion.class);
            when(mockEKV.getEncryptionKeyName()).thenReturn(keyName);
            when(mockEKV.getEncryptionKeyVersionName()).thenReturn(mockVersionName);
            // createKey()
            KeyProvider.Options options = new KeyProvider.Options(conf);
            options.setCipher("AES/CTR/NoPadding");
            options.setBitLength(128);
            options.setDescription("l1");
            KeyProvider.KeyVersion kv0 = kmscp.createKey(keyName, options);
            assertNotNull(kv0.getVersionName());
            assertEquals("Default key version name is incorrect.", "k1@0", kmscp.generateEncryptedKey(keyName).getEncryptionKeyVersionName());
            kmscp.invalidateCache(keyName);
            kq.get(keyName).put(mockEKV);
            assertEquals("Key version incorrect after invalidating cache + putting" + " mock key.", mockVersionName, kmscp.generateEncryptedKey(keyName).getEncryptionKeyVersionName());
            // test new version is returned after invalidation.
            for (int i = 0; i < 100; ++i) {
                kq.get(keyName).put(mockEKV);
                kmscp.invalidateCache(keyName);
                assertEquals("Cache invalidation guarantee failed.", "k1@0", kmscp.generateEncryptedKey(keyName).getEncryptionKeyVersionName());
            }
            return null;
        }
    });
}

Example 12 with Options

use of org.apache.hadoop.crypto.key.KeyProvider.Options in project hadoop by apache.

the class TestKeyAuthorizationKeyProvider method testOpsWhenACLAttributeExists.

@Test
public void testOpsWhenACLAttributeExists() throws Exception {
    final Configuration conf = new Configuration();
    KeyProvider kp = new UserProvider.Factory().createProvider(new URI("user:///"), conf);
    KeyACLs mock = mock(KeyACLs.class);
    when(mock.isACLPresent("testKey", KeyOpType.MANAGEMENT)).thenReturn(true);
    when(mock.isACLPresent("testKey", KeyOpType.GENERATE_EEK)).thenReturn(true);
    when(mock.isACLPresent("testKey", KeyOpType.DECRYPT_EEK)).thenReturn(true);
    when(mock.isACLPresent("testKey", KeyOpType.ALL)).thenReturn(true);
    UserGroupInformation u1 = UserGroupInformation.createRemoteUser("u1");
    UserGroupInformation u2 = UserGroupInformation.createRemoteUser("u2");
    UserGroupInformation u3 = UserGroupInformation.createRemoteUser("u3");
    UserGroupInformation sudo = UserGroupInformation.createRemoteUser("sudo");
    when(mock.hasAccessToKey("testKey", u1, KeyOpType.MANAGEMENT)).thenReturn(true);
    when(mock.hasAccessToKey("testKey", u2, KeyOpType.GENERATE_EEK)).thenReturn(true);
    when(mock.hasAccessToKey("testKey", u3, KeyOpType.DECRYPT_EEK)).thenReturn(true);
    when(mock.hasAccessToKey("testKey", sudo, KeyOpType.ALL)).thenReturn(true);
    final KeyProviderCryptoExtension kpExt = new KeyAuthorizationKeyProvider(KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp), mock);
    final KeyVersion barKv = u1.doAs(new PrivilegedExceptionAction<KeyVersion>() {

        @Override
        public KeyVersion run() throws Exception {
            Options opt = newOptions(conf);
            Map<String, String> m = new HashMap<String, String>();
            m.put("key.acl.name", "testKey");
            opt.setAttributes(m);
            try {
                KeyVersion kv = kpExt.createKey("foo", SecureRandom.getSeed(16), opt);
                kpExt.rollNewVersion(kv.getName());
                kpExt.rollNewVersion(kv.getName(), SecureRandom.getSeed(16));
                kpExt.deleteKey(kv.getName());
            } catch (IOException ioe) {
                Assert.fail("User should be Authorized !!");
            }
            KeyVersion retkv = null;
            try {
                retkv = kpExt.createKey("bar", SecureRandom.getSeed(16), opt);
                kpExt.generateEncryptedKey(retkv.getName());
                Assert.fail("User should NOT be Authorized to generate EEK !!");
            } catch (IOException ioe) {
            }
            Assert.assertNotNull(retkv);
            return retkv;
        }
    });
    final EncryptedKeyVersion barEKv = u2.doAs(new PrivilegedExceptionAction<EncryptedKeyVersion>() {

        @Override
        public EncryptedKeyVersion run() throws Exception {
            try {
                kpExt.deleteKey(barKv.getName());
                Assert.fail("User should NOT be Authorized to " + "perform any other operation !!");
            } catch (IOException ioe) {
            }
            return kpExt.generateEncryptedKey(barKv.getName());
        }
    });
    u3.doAs(new PrivilegedExceptionAction<KeyVersion>() {

        @Override
        public KeyVersion run() throws Exception {
            try {
                kpExt.deleteKey(barKv.getName());
                Assert.fail("User should NOT be Authorized to " + "perform any other operation !!");
            } catch (IOException ioe) {
            }
            return kpExt.decryptEncryptedKey(barEKv);
        }
    });
    sudo.doAs(new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            Options opt = newOptions(conf);
            Map<String, String> m = new HashMap<String, String>();
            m.put("key.acl.name", "testKey");
            opt.setAttributes(m);
            try {
                KeyVersion kv = kpExt.createKey("foo", SecureRandom.getSeed(16), opt);
                kpExt.rollNewVersion(kv.getName());
                kpExt.rollNewVersion(kv.getName(), SecureRandom.getSeed(16));
                EncryptedKeyVersion ekv = kpExt.generateEncryptedKey(kv.getName());
                kpExt.decryptEncryptedKey(ekv);
                kpExt.deleteKey(kv.getName());
            } catch (IOException ioe) {
                Assert.fail("User should be Allowed to do everything !!");
            }
            return null;
        }
    });
}