Examples with KeyProviderCryptoExtension org.apache.hadoop.crypto.key.KeyProviderCryptoExtension used on opensource projects

Example 6 with KeyProviderCryptoExtension

use of org.apache.hadoop.crypto.key.KeyProviderCryptoExtension in project hadoop by apache.

the class DFSClient method decryptEncryptedDataEncryptionKey.

/**
   * Decrypts a EDEK by consulting the KeyProvider.
   */
private KeyVersion decryptEncryptedDataEncryptionKey(FileEncryptionInfo feInfo) throws IOException {
    try (TraceScope ignored = tracer.newScope("decryptEDEK")) {
        KeyProvider provider = getKeyProvider();
        if (provider == null) {
            throw new IOException("No KeyProvider is configured, cannot access" + " an encrypted file");
        }
        EncryptedKeyVersion ekv = EncryptedKeyVersion.createForDecryption(feInfo.getKeyName(), feInfo.getEzKeyVersionName(), feInfo.getIV(), feInfo.getEncryptedDataEncryptionKey());
        try {
            KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(provider);
            return cryptoProvider.decryptEncryptedKey(ekv);
        } catch (GeneralSecurityException e) {
            throw new IOException(e);
        }
    }
}

Example 7 with KeyProviderCryptoExtension

use of org.apache.hadoop.crypto.key.KeyProviderCryptoExtension in project hive by apache.

the class Hadoop23Shims method getMiniDfs.

// Don't move this code to the parent class. There's a binary
// incompatibility between hadoop 1 and 2 wrt MiniDFSCluster and we
// need to have two different shim classes even though they are
// exactly the same.
@Override
public HadoopShims.MiniDFSShim getMiniDfs(Configuration conf, int numDataNodes, boolean format, String[] racks, boolean isHA) throws IOException {
    configureImpersonation(conf);
    MiniDFSCluster miniDFSCluster;
    if (isHA) {
        MiniDFSNNTopology topo = new MiniDFSNNTopology().addNameservice(new MiniDFSNNTopology.NSConf("minidfs").addNN(new MiniDFSNNTopology.NNConf("nn1")).addNN(new MiniDFSNNTopology.NNConf("nn2")));
        miniDFSCluster = new MiniDFSCluster.Builder(conf).numDataNodes(numDataNodes).format(format).racks(racks).nnTopology(topo).build();
        miniDFSCluster.waitActive();
        miniDFSCluster.transitionToActive(0);
    } else {
        miniDFSCluster = new MiniDFSCluster.Builder(conf).numDataNodes(numDataNodes).format(format).racks(racks).build();
    }
    // Need to set the client's KeyProvider to the NN's for JKS,
    // else the updates do not get flushed properly
    KeyProviderCryptoExtension keyProvider = miniDFSCluster.getNameNode(0).getNamesystem().getProvider();
    if (keyProvider != null) {
        try {
            setKeyProvider(miniDFSCluster.getFileSystem(0).getClient(), keyProvider);
        } catch (Exception err) {
            throw new IOException(err);
        }
    }
    cluster = new MiniDFSShim(miniDFSCluster);
    return cluster;
}

Example 8 with KeyProviderCryptoExtension

use of org.apache.hadoop.crypto.key.KeyProviderCryptoExtension in project hadoop by apache.

the class TestKMS method testACLs.

@Test
@SuppressWarnings("checkstyle:methodlength")
public void testACLs() throws Exception {
    Configuration conf = new Configuration();
    conf.set("hadoop.security.authentication", "kerberos");
    final File testDir = getTestDir();
    conf = createBaseKMSConf(testDir, conf);
    conf.set("hadoop.kms.authentication.type", "kerberos");
    conf.set("hadoop.kms.authentication.kerberos.keytab", keytab.getAbsolutePath());
    conf.set("hadoop.kms.authentication.kerberos.principal", "HTTP/localhost");
    conf.set("hadoop.kms.authentication.kerberos.name.rules", "DEFAULT");
    for (KMSACLs.Type type : KMSACLs.Type.values()) {
        conf.set(type.getAclConfigKey(), type.toString());
    }
    conf.set(KMSACLs.Type.CREATE.getAclConfigKey(), KMSACLs.Type.CREATE.toString() + ",SET_KEY_MATERIAL");
    conf.set(KMSACLs.Type.ROLLOVER.getAclConfigKey(), KMSACLs.Type.ROLLOVER.toString() + ",SET_KEY_MATERIAL");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k0.ALL", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k1.ALL", "*");
    writeConf(testDir, conf);
    runServer(null, null, testDir, new KMSCallable<Void>() {

        @Override
        public Void call() throws Exception {
            final Configuration conf = new Configuration();
            conf.setInt(KeyProvider.DEFAULT_BITLENGTH_NAME, 128);
            final URI uri = createKMSUri(getKMSUrl());
            //nothing allowed
            doAs("client", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        kp.createKey("k", new KeyProvider.Options(conf));
                        Assert.fail();
                    } catch (AuthorizationException ex) {
                    //NOP
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    try {
                        kp.createKey("k", new byte[16], new KeyProvider.Options(conf));
                        Assert.fail();
                    } catch (AuthorizationException ex) {
                    //NOP
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    try {
                        kp.rollNewVersion("k");
                        Assert.fail();
                    } catch (AuthorizationException ex) {
                    //NOP
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    try {
                        kp.rollNewVersion("k", new byte[16]);
                        Assert.fail();
                    } catch (AuthorizationException ex) {
                    //NOP
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    try {
                        kp.getKeys();
                        Assert.fail();
                    } catch (AuthorizationException ex) {
                    //NOP
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    try {
                        kp.getKeysMetadata("k");
                        Assert.fail();
                    } catch (AuthorizationException ex) {
                    //NOP
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    try {
                        // we are using JavaKeyStoreProvider for testing, so we know how
                        // the keyversion is created.
                        kp.getKeyVersion("k@0");
                        Assert.fail();
                    } catch (AuthorizationException ex) {
                    //NOP
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    try {
                        kp.getCurrentKey("k");
                        Assert.fail();
                    } catch (AuthorizationException ex) {
                    //NOP
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    try {
                        kp.getMetadata("k");
                        Assert.fail();
                    } catch (AuthorizationException ex) {
                    //NOP
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    try {
                        kp.getKeyVersions("k");
                        Assert.fail();
                    } catch (AuthorizationException ex) {
                    //NOP
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            doAs("CREATE", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        KeyProvider.KeyVersion kv = kp.createKey("k0", new KeyProvider.Options(conf));
                        Assert.assertNull(kv.getMaterial());
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            doAs("DELETE", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        kp.deleteKey("k0");
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            doAs("SET_KEY_MATERIAL", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        KeyProvider.KeyVersion kv = kp.createKey("k1", new byte[16], new KeyProvider.Options(conf));
                        Assert.assertNull(kv.getMaterial());
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            doAs("ROLLOVER", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        KeyProvider.KeyVersion kv = kp.rollNewVersion("k1");
                        Assert.assertNull(kv.getMaterial());
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            doAs("SET_KEY_MATERIAL", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        KeyProvider.KeyVersion kv = kp.rollNewVersion("k1", new byte[16]);
                        Assert.assertNull(kv.getMaterial());
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            final KeyVersion currKv = doAs("GET", new PrivilegedExceptionAction<KeyVersion>() {

                @Override
                public KeyVersion run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        kp.getKeyVersion("k1@0");
                        KeyVersion kv = kp.getCurrentKey("k1");
                        return kv;
                    } catch (Exception ex) {
                        Assert.fail(ex.toString());
                    }
                    return null;
                }
            });
            final EncryptedKeyVersion encKv = doAs("GENERATE_EEK", new PrivilegedExceptionAction<EncryptedKeyVersion>() {

                @Override
                public EncryptedKeyVersion run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        KeyProviderCryptoExtension kpCE = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                        EncryptedKeyVersion ek1 = kpCE.generateEncryptedKey(currKv.getName());
                        return ek1;
                    } catch (Exception ex) {
                        Assert.fail(ex.toString());
                    }
                    return null;
                }
            });
            doAs("GENERATE_EEK", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    KeyProviderCryptoExtension kpCE = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                    kpCE.reencryptEncryptedKey(encKv);
                    return null;
                }
            });
            doAs("DECRYPT_EEK", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        KeyProviderCryptoExtension kpCE = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                        kpCE.decryptEncryptedKey(encKv);
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            doAs("GET_KEYS", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        kp.getKeys();
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            doAs("GET_METADATA", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        kp.getMetadata("k1");
                        kp.getKeysMetadata("k1");
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            //stop the reloader, to avoid running while we are writing the new file
            KMSWebApp.getACLs().stopReloader();
            // test ACL reloading
            // to ensure the ACLs file modifiedTime is newer
            Thread.sleep(10);
            conf.set(KMSACLs.Type.CREATE.getAclConfigKey(), "foo");
            conf.set(KMSACLs.Type.GENERATE_EEK.getAclConfigKey(), "foo");
            writeConf(testDir, conf);
            Thread.sleep(1000);
            // forcing a reload by hand.
            KMSWebApp.getACLs().run();
            // should not be able to create a key now
            doAs("CREATE", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    try {
                        KeyProvider kp = createProvider(uri, conf);
                        KeyProvider.KeyVersion kv = kp.createKey("k2", new KeyProvider.Options(conf));
                        Assert.fail();
                    } catch (AuthorizationException ex) {
                    //NOP
                    } catch (Exception ex) {
                        Assert.fail(ex.getMessage());
                    }
                    return null;
                }
            });
            doAs("GENERATE_EEK", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        KeyProviderCryptoExtension kpCE = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                        kpCE.generateEncryptedKey("k1");
                    } catch (IOException ex) {
                        // through the ValueQueue. See KMSCP#generateEncryptedKey.
                        if (ex.getCause().getCause() instanceof AuthorizationException) {
                            LOG.info("Caught expected exception.", ex);
                        } else {
                            throw ex;
                        }
                    }
                    return null;
                }
            });
            doAs("GENERATE_EEK", new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    KeyProvider kp = createProvider(uri, conf);
                    try {
                        KeyProviderCryptoExtension kpCE = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                        kpCE.reencryptEncryptedKey(encKv);
                    } catch (AuthorizationException ex) {
                        LOG.info("Caught expected exception.", ex);
                    }
                    return null;
                }
            });
            return null;
        }
    });
}

Example 9 with KeyProviderCryptoExtension

use of org.apache.hadoop.crypto.key.KeyProviderCryptoExtension in project hadoop by apache.

the class TestKMS method testKMSProvider.

@Test
@SuppressWarnings("checkstyle:methodlength")
public void testKMSProvider() throws Exception {
    Configuration conf = new Configuration();
    conf.set("hadoop.security.authentication", "kerberos");
    File confDir = getTestDir();
    conf = createBaseKMSConf(confDir, conf);
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k1.ALL", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k2.MANAGEMENT", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k2.READ", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k3.ALL", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k4.ALL", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k5.ALL", "*");
    conf.set(KeyAuthorizationKeyProvider.KEY_ACL + "k6.ALL", "*");
    writeConf(confDir, conf);
    runServer(null, null, confDir, new KMSCallable<Void>() {

        @Override
        public Void call() throws Exception {
            Date started = new Date();
            Configuration conf = new Configuration();
            URI uri = createKMSUri(getKMSUrl());
            KeyProvider kp = createProvider(uri, conf);
            // getKeys() empty
            Assert.assertTrue(kp.getKeys().isEmpty());
            // getKeysMetadata() empty
            Assert.assertEquals(0, kp.getKeysMetadata().length);
            // createKey()
            KeyProvider.Options options = new KeyProvider.Options(conf);
            options.setCipher("AES/CTR/NoPadding");
            options.setBitLength(128);
            options.setDescription("l1");
            KeyProvider.KeyVersion kv0 = kp.createKey("k1", options);
            Assert.assertNotNull(kv0);
            Assert.assertNotNull(kv0.getVersionName());
            Assert.assertNotNull(kv0.getMaterial());
            // getKeyVersion()
            KeyProvider.KeyVersion kv1 = kp.getKeyVersion(kv0.getVersionName());
            Assert.assertEquals(kv0.getVersionName(), kv1.getVersionName());
            Assert.assertNotNull(kv1.getMaterial());
            // getCurrent()
            KeyProvider.KeyVersion cv1 = kp.getCurrentKey("k1");
            Assert.assertEquals(kv0.getVersionName(), cv1.getVersionName());
            Assert.assertNotNull(cv1.getMaterial());
            // getKeyMetadata() 1 version
            KeyProvider.Metadata m1 = kp.getMetadata("k1");
            Assert.assertEquals("AES/CTR/NoPadding", m1.getCipher());
            Assert.assertEquals("AES", m1.getAlgorithm());
            Assert.assertEquals(128, m1.getBitLength());
            Assert.assertEquals(1, m1.getVersions());
            Assert.assertNotNull(m1.getCreated());
            Assert.assertTrue(started.before(m1.getCreated()));
            // getKeyVersions() 1 version
            List<KeyProvider.KeyVersion> lkv1 = kp.getKeyVersions("k1");
            Assert.assertEquals(1, lkv1.size());
            Assert.assertEquals(kv0.getVersionName(), lkv1.get(0).getVersionName());
            Assert.assertNotNull(kv1.getMaterial());
            // rollNewVersion()
            KeyProvider.KeyVersion kv2 = kp.rollNewVersion("k1");
            Assert.assertNotSame(kv0.getVersionName(), kv2.getVersionName());
            Assert.assertNotNull(kv2.getMaterial());
            // getKeyVersion()
            kv2 = kp.getKeyVersion(kv2.getVersionName());
            boolean eq = true;
            for (int i = 0; i < kv1.getMaterial().length; i++) {
                eq = eq && kv1.getMaterial()[i] == kv2.getMaterial()[i];
            }
            Assert.assertFalse(eq);
            // getCurrent()
            KeyProvider.KeyVersion cv2 = kp.getCurrentKey("k1");
            Assert.assertEquals(kv2.getVersionName(), cv2.getVersionName());
            Assert.assertNotNull(cv2.getMaterial());
            eq = true;
            for (int i = 0; i < kv1.getMaterial().length; i++) {
                eq = eq && cv2.getMaterial()[i] == kv2.getMaterial()[i];
            }
            Assert.assertTrue(eq);
            // getKeyVersions() 2 versions
            List<KeyProvider.KeyVersion> lkv2 = kp.getKeyVersions("k1");
            Assert.assertEquals(2, lkv2.size());
            Assert.assertEquals(kv1.getVersionName(), lkv2.get(0).getVersionName());
            Assert.assertNotNull(lkv2.get(0).getMaterial());
            Assert.assertEquals(kv2.getVersionName(), lkv2.get(1).getVersionName());
            Assert.assertNotNull(lkv2.get(1).getMaterial());
            // getKeyMetadata() 2 version
            KeyProvider.Metadata m2 = kp.getMetadata("k1");
            Assert.assertEquals("AES/CTR/NoPadding", m2.getCipher());
            Assert.assertEquals("AES", m2.getAlgorithm());
            Assert.assertEquals(128, m2.getBitLength());
            Assert.assertEquals(2, m2.getVersions());
            Assert.assertNotNull(m2.getCreated());
            Assert.assertTrue(started.before(m2.getCreated()));
            // getKeys() 1 key
            List<String> ks1 = kp.getKeys();
            Assert.assertEquals(1, ks1.size());
            Assert.assertEquals("k1", ks1.get(0));
            // getKeysMetadata() 1 key 2 versions
            KeyProvider.Metadata[] kms1 = kp.getKeysMetadata("k1");
            Assert.assertEquals(1, kms1.length);
            Assert.assertEquals("AES/CTR/NoPadding", kms1[0].getCipher());
            Assert.assertEquals("AES", kms1[0].getAlgorithm());
            Assert.assertEquals(128, kms1[0].getBitLength());
            Assert.assertEquals(2, kms1[0].getVersions());
            Assert.assertNotNull(kms1[0].getCreated());
            Assert.assertTrue(started.before(kms1[0].getCreated()));
            // test generate and decryption of EEK
            KeyProvider.KeyVersion kv = kp.getCurrentKey("k1");
            KeyProviderCryptoExtension kpExt = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
            EncryptedKeyVersion ek1 = kpExt.generateEncryptedKey(kv.getName());
            Assert.assertEquals(KeyProviderCryptoExtension.EEK, ek1.getEncryptedKeyVersion().getVersionName());
            Assert.assertNotNull(ek1.getEncryptedKeyVersion().getMaterial());
            Assert.assertEquals(kv.getMaterial().length, ek1.getEncryptedKeyVersion().getMaterial().length);
            KeyProvider.KeyVersion k1 = kpExt.decryptEncryptedKey(ek1);
            Assert.assertEquals(KeyProviderCryptoExtension.EK, k1.getVersionName());
            KeyProvider.KeyVersion k1a = kpExt.decryptEncryptedKey(ek1);
            Assert.assertArrayEquals(k1.getMaterial(), k1a.getMaterial());
            Assert.assertEquals(kv.getMaterial().length, k1.getMaterial().length);
            EncryptedKeyVersion ek2 = kpExt.generateEncryptedKey(kv.getName());
            KeyProvider.KeyVersion k2 = kpExt.decryptEncryptedKey(ek2);
            boolean isEq = true;
            for (int i = 0; isEq && i < ek2.getEncryptedKeyVersion().getMaterial().length; i++) {
                isEq = k2.getMaterial()[i] == k1.getMaterial()[i];
            }
            Assert.assertFalse(isEq);
            // test re-encrypt
            kpExt.rollNewVersion(ek1.getEncryptionKeyName());
            EncryptedKeyVersion ek1r = kpExt.reencryptEncryptedKey(ek1);
            assertEquals(KeyProviderCryptoExtension.EEK, ek1r.getEncryptedKeyVersion().getVersionName());
            assertFalse(Arrays.equals(ek1.getEncryptedKeyVersion().getMaterial(), ek1r.getEncryptedKeyVersion().getMaterial()));
            assertEquals(kv.getMaterial().length, ek1r.getEncryptedKeyVersion().getMaterial().length);
            assertEquals(ek1.getEncryptionKeyName(), ek1r.getEncryptionKeyName());
            assertArrayEquals(ek1.getEncryptedKeyIv(), ek1r.getEncryptedKeyIv());
            assertNotEquals(ek1.getEncryptionKeyVersionName(), ek1r.getEncryptionKeyVersionName());
            KeyProvider.KeyVersion k1r = kpExt.decryptEncryptedKey(ek1r);
            assertEquals(KeyProviderCryptoExtension.EK, k1r.getVersionName());
            assertArrayEquals(k1.getMaterial(), k1r.getMaterial());
            assertEquals(kv.getMaterial().length, k1r.getMaterial().length);
            // deleteKey()
            kp.deleteKey("k1");
            // Check decryption after Key deletion
            try {
                kpExt.decryptEncryptedKey(ek1);
                Assert.fail("Should not be allowed !!");
            } catch (Exception e) {
                Assert.assertTrue(e.getMessage().contains("'k1@1' not found"));
            }
            // getKey()
            Assert.assertNull(kp.getKeyVersion("k1"));
            // getKeyVersions()
            Assert.assertNull(kp.getKeyVersions("k1"));
            // getMetadata()
            Assert.assertNull(kp.getMetadata("k1"));
            // getKeys() empty
            Assert.assertTrue(kp.getKeys().isEmpty());
            // getKeysMetadata() empty
            Assert.assertEquals(0, kp.getKeysMetadata().length);
            // createKey() no description, no tags
            options = new KeyProvider.Options(conf);
            options.setCipher("AES/CTR/NoPadding");
            options.setBitLength(128);
            KeyVersion kVer2 = kp.createKey("k2", options);
            KeyProvider.Metadata meta = kp.getMetadata("k2");
            Assert.assertNull(meta.getDescription());
            Assert.assertEquals("k2", meta.getAttributes().get("key.acl.name"));
            // test key ACL.. k2 is granted only MANAGEMENT Op access
            try {
                kpExt = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
                kpExt.generateEncryptedKey(kVer2.getName());
                Assert.fail("User should not be allowed to encrypt !!");
            } catch (Exception ex) {
            // 
            }
            // createKey() description, no tags
            options = new KeyProvider.Options(conf);
            options.setCipher("AES/CTR/NoPadding");
            options.setBitLength(128);
            options.setDescription("d");
            kp.createKey("k3", options);
            meta = kp.getMetadata("k3");
            Assert.assertEquals("d", meta.getDescription());
            Assert.assertEquals("k3", meta.getAttributes().get("key.acl.name"));
            Map<String, String> attributes = new HashMap<String, String>();
            attributes.put("a", "A");
            // createKey() no description, tags
            options = new KeyProvider.Options(conf);
            options.setCipher("AES/CTR/NoPadding");
            options.setBitLength(128);
            attributes.put("key.acl.name", "k4");
            options.setAttributes(attributes);
            kp.createKey("k4", options);
            meta = kp.getMetadata("k4");
            Assert.assertNull(meta.getDescription());
            Assert.assertEquals(attributes, meta.getAttributes());
            // createKey() description, tags
            options = new KeyProvider.Options(conf);
            options.setCipher("AES/CTR/NoPadding");
            options.setBitLength(128);
            options.setDescription("d");
            attributes.put("key.acl.name", "k5");
            options.setAttributes(attributes);
            kp.createKey("k5", options);
            meta = kp.getMetadata("k5");
            Assert.assertEquals("d", meta.getDescription());
            Assert.assertEquals(attributes, meta.getAttributes());
            // test rollover draining
            KeyProviderCryptoExtension kpce = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp);
            options = new KeyProvider.Options(conf);
            options.setCipher("AES/CTR/NoPadding");
            options.setBitLength(128);
            kpce.createKey("k6", options);
            EncryptedKeyVersion ekv1 = kpce.generateEncryptedKey("k6");
            kpce.rollNewVersion("k6");
            kpce.invalidateCache("k6");
            EncryptedKeyVersion ekv2 = kpce.generateEncryptedKey("k6");
            assertNotEquals("rollover did not generate a new key even after" + " queue is drained", ekv1.getEncryptionKeyVersionName(), ekv2.getEncryptionKeyVersionName());
            return null;
        }
    });
}

Example 10 with KeyProviderCryptoExtension

use of org.apache.hadoop.crypto.key.KeyProviderCryptoExtension in project hadoop by apache.

the class TestKeyAuthorizationKeyProvider method testOpsWhenACLAttributeExists.

@Test
public void testOpsWhenACLAttributeExists() throws Exception {
    final Configuration conf = new Configuration();
    KeyProvider kp = new UserProvider.Factory().createProvider(new URI("user:///"), conf);
    KeyACLs mock = mock(KeyACLs.class);
    when(mock.isACLPresent("testKey", KeyOpType.MANAGEMENT)).thenReturn(true);
    when(mock.isACLPresent("testKey", KeyOpType.GENERATE_EEK)).thenReturn(true);
    when(mock.isACLPresent("testKey", KeyOpType.DECRYPT_EEK)).thenReturn(true);
    when(mock.isACLPresent("testKey", KeyOpType.ALL)).thenReturn(true);
    UserGroupInformation u1 = UserGroupInformation.createRemoteUser("u1");
    UserGroupInformation u2 = UserGroupInformation.createRemoteUser("u2");
    UserGroupInformation u3 = UserGroupInformation.createRemoteUser("u3");
    UserGroupInformation sudo = UserGroupInformation.createRemoteUser("sudo");
    when(mock.hasAccessToKey("testKey", u1, KeyOpType.MANAGEMENT)).thenReturn(true);
    when(mock.hasAccessToKey("testKey", u2, KeyOpType.GENERATE_EEK)).thenReturn(true);
    when(mock.hasAccessToKey("testKey", u3, KeyOpType.DECRYPT_EEK)).thenReturn(true);
    when(mock.hasAccessToKey("testKey", sudo, KeyOpType.ALL)).thenReturn(true);
    final KeyProviderCryptoExtension kpExt = new KeyAuthorizationKeyProvider(KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp), mock);
    final KeyVersion barKv = u1.doAs(new PrivilegedExceptionAction<KeyVersion>() {

        @Override
        public KeyVersion run() throws Exception {
            Options opt = newOptions(conf);
            Map<String, String> m = new HashMap<String, String>();
            m.put("key.acl.name", "testKey");
            opt.setAttributes(m);
            try {
                KeyVersion kv = kpExt.createKey("foo", SecureRandom.getSeed(16), opt);
                kpExt.rollNewVersion(kv.getName());
                kpExt.rollNewVersion(kv.getName(), SecureRandom.getSeed(16));
                kpExt.deleteKey(kv.getName());
            } catch (IOException ioe) {
                Assert.fail("User should be Authorized !!");
            }
            KeyVersion retkv = null;
            try {
                retkv = kpExt.createKey("bar", SecureRandom.getSeed(16), opt);
                kpExt.generateEncryptedKey(retkv.getName());
                Assert.fail("User should NOT be Authorized to generate EEK !!");
            } catch (IOException ioe) {
            }
            Assert.assertNotNull(retkv);
            return retkv;
        }
    });
    final EncryptedKeyVersion barEKv = u2.doAs(new PrivilegedExceptionAction<EncryptedKeyVersion>() {

        @Override
        public EncryptedKeyVersion run() throws Exception {
            try {
                kpExt.deleteKey(barKv.getName());
                Assert.fail("User should NOT be Authorized to " + "perform any other operation !!");
            } catch (IOException ioe) {
            }
            return kpExt.generateEncryptedKey(barKv.getName());
        }
    });
    u3.doAs(new PrivilegedExceptionAction<KeyVersion>() {

        @Override
        public KeyVersion run() throws Exception {
            try {
                kpExt.deleteKey(barKv.getName());
                Assert.fail("User should NOT be Authorized to " + "perform any other operation !!");
            } catch (IOException ioe) {
            }
            return kpExt.decryptEncryptedKey(barEKv);
        }
    });
    sudo.doAs(new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            Options opt = newOptions(conf);
            Map<String, String> m = new HashMap<String, String>();
            m.put("key.acl.name", "testKey");
            opt.setAttributes(m);
            try {
                KeyVersion kv = kpExt.createKey("foo", SecureRandom.getSeed(16), opt);
                kpExt.rollNewVersion(kv.getName());
                kpExt.rollNewVersion(kv.getName(), SecureRandom.getSeed(16));
                EncryptedKeyVersion ekv = kpExt.generateEncryptedKey(kv.getName());
                kpExt.decryptEncryptedKey(ekv);
                kpExt.deleteKey(kv.getName());
            } catch (IOException ioe) {
                Assert.fail("User should be Allowed to do everything !!");
            }
            return null;
        }
    });
}