Examples with OzoneBlockTokenIdentifier org.apache.hadoop.hdds.security.token.OzoneBlockTokenIdentifier used on opensource projects

Example 1 with OzoneBlockTokenIdentifier

use of org.apache.hadoop.hdds.security.token.OzoneBlockTokenIdentifier in project ozone by apache.

the class ReplicatedFileChecksumHelper method getChunkInfos.

// copied from BlockInputStream
/**
 * Send RPC call to get the block info from the container.
 * @return List of chunks in this block.
 */
protected List<ContainerProtos.ChunkInfo> getChunkInfos(OmKeyLocationInfo keyLocationInfo) throws IOException {
    // irrespective of the container state, we will always read via Standalone
    // protocol.
    Token<OzoneBlockTokenIdentifier> token = keyLocationInfo.getToken();
    Pipeline pipeline = keyLocationInfo.getPipeline();
    BlockID blockID = keyLocationInfo.getBlockID();
    if (pipeline.getType() != HddsProtos.ReplicationType.STAND_ALONE) {
        pipeline = Pipeline.newBuilder(pipeline).setReplicationConfig(StandaloneReplicationConfig.getInstance(ReplicationConfig.getLegacyFactor(pipeline.getReplicationConfig()))).build();
    }
    boolean success = false;
    List<ContainerProtos.ChunkInfo> chunks;
    XceiverClientSpi xceiverClientSpi = null;
    try {
        if (LOG.isDebugEnabled()) {
            LOG.debug("Initializing BlockInputStream for get key to access {}", blockID.getContainerID());
        }
        xceiverClientSpi = getXceiverClientFactory().acquireClientForReadData(pipeline);
        ContainerProtos.DatanodeBlockID datanodeBlockID = blockID.getDatanodeBlockIDProtobuf();
        ContainerProtos.GetBlockResponseProto response = ContainerProtocolCalls.getBlock(xceiverClientSpi, datanodeBlockID, token);
        chunks = response.getBlockData().getChunksList();
        success = true;
    } finally {
        if (!success && xceiverClientSpi != null) {
            getXceiverClientFactory().releaseClientForReadData(xceiverClientSpi, false);
        }
    }
    return chunks;
}

Example 2 with OzoneBlockTokenIdentifier

use of org.apache.hadoop.hdds.security.token.OzoneBlockTokenIdentifier in project ozone by apache.

the class TestSecureContainerServer method runTestClientServer.

private static void runTestClientServer(int numDatanodes, CheckedBiConsumer<Pipeline, OzoneConfiguration, IOException> initConf, CheckedBiFunction<Pipeline, OzoneConfiguration, XceiverClientSpi, IOException> createClient, CheckedBiFunction<DatanodeDetails, OzoneConfiguration, XceiverServerSpi, IOException> createServer, CheckedBiConsumer<DatanodeDetails, Pipeline, IOException> initServer, Consumer<Pipeline> stopServer) throws Exception {
    final List<XceiverServerSpi> servers = new ArrayList<>();
    final Pipeline pipeline = MockPipeline.createPipeline(numDatanodes);
    initConf.accept(pipeline, CONF);
    for (DatanodeDetails dn : pipeline.getNodes()) {
        final XceiverServerSpi s = createServer.apply(dn, CONF);
        servers.add(s);
        s.start();
        initServer.accept(dn, pipeline);
    }
    try (XceiverClientSpi client = createClient.apply(pipeline, CONF)) {
        client.connect();
        long containerID = getTestContainerID();
        BlockID blockID = getTestBlockID(containerID);
        assertFailsTokenVerification(client, getCreateContainerRequest(containerID, pipeline));
        // create the container
        ContainerProtocolCalls.createContainer(client, containerID, getToken(ContainerID.valueOf(containerID)));
        Token<OzoneBlockTokenIdentifier> token = blockTokenSecretManager.generateToken(blockID, EnumSet.allOf(AccessModeProto.class), RandomUtils.nextLong());
        String encodedToken = token.encodeToUrlString();
        ContainerCommandRequestProto.Builder writeChunk = newWriteChunkRequestBuilder(pipeline, blockID, 1024, 0);
        assertRequiresToken(client, encodedToken, writeChunk);
        ContainerCommandRequestProto.Builder putBlock = newPutBlockRequestBuilder(pipeline, writeChunk.getWriteChunk());
        assertRequiresToken(client, encodedToken, putBlock);
        ContainerCommandRequestProto.Builder readChunk = newReadChunkRequestBuilder(pipeline, writeChunk.getWriteChunk());
        assertRequiresToken(client, encodedToken, readChunk);
        ContainerCommandRequestProto.Builder getBlock = newGetBlockRequestBuilder(pipeline, putBlock.getPutBlock());
        assertRequiresToken(client, encodedToken, getBlock);
        ContainerCommandRequestProto.Builder getCommittedBlockLength = newGetCommittedBlockLengthBuilder(pipeline, putBlock.getPutBlock());
        assertRequiresToken(client, encodedToken, getCommittedBlockLength);
    } finally {
        stopServer.accept(pipeline);
        servers.forEach(XceiverServerSpi::stop);
    }
}

Example 3 with OzoneBlockTokenIdentifier

use of org.apache.hadoop.hdds.security.token.OzoneBlockTokenIdentifier in project ozone by apache.

the class OzoneBlockTokenSecretManager method generateToken.

/**
 * Generate an block token for specified user, blockId. Service field for
 * token is set to blockId.
 */
public Token<OzoneBlockTokenIdentifier> generateToken(String user, BlockID blockId, Set<AccessModeProto> modes, long maxLength) {
    OzoneBlockTokenIdentifier tokenIdentifier = createIdentifier(user, blockId, modes, maxLength);
    if (LOG.isDebugEnabled()) {
        long expiryTime = tokenIdentifier.getExpiryDate();
        LOG.info("Issued delegation token -> expiryTime:{}, tokenId:{}", Instant.ofEpochMilli(expiryTime), tokenIdentifier);
    }
    return new Token<>(tokenIdentifier.getBytes(), createPassword(tokenIdentifier), tokenIdentifier.getKind(), new Text(tokenIdentifier.getService()));
}

Example 4 with OzoneBlockTokenIdentifier

use of org.apache.hadoop.hdds.security.token.OzoneBlockTokenIdentifier in project ozone by apache.

the class TestOzoneBlockTokenSecretManager method tokenCannotBeUsedForOtherBlock.

@Test
public void tokenCannotBeUsedForOtherBlock() throws Exception {
    // GIVEN
    BlockID blockID = new BlockID(101, 0);
    BlockID otherBlockID = new BlockID(102, 0);
    // WHEN
    Token<OzoneBlockTokenIdentifier> token = secretManager.generateToken("testUser", blockID, EnumSet.allOf(AccessModeProto.class), 100);
    String encodedToken = token.encodeToUrlString();
    ContainerCommandRequestProto writeChunkRequest = getWriteChunkRequest(pipeline, otherBlockID, 100, encodedToken);
    // THEN
    BlockTokenException e = assertThrows(BlockTokenException.class, () -> tokenVerifier.verify("testUser", token, writeChunkRequest));
    String msg = e.getMessage();
    assertTrue(msg, msg.contains("Token for ID: " + OzoneBlockTokenIdentifier.getTokenService(blockID) + " can't be used to access: " + OzoneBlockTokenIdentifier.getTokenService(otherBlockID)));
}

Example 5 with OzoneBlockTokenIdentifier

use of org.apache.hadoop.hdds.security.token.OzoneBlockTokenIdentifier in project ozone by apache.

the class TestOzoneBlockTokenSecretManager method testBlockTokenReadAccessMode.

@Test
public void testBlockTokenReadAccessMode() throws Exception {
    final String testUser1 = "testUser1";
    BlockID blockID = new BlockID(101, 0);
    Token<OzoneBlockTokenIdentifier> token = secretManager.generateToken(testUser1, blockID, EnumSet.of(AccessModeProto.READ), 100);
    String encodedToken = token.encodeToUrlString();
    ContainerCommandRequestProto writeChunkRequest = getWriteChunkRequest(pipeline, blockID, 100, encodedToken);
    ContainerCommandRequestProto putBlockCommand = getPutBlockRequest(pipeline, encodedToken, writeChunkRequest.getWriteChunk());
    ContainerCommandRequestProto getBlockCommand = getBlockRequest(pipeline, putBlockCommand.getPutBlock());
    BlockTokenException e = assertThrows(BlockTokenException.class, () -> tokenVerifier.verify(testUser1, token, putBlockCommand));
    String msg = e.getMessage();
    assertTrue(msg, msg.contains("doesn't have WRITE permission"));
    tokenVerifier.verify(testUser1, token, getBlockCommand);
}