Java Code Examples for org.apache.hadoop.crypto.key.KeyProvider#KeyVersion

The following examples show how to use org.apache.hadoop.crypto.key.KeyProvider#KeyVersion . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: OzoneKMSUtil.java    From hadoop-ozone with Apache License 2.0 6 votes vote down vote up 
public static KeyProvider.KeyVersion decryptEncryptedDataEncryptionKey(
    FileEncryptionInfo feInfo, KeyProvider keyProvider) throws IOException {
  if (keyProvider == null) {
    throw new IOException("No KeyProvider is configured, " +
        "cannot access an encrypted file");
  } else {
    EncryptedKeyVersion ekv = EncryptedKeyVersion.createForDecryption(
        feInfo.getKeyName(), feInfo.getEzKeyVersionName(), feInfo.getIV(),
        feInfo.getEncryptedDataEncryptionKey());

    try {
      KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension
          .createKeyProviderCryptoExtension(keyProvider);
      return cryptoProvider.decryptEncryptedKey(ekv);
    } catch (GeneralSecurityException gse) {
      throw new IOException(gse);
    }
  }
}
Example 2
Source File: HDFSUtil.java    From spliceengine with GNU Affero General Public License v3.0 6 votes vote down vote up 
private static KeyProvider.KeyVersion decryptEncryptedDataEncryptionKey(DistributedFileSystem dfs, FileEncryptionInfo feInfo) throws IOException {
    KeyProvider provider = dfs.dfs.getKeyProvider();
    if (provider == null) {
        throw new IOException("No KeyProvider is configured, cannot access" +
                " an encrypted file");
    }
    KeyProviderCryptoExtension.EncryptedKeyVersion ekv = KeyProviderCryptoExtension.EncryptedKeyVersion.createForDecryption(
            feInfo.getKeyName(), feInfo.getEzKeyVersionName(), feInfo.getIV(),
            feInfo.getEncryptedDataEncryptionKey());
    try {
        KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension
                .createKeyProviderCryptoExtension(provider);
        return cryptoProvider.decryptEncryptedKey(ekv);
    } catch (GeneralSecurityException e) {
        throw new IOException(e);
    }
}
Example 3
Source File: ProxiedDFSClient.java    From spliceengine with GNU Affero General Public License v3.0 6 votes vote down vote up 
public HdfsDataInputStream createWrappedInputStream(DFSInputStream dfsis)
        throws IOException {
    final FileEncryptionInfo feInfo = dfsis.getFileEncryptionInfo();
    if (feInfo != null) {
        // File is encrypted, wrap the stream in a crypto stream.
        // Currently only one version, so no special logic based on the version #
        getCryptoProtocolVersion(feInfo);
        final CryptoCodec codec = getCryptoCodec(getConfiguration(), feInfo);
        final KeyProvider.KeyVersion decrypted = decryptEncryptedDataEncryptionKey(dfsis, feInfo);
        final CryptoInputStream cryptoIn =
                new CryptoInputStream(dfsis, codec, decrypted.getMaterial(),
                        feInfo.getIV());
        return new HdfsDataInputStream(cryptoIn);
    } else {
        // No FileEncryptionInfo so no encryption.
        return new HdfsDataInputStream(dfsis);
    }
}
Example 4
Source File: RpcClient.java    From hadoop-ozone with Apache License 2.0 5 votes vote down vote up 
private KeyProvider.KeyVersion getDEK(FileEncryptionInfo feInfo)
    throws IOException {
  // check crypto protocol version
  OzoneKMSUtil.checkCryptoProtocolVersion(feInfo);
  KeyProvider.KeyVersion decrypted;
  decrypted = OzoneKMSUtil.decryptEncryptedDataEncryptionKey(feInfo,
      getKeyProvider());
  return decrypted;
}
Example 5
Source File: KMSServerJSONUtils.java    From ranger with Apache License 2.0 5 votes vote down vote up 
@SuppressWarnings("unchecked")
public static List toJSON(List<KeyProvider.KeyVersion> keyVersions) {
  List json = new ArrayList();
  if (keyVersions != null) {
    for (KeyProvider.KeyVersion version : keyVersions) {
      json.add(KMSUtil.toJSON(version));
    }
  }
  return json;
}
Example 6
Source File: KMSServerJSONUtils.java    From big-c with Apache License 2.0 5 votes vote down vote up 
@SuppressWarnings("unchecked")
public static List toJSON(List<KeyProvider.KeyVersion> keyVersions) {
  List json = new ArrayList();
  if (keyVersions != null) {
    for (KeyProvider.KeyVersion version : keyVersions) {
      json.add(toJSON(version));
    }
  }
  return json;
}
Example 7
Source File: KMSServerJSONUtils.java    From big-c with Apache License 2.0 5 votes vote down vote up 
@SuppressWarnings("unchecked")
public static Map toJSON(KeyProvider.KeyVersion keyVersion) {
  Map json = new LinkedHashMap();
  if (keyVersion != null) {
    json.put(KMSRESTConstants.NAME_FIELD,
        keyVersion.getName());
    json.put(KMSRESTConstants.VERSION_NAME_FIELD,
        keyVersion.getVersionName());
    json.put(KMSRESTConstants.MATERIAL_FIELD,
        Base64.encodeBase64URLSafeString(
            keyVersion.getMaterial()));
  }
  return json;
}
Example 8
Source File: KMSServerJSONUtils.java    From hadoop with Apache License 2.0 5 votes vote down vote up 
@SuppressWarnings("unchecked")
public static List toJSON(List<KeyProvider.KeyVersion> keyVersions) {
  List json = new ArrayList();
  if (keyVersions != null) {
    for (KeyProvider.KeyVersion version : keyVersions) {
      json.add(toJSON(version));
    }
  }
  return json;
}
Example 9
Source File: KMSServerJSONUtils.java    From hadoop with Apache License 2.0 5 votes vote down vote up 
@SuppressWarnings("unchecked")
public static Map toJSON(KeyProvider.KeyVersion keyVersion) {
  Map json = new LinkedHashMap();
  if (keyVersion != null) {
    json.put(KMSRESTConstants.NAME_FIELD,
        keyVersion.getName());
    json.put(KMSRESTConstants.VERSION_NAME_FIELD,
        keyVersion.getVersionName());
    json.put(KMSRESTConstants.MATERIAL_FIELD,
        Base64.encodeBase64URLSafeString(
            keyVersion.getMaterial()));
  }
  return json;
}
Example 10
Source File: RpcClient.java    From hadoop-ozone with Apache License 2.0 5 votes vote down vote up 
private OzoneInputStream createInputStream(
    OmKeyInfo keyInfo, Function<OmKeyInfo, OmKeyInfo> retryFunction)
    throws IOException {
  LengthInputStream lengthInputStream = KeyInputStream
      .getFromOmKeyInfo(keyInfo, xceiverClientManager,
          verifyChecksum, retryFunction);
  FileEncryptionInfo feInfo = keyInfo.getFileEncryptionInfo();
  if (feInfo != null) {
    final KeyProvider.KeyVersion decrypted = getDEK(feInfo);
    final CryptoInputStream cryptoIn =
        new CryptoInputStream(lengthInputStream.getWrappedStream(),
            OzoneKMSUtil.getCryptoCodec(conf, feInfo),
            decrypted.getMaterial(), feInfo.getIV());
    return new OzoneInputStream(cryptoIn);
  } else {
    try{
      GDPRSymmetricKey gk;
      Map<String, String> keyInfoMetadata = keyInfo.getMetadata();
      if(Boolean.valueOf(keyInfoMetadata.get(OzoneConsts.GDPR_FLAG))){
        gk = new GDPRSymmetricKey(
            keyInfoMetadata.get(OzoneConsts.GDPR_SECRET),
            keyInfoMetadata.get(OzoneConsts.GDPR_ALGORITHM)
        );
        gk.getCipher().init(Cipher.DECRYPT_MODE, gk.getSecretKey());
        return new OzoneInputStream(
            new CipherInputStream(lengthInputStream, gk.getCipher()));
      }
    }catch (Exception ex){
      throw new IOException(ex);
    }
  }
  return new OzoneInputStream(lengthInputStream.getWrappedStream());
}
Example 11
Source File: KMS.java    From big-c with Apache License 2.0 4 votes vote down vote up 
private static KeyProvider.KeyVersion removeKeyMaterial(
    KeyProvider.KeyVersion keyVersion) {
  return new KMSClientProvider.KMSKeyVersion(keyVersion.getName(),
      keyVersion.getVersionName(), null);
}
Example 12
Source File: KMS.java    From big-c with Apache License 2.0 4 votes vote down vote up 
@SuppressWarnings("rawtypes")
@POST
@Path(KMSRESTConstants.KEY_VERSION_RESOURCE + "/{versionName:.*}/" +
    KMSRESTConstants.EEK_SUB_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response decryptEncryptedKey(
    @PathParam("versionName") final String versionName,
    @QueryParam(KMSRESTConstants.EEK_OP) String eekOp,
    Map jsonPayload)
    throws Exception {
  UserGroupInformation user = HttpUserGroupInformation.get();
  KMSClientProvider.checkNotEmpty(versionName, "versionName");
  KMSClientProvider.checkNotNull(eekOp, "eekOp");

  final String keyName = (String) jsonPayload.get(
      KMSRESTConstants.NAME_FIELD);
  String ivStr = (String) jsonPayload.get(KMSRESTConstants.IV_FIELD);
  String encMaterialStr = 
      (String) jsonPayload.get(KMSRESTConstants.MATERIAL_FIELD);
  Object retJSON;
  if (eekOp.equals(KMSRESTConstants.EEK_DECRYPT)) {
    assertAccess(KMSACLs.Type.DECRYPT_EEK, user, KMSOp.DECRYPT_EEK, keyName);
    KMSClientProvider.checkNotNull(ivStr, KMSRESTConstants.IV_FIELD);
    final byte[] iv = Base64.decodeBase64(ivStr);
    KMSClientProvider.checkNotNull(encMaterialStr,
        KMSRESTConstants.MATERIAL_FIELD);
    final byte[] encMaterial = Base64.decodeBase64(encMaterialStr);

    KeyProvider.KeyVersion retKeyVersion = user.doAs(
        new PrivilegedExceptionAction<KeyVersion>() {
          @Override
          public KeyVersion run() throws Exception {
            return provider.decryptEncryptedKey(
                new KMSClientProvider.KMSEncryptedKeyVersion(keyName,
                    versionName, iv, KeyProviderCryptoExtension.EEK,
                    encMaterial)
            );
          }
        }
    );

    retJSON = KMSServerJSONUtils.toJSON(retKeyVersion);
    kmsAudit.ok(user, KMSOp.DECRYPT_EEK, keyName, "");
  } else {
    throw new IllegalArgumentException("Wrong " + KMSRESTConstants.EEK_OP +
        " value, it must be " + KMSRESTConstants.EEK_GENERATE + " or " +
        KMSRESTConstants.EEK_DECRYPT);
  }
  KMSWebApp.getDecryptEEKCallsMeter().mark();
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(retJSON)
      .build();
}
Example 13
Source File: KMS.java    From hadoop with Apache License 2.0 4 votes vote down vote up 
@SuppressWarnings("rawtypes")
@POST
@Path(KMSRESTConstants.KEY_VERSION_RESOURCE + "/{versionName:.*}/" +
    KMSRESTConstants.EEK_SUB_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response decryptEncryptedKey(
    @PathParam("versionName") final String versionName,
    @QueryParam(KMSRESTConstants.EEK_OP) String eekOp,
    Map jsonPayload)
    throws Exception {
  UserGroupInformation user = HttpUserGroupInformation.get();
  KMSClientProvider.checkNotEmpty(versionName, "versionName");
  KMSClientProvider.checkNotNull(eekOp, "eekOp");

  final String keyName = (String) jsonPayload.get(
      KMSRESTConstants.NAME_FIELD);
  String ivStr = (String) jsonPayload.get(KMSRESTConstants.IV_FIELD);
  String encMaterialStr = 
      (String) jsonPayload.get(KMSRESTConstants.MATERIAL_FIELD);
  Object retJSON;
  if (eekOp.equals(KMSRESTConstants.EEK_DECRYPT)) {
    assertAccess(KMSACLs.Type.DECRYPT_EEK, user, KMSOp.DECRYPT_EEK, keyName);
    KMSClientProvider.checkNotNull(ivStr, KMSRESTConstants.IV_FIELD);
    final byte[] iv = Base64.decodeBase64(ivStr);
    KMSClientProvider.checkNotNull(encMaterialStr,
        KMSRESTConstants.MATERIAL_FIELD);
    final byte[] encMaterial = Base64.decodeBase64(encMaterialStr);

    KeyProvider.KeyVersion retKeyVersion = user.doAs(
        new PrivilegedExceptionAction<KeyVersion>() {
          @Override
          public KeyVersion run() throws Exception {
            return provider.decryptEncryptedKey(
                new KMSClientProvider.KMSEncryptedKeyVersion(keyName,
                    versionName, iv, KeyProviderCryptoExtension.EEK,
                    encMaterial)
            );
          }
        }
    );

    retJSON = KMSServerJSONUtils.toJSON(retKeyVersion);
    kmsAudit.ok(user, KMSOp.DECRYPT_EEK, keyName, "");
  } else {
    throw new IllegalArgumentException("Wrong " + KMSRESTConstants.EEK_OP +
        " value, it must be " + KMSRESTConstants.EEK_GENERATE + " or " +
        KMSRESTConstants.EEK_DECRYPT);
  }
  KMSWebApp.getDecryptEEKCallsMeter().mark();
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(retJSON)
      .build();
}
Example 14
Source File: KMS.java    From ranger with Apache License 2.0 4 votes vote down vote up 
private static KeyProvider.KeyVersion removeKeyMaterial(
    KeyProvider.KeyVersion keyVersion) {
  return new KMSClientProvider.KMSKeyVersion(keyVersion.getName(),
      keyVersion.getVersionName(), null);
}
Example 15
Source File: KMS.java    From hadoop with Apache License 2.0 4 votes vote down vote up 
private static KeyProvider.KeyVersion removeKeyMaterial(
    KeyProvider.KeyVersion keyVersion) {
  return new KMSClientProvider.KMSKeyVersion(keyVersion.getName(),
      keyVersion.getVersionName(), null);
}
Example 16
Source File: RpcClient.java    From hadoop-ozone with Apache License 2.0 4 votes vote down vote up 
private OzoneOutputStream createOutputStream(OpenKeySession openKey,
    String requestId, ReplicationType type, ReplicationFactor factor)
    throws IOException {
  KeyOutputStream keyOutputStream =
      new KeyOutputStream.Builder()
          .setHandler(openKey)
          .setXceiverClientManager(xceiverClientManager)
          .setOmClient(ozoneManagerClient)
          .setChunkSize(chunkSize)
          .setRequestID(requestId)
          .setType(HddsProtos.ReplicationType.valueOf(type.toString()))
          .setFactor(HddsProtos.ReplicationFactor.valueOf(factor.getValue()))
          .setStreamBufferSize(streamBufferSize)
          .setStreamBufferFlushSize(streamBufferFlushSize)
          .setStreamBufferFlushDelay(streamBufferFlushDelay)
          .setStreamBufferMaxSize(streamBufferMaxSize)
          .setBlockSize(blockSize)
          .setChecksumType(checksumType)
          .setBytesPerChecksum(bytesPerChecksum)
          .setMaxRetryCount(maxRetryCount)
          .setRetryInterval(retryInterval)
          .build();
  keyOutputStream
      .addPreallocateBlocks(openKey.getKeyInfo().getLatestVersionLocations(),
          openKey.getOpenVersion());
  final FileEncryptionInfo feInfo = keyOutputStream.getFileEncryptionInfo();
  if (feInfo != null) {
    KeyProvider.KeyVersion decrypted = getDEK(feInfo);
    final CryptoOutputStream cryptoOut =
        new CryptoOutputStream(keyOutputStream,
            OzoneKMSUtil.getCryptoCodec(conf, feInfo),
            decrypted.getMaterial(), feInfo.getIV());
    return new OzoneOutputStream(cryptoOut);
  } else {
    try{
      GDPRSymmetricKey gk;
      Map<String, String> openKeyMetadata =
          openKey.getKeyInfo().getMetadata();
      if(Boolean.valueOf(openKeyMetadata.get(OzoneConsts.GDPR_FLAG))){
        gk = new GDPRSymmetricKey(
            openKeyMetadata.get(OzoneConsts.GDPR_SECRET),
            openKeyMetadata.get(OzoneConsts.GDPR_ALGORITHM)
        );
        gk.getCipher().init(Cipher.ENCRYPT_MODE, gk.getSecretKey());
        return new OzoneOutputStream(
            new CipherOutputStream(keyOutputStream, gk.getCipher()));
      }
    }catch (Exception ex){
      throw new IOException(ex);
    }

    return new OzoneOutputStream(keyOutputStream);
  }
}
Example 17
Source File: HDFSUtil.java    From spliceengine with GNU Affero General Public License v3.0 4 votes vote down vote up 
public static KeyProvider.KeyVersion decrypt(DistributedFileSystem dfs, String path) throws IOException {
    return decryptEncryptedDataEncryptionKey(dfs, dfs.dfs.getLocatedBlocks(path, 0).getFileEncryptionInfo());
}