Java Code Examples for org.apache.hadoop.crypto.key.KeyProvider#KeyVersion

The following examples show how to use org.apache.hadoop.crypto.key.KeyProvider#KeyVersion . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.

Example 1

Source File: OzoneKMSUtil.java From hadoop-ozone with Apache License 2.0

6 votes

public static KeyProvider.KeyVersion decryptEncryptedDataEncryptionKey(
    FileEncryptionInfo feInfo, KeyProvider keyProvider) throws IOException {
  if (keyProvider == null) {
    throw new IOException("No KeyProvider is configured, " +
        "cannot access an encrypted file");
  } else {
    EncryptedKeyVersion ekv = EncryptedKeyVersion.createForDecryption(
        feInfo.getKeyName(), feInfo.getEzKeyVersionName(), feInfo.getIV(),
        feInfo.getEncryptedDataEncryptionKey());

    try {
      KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension
          .createKeyProviderCryptoExtension(keyProvider);
      return cryptoProvider.decryptEncryptedKey(ekv);
    } catch (GeneralSecurityException gse) {
      throw new IOException(gse);
    }
  }
}

Example 2

Source File: HDFSUtil.java From spliceengine with GNU Affero General Public License v3.0

6 votes

private static KeyProvider.KeyVersion decryptEncryptedDataEncryptionKey(DistributedFileSystem dfs, FileEncryptionInfo feInfo) throws IOException {
    KeyProvider provider = dfs.dfs.getKeyProvider();
    if (provider == null) {
        throw new IOException("No KeyProvider is configured, cannot access" +
                " an encrypted file");
    }
    KeyProviderCryptoExtension.EncryptedKeyVersion ekv = KeyProviderCryptoExtension.EncryptedKeyVersion.createForDecryption(
            feInfo.getKeyName(), feInfo.getEzKeyVersionName(), feInfo.getIV(),
            feInfo.getEncryptedDataEncryptionKey());
    try {
        KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension
                .createKeyProviderCryptoExtension(provider);
        return cryptoProvider.decryptEncryptedKey(ekv);
    } catch (GeneralSecurityException e) {
        throw new IOException(e);
    }
}

Example 3

Source File: ProxiedDFSClient.java From spliceengine with GNU Affero General Public License v3.0

6 votes

public HdfsDataInputStream createWrappedInputStream(DFSInputStream dfsis)
        throws IOException {
    final FileEncryptionInfo feInfo = dfsis.getFileEncryptionInfo();
    if (feInfo != null) {
        // File is encrypted, wrap the stream in a crypto stream.
        // Currently only one version, so no special logic based on the version #
        getCryptoProtocolVersion(feInfo);
        final CryptoCodec codec = getCryptoCodec(getConfiguration(), feInfo);
        final KeyProvider.KeyVersion decrypted = decryptEncryptedDataEncryptionKey(dfsis, feInfo);
        final CryptoInputStream cryptoIn =
                new CryptoInputStream(dfsis, codec, decrypted.getMaterial(),
                        feInfo.getIV());
        return new HdfsDataInputStream(cryptoIn);
    } else {
        // No FileEncryptionInfo so no encryption.
        return new HdfsDataInputStream(dfsis);
    }
}

Example 4

Source File: RpcClient.java From hadoop-ozone with Apache License 2.0

5 votes

private KeyProvider.KeyVersion getDEK(FileEncryptionInfo feInfo)
    throws IOException {
  // check crypto protocol version
  OzoneKMSUtil.checkCryptoProtocolVersion(feInfo);
  KeyProvider.KeyVersion decrypted;
  decrypted = OzoneKMSUtil.decryptEncryptedDataEncryptionKey(feInfo,
      getKeyProvider());
  return decrypted;
}

Example 5

Source File: KMSServerJSONUtils.java From ranger with Apache License 2.0

5 votes

@SuppressWarnings("unchecked")
public static List toJSON(List<KeyProvider.KeyVersion> keyVersions) {
  List json = new ArrayList();
  if (keyVersions != null) {
    for (KeyProvider.KeyVersion version : keyVersions) {
      json.add(KMSUtil.toJSON(version));
    }
  }
  return json;
}

Example 6

Source File: KMSServerJSONUtils.java From big-c with Apache License 2.0

5 votes

@SuppressWarnings("unchecked")
public static List toJSON(List<KeyProvider.KeyVersion> keyVersions) {
  List json = new ArrayList();
  if (keyVersions != null) {
    for (KeyProvider.KeyVersion version : keyVersions) {
      json.add(toJSON(version));
    }
  }
  return json;
}

Example 7

Source File: KMSServerJSONUtils.java From big-c with Apache License 2.0

5 votes

@SuppressWarnings("unchecked")
public static Map toJSON(KeyProvider.KeyVersion keyVersion) {
  Map json = new LinkedHashMap();
  if (keyVersion != null) {
    json.put(KMSRESTConstants.NAME_FIELD,
        keyVersion.getName());
    json.put(KMSRESTConstants.VERSION_NAME_FIELD,
        keyVersion.getVersionName());
    json.put(KMSRESTConstants.MATERIAL_FIELD,
        Base64.encodeBase64URLSafeString(
            keyVersion.getMaterial()));
  }
  return json;
}

Example 8

Source File: KMSServerJSONUtils.java From hadoop with Apache License 2.0

5 votes

@SuppressWarnings("unchecked")
public static List toJSON(List<KeyProvider.KeyVersion> keyVersions) {
  List json = new ArrayList();
  if (keyVersions != null) {
    for (KeyProvider.KeyVersion version : keyVersions) {
      json.add(toJSON(version));
    }
  }
  return json;
}

Example 9

Source File: KMSServerJSONUtils.java From hadoop with Apache License 2.0

5 votes

@SuppressWarnings("unchecked")
public static Map toJSON(KeyProvider.KeyVersion keyVersion) {
  Map json = new LinkedHashMap();
  if (keyVersion != null) {
    json.put(KMSRESTConstants.NAME_FIELD,
        keyVersion.getName());
    json.put(KMSRESTConstants.VERSION_NAME_FIELD,
        keyVersion.getVersionName());
    json.put(KMSRESTConstants.MATERIAL_FIELD,
        Base64.encodeBase64URLSafeString(
            keyVersion.getMaterial()));
  }
  return json;
}

Example 10

Source File: RpcClient.java From hadoop-ozone with Apache License 2.0

5 votes

private OzoneInputStream createInputStream(
    OmKeyInfo keyInfo, Function<OmKeyInfo, OmKeyInfo> retryFunction)
    throws IOException {
  LengthInputStream lengthInputStream = KeyInputStream
      .getFromOmKeyInfo(keyInfo, xceiverClientManager,
          verifyChecksum, retryFunction);
  FileEncryptionInfo feInfo = keyInfo.getFileEncryptionInfo();
  if (feInfo != null) {
    final KeyProvider.KeyVersion decrypted = getDEK(feInfo);
    final CryptoInputStream cryptoIn =
        new CryptoInputStream(lengthInputStream.getWrappedStream(),
            OzoneKMSUtil.getCryptoCodec(conf, feInfo),
            decrypted.getMaterial(), feInfo.getIV());
    return new OzoneInputStream(cryptoIn);
  } else {
    try{
      GDPRSymmetricKey gk;
      Map<String, String> keyInfoMetadata = keyInfo.getMetadata();
      if(Boolean.valueOf(keyInfoMetadata.get(OzoneConsts.GDPR_FLAG))){
        gk = new GDPRSymmetricKey(
            keyInfoMetadata.get(OzoneConsts.GDPR_SECRET),
            keyInfoMetadata.get(OzoneConsts.GDPR_ALGORITHM)
        );
        gk.getCipher().init(Cipher.DECRYPT_MODE, gk.getSecretKey());
        return new OzoneInputStream(
            new CipherInputStream(lengthInputStream, gk.getCipher()));
      }
    }catch (Exception ex){
      throw new IOException(ex);
    }
  }
  return new OzoneInputStream(lengthInputStream.getWrappedStream());
}

Example 11

Source File: KMS.java From big-c with Apache License 2.0

4 votes

private static KeyProvider.KeyVersion removeKeyMaterial(
    KeyProvider.KeyVersion keyVersion) {
  return new KMSClientProvider.KMSKeyVersion(keyVersion.getName(),
      keyVersion.getVersionName(), null);
}

Example 12

Source File: KMS.java From big-c with Apache License 2.0

4 votes

@SuppressWarnings("rawtypes")
@POST
@Path(KMSRESTConstants.KEY_VERSION_RESOURCE + "/{versionName:.*}/" +
    KMSRESTConstants.EEK_SUB_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response decryptEncryptedKey(
    @PathParam("versionName") final String versionName,
    @QueryParam(KMSRESTConstants.EEK_OP) String eekOp,
    Map jsonPayload)
    throws Exception {
  UserGroupInformation user = HttpUserGroupInformation.get();
  KMSClientProvider.checkNotEmpty(versionName, "versionName");
  KMSClientProvider.checkNotNull(eekOp, "eekOp");

  final String keyName = (String) jsonPayload.get(
      KMSRESTConstants.NAME_FIELD);
  String ivStr = (String) jsonPayload.get(KMSRESTConstants.IV_FIELD);
  String encMaterialStr = 
      (String) jsonPayload.get(KMSRESTConstants.MATERIAL_FIELD);
  Object retJSON;
  if (eekOp.equals(KMSRESTConstants.EEK_DECRYPT)) {
    assertAccess(KMSACLs.Type.DECRYPT_EEK, user, KMSOp.DECRYPT_EEK, keyName);
    KMSClientProvider.checkNotNull(ivStr, KMSRESTConstants.IV_FIELD);
    final byte[] iv = Base64.decodeBase64(ivStr);
    KMSClientProvider.checkNotNull(encMaterialStr,
        KMSRESTConstants.MATERIAL_FIELD);
    final byte[] encMaterial = Base64.decodeBase64(encMaterialStr);

    KeyProvider.KeyVersion retKeyVersion = user.doAs(
        new PrivilegedExceptionAction<KeyVersion>() {
          @Override
          public KeyVersion run() throws Exception {
            return provider.decryptEncryptedKey(
                new KMSClientProvider.KMSEncryptedKeyVersion(keyName,
                    versionName, iv, KeyProviderCryptoExtension.EEK,
                    encMaterial)
            );
          }
        }
    );

    retJSON = KMSServerJSONUtils.toJSON(retKeyVersion);
    kmsAudit.ok(user, KMSOp.DECRYPT_EEK, keyName, "");
  } else {
    throw new IllegalArgumentException("Wrong " + KMSRESTConstants.EEK_OP +
        " value, it must be " + KMSRESTConstants.EEK_GENERATE + " or " +
        KMSRESTConstants.EEK_DECRYPT);
  }
  KMSWebApp.getDecryptEEKCallsMeter().mark();
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(retJSON)
      .build();
}

Example 13

Source File: KMS.java From hadoop with Apache License 2.0

4 votes

@SuppressWarnings("rawtypes")
@POST
@Path(KMSRESTConstants.KEY_VERSION_RESOURCE + "/{versionName:.*}/" +
    KMSRESTConstants.EEK_SUB_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response decryptEncryptedKey(
    @PathParam("versionName") final String versionName,
    @QueryParam(KMSRESTConstants.EEK_OP) String eekOp,
    Map jsonPayload)
    throws Exception {
  UserGroupInformation user = HttpUserGroupInformation.get();
  KMSClientProvider.checkNotEmpty(versionName, "versionName");
  KMSClientProvider.checkNotNull(eekOp, "eekOp");

  final String keyName = (String) jsonPayload.get(
      KMSRESTConstants.NAME_FIELD);
  String ivStr = (String) jsonPayload.get(KMSRESTConstants.IV_FIELD);
  String encMaterialStr = 
      (String) jsonPayload.get(KMSRESTConstants.MATERIAL_FIELD);
  Object retJSON;
  if (eekOp.equals(KMSRESTConstants.EEK_DECRYPT)) {
    assertAccess(KMSACLs.Type.DECRYPT_EEK, user, KMSOp.DECRYPT_EEK, keyName);
    KMSClientProvider.checkNotNull(ivStr, KMSRESTConstants.IV_FIELD);
    final byte[] iv = Base64.decodeBase64(ivStr);
    KMSClientProvider.checkNotNull(encMaterialStr,
        KMSRESTConstants.MATERIAL_FIELD);
    final byte[] encMaterial = Base64.decodeBase64(encMaterialStr);

    KeyProvider.KeyVersion retKeyVersion = user.doAs(
        new PrivilegedExceptionAction<KeyVersion>() {
          @Override
          public KeyVersion run() throws Exception {
            return provider.decryptEncryptedKey(
                new KMSClientProvider.KMSEncryptedKeyVersion(keyName,
                    versionName, iv, KeyProviderCryptoExtension.EEK,
                    encMaterial)
            );
          }
        }
    );

    retJSON = KMSServerJSONUtils.toJSON(retKeyVersion);
    kmsAudit.ok(user, KMSOp.DECRYPT_EEK, keyName, "");
  } else {
    throw new IllegalArgumentException("Wrong " + KMSRESTConstants.EEK_OP +
        " value, it must be " + KMSRESTConstants.EEK_GENERATE + " or " +
        KMSRESTConstants.EEK_DECRYPT);
  }
  KMSWebApp.getDecryptEEKCallsMeter().mark();
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(retJSON)
      .build();
}

Example 14

Source File: KMS.java From ranger with Apache License 2.0

4 votes

private static KeyProvider.KeyVersion removeKeyMaterial(
    KeyProvider.KeyVersion keyVersion) {
  return new KMSClientProvider.KMSKeyVersion(keyVersion.getName(),
      keyVersion.getVersionName(), null);
}

Example 15

Source File: KMS.java From hadoop with Apache License 2.0

4 votes

private static KeyProvider.KeyVersion removeKeyMaterial(
    KeyProvider.KeyVersion keyVersion) {
  return new KMSClientProvider.KMSKeyVersion(keyVersion.getName(),
      keyVersion.getVersionName(), null);
}

Example 16

Source File: RpcClient.java From hadoop-ozone with Apache License 2.0

4 votes

private OzoneOutputStream createOutputStream(OpenKeySession openKey,
    String requestId, ReplicationType type, ReplicationFactor factor)
    throws IOException {
  KeyOutputStream keyOutputStream =
      new KeyOutputStream.Builder()
          .setHandler(openKey)
          .setXceiverClientManager(xceiverClientManager)
          .setOmClient(ozoneManagerClient)
          .setChunkSize(chunkSize)
          .setRequestID(requestId)
          .setType(HddsProtos.ReplicationType.valueOf(type.toString()))
          .setFactor(HddsProtos.ReplicationFactor.valueOf(factor.getValue()))
          .setStreamBufferSize(streamBufferSize)
          .setStreamBufferFlushSize(streamBufferFlushSize)
          .setStreamBufferFlushDelay(streamBufferFlushDelay)
          .setStreamBufferMaxSize(streamBufferMaxSize)
          .setBlockSize(blockSize)
          .setChecksumType(checksumType)
          .setBytesPerChecksum(bytesPerChecksum)
          .setMaxRetryCount(maxRetryCount)
          .setRetryInterval(retryInterval)
          .build();
  keyOutputStream
      .addPreallocateBlocks(openKey.getKeyInfo().getLatestVersionLocations(),
          openKey.getOpenVersion());
  final FileEncryptionInfo feInfo = keyOutputStream.getFileEncryptionInfo();
  if (feInfo != null) {
    KeyProvider.KeyVersion decrypted = getDEK(feInfo);
    final CryptoOutputStream cryptoOut =
        new CryptoOutputStream(keyOutputStream,
            OzoneKMSUtil.getCryptoCodec(conf, feInfo),
            decrypted.getMaterial(), feInfo.getIV());
    return new OzoneOutputStream(cryptoOut);
  } else {
    try{
      GDPRSymmetricKey gk;
      Map<String, String> openKeyMetadata =
          openKey.getKeyInfo().getMetadata();
      if(Boolean.valueOf(openKeyMetadata.get(OzoneConsts.GDPR_FLAG))){
        gk = new GDPRSymmetricKey(
            openKeyMetadata.get(OzoneConsts.GDPR_SECRET),
            openKeyMetadata.get(OzoneConsts.GDPR_ALGORITHM)
        );
        gk.getCipher().init(Cipher.ENCRYPT_MODE, gk.getSecretKey());
        return new OzoneOutputStream(
            new CipherOutputStream(keyOutputStream, gk.getCipher()));
      }
    }catch (Exception ex){
      throw new IOException(ex);
    }

    return new OzoneOutputStream(keyOutputStream);
  }
}

Example 17

Source File: HDFSUtil.java From spliceengine with GNU Affero General Public License v3.0

4 votes

public static KeyProvider.KeyVersion decrypt(DistributedFileSystem dfs, String path) throws IOException {
    return decryptEncryptedDataEncryptionKey(dfs, dfs.dfs.getLocatedBlocks(path, 0).getFileEncryptionInfo());
}