Java KeyProvider类代码示例

import org.apache.hadoop.crypto.key.KeyProvider; //导入依赖的package包/类
@GET
@Path(KMSRESTConstants.KEYS_METADATA_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response getKeysMetadata(@QueryParam(KMSRESTConstants.KEY)
    List<String> keyNamesList) throws Exception {
  KMSWebApp.getAdminCallsMeter().mark();
  UserGroupInformation user = HttpUserGroupInformation.get();
  final String[] keyNames = keyNamesList.toArray(
      new String[keyNamesList.size()]);
  assertAccess(KMSACLs.Type.GET_METADATA, user, KMSOp.GET_KEYS_METADATA);

  KeyProvider.Metadata[] keysMeta = user.doAs(
      new PrivilegedExceptionAction<KeyProvider.Metadata[]>() {
        @Override
        public KeyProvider.Metadata[] run() throws Exception {
          return provider.getKeysMetadata(keyNames);
        }
      }
  );

  Object json = KMSServerJSONUtils.toJSON(keyNames, keysMeta);
  kmsAudit.ok(user, KMSOp.GET_KEYS_METADATA, "");
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(json).build();
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入依赖的package包/类
@Test
public void testLoadBalancing() throws Exception {
  Configuration conf = new Configuration();
  KMSClientProvider p1 = mock(KMSClientProvider.class);
  when(p1.createKey(Mockito.anyString(), Mockito.any(Options.class)))
      .thenReturn(
          new KMSClientProvider.KMSKeyVersion("p1", "v1", new byte[0]));
  KMSClientProvider p2 = mock(KMSClientProvider.class);
  when(p2.createKey(Mockito.anyString(), Mockito.any(Options.class)))
      .thenReturn(
          new KMSClientProvider.KMSKeyVersion("p2", "v2", new byte[0]));
  KMSClientProvider p3 = mock(KMSClientProvider.class);
  when(p3.createKey(Mockito.anyString(), Mockito.any(Options.class)))
      .thenReturn(
          new KMSClientProvider.KMSKeyVersion("p3", "v3", new byte[0]));
  KeyProvider kp = new LoadBalancingKMSClientProvider(
      new KMSClientProvider[] { p1, p2, p3 }, 0, conf);
  assertEquals("p1", kp.createKey("test1", new Options(conf)).getName());
  assertEquals("p2", kp.createKey("test2", new Options(conf)).getName());
  assertEquals("p3", kp.createKey("test3", new Options(conf)).getName());
  assertEquals("p1", kp.createKey("test4", new Options(conf)).getName());
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入依赖的package包/类
@GET
@Path(KMSRESTConstants.KEY_RESOURCE + "/{name:.*}/" +
    KMSRESTConstants.METADATA_SUB_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response getMetadata(@PathParam("name") final String name)
    throws Exception {
  UserGroupInformation user = HttpUserGroupInformation.get();
  KMSClientProvider.checkNotEmpty(name, "name");
  KMSWebApp.getAdminCallsMeter().mark();
  assertAccess(KMSACLs.Type.GET_METADATA, user, KMSOp.GET_METADATA, name);

  KeyProvider.Metadata metadata = user.doAs(
      new PrivilegedExceptionAction<KeyProvider.Metadata>() {
        @Override
        public KeyProvider.Metadata run() throws Exception {
          return provider.getMetadata(name);
        }
      }
  );

  Object json = KMSServerJSONUtils.toJSON(name, metadata);
  kmsAudit.ok(user, KMSOp.GET_METADATA, name, "");
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(json).build();
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入依赖的package包/类
@SuppressWarnings("unchecked")
public static Map toJSON(String keyName, KeyProvider.Metadata meta) {
  Map json = new LinkedHashMap();
  if (meta != null) {
    json.put(KMSRESTConstants.NAME_FIELD, keyName);
    json.put(KMSRESTConstants.CIPHER_FIELD, meta.getCipher());
    json.put(KMSRESTConstants.LENGTH_FIELD, meta.getBitLength());
    json.put(KMSRESTConstants.DESCRIPTION_FIELD, meta.getDescription());
    json.put(KMSRESTConstants.ATTRIBUTES_FIELD, meta.getAttributes());
    json.put(KMSRESTConstants.CREATED_FIELD,
        meta.getCreated().getTime());
    json.put(KMSRESTConstants.VERSIONS_FIELD,
        (long) meta.getVersions());
  }
  return json;
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入依赖的package包/类
/**
 * Decrypts a EDEK by consulting the KeyProvider.
 */
private KeyVersion decryptEncryptedDataEncryptionKey(FileEncryptionInfo
    feInfo) throws IOException {
  TraceScope scope = Trace.startSpan("decryptEDEK", traceSampler);
  try {
    KeyProvider provider = getKeyProvider();
    if (provider == null) {
      throw new IOException("No KeyProvider is configured, cannot access" +
          " an encrypted file");
    }
    EncryptedKeyVersion ekv = EncryptedKeyVersion.createForDecryption(
        feInfo.getKeyName(), feInfo.getEzKeyVersionName(), feInfo.getIV(),
        feInfo.getEncryptedDataEncryptionKey());
    try {
      KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension
          .createKeyProviderCryptoExtension(provider);
      return cryptoProvider.decryptEncryptedKey(ekv);
    } catch (GeneralSecurityException e) {
      throw new IOException(e);
    }
  } finally {
    scope.close();
  }
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入依赖的package包/类
public KeyProviderCache(long expiryMs) {
  cache = CacheBuilder.newBuilder()
      .expireAfterAccess(expiryMs, TimeUnit.MILLISECONDS)
      .removalListener(new RemovalListener<URI, KeyProvider>() {
        @Override
        public void onRemoval(
            RemovalNotification<URI, KeyProvider> notification) {
          try {
            notification.getValue().close();
          } catch (Throwable e) {
            LOG.error(
                "Error closing KeyProvider with uri ["
                    + notification.getKey() + "]", e);
            ;
          }
        }
      })
      .build();
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入依赖的package包/类
public KeyProvider get(final Configuration conf) {
  URI kpURI = createKeyProviderURI(conf);
  if (kpURI == null) {
    return null;
  }
  try {
    return cache.get(kpURI, new Callable<KeyProvider>() {
      @Override
      public KeyProvider call() throws Exception {
        return DFSUtil.createKeyProvider(conf);
      }
    });
  } catch (Exception e) {
    LOG.error("Could not create KeyProvider for DFSClient !!", e.getCause());
    return null;
  }
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入依赖的package包/类
private KeyProvider createProvider(URI providerUri, Configuration conf,
    URL origUrl, int port, String hostsPart) throws IOException {
  String[] hosts = hostsPart.split(";");
  if (hosts.length == 1) {
    return new KMSClientProvider(providerUri, conf);
  } else {
    KMSClientProvider[] providers = new KMSClientProvider[hosts.length];
    for (int i = 0; i < hosts.length; i++) {
      try {
        providers[i] =
            new KMSClientProvider(
                new URI("kms", origUrl.getProtocol(), hosts[i], port,
                    origUrl.getPath(), null, null), conf);
      } catch (URISyntaxException e) {
        throw new IOException("Could not instantiate KMSProvider..", e);
      }
    }
    return new LoadBalancingKMSClientProvider(providers, conf);
  }
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入依赖的package包/类
/**
 * Decrypts a EDEK by consulting the KeyProvider.
 */
private KeyVersion decryptEncryptedDataEncryptionKey(FileEncryptionInfo
    feInfo) throws IOException {
  try (TraceScope ignored = tracer.newScope("decryptEDEK")) {
    KeyProvider provider = getKeyProvider();
    if (provider == null) {
      throw new IOException("No KeyProvider is configured, cannot access" +
          " an encrypted file");
    }
    EncryptedKeyVersion ekv = EncryptedKeyVersion.createForDecryption(
        feInfo.getKeyName(), feInfo.getEzKeyVersionName(), feInfo.getIV(),
        feInfo.getEncryptedDataEncryptionKey());
    try {
      KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension
          .createKeyProviderCryptoExtension(provider);
      return cryptoProvider.decryptEncryptedKey(ekv);
    } catch (GeneralSecurityException e) {
      throw new IOException(e);
    }
  }
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入依赖的package包/类
public KeyProvider get(final Configuration conf) {
  URI kpURI = createKeyProviderURI(conf);
  if (kpURI == null) {
    return null;
  }
  try {
    return cache.get(kpURI, new Callable<KeyProvider>() {
      @Override
      public KeyProvider call() throws Exception {
        return DFSUtilClient.createKeyProvider(conf);
      }
    });
  } catch (Exception e) {
    LOG.error("Could not create KeyProvider for DFSClient !!", e.getCause());
    return null;
  }
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入依赖的package包/类
/**
 * Decrypts a EDEK by consulting the KeyProvider.
 */
private KeyVersion decryptEncryptedDataEncryptionKey(FileEncryptionInfo
    feInfo) throws IOException {
  KeyProvider provider = getKeyProvider();
  if (provider == null) {
    throw new IOException("No KeyProvider is configured, cannot access" +
        " an encrypted file");
  }
  EncryptedKeyVersion ekv = EncryptedKeyVersion.createForDecryption(
      feInfo.getKeyName(), feInfo.getEzKeyVersionName(), feInfo.getIV(),
      feInfo.getEncryptedDataEncryptionKey());
  try {
    KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension
        .createKeyProviderCryptoExtension(provider);
    return cryptoProvider.decryptEncryptedKey(ekv);
  } catch (GeneralSecurityException e) {
    throw new IOException(e);
  }
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入依赖的package包/类
@Override
public long renew(Token<?> token, Configuration conf) throws IOException {
  LOG.debug("Renewing delegation token {}", token);
  KeyProvider keyProvider = KMSUtil.createKeyProvider(conf,
      KeyProviderFactory.KEY_PROVIDER_PATH);
  try {
    if (!(keyProvider instanceof
        KeyProviderDelegationTokenExtension.DelegationTokenExtension)) {
      LOG.warn("keyProvider {} cannot renew dt.", keyProvider == null ?
          "null" : keyProvider.getClass());
      return 0;
    }
    return ((KeyProviderDelegationTokenExtension.DelegationTokenExtension)
        keyProvider).renewDelegationToken(token);
  } finally {
    if (keyProvider != null) {
      keyProvider.close();
    }
  }
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入依赖的package包/类
@Override
public void cancel(Token<?> token, Configuration conf) throws IOException {
  LOG.debug("Canceling delegation token {}", token);
  KeyProvider keyProvider = KMSUtil.createKeyProvider(conf,
      KeyProviderFactory.KEY_PROVIDER_PATH);
  try {
    if (!(keyProvider instanceof
        KeyProviderDelegationTokenExtension.DelegationTokenExtension)) {
      LOG.warn("keyProvider {} cannot cancel dt.", keyProvider == null ?
          "null" : keyProvider.getClass());
      return;
    }
    ((KeyProviderDelegationTokenExtension.DelegationTokenExtension)
        keyProvider).cancelDelegationToken(token);
  } finally {
    if (keyProvider != null) {
      keyProvider.close();
    }
  }
}