Java MasterKeyData类代码示例

import org.apache.hadoop.yarn.server.security.MasterKeyData; //导入依赖的package包/类
public void recover(RMState state) {
  if (state.getAMRMTokenSecretManagerState() != null) {
    // recover the current master key
    MasterKey currentKey =
        state.getAMRMTokenSecretManagerState().getCurrentMasterKey();
    this.currentMasterKey =
        new MasterKeyData(currentKey, createSecretKey(currentKey.getBytes()
          .array()));

    // recover the next master key if not null
    MasterKey nextKey =
        state.getAMRMTokenSecretManagerState().getNextMasterKey();
    if (nextKey != null) {
      this.nextMasterKey =
          new MasterKeyData(nextKey, createSecretKey(nextKey.getBytes()
            .array()));
      this.timer.schedule(new NextKeyActivator(), this.activationDelay);
    }
  }
}
 

import org.apache.hadoop.yarn.server.security.MasterKeyData; //导入依赖的package包/类
/**
 * Used by NodeManagers to create a token-secret-manager with the key obtained
 * from the RM. This can happen during registration or when the RM rolls the
 * master-key and signals the NM.
 * 
 * @param masterKeyRecord
 */
@Private
public synchronized void setMasterKey(MasterKey masterKeyRecord) {
  LOG.info("Rolling master-key for container-tokens, got key with id "
      + masterKeyRecord.getKeyId());
  if (super.currentMasterKey == null) {
    super.currentMasterKey =
        new MasterKeyData(masterKeyRecord, createSecretKey(masterKeyRecord
          .getBytes().array()));
  } else {
    if (super.currentMasterKey.getMasterKey().getKeyId() != masterKeyRecord
        .getKeyId()) {
      // Update keys only if the key has changed.
      this.previousMasterKey = super.currentMasterKey;
      super.currentMasterKey =
          new MasterKeyData(masterKeyRecord, createSecretKey(masterKeyRecord
            .getBytes().array()));
    }
  }
}
 

import org.apache.hadoop.yarn.server.security.MasterKeyData; //导入依赖的package包/类
/**
 * Used by NodeManagers to create a token-secret-manager with the key
 * obtained from the RM. This can happen during registration or when the RM
 * rolls the master-key and signal the NM.
 */
@Private
public synchronized void setMasterKey(MasterKey masterKey) {
  LOG.info("Rolling master-key for nm-tokens, got key with id :"
      + masterKey.getKeyId());
  if (super.currentMasterKey == null) {
    super.currentMasterKey =
        new MasterKeyData(masterKey, createSecretKey(masterKey.getBytes()
          .array()));
  } else {
    if (super.currentMasterKey.getMasterKey().getKeyId() != masterKey
      .getKeyId()) {
      this.previousMasterKey = super.currentMasterKey;
      super.currentMasterKey =
          new MasterKeyData(masterKey, createSecretKey(masterKey.getBytes()
            .array()));
    }
  }
}
 

import org.apache.hadoop.yarn.server.security.MasterKeyData; //导入依赖的package包/类
public synchronized void recover()
    throws IOException {
  RecoveredContainerTokensState state =
      stateStore.loadContainerTokensState();
  MasterKey key = state.getCurrentMasterKey();
  if (key != null) {
    super.currentMasterKey =
        new MasterKeyData(key, createSecretKey(key.getBytes().array()));
  }

  key = state.getPreviousMasterKey();
  if (key != null) {
    previousMasterKey =
        new MasterKeyData(key, createSecretKey(key.getBytes().array()));
  }

  // restore the serial number from the current master key
  if (super.currentMasterKey != null) {
    super.serialNo = super.currentMasterKey.getMasterKey().getKeyId() + 1;
  }

  for (Entry<ContainerId, Long> entry : state.getActiveTokens().entrySet()) {
    ContainerId containerId = entry.getKey();
    Long expTime = entry.getValue();
    List<ContainerId> containerList =
        recentlyStartedContainerTracker.get(expTime);
    if (containerList == null) {
      containerList = new ArrayList<ContainerId>();
      recentlyStartedContainerTracker.put(expTime, containerList);
    }
    if (!containerList.contains(containerId)) {
      containerList.add(containerId);
    }
  }
}
 

import org.apache.hadoop.yarn.server.security.MasterKeyData; //导入依赖的package包/类
private void updateCurrentMasterKey(MasterKeyData key) {
  super.currentMasterKey = key;
  try {
    stateStore.storeContainerTokenCurrentMasterKey(key.getMasterKey());
  } catch (IOException e) {
    LOG.error("Unable to update current master key in state store", e);
  }
}
 

import org.apache.hadoop.yarn.server.security.MasterKeyData; //导入依赖的package包/类
private void updatePreviousMasterKey(MasterKeyData key) {
  previousMasterKey = key;
  try {
    stateStore.storeContainerTokenPreviousMasterKey(key.getMasterKey());
  } catch (IOException e) {
    LOG.error("Unable to update previous master key in state store", e);
  }
}
 

import org.apache.hadoop.yarn.server.security.MasterKeyData; //导入依赖的package包/类
/**
 * Used by NodeManagers to create a token-secret-manager with the key obtained
 * from the RM. This can happen during registration or when the RM rolls the
 * master-key and signals the NM.
 * 
 * @param masterKeyRecord
 */
@Private
public synchronized void setMasterKey(MasterKey masterKeyRecord) {
  // Update keys only if the key has changed.
  if (super.currentMasterKey == null || super.currentMasterKey.getMasterKey()
        .getKeyId() != masterKeyRecord.getKeyId()) {
    LOG.info("Rolling master-key for container-tokens, got key with id "
        + masterKeyRecord.getKeyId());
    if (super.currentMasterKey != null) {
      updatePreviousMasterKey(super.currentMasterKey);
    }
    updateCurrentMasterKey(new MasterKeyData(masterKeyRecord,
        createSecretKey(masterKeyRecord.getBytes().array())));
  }
}
 

import org.apache.hadoop.yarn.server.security.MasterKeyData; //导入依赖的package包/类
/**
 * Override of this is to validate ContainerTokens generated by using
 * different {@link MasterKey}s.
 */
@Override
public synchronized byte[] retrievePassword(
    ContainerTokenIdentifier identifier) throws SecretManager.InvalidToken {
  int keyId = identifier.getMasterKeyId();

  MasterKeyData masterKeyToUse = null;
  if (this.previousMasterKey != null
      && keyId == this.previousMasterKey.getMasterKey().getKeyId()) {
    // A container-launch has come in with a token generated off the last
    // master-key
    masterKeyToUse = this.previousMasterKey;
  } else if (keyId == super.currentMasterKey.getMasterKey().getKeyId()) {
    // A container-launch has come in with a token generated off the current
    // master-key
    masterKeyToUse = super.currentMasterKey;
  }

  if (nodeHostAddr != null
      && !identifier.getNmHostAddress().equals(nodeHostAddr)) {
    // Valid container token used for incorrect node.
    throw new SecretManager.InvalidToken("Given Container "
        + identifier.getContainerID().toString()
        + " identifier is not valid for current Node manager. Expected : "
        + nodeHostAddr + " Found : " + identifier.getNmHostAddress());
  }
  
  if (masterKeyToUse != null) {
    return retrievePasswordInternal(identifier, masterKeyToUse);
  }

  // Invalid request. Like startContainer() with token generated off
  // old-master-keys.
  throw new SecretManager.InvalidToken("Given Container "
      + identifier.getContainerID().toString()
      + " seems to have an illegally generated token.");
}
 

import org.apache.hadoop.yarn.server.security.MasterKeyData; //导入依赖的package包/类
public NMTokenSecretManagerInNM(NMStateStoreService stateStore) {
  this.oldMasterKeys =
      new HashMap<ApplicationAttemptId, MasterKeyData>();
  appToAppAttemptMap =         
      new HashMap<ApplicationId, List<ApplicationAttemptId>>();
  this.stateStore = stateStore;
}
 

import org.apache.hadoop.yarn.server.security.MasterKeyData; //导入依赖的package包/类
public synchronized void recover()
    throws IOException {
  RecoveredNMTokensState state = stateStore.loadNMTokensState();
  MasterKey key = state.getCurrentMasterKey();
  if (key != null) {
    super.currentMasterKey =
        new MasterKeyData(key, createSecretKey(key.getBytes().array()));
  }

  key = state.getPreviousMasterKey();
  if (key != null) {
    previousMasterKey =
        new MasterKeyData(key, createSecretKey(key.getBytes().array()));
  }

  // restore the serial number from the current master key
  if (super.currentMasterKey != null) {
    super.serialNo = super.currentMasterKey.getMasterKey().getKeyId() + 1;
  }

  for (Map.Entry<ApplicationAttemptId, MasterKey> entry :
       state.getApplicationMasterKeys().entrySet()) {
    key = entry.getValue();
    oldMasterKeys.put(entry.getKey(),
        new MasterKeyData(key, createSecretKey(key.getBytes().array())));
  }

  // reconstruct app to app attempts map
  appToAppAttemptMap.clear();
  for (ApplicationAttemptId attempt : oldMasterKeys.keySet()) {
    ApplicationId app = attempt.getApplicationId();
    List<ApplicationAttemptId> attempts = appToAppAttemptMap.get(app);
    if (attempts == null) {
      attempts = new ArrayList<ApplicationAttemptId>();
      appToAppAttemptMap.put(app, attempts);
    }
    attempts.add(attempt);
  }
}
 

import org.apache.hadoop.yarn.server.security.MasterKeyData; //导入依赖的package包/类
private void updateCurrentMasterKey(MasterKeyData key) {
  super.currentMasterKey = key;
  try {
    stateStore.storeNMTokenCurrentMasterKey(key.getMasterKey());
  } catch (IOException e) {
    LOG.error("Unable to update current master key in state store", e);
  }
}
 

import org.apache.hadoop.yarn.server.security.MasterKeyData; //导入依赖的package包/类
private void updatePreviousMasterKey(MasterKeyData key) {
  previousMasterKey = key;
  try {
    stateStore.storeNMTokenPreviousMasterKey(key.getMasterKey());
  } catch (IOException e) {
    LOG.error("Unable to update previous master key in state store", e);
  }
}
 

import org.apache.hadoop.yarn.server.security.MasterKeyData; //导入依赖的package包/类
/**
 * Used by NodeManagers to create a token-secret-manager with the key
 * obtained from the RM. This can happen during registration or when the RM
 * rolls the master-key and signal the NM.
 */
@Private
public synchronized void setMasterKey(MasterKey masterKey) {
  // Update keys only if the key has changed.
  if (super.currentMasterKey == null || super.currentMasterKey.getMasterKey()
        .getKeyId() != masterKey.getKeyId()) {
    LOG.info("Rolling master-key for container-tokens, got key with id "
        + masterKey.getKeyId());
    if (super.currentMasterKey != null) {
      updatePreviousMasterKey(super.currentMasterKey);
    }
    updateCurrentMasterKey(new MasterKeyData(masterKey,
        createSecretKey(masterKey.getBytes().array())));
  }
}
 

import org.apache.hadoop.yarn.server.security.MasterKeyData; //导入依赖的package包/类
/**
 * This method will be used to verify NMTokens generated by different master
 * keys.
 */
@Override
public synchronized byte[] retrievePassword(NMTokenIdentifier identifier)
    throws InvalidToken {
  int keyId = identifier.getKeyId();
  ApplicationAttemptId appAttemptId = identifier.getApplicationAttemptId();

  /*
   * MasterKey used for retrieving password will be as follows. 1) By default
   * older saved master key will be used. 2) If identifier's master key id
   * matches that of previous master key id then previous key will be used. 3)
   * If identifier's master key id matches that of current master key id then
   * current key will be used.
   */
  MasterKeyData oldMasterKey = oldMasterKeys.get(appAttemptId);
  MasterKeyData masterKeyToUse = oldMasterKey;
  if (previousMasterKey != null
      && keyId == previousMasterKey.getMasterKey().getKeyId()) {
    masterKeyToUse = previousMasterKey;
  } else if (keyId == currentMasterKey.getMasterKey().getKeyId()) {
    masterKeyToUse = currentMasterKey;
  }
  
  if (nodeId != null && !identifier.getNodeId().equals(nodeId)) {
    throw new InvalidToken("Given NMToken for application : "
        + appAttemptId.toString() + " is not valid for current node manager."
        + "expected : " + nodeId.toString() + " found : "
        + identifier.getNodeId().toString());
  }
  
  if (masterKeyToUse != null) {
    byte[] password = retrivePasswordInternal(identifier, masterKeyToUse);
    LOG.debug("NMToken password retrieved successfully!!");
    return password;
  }

  throw new InvalidToken("Given NMToken for application : "
      + appAttemptId.toString() + " seems to have been generated illegally.");
}
 

import org.apache.hadoop.yarn.server.security.MasterKeyData; //导入依赖的package包/类
/**
 * This will be called by startContainer. It will add the master key into
 * the cache used for starting this container. This should be called before
 * validating the startContainer request.
 */
public synchronized void appAttemptStartContainer(
    NMTokenIdentifier identifier)
    throws org.apache.hadoop.security.token.SecretManager.InvalidToken {
  ApplicationAttemptId appAttemptId = identifier.getApplicationAttemptId();
  if (!appToAppAttemptMap.containsKey(appAttemptId.getApplicationId())) {
    // First application attempt for the given application
    appToAppAttemptMap.put(appAttemptId.getApplicationId(),
      new ArrayList<ApplicationAttemptId>());
  }
  MasterKeyData oldKey = oldMasterKeys.get(appAttemptId);

  if (oldKey == null) {
    // This is a new application attempt.
    appToAppAttemptMap.get(appAttemptId.getApplicationId()).add(appAttemptId);
  }
  if (oldKey == null
      || oldKey.getMasterKey().getKeyId() != identifier.getKeyId()) {
    // Update key only if it is modified.
    LOG.debug("NMToken key updated for application attempt : "
        + identifier.getApplicationAttemptId().toString());
    if (identifier.getKeyId() == currentMasterKey.getMasterKey()
      .getKeyId()) {
      updateAppAttemptKey(appAttemptId, currentMasterKey);
    } else if (previousMasterKey != null
        && identifier.getKeyId() == previousMasterKey.getMasterKey()
          .getKeyId()) {
      updateAppAttemptKey(appAttemptId, previousMasterKey);
    } else {
      throw new InvalidToken(
        "Older NMToken should not be used while starting the container.");
    }
  }
}