Java KeyProvider.Metadata方法代码示例

import org.apache.hadoop.crypto.key.KeyProvider; //导入方法依赖的package包/类
@GET
@Path(KMSRESTConstants.KEYS_METADATA_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response getKeysMetadata(@QueryParam(KMSRESTConstants.KEY)
    List<String> keyNamesList) throws Exception {
  KMSWebApp.getAdminCallsMeter().mark();
  UserGroupInformation user = HttpUserGroupInformation.get();
  final String[] keyNames = keyNamesList.toArray(
      new String[keyNamesList.size()]);
  assertAccess(KMSACLs.Type.GET_METADATA, user, KMSOp.GET_KEYS_METADATA);

  KeyProvider.Metadata[] keysMeta = user.doAs(
      new PrivilegedExceptionAction<KeyProvider.Metadata[]>() {
        @Override
        public KeyProvider.Metadata[] run() throws Exception {
          return provider.getKeysMetadata(keyNames);
        }
      }
  );

  Object json = KMSServerJSONUtils.toJSON(keyNames, keysMeta);
  kmsAudit.ok(user, KMSOp.GET_KEYS_METADATA, "");
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(json).build();
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入方法依赖的package包/类
@GET
@Path(KMSRESTConstants.KEY_RESOURCE + "/{name:.*}/" +
    KMSRESTConstants.METADATA_SUB_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response getMetadata(@PathParam("name") final String name)
    throws Exception {
  UserGroupInformation user = HttpUserGroupInformation.get();
  KMSClientProvider.checkNotEmpty(name, "name");
  KMSWebApp.getAdminCallsMeter().mark();
  assertAccess(KMSACLs.Type.GET_METADATA, user, KMSOp.GET_METADATA, name);

  KeyProvider.Metadata metadata = user.doAs(
      new PrivilegedExceptionAction<KeyProvider.Metadata>() {
        @Override
        public KeyProvider.Metadata run() throws Exception {
          return provider.getMetadata(name);
        }
      }
  );

  Object json = KMSServerJSONUtils.toJSON(name, metadata);
  kmsAudit.ok(user, KMSOp.GET_METADATA, name, "");
  return Response.ok().type(MediaType.APPLICATION_JSON).entity(json).build();
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入方法依赖的package包/类
@SuppressWarnings("unchecked")
public static Map toJSON(String keyName, KeyProvider.Metadata meta) {
  Map json = new LinkedHashMap();
  if (meta != null) {
    json.put(KMSRESTConstants.NAME_FIELD, keyName);
    json.put(KMSRESTConstants.CIPHER_FIELD, meta.getCipher());
    json.put(KMSRESTConstants.LENGTH_FIELD, meta.getBitLength());
    json.put(KMSRESTConstants.DESCRIPTION_FIELD, meta.getDescription());
    json.put(KMSRESTConstants.ATTRIBUTES_FIELD, meta.getAttributes());
    json.put(KMSRESTConstants.CREATED_FIELD,
        meta.getCreated().getTime());
    json.put(KMSRESTConstants.VERSIONS_FIELD,
        (long) meta.getVersions());
  }
  return json;
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入方法依赖的package包/类
/**
 * Create an encryption zone on directory src using the specified key.
 *
 * @param src     the path of a directory which will be the root of the
 *                encryption zone. The directory must be empty.
 * @param keyName name of a key which must be present in the configured
 *                KeyProvider.
 * @throws AccessControlException  if the caller is not the superuser.
 * @throws UnresolvedLinkException if the path can't be resolved.
 * @throws SafeModeException       if the Namenode is in safe mode.
 */
void createEncryptionZone(final String src, final String keyName,
                          boolean logRetryCache)
  throws IOException, UnresolvedLinkException,
    SafeModeException, AccessControlException {
  try {
    if (provider == null) {
      throw new IOException(
          "Can't create an encryption zone for " + src +
          " since no key provider is available.");
    }
    if (keyName == null || keyName.isEmpty()) {
      throw new IOException("Must specify a key name when creating an " +
          "encryption zone");
    }
    KeyProvider.Metadata metadata = provider.getMetadata(keyName);
    if (metadata == null) {
      /*
       * It would be nice if we threw something more specific than
       * IOException when the key is not found, but the KeyProvider API
       * doesn't provide for that. If that API is ever changed to throw
       * something more specific (e.g. UnknownKeyException) then we can
       * update this to match it, or better yet, just rethrow the
       * KeyProvider's exception.
       */
      throw new IOException("Key " + keyName + " doesn't exist.");
    }
    // If the provider supports pool for EDEKs, this will fill in the pool
    generateEncryptedDataEncryptionKey(keyName);
    createEncryptionZoneInt(src, metadata.getCipher(),
        keyName, logRetryCache);
  } catch (AccessControlException e) {
    logAuditEvent(false, "createEncryptionZone", src);
    throw e;
  }
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入方法依赖的package包/类
static KeyProvider.Metadata ensureKeyIsInitialized(final FSDirectory fsd,
    final String keyName, final String src) throws IOException {
  KeyProviderCryptoExtension provider = fsd.getProvider();
  if (provider == null) {
    throw new IOException("Can't create an encryption zone for " + src
        + " since no key provider is available.");
  }
  if (keyName == null || keyName.isEmpty()) {
    throw new IOException("Must specify a key name when creating an "
        + "encryption zone");
  }
  KeyProvider.Metadata metadata = provider.getMetadata(keyName);
  if (metadata == null) {
    /*
     * It would be nice if we threw something more specific than
     * IOException when the key is not found, but the KeyProvider API
     * doesn't provide for that. If that API is ever changed to throw
     * something more specific (e.g. UnknownKeyException) then we can
     * update this to match it, or better yet, just rethrow the
     * KeyProvider's exception.
     */
    throw new IOException("Key " + keyName + " doesn't exist.");
  }
  // If the provider supports pool for EDEKs, this will fill in the pool
  provider.warmUpEncryptedKeys(keyName);
  return metadata;
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入方法依赖的package包/类
@GET
@Path(KMSRESTConstants.KEYS_METADATA_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response getKeysMetadata(@QueryParam(KMSRESTConstants.KEY)
    List<String> keyNamesList) throws Exception {
  try {
    LOG.trace("Entering getKeysMetadata method.");
    KMSWebApp.getAdminCallsMeter().mark();
    UserGroupInformation user = HttpUserGroupInformation.get();
    final String[] keyNames = keyNamesList.toArray(
            new String[keyNamesList.size()]);
    assertAccess(KMSACLs.Type.GET_METADATA, user, KMSOp.GET_KEYS_METADATA);

    KeyProvider.Metadata[] keysMeta = user.doAs(
            new PrivilegedExceptionAction<KeyProvider.Metadata[]>() {
            @Override
              public KeyProvider.Metadata[] run() throws Exception {
              return provider.getKeysMetadata(keyNames);
            }
          }
    );

    Object json = KMSServerJSONUtils.toJSON(keyNames, keysMeta);
    kmsAudit.ok(user, KMSOp.GET_KEYS_METADATA, "");
    LOG.trace("Exiting getKeysMetadata method.");
    return Response.ok().type(MediaType.APPLICATION_JSON).entity(json)
            .build();
  } catch (Exception e) {
    LOG.debug("Exception in getKeysmetadata.", e);
    throw e;
  }
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入方法依赖的package包/类
@GET
@Path(KMSRESTConstants.KEY_RESOURCE + "/{name:.*}/" +
    KMSRESTConstants.METADATA_SUB_RESOURCE)
@Produces(MediaType.APPLICATION_JSON)
public Response getMetadata(@PathParam("name") final String name)
    throws Exception {
  try {
    LOG.trace("Entering getMetadata method.");
    UserGroupInformation user = HttpUserGroupInformation.get();
    KMSClientProvider.checkNotEmpty(name, "name");
    KMSWebApp.getAdminCallsMeter().mark();
    assertAccess(KMSACLs.Type.GET_METADATA, user, KMSOp.GET_METADATA, name);
    LOG.debug("Getting metadata for key with name {}.", name);

    KeyProvider.Metadata metadata = user.doAs(
            new PrivilegedExceptionAction<KeyProvider.Metadata>() {
            @Override
              public KeyProvider.Metadata run() throws Exception {
              return provider.getMetadata(name);
            }
          }
    );

    Object json = KMSServerJSONUtils.toJSON(name, metadata);
    kmsAudit.ok(user, KMSOp.GET_METADATA, name, "");
    LOG.trace("Exiting getMetadata method.");
    return Response.ok().type(MediaType.APPLICATION_JSON).entity(json)
            .build();
  } catch (Exception e) {
    LOG.debug("Exception in getMetadata.", e);
    throw e;
  }
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入方法依赖的package包/类
/**
 * Create an encryption zone on directory src using the specified key.
 *
 * @param src     the path of a directory which will be the root of the
 *                encryption zone. The directory must be empty.
 * @param keyName name of a key which must be present in the configured
 *                KeyProvider.
 * @throws AccessControlException  if the caller is not the superuser.
 * @throws UnresolvedLinkException if the path can't be resolved.
 * @throws SafeModeException       if the Namenode is in safe mode.
 */
void createEncryptionZone(final String src, final String keyName)
  throws IOException, UnresolvedLinkException,
    SafeModeException, AccessControlException {
  final CacheEntry cacheEntry = RetryCache.waitForCompletion(retryCache);
  if (cacheEntry != null && cacheEntry.isSuccess()) {
    return; // Return previous response
  }

  boolean success = false;
  try {
    if (provider == null) {
      throw new IOException(
          "Can't create an encryption zone for " + src +
          " since no key provider is available.");
    }
    if (keyName == null || keyName.isEmpty()) {
      throw new IOException("Must specify a key name when creating an " +
          "encryption zone");
    }
    KeyProvider.Metadata metadata = provider.getMetadata(keyName);
    if (metadata == null) {
      /*
       * It would be nice if we threw something more specific than
       * IOException when the key is not found, but the KeyProvider API
       * doesn't provide for that. If that API is ever changed to throw
       * something more specific (e.g. UnknownKeyException) then we can
       * update this to match it, or better yet, just rethrow the
       * KeyProvider's exception.
       */
      throw new IOException("Key " + keyName + " doesn't exist.");
    }
    // If the provider supports pool for EDEKs, this will fill in the pool
    generateEncryptedDataEncryptionKey(keyName);
    createEncryptionZoneInt(src, metadata.getCipher(),
        keyName, cacheEntry != null);
    success = true;
  } catch (AccessControlException e) {
    logAuditEvent(false, "createEncryptionZone", src);
    throw e;
  } finally {
    RetryCache.setState(cacheEntry, success);
  }
}
 

import org.apache.hadoop.crypto.key.KeyProvider; //导入方法依赖的package包/类
/**
 * Create an encryption zone on directory src using the specified key.
 *
 * @param src     the path of a directory which will be the root of the
 *                encryption zone. The directory must be empty.
 * @param keyName name of a key which must be present in the configured
 *                KeyProvider.
 * @throws AccessControlException  if the caller is not the superuser.
 * @throws UnresolvedLinkException if the path can't be resolved.
 * @throws SafeModeException       if the Namenode is in safe mode.
 */
void createEncryptionZone(final String src, final String keyName)
  throws IOException, UnresolvedLinkException,
    SafeModeException, AccessControlException {
  final CacheEntry cacheEntry = RetryCache.waitForCompletion(retryCache);
  if (cacheEntry != null && cacheEntry.isSuccess()) {
    return; // Return previous response
  }

  boolean success = false;
  try {
    if (provider == null) {
      throw new IOException(
          "Can't create an encryption zone for " + src +
          " since no key provider is available.");
    }
    if (keyName == null || keyName.isEmpty()) {
      throw new IOException("Must specify a key name when creating an " +
          "encryption zone");
    }
    KeyProvider.Metadata metadata = provider.getMetadata(keyName);
    if (metadata == null) {
      /*
       * It would be nice if we threw something more specific than
       * IOException when the key is not found, but the KeyProvider API
       * doesn't provide for that. If that API is ever changed to throw
       * something more specific (e.g. UnknownKeyException) then we can
       * update this to match it, or better yet, just rethrow the
       * KeyProvider's exception.
       */
      throw new IOException("Key " + keyName + " doesn't exist.");
    }
    createEncryptionZoneInt(src, metadata.getCipher(),
        keyName, cacheEntry != null);
    success = true;
  } catch (AccessControlException e) {
    logAuditEvent(false, "createEncryptionZone", src);
    throw e;
  } finally {
    RetryCache.setState(cacheEntry, success);
  }
}