Java KeyProviderCryptoExtension.createKeyProviderCryptoExtension方法代码示例

import org.apache.hadoop.crypto.key.KeyProviderCryptoExtension; //导入方法依赖的package包/类
/**
 * Decrypts a EDEK by consulting the KeyProvider.
 */
private KeyVersion decryptEncryptedDataEncryptionKey(FileEncryptionInfo
    feInfo) throws IOException {
  TraceScope scope = Trace.startSpan("decryptEDEK", traceSampler);
  try {
    KeyProvider provider = getKeyProvider();
    if (provider == null) {
      throw new IOException("No KeyProvider is configured, cannot access" +
          " an encrypted file");
    }
    EncryptedKeyVersion ekv = EncryptedKeyVersion.createForDecryption(
        feInfo.getKeyName(), feInfo.getEzKeyVersionName(), feInfo.getIV(),
        feInfo.getEncryptedDataEncryptionKey());
    try {
      KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension
          .createKeyProviderCryptoExtension(provider);
      return cryptoProvider.decryptEncryptedKey(ekv);
    } catch (GeneralSecurityException e) {
      throw new IOException(e);
    }
  } finally {
    scope.close();
  }
}
 

import org.apache.hadoop.crypto.key.KeyProviderCryptoExtension; //导入方法依赖的package包/类
/**
 * Decrypts a EDEK by consulting the KeyProvider.
 */
private KeyVersion decryptEncryptedDataEncryptionKey(FileEncryptionInfo
    feInfo) throws IOException {
  try (TraceScope ignored = tracer.newScope("decryptEDEK")) {
    KeyProvider provider = getKeyProvider();
    if (provider == null) {
      throw new IOException("No KeyProvider is configured, cannot access" +
          " an encrypted file");
    }
    EncryptedKeyVersion ekv = EncryptedKeyVersion.createForDecryption(
        feInfo.getKeyName(), feInfo.getEzKeyVersionName(), feInfo.getIV(),
        feInfo.getEncryptedDataEncryptionKey());
    try {
      KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension
          .createKeyProviderCryptoExtension(provider);
      return cryptoProvider.decryptEncryptedKey(ekv);
    } catch (GeneralSecurityException e) {
      throw new IOException(e);
    }
  }
}
 

import org.apache.hadoop.crypto.key.KeyProviderCryptoExtension; //导入方法依赖的package包/类
/**
 * Decrypts a EDEK by consulting the KeyProvider.
 */
private KeyVersion decryptEncryptedDataEncryptionKey(FileEncryptionInfo
    feInfo) throws IOException {
  KeyProvider provider = getKeyProvider();
  if (provider == null) {
    throw new IOException("No KeyProvider is configured, cannot access" +
        " an encrypted file");
  }
  EncryptedKeyVersion ekv = EncryptedKeyVersion.createForDecryption(
      feInfo.getKeyName(), feInfo.getEzKeyVersionName(), feInfo.getIV(),
      feInfo.getEncryptedDataEncryptionKey());
  try {
    KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension
        .createKeyProviderCryptoExtension(provider);
    return cryptoProvider.decryptEncryptedKey(ekv);
  } catch (GeneralSecurityException e) {
    throw new IOException(e);
  }
}
 

import org.apache.hadoop.crypto.key.KeyProviderCryptoExtension; //导入方法依赖的package包/类
/**
 * Decrypts a EDEK by consulting the KeyProvider.
 */
private KeyVersion decryptEncryptedDataEncryptionKey(FileEncryptionInfo
    feInfo) throws IOException {
  if (provider == null) {
    throw new IOException("No KeyProvider is configured, cannot access" +
        " an encrypted file");
  }
  EncryptedKeyVersion ekv = EncryptedKeyVersion.createForDecryption(
      feInfo.getKeyName(), feInfo.getEzKeyVersionName(), feInfo.getIV(),
      feInfo.getEncryptedDataEncryptionKey());
  try {
    KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension
        .createKeyProviderCryptoExtension(provider);
    return cryptoProvider.decryptEncryptedKey(ekv);
  } catch (GeneralSecurityException e) {
    throw new IOException(e);
  }
}
 

import org.apache.hadoop.crypto.key.KeyProviderCryptoExtension; //导入方法依赖的package包/类
/**
 * Creates a new KeyProviderCryptoExtension by wrapping the
 * KeyProvider specified in the given Configuration.
 *
 * @param conf Configuration
 * @return new KeyProviderCryptoExtension, or null if no provider was found.
 * @throws IOException if the KeyProvider is improperly specified in
 *                             the Configuration
 */
public static KeyProviderCryptoExtension createKeyProviderCryptoExtension(
    final Configuration conf) throws IOException {
  KeyProvider keyProvider = createKeyProvider(conf);
  if (keyProvider == null) {
    return null;
  }
  KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension
      .createKeyProviderCryptoExtension(keyProvider);
  return cryptoProvider;
}
 

import org.apache.hadoop.crypto.key.KeyProviderCryptoExtension; //导入方法依赖的package包/类
/**
 * Creates a new KeyProviderCryptoExtension by wrapping the
 * KeyProvider specified in the given Configuration.
 *
 * @param conf Configuration
 * @return new KeyProviderCryptoExtension, or null if no provider was found.
 * @throws IOException if the KeyProvider is improperly specified in
 *                             the Configuration
 */
public static KeyProviderCryptoExtension createKeyProviderCryptoExtension(
    final Configuration conf) throws IOException {
  KeyProvider keyProvider = DFSUtilClient.createKeyProvider(conf);
  if (keyProvider == null) {
    return null;
  }
  KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension
      .createKeyProviderCryptoExtension(keyProvider);
  return cryptoProvider;
}
 

import org.apache.hadoop.crypto.key.KeyProviderCryptoExtension; //导入方法依赖的package包/类
@Test(expected = IllegalArgumentException.class)
public void testDecryptWithKeyVersionNameKeyMismatch() throws Exception {
  final Configuration conf = new Configuration();
  KeyProvider kp =
      new UserProvider.Factory().createProvider(new URI("user:///"), conf);
  KeyACLs mock = mock(KeyACLs.class);
  when(mock.isACLPresent("testKey", KeyOpType.MANAGEMENT)).thenReturn(true);
  when(mock.isACLPresent("testKey", KeyOpType.GENERATE_EEK)).thenReturn(true);
  when(mock.isACLPresent("testKey", KeyOpType.DECRYPT_EEK)).thenReturn(true);
  when(mock.isACLPresent("testKey", KeyOpType.ALL)).thenReturn(true);
  UserGroupInformation u1 = UserGroupInformation.createRemoteUser("u1");
  UserGroupInformation u2 = UserGroupInformation.createRemoteUser("u2");
  UserGroupInformation u3 = UserGroupInformation.createRemoteUser("u3");
  UserGroupInformation sudo = UserGroupInformation.createRemoteUser("sudo");
  when(mock.hasAccessToKey("testKey", u1,
      KeyOpType.MANAGEMENT)).thenReturn(true);
  when(mock.hasAccessToKey("testKey", u2,
      KeyOpType.GENERATE_EEK)).thenReturn(true);
  when(mock.hasAccessToKey("testKey", u3,
      KeyOpType.DECRYPT_EEK)).thenReturn(true);
  when(mock.hasAccessToKey("testKey", sudo,
      KeyOpType.ALL)).thenReturn(true);
  final KeyProviderCryptoExtension kpExt =
      new KeyAuthorizationKeyProvider(
          KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp),
          mock);

  sudo.doAs(
      new PrivilegedExceptionAction<Void>() {
        @Override
        public Void run() throws Exception {
          Options opt = newOptions(conf);
          Map<String, String> m = new HashMap<String, String>();
          m.put("key.acl.name", "testKey");
          opt.setAttributes(m);
          KeyVersion kv =
              kpExt.createKey("foo", SecureRandom.getSeed(16), opt);
          kpExt.rollNewVersion(kv.getName());
          kpExt.rollNewVersion(kv.getName(), SecureRandom.getSeed(16));
          EncryptedKeyVersion ekv = kpExt.generateEncryptedKey(kv.getName());
          ekv = EncryptedKeyVersion.createForDecryption(
              ekv.getEncryptionKeyName() + "x",
              ekv.getEncryptionKeyVersionName(),
              ekv.getEncryptedKeyIv(),
              ekv.getEncryptedKeyVersion().getMaterial());
          kpExt.decryptEncryptedKey(ekv);
          return null;
        }
      }
  );
}
 

import org.apache.hadoop.crypto.key.KeyProviderCryptoExtension; //导入方法依赖的package包/类
public ProxyReEncryptionExtension(Configuration conf,
                                  KeyProviderCryptoExtension keyProvider)
    throws URISyntaxException, IOException, NoSuchAlgorithmException
{
  this.keyProvider = keyProvider;

  final String keyName = conf.get(LOCAL_KMS_KEY_NAME_KEY, LOCAL_KMS_KEY_NAME_DEFAULT);

  final Metadata meta = keyProvider.getMetadata(keyName);

  if (meta == null) {
    localKey = keyProvider.createKeyPair(keyName, new Options(conf));
  } else {
    localKey = keyProvider.rollNewVersionPair(keyName);
  }

  localEDEKGeneration = conf.getBoolean(LOCAL_KMS_KEY_LOCAL_EDEK_GENERATION, LOCAL_KMS_KEY_LOCAL_EDEK_GENERATION_KEY);

  Metadata metadata = keyProvider.getMetadata(localKey.getName());

  localCryptoExtension = KeyProviderCryptoExtension.createKeyProviderCryptoExtension(
      new LocalKeyProvider(localKey, metadata, conf)
  );

  final String renString = conf.get(RE_KEY_PROVIDER_URI);
  final String renUrlStringList[] = renString.split(",");

  if (renUrlStringList.length == 0)
    throw new IOException("Invalid " + RE_KEY_PROVIDER_URI);

  int index = renUrlStringList.length < 2  ? 0 : new SecureRandom().nextInt(renUrlStringList.length);

  final URI renURI = new URI(renUrlStringList[index]);

  this.rekProvider = ReEncryptionKeyProviderFactory.get(renURI, conf);

}