| /** |
| * Licensed to the Apache Software Foundation (ASF) under one |
| * or more contributor license agreements. See the NOTICE file |
| * distributed with this work for additional information |
| * regarding copyright ownership. The ASF licenses this file |
| * to you under the Apache License, Version 2.0 (the |
| * "License"); you may not use this file except in compliance |
| * with the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| package org.apache.hadoop.hdfs; |
| |
| import java.io.BufferedReader; |
| import java.io.File; |
| import java.io.FileWriter; |
| import java.io.IOException; |
| import java.io.InputStreamReader; |
| import java.io.OutputStreamWriter; |
| import java.io.PrintWriter; |
| import java.io.Writer; |
| import java.net.URI; |
| import java.security.NoSuchAlgorithmException; |
| import java.security.PrivilegedAction; |
| import org.slf4j.Logger; |
| import org.slf4j.LoggerFactory; |
| |
| import org.apache.hadoop.conf.Configuration; |
| import org.apache.hadoop.crypto.key.kms.KMSClientProvider; |
| import org.apache.hadoop.crypto.key.kms.server.KMSConfiguration; |
| import org.apache.hadoop.crypto.key.kms.server.KeyAuthorizationKeyProvider; |
| import org.apache.hadoop.crypto.key.kms.server.MiniKMS; |
| import org.apache.hadoop.fs.CommonConfigurationKeysPublic; |
| import org.apache.hadoop.fs.FSDataInputStream; |
| import org.apache.hadoop.fs.FSDataOutputStream; |
| import org.apache.hadoop.fs.FileSystemTestHelper; |
| import org.apache.hadoop.fs.Path; |
| import org.apache.hadoop.security.UserGroupInformation; |
| import org.apache.hadoop.security.authorize.ProxyUsers; |
| import org.junit.Assert; |
| import static org.junit.Assert.assertEquals; |
| import static org.junit.Assert.assertFalse; |
| import static org.junit.Assert.assertTrue; |
| import org.junit.BeforeClass; |
| import org.junit.Test; |
| |
| /** |
| * This class tests the ACLs system through the full code path. It overlaps |
| * slightly with the ACL tests in common, but the approach is more holistic. |
| * |
| * <b>NOTE:</b> Because of the mechanics of JAXP, when the KMS config files are |
| * written to disk, a config param with a blank value ("") will be written in a |
| * way that the KMS will read as unset, which is different from blank. For this |
| * reason, when testing the effects of blank config params, this test class |
| * sets the values of those config params to a space (" "). A whitespace value |
| * will be preserved by JAXP when writing out the config files and will be |
| * interpreted by KMS as a blank value. (The KMS strips whitespace from ACL |
| * values before interpreting them.) |
| */ |
| public class TestAclsEndToEnd { |
| private static final Logger LOG = |
| LoggerFactory.getLogger(TestAclsEndToEnd.class.getName()); |
| private static final String TEXT = |
| "The blue zone is for loading and unloading only. " |
| + "Please park in the red zone."; |
| private static final Path ZONE1 = new Path("/tmp/BLUEZONE"); |
| private static final Path ZONE2 = new Path("/tmp/REDZONE"); |
| private static final Path ZONE3 = new Path("/tmp/LOADINGZONE"); |
| private static final Path ZONE4 = new Path("/tmp/UNLOADINGZONE"); |
| private static final Path FILE1 = new Path(ZONE1, "file1"); |
| private static final Path FILE1A = new Path(ZONE1, "file1a"); |
| private static final Path FILE2 = new Path(ZONE2, "file2"); |
| private static final Path FILE3 = new Path(ZONE3, "file3"); |
| private static final Path FILE4 = new Path(ZONE4, "file4"); |
| private static final String KEY1 = "key1"; |
| private static final String KEY2 = "key2"; |
| private static final String KEY3 = "key3"; |
| private static UserGroupInformation realUgi; |
| private static String realUser; |
| |
| private MiniKMS miniKMS; |
| private File kmsDir; |
| private MiniDFSCluster cluster; |
| private DistributedFileSystem fs; |
| |
| @BeforeClass |
| public static void captureUser() throws IOException { |
| realUgi = UserGroupInformation.getCurrentUser(); |
| realUser = System.getProperty("user.name"); |
| } |
| |
| /** |
| * Extract the URI for the miniKMS. |
| * |
| * @return the URI for the miniKMS |
| */ |
| private String getKeyProviderURI() { |
| return KMSClientProvider.SCHEME_NAME + "://" + |
| miniKMS.getKMSUrl().toExternalForm().replace("://", "@"); |
| } |
| |
| /** |
| * Write out the config files needed by the miniKMS. The miniKMS doesn't |
| * provide a way to set the configs directly, so the only way to pass config |
| * parameters is to write them out into config files. |
| * |
| * @param confDir the directory into which to write the configs |
| * @param conf the config to write. |
| * @throws IOException |
| */ |
| private void writeConf(File confDir, Configuration conf) |
| throws IOException { |
| URI keystore = new Path(kmsDir.getAbsolutePath(), "kms.keystore").toUri(); |
| |
| conf.set(KMSConfiguration.KEY_PROVIDER_URI, "jceks://file@" + keystore); |
| conf.set("hadoop.kms.authentication.type", "simple"); |
| |
| Writer writer = |
| new FileWriter(new File(confDir, KMSConfiguration.KMS_SITE_XML)); |
| conf.writeXml(writer); |
| writer.close(); |
| |
| writer = new FileWriter(new File(confDir, KMSConfiguration.KMS_ACLS_XML)); |
| conf.writeXml(writer); |
| writer.close(); |
| |
| //create empty core-site.xml |
| writer = new FileWriter(new File(confDir, "core-site.xml")); |
| new Configuration(false).writeXml(writer); |
| writer.close(); |
| } |
| |
| /** |
| * Setup a fresh miniKMS and miniDFS. |
| * |
| * @param conf the configuration to use for both the miniKMS and miniDFS |
| * @throws Exception thrown if setup fails |
| */ |
| private void setup(Configuration conf) throws Exception { |
| setup(conf, true, true); |
| } |
| |
| /** |
| * Setup a fresh miniDFS and a miniKMS. The resetKms parameter controls |
| * whether the miniKMS will start fresh or reuse the existing data. |
| * |
| * @param conf the configuration to use for both the miniKMS and miniDFS |
| * @param resetKms whether to start a fresh miniKMS |
| * @throws Exception thrown if setup fails |
| */ |
| private void setup(Configuration conf, boolean resetKms) throws Exception { |
| setup(conf, resetKms, true); |
| } |
| |
| /** |
| * Setup a miniDFS and miniKMS. The resetKms and resetDfs parameters control |
| * whether the services will start fresh or reuse the existing data. |
| * |
| * @param conf the configuration to use for both the miniKMS and miniDFS |
| * @param resetKms whether to start a fresh miniKMS |
| * @param resetDfs whether to start a fresh miniDFS |
| * @throws Exception thrown if setup fails |
| */ |
| private void setup(Configuration conf, boolean resetKms, boolean resetDfs) |
| throws Exception { |
| if (resetKms) { |
| FileSystemTestHelper fsHelper = new FileSystemTestHelper(); |
| |
| kmsDir = new File(fsHelper.getTestRootDir()).getAbsoluteFile(); |
| |
| Assert.assertTrue(kmsDir.mkdirs()); |
| } |
| |
| writeConf(kmsDir, conf); |
| |
| MiniKMS.Builder miniKMSBuilder = new MiniKMS.Builder(); |
| |
| miniKMS = miniKMSBuilder.setKmsConfDir(kmsDir).build(); |
| miniKMS.start(); |
| |
| conf = new HdfsConfiguration(); |
| |
| // Set up java key store |
| conf.set(ProxyUsers.CONF_HADOOP_PROXYUSER + "." + realUser + ".users", |
| "keyadmin,hdfs,user"); |
| conf.set(ProxyUsers.CONF_HADOOP_PROXYUSER + "." + realUser + ".hosts", |
| "*"); |
| conf.set(CommonConfigurationKeysPublic.HADOOP_SECURITY_KEY_PROVIDER_PATH, |
| getKeyProviderURI()); |
| conf.setBoolean(DFSConfigKeys.DFS_NAMENODE_DELEGATION_TOKEN_ALWAYS_USE_KEY, |
| true); |
| |
| MiniDFSCluster.Builder clusterBuilder = new MiniDFSCluster.Builder(conf); |
| |
| cluster = clusterBuilder.numDataNodes(1).format(resetDfs).build(); |
| fs = cluster.getFileSystem(); |
| } |
| |
| /** |
| * Stop the miniKMS and miniDFS. |
| */ |
| private void teardown() { |
| // Restore login user |
| UserGroupInformation.setLoginUser(realUgi); |
| |
| if (cluster != null) { |
| cluster.shutdown(); |
| } |
| |
| miniKMS.stop(); |
| } |
| |
| /** |
| * Return a new {@link Configuration} with KMS ACLs appropriate to pass the |
| * full ACL test in {@link #doFullAclTest()} set. |
| * |
| * @param hdfsUgi the hdfs user |
| * @param keyadminUgi the keyadmin user |
| * @return the configuration |
| */ |
| private static Configuration getBaseConf(UserGroupInformation hdfsUgi, |
| UserGroupInformation keyadminUgi) { |
| Configuration conf = new Configuration(); |
| |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE", |
| keyadminUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DELETE", |
| keyadminUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.ROLLOVER", |
| keyadminUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET", " "); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_KEYS", |
| keyadminUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA", |
| hdfsUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.SET_KEY_MATERIAL", " "); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| hdfsUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", "*"); |
| |
| return conf; |
| } |
| |
| /** |
| * Set the recommended blacklists. |
| * |
| * @param hdfsUgi the hdfs user |
| */ |
| private static void setBlacklistAcls(Configuration conf, |
| UserGroupInformation hdfsUgi) { |
| |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.CREATE", |
| hdfsUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.DELETE", |
| hdfsUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.ROLLOVER", |
| hdfsUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.GET", "*"); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.SET_KEY_MATERIAL", |
| "*"); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.DECRYPT_EEK", |
| hdfsUgi.getUserName()); |
| } |
| |
| /** |
| * Set the key ACLs appropriate to pass the full ACL test in |
| * {@link #doFullAclTest()} using the specified prefix. The prefix should |
| * either be "whitelist.key.acl." or "key.acl.key1.". |
| * |
| * @param conf the configuration |
| * @param prefix the ACL prefix |
| * @param hdfsUgi the hdfs user |
| * @param keyadminUgi the keyadmin user |
| * @param userUgi the normal user |
| */ |
| private static void setKeyAcls(Configuration conf, String prefix, |
| UserGroupInformation hdfsUgi, |
| UserGroupInformation keyadminUgi, |
| UserGroupInformation userUgi) { |
| |
| conf.set(prefix + "MANAGEMENT", keyadminUgi.getUserName()); |
| conf.set(prefix + "READ", hdfsUgi.getUserName()); |
| conf.set(prefix + "GENERATE_EEK", hdfsUgi.getUserName()); |
| conf.set(KeyAuthorizationKeyProvider.KEY_ACL + KEY1 + ".DECRYPT_EEK", |
| userUgi.getUserName()); |
| } |
| |
| /** |
| * Test the full life cycle of a key using a config with whitelist key ACLs. |
| * The configuration used is the correct configuration to pass the full ACL |
| * test in {@link #doFullAclTest()}. |
| * |
| * @throws Exception thrown on test failure |
| */ |
| @Test |
| public void testGoodWithWhitelist() throws Exception { |
| UserGroupInformation hdfsUgi = |
| UserGroupInformation.createProxyUserForTesting("hdfs", |
| realUgi, new String[] {"supergroup"}); |
| UserGroupInformation keyadminUgi = |
| UserGroupInformation.createProxyUserForTesting("keyadmin", |
| realUgi, new String[] {"keyadmin"}); |
| UserGroupInformation userUgi = |
| UserGroupInformation.createProxyUserForTesting("user", |
| realUgi, new String[] {"staff"}); |
| |
| Configuration conf = getBaseConf(hdfsUgi, keyadminUgi); |
| |
| setBlacklistAcls(conf, hdfsUgi); |
| setKeyAcls(conf, KMSConfiguration.WHITELIST_KEY_ACL_PREFIX, |
| hdfsUgi, keyadminUgi, userUgi); |
| doFullAclTest(conf, hdfsUgi, keyadminUgi, userUgi); |
| } |
| |
| /** |
| * Test the full life cycle of a key using a config with key ACLs. |
| * The configuration used is the correct configuration to pass the full ACL |
| * test in {@link #doFullAclTest()}. |
| * |
| * @throws Exception thrown on test failure |
| */ |
| @Test |
| public void testGoodWithKeyAcls() throws Exception { |
| UserGroupInformation hdfsUgi = |
| UserGroupInformation.createProxyUserForTesting("hdfs", |
| realUgi, new String[] {"supergroup"}); |
| UserGroupInformation keyadminUgi = |
| UserGroupInformation.createProxyUserForTesting("keyadmin", |
| realUgi, new String[] {"keyadmin"}); |
| UserGroupInformation userUgi = |
| UserGroupInformation.createProxyUserForTesting("user", |
| realUgi, new String[] {"staff"}); |
| Configuration conf = getBaseConf(hdfsUgi, keyadminUgi); |
| |
| setBlacklistAcls(conf, hdfsUgi); |
| setKeyAcls(conf, KeyAuthorizationKeyProvider.KEY_ACL + KEY1 + ".", |
| hdfsUgi, keyadminUgi, userUgi); |
| doFullAclTest(conf, hdfsUgi, keyadminUgi, userUgi); |
| } |
| |
| /** |
| * Test the full life cycle of a key using a config with whitelist key ACLs |
| * and without blacklist ACLs. The configuration used is the correct |
| * configuration to pass the full ACL test in {@link #doFullAclTest()}. |
| * |
| * @throws Exception thrown on test failure |
| */ |
| @Test |
| public void testGoodWithWhitelistWithoutBlacklist() throws Exception { |
| UserGroupInformation hdfsUgi = |
| UserGroupInformation.createProxyUserForTesting("hdfs", |
| realUgi, new String[] {"supergroup"}); |
| UserGroupInformation keyadminUgi = |
| UserGroupInformation.createProxyUserForTesting("keyadmin", |
| realUgi, new String[] {"keyadmin"}); |
| UserGroupInformation userUgi = |
| UserGroupInformation.createProxyUserForTesting("user", |
| realUgi, new String[] {"staff"}); |
| Configuration conf = getBaseConf(hdfsUgi, keyadminUgi); |
| |
| setKeyAcls(conf, KMSConfiguration.WHITELIST_KEY_ACL_PREFIX, |
| hdfsUgi, keyadminUgi, userUgi); |
| doFullAclTest(conf, hdfsUgi, keyadminUgi, userUgi); |
| } |
| |
| /** |
| * Test the full life cycle of a key using a config with whitelist key ACLs |
| * and without blacklist ACLs. The configuration used is the correct |
| * configuration to pass the full ACL test in {@link #doFullAclTest()}. |
| * |
| * @throws Exception thrown on test failure |
| */ |
| @Test |
| public void testGoodWithKeyAclsWithoutBlacklist() throws Exception { |
| UserGroupInformation hdfsUgi = |
| UserGroupInformation.createProxyUserForTesting("hdfs", |
| realUgi, new String[] {"supergroup"}); |
| UserGroupInformation keyadminUgi = |
| UserGroupInformation.createProxyUserForTesting("keyadmin", |
| realUgi, new String[] {"keyadmin"}); |
| UserGroupInformation userUgi = |
| UserGroupInformation.createProxyUserForTesting("user", |
| realUgi, new String[] {"staff"}); |
| Configuration conf = getBaseConf(hdfsUgi, keyadminUgi); |
| |
| setKeyAcls(conf, KeyAuthorizationKeyProvider.KEY_ACL + KEY1 + ".", |
| hdfsUgi, keyadminUgi, userUgi); |
| doFullAclTest(conf, hdfsUgi, keyadminUgi, userUgi); |
| } |
| |
| /** |
| * Run a full key life cycle test using the provided configuration and users. |
| * |
| * @param conf the configuration |
| * @param hdfs the user to use as the hdfs user |
| * @param keyadmin the user to use as the keyadmin user |
| * @param user the user to use as the normal user |
| * @throws Exception thrown if there is a test failure |
| */ |
| private void doFullAclTest(final Configuration conf, |
| final UserGroupInformation hdfsUgi, |
| final UserGroupInformation keyadminUgi, |
| final UserGroupInformation userUgi) throws Exception { |
| |
| try { |
| setup(conf); |
| |
| // Create a test key |
| assertTrue("Exception during creation of key " + KEY1 + " by " |
| + keyadminUgi.getUserName(), createKey(keyadminUgi, KEY1, conf)); |
| |
| // Fail to create a test key |
| assertFalse("Allowed creation of key " + KEY2 + " by " |
| + hdfsUgi.getUserName(), createKey(hdfsUgi, KEY2, conf)); |
| assertFalse("Allowed creation of key " + KEY2 + " by " |
| + userUgi.getUserName(), createKey(userUgi, KEY2, conf)); |
| |
| // Create a directory and chown it to the normal user. |
| fs.mkdirs(ZONE1); |
| fs.setOwner(ZONE1, userUgi.getUserName(), |
| userUgi.getPrimaryGroupName()); |
| |
| // Create an EZ |
| assertTrue("Exception during creation of EZ " + ZONE1 + " by " |
| + hdfsUgi.getUserName() + " using key " + KEY1, |
| createEncryptionZone(hdfsUgi, KEY1, ZONE1)); |
| |
| // Fail to create an EZ |
| assertFalse("Allowed creation of EZ " + ZONE2 + " by " |
| + keyadminUgi.getUserName() + " using key " + KEY1, |
| createEncryptionZone(keyadminUgi, KEY1, ZONE2)); |
| assertFalse("Allowed creation of EZ " + ZONE2 + " by " |
| + userUgi.getUserName() + " using key " + KEY1, |
| createEncryptionZone(userUgi, KEY1, ZONE2)); |
| |
| // Create a file in the zone |
| assertTrue("Exception during creation of file " + FILE1 + " by " |
| + userUgi.getUserName(), createFile(userUgi, FILE1, TEXT)); |
| |
| // Fail to create a file in the zone |
| assertFalse("Allowed creation of file " + FILE1A + " by " |
| + hdfsUgi.getUserName(), createFile(hdfsUgi, FILE1A, TEXT)); |
| assertFalse("Allowed creation of file " + FILE1A + " by " |
| + keyadminUgi.getUserName(), createFile(keyadminUgi, FILE1A, TEXT)); |
| |
| // Read a file in the zone |
| assertTrue("Exception while reading file " + FILE1 + " by " |
| + userUgi.getUserName(), compareFile(userUgi, FILE1, TEXT)); |
| |
| // Fail to read a file in the zone |
| assertFalse("Allowed reading of file " + FILE1 + " by " |
| + hdfsUgi.getUserName(), compareFile(hdfsUgi, FILE1, TEXT)); |
| assertFalse("Allowed reading of file " + FILE1 + " by " |
| + keyadminUgi.getUserName(), compareFile(keyadminUgi, FILE1, TEXT)); |
| |
| // Remove the zone |
| fs.delete(ZONE1, true); |
| |
| // Fail to remove the key |
| assertFalse("Allowed deletion of file " + FILE1 + " by " |
| + hdfsUgi.getUserName(), deleteKey(hdfsUgi, KEY1)); |
| assertFalse("Allowed deletion of file " + FILE1 + " by " |
| + userUgi.getUserName(), deleteKey(userUgi, KEY1)); |
| |
| // Remove |
| assertTrue("Exception during deletion of file " + FILE1 + " by " |
| + keyadminUgi.getUserName(), deleteKey(keyadminUgi, KEY1)); |
| } finally { |
| fs.delete(ZONE1, true); |
| fs.delete(ZONE2, true); |
| teardown(); |
| } |
| } |
| |
| /** |
| * Test that key creation is correctly governed by ACLs. |
| * @throws Exception thrown if setup fails |
| */ |
| @Test |
| public void testCreateKey() throws Exception { |
| Configuration conf = new Configuration(); |
| |
| // Correct config with whitelist ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf); |
| |
| assertTrue("Exception during key creation with correct config" |
| + " using whitelist key ACLs", createKey(realUgi, KEY1, conf)); |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Correct config with default ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf); |
| |
| assertTrue("Exception during key creation with correct config" |
| + " using default key ACLs", createKey(realUgi, KEY2, conf)); |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Denied because of blacklist |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.CREATE", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf); |
| |
| assertFalse("Allowed key creation with blacklist for CREATE", |
| createKey(realUgi, KEY3, conf)); |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Missing KMS ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE", " "); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf); |
| |
| assertFalse("Allowed key creation without CREATE KMS ACL", |
| createKey(realUgi, KEY3, conf)); |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Missing key ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf); |
| |
| assertFalse("Allowed key creation without MANAGMENT key ACL", |
| createKey(realUgi, KEY3, conf)); |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Denied because the key ACL set ignores the default ACL set for key3 |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| conf.set(KeyAuthorizationKeyProvider.KEY_ACL + KEY3 + ".DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf); |
| |
| assertFalse("Allowed key creation when default key ACL should have been" |
| + " overridden by key ACL", createKey(realUgi, KEY3, conf)); |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Allowed because the default setting for KMS ACLs is fully permissive |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf); |
| |
| assertTrue("Exception during key creation with default KMS ACLs", |
| createKey(realUgi, KEY3, conf)); |
| } finally { |
| teardown(); |
| } |
| } |
| |
| /** |
| * Test that zone creation is correctly governed by ACLs. |
| * @throws Exception thrown if setup fails |
| */ |
| @Test |
| public void testCreateEncryptionZone() throws Exception { |
| Configuration conf = new Configuration(); |
| |
| // Create a test key |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf); |
| |
| assertTrue("Exception during key creation", |
| createKey(realUgi, KEY1, conf)); |
| } finally { |
| teardown(); |
| } |
| |
| // We tear everything down and then restart it with the ACLs we want to |
| // test so that there's no contamination from the ACLs needed for setup. |
| // To make that work, we have to tell the setup() method not to create a |
| // new KMS directory. |
| conf = new Configuration(); |
| |
| // Correct config with whitelist ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| fs.mkdirs(ZONE1); |
| |
| assertTrue("Exception during zone creation with correct config using" |
| + " whitelist key ACLs", createEncryptionZone(realUgi, KEY1, ZONE1)); |
| } finally { |
| fs.delete(ZONE1, true); |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Correct config with default ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "READ", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| fs.mkdirs(ZONE2); |
| |
| assertTrue("Exception during zone creation with correct config using" |
| + " default key ACLs", createEncryptionZone(realUgi, KEY1, ZONE2)); |
| } finally { |
| fs.delete(ZONE2, true); |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Denied because the key ACL set ignores the default ACL set for key1 |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "READ", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KeyAuthorizationKeyProvider.KEY_ACL + KEY1 + ".DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| fs.mkdirs(ZONE3); |
| |
| assertFalse("Allowed creation of zone when default key ACLs should have" |
| + " been overridden by key ACL", |
| createEncryptionZone(realUgi, KEY1, ZONE3)); |
| } finally { |
| fs.delete(ZONE3, true); |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Correct config with blacklist |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.GET_METADATA", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| fs.mkdirs(ZONE3); |
| |
| assertFalse("Allowed zone creation of zone with blacklisted GET_METADATA", |
| createEncryptionZone(realUgi, KEY1, ZONE3)); |
| } finally { |
| fs.delete(ZONE3, true); |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Correct config with blacklist |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| fs.mkdirs(ZONE3); |
| |
| assertFalse("Allowed zone creation of zone with blacklisted GENERATE_EEK", |
| createEncryptionZone(realUgi, KEY1, ZONE3)); |
| } finally { |
| fs.delete(ZONE3, true); |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Missing KMS ACL but works because defaults for KMS ACLs are fully |
| // permissive |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| fs.mkdirs(ZONE3); |
| |
| assertTrue("Exception during zone creation with default KMS ACLs", |
| createEncryptionZone(realUgi, KEY1, ZONE3)); |
| } finally { |
| fs.delete(ZONE3, true); |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Missing GET_METADATA KMS ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA", " "); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| fs.mkdirs(ZONE4); |
| |
| assertFalse("Allowed zone creation without GET_METADATA KMS ACL", |
| createEncryptionZone(realUgi, KEY1, ZONE4)); |
| } finally { |
| fs.delete(ZONE4, true); |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Missing GET_METADATA KMS ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", " "); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| fs.mkdirs(ZONE4); |
| |
| assertFalse("Allowed zone creation without GENERATE_EEK KMS ACL", |
| createEncryptionZone(realUgi, KEY1, ZONE4)); |
| } finally { |
| fs.delete(ZONE4, true); |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Missing READ key ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| fs.mkdirs(ZONE4); |
| |
| assertFalse("Allowed zone creation without READ ACL", |
| createEncryptionZone(realUgi, KEY1, ZONE4)); |
| } finally { |
| fs.delete(ZONE4, true); |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Missing GENERATE_EEK key ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| fs.mkdirs(ZONE4); |
| |
| assertFalse("Allowed zone creation without GENERATE_EEK ACL", |
| createEncryptionZone(realUgi, KEY1, ZONE4)); |
| } finally { |
| fs.delete(ZONE4, true); |
| teardown(); |
| } |
| } |
| |
| /** |
| * Test that in-zone file creation is correctly governed by ACLs. |
| * @throws Exception thrown if setup fails |
| */ |
| @Test |
| public void testCreateFileInEncryptionZone() throws Exception { |
| Configuration conf = new Configuration(); |
| |
| // Create a test key |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| |
| assertTrue(new File(kmsDir, "kms.keystore").length() == 0); |
| |
| try { |
| setup(conf); |
| |
| assertTrue("Exception during key creation", |
| createKey(realUgi, KEY1, conf)); |
| fs.mkdirs(ZONE1); |
| assertTrue("Exception during zone creation", |
| createEncryptionZone(realUgi, KEY1, ZONE1)); |
| fs.mkdirs(ZONE2); |
| assertTrue("Exception during zone creation", |
| createEncryptionZone(realUgi, KEY1, ZONE2)); |
| fs.mkdirs(ZONE3); |
| assertTrue("Exception during zone creation", |
| createEncryptionZone(realUgi, KEY1, ZONE3)); |
| fs.mkdirs(ZONE4); |
| assertTrue("Exception during zone creation", |
| createEncryptionZone(realUgi, KEY1, ZONE4)); |
| } catch (Throwable ex) { |
| fs.delete(ZONE1, true); |
| fs.delete(ZONE2, true); |
| fs.delete(ZONE3, true); |
| fs.delete(ZONE4, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| |
| // We tear everything down and then restart it with the ACLs we want to |
| // test so that there's no contamination from the ACLs needed for setup. |
| // To make that work, we have to tell the setup() method not to create a |
| // new KMS directory or DFS dierctory. |
| |
| conf = new Configuration(); |
| |
| // Correct config with whitelist ACLs |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertTrue("Exception during file creation with correct config" |
| + " using whitelist ACL", createFile(realUgi, FILE1, TEXT)); |
| } finally { |
| fs.delete(ZONE1, true); |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Correct config with default ACLs |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertTrue("Exception during file creation with correct config" |
| + " using whitelist ACL", createFile(realUgi, FILE2, TEXT)); |
| } finally { |
| fs.delete(ZONE2, true); |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Denied because the key ACL set ignores the default ACL set for key1 |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KeyAuthorizationKeyProvider.KEY_ACL + KEY1 + ".READ", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertFalse("Allowed file creation when default key ACLs should have been" |
| + " overridden by key ACL", createFile(realUgi, FILE3, TEXT)); |
| } catch (Exception ex) { |
| fs.delete(ZONE3, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Denied by blacklist |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertFalse("Allowed file creation with blacklist for GENERATE_EEK", |
| createFile(realUgi, FILE3, TEXT)); |
| } catch (Exception ex) { |
| fs.delete(ZONE3, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Denied by blacklist |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertFalse("Allowed file creation with blacklist for DECRYPT_EEK", |
| createFile(realUgi, FILE3, TEXT)); |
| } catch (Exception ex) { |
| fs.delete(ZONE3, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Allowed because default KMS ACLs are fully permissive |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertTrue("Exception during file creation with default KMS ACLs", |
| createFile(realUgi, FILE3, TEXT)); |
| } catch (Exception ex) { |
| fs.delete(ZONE3, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Denied because of missing GENERATE_EEK KMS ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", " "); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertFalse("Allowed file creation without GENERATE_EEK KMS ACL", |
| createFile(realUgi, FILE4, TEXT)); |
| } catch (Exception ex) { |
| fs.delete(ZONE3, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Denied because of missing DECRYPT_EEK KMS ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", " "); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertFalse("Allowed file creation without DECRYPT_EEK KMS ACL", |
| createFile(realUgi, FILE3, TEXT)); |
| } catch (Exception ex) { |
| fs.delete(ZONE3, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Denied because of missing GENERATE_EEK key ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertFalse("Allowed file creation without GENERATE_EEK key ACL", |
| createFile(realUgi, FILE3, TEXT)); |
| } catch (Exception ex) { |
| fs.delete(ZONE3, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Denied because of missing DECRYPT_EEK key ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertFalse("Allowed file creation without DECRYPT_EEK key ACL", |
| createFile(realUgi, FILE3, TEXT)); |
| } catch (Exception ex) { |
| fs.delete(ZONE3, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| } |
| |
| /** |
| * Test that in-zone file read is correctly governed by ACLs. |
| * @throws Exception thrown if setup fails |
| */ |
| @Test |
| public void testReadFileInEncryptionZone() throws Exception { |
| Configuration conf = new Configuration(); |
| |
| // Create a test key |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| assertTrue(new File(kmsDir, "kms.keystore").length() == 0); |
| |
| try { |
| setup(conf); |
| |
| assertTrue("Exception during key creation", |
| createKey(realUgi, KEY1, conf)); |
| fs.mkdirs(ZONE1); |
| assertTrue("Exception during zone creation", |
| createEncryptionZone(realUgi, KEY1, ZONE1)); |
| assertTrue("Exception during file creation", |
| createFile(realUgi, FILE1, TEXT)); |
| } catch (Throwable ex) { |
| fs.delete(ZONE1, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| |
| // We tear everything down and then restart it with the ACLs we want to |
| // test so that there's no contamination from the ACLs needed for setup. |
| // To make that work, we have to tell the setup() method not to create a |
| // new KMS directory or DFS dierctory. |
| |
| conf = new Configuration(); |
| |
| // Correct config with whitelist ACLs |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertTrue("Exception while reading file with correct config with" |
| + " whitelist ACLs", compareFile(realUgi, FILE1, TEXT)); |
| } catch (Throwable ex) { |
| fs.delete(ZONE1, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Correct config with default ACLs |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertTrue("Exception while reading file with correct config" |
| + " with default ACLs", compareFile(realUgi, FILE1, TEXT)); |
| } catch (Throwable ex) { |
| fs.delete(ZONE1, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Denied because the key ACL set ignores the default ACL set for key1 |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KeyAuthorizationKeyProvider.KEY_ACL + KEY1 + ".READ", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertFalse("Allowed file read when default key ACLs should have been" |
| + " overridden by key ACL", compareFile(realUgi, FILE1, TEXT)); |
| } catch (Throwable ex) { |
| fs.delete(ZONE1, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Denied by blacklist |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.DECRYPT_EEK", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertFalse("Allowed file read with blacklist for DECRYPT_EEK", |
| compareFile(realUgi, FILE1, TEXT)); |
| } catch (Throwable ex) { |
| fs.delete(ZONE1, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Allowed because default KMS ACLs are fully permissive |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertTrue("Exception while reading file with default KMS ACLs", |
| compareFile(realUgi, FILE1, TEXT)); |
| } catch (Throwable ex) { |
| fs.delete(ZONE1, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Denied because of missing DECRYPT_EEK KMS ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", " "); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertFalse("Allowed file read without DECRYPT_EEK KMS ACL", |
| compareFile(realUgi, FILE1, TEXT)); |
| } catch (Throwable ex) { |
| fs.delete(ZONE1, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| |
| // Denied because of missing DECRYPT_EEK key ACL |
| conf = new Configuration(); |
| |
| try { |
| setup(conf, false, false); |
| |
| assertFalse("Allowed file read without DECRYPT_EEK key ACL", |
| compareFile(realUgi, FILE1, TEXT)); |
| } catch (Throwable ex) { |
| fs.delete(ZONE1, true); |
| |
| throw ex; |
| } finally { |
| teardown(); |
| } |
| } |
| |
| /** |
| * Test that key deletion is correctly governed by ACLs. |
| * @throws Exception thrown if setup fails |
| */ |
| @Test |
| public void testDeleteKey() throws Exception { |
| Configuration conf = new Configuration(); |
| |
| // Create a test key |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf); |
| |
| assertTrue("Exception during key creation", |
| createKey(realUgi, KEY1, conf)); |
| assertTrue("Exception during key creation", |
| createKey(realUgi, KEY2, conf)); |
| assertTrue("Exception during key creation", |
| createKey(realUgi, KEY3, conf)); |
| } finally { |
| teardown(); |
| } |
| |
| // We tear everything down and then restart it with the ACLs we want to |
| // test so that there's no contamination from the ACLs needed for setup. |
| // To make that work, we have to tell the setup() method not to create a |
| // new KMS directory. |
| |
| conf = new Configuration(); |
| |
| // Correct config with whitelist ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DELETE", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| assertTrue("Exception during key deletion with correct config" |
| + " using whitelist key ACLs", deleteKey(realUgi, KEY1)); |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Correct config with default ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DELETE", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| assertTrue("Exception during key deletion with correct config" |
| + " using default key ACLs", deleteKey(realUgi, KEY2)); |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Denied because of blacklist |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DELETE", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.DELETE", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| assertFalse("Allowed key deletion with blacklist for DELETE", |
| deleteKey(realUgi, KEY3)); |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Missing KMS ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DELETE", " "); |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| assertFalse("Allowed key deletion without DELETE KMS ACL", |
| deleteKey(realUgi, KEY3)); |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| |
| // Missing key ACL |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DELETE", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| assertFalse("Allowed key deletion without MANAGMENT key ACL", |
| deleteKey(realUgi, KEY3)); |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Denied because the key ACL set ignores the default ACL set for key3 |
| conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DELETE", |
| realUgi.getUserName()); |
| conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| conf.set(KeyAuthorizationKeyProvider.KEY_ACL + KEY3 + ".DECRYPT_EEK", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| assertFalse("Allowed key deletion when default key ACL should have been" |
| + " overridden by key ACL", deleteKey(realUgi, KEY3)); |
| } finally { |
| teardown(); |
| } |
| |
| conf = new Configuration(); |
| |
| // Allowed because the default setting for KMS ACLs is fully permissive |
| conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", |
| realUgi.getUserName()); |
| |
| try { |
| setup(conf, false); |
| |
| assertTrue("Exception during key deletion with default KMS ACLs", |
| deleteKey(realUgi, KEY3)); |
| } finally { |
| teardown(); |
| } |
| } |
| |
| /** |
| * Create a key as the specified user. |
| * |
| * @param ugi the target user |
| * @param key the target key |
| * @param conf the configuration |
| * @return whether the key creation succeeded |
| */ |
| private boolean createKey(UserGroupInformation ugi, final String key, |
| final Configuration conf) { |
| |
| return doUserOp(ugi, new UserOp() { |
| @Override |
| public void execute() throws IOException { |
| try { |
| DFSTestUtil.createKey(key, cluster, conf); |
| } catch (NoSuchAlgorithmException ex) { |
| throw new IOException(ex); |
| } |
| } |
| }); |
| } |
| |
| /** |
| * Create a zone as the specified user. |
| * |
| * @param ugi the target user |
| * @param key the target key |
| * @param zone the target zone |
| * @return whether the zone creation succeeded |
| */ |
| private boolean createEncryptionZone(UserGroupInformation ugi, |
| final String key, final Path zone) { |
| |
| return doUserOp(ugi, new UserOp() { |
| @Override |
| public void execute() throws IOException { |
| cluster.getFileSystem().createEncryptionZone(zone, key); |
| } |
| }); |
| } |
| |
| /** |
| * Create a file as the specified user. |
| * |
| * @param ugi the target user |
| * @param file the target file |
| * @param text the target file contents |
| * @return whether the file creation succeeded |
| */ |
| private boolean createFile(UserGroupInformation ugi, |
| final Path file, final String text) { |
| |
| return doUserOp(ugi, new UserOp() { |
| @Override |
| public void execute() throws IOException { |
| FSDataOutputStream dout = cluster.getFileSystem().create(file); |
| PrintWriter out = new PrintWriter(new OutputStreamWriter(dout)); |
| |
| out.println(text); |
| out.close(); |
| } |
| }); |
| } |
| |
| /** |
| * Read a file as the specified user and compare the contents to expectations. |
| * |
| * @param ugi the target user |
| * @param file the target file |
| * @param text the expected file contents |
| * @return true if the file read succeeded and the contents were as expected |
| */ |
| private boolean compareFile(UserGroupInformation ugi, |
| final Path file, final String text) { |
| |
| return doUserOp(ugi, new UserOp() { |
| @Override |
| public void execute() throws IOException { |
| FSDataInputStream din = cluster.getFileSystem().open(file); |
| BufferedReader in = new BufferedReader(new InputStreamReader(din)); |
| |
| assertEquals("The text read does not match the text written", |
| text, in.readLine()); |
| } |
| }); |
| } |
| |
| /** |
| * Delete a key as the specified user. |
| * |
| * @param ugi the target user |
| * @param key the target key |
| * @return whether the key deletion succeeded |
| */ |
| private boolean deleteKey(UserGroupInformation ugi, final String key) |
| throws IOException, InterruptedException { |
| |
| return doUserOp(ugi, new UserOp() { |
| @Override |
| public void execute() throws IOException { |
| cluster.getNameNode().getNamesystem().getProvider().deleteKey(key); |
| } |
| }); |
| } |
| |
| /** |
| * Perform an operation as the given user. This method requires setting the |
| * login user. This method does not restore the login user to the setting |
| * from prior to the method call. |
| * |
| * @param ugi the target user |
| * @param op the operation to perform |
| * @return true if the operation succeeded without throwing an exception |
| */ |
| private boolean doUserOp(UserGroupInformation ugi, final UserOp op) { |
| UserGroupInformation.setLoginUser(ugi); |
| |
| // Create a test key |
| return ugi.doAs(new PrivilegedAction<Boolean>() { |
| @Override |
| public Boolean run() { |
| try { |
| op.execute(); |
| |
| return true; |
| } catch (IOException ex) { |
| LOG.error("IOException thrown during doAs() operation", ex); |
| |
| return false; |
| } |
| } |
| }); |
| } |
| |
| /** |
| * Simple interface that defines an operation to perform. |
| */ |
| private static interface UserOp { |
| public void execute() throws IOException; |
| } |
| } |
