IMPALA-9010: Add builtin mask functions

There're 6 builtin GenericUDFs for column masking in Hive:
  mask_show_first_n(value, charCount, upperChar, lowerChar, digitChar,
      otherChar, numberChar)
  mask_show_last_n(value, charCount, upperChar, lowerChar, digitChar,
      otherChar, numberChar)
  mask_first_n(value, charCount, upperChar, lowerChar, digitChar,
      otherChar, numberChar)
  mask_last_n(value, charCount, upperChar, lowerChar, digitChar,
      otherChar, numberChar)
  mask(value, upperChar, lowerChar, digitChar, otherChar, numberChar,
      dayValue, monthValue, yearValue)

Description of the parameters:
   value      - value to mask. Supported types: TINYINT, SMALLINT, INT,
                BIGINT, STRING, VARCHAR, CHAR, DATE(only for mask()).
   charCount  - number of characters. Default value: 4
   upperChar  - character to replace upper-case characters with. Specify
                -1 to retain original character. Default value: 'X'
   lowerChar  - character to replace lower-case characters with. Specify
                -1 to retain original character. Default value: 'x'
   digitChar  - character to replace digit characters with. Specify -1
                to retain original character. Default value: 'n'
   otherChar  - character to replace all other characters with. Specify
                -1 to retain original character. Default value: -1
   numberChar - character to replace digits in a number with. Valid
                values: 0-9. Default value: '1'
   dayValue   - value to replace day field in a date with.
                Specify -1 to retain original value. Valid values: 1-31.
                Default value: 1
   monthValue - value to replace month field in a date with. Specify -1
                to retain original value. Valid values: 0-11. Default
                value: 0
   yearValue  - value to replace year field in a date with. Specify -1
                to retain original value. Default value: 1

In Hive, these functions accept variable length of arguments in
non-restricted types:
   mask_show_first_n(val, 8)
   mask_show_first_n(val, 8, 'X', 'x', 'n')
   mask_show_first_n(val, 8, 'x', 'x', 'x', 'x', 2)
   mask_show_first_n(val, 8, 'x', -1, 'x', 'x', '9')
The arguments of upperChar, lowerChar, digitChar, otherChar and
numberChar can be in string or numeric types.

Impala doesn't support Hive GenericUDFs, so we are lack of these mask
functions to support Ranger column masking policies. On the other hand,
we want the masking functions to be evaluated in the C++ builtin logic
rather than calling out to java UDFs for performance. This patch
introduces our builtin implementation of them.

We currently don't have a corresponding framework for GenericUDF
(IMPALA-9271), so we implement these by overloads. However, it may
requires hundreds of overloads to cover all possible combinations. We
just implement some important overloads, including
 - those used by Ranger default masking policies,
 - those with simple arguments and may be useful for users,
 - an overload with all arguments in int type for full functionality.
   Char argument need to be converted to their ASCII value.

 - Add BE tests in expr-test

Change-Id: Ica779a1bf63a085d51f3b533f654cbaac102a664
Reviewed-by: Quanlong Huang <>
Tested-by: Impala Public Jenkins <>
7 files changed
tree: 80a99e667c74ca84bfe5a190ce14c1909eb90a74
  1. .clang-format
  2. .clang-tidy
  3. .gitattributes
  4. .gitignore
  5. CMakeLists.txt
  7. LICENSE.txt
  9. NOTICE.txt
  11. be/
  12. bin/
  14. cmake_modules/
  15. common/
  16. docker/
  17. docs/
  18. ext-data-source/
  19. fe/
  20. impala-parent/
  21. infra/
  22. lib/
  23. query-event-hook-api/
  24. security/
  25. setup.cfg
  26. shaded-deps/
  27. shell/
  28. ssh_keys/
  29. testdata/
  30. tests/
  31. www/

Welcome to Impala

Lightning-fast, distributed SQL queries for petabytes of data stored in Apache Hadoop clusters.

Impala is a modern, massively-distributed, massively-parallel, C++ query engine that lets you analyze, transform and combine data from a variety of data sources:

  • Best of breed performance and scalability.
  • Support for data stored in HDFS, Apache HBase and Amazon S3.
  • Wide analytic SQL support, including window functions and subqueries.
  • On-the-fly code generation using LLVM to generate CPU-efficient code tailored specifically to each individual query.
  • Support for the most commonly-used Hadoop file formats, including the Apache Parquet project.
  • Apache-licensed, 100% open source.

More about Impala

To learn more about Impala as a business user, or to try Impala live or in a VM, please visit the Impala homepage.

If you are interested in contributing to Impala as a developer, or learning more about Impala's internals and architecture, visit the Impala wiki.

Supported Platforms

Impala only supports Linux at the moment.

Export Control Notice

This distribution uses cryptographic software and may be subject to export controls. Please refer to for more information.

Build Instructions

See bin/

Detailed Build Notes

Impala can be built with pre-built components or components downloaded from S3. The components needed to build Impala are Apache Hadoop, Hive, HBase, and Sentry. If you need to manually override the locations or versions of these components, you can do so through the environment variables and scripts listed below.

Scripts and directories
bin/impala-config.shThis script must be sourced to setup all environment variables properly to allow other scripts to work
bin/impala-config-local.shA script can be created in this location to set local overrides for any environment variables
bin/impala-config-branch.shA version of the above that can be checked into a branch for convenience.
bin/bootstrap_build.shA helper script to bootstrap some of the build requirements.
bin/bootstrap_development.shA helper script to bootstrap a developer environment. Please read it before using.
be/build/Impala build output goes here.
be/generated-sources/Thrift and other generated source will be found here.
Build Related Variables
Environment variableDefault valueDescription
IMPALA_HOMETop level Impala directory
IMPALA_TOOLCHAIN“${IMPALA_HOME}/toolchain”Native toolchain directory (for compilers, libraries, etc.)
SKIP_TOOLCHAIN_BOOTSTRAP“false”Skips downloading the toolchain any python dependencies if “true”
CDH_BUILD_NUMBERIdentifier to indicate the CDH build number
CDH_COMPONENTS_HOME“${IMPALA_HOME}/toolchain/cdh_components-${CDH_BUILD_NUMBER}”Location of the CDH components within the toolchain.
CDH_MAJOR_VERSION“5”Identifier used to uniqueify paths for potentially incompatible component builds.
IMPALA_CONFIG_SOURCED“1”Set by ${IMPALA_HOME}/bin/ (internal use)
JAVA_HOME“/usr/lib/jvm/${JAVA_VERSION}”Used to locate Java
JAVA_VERSION“java-7-oracle-amd64”Can override to set a local Java version.
JAVA“${JAVA_HOME}/bin/java”Java binary location.
CLASSPATHSee bin/ for details.
PYTHONPATHWill be changed to include: “${IMPALA_HOME}/shell/gen-py” “${IMPALA_HOME}/testdata” “${THRIFT_HOME}/python/lib/python2.7/site-packages” “${HIVE_HOME}/lib/py” “${IMPALA_HOME}/shell/ext-py/prettytable-0.7.1/dist/prettytable-0.7.1” "${IMPALA_HOME}/shell/ext-py/sasl-0.1.1/dist/sasl-0.1.1-py2.7-linux-x "${IMPALA_HOME}/shell/ext-py/sqlparse-0.1.19/dist/sqlparse-0.1.19-py2
Source Directories for Impala
Environment variableDefault valueDescription
IMPALA_BE_DIR“${IMPALA_HOME}/be”Backend directory. Build output is also stored here.
IMPALA_FE_DIR“${IMPALA_HOME}/fe”Frontend directory
IMPALA_COMMON_DIR“${IMPALA_HOME}/common”Common code (thrift, function registry)
Various Compilation Settings
Environment variableDefault valueDescription
IMPALA_BUILD_THREADS“8” or set to number of processors by default.Used for make -j and distcc -j settings.
IMPALA_MAKE_FLAGS""Any extra settings to pass to make. Also used when copying udfs / udas into HDFS.
USE_SYSTEM_GCC“0”If set to any other value, directs cmake to not set GCC_ROOT, CMAKE_C_COMPILER, CMAKE_CXX_COMPILER, as well as setting TOOLCHAIN_LINK_FLAGS
IMPALA_CXX_COMPILER“default”Used by cmake (cmake_modules/toolchain and clang_toolchain.cmake) to select gcc / clang
USE_GOLD_LINKER“true”Directs backend cmake to use gold.
IS_OSX“false”(Experimental) currently only used to disable Kudu.
Environment variableDefault valueDescription
HADOOP_INCLUDE_DIR“${HADOOP_HOME}/include”For ‘hdfs.h’
HADOOP_LIB_DIR“${HADOOP_HOME}/lib”For ‘libhdfs.a’ or ‘’