You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by ae...@apache.org on 2015/11/05 00:38:24 UTC
[26/50] [abbrv] hadoop git commit: HDFS-9339. Extend full test of KMS
ACLs. Contributed by Daniel Templeton.
HDFS-9339. Extend full test of KMS ACLs. Contributed by Daniel Templeton.
Change-Id: I61eeee8fa5e85250eabc1eef3d8c11f32700d6fb
Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo
Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/78d68908
Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/78d68908
Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/78d68908
Branch: refs/heads/HDFS-7240
Commit: 78d6890865424db850faecfc5c76f14c64925063
Parents: 9e7dcab
Author: Zhe Zhang <zh...@apache.org>
Authored: Mon Nov 2 13:51:45 2015 -0800
Committer: Zhe Zhang <zh...@apache.org>
Committed: Mon Nov 2 13:51:45 2015 -0800
----------------------------------------------------------------------
hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt | 2 +
.../apache/hadoop/hdfs/TestAclsEndToEnd.java | 1042 +++++++++++++++++-
2 files changed, 1041 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hadoop/blob/78d68908/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
----------------------------------------------------------------------
diff --git a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
index a2e4824..fea4106 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
+++ b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
@@ -1613,6 +1613,8 @@ Release 2.8.0 - UNRELEASED
HDFS-9229. Expose size of NameNode directory as a metric.
(Surendra Singh Lilhore via zhz)
+ HDFS-9339. Extend full test of KMS ACLs. (Daniel Templeton via zhz)
+
OPTIMIZATIONS
HDFS-8026. Trace FSOutputSummer#writeChecksumChunks rather than
http://git-wip-us.apache.org/repos/asf/hadoop/blob/78d68908/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/TestAclsEndToEnd.java
----------------------------------------------------------------------
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/TestAclsEndToEnd.java b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/TestAclsEndToEnd.java
index de0646a..2b515d0 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/TestAclsEndToEnd.java
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/TestAclsEndToEnd.java
@@ -233,15 +233,15 @@ public class TestAclsEndToEnd {
keyadminUgi.getUserName());
conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.ROLLOVER",
keyadminUgi.getUserName());
- conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET", "");
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET", " ");
conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_KEYS",
keyadminUgi.getUserName());
conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA",
hdfsUgi.getUserName());
- conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.SET_KEY_MATERIAL", "");
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.SET_KEY_MATERIAL", " ");
conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
hdfsUgi.getUserName());
- conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", "");
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", "*");
return conf;
}
@@ -478,6 +478,1042 @@ public class TestAclsEndToEnd {
}
/**
+ * Test that key creation is correctly governed by ACLs.
+ * @throws Exception thrown if setup fails
+ */
+ @Test
+ public void testCreateKey() throws Exception {
+ Configuration conf = new Configuration();
+
+ // Correct config with whitelist ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+
+ try {
+ setup(conf);
+
+ assertTrue("Exception during key creation with correct config"
+ + " using whitelist key ACLs", createKey(realUgi, KEY1, conf));
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Correct config with default ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+
+ try {
+ setup(conf);
+
+ assertTrue("Exception during key creation with correct config"
+ + " using default key ACLs", createKey(realUgi, KEY2, conf));
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Denied because of blacklist
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.CREATE",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+
+ try {
+ setup(conf);
+
+ assertFalse("Allowed key creation with blacklist for CREATE",
+ createKey(realUgi, KEY3, conf));
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Missing KMS ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE", " ");
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+
+ try {
+ setup(conf);
+
+ assertFalse("Allowed key creation without CREATE KMS ACL",
+ createKey(realUgi, KEY3, conf));
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Missing key ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE",
+ realUgi.getUserName());
+
+ try {
+ setup(conf);
+
+ assertFalse("Allowed key creation without MANAGMENT key ACL",
+ createKey(realUgi, KEY3, conf));
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Denied because the key ACL set ignores the default ACL set for key3
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+ conf.set(KeyAuthorizationKeyProvider.KEY_ACL + KEY3 + ".DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf);
+
+ assertFalse("Allowed key creation when default key ACL should have been"
+ + " overridden by key ACL", createKey(realUgi, KEY3, conf));
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Allowed because the default setting for KMS ACLs is fully permissive
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+
+ try {
+ setup(conf);
+
+ assertTrue("Exception during key creation with default KMS ACLs",
+ createKey(realUgi, KEY3, conf));
+ } finally {
+ teardown();
+ }
+ }
+
+ /**
+ * Test that zone creation is correctly governed by ACLs.
+ * @throws Exception thrown if setup fails
+ */
+ @Test
+ public void testCreateEncryptionZone() throws Exception {
+ Configuration conf = new Configuration();
+
+ // Create a test key
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+
+ try {
+ setup(conf);
+
+ assertTrue("Exception during key creation",
+ createKey(realUgi, KEY1, conf));
+ } finally {
+ teardown();
+ }
+
+ // We tear everything down and then restart it with the ACLs we want to
+ // test so that there's no contamination from the ACLs needed for setup.
+ // To make that work, we have to tell the setup() method not to create a
+ // new KMS directory.
+ conf = new Configuration();
+
+ // Correct config with whitelist ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ fs.mkdirs(ZONE1);
+
+ assertTrue("Exception during zone creation with correct config using"
+ + " whitelist key ACLs", createEncryptionZone(realUgi, KEY1, ZONE1));
+ } finally {
+ fs.delete(ZONE1, true);
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Correct config with default ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "READ",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ fs.mkdirs(ZONE2);
+
+ assertTrue("Exception during zone creation with correct config using"
+ + " default key ACLs", createEncryptionZone(realUgi, KEY1, ZONE2));
+ } finally {
+ fs.delete(ZONE2, true);
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Denied because the key ACL set ignores the default ACL set for key1
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "READ",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KeyAuthorizationKeyProvider.KEY_ACL + KEY1 + ".DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ fs.mkdirs(ZONE3);
+
+ assertFalse("Allowed creation of zone when default key ACLs should have"
+ + " been overridden by key ACL",
+ createEncryptionZone(realUgi, KEY1, ZONE3));
+ } finally {
+ fs.delete(ZONE3, true);
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Correct config with blacklist
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.GET_METADATA",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ fs.mkdirs(ZONE3);
+
+ assertFalse("Allowed zone creation of zone with blacklisted GET_METADATA",
+ createEncryptionZone(realUgi, KEY1, ZONE3));
+ } finally {
+ fs.delete(ZONE3, true);
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Correct config with blacklist
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ fs.mkdirs(ZONE3);
+
+ assertFalse("Allowed zone creation of zone with blacklisted GENERATE_EEK",
+ createEncryptionZone(realUgi, KEY1, ZONE3));
+ } finally {
+ fs.delete(ZONE3, true);
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Missing KMS ACL but works because defaults for KMS ACLs are fully
+ // permissive
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ fs.mkdirs(ZONE3);
+
+ assertTrue("Exception during zone creation with default KMS ACLs",
+ createEncryptionZone(realUgi, KEY1, ZONE3));
+ } finally {
+ fs.delete(ZONE3, true);
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Missing GET_METADATA KMS ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA", " ");
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ fs.mkdirs(ZONE4);
+
+ assertFalse("Allowed zone creation without GET_METADATA KMS ACL",
+ createEncryptionZone(realUgi, KEY1, ZONE4));
+ } finally {
+ fs.delete(ZONE4, true);
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Missing GET_METADATA KMS ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", " ");
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ fs.mkdirs(ZONE4);
+
+ assertFalse("Allowed zone creation without GENERATE_EEK KMS ACL",
+ createEncryptionZone(realUgi, KEY1, ZONE4));
+ } finally {
+ fs.delete(ZONE4, true);
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Missing READ key ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ fs.mkdirs(ZONE4);
+
+ assertFalse("Allowed zone creation without READ ACL",
+ createEncryptionZone(realUgi, KEY1, ZONE4));
+ } finally {
+ fs.delete(ZONE4, true);
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Missing GENERATE_EEK key ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ fs.mkdirs(ZONE4);
+
+ assertFalse("Allowed zone creation without GENERATE_EEK ACL",
+ createEncryptionZone(realUgi, KEY1, ZONE4));
+ } finally {
+ fs.delete(ZONE4, true);
+ teardown();
+ }
+ }
+
+ /**
+ * Test that in-zone file creation is correctly governed by ACLs.
+ * @throws Exception thrown if setup fails
+ */
+ @Test
+ public void testCreateFileInEncryptionZone() throws Exception {
+ Configuration conf = new Configuration();
+
+ // Create a test key
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+
+ assertTrue(new File(kmsDir, "kms.keystore").length() == 0);
+
+ try {
+ setup(conf);
+
+ assertTrue("Exception during key creation",
+ createKey(realUgi, KEY1, conf));
+ fs.mkdirs(ZONE1);
+ assertTrue("Exception during zone creation",
+ createEncryptionZone(realUgi, KEY1, ZONE1));
+ fs.mkdirs(ZONE2);
+ assertTrue("Exception during zone creation",
+ createEncryptionZone(realUgi, KEY1, ZONE2));
+ fs.mkdirs(ZONE3);
+ assertTrue("Exception during zone creation",
+ createEncryptionZone(realUgi, KEY1, ZONE3));
+ fs.mkdirs(ZONE4);
+ assertTrue("Exception during zone creation",
+ createEncryptionZone(realUgi, KEY1, ZONE4));
+ } catch (Throwable ex) {
+ fs.delete(ZONE1, true);
+ fs.delete(ZONE2, true);
+ fs.delete(ZONE3, true);
+ fs.delete(ZONE4, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+
+ // We tear everything down and then restart it with the ACLs we want to
+ // test so that there's no contamination from the ACLs needed for setup.
+ // To make that work, we have to tell the setup() method not to create a
+ // new KMS directory or DFS dierctory.
+
+ conf = new Configuration();
+
+ // Correct config with whitelist ACLs
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertTrue("Exception during file creation with correct config"
+ + " using whitelist ACL", createFile(realUgi, FILE1, TEXT));
+ } finally {
+ fs.delete(ZONE1, true);
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Correct config with default ACLs
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertTrue("Exception during file creation with correct config"
+ + " using whitelist ACL", createFile(realUgi, FILE2, TEXT));
+ } finally {
+ fs.delete(ZONE2, true);
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Denied because the key ACL set ignores the default ACL set for key1
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KeyAuthorizationKeyProvider.KEY_ACL + KEY1 + ".READ",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertFalse("Allowed file creation when default key ACLs should have been"
+ + " overridden by key ACL", createFile(realUgi, FILE3, TEXT));
+ } catch (Exception ex) {
+ fs.delete(ZONE3, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Denied by blacklist
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertFalse("Allowed file creation with blacklist for GENERATE_EEK",
+ createFile(realUgi, FILE3, TEXT));
+ } catch (Exception ex) {
+ fs.delete(ZONE3, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Denied by blacklist
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertFalse("Allowed file creation with blacklist for DECRYPT_EEK",
+ createFile(realUgi, FILE3, TEXT));
+ } catch (Exception ex) {
+ fs.delete(ZONE3, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Allowed because default KMS ACLs are fully permissive
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertTrue("Exception during file creation with default KMS ACLs",
+ createFile(realUgi, FILE3, TEXT));
+ } catch (Exception ex) {
+ fs.delete(ZONE3, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Denied because of missing GENERATE_EEK KMS ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK", " ");
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertFalse("Allowed file creation without GENERATE_EEK KMS ACL",
+ createFile(realUgi, FILE4, TEXT));
+ } catch (Exception ex) {
+ fs.delete(ZONE3, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Denied because of missing DECRYPT_EEK KMS ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", " ");
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertFalse("Allowed file creation without DECRYPT_EEK KMS ACL",
+ createFile(realUgi, FILE3, TEXT));
+ } catch (Exception ex) {
+ fs.delete(ZONE3, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Denied because of missing GENERATE_EEK key ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertFalse("Allowed file creation without GENERATE_EEK key ACL",
+ createFile(realUgi, FILE3, TEXT));
+ } catch (Exception ex) {
+ fs.delete(ZONE3, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Denied because of missing DECRYPT_EEK key ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertFalse("Allowed file creation without DECRYPT_EEK key ACL",
+ createFile(realUgi, FILE3, TEXT));
+ } catch (Exception ex) {
+ fs.delete(ZONE3, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+ }
+
+ /**
+ * Test that in-zone file read is correctly governed by ACLs.
+ * @throws Exception thrown if setup fails
+ */
+ @Test
+ public void testReadFileInEncryptionZone() throws Exception {
+ Configuration conf = new Configuration();
+
+ // Create a test key
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GET_METADATA",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "READ",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+
+ assertTrue(new File(kmsDir, "kms.keystore").length() == 0);
+
+ try {
+ setup(conf);
+
+ assertTrue("Exception during key creation",
+ createKey(realUgi, KEY1, conf));
+ fs.mkdirs(ZONE1);
+ assertTrue("Exception during zone creation",
+ createEncryptionZone(realUgi, KEY1, ZONE1));
+ assertTrue("Exception during file creation",
+ createFile(realUgi, FILE1, TEXT));
+ } catch (Throwable ex) {
+ fs.delete(ZONE1, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+
+ // We tear everything down and then restart it with the ACLs we want to
+ // test so that there's no contamination from the ACLs needed for setup.
+ // To make that work, we have to tell the setup() method not to create a
+ // new KMS directory or DFS dierctory.
+
+ conf = new Configuration();
+
+ // Correct config with whitelist ACLs
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertTrue("Exception while reading file with correct config with"
+ + " whitelist ACLs", compareFile(realUgi, FILE1, TEXT));
+ } catch (Throwable ex) {
+ fs.delete(ZONE1, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Correct config with default ACLs
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertTrue("Exception while reading file with correct config"
+ + " with default ACLs", compareFile(realUgi, FILE1, TEXT));
+ } catch (Throwable ex) {
+ fs.delete(ZONE1, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Denied because the key ACL set ignores the default ACL set for key1
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KeyAuthorizationKeyProvider.KEY_ACL + KEY1 + ".READ",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertFalse("Allowed file read when default key ACLs should have been"
+ + " overridden by key ACL", compareFile(realUgi, FILE1, TEXT));
+ } catch (Throwable ex) {
+ fs.delete(ZONE1, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Denied by blacklist
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.DECRYPT_EEK",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertFalse("Allowed file read with blacklist for DECRYPT_EEK",
+ compareFile(realUgi, FILE1, TEXT));
+ } catch (Throwable ex) {
+ fs.delete(ZONE1, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Allowed because default KMS ACLs are fully permissive
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertTrue("Exception while reading file with default KMS ACLs",
+ compareFile(realUgi, FILE1, TEXT));
+ } catch (Throwable ex) {
+ fs.delete(ZONE1, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Denied because of missing DECRYPT_EEK KMS ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DECRYPT_EEK", " ");
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false, false);
+
+ assertFalse("Allowed file read without DECRYPT_EEK KMS ACL",
+ compareFile(realUgi, FILE1, TEXT));
+ } catch (Throwable ex) {
+ fs.delete(ZONE1, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+
+ // Denied because of missing DECRYPT_EEK key ACL
+ conf = new Configuration();
+
+ try {
+ setup(conf, false, false);
+
+ assertFalse("Allowed file read without DECRYPT_EEK key ACL",
+ compareFile(realUgi, FILE1, TEXT));
+ } catch (Throwable ex) {
+ fs.delete(ZONE1, true);
+
+ throw ex;
+ } finally {
+ teardown();
+ }
+ }
+
+ /**
+ * Test that key deletion is correctly governed by ACLs.
+ * @throws Exception thrown if setup fails
+ */
+ @Test
+ public void testDeleteKey() throws Exception {
+ Configuration conf = new Configuration();
+
+ // Create a test key
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.CREATE",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+
+ try {
+ setup(conf);
+
+ assertTrue("Exception during key creation",
+ createKey(realUgi, KEY1, conf));
+ assertTrue("Exception during key creation",
+ createKey(realUgi, KEY2, conf));
+ assertTrue("Exception during key creation",
+ createKey(realUgi, KEY3, conf));
+ } finally {
+ teardown();
+ }
+
+ // We tear everything down and then restart it with the ACLs we want to
+ // test so that there's no contamination from the ACLs needed for setup.
+ // To make that work, we have to tell the setup() method not to create a
+ // new KMS directory.
+
+ conf = new Configuration();
+
+ // Correct config with whitelist ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DELETE",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ assertTrue("Exception during key deletion with correct config"
+ + " using whitelist key ACLs", deleteKey(realUgi, KEY1));
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Correct config with default ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DELETE",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ assertTrue("Exception during key deletion with correct config"
+ + " using default key ACLs", deleteKey(realUgi, KEY2));
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Denied because of blacklist
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DELETE",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "blacklist.DELETE",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ assertFalse("Allowed key deletion with blacklist for DELETE",
+ deleteKey(realUgi, KEY3));
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Missing KMS ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DELETE", " ");
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ assertFalse("Allowed key deletion without DELETE KMS ACL",
+ deleteKey(realUgi, KEY3));
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+
+ // Missing key ACL
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DELETE",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ assertFalse("Allowed key deletion without MANAGMENT key ACL",
+ deleteKey(realUgi, KEY3));
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Denied because the key ACL set ignores the default ACL set for key3
+ conf.set(KMSConfiguration.CONFIG_PREFIX + "acl.DELETE",
+ realUgi.getUserName());
+ conf.set(KMSConfiguration.DEFAULT_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+ conf.set(KeyAuthorizationKeyProvider.KEY_ACL + KEY3 + ".DECRYPT_EEK",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ assertFalse("Allowed key deletion when default key ACL should have been"
+ + " overridden by key ACL", deleteKey(realUgi, KEY3));
+ } finally {
+ teardown();
+ }
+
+ conf = new Configuration();
+
+ // Allowed because the default setting for KMS ACLs is fully permissive
+ conf.set(KMSConfiguration.WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT",
+ realUgi.getUserName());
+
+ try {
+ setup(conf, false);
+
+ assertTrue("Exception during key deletion with default KMS ACLs",
+ deleteKey(realUgi, KEY3));
+ } finally {
+ teardown();
+ }
+ }
+
+ /**
* Create a key as the specified user.
*
* @param ugi the target user