You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by "ChinmayHegde24 (via GitHub)" <gi...@apache.org> on 2025/09/26 10:38:35 UTC
[PR] RANGER-5341: Capture opCode in KMS access logs for EEK_OP operations [ranger]
ChinmayHegde24 opened a new pull request, #688:
URL: https://github.com/apache/ranger/pull/688
Currently, when the handleEncryptedKeyOp() method in KMS.java is invoked via the API, there is no visibility into whether the request is performing a decryptKey or reEncryptKey operation as same path gets logged for both operations as it hits the same method.
So after this patch opCode will be included in AccessLog pattern.
e.g In access logs we can see opcode appended
<ip> - - [<DateTime>] "GET /kms/v1/keys/names" 200 3 50 -
<ip> - - [<DateTime>] "GET /kms/v1/key/key1/_eek" 500 288 29 generate
<ip> - - [<DateTime>] "POST /kms/v1/keyversion/test-2@1/_eek" 400 176 16 reencrypt
<ip> - - [<DateTime>] "POST /kms/v1/keyversion/test-2@1/_eek" 400 176 14 decrypt
## How was this patch tested?
Checked Access logs after hitting endpoints through Docker setup
Mvn local build
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5341: Capture opCode in KMS access logs for EEK_OP operations [ranger]
Posted by "dhavalshah9131 (via GitHub)" <gi...@apache.org>.
dhavalshah9131 merged PR #688:
URL: https://github.com/apache/ranger/pull/688
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5341: Capture opCode in KMS access logs for EEK_OP operations [ranger]
Posted by "ChinmayHegde24 (via GitHub)" <gi...@apache.org>.
ChinmayHegde24 commented on code in PR #688:
URL: https://github.com/apache/ranger/pull/688#discussion_r2481214243
##########
kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSMDCFilter.java:
##########
@@ -70,15 +78,32 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
DATA_TL.remove();
UserGroupInformation ugi = HttpUserGroupInformation.get();
- String method = ((HttpServletRequest) request).getMethod();
- StringBuffer requestURL = ((HttpServletRequest) request).getRequestURL();
- String queryString = ((HttpServletRequest) request).getQueryString();
+ String method = req.getMethod();
+ StringBuffer requestURL = req.getRequestURL();
+ String queryString = req.getQueryString();
+
+ // Extract operation from query parameters if present
Review Comment:
Handled
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5341: Capture opCode in KMS access logs for EEK_OP operations [ranger]
Posted by "ChinmayHegde24 (via GitHub)" <gi...@apache.org>.
ChinmayHegde24 commented on code in PR #688:
URL: https://github.com/apache/ranger/pull/688#discussion_r2481213694
##########
kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSMDCFilter.java:
##########
Review Comment:
Yeah I've added those
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5341: Capture opCode in KMS access logs for EEK_OP operations [ranger]
Posted by "dhavalshah9131 (via GitHub)" <gi...@apache.org>.
dhavalshah9131 commented on code in PR #688:
URL: https://github.com/apache/ranger/pull/688#discussion_r2472360028
##########
kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSMDCFilter.java:
##########
Review Comment:
Please check for the unit test coverage for new changes.
##########
kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSMDCFilter.java:
##########
@@ -70,15 +78,32 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
DATA_TL.remove();
UserGroupInformation ugi = HttpUserGroupInformation.get();
- String method = ((HttpServletRequest) request).getMethod();
- StringBuffer requestURL = ((HttpServletRequest) request).getRequestURL();
- String queryString = ((HttpServletRequest) request).getQueryString();
+ String method = req.getMethod();
+ StringBuffer requestURL = req.getRequestURL();
+ String queryString = req.getQueryString();
+
+ // Extract operation from query parameters if present
Review Comment:
Can you check for exception and handle it accordingly. E.G. UnsupportedEncodingException.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5341: Capture opCode in KMS access logs for EEK_OP operations [ranger]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #688:
URL: https://github.com/apache/ranger/pull/688#discussion_r2481900569
##########
kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSMDCFilter.java:
##########
@@ -70,15 +84,37 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
DATA_TL.remove();
UserGroupInformation ugi = HttpUserGroupInformation.get();
- String method = ((HttpServletRequest) request).getMethod();
- StringBuffer requestURL = ((HttpServletRequest) request).getRequestURL();
- String queryString = ((HttpServletRequest) request).getQueryString();
+ String method = req.getMethod();
+ StringBuffer requestURL = req.getRequestURL();
+ String queryString = req.getQueryString();
+
+ // Extract operation from query parameters if present
+ String operation = null;
+ if (path.contains("/_eek") && queryString != null) {
+ for (String param : queryString.split("&")) {
+ String[] kv = param.split("=", 2);
+ if (kv.length == 2 && "eek_op".equals(kv[0])) {
+ try {
+ operation = URLDecoder.decode(kv[1], StandardCharsets.UTF_8.name());
+ } catch (UnsupportedEncodingException | IllegalArgumentException e) {
+ logger.error("encoding issue in UTF-8 for eek_op value: {}", kv[1], e);
Review Comment:
The error message should be more specific about the type of encoding issue. Consider: 'Failed to decode eek_op parameter value using UTF-8 encoding: {}'.
```suggestion
logger.error("Failed to decode eek_op parameter value using UTF-8 encoding: {}", kv[1], e);
```
##########
kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSMDCFilter.java:
##########
@@ -70,15 +84,37 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
DATA_TL.remove();
UserGroupInformation ugi = HttpUserGroupInformation.get();
- String method = ((HttpServletRequest) request).getMethod();
- StringBuffer requestURL = ((HttpServletRequest) request).getRequestURL();
- String queryString = ((HttpServletRequest) request).getQueryString();
+ String method = req.getMethod();
+ StringBuffer requestURL = req.getRequestURL();
+ String queryString = req.getQueryString();
+
+ // Extract operation from query parameters if present
+ String operation = null;
+ if (path.contains("/_eek") && queryString != null) {
+ for (String param : queryString.split("&")) {
+ String[] kv = param.split("=", 2);
+ if (kv.length == 2 && "eek_op".equals(kv[0])) {
+ try {
+ operation = URLDecoder.decode(kv[1], StandardCharsets.UTF_8.name());
+ } catch (UnsupportedEncodingException | IllegalArgumentException e) {
+ logger.error("encoding issue in UTF-8 for eek_op value: {}", kv[1], e);
+ throw new ServletException("Unexpected encoding issue with UTF-8");
Review Comment:
The error message is too generic and doesn't help identify the root cause. Consider: 'Failed to decode eek_op parameter: malformed URL encoding'.
```suggestion
throw new ServletException("Failed to decode eek_op parameter: '" + kv[1] + "'. " + e.getClass().getSimpleName() + ": " + e.getMessage(), e);
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org