org.apache.hadoop.hbase.security.visibility

Class VisibilityController

java.lang.Object

org.apache.hadoop.hbase.security.visibility.VisibilityController

All Implemented Interfaces:

Coprocessor, MasterCoprocessor, MasterObserver, RegionCoprocessor, RegionObserver, org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsService.Interface

@InterfaceAudience.LimitedPrivate(value="Configuration")
public class VisibilityController
extends Object
implements MasterCoprocessor, RegionCoprocessor, org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsService.Interface, MasterObserver, RegionObserver

Coprocessor that has both the MasterObserver and RegionObserver implemented that supports in visibility labels

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
private static class	VisibilityController.DeleteVersionVisibilityExpressionFilter

Nested classes/interfaces inherited from interface org.apache.hadoop.hbase.Coprocessor

Coprocessor.State

Nested classes/interfaces inherited from interface org.apache.hadoop.hbase.coprocessor.RegionObserver

RegionObserver.MutationType

Field Summary

Fields

Modifier and Type	Field and Description
private boolean	accessControllerAvailable
private static org.slf4j.Logger	AUDITLOG
(package private) boolean	authorizationEnabled if we are active, usually false, only true if "hbase.security.authorization" has been set to true in site configuration
private boolean	checkAuths
private org.apache.hadoop.conf.Configuration	conf
private boolean	initialized
private boolean	labelsRegion
private static org.slf4j.Logger	LOG
private static ArrayList<Byte>	RESERVED_VIS_TAG_TYPES
private Map<InternalScanner,String>	scannerOwners Mapping of scanner instances to the user who created them
private VisibilityLabelService	visibilityLabelService

Fields inherited from interface org.apache.hadoop.hbase.Coprocessor

PRIORITY_HIGHEST, PRIORITY_LOWEST, PRIORITY_SYSTEM, PRIORITY_USER, VERSION

Constructor Summary

Constructors

Constructor and Description
VisibilityController()

Method Summary

Modifier and Type	Method and Description
void	addLabels(com.google.protobuf.RpcController controller, org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsRequest request, com.google.protobuf.RpcCallback<org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsResponse> done) VisibilityEndpoint service related methods
private static org.apache.hadoop.hbase.protobuf.generated.HBaseProtos.NameBytesPair	buildException(Throwable t) n * @return NameValuePair of the exception name to stringified version os exception.
private void	checkCallingUserAuth()
private Pair<Boolean,Tag>	checkForReservedVisibilityTagPresence(Cell cell, Pair<Boolean,Tag> pair) Checks whether cell contains any tag with type as VISIBILITY_TAG_TYPE.
void	clearAuths(com.google.protobuf.RpcController controller, org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.SetAuthsRequest request, com.google.protobuf.RpcCallback<org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsResponse> done)
private Cell	createNewCellWithTags(Mutation mutation, Cell newCell)
void	getAuths(com.google.protobuf.RpcController controller, org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.GetAuthsRequest request, com.google.protobuf.RpcCallback<org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.GetAuthsResponse> done)
Optional<MasterObserver>	getMasterObserver()
Optional<RegionObserver>	getRegionObserver() Observer/Service Getters
Iterable<com.google.protobuf.Service>	getServices() Coprocessor endpoints providing protobuf services should override this method.
private void	initVisibilityLabelService(RegionCoprocessorEnvironment env)
static boolean	isCellAuthorizationSupported(org.apache.hadoop.conf.Configuration conf)
private boolean	isSystemOrSuperUser()
void	listLabels(com.google.protobuf.RpcController controller, org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.ListLabelsRequest request, com.google.protobuf.RpcCallback<org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.ListLabelsResponse> done)
private void	logResult(boolean isAllowed, String request, String reason, byte[] user, List<byte[]> labelAuths, String regex)
List<Pair<Cell,Cell>>	postAppendBeforeWAL(ObserverContext<RegionCoprocessorEnvironment> ctx, Mutation mutation, List<Pair<Cell,Cell>> cellPairs) Called after a list of new cells has been created during an append operation, but before they are committed to the WAL or memstore.
List<Pair<Cell,Cell>>	postIncrementBeforeWAL(ObserverContext<RegionCoprocessorEnvironment> ctx, Mutation mutation, List<Pair<Cell,Cell>> cellPairs) Called after a list of new cells has been created during an increment operation, but before they are committed to the WAL or memstore.
DeleteTracker	postInstantiateDeleteTracker(ObserverContext<RegionCoprocessorEnvironment> ctx, DeleteTracker delTracker) Called after the ScanQueryMatcher creates ScanDeleteTracker.
void	postOpen(ObserverContext<RegionCoprocessorEnvironment> e) Region related hooks
void	postScannerClose(ObserverContext<RegionCoprocessorEnvironment> c, InternalScanner s) Called after the client closes a scanner.
RegionScanner	postScannerOpen(ObserverContext<RegionCoprocessorEnvironment> c, Scan scan, RegionScanner s) Called after the client opens a new scanner.
void	postSetSplitOrMergeEnabled(ObserverContext<MasterCoprocessorEnvironment> ctx, boolean newValue, MasterSwitchType switchType) Called after setting split / merge switch
void	postStartMaster(ObserverContext<MasterCoprocessorEnvironment> ctx) Master related hooks
void	preBatchMutate(ObserverContext<RegionCoprocessorEnvironment> c, MiniBatchOperationInProgress<Mutation> miniBatchOp) This will be called for every batch mutation operation happening at the server.
void	preDisableTable(ObserverContext<MasterCoprocessorEnvironment> ctx, TableName tableName) Called prior to disabling a table.
void	preGetOp(ObserverContext<RegionCoprocessorEnvironment> e, Get get, List<Cell> results) Called before the client performs a Get
TableDescriptor	preModifyTable(ObserverContext<MasterCoprocessorEnvironment> ctx, TableName tableName, TableDescriptor currentDescriptor, TableDescriptor newDescriptor) Called prior to modifying a table's properties.
void	prePrepareTimeStampForDeleteVersion(ObserverContext<RegionCoprocessorEnvironment> ctx, Mutation delete, Cell cell, byte[] byteNow, Get get) Called before the server updates the timestamp for version delete with latest timestamp.
void	preScannerClose(ObserverContext<RegionCoprocessorEnvironment> c, InternalScanner s) Called before the client closes a scanner.
boolean	preScannerNext(ObserverContext<RegionCoprocessorEnvironment> c, InternalScanner s, List<Result> result, int limit, boolean hasNext) Called before the client asks for the next row on a scanner.
void	preScannerOpen(ObserverContext<RegionCoprocessorEnvironment> e, Scan scan) Called before the client opens a new scanner.
private void	removeReplicationVisibilityTag(List<Tag> tags)
private void	requireScannerOwner(InternalScanner s) Verify, when servicing an RPC, that the caller is the scanner owner.
void	setAuths(com.google.protobuf.RpcController controller, org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.SetAuthsRequest request, com.google.protobuf.RpcCallback<org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsResponse> done)
private void	setExceptionResults(int size, IOException e, org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsResponse.Builder response)
void	start(CoprocessorEnvironment env) Called by the CoprocessorEnvironment during it's own startup to initialize the coprocessor.
void	stop(CoprocessorEnvironment env) Called by the CoprocessorEnvironment during it's own shutdown to stop the coprocessor.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.hadoop.hbase.coprocessor.RegionCoprocessor

getBulkLoadObserver, getEndpointObserver

Methods inherited from interface org.apache.hadoop.hbase.coprocessor.MasterObserver

postAbortProcedure, postAddReplicationPeer, postAddRSGroup, postAssign, postBalance, postBalanceRSGroup, postBalanceSwitch, postClearDeadServers, postCloneSnapshot, postCompletedCreateTableAction, postCompletedDeleteTableAction, postCompletedDisableTableAction, postCompletedEnableTableAction, postCompletedMergeRegionsAction, postCompletedModifyTableAction, postCompletedModifyTableAction, postCompletedSnapshotAction, postCompletedSplitRegionAction, postCompletedTruncateTableAction, postCreateNamespace, postCreateTable, postDecommissionRegionServers, postDeleteNamespace, postDeleteSnapshot, postDeleteTable, postDisableReplicationPeer, postDisableTable, postEnableReplicationPeer, postEnableTable, postGetClusterMetrics, postGetLocks, postGetNamespaceDescriptor, postGetProcedures, postGetReplicationPeerConfig, postGetTableDescriptors, postGetTableNames, postGetUserPermissions, postGrant, postHasUserPermissions, postIsRpcThrottleEnabled, postListDecommissionedRegionServers, postListNamespaceDescriptors, postListNamespaces, postListReplicationPeers, postListSnapshot, postLockHeartbeat, postMasterStoreFlush, postMergeRegions, postMergeRegionsCommitAction, postModifyColumnFamilyStoreFileTracker, postModifyNamespace, postModifyNamespace, postModifyTable, postModifyTable, postModifyTableStoreFileTracker, postMove, postMoveServers, postMoveServersAndTables, postMoveTables, postRecommissionRegionServer, postRegionOffline, postRemoveReplicationPeer, postRemoveRSGroup, postRemoveServers, postRenameRSGroup, postRequestLock, postRestoreSnapshot, postRevoke, postRollBackMergeRegionsAction, postRollBackSplitRegionAction, postSetNamespaceQuota, postSetRegionServerQuota, postSetTableQuota, postSetUserQuota, postSetUserQuota, postSetUserQuota, postSnapshot, postSwitchExceedThrottleQuota, postSwitchRpcThrottle, postTableFlush, postTruncateTable, postUnassign, postUnassign, postUpdateReplicationPeerConfig, postUpdateRSGroupConfig, preAbortProcedure, preAddReplicationPeer, preAddRSGroup, preAssign, preBalance, preBalanceRSGroup, preBalanceSwitch, preClearDeadServers, preCloneSnapshot, preCreateNamespace, preCreateTable, preCreateTableAction, preCreateTableRegionsInfos, preDecommissionRegionServers, preDeleteNamespace, preDeleteSnapshot, preDeleteTable, preDeleteTableAction, preDisableReplicationPeer, preDisableTableAction, preEnableReplicationPeer, preEnableTable, preEnableTableAction, preGetClusterMetrics, preGetLocks, preGetNamespaceDescriptor, preGetProcedures, preGetReplicationPeerConfig, preGetTableDescriptors, preGetTableNames, preGetUserPermissions, preGrant, preHasUserPermissions, preIsRpcThrottleEnabled, preListDecommissionedRegionServers, preListNamespaceDescriptors, preListNamespaces, preListReplicationPeers, preListSnapshot, preLockHeartbeat, preMasterInitialization, preMasterStoreFlush, preMergeRegions, preMergeRegionsAction, preMergeRegionsCommitAction, preModifyColumnFamilyStoreFileTracker, preModifyNamespace, preModifyNamespace, preModifyTable, preModifyTableAction, preModifyTableAction, preModifyTableStoreFileTracker, preMove, preMoveServers, preMoveServersAndTables, preMoveTables, preRecommissionRegionServer, preRegionOffline, preRemoveReplicationPeer, preRemoveRSGroup, preRemoveServers, preRenameRSGroup, preRequestLock, preRestoreSnapshot, preRevoke, preSetNamespaceQuota, preSetRegionServerQuota, preSetSplitOrMergeEnabled, preSetTableQuota, preSetUserQuota, preSetUserQuota, preSetUserQuota, preShutdown, preSnapshot, preSplitRegion, preSplitRegionAction, preSplitRegionAfterMETAAction, preSplitRegionBeforeMETAAction, preStopMaster, preSwitchExceedThrottleQuota, preSwitchRpcThrottle, preTableFlush, preTruncateTable, preTruncateTableAction, preUnassign, preUnassign, preUpdateReplicationPeerConfig, preUpdateRSGroupConfig

Methods inherited from interface org.apache.hadoop.hbase.coprocessor.RegionObserver

postAppend, postAppend, postBatchMutate, postBatchMutateIndispensably, postBulkLoadHFile, postCheckAndDelete, postCheckAndDelete, postCheckAndMutate, postCheckAndPut, postCheckAndPut, postClose, postCloseRegionOperation, postCommitStoreFile, postCompact, postCompactSelection, postDelete, postDelete, postExists, postFlush, postFlush, postGetOp, postIncrement, postIncrement, postMemStoreCompaction, postMutationBeforeWAL, postPut, postPut, postReplayWALs, postScannerFilterRow, postScannerNext, postStartRegionOperation, postStoreFileReaderOpen, postWALRestore, preAppend, preAppend, preAppendAfterRowLock, preBulkLoadHFile, preCheckAndDelete, preCheckAndDelete, preCheckAndDeleteAfterRowLock, preCheckAndDeleteAfterRowLock, preCheckAndMutate, preCheckAndMutateAfterRowLock, preCheckAndPut, preCheckAndPut, preCheckAndPutAfterRowLock, preCheckAndPutAfterRowLock, preClose, preCommitStoreFile, preCompact, preCompactScannerOpen, preCompactSelection, preDelete, preDelete, preExists, preFlush, preFlush, preFlushScannerOpen, preIncrement, preIncrement, preIncrementAfterRowLock, preMemStoreCompaction, preMemStoreCompactionCompact, preMemStoreCompactionCompactScannerOpen, preOpen, prePut, prePut, preReplayWALs, preStoreFileReaderOpen, preStoreScannerOpen, preWALAppend, preWALRestore

Field Detail

LOG

private static final org.slf4j.Logger LOG

AUDITLOG

private static final org.slf4j.Logger AUDITLOG

labelsRegion

private boolean labelsRegion

accessControllerAvailable

private boolean accessControllerAvailable

conf

private org.apache.hadoop.conf.Configuration conf

initialized

private volatile boolean initialized

checkAuths

private boolean checkAuths

scannerOwners

private Map<InternalScanner,String> scannerOwners

Mapping of scanner instances to the user who created them

visibilityLabelService

private VisibilityLabelService visibilityLabelService

authorizationEnabled

boolean authorizationEnabled

if we are active, usually false, only true if "hbase.security.authorization" has been set to true in site configuration

RESERVED_VIS_TAG_TYPES

private static ArrayList<Byte> RESERVED_VIS_TAG_TYPES

Constructor Detail

VisibilityController

public VisibilityController()

Method Detail

isCellAuthorizationSupported

public static boolean isCellAuthorizationSupported(org.apache.hadoop.conf.Configuration conf)

start

public void start(CoprocessorEnvironment env)
           throws IOException

Description copied from interface: Coprocessor

Called by the CoprocessorEnvironment during it's own startup to initialize the coprocessor.

Specified by:

start in interface Coprocessor

Throws:

IOException

stop

public void stop(CoprocessorEnvironment env)
          throws IOException

Description copied from interface: Coprocessor

Called by the CoprocessorEnvironment during it's own shutdown to stop the coprocessor.

Specified by:

stop in interface Coprocessor

Throws:

IOException

getRegionObserver

public Optional<RegionObserver> getRegionObserver()

Observer/Service Getters

Specified by:

getRegionObserver in interface RegionCoprocessor

getMasterObserver

public Optional<MasterObserver> getMasterObserver()

Specified by:

getMasterObserver in interface MasterCoprocessor

getServices

public Iterable<com.google.protobuf.Service> getServices()

Description copied from interface: Coprocessor

Coprocessor endpoints providing protobuf services should override this method.

Specified by:

getServices in interface Coprocessor

Returns:

Iterable of Services or empty collection. Implementations should never return null.

postStartMaster

public void postStartMaster(ObserverContext<MasterCoprocessorEnvironment> ctx)
                     throws IOException

Master related hooks

Specified by:

postStartMaster in interface MasterObserver

Throws:

IOException

preModifyTable

public TableDescriptor preModifyTable(ObserverContext<MasterCoprocessorEnvironment> ctx,
                                      TableName tableName,
                                      TableDescriptor currentDescriptor,
                                      TableDescriptor newDescriptor)
                               throws IOException

Description copied from interface: MasterObserver

Called prior to modifying a table's properties. Called as part of modify table RPC call.

Specified by:

preModifyTable in interface MasterObserver

Parameters:

ctx - the environment to interact with the framework and master

tableName - the name of the table

currentDescriptor - current TableDescriptor of the table

newDescriptor - after modify operation, table will have this descriptor

Throws:

IOException

preDisableTable

public void preDisableTable(ObserverContext<MasterCoprocessorEnvironment> ctx,
                            TableName tableName)
                     throws IOException

Description copied from interface: MasterObserver

Called prior to disabling a table. Called as part of disable table RPC call.

Specified by:

preDisableTable in interface MasterObserver

Parameters:

ctx - the environment to interact with the framework and master

tableName - the name of the table

Throws:

IOException

postOpen

public void postOpen(ObserverContext<RegionCoprocessorEnvironment> e)

Region related hooks

Specified by:

postOpen in interface RegionObserver

Parameters:

e - the environment provided by the region server

initVisibilityLabelService

private void initVisibilityLabelService(RegionCoprocessorEnvironment env)

postSetSplitOrMergeEnabled

public void postSetSplitOrMergeEnabled(ObserverContext<MasterCoprocessorEnvironment> ctx,
                                       boolean newValue,
                                       MasterSwitchType switchType)
                                throws IOException

Description copied from interface: MasterObserver

Called after setting split / merge switch

Specified by:

postSetSplitOrMergeEnabled in interface MasterObserver

Parameters:

ctx - the coprocessor instance's environment

newValue - the new value submitted in the call

switchType - type of switch

Throws:

IOException

preBatchMutate

public void preBatchMutate(ObserverContext<RegionCoprocessorEnvironment> c,
                           MiniBatchOperationInProgress<Mutation> miniBatchOp)
                    throws IOException

Description copied from interface: RegionObserver

This will be called for every batch mutation operation happening at the server. This will be called after acquiring the locks on the mutating rows and after applying the proper timestamp for each Mutation at the server. The batch may contain Put/Delete/Increment/Append. By setting OperationStatus of Mutations (MiniBatchOperationInProgress.setOperationStatus(int, OperationStatus)), RegionObserver can make Region to skip these Mutations.

Note: Do not retain references to any Cells in Mutations beyond the life of this invocation. If need a Cell reference for later use, copy the cell and use that.

Specified by:

preBatchMutate in interface RegionObserver

Parameters:

c - the environment provided by the region server

miniBatchOp - batch of Mutations getting applied to region.

Throws:

IOException

prePrepareTimeStampForDeleteVersion

public void prePrepareTimeStampForDeleteVersion(ObserverContext<RegionCoprocessorEnvironment> ctx,
                                                Mutation delete,
                                                Cell cell,
                                                byte[] byteNow,
                                                Get get)
                                         throws IOException

Description copied from interface: RegionObserver

Called before the server updates the timestamp for version delete with latest timestamp.

Call CoprocessorEnvironment#bypass to skip default actions. If 'bypass' is set, we skip out on calling any subsequent chained coprocessors.

Specified by:

prePrepareTimeStampForDeleteVersion in interface RegionObserver

Parameters:

ctx - the environment provided by the region server

delete - - the parent mutation associated with this delete cell

cell - - The deleteColumn with latest version cell

byteNow - - timestamp bytes

get - - the get formed using the current cell's row. Note that the get does not specify the family and qualifier

Throws:

IOException

checkForReservedVisibilityTagPresence

private Pair<Boolean,Tag> checkForReservedVisibilityTagPresence(Cell cell,
                                                                Pair<Boolean,Tag> pair)
                                                         throws IOException

Checks whether cell contains any tag with type as VISIBILITY_TAG_TYPE. This tag type is reserved and should not be explicitly set by user.

Parameters:

cell - The cell under consideration

pair - An optional pair of type <Boolean, Tag> which would be reused if already set and new one will be created if NULL is passed

Returns:

If the boolean is false then it indicates that the cell has a RESERVERD_VIS_TAG and with boolean as true, not null tag indicates that a string modified tag was found.

Throws:

IOException

removeReplicationVisibilityTag

private void removeReplicationVisibilityTag(List<Tag> tags)
                                     throws IOException

Throws:

IOException

preScannerOpen

public void preScannerOpen(ObserverContext<RegionCoprocessorEnvironment> e,
                           Scan scan)
                    throws IOException

Description copied from interface: RegionObserver

Called before the client opens a new scanner.

Note: Do not retain references to any Cells returned by scanner, beyond the life of this invocation. If need a Cell reference for later use, copy the cell and use that.

Specified by:

preScannerOpen in interface RegionObserver

Parameters:

e - the environment provided by the region server

scan - the Scan specification

Throws:

IOException

postInstantiateDeleteTracker

public DeleteTracker postInstantiateDeleteTracker(ObserverContext<RegionCoprocessorEnvironment> ctx,
                                                  DeleteTracker delTracker)
                                           throws IOException

Description copied from interface: RegionObserver

Called after the ScanQueryMatcher creates ScanDeleteTracker. Implementing this hook would help in creating customised DeleteTracker and returning the newly created DeleteTracker

Warn: This is used by internal coprocessors. Should not be implemented by user coprocessors

Specified by:

postInstantiateDeleteTracker in interface RegionObserver

Parameters:

ctx - the environment provided by the region server

delTracker - the deleteTracker that is created by the QueryMatcher

Returns:

the Delete Tracker

Throws:

IOException

postScannerOpen

public RegionScanner postScannerOpen(ObserverContext<RegionCoprocessorEnvironment> c,
                                     Scan scan,
                                     RegionScanner s)
                              throws IOException

Description copied from interface: RegionObserver

Called after the client opens a new scanner.

Note: Do not retain references to any Cells returned by scanner, beyond the life of this invocation. If need a Cell reference for later use, copy the cell and use that.

Specified by:

postScannerOpen in interface RegionObserver

Parameters:

c - the environment provided by the region server

scan - the Scan specification

s - if not null, the base scanner

Returns:

the scanner instance to use

Throws:

IOException

preScannerNext

public boolean preScannerNext(ObserverContext<RegionCoprocessorEnvironment> c,
                              InternalScanner s,
                              List<Result> result,
                              int limit,
                              boolean hasNext)
                       throws IOException

Description copied from interface: RegionObserver

Called before the client asks for the next row on a scanner.

Call CoprocessorEnvironment#bypass to skip default actions. If 'bypass' is set, we skip out on calling any subsequent chained coprocessors.

Note: Do not retain references to any Cells returned by scanner, beyond the life of this invocation. If need a Cell reference for later use, copy the cell and use that.

Specified by:

preScannerNext in interface RegionObserver

Parameters:

c - the environment provided by the region server

s - the scanner

result - The result to return to the client if default processing is bypassed. Can be modified. Will not be returned if default processing is not bypassed.

limit - the maximum number of results to return

hasNext - the 'has more' indication

Returns:

'has more' indication that should be sent to client

Throws:

IOException

preScannerClose

public void preScannerClose(ObserverContext<RegionCoprocessorEnvironment> c,
                            InternalScanner s)
                     throws IOException

Description copied from interface: RegionObserver

Called before the client closes a scanner.

Call CoprocessorEnvironment#bypass to skip default actions. If 'bypass' is set, we skip out on calling any subsequent chained coprocessors.

Specified by:

preScannerClose in interface RegionObserver

Parameters:

c - the environment provided by the region server

s - the scanner

Throws:

IOException

postScannerClose

public void postScannerClose(ObserverContext<RegionCoprocessorEnvironment> c,
                             InternalScanner s)
                      throws IOException

Description copied from interface: RegionObserver

Called after the client closes a scanner.

Specified by:

postScannerClose in interface RegionObserver

Parameters:

c - the environment provided by the region server

s - the scanner

Throws:

IOException

requireScannerOwner

private void requireScannerOwner(InternalScanner s)
                          throws AccessDeniedException

Verify, when servicing an RPC, that the caller is the scanner owner. If so, we assume that access control is correctly enforced based on the checks performed in preScannerOpen()

Throws:

AccessDeniedException

preGetOp

public void preGetOp(ObserverContext<RegionCoprocessorEnvironment> e,
                     Get get,
                     List<Cell> results)
              throws IOException

Description copied from interface: RegionObserver

Called before the client performs a Get

Call CoprocessorEnvironment#bypass to skip default actions. If 'bypass' is set, we skip out on calling any subsequent chained coprocessors.

Specified by:

preGetOp in interface RegionObserver

Parameters:

e - the environment provided by the region server

get - the Get request

results - The result to return to the client if default processing is bypassed. Can be modified. Will not be used if default processing is not bypassed.

Throws:

IOException

isSystemOrSuperUser

private boolean isSystemOrSuperUser()
                             throws IOException

Throws:

IOException

postIncrementBeforeWAL

public List<Pair<Cell,Cell>> postIncrementBeforeWAL(ObserverContext<RegionCoprocessorEnvironment> ctx,
                                                    Mutation mutation,
                                                    List<Pair<Cell,Cell>> cellPairs)
                                             throws IOException

Description copied from interface: RegionObserver

Called after a list of new cells has been created during an increment operation, but before they are committed to the WAL or memstore.

Specified by:

postIncrementBeforeWAL in interface RegionObserver

Parameters:

ctx - the environment provided by the region server

mutation - the current mutation

cellPairs - a list of cell pair. The first cell is old cell which may be null. And the second cell is the new cell.

Returns:

a list of cell pair, possibly changed.

Throws:

IOException

postAppendBeforeWAL

public List<Pair<Cell,Cell>> postAppendBeforeWAL(ObserverContext<RegionCoprocessorEnvironment> ctx,
                                                 Mutation mutation,
                                                 List<Pair<Cell,Cell>> cellPairs)
                                          throws IOException

Description copied from interface: RegionObserver

Called after a list of new cells has been created during an append operation, but before they are committed to the WAL or memstore.

Specified by:

postAppendBeforeWAL in interface RegionObserver

Parameters:

ctx - the environment provided by the region server

mutation - the current mutation

cellPairs - a list of cell pair. The first cell is old cell which may be null. And the second cell is the new cell.

Returns:

a list of cell pair, possibly changed.

Throws:

IOException

createNewCellWithTags

private Cell createNewCellWithTags(Mutation mutation,
                                   Cell newCell)
                            throws IOException

Throws:

IOException

addLabels

public void addLabels(com.google.protobuf.RpcController controller,
                      org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsRequest request,
                      com.google.protobuf.RpcCallback<org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsResponse> done)

VisibilityEndpoint service related methods

Specified by:

addLabels in interface org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsService.Interface

setExceptionResults

private void setExceptionResults(int size,
                                 IOException e,
                                 org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsResponse.Builder response)

setAuths

public void setAuths(com.google.protobuf.RpcController controller,
                     org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.SetAuthsRequest request,
                     com.google.protobuf.RpcCallback<org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsResponse> done)

Specified by:

setAuths in interface org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsService.Interface

logResult

private void logResult(boolean isAllowed,
                       String request,
                       String reason,
                       byte[] user,
                       List<byte[]> labelAuths,
                       String regex)

getAuths

public void getAuths(com.google.protobuf.RpcController controller,
                     org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.GetAuthsRequest request,
                     com.google.protobuf.RpcCallback<org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.GetAuthsResponse> done)

Specified by:

getAuths in interface org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsService.Interface

clearAuths

public void clearAuths(com.google.protobuf.RpcController controller,
                       org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.SetAuthsRequest request,
                       com.google.protobuf.RpcCallback<org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsResponse> done)

Specified by:

clearAuths in interface org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsService.Interface

listLabels

public void listLabels(com.google.protobuf.RpcController controller,
                       org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.ListLabelsRequest request,
                       com.google.protobuf.RpcCallback<org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.ListLabelsResponse> done)

Specified by:

listLabels in interface org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsService.Interface

checkCallingUserAuth

private void checkCallingUserAuth()
                           throws IOException

Throws:

IOException

buildException

private static org.apache.hadoop.hbase.protobuf.generated.HBaseProtos.NameBytesPair buildException(Throwable t)

n * @return NameValuePair of the exception name to stringified version os exception.