001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software
013 * distributed under the License is distributed on an "AS IS" BASIS,
014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
015 * See the License for the specific language governing permissions and
016 * limitations under the License.
017 */
018package org.apache.hadoop.hbase.util;
019
020import java.io.ByteArrayInputStream;
021import java.io.ByteArrayOutputStream;
022import java.io.IOException;
023import java.util.Map;
024import java.util.concurrent.ConcurrentHashMap;
025import org.apache.hadoop.conf.Configuration;
026import org.apache.hadoop.hbase.HBaseInterfaceAudience;
027import org.apache.hadoop.hbase.HConstants;
028import org.apache.hadoop.hbase.io.crypto.DefaultCipherProvider;
029import org.apache.hadoop.hbase.io.crypto.Encryption;
030import org.apache.hadoop.hbase.io.crypto.KeyStoreKeyProvider;
031import org.apache.hadoop.hbase.security.EncryptionUtil;
032import org.apache.yetus.audience.InterfaceAudience;
033import org.slf4j.Logger;
034import org.slf4j.LoggerFactory;
035
036@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.TOOLS)
037public class EncryptionTest {
038  private static final Logger LOG = LoggerFactory.getLogger(EncryptionTest.class);
039
040  static final Map<String, Boolean> keyProviderResults = new ConcurrentHashMap<>();
041  static final Map<String, Boolean> cipherProviderResults = new ConcurrentHashMap<>();
042  static final Map<String, Boolean> cipherResults = new ConcurrentHashMap<>();
043
044  private EncryptionTest() {
045  }
046
047  /**
048   * Check that the configured key provider can be loaded and initialized, or throw an exception.
049   */
050  public static void testKeyProvider(final Configuration conf) throws IOException {
051    String providerClassName =
052      conf.get(HConstants.CRYPTO_KEYPROVIDER_CONF_KEY, KeyStoreKeyProvider.class.getName());
053    Boolean result = keyProviderResults.get(providerClassName);
054    if (result == null) {
055      try {
056        Encryption.getKeyProvider(conf);
057        keyProviderResults.put(providerClassName, true);
058      } catch (Exception e) { // most likely a RuntimeException
059        keyProviderResults.put(providerClassName, false);
060        throw new IOException(
061          "Key provider " + providerClassName + " failed test: " + e.getMessage(), e);
062      }
063    } else if (!result) {
064      throw new IOException("Key provider " + providerClassName + " previously failed test");
065    }
066  }
067
068  /**
069   * Check that the configured cipher provider can be loaded and initialized, or throw an exception.
070   */
071  public static void testCipherProvider(final Configuration conf) throws IOException {
072    String providerClassName =
073      conf.get(HConstants.CRYPTO_CIPHERPROVIDER_CONF_KEY, DefaultCipherProvider.class.getName());
074    Boolean result = cipherProviderResults.get(providerClassName);
075    if (result == null) {
076      try {
077        Encryption.getCipherProvider(conf);
078        cipherProviderResults.put(providerClassName, true);
079      } catch (Exception e) { // most likely a RuntimeException
080        cipherProviderResults.put(providerClassName, false);
081        throw new IOException(
082          "Cipher provider " + providerClassName + " failed test: " + e.getMessage(), e);
083      }
084    } else if (!result) {
085      throw new IOException("Cipher provider " + providerClassName + " previously failed test");
086    }
087  }
088
089  /**
090   * Check that the specified cipher can be loaded and initialized, or throw an exception. Verifies
091   * key and cipher provider configuration as a prerequisite for cipher verification. Also verifies
092   * if encryption is enabled globally.
093   * @param conf   HBase configuration
094   * @param cipher chiper algorith to use for the column family
095   * @param key    encryption key
096   * @throws IOException in case of encryption configuration error
097   */
098  public static void testEncryption(final Configuration conf, final String cipher, byte[] key)
099    throws IOException {
100    if (cipher == null) {
101      return;
102    }
103    if (!Encryption.isEncryptionEnabled(conf)) {
104      String message =
105        String.format("Cipher %s failed test: encryption is disabled on the cluster", cipher);
106      throw new IOException(message);
107    }
108    testKeyProvider(conf);
109    testCipherProvider(conf);
110    Boolean result = cipherResults.get(cipher);
111    if (result == null) {
112      try {
113        Encryption.Context context = Encryption.newContext(conf);
114        context.setCipher(Encryption.getCipher(conf, cipher));
115        if (key == null) {
116          // Make a random key since one was not provided
117          context.setKey(context.getCipher().getRandomKey());
118        } else {
119          // This will be a wrapped key from schema
120          context.setKey(EncryptionUtil.unwrapKey(conf,
121            conf.get(HConstants.CRYPTO_MASTERKEY_NAME_CONF_KEY, "hbase"), key));
122        }
123        byte[] iv = null;
124        if (context.getCipher().getIvLength() > 0) {
125          iv = new byte[context.getCipher().getIvLength()];
126          Bytes.secureRandom(iv);
127        }
128        byte[] plaintext = new byte[1024];
129        Bytes.random(plaintext);
130        ByteArrayOutputStream out = new ByteArrayOutputStream();
131        Encryption.encrypt(out, new ByteArrayInputStream(plaintext), context, iv);
132        byte[] ciphertext = out.toByteArray();
133        out.reset();
134        Encryption.decrypt(out, new ByteArrayInputStream(ciphertext), plaintext.length, context,
135          iv);
136        byte[] test = out.toByteArray();
137        if (!Bytes.equals(plaintext, test)) {
138          throw new IOException("Did not pass encrypt/decrypt test");
139        }
140        cipherResults.put(cipher, true);
141      } catch (Exception e) {
142        cipherResults.put(cipher, false);
143        throw new IOException("Cipher " + cipher + " failed test: " + e.getMessage(), e);
144      }
145    } else if (!result) {
146      throw new IOException("Cipher " + cipher + " previously failed test");
147    }
148  }
149}