Return-Path: X-Original-To: apmail-hadoop-common-commits-archive@www.apache.org Delivered-To: apmail-hadoop-common-commits-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id D9DF210AFE for ; Thu, 15 Jan 2015 02:04:39 +0000 (UTC) Received: (qmail 86886 invoked by uid 500); 15 Jan 2015 02:04:41 -0000 Delivered-To: apmail-hadoop-common-commits-archive@hadoop.apache.org Received: (qmail 86825 invoked by uid 500); 15 Jan 2015 02:04:41 -0000 Mailing-List: contact common-commits-help@hadoop.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: common-dev@hadoop.apache.org Delivered-To: mailing list common-commits@hadoop.apache.org Received: (qmail 86816 invoked by uid 99); 15 Jan 2015 02:04:41 -0000 Received: from tyr.zones.apache.org (HELO tyr.zones.apache.org) (140.211.11.114) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 15 Jan 2015 02:04:41 +0000 Received: by tyr.zones.apache.org (Postfix, from userid 65534) id CA9B9A433D9; Thu, 15 Jan 2015 02:04:40 +0000 (UTC) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: cmccabe@apache.org To: common-commits@hadoop.apache.org Message-Id: <119f5a3609364f27b99c0f51b179bbce@git.apache.org> X-Mailer: ASF-Git Admin Mailer Subject: hadoop git commit: HDFS-7067. ClassCastException while using a key created by keytool to create encryption zone. (Charles Lamb via Colin P. McCabe) Date: Thu, 15 Jan 2015 02:04:40 +0000 (UTC) Repository: hadoop Updated Branches: refs/heads/branch-2 80f2c41ea -> e6a251ff6 HDFS-7067. ClassCastException while using a key created by keytool to create encryption zone. (Charles Lamb via Colin P. McCabe) (cherry picked from commit a5a033c7ca130528f8c509b035fc090ad4eb981a) Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/e6a251ff Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/e6a251ff Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/e6a251ff Branch: refs/heads/branch-2 Commit: e6a251ff687be7e859934de7278c138dcd95e91f Parents: 80f2c41 Author: Colin Patrick Mccabe Authored: Wed Jan 14 17:42:59 2015 -0800 Committer: Colin Patrick Mccabe Committed: Wed Jan 14 18:04:32 2015 -0800 ---------------------------------------------------------------------- hadoop-common-project/hadoop-common/CHANGES.txt | 3 ++ .../hadoop/crypto/key/JavaKeyStoreProvider.java | 5 +- .../crypto/key/TestKeyProviderFactory.java | 48 +++++++++++++++++++ .../src/test/resources/hdfs7067.keystore | Bin 0 -> 6067 bytes 4 files changed, 55 insertions(+), 1 deletion(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/hadoop/blob/e6a251ff/hadoop-common-project/hadoop-common/CHANGES.txt ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt index 71a0530..4a24c19 100644 --- a/hadoop-common-project/hadoop-common/CHANGES.txt +++ b/hadoop-common-project/hadoop-common/CHANGES.txt @@ -115,6 +115,9 @@ Release 2.7.0 - UNRELEASED HADOOP-11465. Fix findbugs warnings in hadoop-gridmix. (Varun Saxena via Arpit Agarwal) + HADOOP-11481. ClassCastException while using a key created by keytool to + create encryption zone. (Charles Lamb via Colin P. McCabe) + OPTIMIZATIONS HADOOP-11323. WritableComparator#compare keeps reference to byte array. http://git-wip-us.apache.org/repos/asf/hadoop/blob/e6a251ff/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java index a9738ba..bfec1ef 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java @@ -21,7 +21,6 @@ package org.apache.hadoop.crypto.key; import com.google.common.base.Preconditions; import org.apache.commons.io.IOUtils; import org.apache.hadoop.classification.InterfaceAudience; -import org.apache.hadoop.classification.InterfaceAudience.Private; import org.apache.hadoop.conf.Configuration; import org.apache.hadoop.fs.FSDataOutputStream; import org.apache.hadoop.fs.FileStatus; @@ -401,6 +400,10 @@ public class JavaKeyStoreProvider extends KeyProvider { Metadata meta = ((KeyMetadata) keyStore.getKey(name, password)).metadata; cache.put(name, meta); return meta; + } catch (ClassCastException e) { + throw new IOException("Can't cast key for " + name + " in keystore " + + path + " to a KeyMetadata. Key may have been added using " + + " keytool or some other non-Hadoop method.", e); } catch (KeyStoreException e) { throw new IOException("Can't get metadata for " + name + " from keystore " + path, e); http://git-wip-us.apache.org/repos/asf/hadoop/blob/e6a251ff/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/crypto/key/TestKeyProviderFactory.java ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/crypto/key/TestKeyProviderFactory.java b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/crypto/key/TestKeyProviderFactory.java index 998cd6f..ef09d94 100644 --- a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/crypto/key/TestKeyProviderFactory.java +++ b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/crypto/key/TestKeyProviderFactory.java @@ -42,6 +42,7 @@ import static org.junit.Assert.assertArrayEquals; import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertTrue; import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.fail; public class TestKeyProviderFactory { @@ -430,4 +431,51 @@ public class TestKeyProviderFactory { Assert.assertNull(kp); } + + @Test + public void testJksProviderWithKeytoolKeys() throws Exception { + final Configuration conf = new Configuration(); + final String keystoreDirAbsolutePath = + conf.getResource("hdfs7067.keystore").getPath(); + final String ourUrl = JavaKeyStoreProvider.SCHEME_NAME + "://file@/" + + keystoreDirAbsolutePath; + + conf.set(KeyProviderFactory.KEY_PROVIDER_PATH, ourUrl); + + final KeyProvider provider = KeyProviderFactory.getProviders(conf).get(0); + + // Sanity check that we are using the right keystore + @SuppressWarnings("unused") + final KeyProvider.KeyVersion keyVersion = + provider.getKeyVersion("testkey5@0"); + try { + @SuppressWarnings("unused") + final KeyProvider.KeyVersion keyVersionWrongKeyNameFormat = + provider.getKeyVersion("testkey2"); + fail("should have thrown an exception"); + } catch (IOException e) { + // No version in key path testkey2/ + GenericTestUtils.assertExceptionContains("No version in key path", e); + } + try { + @SuppressWarnings("unused") + final KeyProvider.KeyVersion keyVersionCurrentKeyNotWrongKeyNameFormat = + provider.getCurrentKey("testkey5@0"); + fail("should have thrown an exception getting testkey5@0"); + } catch (IOException e) { + // javax.crypto.spec.SecretKeySpec cannot be cast to + // org.apache.hadoop.crypto.key.JavaKeyStoreProvider$KeyMetadata + GenericTestUtils.assertExceptionContains("other non-Hadoop method", e); + } + try { + @SuppressWarnings("unused") + KeyProvider.KeyVersion keyVersionCurrentKeyNotReally = + provider.getCurrentKey("testkey2"); + fail("should have thrown an exception getting testkey2"); + } catch (IOException e) { + // javax.crypto.spec.SecretKeySpec cannot be cast to + // org.apache.hadoop.crypto.key.JavaKeyStoreProvider$KeyMetadata + GenericTestUtils.assertExceptionContains("other non-Hadoop method", e); + } + } } http://git-wip-us.apache.org/repos/asf/hadoop/blob/e6a251ff/hadoop-common-project/hadoop-common/src/test/resources/hdfs7067.keystore ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/src/test/resources/hdfs7067.keystore b/hadoop-common-project/hadoop-common/src/test/resources/hdfs7067.keystore new file mode 100644 index 0000000..a0a69b1 Binary files /dev/null and b/hadoop-common-project/hadoop-common/src/test/resources/hdfs7067.keystore differ