Package org.apache.hadoop.hdfs.protocol.datatransfer.sasl

Class SaslDataTransferClient

java.lang.Object

org.apache.hadoop.hdfs.protocol.datatransfer.sasl.SaslDataTransferClient

@Private
public class SaslDataTransferClient
extends java.lang.Object

Negotiates SASL for DataTransferProtocol on behalf of a client. There are two possible supported variants of SASL negotiation: either a general-purpose negotiation supporting any quality of protection, or a specialized negotiation that enforces privacy as the quality of protection using a cryptographically strong encryption key. This class is used in both the HDFS client and the DataNode. The DataNode needs it, because it acts as a client to other DataNodes during write pipelines and block transfers.

Constructor Summary

Constructors

Constructor	Description
SaslDataTransferClient(org.apache.hadoop.conf.Configuration conf, org.apache.hadoop.security.SaslPropertiesResolver saslPropsResolver, TrustedChannelResolver trustedChannelResolver)	Creates a new SaslDataTransferClient.
SaslDataTransferClient(org.apache.hadoop.conf.Configuration conf, org.apache.hadoop.security.SaslPropertiesResolver saslPropsResolver, TrustedChannelResolver trustedChannelResolver, java.util.concurrent.atomic.AtomicBoolean fallbackToSimpleAuth)	Creates a new SaslDataTransferClient.

Method Summary

Modifier and Type	Method	Description
java.lang.String	getTargetQOP()
IOStreamPair	newSocketSend(java.net.Socket socket, java.io.OutputStream underlyingOut, java.io.InputStream underlyingIn, DataEncryptionKeyFactory encryptionKeyFactory, org.apache.hadoop.security.token.Token<BlockTokenIdentifier> accessToken, DatanodeID datanodeId)	Sends client SASL negotiation for a newly allocated socket if required.
Peer	peerSend(Peer peer, DataEncryptionKeyFactory encryptionKeyFactory, org.apache.hadoop.security.token.Token<BlockTokenIdentifier> accessToken, DatanodeID datanodeId)	Sends client SASL negotiation for a peer if required.
IOStreamPair	socketSend(java.net.Socket socket, java.io.OutputStream underlyingOut, java.io.InputStream underlyingIn, DataEncryptionKeyFactory encryptionKeyFactory, org.apache.hadoop.security.token.Token<BlockTokenIdentifier> accessToken, DatanodeID datanodeId)	Sends client SASL negotiation for a socket if required.
IOStreamPair	socketSend(java.net.Socket socket, java.io.OutputStream underlyingOut, java.io.InputStream underlyingIn, DataEncryptionKeyFactory encryptionKeyFactory, org.apache.hadoop.security.token.Token<BlockTokenIdentifier> accessToken, DatanodeID datanodeId, javax.crypto.SecretKey secretKey)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SaslDataTransferClient

public SaslDataTransferClient(org.apache.hadoop.conf.Configuration conf,
                              org.apache.hadoop.security.SaslPropertiesResolver saslPropsResolver,
                              TrustedChannelResolver trustedChannelResolver)

Creates a new SaslDataTransferClient. This constructor is used in cases where it is not relevant to track if a secure client did a fallback to simple auth. For intra-cluster connections between data nodes in the same cluster, we can assume that all run under the same security configuration.

Parameters:

conf - the configuration

saslPropsResolver - for determining properties of SASL negotiation

trustedChannelResolver - for identifying trusted connections that do not require SASL negotiation

SaslDataTransferClient

public SaslDataTransferClient(org.apache.hadoop.conf.Configuration conf,
                              org.apache.hadoop.security.SaslPropertiesResolver saslPropsResolver,
                              TrustedChannelResolver trustedChannelResolver,
                              java.util.concurrent.atomic.AtomicBoolean fallbackToSimpleAuth)

Creates a new SaslDataTransferClient.

Parameters:

conf - the configuration

saslPropsResolver - for determining properties of SASL negotiation

trustedChannelResolver - for identifying trusted connections that do not require SASL negotiation

fallbackToSimpleAuth - checked on each attempt at general SASL handshake, if true forces use of simple auth

Method Detail

newSocketSend

public IOStreamPair newSocketSend(java.net.Socket socket,
                                  java.io.OutputStream underlyingOut,
                                  java.io.InputStream underlyingIn,
                                  DataEncryptionKeyFactory encryptionKeyFactory,
                                  org.apache.hadoop.security.token.Token<BlockTokenIdentifier> accessToken,
                                  DatanodeID datanodeId)
                           throws java.io.IOException

Sends client SASL negotiation for a newly allocated socket if required.

Parameters:

socket - connection socket

underlyingOut - connection output stream

underlyingIn - connection input stream

encryptionKeyFactory - for creation of an encryption key

accessToken - connection block access token

datanodeId - ID of destination DataNode

Returns:

new pair of streams, wrapped after SASL negotiation

Throws:

java.io.IOException - for any error

peerSend

public Peer peerSend(Peer peer,
                     DataEncryptionKeyFactory encryptionKeyFactory,
                     org.apache.hadoop.security.token.Token<BlockTokenIdentifier> accessToken,
                     DatanodeID datanodeId)
              throws java.io.IOException

Sends client SASL negotiation for a peer if required.

Parameters:

peer - connection peer

encryptionKeyFactory - for creation of an encryption key

accessToken - connection block access token

datanodeId - ID of destination DataNode

Returns:

new pair of streams, wrapped after SASL negotiation

Throws:

java.io.IOException - for any error

socketSend

public IOStreamPair socketSend(java.net.Socket socket,
                               java.io.OutputStream underlyingOut,
                               java.io.InputStream underlyingIn,
                               DataEncryptionKeyFactory encryptionKeyFactory,
                               org.apache.hadoop.security.token.Token<BlockTokenIdentifier> accessToken,
                               DatanodeID datanodeId)
                        throws java.io.IOException

Sends client SASL negotiation for a socket if required.

Parameters:

socket - connection socket

underlyingOut - connection output stream

underlyingIn - connection input stream

encryptionKeyFactory - for creation of an encryption key

accessToken - connection block access token

datanodeId - ID of destination DataNode

Returns:

new pair of streams, wrapped after SASL negotiation

Throws:

java.io.IOException - for any error

socketSend

public IOStreamPair socketSend(java.net.Socket socket,
                               java.io.OutputStream underlyingOut,
                               java.io.InputStream underlyingIn,
                               DataEncryptionKeyFactory encryptionKeyFactory,
                               org.apache.hadoop.security.token.Token<BlockTokenIdentifier> accessToken,
                               DatanodeID datanodeId,
                               javax.crypto.SecretKey secretKey)
                        throws java.io.IOException

Throws:

java.io.IOException

getTargetQOP

@VisibleForTesting
public java.lang.String getTargetQOP()