Package org.apache.hadoop.hdfs.protocol.datatransfer.sasl

Class DataTransferSaslUtil

java.lang.Object

org.apache.hadoop.hdfs.protocol.datatransfer.sasl.DataTransferSaslUtil

@Private
public final class DataTransferSaslUtil
extends java.lang.Object

Utility methods implementing SASL negotiation for DataTransferProtocol.

Field Summary

Fields

Modifier and Type	Field	Description
static java.lang.String	NAME_DELIMITER	Delimiter for the three-part SASL username string.
static int	SASL_TRANSFER_MAGIC_NUMBER	Sent by clients and validated by servers.

Method Summary

Modifier and Type	Method	Description
static void	checkSaslComplete(org.apache.hadoop.hdfs.protocol.datatransfer.sasl.SaslParticipant sasl, java.util.Map<java.lang.String,java.lang.String> saslProps)	Checks that SASL negotiation has completed for the given participant, and the negotiated quality of protection is included in the given SASL properties and therefore acceptable.
static java.util.Map<java.lang.String,java.lang.String>	createSaslPropertiesForEncryption(java.lang.String encryptionAlgorithm)	Creates SASL properties required for an encrypted SASL negotiation.
static IOStreamPair	createStreamPair(org.apache.hadoop.conf.Configuration conf, org.apache.hadoop.crypto.CipherOption cipherOption, java.io.OutputStream out, java.io.InputStream in, boolean isServer)	Create IOStreamPair of CryptoInputStream and CryptoOutputStream
static char[]	encryptionKeyToPassword(byte[] encryptionKey)	For an encrypted SASL negotiation, encodes an encryption key to a SASL password.
static java.net.InetAddress	getPeerAddress(Peer peer)	Returns InetAddress from peer.
static org.apache.hadoop.security.SaslPropertiesResolver	getSaslPropertiesResolver(org.apache.hadoop.conf.Configuration conf)	Creates a SaslPropertiesResolver from the given configuration.
static org.apache.hadoop.crypto.CipherOption	negotiateCipherOption(org.apache.hadoop.conf.Configuration conf, java.util.List<org.apache.hadoop.crypto.CipherOption> options)	Negotiate a cipher option which server supports.
static byte[]	readSaslMessage(java.io.InputStream in)	Reads a SASL negotiation message.
static SaslResponseWithNegotiatedCipherOption	readSaslMessageAndNegotiatedCipherOption(java.io.InputStream in)	Read SASL message and negotiated cipher option from server.
static byte[]	readSaslMessageAndNegotiationCipherOptions(java.io.InputStream in, java.util.List<org.apache.hadoop.crypto.CipherOption> cipherOptions)	Reads a SASL negotiation message and negotiation cipher options.
static org.apache.hadoop.hdfs.protocol.datatransfer.sasl.DataTransferSaslUtil.SaslMessageWithHandshake	readSaslMessageWithHandshakeSecret(java.io.InputStream in)
static boolean	requestedQopContainsPrivacy(java.util.Map<java.lang.String,java.lang.String> saslProps)	Check whether requested SASL Qop contains privacy.
static void	sendGenericSaslErrorMessage(java.io.OutputStream out, java.lang.String message)	Sends a SASL negotiation message indicating an error.
static void	sendSaslMessage(java.io.OutputStream out, byte[] payload)	Sends a SASL negotiation message.
static void	sendSaslMessage(java.io.OutputStream out, org.apache.hadoop.hdfs.protocol.proto.DataTransferProtos.DataTransferEncryptorMessageProto.DataTransferEncryptorStatus status, byte[] payload, java.lang.String message)	Sends a SASL negotiation message.
static void	sendSaslMessage(java.io.OutputStream out, org.apache.hadoop.hdfs.protocol.proto.DataTransferProtos.DataTransferEncryptorMessageProto.DataTransferEncryptorStatus status, byte[] payload, java.lang.String message, org.apache.hadoop.hdfs.protocol.proto.DataTransferProtos.HandshakeSecretProto handshakeSecret)
static void	sendSaslMessage(java.io.OutputStream out, org.apache.hadoop.hdfs.protocol.proto.DataTransferProtos.DataTransferEncryptorMessageProto.DataTransferEncryptorStatus status, byte[] payload, java.lang.String message, org.apache.hadoop.hdfs.protocol.proto.DataTransferProtos.HandshakeSecretProto handshakeSecret, boolean accessTokenError)
static void	sendSaslMessageAndNegotiatedCipherOption(java.io.OutputStream out, byte[] payload, org.apache.hadoop.crypto.CipherOption option)	Send SASL message and negotiated cipher option to client.
static void	sendSaslMessageAndNegotiationCipherOptions(java.io.OutputStream out, byte[] payload, java.util.List<org.apache.hadoop.crypto.CipherOption> options)	Send a SASL negotiation message and negotiation cipher options to server.
static void	sendSaslMessageHandshakeSecret(java.io.OutputStream out, byte[] payload, byte[] secret, java.lang.String bpid)
static void	sendSaslMessageHandshakeSecret(java.io.OutputStream out, org.apache.hadoop.hdfs.protocol.proto.DataTransferProtos.DataTransferEncryptorMessageProto.DataTransferEncryptorStatus status, byte[] payload, java.lang.String message, byte[] secret, java.lang.String bpid)
static org.apache.hadoop.crypto.CipherOption	unwrap(org.apache.hadoop.crypto.CipherOption option, org.apache.hadoop.hdfs.protocol.datatransfer.sasl.SaslParticipant sasl)	Decrypt the key and iv of the negotiated cipher option.
static org.apache.hadoop.crypto.CipherOption	wrap(org.apache.hadoop.crypto.CipherOption option, org.apache.hadoop.hdfs.protocol.datatransfer.sasl.SaslParticipant sasl)	Encrypt the key and iv of the negotiated cipher option.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

NAME_DELIMITER

public static final java.lang.String NAME_DELIMITER

Delimiter for the three-part SASL username string.

See Also:

Constant Field Values

SASL_TRANSFER_MAGIC_NUMBER

public static final int SASL_TRANSFER_MAGIC_NUMBER

Sent by clients and validated by servers. We use a number that's unlikely to ever be sent as the value of the DATA_TRANSFER_VERSION.

See Also:

Constant Field Values

Method Detail

checkSaslComplete

public static void checkSaslComplete(org.apache.hadoop.hdfs.protocol.datatransfer.sasl.SaslParticipant sasl,
                                     java.util.Map<java.lang.String,java.lang.String> saslProps)
                              throws java.io.IOException

Checks that SASL negotiation has completed for the given participant, and the negotiated quality of protection is included in the given SASL properties and therefore acceptable.

Parameters:

sasl - participant to check

saslProps - properties of SASL negotiation

Throws:

java.io.IOException - for any error

requestedQopContainsPrivacy

public static boolean requestedQopContainsPrivacy(java.util.Map<java.lang.String,java.lang.String> saslProps)

Check whether requested SASL Qop contains privacy.

Parameters:

saslProps - properties of SASL negotiation

Returns:

boolean true if privacy exists

createSaslPropertiesForEncryption

public static java.util.Map<java.lang.String,java.lang.String> createSaslPropertiesForEncryption(java.lang.String encryptionAlgorithm)

Creates SASL properties required for an encrypted SASL negotiation.

Parameters:

encryptionAlgorithm - to use for SASL negotation

Returns:

properties of encrypted SASL negotiation

encryptionKeyToPassword

public static char[] encryptionKeyToPassword(byte[] encryptionKey)

For an encrypted SASL negotiation, encodes an encryption key to a SASL password.

Parameters:

encryptionKey - to encode

Returns:

key encoded as SASL password

getPeerAddress

public static java.net.InetAddress getPeerAddress(Peer peer)

Returns InetAddress from peer. The getRemoteAddressString has the form [host][/ip-address]:port. The host may be missing. The IP address (and preceding '/') may be missing. The port preceded by ':' is always present.

Returns:

InetAddress from peer

getSaslPropertiesResolver

public static org.apache.hadoop.security.SaslPropertiesResolver getSaslPropertiesResolver(org.apache.hadoop.conf.Configuration conf)

Creates a SaslPropertiesResolver from the given configuration. This method works by cloning the configuration, translating configuration properties specific to DataTransferProtocol to what SaslPropertiesResolver expects, and then delegating to SaslPropertiesResolver for initialization. This method returns null if SASL protection has not been configured for DataTransferProtocol.

Parameters:

conf - configuration to read

Returns:

SaslPropertiesResolver for DataTransferProtocol, or null if not configured

readSaslMessage

public static byte[] readSaslMessage(java.io.InputStream in)
                              throws java.io.IOException

Reads a SASL negotiation message.

Parameters:

in - stream to read

Returns:

bytes of SASL negotiation messsage

Throws:

java.io.IOException - for any error

readSaslMessageAndNegotiationCipherOptions

public static byte[] readSaslMessageAndNegotiationCipherOptions(java.io.InputStream in,
                                                                java.util.List<org.apache.hadoop.crypto.CipherOption> cipherOptions)
                                                         throws java.io.IOException

Reads a SASL negotiation message and negotiation cipher options.

Parameters:

in - stream to read

cipherOptions - list to store negotiation cipher options

Returns:

byte[] SASL negotiation message

Throws:

java.io.IOException - for any error

readSaslMessageWithHandshakeSecret

public static org.apache.hadoop.hdfs.protocol.datatransfer.sasl.DataTransferSaslUtil.SaslMessageWithHandshake readSaslMessageWithHandshakeSecret(java.io.InputStream in)
                                                                                                                                          throws java.io.IOException

Throws:

java.io.IOException

negotiateCipherOption

public static org.apache.hadoop.crypto.CipherOption negotiateCipherOption(org.apache.hadoop.conf.Configuration conf,
                                                                          java.util.List<org.apache.hadoop.crypto.CipherOption> options)
                                                                   throws java.io.IOException

Negotiate a cipher option which server supports.

Parameters:

conf - the configuration

options - the cipher options which client supports

Returns:

CipherOption negotiated cipher option

Throws:

java.io.IOException

sendSaslMessageAndNegotiatedCipherOption

public static void sendSaslMessageAndNegotiatedCipherOption(java.io.OutputStream out,
                                                            byte[] payload,
                                                            org.apache.hadoop.crypto.CipherOption option)
                                                     throws java.io.IOException

Send SASL message and negotiated cipher option to client.

Parameters:

out - stream to receive message

payload - to send

option - negotiated cipher option

Throws:

java.io.IOException - for any error

createStreamPair

public static IOStreamPair createStreamPair(org.apache.hadoop.conf.Configuration conf,
                                            org.apache.hadoop.crypto.CipherOption cipherOption,
                                            java.io.OutputStream out,
                                            java.io.InputStream in,
                                            boolean isServer)
                                     throws java.io.IOException

Create IOStreamPair of CryptoInputStream and CryptoOutputStream

Parameters:

conf - the configuration

cipherOption - negotiated cipher option

out - underlying output stream

in - underlying input stream

isServer - is server side

Returns:

IOStreamPair the stream pair

Throws:

java.io.IOException - for any error

sendGenericSaslErrorMessage

public static void sendGenericSaslErrorMessage(java.io.OutputStream out,
                                               java.lang.String message)
                                        throws java.io.IOException

Sends a SASL negotiation message indicating an error.

Parameters:

out - stream to receive message

message - to send

Throws:

java.io.IOException - for any error

sendSaslMessage

public static void sendSaslMessage(java.io.OutputStream out,
                                   byte[] payload)
                            throws java.io.IOException

Sends a SASL negotiation message.

Parameters:

out - stream to receive message

payload - to send

Throws:

java.io.IOException - for any error

sendSaslMessageHandshakeSecret

public static void sendSaslMessageHandshakeSecret(java.io.OutputStream out,
                                                  byte[] payload,
                                                  byte[] secret,
                                                  java.lang.String bpid)
                                           throws java.io.IOException

Throws:

java.io.IOException

sendSaslMessageAndNegotiationCipherOptions

public static void sendSaslMessageAndNegotiationCipherOptions(java.io.OutputStream out,
                                                              byte[] payload,
                                                              java.util.List<org.apache.hadoop.crypto.CipherOption> options)
                                                       throws java.io.IOException

Send a SASL negotiation message and negotiation cipher options to server.

Parameters:

out - stream to receive message

payload - to send

options - cipher options to negotiate

Throws:

java.io.IOException - for any error

readSaslMessageAndNegotiatedCipherOption

public static SaslResponseWithNegotiatedCipherOption readSaslMessageAndNegotiatedCipherOption(java.io.InputStream in)
                                                                                       throws java.io.IOException

Read SASL message and negotiated cipher option from server.

Parameters:

in - stream to read

Returns:

SaslResponseWithNegotiatedCipherOption SASL message and negotiated cipher option

Throws:

java.io.IOException - for any error

wrap

public static org.apache.hadoop.crypto.CipherOption wrap(org.apache.hadoop.crypto.CipherOption option,
                                                         org.apache.hadoop.hdfs.protocol.datatransfer.sasl.SaslParticipant sasl)
                                                  throws java.io.IOException

Encrypt the key and iv of the negotiated cipher option.

Parameters:

option - negotiated cipher option

sasl - SASL participant representing server

Returns:

CipherOption negotiated cipher option which contains the encrypted key and iv

Throws:

java.io.IOException - for any error

unwrap

public static org.apache.hadoop.crypto.CipherOption unwrap(org.apache.hadoop.crypto.CipherOption option,
                                                           org.apache.hadoop.hdfs.protocol.datatransfer.sasl.SaslParticipant sasl)
                                                    throws java.io.IOException

Decrypt the key and iv of the negotiated cipher option.

Parameters:

option - negotiated cipher option

sasl - SASL participant representing client

Returns:

CipherOption negotiated cipher option which contains the decrypted key and iv

Throws:

java.io.IOException - for any error

sendSaslMessage

public static void sendSaslMessage(java.io.OutputStream out,
                                   org.apache.hadoop.hdfs.protocol.proto.DataTransferProtos.DataTransferEncryptorMessageProto.DataTransferEncryptorStatus status,
                                   byte[] payload,
                                   java.lang.String message)
                            throws java.io.IOException

Sends a SASL negotiation message.

Parameters:

out - stream to receive message

status - negotiation status

payload - to send

message - to send

Throws:

java.io.IOException - for any error

sendSaslMessage

public static void sendSaslMessage(java.io.OutputStream out,
                                   org.apache.hadoop.hdfs.protocol.proto.DataTransferProtos.DataTransferEncryptorMessageProto.DataTransferEncryptorStatus status,
                                   byte[] payload,
                                   java.lang.String message,
                                   org.apache.hadoop.hdfs.protocol.proto.DataTransferProtos.HandshakeSecretProto handshakeSecret)
                            throws java.io.IOException

Throws:

java.io.IOException

sendSaslMessage

public static void sendSaslMessage(java.io.OutputStream out,
                                   org.apache.hadoop.hdfs.protocol.proto.DataTransferProtos.DataTransferEncryptorMessageProto.DataTransferEncryptorStatus status,
                                   byte[] payload,
                                   java.lang.String message,
                                   org.apache.hadoop.hdfs.protocol.proto.DataTransferProtos.HandshakeSecretProto handshakeSecret,
                                   boolean accessTokenError)
                            throws java.io.IOException

Throws:

java.io.IOException

sendSaslMessageHandshakeSecret

public static void sendSaslMessageHandshakeSecret(java.io.OutputStream out,
                                                  org.apache.hadoop.hdfs.protocol.proto.DataTransferProtos.DataTransferEncryptorMessageProto.DataTransferEncryptorStatus status,
                                                  byte[] payload,
                                                  java.lang.String message,
                                                  byte[] secret,
                                                  java.lang.String bpid)
                                           throws java.io.IOException

Throws:

java.io.IOException