Repository: ranger Updated Branches: refs/heads/ranger-0.7 48fd2586e -> 1de5cab13
RANGER-1505 - Remove KeyProtector code in KMS Signed-off-by: Colm O hEigeartaigh <cohei...@apache.org> Project: http://git-wip-us.apache.org/repos/asf/ranger/repo Commit: http://git-wip-us.apache.org/repos/asf/ranger/commit/13f17952 Tree: http://git-wip-us.apache.org/repos/asf/ranger/tree/13f17952 Diff: http://git-wip-us.apache.org/repos/asf/ranger/diff/13f17952 Branch: refs/heads/ranger-0.7 Commit: 13f17952d9a6869307b10b6dba73001ffd33ee8e Parents: 48fd258 Author: Colm O hEigeartaigh <cohei...@apache.org> Authored: Mon Apr 10 12:23:38 2017 +0100 Committer: Pradeep <prad...@apache.org> Committed: Wed Sep 26 21:14:42 2018 +0530 ---------------------------------------------------------------------- .../hadoop/crypto/key/RangerKeyStore.java | 104 ++++++++++++++----- 1 file changed, 79 insertions(+), 25 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/ranger/blob/13f17952/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java ---------------------------------------------------------------------- diff --git a/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java b/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java index 4b1b9bb..018ead5 100644 --- a/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java +++ b/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java @@ -26,11 +26,13 @@ import java.io.InputStream; import java.io.ObjectInputStream; import java.io.ObjectOutputStream; import java.io.OutputStream; +import java.io.Serializable; import java.io.UnsupportedEncodingException; import java.lang.reflect.Constructor; import java.lang.reflect.Field; import java.lang.reflect.InvocationTargetException; import java.lang.reflect.Method; +import java.security.AlgorithmParameters; import java.security.DigestInputStream; import java.security.DigestOutputStream; import java.security.Key; @@ -39,6 +41,7 @@ import java.security.KeyStoreException; import java.security.KeyStoreSpi; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; +import java.security.SecureRandom; import java.security.UnrecoverableKeyException; import java.security.cert.Certificate; import java.security.cert.CertificateException; @@ -49,7 +52,13 @@ import java.util.List; import java.util.regex.Matcher; import java.util.regex.Pattern; +import javax.crypto.Cipher; +import javax.crypto.IllegalBlockSizeException; import javax.crypto.SealedObject; +import javax.crypto.SecretKey; +import javax.crypto.SecretKeyFactory; +import javax.crypto.spec.PBEKeySpec; +import javax.crypto.spec.PBEParameterSpec; import javax.xml.bind.DatatypeConverter; import org.apache.hadoop.crypto.key.KeyProvider.Metadata; @@ -111,17 +120,9 @@ public class RangerKeyStore extends KeyStoreSpi { return null; } - Class<?> c = null; - Object o = null; try { - c = Class.forName("com.sun.crypto.provider.KeyProtector"); - Constructor<?> constructor = c.getDeclaredConstructor(char[].class); - constructor.setAccessible(true); - o = constructor.newInstance(password); - Method m = c.getDeclaredMethod("unseal", SealedObject.class); - m.setAccessible(true); - key = (Key) m.invoke(o, ((SecretKeyEntry)entry).sealedKey); - } catch (ClassNotFoundException | NoSuchMethodException | SecurityException | InstantiationException | IllegalAccessException | IllegalArgumentException | InvocationTargetException e) { + key = unsealKey(((SecretKeyEntry)entry).sealedKey, password); + } catch (Exception e) { logger.error(e.getMessage()); } return key; @@ -147,22 +148,9 @@ public class RangerKeyStore extends KeyStoreSpi { SecretKeyEntry entry = new SecretKeyEntry(); synchronized(deltaEntries) { try { - Class<?> c = null; - Object o = null; - try { - c = Class.forName("com.sun.crypto.provider.KeyProtector"); - Constructor<?> constructor = c.getDeclaredConstructor(char[].class); - constructor.setAccessible(true); - o = constructor.newInstance(password); - } catch (ClassNotFoundException | NoSuchMethodException | SecurityException | InstantiationException | IllegalAccessException | IllegalArgumentException | InvocationTargetException e) { - logger.error(e.getMessage()); - throw new KeyStoreException(e.getMessage()); - } entry.date = new Date(); // seal and store the key - Method m = c.getDeclaredMethod("seal", Key.class); - m.setAccessible(true); - entry.sealedKey = (SealedObject) m.invoke(o, key); + entry.sealedKey = sealKey(key, password); entry.cipher_field = cipher; entry.bit_length = bitLength; @@ -185,6 +173,47 @@ public class RangerKeyStore extends KeyStoreSpi { } } + private SealedObject sealKey(Key key, char[] password) throws Exception { + // Create SecretKey + SecretKeyFactory secretKeyFactory = SecretKeyFactory.getInstance("PBEWithMD5AndTripleDES"); + PBEKeySpec pbeKeySpec = new PBEKeySpec(password); + SecretKey secretKey = secretKeyFactory.generateSecret(pbeKeySpec); + pbeKeySpec.clearPassword(); + + // Generate random bytes + set up the PBEParameterSpec + SecureRandom random = new SecureRandom(); + byte[] salt = new byte[8]; + random.nextBytes(salt); + PBEParameterSpec pbeSpec = new PBEParameterSpec(salt, 20); + + // Seal the Key + Cipher cipher = Cipher.getInstance("PBEWithMD5AndTripleDES"); + cipher.init(Cipher.ENCRYPT_MODE, secretKey, pbeSpec); + return new RangerSealedObject(key, cipher); + } + + private Key unsealKey(SealedObject sealedKey, char[] password) throws Exception { + // Create SecretKey + SecretKeyFactory secretKeyFactory = SecretKeyFactory.getInstance("PBEWithMD5AndTripleDES"); + PBEKeySpec pbeKeySpec = new PBEKeySpec(password); + SecretKey secretKey = secretKeyFactory.generateSecret(pbeKeySpec); + pbeKeySpec.clearPassword(); + + // Get the AlgorithmParameters from RangerSealedObject + AlgorithmParameters algorithmParameters = null; + if (sealedKey instanceof RangerSealedObject) { + algorithmParameters = ((RangerSealedObject)sealedKey).getParameters(); + } else { + algorithmParameters = new RangerSealedObject(sealedKey).getParameters(); + } + + // Unseal the Key + Cipher cipher = Cipher.getInstance("PBEWithMD5AndTripleDES"); + cipher.init(Cipher.DECRYPT_MODE, secretKey, algorithmParameters); + + return (Key)sealedKey.getObject(cipher); + } + @Override public void engineDeleteEntry(String alias) throws KeyStoreException @@ -599,5 +628,30 @@ public class RangerKeyStore extends KeyStoreSpi { public void clearDeltaEntires(){ deltaEntries.clear(); } - + + /** + * Encapsulate the encrypted key, so that we can retrieve the AlgorithmParameters object on the decryption side + */ + private static class RangerSealedObject extends SealedObject { + + /** + * + */ + private static final long serialVersionUID = -7551578543434362070L; + + protected RangerSealedObject(SealedObject so) { + super(so); + } + + protected RangerSealedObject(Serializable object, Cipher cipher) throws IllegalBlockSizeException, IOException { + super(object, cipher); + } + + public AlgorithmParameters getParameters() throws NoSuchAlgorithmException, IOException { + AlgorithmParameters algorithmParameters = AlgorithmParameters.getInstance("PBEWithMD5AndTripleDES"); + algorithmParameters.init(super.encodedParams); + return algorithmParameters; + } + + } }