[
https://issues.apache.org/jira/browse/HDFS-7077?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrew Wang updated HDFS-7077:
------------------------------
Attachment: hdfs-7077.001.patch
Patch attached. The main thing is using EncryptionProtocolVersion rather than
trying to arbitrate based on the CipherSuite. Now, the CipherSuite is simply
chosen based on the provided EZ key, and clients all need to use that
CipherSuite.
On write, the client provides its supported protocol versions. The NN chooses
among these based on the encryption zone, throwing an exception if the client
doesn't support the EZ's version. On read, the client checks the protocol
version of the file and throws an exception if it doesn't support it.
There are also a few other changes. I renamed the CipherSuite proto to
CipherSuiteProto to make a static import possible. The CryptoCodec factory
method was also throwing a runtime exception if the requested codec could not
be created, which is counter to the javadoc and also an extreme response.
> Separate CipherSuite from crypto protocol version
> -------------------------------------------------
>
> Key: HDFS-7077
> URL: https://issues.apache.org/jira/browse/HDFS-7077
> Project: Hadoop HDFS
> Issue Type: Sub-task
> Components: encryption
> Affects Versions: 2.6.0
> Reporter: Andrew Wang
> Assignee: Andrew Wang
> Attachments: hdfs-7077.001.patch
>
>
> Right now the CipherSuite is used for protocol version negotiation, which is
> wrong. We need to separate it out. An EZ should be locked to a certain
> CipherSuite and protocol version. A client reading and writing to the EZ then
> needs to negotiate based on both of these parameters.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
