View Javadoc

1   /**
2    * Licensed to the Apache Software Foundation (ASF) under one
3    * or more contributor license agreements.  See the NOTICE file
4    * distributed with this work for additional information
5    * regarding copyright ownership.  The ASF licenses this file
6    * to you under the Apache License, Version 2.0 (the
7    * "License"); you may not use this file except in compliance
8    * with the License.  You may obtain a copy of the License at
9    *
10   *     http://www.apache.org/licenses/LICENSE-2.0
11   *
12   * Unless required by applicable law or agreed to in writing, software
13   * distributed under the License is distributed on an "AS IS" BASIS,
14   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15   * See the License for the specific language governing permissions and
16   * limitations under the License.
17   */
18  package org.apache.hadoop.hbase.security.visibility;
19  
20  import static org.apache.hadoop.hbase.security.visibility.VisibilityConstants.LABELS_TABLE_NAME;
21  import static org.junit.Assert.assertArrayEquals;
22  import static org.junit.Assert.assertEquals;
23  import static org.junit.Assert.assertTrue;
24  
25  import java.io.IOException;
26  import java.security.PrivilegedExceptionAction;
27  import java.util.ArrayList;
28  import java.util.List;
29  import java.util.concurrent.atomic.AtomicInteger;
30  
31  import org.apache.commons.logging.Log;
32  import org.apache.commons.logging.LogFactory;
33  import org.apache.hadoop.conf.Configuration;
34  import org.apache.hadoop.hbase.Cell;
35  import org.apache.hadoop.hbase.CellScanner;
36  import org.apache.hadoop.hbase.CellUtil;
37  import org.apache.hadoop.hbase.HBaseConfiguration;
38  import org.apache.hadoop.hbase.HBaseTestingUtility;
39  import org.apache.hadoop.hbase.HColumnDescriptor;
40  import org.apache.hadoop.hbase.HConstants;
41  import org.apache.hadoop.hbase.HTableDescriptor;
42  import org.apache.hadoop.hbase.KeyValue;
43  import org.apache.hadoop.hbase.KeyValueUtil;
44  import org.apache.hadoop.hbase.testclassification.MediumTests;
45  import org.apache.hadoop.hbase.TableName;
46  import org.apache.hadoop.hbase.Tag;
47  import org.apache.hadoop.hbase.TagRewriteCell;
48  import org.apache.hadoop.hbase.TagType;
49  import org.apache.hadoop.hbase.client.Durability;
50  import org.apache.hadoop.hbase.client.Get;
51  import org.apache.hadoop.hbase.client.HBaseAdmin;
52  import org.apache.hadoop.hbase.client.HTable;
53  import org.apache.hadoop.hbase.client.Put;
54  import org.apache.hadoop.hbase.client.Result;
55  import org.apache.hadoop.hbase.client.ResultScanner;
56  import org.apache.hadoop.hbase.client.Scan;
57  import org.apache.hadoop.hbase.client.Table;
58  import org.apache.hadoop.hbase.client.replication.ReplicationAdmin;
59  import org.apache.hadoop.hbase.codec.KeyValueCodecWithTags;
60  import org.apache.hadoop.hbase.coprocessor.BaseRegionObserver;
61  import org.apache.hadoop.hbase.coprocessor.CoprocessorHost;
62  import org.apache.hadoop.hbase.coprocessor.ObserverContext;
63  import org.apache.hadoop.hbase.coprocessor.RegionCoprocessorEnvironment;
64  import org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsResponse;
65  import org.apache.hadoop.hbase.regionserver.wal.WALEdit;
66  import org.apache.hadoop.hbase.replication.ReplicationEndpoint;
67  import org.apache.hadoop.hbase.security.User;
68  import org.apache.hadoop.hbase.security.visibility.VisibilityController.VisibilityReplication;
69  import org.junit.experimental.categories.Category;
70  import org.apache.hadoop.hbase.util.Bytes;
71  import org.apache.hadoop.hbase.wal.WAL.Entry;
72  import org.apache.hadoop.hbase.zookeeper.MiniZooKeeperCluster;
73  import org.apache.hadoop.hbase.zookeeper.ZooKeeperWatcher;
74  import org.junit.Assert;
75  import org.junit.Before;
76  import org.junit.Rule;
77  import org.junit.Test;
78  import org.junit.rules.TestName;
79  
80  @Category(MediumTests.class)
81  public class TestVisibilityLabelsReplication {
82    private static final Log LOG = LogFactory.getLog(TestVisibilityLabelsReplication.class);
83    protected static final int NON_VIS_TAG_TYPE = 100;
84    protected static final String TEMP = "temp";
85    protected static Configuration conf;
86    protected static Configuration conf1;
87    protected static String TABLE_NAME = "TABLE_NAME";
88    protected static byte[] TABLE_NAME_BYTES = Bytes.toBytes(TABLE_NAME);
89    protected static ReplicationAdmin replicationAdmin;
90    public static final String TOPSECRET = "topsecret";
91    public static final String PUBLIC = "public";
92    public static final String PRIVATE = "private";
93    public static final String CONFIDENTIAL = "confidential";
94    public static final String COPYRIGHT = "\u00A9ABC";
95    public static final String ACCENT = "\u0941";
96    public static final String SECRET = "secret";
97    public static final String UNICODE_VIS_TAG = COPYRIGHT + "\"" + ACCENT + "\\" + SECRET + "\""
98        + "\u0027&\\";
99    public static HBaseTestingUtility TEST_UTIL;
100   public static HBaseTestingUtility TEST_UTIL1;
101   public static final byte[] row1 = Bytes.toBytes("row1");
102   public static final byte[] row2 = Bytes.toBytes("row2");
103   public static final byte[] row3 = Bytes.toBytes("row3");
104   public static final byte[] row4 = Bytes.toBytes("row4");
105   public final static byte[] fam = Bytes.toBytes("info");
106   public final static byte[] qual = Bytes.toBytes("qual");
107   public final static byte[] value = Bytes.toBytes("value");
108   protected static ZooKeeperWatcher zkw1;
109   protected static ZooKeeperWatcher zkw2;
110   protected static int expected[] = { 4, 6, 4, 0, 3 };
111   private static final String NON_VISIBILITY = "non-visibility";
112   protected static String[] expectedVisString = {
113       "(\"secret\"&\"topsecret\"&\"public\")|(\"topsecret\"&\"confidential\")",
114       "(\"public\"&\"private\")|(\"topsecret\"&\"private\")|"
115           + "(\"confidential\"&\"public\")|(\"topsecret\"&\"confidential\")",
116       "(!\"topsecret\"&\"secret\")|(!\"topsecret\"&\"confidential\")",
117       "(\"secret\"&\"" + COPYRIGHT + "\\\"" + ACCENT + "\\\\" + SECRET + "\\\"" + "\u0027&\\\\"
118           + "\")" };
119 
120   @Rule
121   public final TestName TEST_NAME = new TestName();
122   public static User SUPERUSER, USER1;
123 
124   @Before
125   public void setup() throws Exception {
126     // setup configuration
127     conf = HBaseConfiguration.create();
128     conf.setBoolean(HConstants.DISTRIBUTED_LOG_REPLAY_KEY, false);
129     conf.setBoolean("hbase.online.schema.update.enable", true);
130     conf.setInt("hfile.format.version", 3);
131     conf.set(HConstants.ZOOKEEPER_ZNODE_PARENT, "/1");
132     conf.setInt("replication.source.size.capacity", 10240);
133     conf.setLong("replication.source.sleepforretries", 100);
134     conf.setInt("hbase.regionserver.maxlogs", 10);
135     conf.setLong("hbase.master.logcleaner.ttl", 10);
136     conf.setInt("zookeeper.recovery.retry", 1);
137     conf.setInt("zookeeper.recovery.retry.intervalmill", 10);
138     conf.setBoolean("dfs.support.append", true);
139     conf.setLong(HConstants.THREAD_WAKE_FREQUENCY, 100);
140     conf.setInt("replication.stats.thread.period.seconds", 5);
141     conf.setBoolean("hbase.tests.use.shortcircuit.reads", false);
142     setVisibilityLabelServiceImpl(conf);
143     conf.setBoolean(HConstants.REPLICATION_ENABLE_KEY, HConstants.REPLICATION_ENABLE_DEFAULT);
144     conf.setStrings(HConstants.REPLICATION_CODEC_CONF_KEY, KeyValueCodecWithTags.class.getName());
145     VisibilityTestUtil.enableVisiblityLabels(conf);
146     conf.set(CoprocessorHost.REGIONSERVER_COPROCESSOR_CONF_KEY,
147         VisibilityReplication.class.getName());
148     conf.setStrings(CoprocessorHost.USER_REGION_COPROCESSOR_CONF_KEY,
149         SimpleCP.class.getName());
150     // Have to reset conf1 in case zk cluster location different
151     // than default
152     conf.setClass(VisibilityUtils.VISIBILITY_LABEL_GENERATOR_CLASS, SimpleScanLabelGenerator.class,
153         ScanLabelGenerator.class);
154     conf.set("hbase.superuser", User.getCurrent().getShortName());
155     SUPERUSER = User.createUserForTesting(conf, User.getCurrent().getShortName(),
156         new String[] { "supergroup" });
157     // User.createUserForTesting(conf, User.getCurrent().getShortName(), new
158     // String[] { "supergroup" });
159     USER1 = User.createUserForTesting(conf, "user1", new String[] {});
160     TEST_UTIL = new HBaseTestingUtility(conf);
161     TEST_UTIL.startMiniZKCluster();
162     MiniZooKeeperCluster miniZK = TEST_UTIL.getZkCluster();
163     zkw1 = new ZooKeeperWatcher(conf, "cluster1", null, true);
164     replicationAdmin = new ReplicationAdmin(conf);
165 
166     // Base conf2 on conf1 so it gets the right zk cluster.
167     conf1 = HBaseConfiguration.create(conf);
168     conf1.setInt("hfile.format.version", 3);
169     conf1.set(HConstants.ZOOKEEPER_ZNODE_PARENT, "/2");
170     conf1.setInt(HConstants.HBASE_CLIENT_RETRIES_NUMBER, 6);
171     conf1.setBoolean("dfs.support.append", true);
172     conf1.setBoolean("hbase.tests.use.shortcircuit.reads", false);
173     conf.setBoolean(HConstants.REPLICATION_ENABLE_KEY, HConstants.REPLICATION_ENABLE_DEFAULT);
174     conf1.setStrings(HConstants.REPLICATION_CODEC_CONF_KEY, KeyValueCodecWithTags.class.getName());
175     conf1.setStrings(CoprocessorHost.USER_REGION_COPROCESSOR_CONF_KEY,
176         TestCoprocessorForTagsAtSink.class.getName());
177     // setVisibilityLabelServiceImpl(conf1);
178     USER1 = User.createUserForTesting(conf1, "user1", new String[] {});
179     TEST_UTIL1 = new HBaseTestingUtility(conf1);
180     TEST_UTIL1.setZkCluster(miniZK);
181     zkw2 = new ZooKeeperWatcher(conf1, "cluster2", null, true);
182     replicationAdmin.addPeer("2", TEST_UTIL1.getClusterKey());
183 
184     TEST_UTIL.startMiniCluster(1);
185     // Wait for the labels table to become available
186     TEST_UTIL.waitTableEnabled(LABELS_TABLE_NAME.getName(), 50000);
187     TEST_UTIL1.startMiniCluster(1);
188     HBaseAdmin hBaseAdmin = TEST_UTIL.getHBaseAdmin();
189     HTableDescriptor table = new HTableDescriptor(TableName.valueOf(TABLE_NAME));
190     HColumnDescriptor desc = new HColumnDescriptor(fam);
191     desc.setScope(HConstants.REPLICATION_SCOPE_GLOBAL);
192     table.addFamily(desc);
193     try {
194       hBaseAdmin.createTable(table);
195     } finally {
196       if (hBaseAdmin != null) {
197         hBaseAdmin.close();
198       }
199     }
200     HBaseAdmin hBaseAdmin1 = TEST_UTIL1.getHBaseAdmin();
201     try {
202       hBaseAdmin1.createTable(table);
203     } finally {
204       if (hBaseAdmin1 != null) {
205         hBaseAdmin1.close();
206       }
207     }
208     addLabels();
209     setAuths(conf);
210     setAuths(conf1);
211   }
212 
213   protected static void setVisibilityLabelServiceImpl(Configuration conf) {
214     conf.setClass(VisibilityLabelServiceManager.VISIBILITY_LABEL_SERVICE_CLASS,
215         DefaultVisibilityLabelServiceImpl.class, VisibilityLabelService.class);
216   }
217 
218   @Test
219   public void testVisibilityReplication() throws Exception {
220     TableName tableName = TableName.valueOf(TABLE_NAME);
221     Table table = writeData(tableName, "(" + SECRET + "&" + PUBLIC + ")" + "|(" + CONFIDENTIAL
222         + ")&(" + TOPSECRET + ")", "(" + PRIVATE + "|" + CONFIDENTIAL + ")&(" + PUBLIC + "|"
223         + TOPSECRET + ")", "(" + SECRET + "|" + CONFIDENTIAL + ")" + "&" + "!" + TOPSECRET,
224         CellVisibility.quote(UNICODE_VIS_TAG) + "&" + SECRET);
225     int retry = 0;
226     try {
227       Scan s = new Scan();
228       s.setAuthorizations(new Authorizations(SECRET, CONFIDENTIAL, PRIVATE, TOPSECRET,
229           UNICODE_VIS_TAG));
230       ResultScanner scanner = table.getScanner(s);
231       Result[] next = scanner.next(4);
232 
233       assertTrue(next.length == 4);
234       CellScanner cellScanner = next[0].cellScanner();
235       cellScanner.advance();
236       Cell current = cellScanner.current();
237       assertTrue(Bytes.equals(current.getRowArray(), current.getRowOffset(),
238           current.getRowLength(), row1, 0, row1.length));
239       cellScanner = next[1].cellScanner();
240       cellScanner.advance();
241       current = cellScanner.current();
242       assertTrue(Bytes.equals(current.getRowArray(), current.getRowOffset(),
243           current.getRowLength(), row2, 0, row2.length));
244       cellScanner = next[2].cellScanner();
245       cellScanner.advance();
246       current = cellScanner.current();
247       assertTrue(Bytes.equals(current.getRowArray(), current.getRowOffset(),
248           current.getRowLength(), row3, 0, row3.length));
249       cellScanner = next[3].cellScanner();
250       cellScanner.advance();
251       current = cellScanner.current();
252       assertTrue(Bytes.equals(current.getRowArray(), current.getRowOffset(),
253           current.getRowLength(), row4, 0, row4.length));
254       HTable table2 = null;
255       try {
256         table2 = new HTable(TEST_UTIL1.getConfiguration(), TABLE_NAME_BYTES);
257         s = new Scan();
258         // Ensure both rows are replicated
259         scanner = table2.getScanner(s);
260         next = scanner.next(4);
261         while (next.length == 0 && retry <= 10) {
262           scanner = table2.getScanner(s);
263           next = scanner.next(4);
264           Thread.sleep(2000);
265           retry++;
266         }
267         assertTrue(next.length == 4);
268         verifyGet(row1, expectedVisString[0], expected[0], false, TOPSECRET, CONFIDENTIAL);
269         TestCoprocessorForTagsAtSink.tags.clear();
270         verifyGet(row2, expectedVisString[1], expected[1], false, CONFIDENTIAL, PUBLIC);
271         TestCoprocessorForTagsAtSink.tags.clear();
272         verifyGet(row3, expectedVisString[2], expected[2], false, PRIVATE, SECRET);
273         verifyGet(row3, "", expected[3], true, TOPSECRET, SECRET);
274         verifyGet(row4, expectedVisString[3], expected[4], false, UNICODE_VIS_TAG, SECRET);
275       } finally {
276         if (table2 != null) {
277           table2.close();
278         }
279       }
280     } finally {
281       if (table != null) {
282         table.close();
283       }
284     }
285   }
286 
287   protected static void doAssert(byte[] row, String visTag) throws Exception {
288     if (VisibilityReplicationEndPointForTest.lastEntries == null) {
289       return; // first call
290     }
291     Assert.assertEquals(1, VisibilityReplicationEndPointForTest.lastEntries.size());
292     List<Cell> cells = VisibilityReplicationEndPointForTest.lastEntries.get(0).getEdit().getCells();
293     Assert.assertEquals(4, cells.size());
294     boolean tagFound = false;
295     for (Cell cell : cells) {
296       if ((Bytes.equals(cell.getRowArray(), cell.getRowOffset(), cell.getRowLength(), row, 0,
297           row.length))) {
298         List<Tag> tags = Tag
299             .asList(cell.getTagsArray(), cell.getTagsOffset(), cell.getTagsLength());
300         for (Tag tag : tags) {
301           if (tag.getType() == TagType.STRING_VIS_TAG_TYPE) {
302             assertEquals(visTag, Bytes.toString(tag.getValue()));
303             tagFound = true;
304             break;
305           }
306         }
307       }
308     }
309     assertTrue(tagFound);
310   }
311 
312   protected void verifyGet(final byte[] row, final String visString, final int expected,
313       final boolean nullExpected, final String... auths) throws IOException,
314       InterruptedException {
315     PrivilegedExceptionAction<Void> scanAction = new PrivilegedExceptionAction<Void>() {
316       HTable table2 = null;
317 
318       public Void run() throws Exception {
319         try {
320           table2 = new HTable(conf1, TABLE_NAME_BYTES);
321           CellScanner cellScanner;
322           Cell current;
323           Get get = new Get(row);
324           get.setAuthorizations(new Authorizations(auths));
325           Result result = table2.get(get);
326           cellScanner = result.cellScanner();
327           boolean advance = cellScanner.advance();
328           if (nullExpected) {
329             assertTrue(!advance);
330             return null;
331           }
332           current = cellScanner.current();
333           assertArrayEquals(CellUtil.cloneRow(current), row);
334           for (Tag tag : TestCoprocessorForTagsAtSink.tags) {
335             LOG.info("The tag type is " + tag.getType());
336           }
337           assertEquals(expected, TestCoprocessorForTagsAtSink.tags.size());
338           Tag tag = TestCoprocessorForTagsAtSink.tags.get(1);
339           if (tag.getType() != NON_VIS_TAG_TYPE) {
340             assertEquals(TagType.VISIBILITY_EXP_SERIALIZATION_FORMAT_TAG_TYPE, tag.getType());
341           }
342           tag = TestCoprocessorForTagsAtSink.tags.get(0);
343           boolean foundNonVisTag = false;
344           for (Tag t : TestCoprocessorForTagsAtSink.tags) {
345             if (t.getType() == NON_VIS_TAG_TYPE) {
346               assertEquals(TEMP, Bytes.toString(t.getValue()));
347               foundNonVisTag = true;
348               break;
349             }
350           }
351           doAssert(row, visString);
352           assertTrue(foundNonVisTag);
353           return null;
354         } finally {
355           if (table2 != null) {
356             table2.close();
357           }
358         }
359       }
360     };
361     USER1.runAs(scanAction);
362   }
363 
364   public static void addLabels() throws Exception {
365     PrivilegedExceptionAction<VisibilityLabelsResponse> action =
366         new PrivilegedExceptionAction<VisibilityLabelsResponse>() {
367       public VisibilityLabelsResponse run() throws Exception {
368         String[] labels = { SECRET, TOPSECRET, CONFIDENTIAL, PUBLIC, PRIVATE, UNICODE_VIS_TAG };
369         try {
370           VisibilityClient.addLabels(conf, labels);
371         } catch (Throwable t) {
372           throw new IOException(t);
373         }
374         return null;
375       }
376     };
377     SUPERUSER.runAs(action);
378   }
379 
380   public static void setAuths(final Configuration conf) throws Exception {
381     PrivilegedExceptionAction<VisibilityLabelsResponse> action =
382         new PrivilegedExceptionAction<VisibilityLabelsResponse>() {
383       public VisibilityLabelsResponse run() throws Exception {
384         try {
385           return VisibilityClient.setAuths(conf, new String[] { SECRET, CONFIDENTIAL, PRIVATE,
386               TOPSECRET, UNICODE_VIS_TAG }, "user1");
387         } catch (Throwable e) {
388           throw new Exception(e);
389         }
390       }
391     };
392     VisibilityLabelsResponse response = SUPERUSER.runAs(action);
393   }
394 
395   static Table writeData(TableName tableName, String... labelExps) throws Exception {
396     Table table = TEST_UTIL.getConnection().getTable(TableName.valueOf(TABLE_NAME));
397     int i = 1;
398     List<Put> puts = new ArrayList<Put>();
399     for (String labelExp : labelExps) {
400       Put put = new Put(Bytes.toBytes("row" + i));
401       put.add(fam, qual, HConstants.LATEST_TIMESTAMP, value);
402       put.setCellVisibility(new CellVisibility(labelExp));
403       put.setAttribute(NON_VISIBILITY, Bytes.toBytes(TEMP));
404       puts.add(put);
405       i++;
406     }
407     table.put(puts);
408     return table;
409   }
410   // A simple BaseRegionbserver impl that allows to add a non-visibility tag from the
411   // attributes of the Put mutation.  The existing cells in the put mutation is overwritten
412   // with a new cell that has the visibility tags and the non visibility tag
413   public static class SimpleCP extends BaseRegionObserver {
414     @Override
415     public void prePut(ObserverContext<RegionCoprocessorEnvironment> e, Put m, WALEdit edit,
416         Durability durability) throws IOException {
417       byte[] attribute = m.getAttribute(NON_VISIBILITY);
418       byte[] cf = null;
419       List<Cell> updatedCells = new ArrayList<Cell>();
420       if (attribute != null) {
421         for (List<? extends Cell> edits : m.getFamilyCellMap().values()) {
422           for (Cell cell : edits) {
423             KeyValue kv = KeyValueUtil.ensureKeyValue(cell);
424             if (cf == null) {
425               cf = kv.getFamily();
426             }
427             Tag tag = new Tag((byte) NON_VIS_TAG_TYPE, attribute);
428             List<Tag> tagList = new ArrayList<Tag>();
429             tagList.add(tag);
430             tagList.addAll(kv.getTags());
431             byte[] fromList = Tag.fromList(tagList);
432             TagRewriteCell newcell = new TagRewriteCell(kv, fromList);
433             KeyValue newKV = new KeyValue(kv.getRow(), 0, kv.getRowLength(), kv.getFamily(), 0,
434                 kv.getFamilyLength(), kv.getQualifier(), 0, kv.getQualifierLength(),
435                 kv.getTimestamp(), KeyValue.Type.codeToType(kv.getType()), kv.getValue(), 0,
436                 kv.getValueLength(), tagList);
437             ((List<Cell>) updatedCells).add(newcell);
438           }
439         }
440         m.getFamilyCellMap().remove(cf);
441         // Update the family map
442         m.getFamilyCellMap().put(cf, updatedCells);
443       }
444     }
445   }
446 
447   public static class TestCoprocessorForTagsAtSink extends BaseRegionObserver {
448     public static List<Tag> tags = null;
449 
450     @Override
451     public void postGetOp(ObserverContext<RegionCoprocessorEnvironment> e, Get get,
452         List<Cell> results) throws IOException {
453       if (results.size() > 0) {
454         // Check tag presence in the 1st cell in 1st Result
455         if (!results.isEmpty()) {
456           Cell cell = results.get(0);
457           tags = Tag.asList(cell.getTagsArray(), cell.getTagsOffset(), cell.getTagsLength());
458         }
459       }
460     }
461   }
462 
463   /**
464    * An extn of VisibilityReplicationEndpoint to verify the tags that are replicated
465    */
466   public static class VisibilityReplicationEndPointForTest extends VisibilityReplicationEndpoint {
467     static AtomicInteger replicateCount = new AtomicInteger();
468     static volatile List<Entry> lastEntries = null;
469 
470     public VisibilityReplicationEndPointForTest(ReplicationEndpoint endpoint,
471         VisibilityLabelService visibilityLabelsService) {
472       super(endpoint, visibilityLabelsService);
473     }
474 
475     @Override
476     public boolean replicate(ReplicateContext replicateContext) {
477       boolean ret = super.replicate(replicateContext);
478       lastEntries = replicateContext.getEntries();
479       replicateCount.incrementAndGet();
480       return ret;
481     }
482   }
483 }