1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18 package org.apache.hadoop.hbase.security.visibility;
19
20 import static org.apache.hadoop.hbase.security.visibility.VisibilityConstants.LABELS_TABLE_NAME;
21 import static org.junit.Assert.assertArrayEquals;
22 import static org.junit.Assert.assertEquals;
23 import static org.junit.Assert.assertTrue;
24
25 import java.io.IOException;
26 import java.security.PrivilegedExceptionAction;
27 import java.util.ArrayList;
28 import java.util.List;
29 import java.util.concurrent.atomic.AtomicInteger;
30
31 import org.apache.commons.logging.Log;
32 import org.apache.commons.logging.LogFactory;
33 import org.apache.hadoop.conf.Configuration;
34 import org.apache.hadoop.hbase.Cell;
35 import org.apache.hadoop.hbase.CellScanner;
36 import org.apache.hadoop.hbase.CellUtil;
37 import org.apache.hadoop.hbase.HBaseConfiguration;
38 import org.apache.hadoop.hbase.HBaseTestingUtility;
39 import org.apache.hadoop.hbase.HColumnDescriptor;
40 import org.apache.hadoop.hbase.HConstants;
41 import org.apache.hadoop.hbase.HTableDescriptor;
42 import org.apache.hadoop.hbase.KeyValue;
43 import org.apache.hadoop.hbase.KeyValueUtil;
44 import org.apache.hadoop.hbase.testclassification.MediumTests;
45 import org.apache.hadoop.hbase.TableName;
46 import org.apache.hadoop.hbase.Tag;
47 import org.apache.hadoop.hbase.TagRewriteCell;
48 import org.apache.hadoop.hbase.TagType;
49 import org.apache.hadoop.hbase.client.Durability;
50 import org.apache.hadoop.hbase.client.Get;
51 import org.apache.hadoop.hbase.client.HBaseAdmin;
52 import org.apache.hadoop.hbase.client.HTable;
53 import org.apache.hadoop.hbase.client.Put;
54 import org.apache.hadoop.hbase.client.Result;
55 import org.apache.hadoop.hbase.client.ResultScanner;
56 import org.apache.hadoop.hbase.client.Scan;
57 import org.apache.hadoop.hbase.client.Table;
58 import org.apache.hadoop.hbase.client.replication.ReplicationAdmin;
59 import org.apache.hadoop.hbase.codec.KeyValueCodecWithTags;
60 import org.apache.hadoop.hbase.coprocessor.BaseRegionObserver;
61 import org.apache.hadoop.hbase.coprocessor.CoprocessorHost;
62 import org.apache.hadoop.hbase.coprocessor.ObserverContext;
63 import org.apache.hadoop.hbase.coprocessor.RegionCoprocessorEnvironment;
64 import org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.VisibilityLabelsResponse;
65 import org.apache.hadoop.hbase.regionserver.wal.WALEdit;
66 import org.apache.hadoop.hbase.replication.ReplicationEndpoint;
67 import org.apache.hadoop.hbase.security.User;
68 import org.apache.hadoop.hbase.security.visibility.VisibilityController.VisibilityReplication;
69 import org.junit.experimental.categories.Category;
70 import org.apache.hadoop.hbase.util.Bytes;
71 import org.apache.hadoop.hbase.wal.WAL.Entry;
72 import org.apache.hadoop.hbase.zookeeper.MiniZooKeeperCluster;
73 import org.apache.hadoop.hbase.zookeeper.ZooKeeperWatcher;
74 import org.junit.Assert;
75 import org.junit.Before;
76 import org.junit.Rule;
77 import org.junit.Test;
78 import org.junit.rules.TestName;
79
80 @Category(MediumTests.class)
81 public class TestVisibilityLabelsReplication {
82 private static final Log LOG = LogFactory.getLog(TestVisibilityLabelsReplication.class);
83 protected static final int NON_VIS_TAG_TYPE = 100;
84 protected static final String TEMP = "temp";
85 protected static Configuration conf;
86 protected static Configuration conf1;
87 protected static String TABLE_NAME = "TABLE_NAME";
88 protected static byte[] TABLE_NAME_BYTES = Bytes.toBytes(TABLE_NAME);
89 protected static ReplicationAdmin replicationAdmin;
90 public static final String TOPSECRET = "topsecret";
91 public static final String PUBLIC = "public";
92 public static final String PRIVATE = "private";
93 public static final String CONFIDENTIAL = "confidential";
94 public static final String COPYRIGHT = "\u00A9ABC";
95 public static final String ACCENT = "\u0941";
96 public static final String SECRET = "secret";
97 public static final String UNICODE_VIS_TAG = COPYRIGHT + "\"" + ACCENT + "\\" + SECRET + "\""
98 + "\u0027&\\";
99 public static HBaseTestingUtility TEST_UTIL;
100 public static HBaseTestingUtility TEST_UTIL1;
101 public static final byte[] row1 = Bytes.toBytes("row1");
102 public static final byte[] row2 = Bytes.toBytes("row2");
103 public static final byte[] row3 = Bytes.toBytes("row3");
104 public static final byte[] row4 = Bytes.toBytes("row4");
105 public final static byte[] fam = Bytes.toBytes("info");
106 public final static byte[] qual = Bytes.toBytes("qual");
107 public final static byte[] value = Bytes.toBytes("value");
108 protected static ZooKeeperWatcher zkw1;
109 protected static ZooKeeperWatcher zkw2;
110 protected static int expected[] = { 4, 6, 4, 0, 3 };
111 private static final String NON_VISIBILITY = "non-visibility";
112 protected static String[] expectedVisString = {
113 "(\"secret\"&\"topsecret\"&\"public\")|(\"topsecret\"&\"confidential\")",
114 "(\"public\"&\"private\")|(\"topsecret\"&\"private\")|"
115 + "(\"confidential\"&\"public\")|(\"topsecret\"&\"confidential\")",
116 "(!\"topsecret\"&\"secret\")|(!\"topsecret\"&\"confidential\")",
117 "(\"secret\"&\"" + COPYRIGHT + "\\\"" + ACCENT + "\\\\" + SECRET + "\\\"" + "\u0027&\\\\"
118 + "\")" };
119
120 @Rule
121 public final TestName TEST_NAME = new TestName();
122 public static User SUPERUSER, USER1;
123
124 @Before
125 public void setup() throws Exception {
126
127 conf = HBaseConfiguration.create();
128 conf.setBoolean(HConstants.DISTRIBUTED_LOG_REPLAY_KEY, false);
129 conf.setBoolean("hbase.online.schema.update.enable", true);
130 conf.setInt("hfile.format.version", 3);
131 conf.set(HConstants.ZOOKEEPER_ZNODE_PARENT, "/1");
132 conf.setInt("replication.source.size.capacity", 10240);
133 conf.setLong("replication.source.sleepforretries", 100);
134 conf.setInt("hbase.regionserver.maxlogs", 10);
135 conf.setLong("hbase.master.logcleaner.ttl", 10);
136 conf.setInt("zookeeper.recovery.retry", 1);
137 conf.setInt("zookeeper.recovery.retry.intervalmill", 10);
138 conf.setBoolean("dfs.support.append", true);
139 conf.setLong(HConstants.THREAD_WAKE_FREQUENCY, 100);
140 conf.setInt("replication.stats.thread.period.seconds", 5);
141 conf.setBoolean("hbase.tests.use.shortcircuit.reads", false);
142 setVisibilityLabelServiceImpl(conf);
143 conf.setBoolean(HConstants.REPLICATION_ENABLE_KEY, HConstants.REPLICATION_ENABLE_DEFAULT);
144 conf.setStrings(HConstants.REPLICATION_CODEC_CONF_KEY, KeyValueCodecWithTags.class.getName());
145 VisibilityTestUtil.enableVisiblityLabels(conf);
146 conf.set(CoprocessorHost.REGIONSERVER_COPROCESSOR_CONF_KEY,
147 VisibilityReplication.class.getName());
148 conf.setStrings(CoprocessorHost.USER_REGION_COPROCESSOR_CONF_KEY,
149 SimpleCP.class.getName());
150
151
152 conf.setClass(VisibilityUtils.VISIBILITY_LABEL_GENERATOR_CLASS, SimpleScanLabelGenerator.class,
153 ScanLabelGenerator.class);
154 conf.set("hbase.superuser", User.getCurrent().getShortName());
155 SUPERUSER = User.createUserForTesting(conf, User.getCurrent().getShortName(),
156 new String[] { "supergroup" });
157
158
159 USER1 = User.createUserForTesting(conf, "user1", new String[] {});
160 TEST_UTIL = new HBaseTestingUtility(conf);
161 TEST_UTIL.startMiniZKCluster();
162 MiniZooKeeperCluster miniZK = TEST_UTIL.getZkCluster();
163 zkw1 = new ZooKeeperWatcher(conf, "cluster1", null, true);
164 replicationAdmin = new ReplicationAdmin(conf);
165
166
167 conf1 = HBaseConfiguration.create(conf);
168 conf1.setInt("hfile.format.version", 3);
169 conf1.set(HConstants.ZOOKEEPER_ZNODE_PARENT, "/2");
170 conf1.setInt(HConstants.HBASE_CLIENT_RETRIES_NUMBER, 6);
171 conf1.setBoolean("dfs.support.append", true);
172 conf1.setBoolean("hbase.tests.use.shortcircuit.reads", false);
173 conf.setBoolean(HConstants.REPLICATION_ENABLE_KEY, HConstants.REPLICATION_ENABLE_DEFAULT);
174 conf1.setStrings(HConstants.REPLICATION_CODEC_CONF_KEY, KeyValueCodecWithTags.class.getName());
175 conf1.setStrings(CoprocessorHost.USER_REGION_COPROCESSOR_CONF_KEY,
176 TestCoprocessorForTagsAtSink.class.getName());
177
178 USER1 = User.createUserForTesting(conf1, "user1", new String[] {});
179 TEST_UTIL1 = new HBaseTestingUtility(conf1);
180 TEST_UTIL1.setZkCluster(miniZK);
181 zkw2 = new ZooKeeperWatcher(conf1, "cluster2", null, true);
182 replicationAdmin.addPeer("2", TEST_UTIL1.getClusterKey());
183
184 TEST_UTIL.startMiniCluster(1);
185
186 TEST_UTIL.waitTableEnabled(LABELS_TABLE_NAME.getName(), 50000);
187 TEST_UTIL1.startMiniCluster(1);
188 HBaseAdmin hBaseAdmin = TEST_UTIL.getHBaseAdmin();
189 HTableDescriptor table = new HTableDescriptor(TableName.valueOf(TABLE_NAME));
190 HColumnDescriptor desc = new HColumnDescriptor(fam);
191 desc.setScope(HConstants.REPLICATION_SCOPE_GLOBAL);
192 table.addFamily(desc);
193 try {
194 hBaseAdmin.createTable(table);
195 } finally {
196 if (hBaseAdmin != null) {
197 hBaseAdmin.close();
198 }
199 }
200 HBaseAdmin hBaseAdmin1 = TEST_UTIL1.getHBaseAdmin();
201 try {
202 hBaseAdmin1.createTable(table);
203 } finally {
204 if (hBaseAdmin1 != null) {
205 hBaseAdmin1.close();
206 }
207 }
208 addLabels();
209 setAuths(conf);
210 setAuths(conf1);
211 }
212
213 protected static void setVisibilityLabelServiceImpl(Configuration conf) {
214 conf.setClass(VisibilityLabelServiceManager.VISIBILITY_LABEL_SERVICE_CLASS,
215 DefaultVisibilityLabelServiceImpl.class, VisibilityLabelService.class);
216 }
217
218 @Test
219 public void testVisibilityReplication() throws Exception {
220 TableName tableName = TableName.valueOf(TABLE_NAME);
221 Table table = writeData(tableName, "(" + SECRET + "&" + PUBLIC + ")" + "|(" + CONFIDENTIAL
222 + ")&(" + TOPSECRET + ")", "(" + PRIVATE + "|" + CONFIDENTIAL + ")&(" + PUBLIC + "|"
223 + TOPSECRET + ")", "(" + SECRET + "|" + CONFIDENTIAL + ")" + "&" + "!" + TOPSECRET,
224 CellVisibility.quote(UNICODE_VIS_TAG) + "&" + SECRET);
225 int retry = 0;
226 try {
227 Scan s = new Scan();
228 s.setAuthorizations(new Authorizations(SECRET, CONFIDENTIAL, PRIVATE, TOPSECRET,
229 UNICODE_VIS_TAG));
230 ResultScanner scanner = table.getScanner(s);
231 Result[] next = scanner.next(4);
232
233 assertTrue(next.length == 4);
234 CellScanner cellScanner = next[0].cellScanner();
235 cellScanner.advance();
236 Cell current = cellScanner.current();
237 assertTrue(Bytes.equals(current.getRowArray(), current.getRowOffset(),
238 current.getRowLength(), row1, 0, row1.length));
239 cellScanner = next[1].cellScanner();
240 cellScanner.advance();
241 current = cellScanner.current();
242 assertTrue(Bytes.equals(current.getRowArray(), current.getRowOffset(),
243 current.getRowLength(), row2, 0, row2.length));
244 cellScanner = next[2].cellScanner();
245 cellScanner.advance();
246 current = cellScanner.current();
247 assertTrue(Bytes.equals(current.getRowArray(), current.getRowOffset(),
248 current.getRowLength(), row3, 0, row3.length));
249 cellScanner = next[3].cellScanner();
250 cellScanner.advance();
251 current = cellScanner.current();
252 assertTrue(Bytes.equals(current.getRowArray(), current.getRowOffset(),
253 current.getRowLength(), row4, 0, row4.length));
254 HTable table2 = null;
255 try {
256 table2 = new HTable(TEST_UTIL1.getConfiguration(), TABLE_NAME_BYTES);
257 s = new Scan();
258
259 scanner = table2.getScanner(s);
260 next = scanner.next(4);
261 while (next.length == 0 && retry <= 10) {
262 scanner = table2.getScanner(s);
263 next = scanner.next(4);
264 Thread.sleep(2000);
265 retry++;
266 }
267 assertTrue(next.length == 4);
268 verifyGet(row1, expectedVisString[0], expected[0], false, TOPSECRET, CONFIDENTIAL);
269 TestCoprocessorForTagsAtSink.tags.clear();
270 verifyGet(row2, expectedVisString[1], expected[1], false, CONFIDENTIAL, PUBLIC);
271 TestCoprocessorForTagsAtSink.tags.clear();
272 verifyGet(row3, expectedVisString[2], expected[2], false, PRIVATE, SECRET);
273 verifyGet(row3, "", expected[3], true, TOPSECRET, SECRET);
274 verifyGet(row4, expectedVisString[3], expected[4], false, UNICODE_VIS_TAG, SECRET);
275 } finally {
276 if (table2 != null) {
277 table2.close();
278 }
279 }
280 } finally {
281 if (table != null) {
282 table.close();
283 }
284 }
285 }
286
287 protected static void doAssert(byte[] row, String visTag) throws Exception {
288 if (VisibilityReplicationEndPointForTest.lastEntries == null) {
289 return;
290 }
291 Assert.assertEquals(1, VisibilityReplicationEndPointForTest.lastEntries.size());
292 List<Cell> cells = VisibilityReplicationEndPointForTest.lastEntries.get(0).getEdit().getCells();
293 Assert.assertEquals(4, cells.size());
294 boolean tagFound = false;
295 for (Cell cell : cells) {
296 if ((Bytes.equals(cell.getRowArray(), cell.getRowOffset(), cell.getRowLength(), row, 0,
297 row.length))) {
298 List<Tag> tags = Tag
299 .asList(cell.getTagsArray(), cell.getTagsOffset(), cell.getTagsLength());
300 for (Tag tag : tags) {
301 if (tag.getType() == TagType.STRING_VIS_TAG_TYPE) {
302 assertEquals(visTag, Bytes.toString(tag.getValue()));
303 tagFound = true;
304 break;
305 }
306 }
307 }
308 }
309 assertTrue(tagFound);
310 }
311
312 protected void verifyGet(final byte[] row, final String visString, final int expected,
313 final boolean nullExpected, final String... auths) throws IOException,
314 InterruptedException {
315 PrivilegedExceptionAction<Void> scanAction = new PrivilegedExceptionAction<Void>() {
316 HTable table2 = null;
317
318 public Void run() throws Exception {
319 try {
320 table2 = new HTable(conf1, TABLE_NAME_BYTES);
321 CellScanner cellScanner;
322 Cell current;
323 Get get = new Get(row);
324 get.setAuthorizations(new Authorizations(auths));
325 Result result = table2.get(get);
326 cellScanner = result.cellScanner();
327 boolean advance = cellScanner.advance();
328 if (nullExpected) {
329 assertTrue(!advance);
330 return null;
331 }
332 current = cellScanner.current();
333 assertArrayEquals(CellUtil.cloneRow(current), row);
334 for (Tag tag : TestCoprocessorForTagsAtSink.tags) {
335 LOG.info("The tag type is " + tag.getType());
336 }
337 assertEquals(expected, TestCoprocessorForTagsAtSink.tags.size());
338 Tag tag = TestCoprocessorForTagsAtSink.tags.get(1);
339 if (tag.getType() != NON_VIS_TAG_TYPE) {
340 assertEquals(TagType.VISIBILITY_EXP_SERIALIZATION_FORMAT_TAG_TYPE, tag.getType());
341 }
342 tag = TestCoprocessorForTagsAtSink.tags.get(0);
343 boolean foundNonVisTag = false;
344 for (Tag t : TestCoprocessorForTagsAtSink.tags) {
345 if (t.getType() == NON_VIS_TAG_TYPE) {
346 assertEquals(TEMP, Bytes.toString(t.getValue()));
347 foundNonVisTag = true;
348 break;
349 }
350 }
351 doAssert(row, visString);
352 assertTrue(foundNonVisTag);
353 return null;
354 } finally {
355 if (table2 != null) {
356 table2.close();
357 }
358 }
359 }
360 };
361 USER1.runAs(scanAction);
362 }
363
364 public static void addLabels() throws Exception {
365 PrivilegedExceptionAction<VisibilityLabelsResponse> action =
366 new PrivilegedExceptionAction<VisibilityLabelsResponse>() {
367 public VisibilityLabelsResponse run() throws Exception {
368 String[] labels = { SECRET, TOPSECRET, CONFIDENTIAL, PUBLIC, PRIVATE, UNICODE_VIS_TAG };
369 try {
370 VisibilityClient.addLabels(conf, labels);
371 } catch (Throwable t) {
372 throw new IOException(t);
373 }
374 return null;
375 }
376 };
377 SUPERUSER.runAs(action);
378 }
379
380 public static void setAuths(final Configuration conf) throws Exception {
381 PrivilegedExceptionAction<VisibilityLabelsResponse> action =
382 new PrivilegedExceptionAction<VisibilityLabelsResponse>() {
383 public VisibilityLabelsResponse run() throws Exception {
384 try {
385 return VisibilityClient.setAuths(conf, new String[] { SECRET, CONFIDENTIAL, PRIVATE,
386 TOPSECRET, UNICODE_VIS_TAG }, "user1");
387 } catch (Throwable e) {
388 throw new Exception(e);
389 }
390 }
391 };
392 VisibilityLabelsResponse response = SUPERUSER.runAs(action);
393 }
394
395 static Table writeData(TableName tableName, String... labelExps) throws Exception {
396 Table table = TEST_UTIL.getConnection().getTable(TableName.valueOf(TABLE_NAME));
397 int i = 1;
398 List<Put> puts = new ArrayList<Put>();
399 for (String labelExp : labelExps) {
400 Put put = new Put(Bytes.toBytes("row" + i));
401 put.add(fam, qual, HConstants.LATEST_TIMESTAMP, value);
402 put.setCellVisibility(new CellVisibility(labelExp));
403 put.setAttribute(NON_VISIBILITY, Bytes.toBytes(TEMP));
404 puts.add(put);
405 i++;
406 }
407 table.put(puts);
408 return table;
409 }
410
411
412
413 public static class SimpleCP extends BaseRegionObserver {
414 @Override
415 public void prePut(ObserverContext<RegionCoprocessorEnvironment> e, Put m, WALEdit edit,
416 Durability durability) throws IOException {
417 byte[] attribute = m.getAttribute(NON_VISIBILITY);
418 byte[] cf = null;
419 List<Cell> updatedCells = new ArrayList<Cell>();
420 if (attribute != null) {
421 for (List<? extends Cell> edits : m.getFamilyCellMap().values()) {
422 for (Cell cell : edits) {
423 KeyValue kv = KeyValueUtil.ensureKeyValue(cell);
424 if (cf == null) {
425 cf = kv.getFamily();
426 }
427 Tag tag = new Tag((byte) NON_VIS_TAG_TYPE, attribute);
428 List<Tag> tagList = new ArrayList<Tag>();
429 tagList.add(tag);
430 tagList.addAll(kv.getTags());
431 byte[] fromList = Tag.fromList(tagList);
432 TagRewriteCell newcell = new TagRewriteCell(kv, fromList);
433 KeyValue newKV = new KeyValue(kv.getRow(), 0, kv.getRowLength(), kv.getFamily(), 0,
434 kv.getFamilyLength(), kv.getQualifier(), 0, kv.getQualifierLength(),
435 kv.getTimestamp(), KeyValue.Type.codeToType(kv.getType()), kv.getValue(), 0,
436 kv.getValueLength(), tagList);
437 ((List<Cell>) updatedCells).add(newcell);
438 }
439 }
440 m.getFamilyCellMap().remove(cf);
441
442 m.getFamilyCellMap().put(cf, updatedCells);
443 }
444 }
445 }
446
447 public static class TestCoprocessorForTagsAtSink extends BaseRegionObserver {
448 public static List<Tag> tags = null;
449
450 @Override
451 public void postGetOp(ObserverContext<RegionCoprocessorEnvironment> e, Get get,
452 List<Cell> results) throws IOException {
453 if (results.size() > 0) {
454
455 if (!results.isEmpty()) {
456 Cell cell = results.get(0);
457 tags = Tag.asList(cell.getTagsArray(), cell.getTagsOffset(), cell.getTagsLength());
458 }
459 }
460 }
461 }
462
463
464
465
466 public static class VisibilityReplicationEndPointForTest extends VisibilityReplicationEndpoint {
467 static AtomicInteger replicateCount = new AtomicInteger();
468 static volatile List<Entry> lastEntries = null;
469
470 public VisibilityReplicationEndPointForTest(ReplicationEndpoint endpoint,
471 VisibilityLabelService visibilityLabelsService) {
472 super(endpoint, visibilityLabelsService);
473 }
474
475 @Override
476 public boolean replicate(ReplicateContext replicateContext) {
477 boolean ret = super.replicate(replicateContext);
478 lastEntries = replicateContext.getEntries();
479 replicateCount.incrementAndGet();
480 return ret;
481 }
482 }
483 }