From b7e67db37238e775150180ff4de65da27a99e282 Mon Sep 17 00:00:00 2001 From: Andrew Wang Date: Tue, 5 Aug 2014 02:32:44 +0000 Subject: [PATCH] HADOOP-10936. Change default KeyProvider bitlength to 128. (wang) git-svn-id: https://svn.apache.org/repos/asf/hadoop/common/trunk@1615850 13f79535-47bb-0310-9956-ffa450edef68 --- hadoop-common-project/hadoop-common/CHANGES.txt | 2 ++ .../org/apache/hadoop/crypto/key/KeyProvider.java | 12 +++++++++++- .../java/org/apache/hadoop/crypto/key/KeyShell.java | 5 +++-- .../org/apache/hadoop/crypto/key/TestKeyShell.java | 8 ++++---- .../hadoop/crypto/key/kms/server/KMSWebApp.java | 9 ++++++++- 5 files changed, 28 insertions(+), 8 deletions(-) diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt index 85aeaf40f45..f7f20ede41f 100644 --- a/hadoop-common-project/hadoop-common/CHANGES.txt +++ b/hadoop-common-project/hadoop-common/CHANGES.txt @@ -197,6 +197,8 @@ Trunk (Unreleased) HADOOP-10793. KeyShell args should use single-dash style. (wang) + HADOOP-10936. Change default KeyProvider bitlength to 128. (wang) + BUG FIXES HADOOP-9451. Fault single-layer config if node group topology is enabled. diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProvider.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProvider.java index 3576badada3..a34ae10a71a 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProvider.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProvider.java @@ -54,7 +54,7 @@ public abstract class KeyProvider { public static final String DEFAULT_CIPHER = "AES/CTR/NoPadding"; public static final String DEFAULT_BITLENGTH_NAME = "hadoop.security.key.default.bitlength"; - public static final int DEFAULT_BITLENGTH = 256; + public static final int DEFAULT_BITLENGTH = 128; /** * The combination of both the key version name and the key material. @@ -341,6 +341,16 @@ public abstract class KeyProvider { public Map getAttributes() { return (attributes == null) ? Collections.EMPTY_MAP : attributes; } + + @Override + public String toString() { + return "Options{" + + "cipher='" + cipher + '\'' + + ", bitLength=" + bitLength + + ", description='" + description + '\'' + + ", attributes=" + attributes + + '}'; + } } /** diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyShell.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyShell.java index 6d50c9168d8..1fb91c65e74 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyShell.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyShell.java @@ -445,7 +445,7 @@ public class KeyShell extends Configured implements Tool { "by the argument within the provider specified by the\n" + "-provider argument. You may specify a cipher with the -cipher\n" + "argument. The default cipher is currently \"AES/CTR/NoPadding\".\n" + - "The default keysize is 256. You may specify the requested key\n" + + "The default keysize is 128. You may specify the requested key\n" + "length using the -size argument. Arbitrary attribute=value\n" + "style attributes may be specified using the -attr argument.\n" + "-attr may be specified multiple times, once per attribute.\n"; @@ -479,7 +479,8 @@ public class KeyShell extends Configured implements Tool { warnIfTransientProvider(); try { provider.createKey(keyName, options); - out.println(keyName + " has been successfully created."); + out.println(keyName + " has been successfully created with options " + + options.toString() + "."); provider.flush(); printProviderWritten(); } catch (InvalidParameterException e) { diff --git a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/crypto/key/TestKeyShell.java b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/crypto/key/TestKeyShell.java index 5981a2a6a38..d65d9b212be 100644 --- a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/crypto/key/TestKeyShell.java +++ b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/crypto/key/TestKeyShell.java @@ -110,7 +110,7 @@ public class TestKeyShell { rc = ks.run(args1); assertEquals(0, rc); assertTrue(outContent.toString().contains(keyName + " has been " + - "successfully created.")); + "successfully created")); String listOut = listKeys(ks, false); assertTrue(listOut.contains(keyName)); @@ -145,7 +145,7 @@ public class TestKeyShell { rc = ks.run(args1); assertEquals(0, rc); assertTrue(outContent.toString().contains("key1 has been successfully " + - "created.")); + "created")); String listOut = listKeys(ks, true); assertTrue(listOut.contains("description")); @@ -233,7 +233,7 @@ public class TestKeyShell { rc = ks.run(args1); assertEquals(0, rc); assertTrue(outContent.toString().contains(keyName + " has been " + - "successfully " + "created.")); + "successfully created")); deleteKey(ks, keyName); } @@ -250,7 +250,7 @@ public class TestKeyShell { rc = ks.run(args1); assertEquals(0, rc); assertTrue(outContent.toString().contains("keyattr1 has been " + - "successfully " + "created.")); + "successfully created")); /* ...and list to see that we have the attr */ String listOut = listKeys(ks, true); diff --git a/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java b/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java index 571ab965351..aaf90e8cff1 100644 --- a/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java +++ b/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java @@ -181,12 +181,19 @@ public class KMSWebApp implements ServletContextListener { keyProvider = new CachingKeyProvider(keyProvider, keyTimeOutMillis, currKeyTimeOutMillis); } + LOG.info("Initialized KeyProvider " + keyProvider); + keyProviderCryptoExtension = KeyProviderCryptoExtension. createKeyProviderCryptoExtension(keyProvider); keyProviderCryptoExtension = new EagerKeyGeneratorKeyProviderCryptoExtension(kmsConf, keyProviderCryptoExtension); - + LOG.info("Initialized KeyProviderCryptoExtension " + + keyProviderCryptoExtension); + final int defaultBitlength = kmsConf + .getInt(KeyProvider.DEFAULT_BITLENGTH_NAME, + KeyProvider.DEFAULT_BITLENGTH); + LOG.info("Default key bitlength is {}", defaultBitlength); LOG.info("KMS Started"); } catch (Throwable ex) { System.out.println();