Class KeyProviderImpl

java/shims/src/java/org/apache/orc/impl/KeyProviderImpl.java:83–175

Shim implementation for ORC's KeyProvider API that uses Hadoop's KeyProvider API and implementations. Most users use a Hadoop or Ranger KMS and thus should use this default implementation. The main two methods of ORC's KeyProvider are createLocalKey and decryptLocalKey. These are very similar to

 * to either take the random key or pass it back.
 */
class KeyProviderImpl implements KeyProvider {
  private final org.apache.hadoop.crypto.key.KeyProvider provider;
  private final Random random;

  KeyProviderImpl(org.apache.hadoop.crypto.key.KeyProvider provider,
                  Random random) {
    this.provider = provider;
    this.random = random;
  }

  @Override
  public List<String> getKeyNames() throws IOException {
    return provider.getKeys();
  }

  @Override
  public HadoopShims.KeyMetadata getCurrentKeyVersion(String keyName) throws IOException {
    org.apache.hadoop.crypto.key.KeyProvider.Metadata meta =
        provider.getMetadata(keyName);
    return new HadoopShims.KeyMetadata(keyName, meta.getVersions() - 1,
        HadoopShimsCurrent.findAlgorithm(meta));
  }

  /**
   * The Ranger/Hadoop KMS mangles the IV by bit flipping it in a misguided
   * attempt to improve security. By bit flipping it here, we undo the
   * silliness so that we get
   *
   * @param input  the input array to copy from
   * @param output the output array to write to
   */
  private static void unmangleIv(byte[] input, byte[] output) {
    for (int i = 0; i < output.length && i < input.length; ++i) {
      output[i] = (byte) (0xff ^ input[i]);
    }
  }

  @Override
  public LocalKey createLocalKey(HadoopShims.KeyMetadata key) throws IOException {
    EncryptionAlgorithm algorithm = key.getAlgorithm();
    byte[] encryptedKey = new byte[algorithm.keyLength()];
    random.nextBytes(encryptedKey);
    byte[] iv = new byte[algorithm.getIvLength()];
    unmangleIv(encryptedKey, iv);
    EncryptedKeyVersion param = EncryptedKeyVersion.createForDecryption(
        key.getKeyName(), HadoopShimsCurrent.buildKeyVersionName(key), iv, encryptedKey);
    try {
      KeyProviderCryptoExtension.KeyVersion decryptedKey;
      if (provider instanceof KeyProviderCryptoExtension) {
        decryptedKey = ((KeyProviderCryptoExtension) provider).decryptEncryptedKey(param);
      } else if (provider instanceof CryptoExtension) {
        decryptedKey = ((CryptoExtension) provider).decryptEncryptedKey(param);
      } else {
        throw new UnsupportedOperationException(
            provider.getClass().getCanonicalName() + " is not supported.");
      }
      return new LocalKey(algorithm, decryptedKey.getMaterial(),
          encryptedKey);