import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
/**
 * Create a FileEncryptionInfo.
 *
 * @param suite CipherSuite used to encrypt the file
 * @param edek encrypted data encryption key (EDEK) of the file
 * @param iv initialization vector (IV) used to encrypt the file
 * @param keyName name of the key used for the encryption zone
 * @param ezKeyVersionName name of the KeyVersion used to encrypt the
 *                         encrypted data encryption key.
 */
public FileEncryptionInfo(final CipherSuite suite,
    final CryptoProtocolVersion version, final byte[] edek,
    final byte[] iv, final String keyName, final String ezKeyVersionName) {
  checkNotNull(suite);
  checkNotNull(version);
  checkNotNull(edek);
  checkNotNull(iv);
  checkNotNull(keyName);
  checkNotNull(ezKeyVersionName);
  checkArgument(iv.length == suite.getAlgorithmBlockSize(),
      "Unexpected IV length");
  this.cipherSuite = suite;
  this.version = version;
  this.edek = edek;
  this.iv = iv;
  this.keyName = keyName;
  this.ezKeyVersionName = ezKeyVersionName;
}
 

import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
/**
 * Obtain a CryptoCodec based on the CipherSuite set in a FileEncryptionInfo
 * and the available CryptoCodecs configured in the Configuration.
 *
 * @param conf   Configuration
 * @param feInfo FileEncryptionInfo
 * @return CryptoCodec
 * @throws IOException if no suitable CryptoCodec for the CipherSuite is
 *                     available.
 */
private static CryptoCodec getCryptoCodec(Configuration conf,
    FileEncryptionInfo feInfo) throws IOException {
  final CipherSuite suite = feInfo.getCipherSuite();
  if (suite.equals(CipherSuite.UNKNOWN)) {
    throw new IOException("NameNode specified unknown CipherSuite with ID "
        + suite.getUnknownValue() + ", cannot instantiate CryptoCodec.");
  }
  final CryptoCodec codec = CryptoCodec.getInstance(conf, suite);
  if (codec == null) {
    throw new UnknownCipherSuiteException(
        "No configuration found for the cipher suite "
        + suite.getConfigSuffix() + " prefixed with "
        + HADOOP_SECURITY_CRYPTO_CODEC_CLASSES_KEY_PREFIX
        + ". Please see the example configuration "
        + "hadoop.security.crypto.codec.classes.EXAMPLECIPHERSUITE "
        + "at core-default.xml for details.");
  }
  return codec;
}
 

import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
public static CipherOption convert(CipherOptionProto proto) {
  if (proto != null) {
    CipherSuite suite = null;
    if (proto.getSuite() != null) {
      suite = convert(proto.getSuite());
    }
    byte[] inKey = null;
    if (proto.getInKey() != null) {
      inKey = proto.getInKey().toByteArray();
    }
    byte[] inIv = null;
    if (proto.getInIv() != null) {
      inIv = proto.getInIv().toByteArray();
    }
    byte[] outKey = null;
    if (proto.getOutKey() != null) {
      outKey = proto.getOutKey().toByteArray();
    }
    byte[] outIv = null;
    if (proto.getOutIv() != null) {
      outIv = proto.getOutIv().toByteArray();
    }
    return new CipherOption(suite, inKey, inIv, outKey, outIv);
  }
  return null;
}
 

import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
@SuppressWarnings("unchecked")
private static void mockCreate(ClientProtocol mcp,
    CipherSuite suite, CryptoProtocolVersion version) throws Exception {
  Mockito.doReturn(
      new HdfsFileStatus(0, false, 1, 1024, 0, 0, new FsPermission(
          (short) 777), "owner", "group", new byte[0], new byte[0],
          1010, 0, new FileEncryptionInfo(suite,
          version, new byte[suite.getAlgorithmBlockSize()],
          new byte[suite.getAlgorithmBlockSize()],
          "fakeKey", "fakeVersion"),
          (byte) 0))
      .when(mcp)
      .create(anyString(), (FsPermission) anyObject(), anyString(),
          (EnumSetWritable<CreateFlag>) anyObject(), anyBoolean(),
          anyShort(), anyLong(), (CryptoProtocolVersion[]) anyObject());
}
 

import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
/**
 * Obtain a CryptoCodec based on the CipherSuite set in a FileEncryptionInfo
 * and the available CryptoCodecs configured in the Configuration.
 *
 * @param conf   Configuration
 * @param feInfo FileEncryptionInfo
 * @return CryptoCodec
 * @throws IOException if no suitable CryptoCodec for the CipherSuite is
 *                     available.
 */
private static CryptoCodec getCryptoCodec(Configuration conf,
    FileEncryptionInfo feInfo) throws IOException {
  final CipherSuite suite = feInfo.getCipherSuite();
  if (suite.equals(CipherSuite.UNKNOWN)) {
    throw new IOException("NameNode specified unknown CipherSuite with ID "
        + suite.getUnknownValue() + ", cannot instantiate CryptoCodec.");
  }
  final CryptoCodec codec = CryptoCodec.getInstance(conf, suite);
  if (codec == null) {
    throw new UnknownCipherSuiteException(
        "No configuration found for the cipher suite "
            + suite.getConfigSuffix() + " prefixed with "
            + HADOOP_SECURITY_CRYPTO_CODEC_CLASSES_KEY_PREFIX
            + ". Please see the example configuration "
            + "hadoop.security.crypto.codec.classes.EXAMPLECIPHERSUITE "
            + "at core-default.xml for details.");
  }
  return codec;
}
 

import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
public static CipherOption convert(HdfsProtos.CipherOptionProto proto) {
  if (proto != null) {
    CipherSuite suite = null;
    if (proto.getSuite() != null) {
      suite = convert(proto.getSuite());
    }
    byte[] inKey = null;
    if (proto.getInKey() != null) {
      inKey = proto.getInKey().toByteArray();
    }
    byte[] inIv = null;
    if (proto.getInIv() != null) {
      inIv = proto.getInIv().toByteArray();
    }
    byte[] outKey = null;
    if (proto.getOutKey() != null) {
      outKey = proto.getOutKey().toByteArray();
    }
    byte[] outIv = null;
    if (proto.getOutIv() != null) {
      outIv = proto.getOutIv().toByteArray();
    }
    return new CipherOption(suite, inKey, inIv, outKey, outIv);
  }
  return null;
}
 

import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
/**
 * Create an encryption zone on directory path using the specified key.
 *
 * @param fsd fsdirectory
 * @param srcArg the path of a directory which will be the root of the
 *               encryption zone. The directory must be empty
 * @param pc permission checker to check fs permission
 * @param cipher cipher
 * @param keyName name of a key which must be present in the configured
 *                KeyProvider
 * @param logRetryCache whether to record RPC ids in editlog for retry cache
 *                      rebuilding
 * @return HdfsFileStatus
 * @throws IOException
 */
static HdfsFileStatus createEncryptionZone(final FSDirectory fsd,
    final String srcArg, final FSPermissionChecker pc, final String cipher,
    final String keyName, final boolean logRetryCache) throws IOException {
  final byte[][] pathComponents = FSDirectory
      .getPathComponentsForReservedPath(srcArg);
  final CipherSuite suite = CipherSuite.convert(cipher);
  List<XAttr> xAttrs = Lists.newArrayListWithCapacity(1);
  final String src;
  // For now this is hard coded, as we only support one method.
  final CryptoProtocolVersion version =
      CryptoProtocolVersion.ENCRYPTION_ZONES;

  fsd.writeLock();
  try {
    src = fsd.resolvePath(pc, srcArg, pathComponents);
    final XAttr ezXAttr = fsd.ezManager.createEncryptionZone(src, suite,
        version, keyName);
    xAttrs.add(ezXAttr);
  } finally {
    fsd.writeUnlock();
  }
  fsd.getEditLog().logSetXAttrs(src, xAttrs, logRetryCache);
  final INodesInPath iip = fsd.getINodesInPath4Write(src, false);
  return fsd.getAuditFileInfo(iip);
}
 

import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
static EncryptionKeyInfo getEncryptionKeyInfo(FSNamesystem fsn,
    FSPermissionChecker pc, String src,
    CryptoProtocolVersion[] supportedVersions)
    throws IOException {
  byte[][] pathComponents = FSDirectory.getPathComponentsForReservedPath(src);
  FSDirectory fsd = fsn.getFSDirectory();
  src = fsd.resolvePath(pc, src, pathComponents);
  INodesInPath iip = fsd.getINodesInPath4Write(src);
  // Nothing to do if the path is not within an EZ
  final EncryptionZone zone = FSDirEncryptionZoneOp.getEZForPath(fsd, iip);
  if (zone == null) {
    return null;
  }
  CryptoProtocolVersion protocolVersion = fsn.chooseProtocolVersion(
      zone, supportedVersions);
  CipherSuite suite = zone.getSuite();
  String ezKeyName = zone.getKeyName();

  Preconditions.checkNotNull(protocolVersion);
  Preconditions.checkNotNull(suite);
  Preconditions.checkArgument(!suite.equals(CipherSuite.UNKNOWN),
                              "Chose an UNKNOWN CipherSuite!");
  Preconditions.checkNotNull(ezKeyName);
  return new EncryptionKeyInfo(protocolVersion, suite, ezKeyName);
}
 

import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
@SuppressWarnings("unchecked")
private static void mockCreate(ClientProtocol mcp,
    CipherSuite suite, CryptoProtocolVersion version) throws Exception {
  Mockito.doReturn(
      new HdfsFileStatus(0, false, 1, 1024, 0, 0, new FsPermission(
          (short) 777), "owner", "group", new byte[0], new byte[0],
          1010, 0, new FileEncryptionInfo(suite,
          version, new byte[suite.getAlgorithmBlockSize()],
          new byte[suite.getAlgorithmBlockSize()],
          "fakeKey", "fakeVersion"),
          (byte) 0, null))
      .when(mcp)
      .create(anyString(), (FsPermission) anyObject(), anyString(),
          (EnumSetWritable<CreateFlag>) anyObject(), anyBoolean(),
          anyShort(), anyLong(), (CryptoProtocolVersion[]) anyObject());
}
 

import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
@Override
public void setConf(Configuration conf) {
    String reEncryptionSuite = conf.get(HADOOP_SECURITY_CRYPTO_RE_ENC_SUITE_KEY,
        HADOOP_SECURITY_CRYPTO_RE_ENC_SUITE_DEFAULT);
    suite = CipherSuite.convert(reEncryptionSuite);
    this.conf = conf;
}
 

import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
/**
 * Negotiate a cipher option which server supports.
 * 
 * @param conf the configuration
 * @param options the cipher options which client supports
 * @return CipherOption negotiated cipher option
 */
public static CipherOption negotiateCipherOption(Configuration conf,
    List<CipherOption> options) throws IOException {
  // Negotiate cipher suites if configured.  Currently, the only supported
  // cipher suite is AES/CTR/NoPadding, but the protocol allows multiple
  // values for future expansion.
  String cipherSuites = conf.get(DFS_ENCRYPT_DATA_TRANSFER_CIPHER_SUITES_KEY);
  if (cipherSuites == null || cipherSuites.isEmpty()) {
    return null;
  }
  if (!cipherSuites.equals(CipherSuite.AES_CTR_NOPADDING.getName())) {
    throw new IOException(String.format("Invalid cipher suite, %s=%s",
        DFS_ENCRYPT_DATA_TRANSFER_CIPHER_SUITES_KEY, cipherSuites));
  }
  if (options != null) {
    for (CipherOption option : options) {
      CipherSuite suite = option.getCipherSuite();
      if (suite == CipherSuite.AES_CTR_NOPADDING) {
        int keyLen = conf.getInt(
            DFS_ENCRYPT_DATA_TRANSFER_CIPHER_KEY_BITLENGTH_KEY,
            DFS_ENCRYPT_DATA_TRANSFER_CIPHER_KEY_BITLENGTH_DEFAULT) / 8;
        CryptoCodec codec = CryptoCodec.getInstance(conf, suite);
        byte[] inKey = new byte[keyLen];
        byte[] inIv = new byte[suite.getAlgorithmBlockSize()];
        byte[] outKey = new byte[keyLen];
        byte[] outIv = new byte[suite.getAlgorithmBlockSize()];
        codec.generateSecureRandom(inKey);
        codec.generateSecureRandom(inIv);
        codec.generateSecureRandom(outKey);
        codec.generateSecureRandom(outIv);
        return new CipherOption(suite, inKey, inIv, outKey, outIv);
      }
    }
  }
  return null;
}
 

import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
public EncryptionZone(long id, String path, CipherSuite suite,
    CryptoProtocolVersion version, String keyName) {
  this.id = id;
  this.path = path;
  this.suite = suite;
  this.version = version;
  this.keyName = keyName;
}
 

import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
XAttr createEncryptionZone(String src, CipherSuite suite,
    CryptoProtocolVersion version, String keyName)
  throws IOException {
  writeLock();
  try {
    return ezManager.createEncryptionZone(src, suite, version, keyName);
  } finally {
    writeUnlock();
  }
}
 

import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
private void createEncryptionZoneInt(final String srcArg, String cipher,
    String keyName, final boolean logRetryCache) throws IOException {
  String src = srcArg;
  HdfsFileStatus resultingStat = null;
  checkSuperuserPrivilege();
  checkOperation(OperationCategory.WRITE);
  final byte[][] pathComponents =
    FSDirectory.getPathComponentsForReservedPath(src);
  FSPermissionChecker pc = getPermissionChecker();
  writeLock();
  try {
    checkSuperuserPrivilege();
    checkOperation(OperationCategory.WRITE);
    checkNameNodeSafeMode("Cannot create encryption zone on " + src);
    src = dir.resolvePath(pc, src, pathComponents);

    final CipherSuite suite = CipherSuite.convert(cipher);
    // For now this is hardcoded, as we only support one method.
    final CryptoProtocolVersion version =
        CryptoProtocolVersion.ENCRYPTION_ZONES;
    final XAttr ezXAttr = dir.createEncryptionZone(src, suite,
        version, keyName);
    List<XAttr> xAttrs = Lists.newArrayListWithCapacity(1);
    xAttrs.add(ezXAttr);
    getEditLog().logSetXAttrs(src, xAttrs, logRetryCache);
    final INodesInPath iip = dir.getINodesInPath4Write(src, false);
    resultingStat = dir.getAuditFileInfo(iip);
  } finally {
    writeUnlock();
  }
  getEditLog().logSync();
  logAuditEvent(true, "createEncryptionZone", srcArg, null, resultingStat);
}
 

import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
EncryptionZoneInt(long inodeId, CipherSuite suite,
    CryptoProtocolVersion version, String keyName) {
  Preconditions.checkArgument(suite != CipherSuite.UNKNOWN);
  Preconditions.checkArgument(version != CryptoProtocolVersion.UNKNOWN);
  this.inodeId = inodeId;
  this.suite = suite;
  this.version = version;
  this.keyName = keyName;
}
 

import org.apache.hadoop.crypto.CipherSuite; //导入依赖的package包/类
/**
 * Create a new encryption zone.
 * <p/>
 * Called while holding the FSDirectory lock.
 */
XAttr createEncryptionZone(String src, CipherSuite suite,
    CryptoProtocolVersion version, String keyName)
    throws IOException {
  assert dir.hasWriteLock();
  final INodesInPath srcIIP = dir.getINodesInPath4Write(src, false);
  if (dir.isNonEmptyDirectory(srcIIP)) {
    throw new IOException(
        "Attempt to create an encryption zone for a non-empty directory.");
  }

  if (srcIIP != null &&
      srcIIP.getLastINode() != null &&
      !srcIIP.getLastINode().isDirectory()) {
    throw new IOException("Attempt to create an encryption zone for a file.");
  }
  EncryptionZoneInt ezi = getEncryptionZoneForPath(srcIIP);
  if (ezi != null) {
    throw new IOException("Directory " + src + " is already in an " +
        "encryption zone. (" + getFullPathName(ezi) + ")");
  }

  final HdfsProtos.ZoneEncryptionInfoProto proto =
      PBHelper.convert(suite, version, keyName);
  final XAttr ezXAttr = XAttrHelper
      .buildXAttr(CRYPTO_XATTR_ENCRYPTION_ZONE, proto.toByteArray());

  final List<XAttr> xattrs = Lists.newArrayListWithCapacity(1);
  xattrs.add(ezXAttr);
  // updating the xattr will call addEncryptionZone,
  // done this way to handle edit log loading
  FSDirXAttrOp.unprotectedSetXAttrs(dir, src, xattrs,
                                    EnumSet.of(XAttrSetFlag.CREATE));
  return ezXAttr;
}