busbey commented on a change in pull request #2539: URL: https://github.com/apache/hbase/pull/2539#discussion_r519996581
########## File path: hbase-server/src/test/java/org/apache/hadoop/hbase/regionserver/TestEncryptionDisabled.java ########## @@ -0,0 +1,110 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.hadoop.hbase.regionserver; + +import static org.junit.Assert.assertTrue; +import static org.junit.Assert.fail; + +import org.apache.hadoop.conf.Configuration; +import org.apache.hadoop.hbase.DoNotRetryIOException; +import org.apache.hadoop.hbase.HBaseClassTestRule; +import org.apache.hadoop.hbase.HBaseTestingUtility; +import org.apache.hadoop.hbase.HConstants; +import org.apache.hadoop.hbase.TableName; +import org.apache.hadoop.hbase.client.ColumnFamilyDescriptorBuilder; +import org.apache.hadoop.hbase.client.TableDescriptorBuilder; +import org.apache.hadoop.hbase.io.crypto.Encryption; +import org.apache.hadoop.hbase.io.crypto.KeyProviderForTesting; +import org.apache.hadoop.hbase.testclassification.MasterTests; +import org.apache.hadoop.hbase.testclassification.MediumTests; +import org.apache.hadoop.hbase.util.Bytes; +import org.apache.hadoop.hbase.util.TableDescriptorChecker; +import org.junit.AfterClass; +import org.junit.BeforeClass; +import org.junit.ClassRule; +import org.junit.Test; +import org.junit.experimental.categories.Category; + +@Category({MasterTests.class, MediumTests.class}) +public class TestEncryptionDisabled { + + @ClassRule + public static final HBaseClassTestRule CLASS_RULE = + HBaseClassTestRule.forClass(TestEncryptionDisabled.class); + + private static final HBaseTestingUtility TEST_UTIL = new HBaseTestingUtility(); + private static Configuration conf = TEST_UTIL.getConfiguration(); + private static TableDescriptorBuilder tdb; + + + @BeforeClass + public static void setUp() throws Exception { + conf.setInt("hfile.format.version", 3); + conf.set(HConstants.CRYPTO_KEYPROVIDER_CONF_KEY, KeyProviderForTesting.class.getName()); + conf.set(HConstants.CRYPTO_MASTERKEY_NAME_CONF_KEY, "hbase"); + conf.set(Encryption.CRYPTO_ENABLED_CONF_KEY, "false"); + conf.set(TableDescriptorChecker.TABLE_SANITY_CHECKS, "true"); + + // Start the minicluster + TEST_UTIL.startMiniCluster(1); + } + + @AfterClass + public static void tearDown() throws Exception { + TEST_UTIL.shutdownMiniCluster(); + } + + @Test + public void testEncryptedTableShouldNotBeCreatedWhenEncryptionDisabled() throws Exception { + // Create the table schema + // Specify an encryption algorithm without a key (normally HBase would generate a random key) + tdb = TableDescriptorBuilder.newBuilder(TableName.valueOf("default", + "TestEncryptionDisabledFail")); + ColumnFamilyDescriptorBuilder columnFamilyDescriptorBuilder = + ColumnFamilyDescriptorBuilder.newBuilder(Bytes.toBytes("cf")); + String algorithm = conf.get(HConstants.CRYPTO_KEY_ALGORITHM_CONF_KEY, HConstants.CIPHER_AES); + columnFamilyDescriptorBuilder.setEncryptionType(algorithm); + tdb.setColumnFamily(columnFamilyDescriptorBuilder.build()); + + // Create the test table, we expect to get back an exception + try { Review comment: follow on: do this kind of exception checking with JUnit's `ExpectedException` rule ########## File path: hbase-server/src/test/java/org/apache/hadoop/hbase/util/TestEncryptionTest.java ########## @@ -91,6 +92,35 @@ public void testTestCipher() { } catch (Exception e) { } } + @Test + public void testTestEnabled() { Review comment: follow on: * break this into two tests e.g. `testDefaultEnabled` and `testSetToEnabled`. * the third test condition feels like it is duplicating work done in `TestEncryptionDisabled`, but if I'm wrong about that then make it a third test an use JUnit's expected for the exception. ########## File path: hbase-client/src/main/java/org/apache/hadoop/hbase/security/EncryptionUtil.java ########## @@ -186,6 +198,10 @@ public static Key unwrapWALKey(Configuration conf, String subject, byte[] value) Encryption.Context cryptoContext = Encryption.Context.NONE; String cipherName = family.getEncryptionType(); if (cipherName != null) { + if(!Encryption.isEncryptionEnabled(conf)) { + throw new RuntimeException("Encryption for family '" + family.getNameAsString() Review comment: followon: do this via `IllegalStateException` ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected]
