|
| 1 | +/* |
| 2 | + * Licensed to the Apache Software Foundation (ASF) under one or more |
| 3 | + * contributor license agreements. See the NOTICE file distributed with |
| 4 | + * this work for additional information regarding copyright ownership. |
| 5 | + * The ASF licenses this file to You under the Apache License, Version 2.0 |
| 6 | + * (the "License"); you may not use this file except in compliance with |
| 7 | + * the License. You may obtain a copy of the License at |
| 8 | + * |
| 9 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | + * |
| 11 | + * Unless required by applicable law or agreed to in writing, software |
| 12 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | + * See the License for the specific language governing permissions and |
| 15 | + * limitations under the License. |
| 16 | + */ |
| 17 | + |
| 18 | +package org.apache.hadoop.ozone.security; |
| 19 | + |
| 20 | +import static org.apache.hadoop.ozone.om.exceptions.OMException.ResultCodes.INTERNAL_ERROR; |
| 21 | +import static org.apache.hadoop.ozone.om.exceptions.OMException.ResultCodes.REVOKED_TOKEN; |
| 22 | +import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; |
| 23 | +import static org.junit.jupiter.api.Assertions.assertEquals; |
| 24 | +import static org.junit.jupiter.api.Assertions.assertThrows; |
| 25 | +import static org.junit.jupiter.api.Assertions.assertTrue; |
| 26 | +import static org.mockito.ArgumentMatchers.any; |
| 27 | +import static org.mockito.ArgumentMatchers.anyString; |
| 28 | +import static org.mockito.ArgumentMatchers.eq; |
| 29 | +import static org.mockito.Mockito.CALLS_REAL_METHODS; |
| 30 | +import static org.mockito.Mockito.doThrow; |
| 31 | +import static org.mockito.Mockito.mock; |
| 32 | +import static org.mockito.Mockito.mockStatic; |
| 33 | +import static org.mockito.Mockito.spy; |
| 34 | +import static org.mockito.Mockito.when; |
| 35 | + |
| 36 | +import java.time.Clock; |
| 37 | +import java.util.UUID; |
| 38 | +import java.util.concurrent.ThreadLocalRandom; |
| 39 | +import org.apache.hadoop.hdds.security.symmetric.SecretKeyClient; |
| 40 | +import org.apache.hadoop.hdds.utils.db.InMemoryTestTable; |
| 41 | +import org.apache.hadoop.hdds.utils.db.Table; |
| 42 | +import org.apache.hadoop.ozone.om.OMMetadataManager; |
| 43 | +import org.apache.hadoop.ozone.om.OzoneManager; |
| 44 | +import org.apache.hadoop.ozone.om.exceptions.OMException; |
| 45 | +import org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.OMRequest; |
| 46 | +import org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.S3Authentication; |
| 47 | +import org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.Type; |
| 48 | +import org.apache.ozone.test.TestClock; |
| 49 | +import org.junit.jupiter.api.Test; |
| 50 | +import org.mockito.MockedStatic; |
| 51 | + |
| 52 | +/** |
| 53 | + * Tests for STS revocation handling in {@link S3SecurityUtil}. |
| 54 | + */ |
| 55 | +public class TestS3SecurityUtil { |
| 56 | + private static final byte[] ENCRYPTION_KEY = new byte[5]; |
| 57 | + private static final TestClock CLOCK = TestClock.newInstance(); |
| 58 | + |
| 59 | + { |
| 60 | + ThreadLocalRandom.current().nextBytes(ENCRYPTION_KEY); |
| 61 | + } |
| 62 | + |
| 63 | + @Test |
| 64 | + public void testValidateS3CredentialFailsWhenTokenRevoked() throws Exception { |
| 65 | + // If the revoked STS token table contains an entry for the temporary access key id extracted from the session |
| 66 | + // token, validateS3Credential should reject the request with REVOKED_TOKEN |
| 67 | + final OMMetadataManager metadataManager = mock(OMMetadataManager.class); |
| 68 | + final Table<String, String> revokedSTSTokenTable = new InMemoryTestTable<>(); |
| 69 | + validateS3CredentialHelper( |
| 70 | + "session-token-a", metadataManager, revokedSTSTokenTable, true, createSTSTokenIdentifier(), |
| 71 | + REVOKED_TOKEN, "STS token has been revoked"); |
| 72 | + } |
| 73 | + |
| 74 | + @Test |
| 75 | + public void testValidateS3CredentialWhenMetadataUnavailable() throws Exception { |
| 76 | + // If the metadata manager is not available, throws INTERNAL_ERROR |
| 77 | + validateS3CredentialHelper( |
| 78 | + "session-token-b", null, null, false, createSTSTokenIdentifier(), |
| 79 | + INTERNAL_ERROR, "Could not determine STS revocation: metadataManager is null"); |
| 80 | + } |
| 81 | + |
| 82 | + @Test |
| 83 | + public void testValidateS3CredentialSuccessWhenNotRevoked() throws Exception { |
| 84 | + // Normal case: token is NOT revoked and request is accepted |
| 85 | + final OMMetadataManager metadataManager = mock(OMMetadataManager.class); |
| 86 | + final Table<String, String> revokedSTSTokenTable = new InMemoryTestTable<>(); |
| 87 | + validateS3CredentialHelper( |
| 88 | + "session-token-c", metadataManager, revokedSTSTokenTable, false, createSTSTokenIdentifier(), |
| 89 | + null, null); |
| 90 | + } |
| 91 | + |
| 92 | + @Test |
| 93 | + public void testValidateS3CredentialWhenMetadataManagerAvailableButRevokedTableNull() throws Exception { |
| 94 | + // If the revoked STS token table is not available, throws INTERNAL_ERROR |
| 95 | + final OMMetadataManager metadataManager = mock(OMMetadataManager.class); |
| 96 | + validateS3CredentialHelper( |
| 97 | + "session-token-d", metadataManager, null, false, createSTSTokenIdentifier(), |
| 98 | + INTERNAL_ERROR, "Could not determine STS revocation: revokedStsTokenTable is null"); |
| 99 | + } |
| 100 | + |
| 101 | + @Test |
| 102 | + public void testValidateS3CredentialWhenTableThrowsException() throws Exception { |
| 103 | + // If the revoked STS token table lookup throws, throws INTERNAL_ERROR (wrapped) |
| 104 | + final OMMetadataManager metadataManager = mock(OMMetadataManager.class); |
| 105 | + final Table<String, String> revokedSTSTokenTable = spy(new InMemoryTestTable<>()); |
| 106 | + doThrow(new RuntimeException("lookup failed")).when(revokedSTSTokenTable).getIfExist(anyString()); |
| 107 | + validateS3CredentialHelper( |
| 108 | + "session-token-g", metadataManager, revokedSTSTokenTable, false, createSTSTokenIdentifier(), |
| 109 | + INTERNAL_ERROR, "Could not determine STS revocation because of Exception: lookup failed"); |
| 110 | + } |
| 111 | + |
| 112 | + private void validateS3CredentialHelper(String sessionToken, OMMetadataManager metadataManager, |
| 113 | + Table<String, String> revokedSTSTokenTable, boolean isRevoked, STSTokenIdentifier stsTokenIdentifier, |
| 114 | + OMException.ResultCodes expectedResult, String expectedMessageContents) throws Exception { |
| 115 | + |
| 116 | + try (OzoneManager ozoneManager = mock(OzoneManager.class)) { |
| 117 | + when(ozoneManager.isSecurityEnabled()).thenReturn(true); |
| 118 | + when(ozoneManager.getSecretKeyClient()).thenReturn(mock(SecretKeyClient.class)); |
| 119 | + |
| 120 | + when(ozoneManager.getMetadataManager()).thenReturn(metadataManager); |
| 121 | + if (metadataManager != null) { |
| 122 | + when(metadataManager.getS3RevokedStsTokenTable()).thenReturn(revokedSTSTokenTable); |
| 123 | + } |
| 124 | + |
| 125 | + final String tempAccessKeyId = "temp-access-key-id"; |
| 126 | + if (isRevoked) { |
| 127 | + if (revokedSTSTokenTable == null) { |
| 128 | + throw new IllegalArgumentException("revokedSTSTokenTable must not be null when isRevoked=true"); |
| 129 | + } |
| 130 | + revokedSTSTokenTable.put(tempAccessKeyId, sessionToken); |
| 131 | + } |
| 132 | + |
| 133 | + try (MockedStatic<STSSecurityUtil> stsSecurityUtilMock = mockStatic(STSSecurityUtil.class, CALLS_REAL_METHODS); |
| 134 | + MockedStatic<AWSV4AuthValidator> awsV4AuthValidatorMock = mockStatic( |
| 135 | + AWSV4AuthValidator.class, CALLS_REAL_METHODS)) { |
| 136 | + |
| 137 | + stsSecurityUtilMock.when( |
| 138 | + () -> STSSecurityUtil.constructValidateAndDecryptSTSToken( |
| 139 | + eq(sessionToken), any(SecretKeyClient.class), any(Clock.class))) |
| 140 | + .thenReturn(stsTokenIdentifier); |
| 141 | + |
| 142 | + // Mock AWS V4 signature validation |
| 143 | + awsV4AuthValidatorMock.when(() -> AWSV4AuthValidator.validateRequest(anyString(), anyString(), anyString())) |
| 144 | + .thenReturn(true); |
| 145 | + |
| 146 | + final OMRequest omRequest = createRequestWithSessionToken(sessionToken); |
| 147 | + |
| 148 | + if (expectedResult != null) { |
| 149 | + final OMException omException = assertThrows( |
| 150 | + OMException.class, () -> S3SecurityUtil.validateS3Credential(omRequest, ozoneManager)); |
| 151 | + assertEquals(expectedResult, omException.getResult()); |
| 152 | + if (expectedMessageContents != null) { |
| 153 | + assertTrue( |
| 154 | + omException.getMessage().contains(expectedMessageContents), |
| 155 | + "Expected exception message to contain: '" + expectedMessageContents + "' but was: '" + |
| 156 | + omException.getMessage() + "'"); |
| 157 | + } |
| 158 | + } else { |
| 159 | + assertDoesNotThrow(() -> S3SecurityUtil.validateS3Credential(omRequest, ozoneManager)); |
| 160 | + } |
| 161 | + } |
| 162 | + } |
| 163 | + } |
| 164 | + |
| 165 | + private STSTokenIdentifier createSTSTokenIdentifier() { |
| 166 | + return new STSTokenIdentifier( |
| 167 | + "temp-access-key-id", "original-access-key-id", "arn:aws:iam::123456789012:role/test-role", |
| 168 | + CLOCK.instant().plusSeconds(3600), "secret-access-key", "session-policy", |
| 169 | + ENCRYPTION_KEY); |
| 170 | + } |
| 171 | + |
| 172 | + private static OMRequest createRequestWithSessionToken(String sessionToken) { |
| 173 | + final S3Authentication s3Authentication = S3Authentication.newBuilder() |
| 174 | + .setAccessId("accessKeyId") |
| 175 | + .setStringToSign("string-to-sign") |
| 176 | + .setSignature("signature") |
| 177 | + .setSessionToken(sessionToken) |
| 178 | + .build(); |
| 179 | + |
| 180 | + return OMRequest.newBuilder() |
| 181 | + .setClientId(UUID.randomUUID().toString()) |
| 182 | + .setCmdType(Type.CreateVolume) |
| 183 | + .setS3Authentication(s3Authentication) |
| 184 | + .build(); |
| 185 | + } |
| 186 | +} |
0 commit comments