[HDFS-15230] Sanity check should not assume key base name can be derived from version name

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Assignee: Unassigned
• Reporter: Wei-Chiu Chuang
• Created: 20/Mar/20 17:31
• Updated: 07/Sep/21 18:50

Description

HDFS-14884 checks if the encryption info of a file matches the encryption zone key.

        if (!KeyProviderCryptoExtension.
                getBaseName(keyVersionName).equals(zoneKeyName)) {
          throw new IllegalArgumentException(String.format(
                  "KeyVersion '%s' does not belong to the key '%s'",
                  keyVersionName, zoneKeyName));
        }

Here it assumes the "base name" can be derived from key version name, and that the base name should be the same as zone key.

However, there is no published definition of what a key version name should be.

While the code works for the builtin JKS key provider, it may not work for other kind of key providers. (Specifically, it breaks Cloudera's KeyTrustee KMS KeyProvider)

Issue Links

• is broken by: HDFS-14884 Add sanity check that zone key equals feinfo key while setting Xattrs