/**
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.hadoop.hive.ql.security.authorization.plugin.sqlstd;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
import java.lang.reflect.Field;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import org.apache.hadoop.hive.conf.HiveConf;
import org.apache.hadoop.hive.conf.HiveConf.ConfVars;
import org.apache.hadoop.hive.ql.security.HadoopDefaultAuthenticator;
import org.apache.hadoop.hive.ql.security.authorization.plugin.DisallowTransformHook;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzPluginException;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzSessionContext;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzSessionContext.Builder;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzSessionContext.CLIENT_TYPE;
import org.junit.Test;
import com.google.common.base.Joiner;
/**
* Test SQLStdHiveAccessController
*/
public class TestSQLStdHiveAccessControllerHS2 {
/**
* Test if SQLStdHiveAccessController is applying configuration security
* policy on hiveconf correctly
*
* @throws HiveAuthzPluginException
* @throws IllegalAccessException
* @throws NoSuchFieldException
* @throws IllegalArgumentException
* @throws SecurityException
*/
@Test
public void testConfigProcessing() throws HiveAuthzPluginException, SecurityException,
IllegalArgumentException, NoSuchFieldException, IllegalAccessException {
HiveConf processedConf = newAuthEnabledConf();
SQLStdHiveAccessController accessController = new SQLStdHiveAccessController(null,
processedConf, new HadoopDefaultAuthenticator(), getHS2SessionCtx());
accessController.applyAuthorizationConfigPolicy(processedConf);
// check that hook to disable transforms has been added
assertTrue("Check for transform query disabling hook",
processedConf.getVar(ConfVars.PREEXECHOOKS).contains(DisallowTransformHook.class.getName()));
List<String> settableParams = getSettableParams();
verifyParamSettability(settableParams, processedConf);
}
private HiveConf newAuthEnabledConf() {
HiveConf conf = new HiveConf();
conf.setBoolVar(ConfVars.HIVE_AUTHORIZATION_ENABLED, true);
return conf;
}
/**
* @return list of parameters that should be possible to set
*/
private List<String> getSettableParams() throws SecurityException, NoSuchFieldException,
IllegalArgumentException, IllegalAccessException {
// get all the variable names being converted to regex in HiveConf, using reflection
Field varNameField = HiveConf.class.getDeclaredField("sqlStdAuthSafeVarNames");
varNameField.setAccessible(true);
List<String> confVarList = Arrays.asList((String[]) varNameField.get(null));
// create list with variables that match some of the regexes
List<String> confVarRegexList = Arrays.asList("hive.convert.join.bucket.mapjoin.tez",
"hive.optimize.index.filter.compact.maxsize", "hive.tez.dummy", "tez.task.dummy",
"hive.exec.dynamic.partition", "hive.exec.dynamic.partition.mode",
"hive.exec.max.dynamic.partitions", "hive.exec.max.dynamic.partitions.pernode",
"oozie.HadoopAccessorService.created", "tez.queue.name");
// combine two lists
List<String> varList = new ArrayList<String>();
varList.addAll(confVarList);
varList.addAll(confVarRegexList);
return varList;
}
private HiveAuthzSessionContext getHS2SessionCtx() {
Builder ctxBuilder = new HiveAuthzSessionContext.Builder();
ctxBuilder.setClientType(CLIENT_TYPE.HIVESERVER2);
return ctxBuilder.build();
}
/**
* Verify that params in settableParams can be modified, and other random ones can't be modified
* @param settableParams
* @param processedConf
*/
private void verifyParamSettability(List<String> settableParams, HiveConf processedConf) {
// verify that the whitlelist params can be set
for (String param : settableParams) {
try {
processedConf.verifyAndSet(param, "dummy");
} catch (IllegalArgumentException e) {
fail("Unable to set value for parameter in whitelist " + param + " " + e);
}
}
// verify that non whitelist params can't be set
assertConfModificationException(processedConf, "dummy.param");
// does not make sense to have any of the metastore config variables to be
// modifiable
for (ConfVars metaVar : HiveConf.metaVars) {
assertConfModificationException(processedConf, metaVar.varname);
}
}
/**
* Test that setting HIVE_AUTHORIZATION_SQL_STD_AUTH_CONFIG_WHITELIST_APPEND config works
* @throws HiveAuthzPluginException
*/
@Test
public void testConfigProcessingCustomSetWhitelistAppend() throws HiveAuthzPluginException {
// append new config params to whitelist
List<String> paramRegexes = Arrays.asList("hive.ctest.param", "hive.abc..*");
List<String> settableParams = Arrays.asList("hive.ctest.param", "hive.abc.def");
verifySettability(paramRegexes, settableParams,
ConfVars.HIVE_AUTHORIZATION_SQL_STD_AUTH_CONFIG_WHITELIST_APPEND);
}
/**
* Test that setting HIVE_AUTHORIZATION_SQL_STD_AUTH_CONFIG_WHITELIST config works
* @throws HiveAuthzPluginException
*/
@Test
public void testConfigProcessingCustomSetWhitelist() throws HiveAuthzPluginException {
// append new config params to whitelist
List<String> paramRegexes = Arrays.asList("hive.ctest.param", "hive.abc..*");
List<String> settableParams = Arrays.asList("hive.ctest.param", "hive.abc.def");
verifySettability(paramRegexes, settableParams,
ConfVars.HIVE_AUTHORIZATION_SQL_STD_AUTH_CONFIG_WHITELIST);
}
private void verifySettability(List<String> paramRegexes, List<String> settableParams,
ConfVars whiteListParam) throws HiveAuthzPluginException {
HiveConf processedConf = newAuthEnabledConf();
processedConf.setVar(whiteListParam,
Joiner.on("|").join(paramRegexes));
SQLStdHiveAccessController accessController = new SQLStdHiveAccessController(null,
processedConf, new HadoopDefaultAuthenticator(), getHS2SessionCtx());
accessController.applyAuthorizationConfigPolicy(processedConf);
verifyParamSettability(settableParams, processedConf);
}
private void assertConfModificationException(HiveConf processedConf, String param) {
boolean caughtEx = false;
try {
processedConf.verifyAndSet(param, "dummy");
} catch (IllegalArgumentException e) {
caughtEx = true;
}
assertTrue("Exception should be thrown while modifying the param " + param, caughtEx);
}
}