RangerKeyStore.java

/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.apache.hadoop.crypto.key;

import com.microsoft.azure.keyvault.KeyVaultClient;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.DataInputStream;
import java.io.DataOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.OutputStream;
import java.io.Serializable;
import java.io.UnsupportedEncodingException;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.security.AlgorithmParameters;
import java.security.DigestInputStream;
import java.security.DigestOutputStream;
import java.security.Key;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.KeyStoreSpi;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.security.UnrecoverableKeyException;
import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.util.Collections;
import java.util.Date;
import java.util.Enumeration;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import java.util.concurrent.ConcurrentHashMap;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.KeyGenerator;
import javax.crypto.SealedObject;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.PBEParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import javax.xml.bind.DatatypeConverter;
import org.apache.hadoop.conf.Configuration;
import org.apache.commons.lang.StringUtils;
import org.apache.hadoop.crypto.key.KeyProvider.Metadata;
import org.apache.hadoop.crypto.key.RangerKeyStoreProvider.KeyMetadata;
import org.apache.log4j.Logger;
import org.apache.ranger.entity.XXRangerKeyStore;
import org.apache.ranger.kms.dao.DaoManager;
import org.apache.ranger.kms.dao.RangerKMSDao;
import org.codehaus.jackson.JsonParseException;
import org.codehaus.jackson.map.JsonMappingException;
import org.codehaus.jackson.map.ObjectMapper;
import org.codehaus.jackson.type.TypeReference;

/**
 * This class provides the Database store implementation.
 */

public class RangerKeyStore extends KeyStoreSpi {

    static final Logger logger = Logger.getLogger(RangerKeyStore.class);
    private static final String KEY_METADATA = "KeyMetadata";
    private static final String KEY_NAME_VALIDATION = "[a-z,A-Z,0-9](?!.*--)(?!.*__)(?!.*-_)(?!.*_-)[\\w\\-\\_]*";
    private static final Pattern pattern = Pattern.compile(KEY_NAME_VALIDATION);
    private static final String AZURE_KEYVAULT_ENABLED = "ranger.kms.azurekeyvault.enabled";
    private boolean azureKeyVaultEnabled = false;

    private DaoManager daoManager;
    private RangerKeyVaultKeyGenerator kvKeyGen;

    // keys
    private static class KeyEntry {
        Date date = new Date(); // the creation date of this entry
    }

    // Secret key
	private static final class SecretKeyEntry {
		Date date = new Date(); // the creation date of this entry
		SealedObject sealedKey;
		String cipher_field;
		int bit_length;
		String description;
		String attributes;
		int version;
	}

	private static final class SecretKeyByteEntry {
		Date date = new Date();
		byte[] key;
		String cipher_field;
		int bit_length;
		String description;
		String attributes;
		int version;
	}

    private Map<String, Object> keyEntries = new ConcurrentHashMap<>();
    private Map<String, Object> deltaEntries = new ConcurrentHashMap<>();

    RangerKeyStore() {
    }

    public RangerKeyStore(DaoManager daoManager) {
        this.daoManager = daoManager;
    }
    
    public RangerKeyStore(DaoManager daoManager, Configuration conf, KeyVaultClient kvClient) {
        this.daoManager = daoManager;
        this.kvKeyGen = new RangerKeyVaultKeyGenerator(conf, kvClient);
        if(conf != null
				&& StringUtils.isNotEmpty(conf
						.get(AZURE_KEYVAULT_ENABLED))
				&& conf.get(AZURE_KEYVAULT_ENABLED).equalsIgnoreCase(
						"true")){
        	azureKeyVaultEnabled = true;
        }
    }

    String convertAlias(String alias) {
        return alias.toLowerCase();
    }

    @Override
    public Key engineGetKey(String alias, char[] password) throws NoSuchAlgorithmException, UnrecoverableKeyException {
        if (logger.isDebugEnabled()) {
            logger.debug("==> RangerKeyStore.engineGetKey()");
        }
        Key key = null;
        Object entry = keyEntries.get(convertAlias(alias));

        if (!(entry instanceof SecretKeyEntry)) {
            return null;
        }
        try {
            key = unsealKey(((SecretKeyEntry) entry).sealedKey, password);
        } catch (Exception e) {
            logger.error("==> RangerKeyStore.engineGetKey() error: ", e);
        }
        if (logger.isDebugEnabled()) {
            logger.debug("<== RangerKeyStore.engineGetKey()");
        }
        return key;
    }
    
	public byte[] engineGetDecryptedZoneKeyByte(String alias) throws Exception {
		try {
			Object entry = keyEntries.get(convertAlias(alias));
			if (!(entry instanceof SecretKeyByteEntry)) {
				return null;
			}
			SecretKeyByteEntry key = (SecretKeyByteEntry) entry;
			byte[] decryptKeyByte = kvKeyGen.dencryptZoneKey(key.key);
			return decryptKeyByte;
		} catch (Exception ex) {
			throw new Exception("Error while decrpting zone key. Name : "
					+ alias + " Error : " + ex);
		}
	}
	
	public Key engineGetDecryptedZoneKey(String alias) throws Exception {
		byte[] decryptKeyByte = engineGetDecryptedZoneKeyByte(alias);
		Metadata metadata = engineGetKeyMetadata(alias); 
		Key k = new KeyByteMetadata(metadata, decryptKeyByte);
		return k;
	}
	
	public Metadata engineGetKeyMetadata(String alias) {
		Object entry = keyEntries.get(convertAlias(alias));
		if (!(entry instanceof SecretKeyByteEntry)) {
			return null;
		}
		SecretKeyByteEntry key = (SecretKeyByteEntry) entry;
		ObjectMapper mapper = new ObjectMapper();
		Map<String, String> attributesMap = null;
		try {
			attributesMap = mapper.readValue(key.attributes,
					new TypeReference<Map<String, String>>() {
					});
		} catch (JsonParseException e) {
			logger.error("Invalid attribute string data: " + e.getMessage());

		} catch (JsonMappingException e) {
			logger.error("Invalid attribute string data: " + e.getMessage());
		} catch (IOException e) {
			logger.error("Invalid attribute string data: " + e.getMessage());
		}
		Metadata meta = new Metadata(key.cipher_field, key.bit_length,
				key.description, attributesMap, key.date, key.version);
		return meta;
	}
	
	public void addSecureKeyByteEntry(String alias, Key key, String cipher,
			int bitLength, String description, int version, String attributes)
			throws KeyStoreException {
		SecretKeyByteEntry entry = new SecretKeyByteEntry();
		synchronized (deltaEntries) {
			try {
				entry.date = new Date();
				// encrypt and store the key
				entry.key = kvKeyGen.encryptZoneKey(key);
				entry.cipher_field = cipher;
				entry.bit_length = bitLength;
				entry.description = description;
				entry.version = version;
				entry.attributes = attributes;
				deltaEntries.put(convertAlias(alias), entry);

			} catch (Exception e) {
				logger.error(e.getMessage());
				throw new KeyStoreException(e.getMessage());
			}
		}
		synchronized (keyEntries) {
			try {
				keyEntries.put(convertAlias(alias), entry);
			} catch (Exception e) {
				logger.error(e.getMessage());
				throw new KeyStoreException(e.getMessage());
			}
		}
	}
	
    @Override
    public Date engineGetCreationDate(String alias) {
        Object entry = keyEntries.get(convertAlias(alias));
        Date date = null;
        if (entry != null) {
            KeyEntry keyEntry = (KeyEntry) entry;
            if (keyEntry.date != null) {
                date = new Date(keyEntry.date.getTime());
            }
        }
        return date;
    }

    public void addKeyEntry(String alias, Key key, char[] password, String cipher, int bitLength, String description, int version, String attributes)
            throws KeyStoreException {
        if (logger.isDebugEnabled()) {
            logger.debug("==> RangerKeyStore.addKeyEntry()");
            logger.debug("Adding entry for alias:" + alias);
        }
        SecretKeyEntry entry = new SecretKeyEntry();
        synchronized (deltaEntries) {
            try {
                entry.date = new Date();
                // seal and store the key
                entry.sealedKey = sealKey(key, password);

                entry.cipher_field = cipher;
                entry.bit_length = bitLength;
                entry.description = description;
                entry.version = version;
                entry.attributes = attributes;
                deltaEntries.put(convertAlias(alias), entry);
            } catch (Exception e) {
                logger.error("==> RangerKeyStore.addKeyEntry() error: ", e);
                throw new KeyStoreException(e.getMessage());
            }
        }
        synchronized (keyEntries) {
            try {
                keyEntries.put(convertAlias(alias), entry);
            } catch (Exception e) {
                logger.error("==> RangerKeyStore.addKeyEntry() error: ", e);
                throw new KeyStoreException(e.getMessage());
            }
        }
    }

    private SealedObject sealKey(Key key, char[] password) throws Exception {
        if (logger.isDebugEnabled()) {
            logger.debug("==> RangerKeyStore.sealKey()");
        }
        // Create SecretKey
        SecretKeyFactory secretKeyFactory = SecretKeyFactory.getInstance("PBEWithMD5AndTripleDES");
        PBEKeySpec pbeKeySpec = new PBEKeySpec(password);
        SecretKey secretKey = secretKeyFactory.generateSecret(pbeKeySpec);
        pbeKeySpec.clearPassword();

        // Generate random bytes + set up the PBEParameterSpec
        SecureRandom random = new SecureRandom();
        byte[] salt = new byte[8];
        random.nextBytes(salt);
        PBEParameterSpec pbeSpec = new PBEParameterSpec(salt, 20);

        // Seal the Key
        Cipher cipher = Cipher.getInstance("PBEWithMD5AndTripleDES");
        cipher.init(Cipher.ENCRYPT_MODE, secretKey, pbeSpec);
        if (logger.isDebugEnabled()) {
            logger.debug("<== RangerKeyStore.sealKey()");
        }
        return new RangerSealedObject(key, cipher);
    }

    private Key unsealKey(SealedObject sealedKey, char[] password) throws Exception {
        if (logger.isDebugEnabled()) {
            logger.debug("==> RangerKeyStore.unsealKey()");
        }
        // Create SecretKey
        SecretKeyFactory secretKeyFactory = SecretKeyFactory.getInstance("PBEWithMD5AndTripleDES");
        PBEKeySpec pbeKeySpec = new PBEKeySpec(password);
        SecretKey secretKey = secretKeyFactory.generateSecret(pbeKeySpec);
        pbeKeySpec.clearPassword();

        // Get the AlgorithmParameters from RangerSealedObject
        AlgorithmParameters algorithmParameters = null;
        if (sealedKey instanceof RangerSealedObject) {
            algorithmParameters = ((RangerSealedObject) sealedKey).getParameters();
        } else {
            algorithmParameters = new RangerSealedObject(sealedKey).getParameters();
        }

        // Unseal the Key
        Cipher cipher = Cipher.getInstance("PBEWithMD5AndTripleDES");
        cipher.init(Cipher.DECRYPT_MODE, secretKey, algorithmParameters);
        if (logger.isDebugEnabled()) {
            logger.debug("<== RangerKeyStore.unsealKey()");
        }
        return (Key) sealedKey.getObject(cipher);
    }

    @Override
    public void engineDeleteEntry(String alias)
            throws KeyStoreException {
        synchronized (keyEntries) {
            dbOperationDelete(convertAlias(alias));
            keyEntries.remove(convertAlias(alias));
        }
        synchronized (deltaEntries) {
            deltaEntries.remove(convertAlias(alias));
        }
    }


    private void dbOperationDelete(String alias) {
        if (logger.isDebugEnabled()) {
            logger.debug("==> RangerKeyStore.dbOperationDelete(" + alias + ")");
        }
        try {
            if (daoManager != null) {
                RangerKMSDao rangerKMSDao = new RangerKMSDao(daoManager);
                rangerKMSDao.deleteByAlias(alias);
            }
        } catch (Exception e) {
            logger.error("==> RangerKeyStore.dbOperationDelete() error : ", e);
        }
    }


    @Override
    public Enumeration<String> engineAliases() {
        return Collections.enumeration(keyEntries.keySet());
    }

    @Override
    public boolean engineContainsAlias(String alias) {
        return keyEntries.containsKey(convertAlias(alias));
    }

    @Override
    public int engineSize() {
        return keyEntries.size();
    }

    @Override
    public void engineStore(OutputStream stream, char[] password)
			throws IOException, NoSuchAlgorithmException, CertificateException {
		if (logger.isDebugEnabled()) {
			logger.debug("==> RangerKeyStore.engineStore()");
		}
		synchronized (deltaEntries) {
			if (azureKeyVaultEnabled) {
				for (Entry<String, Object> entry : deltaEntries.entrySet()) {
					Long creationDate = ((SecretKeyByteEntry) entry.getValue()).date
							.getTime();
					SecretKeyByteEntry secretSecureKey = (SecretKeyByteEntry) entry
							.getValue();
					XXRangerKeyStore xxRangerKeyStore = mapObjectToEntity(
							entry.getKey(), creationDate, secretSecureKey.key,
							secretSecureKey.cipher_field,
							secretSecureKey.bit_length,
							secretSecureKey.description,
							secretSecureKey.version, secretSecureKey.attributes);
					dbOperationStore(xxRangerKeyStore);
				}

			} else {
				// password is mandatory when storing
				if (password == null) {
					throw new IllegalArgumentException(
							"Ranger Master Key can't be null");
				}

				MessageDigest md = getKeyedMessageDigest(password);

				byte digest[] = md.digest();
				for (Entry<String, Object> entry : deltaEntries.entrySet()) {
					ByteArrayOutputStream baos = new ByteArrayOutputStream();
					DataOutputStream dos = new DataOutputStream(
							new DigestOutputStream(baos, md));

					ObjectOutputStream oos = null;
					try {

						oos = new ObjectOutputStream(dos);
						oos.writeObject(((SecretKeyEntry) entry.getValue()).sealedKey);

						dos.write(digest);
						dos.flush();
						Long creationDate = ((SecretKeyEntry) entry.getValue()).date
								.getTime();
						SecretKeyEntry secretKey = (SecretKeyEntry) entry
								.getValue();
						XXRangerKeyStore xxRangerKeyStore = mapObjectToEntity(
								entry.getKey(), creationDate,
								baos.toByteArray(), secretKey.cipher_field,
								secretKey.bit_length, secretKey.description,
								secretKey.version, secretKey.attributes);
						dbOperationStore(xxRangerKeyStore);
					} finally {
						if (oos != null) {
							oos.close();
						} else {
							dos.close();
						}
					}
				}
			}
			clearDeltaEntires();
		}
	}

    private XXRangerKeyStore mapObjectToEntity(String alias, Long creationDate,
                                               byte[] byteArray, String cipher_field, int bit_length,
                                               String description, int version, String attributes) {
        XXRangerKeyStore xxRangerKeyStore = new XXRangerKeyStore();
        xxRangerKeyStore.setAlias(alias);
        xxRangerKeyStore.setCreatedDate(creationDate);
        xxRangerKeyStore.setEncoded(DatatypeConverter.printBase64Binary(byteArray));
        xxRangerKeyStore.setCipher(cipher_field);
        xxRangerKeyStore.setBitLength(bit_length);
        xxRangerKeyStore.setDescription(description);
        xxRangerKeyStore.setVersion(version);
        xxRangerKeyStore.setAttributes(attributes);
        return xxRangerKeyStore;
    }

    public void dbOperationStore(XXRangerKeyStore rangerKeyStore) {
        if (logger.isDebugEnabled()) {
            logger.debug("==> RangerKeyStore.dbOperationStore()");
        }
        try {
            if (daoManager != null) {
                RangerKMSDao rangerKMSDao = new RangerKMSDao(daoManager);
                XXRangerKeyStore xxRangerKeyStore = rangerKMSDao.findByAlias(rangerKeyStore.getAlias());
                boolean keyStoreExists = true;
                if (xxRangerKeyStore == null) {
                    xxRangerKeyStore = new XXRangerKeyStore();
                    keyStoreExists = false;
                }
                xxRangerKeyStore = mapToEntityBean(rangerKeyStore, xxRangerKeyStore);
                if (keyStoreExists) {
                    xxRangerKeyStore = rangerKMSDao.update(xxRangerKeyStore);
                } else {
                    xxRangerKeyStore = rangerKMSDao.create(xxRangerKeyStore);
                }
            }
        } catch (Exception e) {
            logger.error("==> RangerKeyStore.dbOperationStore() error : ", e);
        }
    }

    private XXRangerKeyStore mapToEntityBean(XXRangerKeyStore rangerKMSKeyStore, XXRangerKeyStore xxRangerKeyStore) {
        xxRangerKeyStore.setAlias(rangerKMSKeyStore.getAlias());
        xxRangerKeyStore.setCreatedDate(rangerKMSKeyStore.getCreatedDate());
        xxRangerKeyStore.setEncoded(rangerKMSKeyStore.getEncoded());
        xxRangerKeyStore.setCipher(rangerKMSKeyStore.getCipher());
        xxRangerKeyStore.setBitLength(rangerKMSKeyStore.getBitLength());
        xxRangerKeyStore.setDescription(rangerKMSKeyStore.getDescription());
        xxRangerKeyStore.setVersion(rangerKMSKeyStore.getVersion());
        xxRangerKeyStore.setAttributes(rangerKMSKeyStore.getAttributes());
        return xxRangerKeyStore;
    }


    @Override
    public void engineLoad(InputStream stream, char[] password)
			throws IOException, NoSuchAlgorithmException, CertificateException {
		if (logger.isDebugEnabled()) {
			logger.debug("==> RangerKeyStore.engineLoad()");
		}

		synchronized (keyEntries) {
			List<XXRangerKeyStore> rangerKeyDetails = dbOperationLoad();

			if (rangerKeyDetails == null || rangerKeyDetails.size() < 1) {
				if (logger.isDebugEnabled()) {
					logger.debug("RangerKeyStore might be null or key is not present in the database.");
				}
				return;
			}

			keyEntries.clear();
			if (azureKeyVaultEnabled) {
				for (XXRangerKeyStore rangerKey : rangerKeyDetails) {
					String encodedStr = rangerKey.getEncoded();
					byte[] encodedByte = DatatypeConverter
							.parseBase64Binary(encodedStr);
					String alias;
					SecretKeyByteEntry entry = new SecretKeyByteEntry();
					alias = rangerKey.getAlias();
					entry.date = new Date(rangerKey.getCreatedDate());
					entry.cipher_field = rangerKey.getCipher();
					entry.bit_length = rangerKey.getBitLength();
					entry.description = rangerKey.getDescription();
					entry.version = rangerKey.getVersion();
					entry.attributes = rangerKey.getAttributes();
					entry.key = encodedByte;
					keyEntries.put(alias, entry);
				}
			} else {
				DataInputStream dis;
				MessageDigest md = null;
				if (password != null) {
					md = getKeyedMessageDigest(password);
				}

				byte computed[] = {};
				if (md != null) {
					computed = md.digest();
				}
				for (XXRangerKeyStore rangerKey : rangerKeyDetails) {

					String encoded = rangerKey.getEncoded();
					byte[] data = DatatypeConverter.parseBase64Binary(encoded);

					if (data != null && data.length > 0) {
						stream = new ByteArrayInputStream(data);
					} else {
						logger.error("No Key found for alias "
								+ rangerKey.getAlias());
					}

					if (computed != null) {
						int counter = 0;
						for (int i = computed.length - 1; i >= 0; i--) {
							if (computed[i] != data[data.length - (1 + counter)]) {
								Throwable t = new UnrecoverableKeyException(
										"Password verification failed");
								logger.error(
										"Keystore was tampered with, or password was incorrect.",
										t);
								throw (IOException) new IOException(
										"Keystore was tampered with, or "
												+ "password was incorrect")
										.initCause(t);
							} else {
								counter++;
							}
						}
					}

					if (password != null) {
						dis = new DataInputStream(new DigestInputStream(stream,
								md));
					} else {
						dis = new DataInputStream(stream);
					}

					ObjectInputStream ois = null;
					try {
						String alias;

						SecretKeyEntry entry = new SecretKeyEntry();

						// read the alias
						alias = rangerKey.getAlias();

						// read the (entry creation) date
						entry.date = new Date(rangerKey.getCreatedDate());
						entry.cipher_field = rangerKey.getCipher();
						entry.bit_length = rangerKey.getBitLength();
						entry.description = rangerKey.getDescription();
						entry.version = rangerKey.getVersion();
						entry.attributes = rangerKey.getAttributes();
						// read the sealed key
						try {
							ois = new ObjectInputStream(dis);
							entry.sealedKey = (SealedObject) ois.readObject();
						} catch (ClassNotFoundException cnfe) {
							throw new IOException(cnfe.getMessage());
						}
						// Add the entry to the list
						keyEntries.put(alias, entry);
					} finally {
						if (ois != null) {
							ois.close();
						} else {
							dis.close();
						}
					}
				}
			}
		}
	}

    private List<XXRangerKeyStore> dbOperationLoad() throws IOException {
    	if (logger.isDebugEnabled()) {
            logger.debug("==> RangerKeyStore.dbOperationLoad()");
        }
        try {
            if (daoManager != null) {
                RangerKMSDao rangerKMSDao = new RangerKMSDao(daoManager);
                if (logger.isDebugEnabled()) {
                    logger.debug("<== RangerKeyStore.dbOperationLoad()");
                }
                return rangerKMSDao.getAllKeys();
            }
        } catch (Exception e) {
            logger.error("==> RangerKeyStore.dbOperationLoad() error:", e);
        }
        if (logger.isDebugEnabled()) {
            logger.debug("<== RangerKeyStore.dbOperationLoad()");
        }
        return null;
    }

    /**
     * To guard against tampering with the keystore, we append a keyed
     * hash with a bit of whitener.
     */

    private final String SECRET_KEY_HASH_WORD = "Apache Ranger";

    private MessageDigest getKeyedMessageDigest(char[] aKeyPassword)
            throws NoSuchAlgorithmException, UnsupportedEncodingException {
        int i, j;

        MessageDigest md = MessageDigest.getInstance("SHA");
        byte[] keyPasswordBytes = new byte[aKeyPassword.length * 2];
        for (i = 0, j = 0; i < aKeyPassword.length; i++) {
            keyPasswordBytes[j++] = (byte) (aKeyPassword[i] >> 8);
            keyPasswordBytes[j++] = (byte) aKeyPassword[i];
        }
        md.update(keyPasswordBytes);
        for (i = 0; i < keyPasswordBytes.length; i++)
            keyPasswordBytes[i] = 0;
        md.update(SECRET_KEY_HASH_WORD.getBytes("UTF8"));
        return md;
    }

    @Override
    public void engineSetKeyEntry(String arg0, byte[] arg1, Certificate[] arg2)
            throws KeyStoreException {
    }

    @Override
    public Certificate engineGetCertificate(String alias) {
        return null;
    }

    @Override
    public String engineGetCertificateAlias(Certificate cert) {
        return null;
    }

    @Override
    public Certificate[] engineGetCertificateChain(String alias) {
        return null;
    }

    @Override
    public boolean engineIsCertificateEntry(String alias) {
        return false;
    }

    @Override
    public boolean engineIsKeyEntry(String alias) {
        return false;
    }

    @Override
    public void engineSetCertificateEntry(String alias, Certificate cert)
            throws KeyStoreException {
    }

    @Override
    public void engineSetKeyEntry(String alias, Key key, char[] password,
                                  Certificate[] chain) throws KeyStoreException {
    }

    //
    // The method is created to support JKS migration (from hadoop-common KMS keystore to RangerKMS keystore)
    //

    private static final String METADATA_FIELDNAME = "metadata";
    private static final int NUMBER_OF_BITS_PER_BYTE = 8;

    public void engineLoadKeyStoreFile(InputStream stream, char[] storePass,
                                       char[] keyPass, char[] masterKey, String fileFormat)
			throws IOException, NoSuchAlgorithmException, CertificateException {
		if (logger.isDebugEnabled()) {
			logger.debug("==> RangerKeyStoreProvider.engineLoadKeyStoreFile()");
		}
		synchronized (deltaEntries) {
			KeyStore ks;
			if (azureKeyVaultEnabled) {
				try {
					ks = KeyStore.getInstance(fileFormat);
					ks.load(stream, storePass);
					deltaEntries.clear();
					for (Enumeration<String> name = ks.aliases(); name
							.hasMoreElements();) {
						SecretKeyByteEntry entry = new SecretKeyByteEntry();
						String alias = (String) name.nextElement();
						Key k = ks.getKey(alias, keyPass);
						SecretKey secretKey = null;
						if (k instanceof JavaKeyStoreProvider.KeyMetadata) {
							JavaKeyStoreProvider.KeyMetadata keyMetadata = (JavaKeyStoreProvider.KeyMetadata) k;
							Field f = JavaKeyStoreProvider.KeyMetadata.class
									.getDeclaredField(METADATA_FIELDNAME);
							f.setAccessible(true);
							Metadata metadata = (Metadata) f.get(keyMetadata);
							entry.bit_length = metadata.getBitLength();
							entry.cipher_field = metadata.getAlgorithm();
							entry.version = metadata.getVersions();
							Constructor<RangerKeyStoreProvider.KeyMetadata> constructor = RangerKeyStoreProvider.KeyMetadata.class
									.getDeclaredConstructor(Metadata.class);
							constructor.setAccessible(true);
							RangerKeyStoreProvider.KeyMetadata nk = constructor
									.newInstance(metadata);
							k = nk;
							secretKey = new SecretKeySpec(k.getEncoded(),
									getAlgorithm(metadata.getAlgorithm()));
						} else if (k instanceof KeyByteMetadata) {
							Metadata metadata = ((KeyByteMetadata) k).metadata;
							entry.cipher_field = metadata.getCipher();
							entry.version = metadata.getVersions();
							entry.bit_length = metadata.getBitLength();
							if (k.getEncoded() != null && k.getEncoded().length > 0) {
								secretKey = new SecretKeySpec(k.getEncoded(),
										getAlgorithm(metadata.getAlgorithm()));
							} else {
								KeyGenerator keyGenerator = KeyGenerator
										.getInstance(getAlgorithm(metadata.getCipher()));
								keyGenerator.init(metadata.getBitLength());
								byte[] keyByte = keyGenerator.generateKey().getEncoded();
								secretKey = new SecretKeySpec(keyByte,
										getAlgorithm(metadata.getCipher()));
							}
						} else if (k instanceof KeyMetadata) {
							Metadata metadata = ((KeyMetadata) k).metadata;
							entry.bit_length = metadata.getBitLength();
							entry.cipher_field = metadata.getCipher();
							entry.version = metadata.getVersions();

							if (k.getEncoded() != null
									&& k.getEncoded().length > 0) {
								secretKey = new SecretKeySpec(k.getEncoded(),
										getAlgorithm(metadata.getAlgorithm()));
							} else {
								KeyGenerator keyGenerator = KeyGenerator
										.getInstance(getAlgorithm(metadata
												.getCipher()));
								keyGenerator.init(metadata.getBitLength());
								byte[] keyByte = keyGenerator.generateKey()
										.getEncoded();
								secretKey = new SecretKeySpec(keyByte,
										getAlgorithm(metadata.getCipher()));
							}

						}else {
							entry.bit_length = (k.getEncoded().length * NUMBER_OF_BITS_PER_BYTE);
							entry.cipher_field = k.getAlgorithm();
							if (alias.split("@").length == 2) {
								entry.version = Integer.parseInt(alias
										.split("@")[1]) + 1;
							} else {
								entry.version = 1;
							}
							
							if(k.getEncoded() != null && k.getEncoded().length > 0){
								secretKey = new SecretKeySpec(k.getEncoded(),
										getAlgorithm(k.getAlgorithm()));
							}
						}

						String keyName = alias.split("@")[0];
						validateKeyName(keyName);
						entry.attributes = "{\"key.acl.name\":\"" + keyName
								+ "\"}";
						entry.key = kvKeyGen.encryptZoneKey(secretKey);
						entry.date = ks.getCreationDate(alias);
						entry.description = k.getFormat() + " - "
								+ ks.getType();
						deltaEntries.put(alias, entry);
					}
				} catch (Throwable t) {
					logger.error("Unable to load keystore file ", t);
					throw new IOException(t);
				}
			} else {
				try {
					ks = KeyStore.getInstance(fileFormat);
					ks.load(stream, storePass);
					deltaEntries.clear();
					for (Enumeration<String> name = ks.aliases(); name
							.hasMoreElements();) {
						SecretKeyEntry entry = new SecretKeyEntry();
						String alias = (String) name.nextElement();
						Key k = ks.getKey(alias, keyPass);

						if (k instanceof JavaKeyStoreProvider.KeyMetadata) {
							JavaKeyStoreProvider.KeyMetadata keyMetadata = (JavaKeyStoreProvider.KeyMetadata) k;
							Field f = JavaKeyStoreProvider.KeyMetadata.class
									.getDeclaredField(METADATA_FIELDNAME);
							f.setAccessible(true);
							Metadata metadata = (Metadata) f.get(keyMetadata);
							entry.bit_length = metadata.getBitLength();
							entry.cipher_field = metadata.getAlgorithm();
							entry.version = metadata.getVersions();
							Constructor<RangerKeyStoreProvider.KeyMetadata> constructor = RangerKeyStoreProvider.KeyMetadata.class
									.getDeclaredConstructor(Metadata.class);
							constructor.setAccessible(true);
							RangerKeyStoreProvider.KeyMetadata nk = constructor
									.newInstance(metadata);
							k = nk;
						} else if (k instanceof KeyMetadata) {
							Metadata metadata = ((KeyMetadata) k).metadata;
							entry.bit_length = metadata.getBitLength();
							entry.cipher_field = metadata.getCipher();
							entry.version = metadata.getVersions();
						} else {
							entry.bit_length = (k.getEncoded().length * NUMBER_OF_BITS_PER_BYTE);
							entry.cipher_field = k.getAlgorithm();
							entry.version = (alias.split("@").length == 2) ? (Integer
									.parseInt(alias.split("@")[1]) + 1) : 1;
						}
						String keyName = alias.split("@")[0];
						validateKeyName(keyName);
						entry.attributes = "{\"key.acl.name\":\"" + keyName
								+ "\"}";
						Class<?> c = null;
						Object o = null;
						try {
							c = Class
									.forName("com.sun.crypto.provider.KeyProtector");
							Constructor<?> constructor = c
									.getDeclaredConstructor(char[].class);
							constructor.setAccessible(true);
							o = constructor.newInstance(masterKey);
							// seal and store the key
							Method m = c.getDeclaredMethod("seal", Key.class);
							m.setAccessible(true);
							entry.sealedKey = (SealedObject) m.invoke(o, k);
						} catch (ClassNotFoundException | NoSuchMethodException
								| SecurityException | InstantiationException
								| IllegalAccessException
								| IllegalArgumentException
								| InvocationTargetException e) {
							logger.error(e.getMessage());
							throw new IOException(e.getMessage());
						}

						entry.date = ks.getCreationDate(alias);
						entry.description = k.getFormat() + " - "
								+ ks.getType();
						deltaEntries.put(alias, entry);
					}
				} catch (Throwable t) {
					logger.error("Unable to load keystore file ", t);
					throw new IOException(t);
				}
			}
		}
	}

    public void engineLoadToKeyStoreFile(OutputStream stream, char[] storePass,
                                         char[] keyPass, char[] masterKey, String fileFormat)
            throws IOException, NoSuchAlgorithmException, CertificateException {
        if (logger.isDebugEnabled()) {
            logger.debug("==> RangerKeyStoreProvider.engineLoadToKeyStoreFile()");
        }

        synchronized (keyEntries) {
            KeyStore ks;
            try {
                ks = KeyStore.getInstance(fileFormat);
                if (ks != null) {
                    ks.load(null, storePass);
                    String alias = null;
                    engineLoad(null, masterKey);
                    Enumeration<String> e = engineAliases();
                    Key key;
                    while (e.hasMoreElements()) {
                        alias = e.nextElement();
                        if(azureKeyVaultEnabled){
                        	key = engineGetDecryptedZoneKey(alias);
						} else {
							key = engineGetKey(alias, masterKey);
							if (key instanceof KeyMetadata) {
								Metadata meta = ((KeyMetadata) key).metadata;
								if (meta != null) {
									key = new KeyMetadata(meta);
								}
							}

						}
                        ks.setKeyEntry(alias, key, keyPass, null);
                        
                    }
                    ks.store(stream, storePass);
                }
            } catch (Throwable t) {
                logger.error("Unable to load keystore file ", t);
                throw new IOException(t);
            }
        }
    }

    private void validateKeyName(String name) {
        Matcher matcher = pattern.matcher(name);
        if (!matcher.matches()) {
            throw new IllegalArgumentException(
                    "Key Name : "
                            + name
                            + ", should start with alpha/numeric letters and can have special characters - (hypen) or _ (underscore)");
        }
    }

    public void clearDeltaEntires() {
        deltaEntries.clear();
    }
    
    private Object getKeyEntry(String alias) {
    	   	return keyEntries.get(alias);
    }

	public XXRangerKeyStore convertKeysBetweenRangerKMSAndAzureKeyVault(
			String alias, Key key,
			RangerKeyVaultKeyGenerator rangerKVKeyGenerator) {
		try {
			XXRangerKeyStore xxRangerKeyStore;
			SecretKeyEntry secretKey = (SecretKeyEntry) getKeyEntry(alias);
			if (key instanceof KeyMetadata) {
				Metadata meta = ((KeyMetadata) key).metadata;
				KeyGenerator keyGenerator = KeyGenerator
						.getInstance(getAlgorithm(meta.getCipher()));
				keyGenerator.init(meta.getBitLength());
				byte[] keyByte = keyGenerator.generateKey().getEncoded();
				Key ezkey = new SecretKeySpec(keyByte,
						getAlgorithm(meta.getCipher()));
				byte[] encryptedKey = rangerKVKeyGenerator
						.encryptZoneKey(ezkey);
				Long creationDate = new Date().getTime();
				String attributes = secretKey.attributes;
				xxRangerKeyStore = mapObjectToEntity(alias, creationDate,
						encryptedKey, meta.getCipher(), meta.getBitLength(),
						meta.getDescription(), meta.getVersions(),
						attributes);
			} else {
				byte[] encryptedKey = rangerKVKeyGenerator.encryptZoneKey(key);
				Long creationDate = secretKey.date.getTime();
				int version = secretKey.version;
				if ((alias.split("@").length == 2)
						&& (((Integer.parseInt(alias.split("@")[1])) + 1) != secretKey.version)) {
					version++;
				}
				xxRangerKeyStore = mapObjectToEntity(alias, creationDate,
						encryptedKey, secretKey.cipher_field,
						secretKey.bit_length, secretKey.description, version,
						secretKey.attributes);
			}
			return xxRangerKeyStore;
		} catch (Throwable t) {
			throw new RuntimeException(
					"Migration failed between key secure and Ranger DB : ", t);
		}
	}

	public String getAlgorithm(String cipher) {
		int slash = cipher.indexOf(47);
		if (slash == -1) {
			return cipher;
		}
		return cipher.substring(0, slash);
	}

    /**
     * Encapsulate the encrypted key, so that we can retrieve the AlgorithmParameters object on the decryption side
     */
    private static class RangerSealedObject extends SealedObject {

        /**
         *
         */
        private static final long serialVersionUID = -7551578543434362070L;

        protected RangerSealedObject(SealedObject so) {
            super(so);
        }

        protected RangerSealedObject(Serializable object, Cipher cipher) throws IllegalBlockSizeException, IOException {
            super(object, cipher);
        }

        public AlgorithmParameters getParameters() throws NoSuchAlgorithmException, IOException {
            AlgorithmParameters algorithmParameters = AlgorithmParameters.getInstance("PBEWithMD5AndTripleDES");
            algorithmParameters.init(super.encodedParams);
            return algorithmParameters;
        }

    }
    
    public static class KeyByteMetadata implements Key, Serializable {
        private Metadata metadata;
        private byte[] keyByte;
        
        private final static long serialVersionUID = 8405872419967874451L;

        private KeyByteMetadata(Metadata meta, byte[] encoded) {
            this.metadata = meta;
            this.keyByte = encoded;
        }

        @Override
        public String getAlgorithm() {
            return metadata.getCipher();
        }

        @Override
        public String getFormat() {
            return KEY_METADATA;
        }

        @Override
        public byte[] getEncoded() {
            return this.keyByte;
        }

        private void writeObject(ObjectOutputStream out) throws IOException {
        	byte[] serialized = metadata.serialize();
            
            out.writeInt(serialized.length);
            out.write(serialized);
            out.writeInt(keyByte.length);
            out.write(keyByte);
        }

        private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
        	  byte[] metadataBuf = new byte[in.readInt()];
              in.readFully(metadataBuf);
              metadata = new Metadata(metadataBuf);
              byte[] keybyteBuf = new byte[in.readInt()];
              in.readFully(keybyteBuf);
              keyByte = keybyteBuf;
        }

    }
}