in parquet-hadoop/src/main/java/org/apache/parquet/crypto/InternalFileDecryptor.java [216:276]
public InternalColumnDecryptionSetup setColumnCryptoMetadata(ColumnPath path, boolean encrypted,
boolean encryptedWithFooterKey, byte[] keyMetadata, int columnOrdinal) {
if (!fileCryptoMetaDataProcessed) {
throw new ParquetCryptoRuntimeException("Haven't parsed the file crypto metadata yet");
}
InternalColumnDecryptionSetup columnDecryptionSetup = columnMap.get(path);
if (null != columnDecryptionSetup) {
if (columnDecryptionSetup.isEncrypted() != encrypted) {
throw new ParquetCryptoRuntimeException("Re-use: wrong encrypted flag. Column: " + path);
}
if (encrypted) {
if (encryptedWithFooterKey != columnDecryptionSetup.isEncryptedWithFooterKey()) {
throw new ParquetCryptoRuntimeException("Re-use: wrong encryption key (column vs footer). Column: " + path);
}
if (!encryptedWithFooterKey && !Arrays.equals(columnDecryptionSetup.getKeyMetadata(), keyMetadata)) {
throw new ParquetCryptoRuntimeException("Decryptor re-use: Different footer key metadata ");
}
}
return columnDecryptionSetup;
}
if (!encrypted) {
columnDecryptionSetup = new InternalColumnDecryptionSetup(path, false, false, null, null, columnOrdinal, null);
} else {
if (encryptedWithFooterKey) {
if (null == footerKey) {
throw new ParquetCryptoRuntimeException("Column " + path + " is encrypted with NULL footer key");
}
columnDecryptionSetup = new InternalColumnDecryptionSetup(path, true, true,
getDataModuleDecryptor(null), getThriftModuleDecryptor(null), columnOrdinal, null);
if (LOG.isDebugEnabled()) {
LOG.debug("Column decryption (footer key): {}", path);
}
} else { // Column is encrypted with column-specific key
byte[] columnKeyBytes = fileDecryptionProperties.getColumnKey(path);
if ((null == columnKeyBytes) && (null != keyMetadata) && (null != keyRetriever)) {
// No explicit column key given via API. Retrieve via key metadata.
try {
columnKeyBytes = keyRetriever.getKey(keyMetadata);
} catch (KeyAccessDeniedException e) {
throw new KeyAccessDeniedException("Column " + path + ": key access denied", e);
}
}
if (null == columnKeyBytes) {
throw new ParquetCryptoRuntimeException("Column " + path + "is encrypted with NULL column key");
}
columnDecryptionSetup = new InternalColumnDecryptionSetup(path, true, false,
getDataModuleDecryptor(columnKeyBytes), getThriftModuleDecryptor(columnKeyBytes), columnOrdinal, keyMetadata);
if (LOG.isDebugEnabled()) {
LOG.debug("Column decryption (column key): {}", path);
}
}
}
columnMap.put(path, columnDecryptionSetup);
return columnDecryptionSetup;
}