class Fluent::Plugin::JwtFilter

JwtFilter Encrypt/Decript JSON message using JSON Web Token Technology For encryption, JSON Web Key (public) is used For decryption, JSON Web Key (private) is used Currently symmetric key is not supported in JSON Web Key (TODO)

Example encrypted JSON message is as follows: {“jwe_encrypted”:

{
  "protected": "eyJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiUlNBMV81In0",
  "encrypted_key": "P8dKW8KE5nJm7s9GDENrcSW2iNw0Fo4FqDxRwyr6JSGCPCwjc_agoEq7O8xhWX_WoRZin90ORPP1oO5_kavTIcppnRcmquxm1jhQtKk77-HN9Efo7DQf3yfgdnD7xv-M1I_rCPeHVFm33BNB6TIhCo1fUfhEUM8GjjC8PLFFwOcDUNf1vw1-WjUqMhUf-b45s6CHhYdpDqzs7GYuovDo0LMeFeBSc4Xntw_vWPMeHxsuVyuZpDHUQm-dX5wnmQ4UhZPzEhkkVJw1oz2uTMjcl6mi1bucKGy1zNaGN-JEhg5_2QgijqTxRtJgOBlVtHLJ5HABT4tI6-v06M3dPryz5w",
  "iv": "xYk2s_39pHvLBZy3",
  "ciphertext": "taCQAMBZtKgQfh5LaWs",
  "tag": "nbWyhG82A-eCJMvdhbrSJw"
}

}

If some attributes added to the contents during the transfer, the decrypted contents are merged into the modified hash.

Public Instance Methods

configure(conf) click to toggle source

This method is called after config_params have read configuration parameters

Calls superclass method
# File lib/fluent/plugin/filter_jwt.rb, line 37
def configure(conf)
  super
  begin
    case @method
    when "encrypt"
      # read public key from file
      @jwk_pub = JSON::JWK.new(JSON.parse(open(@jwk_pub_file).read))
    when "decrypt"
      # read private key from file
      @jwk = JSON::JWK.new(JSON.parse(open(@jwk_file).read))
    else
      not_supported_error
    end
  rescue JSON::ParserError => e
    log.error "JSON Web Key parse error", error: e.to_s
    log.debug_backtrace(e.backtrace)
  end
end
decrypt(record) click to toggle source
# File lib/fluent/plugin/filter_jwt.rb, line 96
def decrypt(record)
  begin
    # decrypt JSON format cipher data
    jwe_dec = JSON::JWE.decode_json_serialized(record["jwe_encrypted"], @jwk.to_key)
    log.debug jwe_dec.plain_text
    # merge decrypted contents into original contents without jwe_encrypted
    output = record.select {|k| k != "jwe_encrypted"}.merge(JSON.parse(jwe_dec.plain_text))
    log.debug output
    output
  rescue JSON::ParserError => e
    log.error "Message parse error", error: e.to_s
    log.debug_backtrace(e.backtrace)
  rescue Exception => e
    log.error "Error", error: e.to_s
    log.debug_backtrace(e.backtrace)
  end
end
encrypt(record) click to toggle source

This is the method that formats the data output.

# File lib/fluent/plugin/filter_jwt.rb, line 76
def encrypt(record)
  begin
    # encrypt JSON format record
    jwe = JSON::JWE.new(record.to_json)
    # choose block cipher algorithm
    jwe.enc = @block_cipher_alg.to_sym
    # choose cipher algorithm for encrypting block cipher key (symmetric cipher key)
    jwe.alg = @key_encryption_alg.to_sym
    # encryption
    jwe.encrypt!(@jwk_pub.to_key)
    # output the result in JSON format
    output = {jwe_encrypted: jwe.as_json}
    log.debug output
    output
  rescue Exception => e
    log.error "Error", error: e.to_s
    log.debug_backtrace(e.backtrace)
  end
end
filter(tag, time, record) click to toggle source
# File lib/fluent/plugin/filter_jwt.rb, line 64
def filter(tag, time, record)
  case @method
  when "encrypt"
    encrypt(record)
  when "decrypt"
    decrypt(record)
  else
    not_supported_error
  end
end
not_supported_error() click to toggle source
# File lib/fluent/plugin/filter_jwt.rb, line 32
def not_supported_error
  log.error "JwtFilter: Not supported method is specified"
end
shutdown() click to toggle source
Calls superclass method
# File lib/fluent/plugin/filter_jwt.rb, line 60
def shutdown
  super
end
start() click to toggle source
Calls superclass method
# File lib/fluent/plugin/filter_jwt.rb, line 56
def start
  super
end