fluent-plugin-encrypt 0.1.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: fee7cc24297fc5d3edaa60d93493f90aa79ebb72
+  data.tar.gz: 324f99c696e3dfcf5c9ec6a1c88fc5c7c1bc18a9
+SHA512:
+  metadata.gz: befaad082eb596f63a949d586d17c62def86e9a4fcd908f60ac868250c34306240792ee170a8fcaf21779cd8d2826f68099e602cfe60f1b600bd8587331d1e1a
+  data.tar.gz: aa3a3845ac854f3bb5d439f0a139d54fb40ea16a1b9d373e83c92466de42fca1f73f426627c1c31b4b9bf313e3a2fae5a3f5d080f0456b69c656b4d518fe7457

data/.gitignore

@@ -0,0 +1,9 @@
+/.bundle/
+/.yardoc
+/Gemfile.lock
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in fluent-plugin-encrypt.gemspec
+gemspec

data/README.md

@@ -0,0 +1,36 @@
+# Fluent::Plugin::Encrypt
+
+Welcome to your new gem! In this directory, you'll find the files you need to be able to package up your Ruby library into a gem. Put your Ruby code in the file `lib/fluent/plugin/encrypt`. To experiment with that code, run `bin/console` for an interactive prompt.
+
+TODO: Delete this and the text above, and describe your gem
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'fluent-plugin-encrypt'
+```
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install fluent-plugin-encrypt
+
+## Usage
+
+TODO: Write usage instructions here
+
+## Development
+
+After checking out the repo, run `bin/setup` to install dependencies. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+
+To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/fluent-plugin-encrypt.
+

data/Rakefile

@@ -0,0 +1,14 @@
+
+require 'bundler'
+Bundler::GemHelper.install_tasks
+
+require 'rake/testtask'
+
+Rake::TestTask.new(:test) do |test|
+  test.libs << 'lib' << 'test'
+  test.test_files = FileList['test/**/test_*.rb']
+  test.verbose = true
+end
+
+task :default => [:test]
+

data/bin/fluent-plugin-encrypt-genkey

@@ -0,0 +1,18 @@
+#/usr/bin/env ruby
+require 'openssl'
+
+if ARGV.length != 2
+  puts "Usage: #{$0} <algorithm> <password>"
+  exit 1
+end
+
+cipher = OpenSSL::Cipher.new ARGV[0]
+password = ARGV[1]
+
+cipher.encrypt
+iv = cipher.random_iv
+salt = OpenSSL::Random.random_bytes(16)
+key = OpenSSL::PKCS5.pbkdf2_hmac(password, salt, 20000, cipher.key_len, OpenSSL::Digest::SHA256.new)
+
+puts "key=#{key.unpack('H*')[0].upcase}"
+puts "iv =#{iv.unpack('H*')[0].upcase}"

data/fluent-plugin-encrypt.gemspec

@@ -0,0 +1,23 @@
+# coding: utf-8
+
+Gem::Specification.new do |spec|
+  spec.name          = "fluent-plugin-encrypt"
+  spec.version       = "0.1.1"
+  spec.authors       = ["TAGOMORI Satoshi"]
+  spec.email         = ["tagomoris@gmail.com"]
+
+  spec.summary       = %q{Fluentd filter plugin to encrypt fields}
+  spec.description   = %q{This plugin converts data of specified fields, by encrypting using AES and base64 encoding for encrypted values}
+  spec.homepage      = "https://github.com/tagomoris/fluent-plugin-encrypt"
+
+  spec.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+  spec.bindir        = "bin"
+  spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
+  spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
+  spec.require_paths = ["lib"]
+
+  spec.add_runtime_dependency "fluentd", "~> 0.12.0"
+  spec.add_development_dependency "bundler", "~> 1.11"
+  spec.add_development_dependency "rake", "~> 10.0"
+  spec.add_development_dependency "test-unit", "~> 3.0"
+end

data/lib/fluent/plugin/filter_encrypt.rb

@@ -0,0 +1,77 @@
+require 'fluent/filter'
+require 'openssl'
+require 'base64'
+
+module Fluent
+  class EncryptFilter < Filter
+    Fluent::Plugin.register_filter('encrypt', self)
+
+    SUPPORTED_ALGORITHMS = {
+      aes_256_cbc: { name: "AES-256-CBC", use_iv: true },
+      aes_192_cbc: { name: "AES-192-CBC", use_iv: true },
+      aes_128_cbc: { name: "AES-128-CBC", use_iv: true },
+      aes_256_ecb: { name: "AES-256-ECB", use_iv: false },
+      aes_192_ecb: { name: "AES-192-ECB", use_iv: false },
+      aes_128_ecb: { name: "AES-128-ECB", use_iv: false },
+    }
+
+    config_param :algorithm, :enum, list: SUPPORTED_ALGORITHMS.keys, default: :aes_256_cbc
+    config_param :encrypt_key_hex, :string
+    config_param :encrypt_iv_hex, :string, default: nil
+
+    config_param :key,  :string, default: nil
+    config_param :keys, :array, default: []
+
+    attr_reader :target_keys
+
+    def configure(conf)
+      super
+
+      @target_keys = @keys + [@key]
+      if @target_keys.empty?
+        raise Fluent::ConfigError, "no keys specified to be encrypted"
+      end
+
+      algorithm = SUPPORTED_ALGORITHMS[@algorithm]
+      if algorithm[:use_iv] && !@encrypt_iv_hex
+        raise Fluent::ConfigError, "Encryption algorithm #{@algorithm} requires 'encrypt_iv_hex'"
+      end
+
+      @enc_key = Base64.decode64(@encrypt_key_hex)
+      @enc_iv = if @encrypt_iv_hex
+                  Base64.decode64(@encrypt_iv_hex)
+                else
+                  nil
+                end
+      @enc_generator = ->(){
+        enc = OpenSSL::Cipher.new(algorithm[:name])
+        enc.encrypt
+        enc.key = @enc_key
+        enc.iv  = @enc_iv if @enc_iv
+        enc
+      }
+    end
+
+    def filter_stream(tag, es)
+      new_es = MultiEventStream.new
+      es.each do |time, record|
+        r = record.dup
+        record.each_pair do |key, value|
+          if @target_keys.include?(key)
+            r[key] = encrypt(value)
+          end
+        end
+        new_es.add(time, r)
+      end
+      new_es
+    end
+
+    def encrypt(value)
+      encrypted = ""
+      enc = @enc_generator.call()
+      encrypted << enc.update(value)
+      encrypted << enc.final
+      Base64.encode64(encrypted)
+    end
+  end
+end

metadata

@@ -0,0 +1,109 @@
+--- !ruby/object:Gem::Specification
+name: fluent-plugin-encrypt
+version: !ruby/object:Gem::Version
+  version: 0.1.1
+platform: ruby
+authors:
+- TAGOMORI Satoshi
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2016-03-04 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: fluentd
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.12.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.12.0
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.11'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.11'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: test-unit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+description: This plugin converts data of specified fields, by encrypting using AES
+  and base64 encoding for encrypted values
+email:
+- tagomoris@gmail.com
+executables:
+- fluent-plugin-encrypt-genkey
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- Gemfile
+- README.md
+- Rakefile
+- bin/fluent-plugin-encrypt-genkey
+- fluent-plugin-encrypt.gemspec
+- lib/fluent/plugin/filter_encrypt.rb
+homepage: https://github.com/tagomoris/fluent-plugin-encrypt
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.5.1
+signing_key: 
+specification_version: 4
+summary: Fluentd filter plugin to encrypt fields
+test_files: []
+has_rdoc: