logstash-filter-cipher_kms 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed89b14bf1cc7071f46c6b032418964fbbba986bce93223c43834767ffb2015c
-  data.tar.gz: 8b606cdb81cd8a4cdc3e4dac878c84b8e03abb7ede4f49c5f2392b5c13182b36
+  metadata.gz: 4c989e3557976e3787785dceea661541b8f868d51e47c69235a231523eead501
+  data.tar.gz: f13d8829089f66c19a6e55ccaa57c3d99f2ac5474585c5d26ed27e0b96e09d2b
 SHA512:
-  metadata.gz: c20c24d7da265edda22c83b236583b8b90aa3b0b413494779bb5881f470d1ba38190705198337abcfb030f67f3af4b991cba747cae26a12e3e4fad0eab27376f
-  data.tar.gz: 8a74e1042d7a8e802d6512f2561a37b63c960cfe135cd203374c9084122c31a465951a704b4170c3fb527ccf7efc0165416c4621947a33e1ec07fc2d47b9125a
+  metadata.gz: 87b41c4c8b27655ad5d41617178068ab1737114567fbff767526ad0c15f592c3af6e86cfecc219455a0d7e57ab5619e9fae4dfc5601969e3b8e4de46b9f6eace
+  data.tar.gz: 6eb778dc69cf5d21c54c4a266e9c38e8de8e3e2a3411624930bd974cf209b188cec36c55809ebd2fda6c53b8d7d8f41779a62e32becfcec0c869c30d862ba6be

data/lib/logstash/filters/cipher_kms.rb

@@ -134,8 +134,8 @@ class LogStash::Filters::CipherKms < LogStash::Filters::Base
   def filter(event)
     # If decrypt or encrypt fails, we keep it it intact.
     begin
-      if event.get(@source).blank?
-        @logger.debug("Event to filter, event 'source' field: " + @source + ' was nil or blank, doing nothing.')
+      if blank?(event.get(@source))
+        @logger.debug("Event to filter, event 'source' field: " + @source + ' was nil or empty, doing nothing.')
         return
       end
 
@@ -156,14 +156,18 @@ class LogStash::Filters::CipherKms < LogStash::Filters::Base
         filter_matched(event)
       end
     rescue => e
-      @logger.warn('Exception caught on cipher filter', event: event, error: e)
-      # force a re-initialize on error to be safe
-      init_cipher
+      handle_unexpected_error(event, e)
     ensure
       rotate_cipher_if_needed
     end
   end
 
+  def handle_unexpected_error(event, error)
+    @logger.warn('Exception caught on cipher filter', event: event, error: error)
+    # force a re-initialize on error to be safe
+    init_cipher
+  end
+
   def encrypt(data)
     @random_iv = OpenSSL::Random.random_bytes(@iv_random_length)
     kms_response = @kms.generate_data_key(key_id: @key_id, key_spec: @algorithm,
@@ -224,10 +228,10 @@ class LogStash::Filters::CipherKms < LogStash::Filters::Base
     @logger.debug('Encryption Context: ' + @encryption_context.to_s, plugin: self.class.name)
 
     credentials = nil
-    if !@access_key_id.blank? && !@secret_access_key.blank?
+    if !blank?(@access_key_id) && !blank?(@secret_access_key)
       credentials = Aws::Credentials.new(@access_key_id, @secret_access_key)
       @logger.debug('Using Static Credentials', plugin: self.class.name)
-    elsif !@aws_shared_credentials_path.blank? || !@aws_profile.blank?
+    elsif !blank?(@aws_shared_credentials_path) || !blank?(@aws_profile.blank)
       credentials = Aws::SharedCredentials.new(path: @aws_shared_credentials_path, profile_name: @aws_profile)
       @logger.debug('Using Shared Credentials', plugin: self.class.name)
     elsif @aws_instance_profile
@@ -276,4 +280,9 @@ class LogStash::Filters::CipherKms < LogStash::Filters::Base
     true
   end
 
+  private
+
+  def blank?(data)
+    data.nil? || data.empty?
+  end
 end

data/logstash-filter-cipher_kms.gemspec

@@ -2,7 +2,7 @@
 
 Gem::Specification.new do |s|
   s.name          = 'logstash-filter-cipher_kms'
-  s.version       = '0.1.2'
+  s.version       = '0.1.3'
   s.licenses      = ['Apache License (2.0)']
   s.summary       = 'This is a Logstash plugin to allow data
                       encryption/decryption using AWS KMS.'

data/spec/filters/cipher_kms_spec.rb

@@ -137,8 +137,14 @@ describe LogStash::Filters::CipherKms do
             'kms_cmk_id' => 'arn:aws:kms:eu-west-1:666666666666:alias/kms-key'
         }
       )
-      plain_text = 'foo'
-      event = LogStash::Event.new(LogStash::Json.load("{\"message\":\"#{plain_text}\"}"))
+      msg = {
+        message: {
+          foo: 'bar'
+        }
+      }.to_json
+
+      event = LogStash::Event.new(LogStash::Json.load(msg))
+      expect(encrypter).not_to receive(:handle_unexpected_error)
       encrypter.register
       decrypter.register
 
@@ -147,7 +153,7 @@ describe LogStash::Filters::CipherKms do
         decrypter.filter(event)
       end
 
-      expect(event.get('message')).to eq(plain_text)
+      expect(event.get('message')).to eq({ "foo" => "bar" })
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-cipher_kms
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - Onfido
@@ -120,7 +120,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project:
-rubygems_version: 2.6.13
+rubygems_version: 2.6.11
 signing_key:
 specification_version: 4
 summary: This is a Logstash plugin to allow data encryption/decryption using AWS KMS.