Skip to content

Commit 666cc30

Browse files
daisyfaithaumadaisyfaithauma
authored
decrypt Openssl (#17730)
1 parent 50350ad commit 666cc30

File tree

1 file changed

+117
-68
lines changed
  • src/content/docs/ai-gateway/observability/logging

1 file changed

+117
-68
lines changed

‎src/content/docs/ai-gateway/observability/logging/logpush.mdx‎

Lines changed: 117 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ sidebar:
66
text: Beta
77
---
88

9-
import { Render } from "~/components";
9+
import { Render, Tabs, TabItem } from "~/components";
1010

1111
AI Gateway allows you to securely export logs to an external storage location, where you can decrypt and process them.
1212
You can toggle Logpush on and off in the [Cloudflare dashboard](https://dash.cloudflare.com) settings.
@@ -37,7 +37,9 @@ To configure Logpush for AI Gateway, follow these steps:
3737

3838
## 1. Generate an RSA key pair locally
3939

40-
You need to generate a key pair to encrypt and decrypt the logs. This script will output your RSA privateKey and publicKey. Keep the private key secure, as it will be used to decrypt the logs. Below is a sample script to generate the keys using Node.js.
40+
You need to generate a key pair to encrypt and decrypt the logs. This script will output your RSA privateKey and publicKey. Keep the private key secure, as it will be used to decrypt the logs. Below is a sample script to generate the keys using Node.js and OpenSSL.
41+
42+
<Tabs syncKey="JSPlusSSL"> <TabItem label="Javascript">
4143

4244
```js title="JavaScript"
4345
const crypto = require("crypto");
@@ -64,6 +66,23 @@ Run the script by executing the below code on your terminal. Replace `file name`
6466
node {file name}
6567
```
6668

69+
</TabItem> <TabItem label="OpenSSL">
70+
71+
1. Generate private key:
72+
Use the following command to generate a RSA private key:
73+
74+
```bash
75+
openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:4096
76+
```
77+
78+
2. Generate public key:
79+
After generating the private key, you can extract the corresponding public key using:
80+
81+
```bash
82+
openssl rsa -pubout -in private_key.pem -out public_key.pem
83+
```
84+
85+
</TabItem> </Tabs>
6786

6887
## 2. Upload public key to gateway settings
6988

@@ -79,6 +98,10 @@ After configuring Logpush, logs will be sent encrypted using the public key you
7998

8099
## 5. Decrypt logs
81100

101+
To decrypt the encrypted log bodies and metadata from AI Gateway, you can use the following Node.js script or OpenSSL:
102+
103+
<Tabs syncKey="JSPlusSSL"> <TabItem label="Javascript">
104+
82105
To decrypt the encrypted log bodies and metadata from AI Gateway, download the logs to a folder, in this case its named `my_log.log.gz`.
83106

84107
Then copy this javascript file into the same folder and place your private key in the top variable.
@@ -96,81 +119,81 @@ const zlib = require("zlib");
96119
const readline = require("readline");
97120

98121
async function importAESGCMKey(keyBuffer) {
99-
try {
100-
// Ensure the key length is valid for AES
101-
if ([128, 192, 256].includes(256)) {
102-
return await crypto.webcrypto.subtle.importKey(
103-
'raw',
104-
keyBuffer,
105-
{
106-
name: 'AES-GCM',
107-
length: 256
108-
},
109-
true, // Whether the key is extractable (true in this case to allow for export later if needed)
110-
['encrypt', 'decrypt'] // Use for encryption and decryption
111-
);
112-
} else {
113-
throw new Error('Invalid AES key length. Must be 128, 12, or 256 bits.');
114-
}
115-
} catch (error) {
116-
console.error('Failed to import key:', error);
117-
throw error;
118-
}
122+
try {
123+
// Ensure the key length is valid for AES
124+
if ([128, 192, 256].includes(256)) {
125+
return await crypto.webcrypto.subtle.importKey(
126+
"raw",
127+
keyBuffer,
128+
{
129+
name: "AES-GCM",
130+
length: 256,
131+
},
132+
true, // Whether the key is extractable (true in this case to allow for export later if needed)
133+
["encrypt", "decrypt"], // Use for encryption and decryption
134+
);
135+
} else {
136+
throw new Error("Invalid AES key length. Must be 128, 12, or 256 bits.");
137+
}
138+
} catch (error) {
139+
console.error("Failed to import key:", error);
140+
throw error;
141+
}
119142
}
120143

121144
async function decryptData(encryptedData, aesKey, iv) {
122-
const decryptedData = await crypto.subtle.decrypt(
123-
{name: "AES-GCM", iv: iv},
124-
aesKey,
125-
encryptedData
126-
);
127-
return new TextDecoder().decode(decryptedData);
145+
const decryptedData = await crypto.subtle.decrypt(
146+
{ name: "AES-GCM", iv: iv },
147+
aesKey,
148+
encryptedData,
149+
);
150+
return new TextDecoder().decode(decryptedData);
128151
}
129152

130153
async function decryptBase64(privateKey, data) {
131-
if (data.key === undefined) {
132-
return data
133-
}
134-
135-
const aesKeyBuf = crypto.privateDecrypt(
136-
{
137-
key: privateKey,
138-
oaepHash: "SHA256",
139-
},
140-
Buffer.from(data.key, "base64"),
141-
);
142-
const aesKey = await importAESGCMKey(aesKeyBuf)
143-
144-
const decryptedData = await decryptData(
145-
Buffer.from(data.data, "base64"),
146-
aesKey,
147-
Buffer.from(data.iv, "base64")
148-
)
149-
150-
return decryptedData.toString();
154+
if (data.key === undefined) {
155+
return data;
156+
}
157+
158+
const aesKeyBuf = crypto.privateDecrypt(
159+
{
160+
key: privateKey,
161+
oaepHash: "SHA256",
162+
},
163+
Buffer.from(data.key, "base64"),
164+
);
165+
const aesKey = await importAESGCMKey(aesKeyBuf);
166+
167+
const decryptedData = await decryptData(
168+
Buffer.from(data.data, "base64"),
169+
aesKey,
170+
Buffer.from(data.iv, "base64"),
171+
);
172+
173+
return decryptedData.toString();
151174
}
152175

153176
async function run() {
154-
let lineReader = readline.createInterface({
155-
input: fs.createReadStream("my_log.log.gz").pipe(zlib.createGunzip()),
156-
});
157-
158-
lineReader.on("line", async (line) => {
159-
line = JSON.parse(line);
160-
161-
const {Metadata, RequestBody, ResponseBody, ...remaining} = line;
162-
163-
console.log({
164-
...remaining,
165-
Metadata: await decryptBase64(privateKey, Metadata),
166-
RequestBody: await decryptBase64(privateKey, RequestBody),
167-
ResponseBody: await decryptBase64(privateKey, ResponseBody),
168-
});
169-
console.log("--");
170-
});
177+
let lineReader = readline.createInterface({
178+
input: fs.createReadStream("my_log.log.gz").pipe(zlib.createGunzip()),
179+
});
180+
181+
lineReader.on("line", async (line) => {
182+
line = JSON.parse(line);
183+
184+
const { Metadata, RequestBody, ResponseBody, ...remaining } = line;
185+
186+
console.log({
187+
...remaining,
188+
Metadata: await decryptBase64(privateKey, Metadata),
189+
RequestBody: await decryptBase64(privateKey, RequestBody),
190+
ResponseBody: await decryptBase64(privateKey, ResponseBody),
191+
});
192+
console.log("--");
193+
});
171194
}
172195

173-
run()
196+
run();
174197
```
175198

176199
Run the script by executing the below code on your terminal. Replace `file name` with the name of your JavaScript file.
@@ -179,7 +202,33 @@ Run the script by executing the below code on your terminal. Replace `file name`
179202
node {file name}
180203
```
181204

182-
## Script Explanation
183-
184205
The script reads the encrypted log file `(my_log.log.gz)`, decrypts the metadata, request body, and response body, and prints the decrypted data.
185206
Ensure you replace the `privateKey` variable with your actual private RSA key that you generated in step 1.
207+
208+
</TabItem> <TabItem label="OpenSSL">
209+
210+
1. Decrypt the encrypted log file using the private key.
211+
212+
Assuming that the logs were encrypted with the public key (for example `public_key.pem`), you can use the private key (`private_key.pem`) to decrypt the log file.
213+
214+
For example, if the encrypted logs are in a file named `encrypted_logs.bin`, you can decrypt it like this:
215+
216+
```bash
217+
openssl rsautl -decrypt -inkey private_key.pem -in encrypted_logs.bin -out decrypted_logs.txt
218+
```
219+
220+
- `-decrypt` tells OpenSSL that we want to decrypt the file.
221+
- `-inkey private_key.pem` specifies the private key that will be used to decrypt the logs.
222+
- `-in encrypted_logs.bin` is the encrypted log file.
223+
- `-out decrypted_logs.txt`decrypted logs will be saved into this file.
224+
225+
2. View the decrypted logs
226+
Once decrypted, you can view the logs by simply running:
227+
228+
```bash
229+
cat decrypted_logs.txt
230+
```
231+
232+
This command will output the decrypted logs to the terminal.
233+
234+
</TabItem> </Tabs>

0 commit comments

Comments
 (0)