Merge jwe decrypt

Cargo.toml

@@ -13,7 +13,7 @@ repository = "https://github.com/lmammino/jwtinfo"
 homepage = "https://github.com/lmammino/jwtinfo"
 documentation = "https://github.com/lmammino/jwtinfo"
 readme = "README.md"
-version = "0.6.1"
+version = "0.7.0"
 authors = ["Luciano Mammino", "Stefano Abalsamo"]
 edition = "2018"
 license = "MIT"
@@ -26,9 +26,14 @@ eula = false
 
 [dependencies]
 clap = "4.4.7"
-base64 = "0.21"
+base64 = "0.22"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
+rsa = "0.9.9"
+sha2 = "0.10.9"
+aes-gcm = "0.10.3"
+sha1 = "0.10.6"
+thiserror = "2.0"
 
 [dev-dependencies]
 assert_cmd = "2.0"

README.md

@@ -19,7 +19,7 @@ A command line tool to get information about
 - **Multiple display modes**: view body only (default), header only (`--header`), or both (`--full`)
 - **Pretty printing** with `--pretty` flag for readable JSON output
 - **Stdin support** - pipe tokens directly or use as command argument
-- **JWE token detection** - gracefully handles encrypted JWT tokens with clear messaging
+- **JWE decryption** - decrypt encrypted JWTs with `--key` (supports `dir`, `RSA-OAEP`, `RSA-OAEP-256` + `A128GCM`/`A256GCM`)
 - **Composable** - works seamlessly with tools like `jq` for advanced JSON processing
 
 ### Rust Library
@@ -103,8 +103,25 @@ You can combine the tool with other command line utilities, for instance
 jwtinfo eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c | jq .
 ```
 
+### JWE decryption
+
+If the token is encrypted (JWE), and you own the decryption key, you can see the decrypted payload by providing the key file:
+
+```bash
+jwtinfo --key /path/to/private.pem "$(cat /path/to/jwe.txt)"
+```
+
+Supported algorithms:
+
+- **Key management (`alg`)**: `dir`, `RSA-OAEP`, `RSA-OAEP-256`
+- **Content encryption (`enc`)**: `A128GCM`, `A256GCM`
+
+For `dir`, the key file must contain the raw content-encryption key (CEK) bytes.
+For RSA-based algorithms, the key file must be a PEM-encoded private key in PKCS#1 or PKCS#8 format.
+At the moment only `.pem` keys are supported; additional formats will be added in the future.
+
 > [!NOTE]
-> **Encrypted [JWE](https://datatracker.ietf.org/doc/html/rfc7516) Tokens**: If you provide an encrypted JWE token (JSON Web Encryption), the tool will detect it by checking for the `enc` field in the header. Since JWE tokens are encrypted, the claims/body cannot be read without decryption. In this case, `jwtinfo` will display the special placeholder string `"<encrypted JWE body>"` instead of the actual claims. The header can still be inspected normally using the `--header` flag.
+> **Encrypted [JWE](https://datatracker.ietf.org/doc/html/rfc7516) Tokens**: If you provide an encrypted JWE token without a key, `jwtinfo` will show a placeholder message indicating that a private key is required. Use `-K/--key` to decrypt it. The header can still be inspected normally using the `--header` flag.
 
 ## Install
 

src/cli.rs

@@ -1,11 +1,19 @@
+pub mod jw_error;
+pub mod jw_parser;
+pub mod jwe;
+pub mod jwt;
+
+use crate::jwe::handle_jwe;
+use crate::jwt::stringify_token;
 use clap::{Arg, ArgAction, Command};
-use jwtinfo::jwt;
-use serde_json::to_string_pretty;
-use std::io::{self, Read};
-use std::process;
+use std::{
+    error::Error,
+    fs,
+    io::{self, Read},
+};
 
 #[doc(hidden)]
-fn main() -> io::Result<()> {
+fn main() -> Result<(), Box<dyn Error>> {
     let matches = Command::new("jwtinfo")
         .version(env!("CARGO_PKG_VERSION"))
         .about("Shows information about a JWT (Json Web Token)")
@@ -31,12 +39,17 @@ fn main() -> io::Result<()> {
                 .index(1)
                 .allow_hyphen_values(true)
                 .required(true)
-                .help("the JWT as a string (use \"-\" to read from stdin)"),
+                .help("the JWT/JWE as a string (use \"-\" to read from stdin)"),
+            Arg::new("key")
+                .short('K')
+                .long("key")
+                .help("the path to the private key for the cek decryption in case of JWE"),
         ])
         .get_matches();
 
+    let full_flag = matches.get_flag("full");
     let should_pretty_print = matches.get_flag("pretty");
-
+    let header_flag = matches.get_flag("header");
     let mut token = matches.get_one::<String>("token").unwrap().clone();
     let mut buffer = String::new();
 
@@ -46,40 +59,23 @@ fn main() -> io::Result<()> {
         token = (*buffer.trim()).to_string();
     }
 
-    let jwt_token = match jwt::parse(token) {
-        Ok(t) => t,
-        Err(e) => {
-            eprintln!("Error: {}", e);
-            process::exit(1);
-        }
-    };
+    // if there is a key must be a JWE
+    if let Some(key_path) = matches.get_one::<String>("key") {
+        let key = fs::read(key_path)?;
+        // handle_jwe returns the JWE payload, which could be a UTF-8 string or a
+        // JWT to decode (currently we don't handle payload as byte arrays)
+        token = handle_jwe(token, key)?;
+    }
 
-    let stringified = if matches.get_flag("full") {
-        // Show both header and claims
-        let full_output = serde_json::json!({
-            "header": jwt_token.header,
-            "claims": jwt_token.body
-        });
-        if should_pretty_print {
-            to_string_pretty(&full_output)?
-        } else {
-            full_output.to_string()
+    // if the token is a JWT, jwt::parse will handle it correctly, otherwise
+    // the raw string will be printed
+    match jwt::parse(&token) {
+        Ok(jwt_token) => {
+            let stringified =
+                stringify_token(jwt_token, full_flag, should_pretty_print, header_flag)?;
+            println!("{}", stringified);
         }
-    } else {
-        // Show either header or body
-        let part = if matches.get_flag("header") {
-            jwt_token.header
-        } else {
-            jwt_token.body
-        };
-        if should_pretty_print {
-            to_string_pretty(&part)?
-        } else {
-            part.to_string()
-        }
-    };
-
-    println!("{}", stringified);
-
+        Err(_) => println!("{}", token),
+    }
     Ok(())
 }

src/jw_error.rs

@@ -0,0 +1,98 @@
+use std::{error::Error, str, string};
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum ParseError {
+    /// Indicates that a given section was not correctly Base64-encoded
+    #[error("Base64 error, {0}")]
+    InvalidBase64(#[from] base64::DecodeError),
+    /// Indicates that a section did not contain a valid utf8 string
+    #[error("UTF8 error, {0}")]
+    InvalidStrUtf8(#[from] str::Utf8Error),
+    #[error("UTF8 error, {0}")]
+    InvalidStringUtf8(#[from] string::FromUtf8Error),
+}
+
+/// Represents an error while parsing a JWT
+#[derive(Debug, Error)]
+pub enum JWTParseError {
+    /// Indicates that an expected section (Header, Body or Signature) was not found
+    #[error("Missing token section")]
+    MissingSection(),
+    #[error("{0}")]
+    InvalidFormat(#[from] ParseError),
+    /// Indicates that a given section did not contain a valid JSON string
+    #[error("JSON error, {0}")]
+    InvalidJSON(#[from] serde_json::error::Error),
+}
+
+impl From<base64::DecodeError> for JWTParseError {
+    fn from(err: base64::DecodeError) -> JWTParseError {
+        JWTParseError::InvalidFormat(ParseError::InvalidBase64(err))
+    }
+}
+
+/// Represents an error while parsing a given part of a JWT
+#[derive(Debug, Error)]
+pub enum JWTParsePartError {
+    /// Error while parsing the Header part
+    #[error("Invalid Header: {0}")]
+    Header(JWTParseError),
+    /// Error while parsing the Body part
+    #[error("Invalid Body: {0}")]
+    Body(JWTParseError),
+    /// Error while parsing the Signature part
+    #[error("Invalid Signature: {0}")]
+    Signature(JWTParseError),
+    /// Error because an additional part was found after the Signature part
+    #[error("Error: Unexpected fragment after signature")]
+    UnexpectedPart(),
+}
+
+#[derive(Debug, Error)]
+pub enum JweParseError {
+    #[error("Missing JWE section")]
+    MissingParts(),
+    #[error("Unexpected section")]
+    TooManyParts(),
+    #[error("{0}")]
+    InvalidFormat(#[from] ParseError),
+}
+
+impl From<base64::DecodeError> for JweParseError {
+    fn from(err: base64::DecodeError) -> JweParseError {
+        JweParseError::InvalidFormat(ParseError::InvalidBase64(err))
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum JweError {
+    #[error("{0}")]
+    ParseError(#[from] JweParseError),
+    #[error("{0}")]
+    StringError(String),
+    #[error("{0}")]
+    Internal(Box<dyn Error + Send + Sync + 'static>),
+    #[error("not serialized error")]
+    JsonError(#[from] serde_json::Error),
+    #[error("Invalid UTF-8 string: {0}")]
+    InvalidUtf8Error(#[from] string::FromUtf8Error),
+}
+
+impl From<String> for JweError {
+    fn from(e: String) -> Self {
+        JweError::StringError(e)
+    }
+}
+
+impl From<Box<dyn Error + Send + Sync + 'static>> for JweError {
+    fn from(e: Box<dyn Error + Send + Sync + 'static>) -> Self {
+        JweError::Internal(e)
+    }
+}
+
+impl From<ParseError> for JweError {
+    fn from(e: ParseError) -> Self {
+        JweError::ParseError(JweParseError::InvalidFormat(e))
+    }
+}

src/jw_parser.rs

@@ -0,0 +1,61 @@
+use base64::{
+    alphabet,
+    engine::{self, general_purpose},
+    Engine as _,
+};
+use std::{convert::TryInto, sync::OnceLock};
+
+use crate::jw_error::JweParseError;
+use crate::jw_error::ParseError;
+use crate::jwe::jwe_handler::JweToken;
+
+static BASE64_ENGINE: OnceLock<engine::GeneralPurpose> = OnceLock::new();
+
+#[inline]
+pub fn get_base64() -> &'static engine::GeneralPurpose {
+    BASE64_ENGINE
+        .get_or_init(|| engine::GeneralPurpose::new(&alphabet::URL_SAFE, general_purpose::NO_PAD))
+}
+
+#[doc(hidden)]
+fn parse_base64_string(string_to_parse: &str) -> Result<String, ParseError> {
+    let bytes = get_base64().decode(string_to_parse)?;
+    let string = String::from_utf8(bytes)?;
+    Ok(string)
+}
+
+pub fn split_jwe(token: &str) -> Result<[&str; 5], JweParseError> {
+    token
+        .split('.')
+        .collect::<Vec<&str>>()
+        .try_into()
+        .map_err(|vec: Vec<&str>| {
+            if vec.len() < 5 {
+                JweParseError::MissingParts()
+            } else {
+                JweParseError::TooManyParts()
+            }
+        })
+}
+
+pub fn parse_jwe(token: &str) -> Result<JweToken, JweParseError> {
+    let [b64_header, b64_key, b64_iv, b64_cipher, b64_tag] = split_jwe(token)?;
+
+    let decode = |s: &str| get_base64().decode(s);
+
+    let aad = b64_header.as_bytes().to_vec();
+    let header = parse_base64_string(b64_header)?;
+    let key_encrypted = decode(b64_key)?;
+    let iv = decode(b64_iv)?;
+    let ciphertext = decode(b64_cipher)?;
+    let tag = decode(b64_tag)?;
+
+    Ok(JweToken::new(
+        header,
+        aad,
+        key_encrypted,
+        iv,
+        ciphertext,
+        tag,
+    ))
+}

src/jwe.rs

@@ -0,0 +1,21 @@
+pub mod jwe_handler;
+
+use crate::jwe::jwe_handler::{AlgorithmFactory, JweHeader};
+
+use crate::jw_error::JweError;
+use crate::jw_parser::parse_jwe;
+
+pub fn handle_jwe(token: String, key: Vec<u8>) -> Result<String, JweError> {
+    let jwe_token = parse_jwe(token.as_str())?;
+    let jwe_header: JweHeader = serde_json::from_str(&jwe_token.header)?;
+    let key_decryptor = AlgorithmFactory::get_key_decryptor(jwe_header.alg.as_str())?;
+    let key_decrypted = key_decryptor.decrypt_cek(&key, &jwe_token.key_encrypted)?;
+    let content_decryptor = AlgorithmFactory::get_content_decryptor(jwe_header.enc.as_str())?;
+    let cipher = jwe_token.decrypt_content(&*content_decryptor, &key_decrypted)?;
+    let payload_string = String::from_utf8(cipher)?;
+
+    Ok(payload_string)
+}
+
+#[cfg(test)]
+mod test;

src/jwe/jwe_handler.rs

@@ -0,0 +1,4 @@
+mod algorithms;
+mod jwe_token;
+pub use algorithms::AlgorithmFactory;
+pub use jwe_token::{JweHeader, JweToken};