o ,&a[@sddlZddlmZddlmZmZmZmZmZddl m Z m Z m Z m Z mZddlmZddlmZGdddeZGd d d eZGd d d eZGd ddeZGdddeZGdddeZGdddeZGdddeZeeeeeeedZdS)N)BytesIO)_host_from_url_get_body_as_dict BaseSignerSIGNED_HEADERS_BLACKLISTUNSIGNED_PAYLOAD)awscrt HTTPHeadersparse_qsurlsplit urlunsplit)percent_encode_sequence)NoCredentialsErrorc@reZdZdZgdZejjjZ dZ dZ ddZ ddZ ddZd d Zd d Zd dZddZddZddZdS) CrtSigV4AuthT Authorizationz X-Amz-DateX-Amz-Content-SHA256zX-Amz-Security-TokencC||_||_||_d|_dSN credentials _service_name _region_name_expiration_in_secondsselfr service_name region_namer3/usr/lib/python3/dist-packages/botocore/crt/auth.py__init__ zCrtSigV4Auth.__init__c C|jdurttjjtjjd}||}||t j j j |jj |jj|jjd}||r:|r7|}nd}nt}||rGt j jj}nt j jj}t j jt j jj|j||j|j||j|j|j|||jd }| |}t j !||} | "|#||dSN)tzinfo) access_key_idsecret_access_key session_token) algorithmsignature_typecredentials_providerregionservicedateshould_sign_headeruse_double_uri_encodeshould_normalize_uri_pathsigned_body_valuesigned_body_header_typeexpiration_in_seconds)$rrdatetimeutcnowreplacetimezoneutc_get_existing_sha256_modify_request_before_signingrauthAwsCredentialsProvider new_static access_key secret_keytoken_should_sha256_sign_payloadr!_should_add_content_sha256_headerAwsSignedBodyHeaderTypeX_AMZ_CONTENT_SHA_256NONEAwsSigningConfigAwsSigningAlgorithmV4_SIGNATURE_TYPErr_should_sign_header_USE_DOUBLE_URI_ENCODE_SHOULD_NORMALIZE_URI_PATHr_crt_request_from_aws_requestaws_sign_requestresult_apply_signing_changes rrequest datetime_nowexisting_sha256r+explicit_payload body_headersigning_config crt_requestfuturerrr add_authN        zCrtSigV4Auth.add_authc Ct|j}|jr |jnd}|jr3g}|jD]\}}t|}|d||fq|dd|}n |jr=d||jf}t j |j }d}|j rZt|j drU|j }nt|j }t j j|j|||d} | SN/z%s=%s?&z%s?%sseek)methodpathheaders body_streamr urlrdparamsitemsstrappendjoinqueryrhttp HttpHeadersrebodyhasattrr HttpRequestrc r aws_request url_partscrt_patharrayparamvalue crt_headerscrt_body_streamrYrrr rNS.   z*CrtSigV4Auth._crt_request_from_aws_requestcCtt|j|_dSrr from_pairslistrerrusigned_crt_requestrrr rQp z#CrtSigV4Auth._apply_signing_changescK |tvSrlowerrrnamekwargsrrr rKu z CrtSigV4Auth._should_sign_headercC@|jD] }||jvr|j|=qd|jvrt|j|jd<dSdSNhost_PRESIGNED_HEADERS_BLOCKLISTrerrhrrShrrr r;x   z+CrtSigV4Auth._modify_request_before_signingcC |jdSNrregetrrSrrr r:rz!CrtSigV4Auth._get_existing_sha256cC|jdsdS|jddSNhttpsTpayload_signing_enabledrh startswithcontextrrrrr rB z(CrtSigV4Auth._should_sha256_sign_payloadcC|duSrrrrVrrr rCz.CrtSigV4Auth._should_add_content_sha256_headerN__name__ __module__ __qualname__REQUIRES_REGIONrrr<AwsSignatureTypeHTTP_REQUEST_HEADERSrJrLrMr!r[rNrQrKr;r:rBrCrrrr r  4  rc4eZdZdZdZddZfddZddZZS)CrtS3SigV4AuthFcCdSrrrrrr r:z#CrtS3SigV4Auth._get_existing_sha256ct|jd}t|dd}|duri}|dd}|dur|S|jdr)d|jvr+dS|jddr4dSt|S N client_configs3rrz Content-MD5Thas_streaming_inputFrrgetattrrhrresuperrBrrSr s3_config sign_payload __class__rr rB      z*CrtS3SigV4Auth._should_sha256_sign_payloadcCdSNTrrrrr rCrz0CrtS3SigV4Auth._should_add_content_sha256_header rrrrLrMr:rBrC __classcell__rrrr r  "rc@r)CrtSigV4AsymAuthTrcCrrrrrrr r!r"zCrtSigV4AsymAuth.__init__c Cr#r$)$rrr5r6r7r8r9r:r;rr<r=r>r?r@rArBrrCrDrErFrGrH V4_ASYMMETRICrJrrrKrLrMrrNrOrPrQrRrrr r[r\zCrtSigV4AsymAuth.add_authc Cr]r^rgrtrrr rN r}z.CrtSigV4AsymAuth._crt_request_from_aws_requestcCr~rrrrrr rQ'rz'CrtSigV4AsymAuth._apply_signing_changescKrrrrrrr rK,rz$CrtSigV4AsymAuth._should_sign_headercCrrrrrrr r;/rz/CrtSigV4AsymAuth._modify_request_before_signingcCrrrrrrr r:9rz%CrtSigV4AsymAuth._get_existing_sha256cCrrrrrrr rB<rz,CrtSigV4AsymAuth._should_sha256_sign_payloadcCrrrrrrr rCFrz2CrtSigV4AsymAuth._should_add_content_sha256_headerNrrrrr rrrcr)CrtS3SigV4AsymAuthFcCrrrrrrr r:Prz'CrtS3SigV4AsymAuth._get_existing_sha256crrrrrrr rBTrz.CrtS3SigV4AsymAuth._should_sha256_sign_payloadcCrrrrrrr rCvrz4CrtS3SigV4AsymAuth._should_add_content_sha256_headerrrrrr rKrrcFeZdZdZejjjZeffdd Z fddZ fddZ Z S)CrtSigV4AsymQueryAuthct|||||_dSrrr!rrrrrexpiresrrr r! zCrtSigV4AsymQueryAuth.__init__cst||jd}|dkr|jd=t|j}tddt|jdd D}|j r6| t |d|_ t |}|}|d|d |d ||d f}t||_dS) N content-type0application/x-www-form-urlencoded; charset=utf-8cSg|] \}}||dfqSrr.0kvrrr zHCrtSigV4AsymQueryAuth._modify_request_before_signing..Tkeep_blank_valuesr)rr;rerr rhdictr rnrjdataupdaterr r rrS content_typerv query_dictnew_query_stringp new_url_partsrrr r;s"     z4CrtSigV4AsymQueryAuth._modify_request_before_signingcLt||t|jj}t|j}t|d|d|d||df|_dSNrrrrrrQr rdrnrhr rrur signed_queryrrrr rQ  ( z,CrtSigV4AsymQueryAuth._apply_signing_changes rrrDEFAULT_EXPIRESrr<rHTTP_REQUEST_QUERY_PARAMSrJr!r;rQrrrrr r{s  *rc@(eZdZdZdZdZddZddZdS)CrtS3SigV4AsymQueryAuthzS3 SigV4A auth using query parameters. This signer will sign a request using query parameters and signature version 4A, i.e a "presigned url" signer. FcCrNFrrrrr rBz3CrtS3SigV4AsymQueryAuth._should_sha256_sign_payloadcCrrrrrrr rCrz9CrtS3SigV4AsymQueryAuth._should_add_content_sha256_headerNrrr__doc__rLrMrBrCrrrr rs  rcr)CrtSigV4QueryAuthrcrrrrrrr r!rzCrtSigV4QueryAuth.__init__cst||jd}|dkr|jd=t|j}tddt|jdd D}|j r5| |j i|_ |j rB| t |d|_ t|}|}|d|d |d ||d f}t||_dS) NrrcSrrrrrrr rrzDCrtSigV4QueryAuth._modify_request_before_signing..Trrrrrr)rr;rerr rhrr rnrjrirrrr r rrrr r;s(     z0CrtSigV4QueryAuth._modify_request_before_signingcrrrrrrr rQ rz(CrtSigV4QueryAuth._apply_signing_changesrrrrr rs  -rc@r)CrtS3SigV4QueryAuthaS3 SigV4 auth using query parameters. This signer will sign a request using query parameters and signature version 4, i.e a "presigned url" signer. Based off of: http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html FcCrrrrrrr rB(rz/CrtS3SigV4QueryAuth._should_sha256_sign_payloadcCrrrrrrr rC/rz5CrtS3SigV4QueryAuth._should_add_content_sha256_headerNrrrrr rs  r)v4zv4-queryv4as3v4z s3v4-querys3v4az s3v4a-query)r5ior botocore.authrrrrrbotocore.compatrr r r r botocore.utilsr botocore.exceptionsrrrrrrrrrCRT_AUTH_TYPE_MAPSrrrr s0   00DG