| Current File : //usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyo |
�
�p/Xc @@ s� d d l m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l
Z
d d l Z d d l j j Z d d l m Z d d l m Z d d l m Z d Z d Z d e f d � � YZ d
e f d � � YZ d e f d
� � YZ d e f d � � YZ d e f d � � YZ d e f d � � YZ d � Z! d � Z" d S( i ( t absolute_importN( t Arg( t BaseAuth( t AuthErrors %Y-%m-%dT%H:%M:%SZs %Y%m%dT%H%M%SZt HmacKeyAuthc B@ s� e Z d Z e d d d d d d �e d d d d d d
�e d d d d d
�g Z e d � � Z d � Z d � Z d � Z d � Z
RS( s1
Basis for AWS HMAC-based authentication
s -Is --access-key-idt destt key_idt metavart KEY_IDs -Ss --secret-keyt
secret_keyt KEYs --security-tokent security_tokent TOKENc K@ s� | j d | j j � | j d | j j d � � | j d | j j d � � | j d | j j d � � | j d | j j d � � | | j | � } | j � | S( Nt loglevelR R R t credential_expiration( t
setdefaultt logt levelt argst gett configt configure( t clst othert kwargst new( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt
from_other1 s
c C@ s� | j � | j j d � s+ t d � � n | j j d � sL t d � � n | j j d � r� d } xf d
D]> } y! t j j | j d | � } PWqk t k
r� qk qk Xqk W| j j d j
| j d � � | r� | t j j � k r� t d � � q� n d S( NR s0 missing access key ID; please supply one with -IR s- missing secret key; please supply one with -SR s %Y-%m-%dT%H:%M:%S.%fZs %Y-%m-%dT%H:%M:%SZsO failed to parse credential expiration time '{0}'; proceeding without validations credentials have expired( s %Y-%m-%dT%H:%M:%S.%fZs %Y-%m-%dT%H:%M:%SZ( t _HmacKeyAuth__populate_auth_argsR R R t Nonet datetimet strptimet
ValueErrorR t warnt formatt utcnow( t selft
expirationt fmt( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR = s&
c
C@ s# d t j k r t j d � } t j j | � } t j j | � } t | � �� } x� | D]� } | j d d � d } d | k rX | j d d � \ } } | j � d k r� | j j
d � r� | j � | j d <q| j � d k r| j j
d � r| j � | j d <qqX qX WWd QX| Sd S(
Nt AWS_CREDENTIAL_FILEt #i i t =t AWSAccessKeyIdR t AWSSecretKeyR ( t ost environt getenvt patht
expandvarst
expandusert opent splitt stripR R ( R# R. t credfilet linet keyt val( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt" configure_from_aws_credential_fileU s
#c C@ s� | j j d � r4 | j j d � r4 t d � � n | j j d � rh | j j d � rh t d � � n | j � r� | j j d � d St j d � p� t j d � | j d <t j d � p� t j d
� | j d <t j d � | j d <t j d
� | j d <| j � r | j j d � d S| j � } | rS| j � rS| j j d | � d S| j j
d � | j d <| j j
d d t �| j d <| j � r�| j j d � d Sd S( s
Try to get auth info from each source in turn until one provides
both a key ID and a secret key. After each time a source fails
to provide enough info we wipe self.args out so we don't wind up
mixing info from multiple sources.
R R s- missing secret key; please supply one with -Ss0 missing access key ID; please supply one with -Is! using auth info provided directlyNt AWS_ACCESS_KEY_IDt AWS_ACCESS_KEYt AWS_SECRET_ACCESS_KEYt AWS_SECRET_KEYt AWS_SECURITY_TOKENR t AWS_CREDENTIAL_EXPIRATIONR s using auth info from environments+ using auth info from AWS credential file %ss key-ids
secret-keyt redacts" using auth info from configuration( R R R t _HmacKeyAuth__reset_unless_readyR t debugR+ R- R8 R t get_user_optiont True( R# t aws_credfile_path( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt __populate_auth_argsi s6 %% c C@ sJ | j j d � r( | j j d � r( t Sx d D] } d | j | <q/ Wt S( s�
If both an access key ID and a secret key are set in self.args
return True. Otherwise, clear auth info from self.args and
return False.
R R R R ( s key_ids
secret_keys security_tokens credential_expirationN( R R RC R t False( R# t arg( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt __reset_unless_ready� s $
( t __name__t
__module__t __doc__R t ARGSt classmethodR R R8 R R@ ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR ) s -t
HmacV1Authc B@ sb e Z d Z e d � Z d � Z d � Z d � Z d � Z d � Z d � Z
d � Z d � Z RS( sk
S3 REST authentication
http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html
t aclt lifecyclet locationt loggingt notificationt
partNumbert policyt requestPaymentt torrentt uploadIdt uploadst versionIdt
versioningt versionst websitec C@ s� | j | � | j | � } | j | | � } | j | | | � } | j j d t | � � | j | j d � � } | j j d | � | j | | � | S( Ns string to sign: %ss utf-8s b64-encoded signature: %s(
t _update_request_before_signingt get_canonicalized_headerst get_canonicalized_resourcet _get_string_to_signR RA t reprt sign_stringt encodet _apply_signature( R# t reqt servicet c_headerst
c_resourcet to_signt signature( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt apply_to_request� s
c
C@ s� d } | j j | � t j | t � x! d D] } | j j | d � q- Wt j | j � � } | t
j
j � } | j | j
| j d d d d } | j j d | | � | j | � } | j j d
t | � � | j | | � }
| j j d t |
� � d j | j | j j d
d � | j j d d � t j | � | |
f � } | j j d t | � � | j | j d � � } | j j d | � | j d | j d <t j | � | j d <| | j d <| j j d � r�| j d | j d <n d S( Nse S3RestAuth.apply_to_request_params is deprecated; use requestbuilder.auth.aws.QueryHmacV1Auth insteadR) t Expirest Signaturei i i
i s$ expiration: %i (%f seconds from now)s canonicalized headers: %ss canonicalized resource: %ss
s Content-MD5t s Content-Types string to sign: %ss utf-8s b64-encoded signature: %sR R t
SecurityToken( s AWSAccessKeyIdRm Rn i@B i@B ( R R t warningst DeprecationWarningt paramst popR t calendart timegmt utctimetupleR R" t microsecondst secondst daysRA R_ Rb R` t joint methodt headersR t sixt text_typeRc Rd R (
R# Rf Rg t expiration_datetimet msgt paramR$ t delta_tt delta_t_secRh Ri Rj Rk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt apply_to_request_params� s:
c C@ s� | j s i | _ n t j j � | j d <t j | j � j | j d <| j j d � rp | j d | j d <n | j j d d � d S( Nt Datet HostR s x-amz-security-tokenRn ( R} t emailt utilst
formatdatet urlparset urlt netlocR R Rt R ( R# Rf ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR^ � s c C@ sS d j | j j � | j j d d � | j j d d � | j j d � | | f � S( Ns
s Content-MD5Ro s Content-TypeR� ( R{ R| t upperR} R ( R# Rf Rh Ri ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRa � s
c C@ s$ d j | j d | � | j d <d S( Ns AWS {0}:{1}R t
Authorization( R! R R} ( R# Rf Rk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRe � s c
C@ sD t j | j � j } t j | j � j } | t | � } | j d � rV d | } n | se d } n t | d d � r� | j } n t | j � } | r'g } x� t
| j � � D]o \ } } | | j k r | d k r� | j
| � q | j
| d | � n | r� | d d j | � 7} q� q� Wn | j j d t | � � | S( Nt /Rs R( t ?t &s canonicalized resource: %s( R� R� R. t endpointt lent endswitht getattrR Rs t _get_params_from_urlt sortedt iteritemst
HASHED_PARAMSt appendR{ R RA Rb (
R# Rf Rg t parsed_req_patht parsed_svc_patht resourceRs t subresourcesR6 R7 ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR` � s*
!c C@ s i } xq | j j � D]` \ } } | j � j d � r | j | j � g � | | j � j d j | j � � � q q Wg } xB t | j � � D]. \ } } | j d j | d j | � � � q� W| r� d j | � d } n d } | j
j d t | � � | S( Ns x-amz-t s {0}:{1}t ,s
Ro s canonicalized headers: %s(
R} R� t lowert
startswithR R� R{ R2 R� R! R RA Rb ( R# Rf t headers_dictR6 R7 t headers_strst valsRh ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR_ s - &c C@ s? t j | j d d t j �} | j | � t j | j � � S( NR t digestmod( t hmacR R t hashlibt sha1t updatet base64t b64encodet digest( R# Rj t req_hmac( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRc & s
( RO RP RQ RR RS RT RU RV RW RX RY RZ R[ R\ R] (
RI RJ RK t setR� Rl R� R^ Ra Re R` R_ Rc ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRN � s $ # t QueryHmacV1Authc B@ s) e Z d Z d � Z d � Z d � Z RS( iX c C@ s� t | j j d � � p | j } t | j � } | j d | d <t t j � | � | d <| j d d � | j t
| j � | � d S( Nt timeoutR R) Rm Rn ( t intR R t DEFAULT_TIMEOUTR� R� t timeRt R t prepare_urlt _remove_params_from_url( R# Rf R� Rs ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR^ / s !c C@ sZ t | j � } d j | j j � | j j d d � | j j d d � | d | | f � S( Ns
s Content-MD5Ro s Content-TypeRm ( R� R� R{ R| R� R} R ( R# Rf Rh Ri Rs ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRa 8 s c C@ s | j | j i | d 6� d S( NRn ( R� R� ( R# Rf Rk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRe @ s ( RI RJ R� R^ Ra Re ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� , s t QueryHmacV2Authc B@ s e Z d Z d � Z d � Z RS( sk
AWS signature version 2
http://docs.aws.amazon.com/general/latest/gr/signature-version-2.html
c C@ s5 t j | j � } | j d k rB t j | j p3 d d t �} n t j | j d t �} t d � | j � D� � } | j d | d <d | d <d | d
<t
j t t
j
� � | d <| j j d � r� | j d | d
<n | j d d � d j d | j d | j j � d | j pd � } g } xZ t | � D]L } t j | | � } | j t j | d d �d t j | d d �� q3Wd j | � } | | 7} t j d d | � }
| j j d t |
� � | j | � } | j j d | � | | d <| j d k r| j! | i � n | j" t# | j � | � | S( Nt POSTRo t keep_blank_valuesc s@ s% | ] \ } } | | d f Vq d S( i N( ( t .0R6 R� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pys <genexpr>Q s R R) i t SignatureVersiont
HmacSHA256t SignatureMethodt TimestampR Rp Rn s {method}
{host}
{path}
R| t hostR. R� t safeR( s -_~R� s
assword=[^&]*s assword=<redacted>s string to sign: %ss b64-encoded signature: %s($ R� R� R| t parse_qst bodyRC t queryt dictR� R R� t strftimet ISO8601t gmtimeR Rt R R! R� R� R. R� R~ R R� t quoteR{ t ret subR RA Rb Rc t prepare_bodyR� R� ( R# Rf Rg t parsedRs Rj t
quoted_paramsR6 R7 t query_stringt redacted_to_signRk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRl J s@ !
c C@ s? t j | j d d t j �} | j | � t j | j � � S( NR R� ( R� R R R� t sha256R� R� R� R� ( R# Rj R� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRc r s
( RI RJ RK Rl Rc ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� D s (t
HmacV4Authc B@ sh e Z d Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z
d � Z d
� Z RS( sk
AWS signature version 4
http://docs.aws.amazon.com/general/latest/gr/signature-version-4.html
c C@ sE | j s@ | j j d | j j � t d j | j j � � � n | j | � } t j � } t j t
t j | � � } | j | | � } d j
| j d f | � } | j | | | | � | j | � } | j | � } | j | � }
| j | � } d j
| j j � | | |
d | | f � } | j j d t | � � d j
d | d j
| � t j | � j � f � }
t j d d
|
� } | j j d t | � � t j d j | j d
� d t j �} x9 | D]1 } | j | � t j | j � d t j �} q�W| j |
� | j � } | j j d | � | j! | | | � | S( Ns8 service class %s must have a NAME attribute to use sigv4s+ BUG: service class {0} does not have a nameR� R s
Ro s canonical request: %ss AWS4-HMAC-SHA256s
assword=[^&]*s assword=<redacted>s string to sign: %ss AWS4{0}R R� s
signature: %s(" t NAMER t criticalt __class__RI R R! t
_hash_payloadR� R� t
ISO8601_BASICR� t _build_scopeR{ R R^ t _get_canonical_urit _get_canonical_queryt _get_canonical_headerst _get_signed_headersR| R� RA Rb R� R� t hexdigestR� R� R� R R� R� Re ( R# Rf Rg t payload_hasht nowt date_headert scopet
credentialt c_urit c_queryRh t s_headerst c_requestRj R� t derived_hmact chunkRk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRl ~ sF
c C@ s| t j | j � } | j | j d <| j j d d � | | j d <| | j d <| j j d � rx | j d | j d <n d S( NR� R� s X-Amz-Content-SHA256s
X-Amz-DateR s X-Amz-Security-Token( R� R� R� R} Rt R R R ( R# Rf R� t payload_sha256R� R� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR^ � s
c C@ sM d j d j | � d j | j | � � d j | � f � } | | j d <d S( Ns , s AWS4-HMAC-SHA256 Credential={0}s SignedHeaders={0}s
Signature={0}R� ( R{ R! R� R} ( R# Rf R� Rk t auth_header( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRe � s
c C@ s� | j r | j } n= t j d � r6 t j d � } n | j j d � t d � � t j d t j | � � | | j d f } | j j
d d j | � � | S( Nt AWS_AUTH_REGIONs& a region name is required to use sigv4sw region name is required; either use a config file to supply the service's URL or set AWS_AUTH_REGION in the environments %Y%m%dt aws4_requests scope: %sR� ( t region_nameR+ R- R t errorR R� R� R� R� RA R{ ( R# Rg t timestampt regionR� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� � s c C@ sG t j | j � j p d } t j | d d �} | j j d | � | S( NR� R� s /~s canonical URI: %s( R� t urlsplitR� R. R� R RA ( R# Rf R. R� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� � s c C@ s� t j t j | j � j d t �} g } xZ t | p9 g � D]F \ } } | j d j t j | d d �t j | d d �f � � q= Wd j | � } | j j
d | � | S( NR� R( R� s ~-_.R� s canonical query: %s( R� t parse_qslR� R� RC R� R� R{ R� R RA ( R# Rf t
req_paramsRs R6 R7 t c_params( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� � s c C@ s[ i } xN | j j � D]= \ } } | j � d k r | j � | | j � j � <q q W| S( Nt
connections
user-agent( R� s
user-agent( R} R� R� R3 ( R# Rf R} R6 R7 ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt _get_normalized_headers� s
#c C@ sz g } | j | � } x< t | j � � D]( \ } } | j d j | | f � � q( W| j j d t | � � d j | � S( Nt :s canonical headers: %ss
( R� R� t itemsR� R{ R RA t str( R# Rf R} t normalized_headersR6 R7 ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� � s c C@ s; | j | � } d j t | � � } | j j d | � | S( Nt ;s signed headers: %s( R� R{ R� R RA ( R# Rf R� R� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� � s c C@ s� | j j d � r | j d St j � } | j s5 nJt | j d � r� | j j � } | j j d � x3 t
r� | j j d � } | s� Pn | j | � qi W| j j
| � | j j d � n� t | j d � ro| j j d � t j d d � } x@ t
r5| j j d � } | sPn | j | � | j | � q� W| j j d � | j
d � | j j d
� | | _ n | j | j � | j j d | j � � | j � S( NR� t seeks payload hashing startingi @ s payload hashing donet reads! payload spooling/hashing startingt max_sizei
i s payload spooling/hashing donei s+ re-pointing request body at spooled payloads payload hash: %si ( i � ( R R R� R� R� t hasattrt datat tellR RA RC R� R� R� t tempfilet SpooledTemporaryFilet writet infoR� ( R# Rf R� t
body_positionR� t spool( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� � s>
(
RI RJ RK Rl R^ Re R� R� R� R� R� R� R� ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� x s )
t QueryHmacV4Authc B@ s e Z d � Z d � Z RS( c C@ s | j j � d k rC d | j j d d � k rC | j j d � n t j | j � } | j | j d <| j j d d � i d d 6| d
6| d 6| j | � d 6} | j j d
� r� | j d
| d <n | j j d � r� | j d | d <n | j
| j | � d S( NR� s form-urlencodeds Content-TypeRo sk Query string authentication and POST form data are generally mutually exclusive; GET is recommended insteadR� R� s AWS4-HMAC-SHA256s X-Amz-Algorithms X-Amz-Credentials
X-Amz-Dates X-Amz-SignedHeadersR� s
X-Amz-ExpiresR s X-Amz-Security-Token( R| R� R} R R R R� R� R� Rt R R� R R� ( R# Rf R� R� R� R� Rs ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR^ s c C@ s | j | j i | d 6� d S( Ns X-Amz-Signature( R� R� ( R# Rf R� Rk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRe / s ( RI RJ R^ Re ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR s c C@ sA t j | � } t j | j d t �} t d � | j � D� � S( s�
Given a URL, return a dict of parameters and their values. If a
parameter appears more than once all but the first value will be lost.
R� c s@ s% | ] \ } } | | d f Vq d S( i N( ( R� R6 R� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pys <genexpr>: s ( R� R� R� RC R� R� ( R� R� Rs ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� 3 s c C@ s: t j | � } t j | d | d | d d d d f � S( s^
Return a copy of a URL with its parameters, fragments, and query
string removed.
i i i Ro ( R� t
urlunparse( R� R� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� = s (# t
__future__R R� Ru R t email.utilsR� R� R� R+ R� R R� Rq R~ t six.moves.urllib_parset movest urllib_parseR� t requestbuilderR t requestbuilder.authR t requestbuilder.exceptionsR R� R� R RN R� R� R� R R� R� ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt <module> s4 {�4�