File: //lib/python3/dist-packages/botocore/__pycache__/auth.cpython-310.pyc
o
,&�a � � @ s� d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZ d dl Z d dl
Z
d dl m Z d dl
Z
d dlmZmZmZmZmZmZmZmZmZmZmZ d dlmZ d dl m Z m Z d dlm Z e
� e!�Z"d Z#d
Z$d Z%d Z&g d
�Z'dZ(dd� Z)dd� Z*G dd� de+�Z,G dd� de,�Z-G dd� de,�Z.G dd� de,�Z/G dd � d e/�Z0G d d � d e/�Z1G d d � d e1�Z2G d!d"� d"e/�Z3G d#d$� d$e,�Z4G d%d&� d&e4�Z5G d'd(� d(e4�Z6e-e.e.e4e5e6e3d)�Z7er�d d*l8m9Z9 e7�:e9� dS e7�:e/e1e0e2d+�� dS ),� N��
formatdate)�sha1�sha256)�
itemgetter) � encodebytes�ensure_unicode� HTTPHeaders�json�parse_qs�quote�six�unquote�urlsplit�
urlunsplit�HAS_CRT)�NoCredentialsError)�normalize_url_path�percent_encode_sequence)�
MD5_AVAILABLE�@e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855i z%Y-%m-%dT%H:%M:%SZz%Y%m%dT%H%M%SZ)�expectz
user-agentzx-amzn-trace-idzUNSIGNED-PAYLOADc C sF t | �}|j}ddd�}|jd ur!|j|�|j�kr!d||jf }|S )N�P i� )�http�httpsz%s:%d)r �hostname�port�get�scheme)�url� url_parts�host�
default_ports� r# �//usr/lib/python3/dist-packages/botocore/auth.py�_host_from_url7 s �
r% c C s@ | j }t|tj�rt�|�d��}|S t|tj�r t�|�}|S �N�utf-8)�data�
isinstancer
� binary_typer
�loads�decode� string_types)�requestr( r# r# r$ �_get_body_as_dictH s �
r/ c @ � e Zd ZdZdd� ZdS )�
BaseSignerFc C s t d��)N�add_auth)�NotImplementedError��selfr. r# r# r$ r2 X s zBaseSigner.add_authN)�__name__�
__module__� __qualname__�REQUIRES_REGIONr2 r# r# r# r$ r1 U s r1 c @ s( e Zd ZdZdd� Zdd� Zdd� ZdS ) � SigV2Authz+
Sign a request with Signature V2.
c C �
|| _ d S �N�� credentials�r5 r> r# r# r$ �__init__a �
zSigV2Auth.__init__c C s t �d� t|j�}|j}t|�dkrd}d|j|j|f }tj | j
j � d�t
d�}g }t|�D ]*}|dkr7q0t�|| �} t|� d�dd �}
t| � d�d
d �} |�|
� d | � �� q0d �|�} || 7 }t �d
|� |�|� d�� t�|�� ��� �d�}
| |
fS )Nz$Calculating signature using v2 auth.r �/z %s
%s
%s
r' �� digestmod� Signature� ��safez-_~�=�&zString to sign: %s)�logger�debugr r �path�len�method�netloc�hmac�newr> �
secret_key�encoder �sortedr
� text_typer �append�join�update�base64� b64encode�digest�stripr, )r5 r. �params�splitrM �string_to_sign�lhmac�pairs�key�value�
quoted_key� quoted_value�qs�b64r# r# r$ �calc_signatured s4
��
zSigV2Auth.calc_signaturec C s� | j d u rt� �|jr|j}n|j}| j j|d< d|d< d|d< t�tt�� �|d< | j j r4| j j |d< | �
||�\}}||d< |S ) N�AWSAccessKeyId�2�SignatureVersion�
HmacSHA256�SignatureMethod� Timestamp�
SecurityTokenrE ) r> r r( r^ �
access_key�time�strftime�ISO8601�gmtime�tokenri )r5 r. r^ rg � signaturer# r# r$ r2 � s
zSigV2Auth.add_authN)r6 r7 r8 �__doc__r@ ri r2 r# r# r# r$ r: \ s
r: c @ s e Zd Zdd� Zdd� ZdS )� SigV3Authc C r; r< r= r? r# r# r$ r@ � rA zSigV3Auth.__init__c C s� | j d u rt� �d|jv r|jd= tdd�|jd< | j jr-d|jv r&|jd= | j j|jd< tj| j j�d�t d�}|�
|jd �d�� t |� � ��
� }d| j jd|�d�f }d |jv ra|jd = ||jd < d S )
N�DateT��usegmt�X-Amz-Security-Tokenr' rC z6AWS3-HTTPS AWSAccessKeyId=%s,Algorithm=%s,Signature=%srm zX-Amzn-Authorization)r> r �headersr rv rQ rR rS rT r rY r r\ r] rq r, )r5 r. �new_hmac�encoded_signaturerw r# r# r$ r2 � s,
���
zSigV3Auth.add_authN)r6 r7 r8 r@ r2 r# r# r# r$ ry � s ry c @ s� e Zd ZdZdZdd� Zd/dd�Zdd � Zd
d � Zd d
� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.S )0� SigV4Authz+
Sign a request with Signature V4.
Tc C s || _ || _|| _d S r< )r> � _region_name�
_service_name�r5 r> � service_name� region_namer# r# r$ r@ � s
zSigV4Auth.__init__Fc C s< |rt �||�d�t��� }|S t �||�d�t��� }|S r& )rQ rR rT r � hexdigestr\ )r5 rc �msg�hex�sigr# r# r$ �_sign� s
�zSigV4Auth._signc C sL t � }|j�� D ]\}}|�� }|tvr|||< qd|vr$t|j�|d< |S )zk
Select the headers from the request that need to be included
in the StringToSign.
r! )r r~ �items�lower�SIGNED_HEADERS_BLACKLISTr% r )r5 r. �
header_map�namerd �lnamer# r# r$ �headers_to_sign� s �zSigV4Auth.headers_to_signc C s" |j r | �|j �S | �t|j��S r< )r^ � _canonical_query_string_params�_canonical_query_string_urlr r r4 r# r# r$ �canonical_query_string� s z SigV4Auth.canonical_query_stringc C sn g }|D ]}t || �}|�t|dd�t|dd�f� qg }t|�D ]
\}}|�d||f � q"d�|�}|S )Nz-_.~rG �%s=%srJ )�strrW r rU rX )r5 r^ �
key_val_pairsrc rd �sorted_key_valsr� r# r# r$ r� � s
�
z(SigV4Auth._canonical_query_string_paramsc C st d}|j r8g }|j �d�D ]}|�d�\}}}|�||f� q
g }t|�D ]
\}}|�d||f � q%d�|�}|S )NrF rJ rI r� )�queryr_ � partitionrW rU rX ) r5 �partsr� r� �pairrc �_rd r� r# r# r$ r� � s
z%SigV4Auth._canonical_query_string_urlc sX g }t t|��}|D ] }d�� fdd�|�|�D ��}|�d|t|�f � q
d�|�S )a
Return the headers that need to be included in the StringToSign
in their canonical form by converting all header keys to lower
case, sorting them in alphabetical order and then joining
them into a string, separated by newlines.
�,c 3 s � | ]}� � |�V qd S r< )�
_header_value��.0�v�r5 r# r$ � <genexpr> s � z.SigV4Auth.canonical_headers.<locals>.<genexpr>�%s:%s�
)rU �setrX �get_allrW r )r5 r� r~ �sorted_header_namesrc rd r# r� r$ �canonical_headers s �
zSigV4Auth.canonical_headersc C s d� |�� �S )N� )rX r_ )r5 rd r# r# r$ r� s zSigV4Auth._header_valuec C s t dd� t|�D ��}d�|�S )Nc S s g | ]}|� � �� �qS r# )r� r] )r� �nr# r# r$ �
<listcomp> � z,SigV4Auth.signed_headers.<locals>.<listcomp>�;)rU r� rX )r5 r� r~ r# r# r$ �signed_headers s �
zSigV4Auth.signed_headersc C s� | � |�stS |j}|r7t|d�r7|�� }t�|jt�}t � }t
|d�D ]}|� |� q$|� � }|�
|� |S |r?t |�� � S tS )N�seek� )�_should_sha256_sign_payload�UNSIGNED_PAYLOAD�body�hasattr�tell� functools�partial�read�PAYLOAD_BUFFERr �iterrY r� r� �EMPTY_SHA256_HASH)r5 r. � request_body�position�read_chunksize�checksum�chunk� hex_checksumr# r# r$ �payload s"
�
zSigV4Auth.payloadc C s |j �d�sdS |j�dd�S )Nr T�payload_signing_enabled)r �
startswith�contextr r4 r# r# r$ r� 6 s z%SigV4Auth._should_sha256_sign_payloadc C s� |j �� g}| �t|j�j�}|�|� |�| �|�� | �|�}|�| � |�d � |�| �
|�� d|j v r>|j d }n| � |�}|�|� d�
|�S )Nr� �X-Amz-Content-SHA256)rO �upper�_normalize_url_pathr r rM rW r� r� r� r� r~ r� rX )r5 r. �crrM r� �
body_checksumr# r# r$ �canonical_request@ s
zSigV4Auth.canonical_requestc C s t t|�dd�}|S )Nz/~rG )r r )r5 rM �normalized_pathr# r# r$ r� O s z SigV4Auth._normalize_url_pathc C sN | j jg}|�|jd dd� � |�| j� |�| j� |�d� d�|�S �N� timestampr � � aws4_requestrB )r> rq rW r� r� r� rX �r5 r. �scoper# r# r$ r� S s
zSigV4Auth.scopec C sH g }|� |jd dd� � |� | j� |� | j� |� d� d�|�S r� )rW r� r� r� rX r� r# r# r$ �credential_scope[ s
zSigV4Auth.credential_scopec C sH dg}|� |jd � |� | �|�� |� t|�d���� � d�|�S )z�
Return the canonical StringToSign as well as a dict
containing the original version of all headers that
were included in the StringToSign.
�AWS4-HMAC-SHA256r� r' r� )rW r� r� r rT r� rX )r5 r. r� �stsr# r# r$ r` c s
zSigV4Auth.string_to_signc C sd | j j}| �d| �d�|jd dd� �}| �|| j�}| �|| j�}| �|d�}| j||dd�S ) N�AWS4r' r� r r� r� T)r� )r> rS r� rT r� r� r� )r5 r` r. rc �k_date�k_region� k_service� k_signingr# r# r$ rw o s � zSigV4Auth.signaturec C s� | j d u rt� �tj�� }|�t�|jd< | �|� | �|�}t �
d� t �
d|� | � ||�}t �
d|� | � ||�}t �
d|� | �
||� d S )Nr� z$Calculating signature using v4 auth.zCanonicalRequest:
%s�StringToSign:
%sz
Signature:
%s)r> r �datetime�utcnowrs �SIGV4_TIMESTAMPr� � _modify_request_before_signingr� rK rL r` rw � _inject_signature_to_request)r5 r. � datetime_nowr� r` rw r# r# r$ r2 x s
zSigV4Auth.add_authc C sP d| � |� g}| �|�}|�d| �|� � |�d| � d�|�|jd< |S )Nz AWS4-HMAC-SHA256 Credential=%szSignedHeaders=%sz Signature=%sz, �
Authorization)r� r� rW r� rX r~ )r5 r. rw �auth_strr� r# r# r$ r� � s
z&SigV4Auth._inject_signature_to_requestc C sv d|j v r |j d= | �|� | jjr"d|j v r|j d= | jj|j d< |j�dd�s9d|j v r2|j d= t|j d< d S d S )Nr� r} r� Tr� )r~ �_set_necessary_date_headersr> rv r� r r� r4 r# r# r$ r� � s
�z(SigV4Auth._modify_request_before_signingc C s� d|j v r.|j d= tj�|jd t�}ttt�|� � ���|j d< d|j v r,|j d= d S d S d|j v r7|j d= |jd |j d< d S )Nrz r� �
X-Amz-Date)
r~ r� �strptimer� r� r �int�calendar�timegm� timetuple)r5 r. �datetime_timestampr# r# r$ r� � s
�
�
�
z%SigV4Auth._set_necessary_date_headersN)F)r6 r7 r8 rx r9 r@ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r` rw r2 r� r� r� r# r# r# r$ r� � s0
r� c s0 e Zd Z� fdd�Z� fdd�Zdd� Z� ZS )� S3SigV4Authc s6 t t| ��|� d|jv r|jd= | �|�|jd< d S )Nr� )�superr� r� r~ r� r4 �� __class__r# r$ r� � s
z*S3SigV4Auth._modify_request_before_signingc sx |j �d�}t|dd �}|d u ri }|�dd �}|d ur |S |j�d�r)d|jvr+dS |j �dd�r4dS tt| ��|�S ) N�
client_config�s3r� r z Content-MD5T�has_streaming_inputF) r� r �getattrr r� r~ r� r� r� )r5 r. r� � s3_config� sign_payloadr� r# r$ r� � s
z'S3SigV4Auth._should_sha256_sign_payloadc C � |S r< r# �r5 rM r# r# r$ r� � � z S3SigV4Auth._normalize_url_path)r6 r7 r8 r� r� r� �
__classcell__r# r# r� r$ r� � s "r� c s4 e Zd ZdZef� fdd� Zdd� Zdd� Z� ZS )�SigV4QueryAuth� c s t t| ��|||� || _d S r< )r� r� r@ �_expires)r5 r> r� r� �expiresr� r# r$ r@ � s �
zSigV4QueryAuth.__init__c C s |j �d�}d}||kr|j d= | �| �|��}d| �|�|jd | j|d�}| jjd ur3| jj|d< t |j
�}t dd� t |j
d d
��� D ��}|jrT|�|j� i |_d }|jrc|�t|�� d |_|rkt|�d }|t|� } |}
|
d
|
d |
d | |
d f} t| �|_
d S )N� content-typez0application/x-www-form-urlencoded; charset=utf-8r� r� )zX-Amz-AlgorithmzX-Amz-Credentialr� z
X-Amz-ExpireszX-Amz-SignedHeadersr} c S s g | ]
\}}||d f�qS �r r# )r� �kr� r# r# r$ r� s zASigV4QueryAuth._modify_request_before_signing.<locals>.<listcomp>T)�keep_blank_valuesrF rJ r � � � )r~ r r� r� r� r� r� r> rv r r �dictr r� r� r^ rY r( r/ r r ) r5 r. � content_type�blacklisted_content_typer� � auth_paramsr �
query_dict�operation_params�new_query_string�p�
new_url_partsr# r# r$ r� � sF ��
�� �
z-SigV4QueryAuth._modify_request_before_signingc C s | j d| 7 _ d S )Nz&X-Amz-Signature=%s)r �r5 r. rw r# r# r$ r� * s z+SigV4QueryAuth._inject_signature_to_request)r6 r7 r8 �DEFAULT_EXPIRESr@ r� r� r� r# r# r� r$ r� � s �@r� c @ s e Zd ZdZdd� Zdd� ZdS )�S3SigV4QueryAutha S3 SigV4 auth using query parameters.
This signer will sign a request using query parameters and signature
version 4, i.e a "presigned url" signer.
Based off of:
http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html
c C r� r< r# r� r# r# r$ r� < r� z$S3SigV4QueryAuth._normalize_url_pathc C s t S r< )r� r4 r# r# r$ r� @ s zS3SigV4QueryAuth.payloadN)r6 r7 r8 rx r� r� r# r# r# r$ r 1 s
r c @ r0 )�S3SigV4PostAuthz�
Presigns a s3 post
Implementation doc here:
http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-UsingHTTPPOST.html
c C sN t j �� }|�t�|jd< i }|j�dd �d ur |jd }i }g }|j�dd �d ur;|jd }|�dd �d ur;|d }||d< d|d< | �|�|d< |jd |d< |�ddi� |�d| �|�i� |�d|jd i� | jj d ur�| jj |d < |�d | jj i� t
� t �
|��d
���d
�|d < | �|d |�|d < ||jd< ||jd< d S )
Nr� �s3-presign-post-fields�s3-presign-post-policy�
conditionsr� zx-amz-algorithmzx-amz-credentialz
x-amz-date�x-amz-security-tokenr' �policyzx-amz-signature)r� r� rs r� r� r r� rW r> rv rZ r[ r
�dumpsrT r, rw )r5 r. r� �fieldsr r r# r# r$ r2 O s:
��
zS3SigV4PostAuth.add_authN�r6 r7 r8 rx r2 r# r# r# r$ r H s r c @ s| e Zd Zg d�Zddd�Zdd� Zdd� Zd d
� Zd d � Zdd
d�Z ddd�Z
ddd�Z dd� Z dd� Z
dd� ZdS )�
HmacV1Auth)$�
accelerate�acl�cors�defaultObjectAcl�location�logging�
partNumberr �requestPayment�torrent�
versioning� versionId�versions�website�uploads�uploadIdzresponse-content-typezresponse-content-languagezresponse-expireszresponse-cache-controlz response-content-dispositionzresponse-content-encoding�delete� lifecycle�tagging�restore� storageClass� notification� replicationr% � analytics�metrics� inventory�selectz select-typez object-lockNc C r; r< r= r� r# r# r$ r@ � rA zHmacV1Auth.__init__c C s> t j| jj�d�td�}|�|�d�� t|�� �� � �
d�S )Nr' rC ) rQ rR r> rS rT r rY r r\ r] r, )r5 r` r r# r# r$ � sign_string� s
�zHmacV1Auth.sign_stringc C s� g d�}g }d|v r
|d= | � � |d< |D ])}d}|D ]}|�� }|| d ur6||kr6|�|| �� � d}q|s>|�d� qd�|�S )N)� content-md5r �daterz FTrF r� )� _get_dater� rW r] rX )r5 r~ �interesting_headers�hoi�ih�foundrc �lkr# r# r$ �canonical_standard_headers� s" �
�
z%HmacV1Auth.canonical_standard_headersc C s� g }i }|D ] }|� � }|| d ur&|�d�r&d�dd� |�|�D ��||< qt|�� �}|D ]
}|�d||| f � q/d�|�S )N�x-amz-r� c s s � | ]}|� � V qd S r< )r] r� r# r# r$ r� � s � z6HmacV1Auth.canonical_custom_headers.<locals>.<genexpr>r� r� )r� r� rX r� rU �keysrW )r5 r~ r= �custom_headersrc r@ �sorted_header_keysr# r# r$ �canonical_custom_headers� s
��
z#HmacV1Auth.canonical_custom_headersc C s$ t |�dkr|S |d t|d �fS )z(
TODO: Do we need this?
r r )rN r )r5 �nvr# r# r$ � unquote_v� s zHmacV1Auth.unquote_vc s� |d ur|}n|j }|jrC|j�d�}dd� |D �}� fdd�|D �}t|�dkrC|jtd�d� dd� |D �}|d7 }|d�|�7 }|S ) NrJ c S s g | ]}|� d d��qS )rI r )r_ �r� �ar# r# r$ r� � r� z1HmacV1Auth.canonical_resource.<locals>.<listcomp>c s$ g | ]}|d � j v r� �|��qS r )�
QSAOfInterestrH rI r� r# r$ r� � s �r )rc c S s g | ]}d � |��qS )rI )rX rI r# r# r$ r� � s �?)rM r� r_ rN �sortr rX )r5 r_ � auth_path�buf�qsar# r� r$ �canonical_resource� s z HmacV1Auth.canonical_resourcec C sN |� � d }|| �|�d 7 }| �|�}|r ||d 7 }|| j||d�7 }|S )Nr� �rN )r� rA rF rQ )r5 rO r_ r~ r rN �csrD r# r# r$ �canonical_string� s
zHmacV1Auth.canonical_stringc C sB | j jr
|d= | j j|d< | j||||d�}t�d|� | �|�S )Nr rR r� )r> rv rT rK rL r8 )r5 rO r_ r~ r rN r` r# r# r$ �
get_signature� s �
zHmacV1Auth.get_signaturec C sX | j d u rt�t�d� t|j�}t�d|j� | j|j||j|j d�}| �
||� d S )Nz(Calculating signature using hmacv1 auth.zHTTP request method: %srR ) r> r rK rL r r rO rU r~ rN �_inject_signature)r5 r. r_ rw r# r# r$ r2 � s
�zHmacV1Auth.add_authc C s
t dd�S )NTr{ r r� r# r# r$ r; � rA zHmacV1Auth._get_datec C s, d|j v r |j d= d| jj|f |j d< d S )Nr� z AWS %s:%s)r~ r> rq r r# r# r$ rV � s
�z HmacV1Auth._inject_signature)NNr< )r6 r7 r8 rK r@ r8 rA rF rH rQ rT rU r2 r; rV r# r# r# r$ r v s"
�
� r c @ s0 e Zd ZdZdZefdd�Zdd� Zdd� Zd S )
�HmacV1QueryAuthz�
Generates a presigned request for s3.
Spec from this document:
http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html
#RESTAuthenticationQueryStringAuth
r� c C s || _ || _d S r< )r> r� )r5 r> r r# r# r$ r@ s
zHmacV1QueryAuth.__init__c C s t tt�� t| j� ��S r< )r� r� rr r� r� r# r# r$ r; s zHmacV1QueryAuth._get_datec C s� i }| j j|d< ||d< |jD ]"}|�� }|dkr!|jd |d< q|�d�s*|dv r1|j| ||< qt|�}t|j�}|d rGd|d |f }|d |d
|d ||d f}t|�|_d S )
Nrj rE rz �ExpiresrB )r9 r � z%s&%sr r r r ) r> rq r~ r� r� r r r r ) r5 r. rw r �
header_keyr@ r r r r# r# r$ rV s
�
z!HmacV1QueryAuth._inject_signatureN)r6 r7 r8 rx r r@ r; rV r# r# r# r$ rW s rW c @ r0 )�HmacV1PostAuthz�
Generates a presigned post for s3.
Spec from this document:
http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingHTTPPOST.html
c C s� i }|j �dd �d ur|j d }i }g }|j �dd �d ur.|j d }|�dd �d ur.|d }||d< | jj|d< | jjd urM| jj|d< |�d| jji� t�t� |��
d��� d�|d< | � |d �|d< ||j d< ||j d< d S ) Nr r r rj r r' r rw )
r� r r> rq rv rW rZ r[ r
r rT r, r8 )r5 r. r r r r# r# r$ r2 : s,
��
zHmacV1PostAuth.add_authNr r# r# r# r$ r[ 2 s r[ )�v2�v3�v3httpsr� zs3-queryzs3-presign-postzs3v4-presign-post)�CRT_AUTH_TYPE_MAPS)�v4zv4-query�s3v4z
s3v4-query);rZ r� r� r� � email.utilsr �hashlibr r rQ r# �operatorr rr �botocore.compatr r r r
r r r
r r r r �botocore.exceptionsr �botocore.utilsr r r � getLoggerr6 rK r� r� rt r� r� r� r% r/ �objectr1 r: ry r� r� r� r r r rW r[ �AUTH_TYPE_MAPS�botocore.crt.authr_ rY r# r# r# r$ �<module> sl
4
�
> /P. 2'� �