U
    3ìdV£  ã                   @   s4  d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl	m
Z
 ddlZddlZddlZddlmZmZmZmZ ddlmZ ddlmZ zddlmZ ddlmZ W n  ek
rÔ   ddlZdZY nX d	d
ddddddddddddddddddgZdddd d!d"d#d$d%d&d'd(d)gZG d*d+„ d+eƒZG d,d-„ d-eeƒZG d.d/„ d/eeƒZG d0d1„ d1eeƒZ G d2d3„ d3eeƒZ!G d4d5„ d5eeƒZ"G d6d7„ d7eeƒZ#G d8d9„ d9e#eƒZ$G d:d;„ d;eƒZ%G d<d=„ d=eƒZ&G d>d?„ d?e&eƒZ'G d@dA„ dAe&eƒZ(G dBdC„ dCe&eƒZ)G dDdE„ dEe)eƒZ*dLdFdG„Z+dHdI„ Z,dJdK„ Z-dS )Mz/
Handles authentication required to AWS and GS
é    N)Ú
formatdate)ÚurllibÚencodebytesÚparse_qs_safeÚurlparse)ÚAuthHandler)ÚBotoClientError)Úsha1)Úsha256z-ap-northeast-1z.ap-northeast-1z-ap-southeast-1z.ap-southeast-1z-ap-southeast-2z.ap-southeast-2z
-eu-west-1z
.eu-west-1z-external-1z.external-1z
-sa-east-1z
.sa-east-1z
-us-east-1z
.us-east-1z-us-gov-west-1z.us-gov-west-1z
-us-west-1z
.us-west-1z
-us-west-2z
.us-west-2z.cn-z.eu-centralz-eu-centralz.ap-northeast-2z-ap-northeast-2z.ap-south-1z-ap-south-1z
.us-east-2z
-us-east-2z-ca-centralz.ca-centralz
.eu-west-2z
-eu-west-2c                   @   sH   e Zd ZdZdd„ Zdd„ Zdd„ Zdd	„ Zd
d„ Zdd„ Z	dd„ Z
dS )ÚHmacKeyszKey based Auth handler helper.c                 C   s2   |j d ks|jd krtj ¡ ‚|| _|  |¡ d S ©N)Ú
access_keyÚ
secret_keyÚbotoÚauth_handlerÚNotReadyToAuthenticateÚhostÚupdate_provider©Úselfr   ÚconfigÚprovider© r   ú-/tmp/pip-unpacked-wheel-d7dsrkjd/boto/auth.pyÚ__init__e   s    
zHmacKeys.__init__c                 C   sJ   || _ tj| j j d¡td| _tr@tj| j j d¡td| _nd | _d S ©Núutf-8)Ú	digestmod)	Ú	_providerÚhmacÚnewr   ÚencodeÚshaÚ_hmacr
   Ú	_hmac_256©r   r   r   r   r   r   k   s    ÿÿ
zHmacKeys.update_providerc                 C   s   | j r
dS dS d S )NZ
HmacSHA256ZHmacSHA1)r$   ©r   r   r   r   Ú	algorithmu   s    zHmacKeys.algorithmc                 C   s(   | j rt}nt}tj| jj d¡|dS r   )r$   r
   r"   r   r    r   r   r!   )r   r   r   r   r   Ú	_get_hmac{   s    ÿzHmacKeys._get_hmacc                 C   s.   |   ¡ }| | d¡¡ t| ¡ ƒ d¡ ¡ S ©Nr   )r(   Úupdater!   r   ÚdigestÚdecodeÚstrip)r   Ústring_to_signZnew_hmacr   r   r   Úsign_stringƒ   s    zHmacKeys.sign_stringc                 C   s   t   | j¡}|d= |d= |S )Nr#   r$   )ÚcopyÚ__dict__)r   Zpickled_dictr   r   r   Ú__getstate__ˆ   s    zHmacKeys.__getstate__c                 C   s   || _ |  | j¡ d S r   )r1   r   r   )r   Údctr   r   r   Ú__setstate__Ž   s    zHmacKeys.__setstate__N)Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   r   r'   r(   r/   r2   r4   r   r   r   r   r   b   s   
r   c                       s.   e Zd ZdZdgZ‡ fdd„Zdd„ Z‡  ZS )ÚAnonAuthHandlerz(
    Implements Anonymous requests.
    Úanonc                    s   t t| ƒ |||¡ d S r   )Úsuperr9   r   r   ©Ú	__class__r   r   r   š   s    zAnonAuthHandler.__init__c                 K   s   d S r   r   )r   Úhttp_requestÚkwargsr   r   r   Úadd_auth   s    zAnonAuthHandler.add_auth)r5   r6   r7   r8   Ú
capabilityr   r@   Ú__classcell__r   r   r<   r   r9   “   s   r9   c                       s8   e Zd ZdZddgZdd„ Z‡ fdd„Zdd	„ Z‡  ZS )
ÚHmacAuthV1Handlerz:    Implements the HMAC request signing used by S3 and GS.zhmac-v1Ús3c                 C   s*   t  | |||¡ t | |||¡ d | _d S r   ©r   r   r   r$   r   r   r   r   r   ¦   s    zHmacAuthV1Handler.__init__c                    s   t t| ƒ |¡ d | _d S r   )r;   rC   r   r$   r%   r<   r   r   r   «   s    z!HmacAuthV1Handler.update_providerc                 K   sª   |j }|j}|j}d|kr(tdd|d< | jjrD| jj}| jj||< tj 	|||d | j¡}tj
 d| ¡ |  |¡}| jj}	d|	| jj|f }
tj
 d|
 ¡ |
|d< d S )NÚDateT©ÚusegmtúStringToSign:
%sú%s %s:%súSignature:
%sÚAuthorization)ÚheadersÚmethodÚ	auth_pathr   r   Úsecurity_tokenÚsecurity_token_headerr   ÚutilsZcanonical_stringÚlogÚdebugr/   Úauth_headerr   )r   r>   r?   rM   rN   rO   Úkeyr.   Úb64_hmacÚauth_hdrÚauthr   r   r   r@   ¯   s&    
 þ
zHmacAuthV1Handler.add_auth©	r5   r6   r7   r8   rA   r   r   r@   rB   r   r   r<   r   rC   ¡   s
   rC   c                       s8   e Zd ZdZddgZdd„ Z‡ fdd„Zdd	„ Z‡  ZS )
ÚHmacAuthV2HandlerzJ
    Implements the simplified HMAC authorization used by CloudFront.
    zhmac-v2Z
cloudfrontc                 C   s*   t  | |||¡ t | |||¡ d | _d S r   rE   r   r   r   r   r   Ê   s    zHmacAuthV2Handler.__init__c                    s   t t| ƒ |¡ d | _d S r   )r;   r[   r   r$   r%   r<   r   r   r   Ï   s    z!HmacAuthV2Handler.update_providerc                 K   sh   |j }d|krtdd|d< | jjr8| jj}| jj||< |  |d ¡}| jj}d|| jj|f |d< d S )NrF   TrG   rJ   rL   )rM   r   r   rP   rQ   r/   rU   r   )r   r>   r?   rM   rV   rW   rX   r   r   r   r@   Ó   s     ÿÿzHmacAuthV2Handler.add_authrZ   r   r   r<   r   r[   Ä   s
   r[   c                   @   s*   e Zd ZdZdddgZdd„ Zdd„ Zd	S )
ÚHmacAuthV3Handlerz@Implements the new Version 3 HMAC authorization used by Route53.zhmac-v3Zroute53Zsesc                 C   s$   t  | |||¡ t | |||¡ d S r   ©r   r   r   r   r   r   r   r   ç   s    zHmacAuthV3Handler.__init__c                 K   sr   |j }d|krtdd|d< | jjr8| jj}| jj||< |  |d ¡}d| jj }|d|  ¡ |f 7 }||d< d S )NrF   TrG   zAWS3-HTTPS AWSAccessKeyId=%s,zAlgorithm=%s,Signature=%súX-Amzn-Authorization)rM   r   r   rP   rQ   r/   r   r'   )r   r>   r?   rM   rV   rW   Úsr   r   r   r@   ë   s    zHmacAuthV3Handler.add_authN)r5   r6   r7   r8   rA   r   r@   r   r   r   r   r\   â   s   
r\   c                   @   s>   e Zd ZdZdgZdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Z	dS )ÚHmacAuthV3HTTPHandlerzK
    Implements the new Version 3 HMAC authorization used by DynamoDB.
    zhmac-v3-httpc                 C   s$   t  | |||¡ t | |||¡ d S r   r]   r   r   r   r   r     s    zHmacAuthV3HTTPHandler.__init__c                 C   s<   d| j i}|j ¡ D ]"\}}| ¡ }| d¡r|||< q|S )úk
        Select the headers from the request that need to be included
        in the StringToSign.
        ÚHostúx-amz)r   rM   ÚitemsÚlowerÚ
startswith)r   r>   Úheaders_to_signÚnameÚvalueÚlnamer   r   r   rg     s    


z%HmacAuthV3HTTPHandler.headers_to_signc                    s    t ‡ fdd„ˆ D ƒƒ}d |¡S )á  
        Return the headers that need to be included in the StringToSign
        in their canonical form by converting all header keys to lower
        case, sorting them in alphabetical order and then joining
        them into a string, separated by newlines.
        c                    s(   g | ] }d |  ¡  ¡ ˆ |  ¡ f ‘qS )ú%s:%s©re   r-   ©Ú.0Ún©rg   r   r   Ú
<listcomp>  s   ÿ
ÿz;HmacAuthV3HTTPHandler.canonical_headers.<locals>.<listcomp>Ú
©ÚsortedÚjoin©r   rg   Úlr   rq   r   Úcanonical_headers  s    ÿz'HmacAuthV3HTTPHandler.canonical_headersc                 C   s8   |   |¡}|  |¡}d |j|jd|d|jg¡}||fS )ú¬
        Return the canonical StringToSign as well as a dict
        containing the original version of all headers that
        were included in the StringToSign.
        rs   Ú )rg   ry   rv   rN   rO   Úbody)r   r>   rg   ry   r.   r   r   r   r.     s    

ûz$HmacAuthV3HTTPHandler.string_to_signc                 K   sº   d|j kr|j d= tdd|j d< | jjr8| jj|j d< |  |¡\}}tj d| ¡ t| 	d¡ƒ 
¡ }|  |¡}d| jj }|d	|  ¡  7 }|d
d |¡ 7 }|d| 7 }||j d< dS )z›
        Add AWS3 authentication to a request.

        :type req: :class`boto.connection.HTTPRequest`
        :param req: The HTTPRequest object.
        r^   TrG   ú
X-Amz-DateúX-Amz-Security-TokenrI   r   zAWS3 AWSAccessKeyId=%s,zAlgorithm=%s,zSignedHeaders=%s,ú;úSignature=%sN)rM   r   r   rP   r.   r   rS   rT   r
   r!   r+   r/   r   r'   rv   )r   Úreqr?   r.   rg   Z
hash_valuerW   r_   r   r   r   r@   ,  s    	

zHmacAuthV3HTTPHandler.add_authN)
r5   r6   r7   r8   rA   r   rg   ry   r.   r@   r   r   r   r   r`   ú   s   r`   c                   @   s²   e Zd ZdZdgZd+dd„Zd,dd„Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd „ Zd!d"„ Zd#d$„ Zd%d&„ Zd'd(„ Zd)d*„ ZdS )-ÚHmacAuthV4Handlerz:
    Implements the new Version 4 HMAC authorization.
    úhmac-v4Nc                 C   s0   t  | |||¡ t | |||¡ || _|| _d S r   )r   r   r   Úservice_nameÚregion_name)r   r   r   r   r„   r…   r   r   r   r   L  s    zHmacAuthV4Handler.__init__Fc                 C   sN   t |tƒs| d¡}|r2t || d¡t¡ ¡ }nt || d¡t¡ ¡ }|S r)   )Ú
isinstanceÚbytesr!   r   r    r
   Ú	hexdigestr+   )r   rV   ÚmsgÚhexÚsigr   r   r   Ú_signV  s    

zHmacAuthV4Handler._signc                 C   sr   |   | j|¡}|j d¡r$|jd }d|i}|j ¡ D ]6\}}| ¡ }| d¡r6t|tƒrd| 	d¡}|||< q6|S )ra   rb   rc   r   )
Úhost_headerr   rM   Úgetrd   re   rf   r†   r‡   r,   ©r   r>   Zhost_header_valuerg   rh   ri   rj   r   r   r   rg   `  s    




z!HmacAuthV4Handler.headers_to_signc                 C   s8   |j }|jdk}|dkr|r(|dkr,|r,|S d||f S ©NÚhttpséP   i»  rl   )ÚportÚprotocol©r   r   r>   r“   Úsecurer   r   r   r   q  s
    
zHmacAuthV4Handler.host_headerc                 C   sb   t |j ¡ ƒ}g }|D ]@}tj |j| ¡}| tjj	|ddd tjj	|dd ¡ qd 
|¡S )Nr{   ©Úsafeú=ú-_~ú&)ru   ÚparamsÚkeysr   rR   Úget_utf8_valueÚappendr   ÚparseÚquoterv   )r   r>   Zparameter_namesÚpairsZpnameZpvalr   r   r   Úquery_stringx  s    ÿzHmacAuthV4Handler.query_stringc              	   C   sh   |j dkrdS g }t|jƒD ]@}tj |j| ¡}| dtjj	|ddtjj	|ddf ¡ qd 
|¡S )NÚPOSTr{   ú%s=%sú-_.~r—   r›   )rN   ru   rœ   r   rR   rž   rŸ   r   r    r¡   rv   ©r   r>   rx   Úparamri   r   r   r   Úcanonical_query_string  s    
ÿ
z(HmacAuthV4Handler.canonical_query_stringc                 C   sj   g }|D ]R}|  ¡  ¡ }t|| ƒ}d|kr6| ¡ }nd | ¡  ¡ ¡}| d||f ¡ qd t|ƒ¡S )rk   ú"ú rl   rs   )re   r-   Ústrrv   ÚsplitrŸ   ru   )r   rg   Ú	canonicalÚheaderZc_nameZ	raw_valueZc_valuer   r   r   ry     s    
z#HmacAuthV4Handler.canonical_headersc                 C   s    dd„ |D ƒ}t |ƒ}d |¡S )Nc                 S   s   g | ]}d |  ¡  ¡  ‘qS ©z%srm   rn   r   r   r   rr   ¡  s     z4HmacAuthV4Handler.signed_headers.<locals>.<listcomp>r   rt   rw   r   r   r   Úsigned_headers   s    z HmacAuthV4Handler.signed_headersc                 C   sF   |j }t |¡ dd¡}tj |¡}t|ƒdkrB| d¡rB|d7 }|S )Nú\ú/é   )	rO   Ú	posixpathÚnormpathÚreplacer   r    r¡   ÚlenÚendswith)r   r>   ÚpathÚ
normalizedÚencodedr   r   r   Úcanonical_uri¥  s    zHmacAuthV4Handler.canonical_uric                 C   sN   |j }t|dƒr.t|dƒr.tjj|tdd S t|tƒsB| d¡}t|ƒ 	¡ S )NÚseekÚread)Zhash_algorithmr   r   )
r|   Úhasattrr   rR   Zcompute_hashr
   r†   r‡   r!   rˆ   )r   r>   r|   r   r   r   Úpayload°  s    

zHmacAuthV4Handler.payloadc                 C   st   |j  ¡ g}| |  |¡¡ | |  |¡¡ |  |¡}| |  |¡d ¡ | |  |¡¡ | |  |¡¡ d 	|¡S )Nrs   )
rN   ÚupperrŸ   r½   r©   rg   ry   r±   rÁ   rv   )r   r>   Úcrrg   r   r   r   Úcanonical_request»  s    
z#HmacAuthV4Handler.canonical_requestc                 C   sB   | j jg}| |j¡ | |j¡ | |j¡ | d¡ d |¡S )NÚaws4_requestr³   )r   r   rŸ   Ú	timestampr…   r„   rv   )r   r>   Úscoper   r   r   rÇ   Å  s    

zHmacAuthV4Handler.scopec                 C   s
   |  d¡S )NÚ.)r­   ©r   r   r   r   r   Úsplit_host_partsÍ  s    z"HmacAuthV4Handler.split_host_partsc                 C   sb   |   |¡}| jd k	r| j}nBt|ƒdkrV|d dkr:d}q^t|ƒdkrLd}q^|d }n|d }|S )Nr´   zus-govzus-gov-west-1é   ú	us-east-1r   )rÊ   r…   r¸   )r   r   Úpartsr…   r   r   r   Údetermine_region_nameÐ  s    


z'HmacAuthV4Handler.determine_region_namec                 C   s(   |   |¡}| jd k	r| j}n|d }|S )Nr   )rÊ   r„   )r   r   rÍ   r„   r   r   r   Údetermine_service_nameá  s
    

z(HmacAuthV4Handler.determine_service_namec                 C   st   g }|j d dd… |_| |j¡ |  |j¡}|  |j¡}||_||_| |j¡ | |j¡ | d¡ d |¡S )Nr}   r   é   rÅ   r³   )	rM   rÆ   rŸ   rÎ   r   rÏ   r„   r…   rv   )r   r>   rÇ   r…   r„   r   r   r   Úcredential_scopeé  s    
z"HmacAuthV4Handler.credential_scopec                 C   sH   dg}|  |jd ¡ |  |  |¡¡ |  t| d¡ƒ ¡ ¡ d |¡S )rz   úAWS4-HMAC-SHA256r}   r   rs   )rŸ   rM   rÑ   r
   r!   rˆ   rv   )r   r>   rÄ   Ústsr   r   r   r.   ú  s
    z HmacAuthV4Handler.string_to_signc                 C   sX   | j j}|  d|  d¡|j¡}|  ||j¡}|  ||j¡}|  |d¡}| j||ddS )NZAWS4r   rÅ   T)rŠ   )r   r   rŒ   r!   rÆ   r…   r„   )r   r>   r.   rV   Zk_dateZk_regionZ	k_serviceZ	k_signingr   r   r   Ú	signature  s    ÿzHmacAuthV4Handler.signaturec                 K   sb  d|j kr|j d= tj ¡ }| d¡|j d< | jjrB| jj|j d< |  |¡}|}d|krf|  |d ¡}|rš|jdkrš||_d|j d< t	t
|jƒƒ|j d	< n&|j d
¡d |_|rÀ|jd
 | |_|  |¡}tj d| ¡ |  ||¡}tj d| ¡ |  ||¡}tj d| ¡ |  |¡}	d|  |¡ g}
|
 d|  |	¡ ¡ |
 d| ¡ d |
¡|j d< dS )z›
        Add AWS4 authentication to a request.

        :type req: :class`boto.connection.HTTPRequest`
        :param req: The HTTPRequest object.
        r^   ú%Y%m%dT%H%M%SZr}   r~   Úunmangled_reqr¤   ú0application/x-www-form-urlencoded; charset=UTF-8úContent-TypeúContent-Lengthú?r   zCanonicalRequest:
%srI   rK   zAWS4-HMAC-SHA256 Credential=%szSignedHeaders=%sr€   ú,rL   N)rM   ÚdatetimeÚutcnowÚstrftimer   rP   r£   rN   r|   r¬   r¸   rº   r­   rÄ   r   rS   rT   r.   rÔ   rg   rÇ   rŸ   r±   rv   )r   r   r?   ÚnowÚqsZ
qs_to_postrÄ   r.   rÔ   rg   rx   r   r   r   r@     s8    	





zHmacAuthV4Handler.add_auth)NN)F)r5   r6   r7   r8   rA   r   rŒ   rg   r   r£   r©   ry   r±   r½   rÁ   rÄ   rÇ   rÊ   rÎ   rÏ   rÑ   r.   rÔ   r@   r   r   r   r   r‚   E  s.      ÿ



	
	r‚   c                       sˆ   e Zd ZdZdgZ‡ fdd„Zdd„ Zdd„ Zd	d
„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Z‡ fdd„Z‡ fdd„Zddd„Z‡  ZS )ÚS3HmacAuthV4HandlerzN
    Implements a variant of Version 4 HMAC authorization specific to S3.
    ú
hmac-v4-s3c                    s*   t t| ƒj||Ž | jr&|  | j¡| _d S r   )r;   rá   r   r…   Úclean_region_name)r   Úargsr?   r<   r   r   r   O  s    zS3HmacAuthV4Handler.__init__c                 C   s   |  d¡r|dd … S |S )Nús3-rË   )rf   )r   r…   r   r   r   rã   U  s    
z%S3HmacAuthV4Handler.clean_region_namec                 C   s0   t j |j¡}t j |j¡}t jj|dd}|S )Nz/~r—   )r   r    r   rº   Úunquoter¡   )r   r>   rº   Zunquotedr¼   r   r   r   r½   [  s    z!S3HmacAuthV4Handler.canonical_uric              	   C   sZ   g }t |jƒD ]@}tj |j| ¡}| dtjj|ddtjj|ddf ¡ qd 	|¡S )Nr¥   r¦   r—   r›   )
ru   rœ   r   rR   rž   rŸ   r   r    r¡   rv   r§   r   r   r   r©   e  s    ÿ
z*S3HmacAuthV4Handler.canonical_query_stringc                 C   s<   |j }|jdk}|dkr|r(|dkr.|r.|jS d|j|f S r   )r“   r”   r   r•   r   r   r   r   p  s
    
zS3HmacAuthV4Handler.host_headerc                 C   sF   |   | j|¡}d|i}|j ¡ D ] \}}| ¡ }|dkr |||< q |S )ra   rb   )Úauthorization)r   r   rM   rd   re   r   r   r   r   rg   w  s    
z#S3HmacAuthV4Handler.headers_to_signc                 C   s¢   |   |¡}| jd k	r| j}n‚t|ƒdkrD|  |d ¡}|dkržd}nZtt|ƒƒD ]L\}}| ¡ }|dkr„||  }|dkr~d} qžqP| d¡rP|  |¡} qžqP|S )NrË   r   rD   rÌ   Z	amazonawsrå   )rÊ   r…   r¸   rã   Ú	enumerateÚreversedre   rf   )r   r   rÍ   r…   ÚoffsetÚpartr   r   r   rÎ   ‡  s$    




z)S3HmacAuthV4Handler.determine_region_namec                 C   s   dS )NrD   r   rÉ   r   r   r   rÏ   ´  s    z*S3HmacAuthV4Handler.determine_service_namec           	      C   sœ   t   |¡}tj |j¡}|j|_|jdkr2i |_n|j  ¡ }||_|j}t|dd}| 	¡ D ].\}}t
|ttfƒr\t|ƒdkr\|d ||< q\|j |¡ |S )z|
        Returns a copy of the request object with fixed ``auth_path/params``
        attributes from the original.
        NT)Úkeep_blank_valuesr´   r   )r0   r   r    r   rO   rº   rœ   Úqueryr   rd   r†   ÚlistÚtupler¸   r*   )	r   r   Zmodified_reqZparsed_pathZcopy_paramsZraw_qsZexisting_qsrV   ri   r   r   r   Úmangle_path_and_paramsº  s$    


þz*S3HmacAuthV4Handler.mangle_path_and_paramsc                    s&   |j  d¡r|j d S tt| ƒ |¡S )Núx-amz-content-sha256)rM   rŽ   r;   rá   rÁ   )r   r>   r<   r   r   rÁ   ä  s    
zS3HmacAuthV4Handler.payloadc                    s^   d|j kr8d|j kr(|j  d¡|j d< n|  |¡|j d< |  |¡}tt| ƒj|fd|i|—ŽS )Nrñ   Ú_sha256rÖ   )rM   ÚpoprÁ   rð   r;   rá   r@   )r   r   r?   Zupdated_reqr<   r   r   r@   ê  s    


ÿþzS3HmacAuthV4Handler.add_authNc                 C   s  |dkrt j  ¡  d¡}|  |j¡}|  |j¡}dd| jj|dd… ||f ||ddœ}| jjrl| jj|d< |  	|¡}t
d	d
„ |D ƒƒ}d |¡|d< |j |¡ |  |¡}	d |	 d¡dd… ¡d }	||jd< |  ||	¡}
|  ||
¡}||jd< d|j|j|jtj |j¡f S )zè
        Presign a request using SigV4 query params. Takes in an HTTP request
        and an expiration time in seconds and returns a URL.

        http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html
        NrÕ   rÒ   z%s/%s/%s/%s/aws4_requestrÐ   r   )zX-Amz-AlgorithmzX-Amz-Credentialr}   zX-Amz-ExpiresúX-Amz-SignedHeadersr~   c                 S   s   g | ]}d |  ¡  ¡  ‘qS r°   rm   rn   r   r   r   rr     s     z/S3HmacAuthV4Handler.presign.<locals>.<listcomp>r   rô   rs   éÿÿÿÿz
UNSIGNED-PAYLOADr}   zX-Amz-Signaturez%s://%s%s?%s)rÜ   rÝ   rÞ   rÎ   r   rÏ   r   r   rP   rg   ru   rv   rœ   r*   rÄ   r­   rM   r.   rÔ   r”   rº   r   r    Ú	urlencode)r   r   ÚexpiresZiso_dateÚregionZservicerœ   rg   rx   rÃ   rÓ   rÔ   r   r   r   Úpresignõ  s<    
üö



ÿzS3HmacAuthV4Handler.presign)N)r5   r6   r7   r8   rA   r   rã   r½   r©   r   rg   rÎ   rÏ   rð   rÁ   r@   rù   rB   r   r   r<   r   rá   I  s   
-*rá   c                   @   s.   e Zd ZdZdgZdd„ Zdd„ Zdd„ Zd	S )
ÚSTSAnonHandlerz¥
    Provides pure query construction (no actual signing).

    Used for making anonymous STS request for operations like
    ``assume_role_with_web_identity``.
    zsts-anonc                 C   s   t j |¡S r   )r   r    r¡   )r   ri   r   r   r   Ú_escape_value4  s    zSTSAnonHandler._escape_valuec              	   C   sb   t | ¡ ƒ}|jdd„ d g }|D ]2}tj || ¡}| |d |  | d¡¡ ¡ q$d 	|¡S )Nc                 S   s   |   ¡ S r   ©re   ©Úxr   r   r   Ú<lambda>=  ó    z4STSAnonHandler._build_query_string.<locals>.<lambda>©rV   r™   r   r›   )
rî   r   Úsortr   rR   rž   rŸ   rû   r,   rv   )r   rœ   r   r¢   rV   Úvalr   r   r   Ú_build_query_string;  s     z"STSAnonHandler._build_query_stringc                 K   s4   |j }|  |j¡}tj d| ¡ d|d< ||_d S )Nzquery_string in body: %sz!application/x-www-form-urlencodedrØ   )rM   r  rœ   r   rS   rT   r|   )r   r>   r?   rM   rà   r   r   r   r@   D  s    ÿzSTSAnonHandler.add_authN)r5   r6   r7   r8   rA   rû   r  r@   r   r   r   r   rú   *  s
   	rú   c                   @   s   e Zd ZdZdd„ ZdS )ÚQuerySignatureHelperzy
    Helper for Query signature based Auth handler.

    Concrete sub class need to implement _calc_sigature method.
    c                 K   sÚ   |j }|j}| jj|d< | j|d< tj ¡ |d< |  |j|j	|j
|j¡\}}tj d||f ¡ |j	dkržd|d< |d tj |¡ |_tt|jƒƒ|j d	< n8d
|_|j d¡d |_|jd | d tj |¡ |_d S )NÚAWSAccessKeyIdÚSignatureVersionÚ	Timestampúquery_string: %s Signature: %sr¤   r×   rØ   ú&Signature=rÙ   r{   rÚ   r   )rM   rœ   r   r   r  r   rR   Úget_tsÚ_calc_signaturerN   rO   r   rS   rT   r   r    Ú
quote_plusr|   r¬   r¸   rº   r­   )r   r>   r?   rM   rœ   rà   rÔ   r   r   r   r@   W  s.    
  þ
ÿ
ÿzQuerySignatureHelper.add_authN)r5   r6   r7   r8   r@   r   r   r   r   r  P  s   r  c                   @   s"   e Zd ZdZdZdgZdd„ ZdS )ÚQuerySignatureV0AuthHandlerzProvides Signature V0 Signingr   zsign-v0c           
      G   s    t j d¡ |  ¡ }|d |d  }| | d¡¡ | ¡ }|jdd„ d g }|D ].}t j 	|| ¡}| 
|d tj |¡ ¡ qTd	 |¡}	|	t | ¡ ¡fS )
Nzusing _calc_signature_0ÚActionr  r   c                 S   s   t |  ¡ | ¡ ƒS r   )Úcmpre   )rþ   Úyr   r   r   rÿ   z  r   z=QuerySignatureV0AuthHandler._calc_signature.<locals>.<lambda>)r  r™   r›   )r   rS   rT   r(   r*   r!   r   r  rR   rž   rŸ   r   r    r¡   rv   Úbase64Ú	b64encoder+   )
r   rœ   rä   r   r_   r   r¢   rV   r  rà   r   r   r   r  t  s    
z+QuerySignatureV0AuthHandler._calc_signatureN©r5   r6   r7   r8   r  rA   r  r   r   r   r   r  n  s   r  c                   @   s,   e Zd ZdZdZddgZdd„ Zdd„ Zd	S )
ÚQuerySignatureV1AuthHandlerz5
    Provides Query Signature V1 Authentication.
    r´   zsign-v1Zmturkc                 O   s.   t j| f|ž|Ž tj| f|ž|Ž d | _d S r   )r  r   r   r$   )r   rä   Úkwr   r   r   r   ‹  s    z$QuerySignatureV1AuthHandler.__init__c           	      G   sž   t j d¡ |  ¡ }t| ¡ ƒ}|jdd„ d g }|D ]H}| | d¡¡ t j	 
|| ¡}| |¡ | |d tj |¡ ¡ q8d |¡}|t | ¡ ¡fS )Nzusing _calc_signature_1c                 S   s   |   ¡ S r   rü   rý   r   r   r   rÿ   ”  r   z=QuerySignatureV1AuthHandler._calc_signature.<locals>.<lambda>r  r   r™   r›   )r   rS   rT   r(   rî   r   r  r*   r!   rR   rž   rŸ   r   r    r¡   rv   r  r  r+   )	r   rœ   rä   r   r   r¢   rV   r  rà   r   r   r   r    s    

z+QuerySignatureV1AuthHandler._calc_signatureN)r5   r6   r7   r8   r  rA   r   r  r   r   r   r   r  ƒ  s
   r  c                   @   s8   e Zd ZdZdZdddddddd	d
dddgZdd„ ZdS )ÚQuerySignatureV2AuthHandlerz+Provides Query Signature V2 Authentication.é   zsign-v2Úec2ZemrZfpsZecsZsdbZiamZrdsZsnsZsqsZcloudformationc                 C   s  t j d¡ d|| ¡ |f }|  ¡ }|  ¡ |d< | jjrF| jj|d< t| 	¡ ƒ}g }|D ]>}	t j
 ||	 ¡}
| tjj|	ddd tjj|
dd ¡ qZd	 |¡}t j d
| ¡ ||7 }t j d| ¡ | | d¡¡ t | ¡ ¡}t j dt|ƒ ¡ t j d| ¡ ||fS )Nzusing _calc_signature_2z	%s
%s
%s
ZSignatureMethodZSecurityTokenr{   r—   r™   rš   r›   zquery string: %szstring_to_sign: %sr   zlen(b64)=%dzbase64 encoded digest: %s)r   rS   rT   re   r(   r'   r   rP   ru   r   rR   rž   rŸ   r   r    r¡   rv   r*   r!   r  r  r+   r¸   )r   rœ   Zverbrº   Zserver_namer.   r   r   r¢   rV   r  rà   Zb64r   r   r   r  ¦  s,    ÿ
z+QuerySignatureV2AuthHandler._calc_signatureNr  r   r   r   r   r  Ÿ  s        ÿr  c                   @   s   e Zd ZdZdgZdd„ ZdS )ÚPOSTPathQSV2AuthHandlerz„
    Query Signature V2 Authentication relocating signed query
    into the path and allowing POST requests with Content-Types.
    Zmwsc                 K   sÊ   | j j|jd< | j|jd< tj ¡ |jd< |  |j|j|j	|j
¡\}}tj d||f ¡ |jdkrŽtt|jƒƒ|jd< |j dd¡|jd< nd	|_|j d
¡d |_|jd
 | d tj |¡ |_d S )Nr  r  r  r	  r¤   rÙ   rØ   z
text/plainr{   rÚ   r   r
  )r   r   rœ   r  r   rR   r  r  rN   rO   r   rS   rT   r¬   r¸   r|   rM   rŽ   rº   r­   r   r    r  )r   r   r?   rà   rÔ   r   r   r   r@   Æ  s(     ÿ
ÿÿ
ÿz POSTPathQSV2AuthHandler.add_authN)r5   r6   r7   r8   rA   r@   r   r   r   r   r  ¾  s   r  c           	   	   C   s†   g }t j t|¡}|D ]4}z| || ||ƒ¡ W q t jjk
rH   Y qX q|s~|}dd„ |D ƒ}t j dt	|ƒt
|ƒf ¡‚|d S )aÇ  Finds an AuthHandler that is ready to authenticate.

    Lists through all the registered AuthHandlers to find one that is willing
    to handle for the requested capabilities, config and provider.

    :type host: string
    :param host: The name of the host

    :type config:
    :param config:

    :type provider:
    :param provider:

    Returns:
        An implementation of AuthHandler.

    Raises:
        boto.exception.NoAuthHandlerFound
    c                 S   s   g | ]
}|j ‘qS r   )r5   )ro   Úhandlerr   r   r   rr   ù  s     z$get_auth_handler.<locals>.<listcomp>zYNo handler was ready to authenticate. %d handlers were checked. %s Check your credentialsrõ   )r   ZpluginZ
get_pluginr   rŸ   r   r   Ú	exceptionZNoAuthHandlerFoundr¸   r¬   )	r   r   r   Zrequested_capabilityZready_handlersZauth_handlersr  Zchecked_handlersÚnamesr   r   r   Úget_auth_handlerÚ  s     þÿr  c                    s   ‡ fdd„}|S )Nc                    sj   t j dd¡rdgS tj ddd¡r*dgS t| dƒrbt| jddƒrbtD ]}|| jj	krFdg  S qFˆ | ƒS )	NZEC2_USE_SIGV4Frƒ   r  ú	use-sigv4rø   Úendpointr{   )
ÚosÚenvironrŽ   r   r   rÀ   Úgetattrrø   ÚSIGV4_DETECTr   )r   Útest©Úfuncr   r   Ú_wrapper  s    
z(detect_potential_sigv4.<locals>._wrapperr   ©r'  r(  r   r&  r   Údetect_potential_sigv4  s    r*  c                    s   ‡ fdd„}|S )Nc                    sô   t j dd¡rdgS tj ddd¡r*dgS tˆ dƒs<ˆˆ ƒS tD ]}|ˆ jkr@dg  S q@ˆ j}ˆ j d¡rxˆ j d¡r€d| }t	|ƒj
}| d	¡s¦| d
¡s¦ˆˆ ƒS | d¡r¸ˆˆ ƒS t‡ fdd„tD ƒƒrÖˆˆ ƒS tˆ dƒrîˆ jrîˆˆ ƒS dgS )NZS3_USE_SIGV4Frâ   rD   r  r   zhttp://zhttps://zamazonaws.comzamazonaws.com.cnzs3.amazonaws.comc                 3   s   | ]}|ˆ j kV  qd S r   )r   )ro   r%  r&   r   r   Ú	<genexpr>A  s     z=detect_potential_s3sigv4.<locals>._wrapper.<locals>.<genexpr>r:   )r!  r"  rŽ   r   r   rÀ   r$  r   rf   r   Únetlocr¹   ÚanyÚS3_AUTH_DETECTr:   )r   r%  r   r,  r&  r&   r   r(  "  s4    


ÿ

ÿ
z*detect_potential_s3sigv4.<locals>._wrapperr   r)  r   r&  r   Údetect_potential_s3sigv4!  s    )r/  )N).r8   r  r   Zboto.auth_handlerZboto.exceptionZboto.pluginZ
boto.utilsr0   rÜ   Úemail.utilsr   r   r!  rµ   Zboto.compatr   r   r   r   r   r   Úhashlibr	   r"   r
   ÚImportErrorr.  r$  Úobjectr   r9   rC   r[   r\   r`   r‚   rá   rú   r  r  r  r  r  r  r*  r/  r   r   r   r   Ú<module>   s˜   
ìò1#K   b&
2