p/Xc @@ s d d l m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l
Z
d d l Z d d l j j Z d d l m Z d d l m Z d d l m Z d Z d Z d e f d YZ d
e f d YZ d e f d
YZ d e f d YZ d e f d YZ d e f d YZ d Z! d Z" d S( i ( t absolute_importN( t Arg( t BaseAuth( t AuthErrors %Y-%m-%dT%H:%M:%SZs %Y%m%dT%H%M%SZt HmacKeyAuthc B@ s e Z d Z e d d d d d d e d d d d d d
e d d d d d
g Z e d Z d Z d Z d Z d Z
RS( s1
Basis for AWS HMAC-based authentication
s -Is --access-key-idt destt key_idt metavart KEY_IDs -Ss --secret-keyt
secret_keyt KEYs --security-tokent security_tokent TOKENc K@ s | j d | j j | j d | j j d | j d | j j d | j d | j j d | j d | j j d | | j | } | j | S( Nt loglevelR R R t credential_expiration( t
setdefaultt logt levelt argst gett configt configure( t clst othert kwargst new( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt
from_other1 s
c C@ s | j | j j d s+ t d n | j j d sL t d n | j j d r d } xf d
D]> } y! t j j | j d | } PWqk t k
r qk qk Xqk W| j j d j
| j d | r | t j j k r t d q n d S( NR s0 missing access key ID; please supply one with -IR s- missing secret key; please supply one with -SR s %Y-%m-%dT%H:%M:%S.%fZs %Y-%m-%dT%H:%M:%SZsO failed to parse credential expiration time '{0}'; proceeding without validations credentials have expired( s %Y-%m-%dT%H:%M:%S.%fZs %Y-%m-%dT%H:%M:%SZ( t _HmacKeyAuth__populate_auth_argsR R R t Nonet datetimet strptimet
ValueErrorR t warnt formatt utcnow( t selft
expirationt fmt( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR = s&
c
C@ s# d t j k r t j d } t j j | } t j j | } t | } x | D] } | j d d d } d | k rX | j d d \ } } | j d k r | j j
d r | j | j d <q| j d k r| j j
d r| j | j d <qqX qX WWd QX| Sd S(
Nt AWS_CREDENTIAL_FILEt #i i t =t AWSAccessKeyIdR t AWSSecretKeyR ( t ost environt getenvt patht
expandvarst
expandusert opent splitt stripR R ( R# R. t credfilet linet keyt val( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt" configure_from_aws_credential_fileU s
#c C@ s | j j d r4 | j j d r4 t d n | j j d rh | j j d rh t d n | j r | j j d d St j d p t j d | j d <t j d p t j d
| j d <t j d | j d <t j d
| j d <| j r | j j d d S| j } | rS| j rS| j j d | d S| j j
d | j d <| j j
d d t | j d <| j r| j j d d Sd S( s
Try to get auth info from each source in turn until one provides
both a key ID and a secret key. After each time a source fails
to provide enough info we wipe self.args out so we don't wind up
mixing info from multiple sources.
R R s- missing secret key; please supply one with -Ss0 missing access key ID; please supply one with -Is! using auth info provided directlyNt AWS_ACCESS_KEY_IDt AWS_ACCESS_KEYt AWS_SECRET_ACCESS_KEYt AWS_SECRET_KEYt AWS_SECURITY_TOKENR t AWS_CREDENTIAL_EXPIRATIONR s using auth info from environments+ using auth info from AWS credential file %ss key-ids
secret-keyt redacts" using auth info from configuration( R R R t _HmacKeyAuth__reset_unless_readyR t debugR+ R- R8 R t get_user_optiont True( R# t aws_credfile_path( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt __populate_auth_argsi s6 %% c C@ sJ | j j d r( | j j d r( t Sx d D] } d | j | <q/ Wt S( s
If both an access key ID and a secret key are set in self.args
return True. Otherwise, clear auth info from self.args and
return False.
R R R R ( s key_ids
secret_keys security_tokens credential_expirationN( R R RC R t False( R# t arg( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt __reset_unless_ready s $
( t __name__t
__module__t __doc__R t ARGSt classmethodR R R8 R R@ ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR ) s -t
HmacV1Authc B@ sb e Z d Z e d Z d Z d Z d Z d Z d Z d Z
d Z d Z RS( sk
S3 REST authentication
http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html
t aclt lifecyclet locationt loggingt notificationt
partNumbert policyt requestPaymentt torrentt uploadIdt uploadst versionIdt
versioningt versionst websitec C@ s | j | | j | } | j | | } | j | | | } | j j d t | | j | j d } | j j d | | j | | | S( Ns string to sign: %ss utf-8s b64-encoded signature: %s(
t _update_request_before_signingt get_canonicalized_headerst get_canonicalized_resourcet _get_string_to_signR RA t reprt sign_stringt encodet _apply_signature( R# t reqt servicet c_headerst
c_resourcet to_signt signature( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt apply_to_request s
c
C@ s d } | j j | t j | t x! d D] } | j j | d q- Wt j | j } | t
j
j } | j | j
| j d d d d } | j j d | | | j | } | j j d
t | | j | | }
| j j d t |
d j | j | j j d
d | j j d d t j | | |
f } | j j d t | | j | j d } | j j d | | j d | j d <t j | | j d <| | j d <| j j d r| j d | j d <n d S( Nse S3RestAuth.apply_to_request_params is deprecated; use requestbuilder.auth.aws.QueryHmacV1Auth insteadR) t Expirest Signaturei i i
i s$ expiration: %i (%f seconds from now)s canonicalized headers: %ss canonicalized resource: %ss
s Content-MD5t s Content-Types string to sign: %ss utf-8s b64-encoded signature: %sR R t
SecurityToken( s AWSAccessKeyIdRm Rn i@B i@B ( R R t warningst DeprecationWarningt paramst popR t calendart timegmt utctimetupleR R" t microsecondst secondst daysRA R_ Rb R` t joint methodt headersR t sixt text_typeRc Rd R (
R# Rf Rg t expiration_datetimet msgt paramR$ t delta_tt delta_t_secRh Ri Rj Rk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt apply_to_request_params s:
c C@ s | j s i | _ n t j j | j d <t j | j j | j d <| j j d rp | j d | j d <n | j j d d d S( Nt Datet HostR s x-amz-security-tokenRn ( R} t emailt utilst
formatdatet urlparset urlt netlocR R Rt R ( R# Rf ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR^ s c C@ sS d j | j j | j j d d | j j d d | j j d | | f S( Ns
s Content-MD5Ro s Content-TypeR ( R{ R| t upperR} R ( R# Rf Rh Ri ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRa s
c C@ s$ d j | j d | | j d <d S( Ns AWS {0}:{1}R t
Authorization( R! R R} ( R# Rf Rk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRe s c
C@ sD t j | j j } t j | j j } | t | } | j d rV d | } n | se d } n t | d d r | j } n t | j } | r'g } x t
| j D]o \ } } | | j k r | d k r | j
| q | j
| d | n | r | d d j | 7} q q Wn | j j d t | | S( Nt /Rs R( t ?t &s canonicalized resource: %s( R R R. t endpointt lent endswitht getattrR Rs t _get_params_from_urlt sortedt iteritemst
HASHED_PARAMSt appendR{ R RA Rb (
R# Rf Rg t parsed_req_patht parsed_svc_patht resourceRs t subresourcesR6 R7 ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR` s*
!c C@ s i } xq | j j D]` \ } } | j j d r | j | j g | | j j d j | j q q Wg } xB t | j D]. \ } } | j d j | d j | q W| r d j | d } n d } | j
j d t | | S( Ns x-amz-t s {0}:{1}t ,s
Ro s canonicalized headers: %s(
R} R t lowert
startswithR R R{ R2 R R! R RA Rb ( R# Rf t headers_dictR6 R7 t headers_strst valsRh ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR_ s - &c C@ s? t j | j d d t j } | j | t j | j S( NR t digestmod( t hmacR R t hashlibt sha1t updatet base64t b64encodet digest( R# Rj t req_hmac( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRc & s
( RO RP RQ RR RS RT RU RV RW RX RY RZ R[ R\ R] (
RI RJ RK t setR Rl R R^ Ra Re R` R_ Rc ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRN s $ # t QueryHmacV1Authc B@ s) e Z d Z d Z d Z d Z RS( iX c C@ s t | j j d p | j } t | j } | j d | d <t t j | | d <| j d d | j t
| j | d S( Nt timeoutR R) Rm Rn ( t intR R t DEFAULT_TIMEOUTR R t timeRt R t prepare_urlt _remove_params_from_url( R# Rf R Rs ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR^ / s !c C@ sZ t | j } d j | j j | j j d d | j j d d | d | | f S( Ns
s Content-MD5Ro s Content-TypeRm ( R R R{ R| R R} R ( R# Rf Rh Ri Rs ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRa 8 s c C@ s | j | j i | d 6 d S( NRn ( R R ( R# Rf Rk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRe @ s ( RI RJ R R^ Ra Re ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR , s t QueryHmacV2Authc B@ s e Z d Z d Z d Z RS( sk
AWS signature version 2
http://docs.aws.amazon.com/general/latest/gr/signature-version-2.html
c C@ s5 t j | j } | j d k rB t j | j p3 d d t } n t j | j d t } t d | j D } | j d | d <d | d <d | d
<t
j t t
j
| d <| j j d r | j d | d
<n | j d d d j d | j d | j j d | j pd } g } xZ t | D]L } t j | | } | j t j | d d d t j | d d q3Wd j | } | | 7} t j d d | }
| j j d t |
| j | } | j j d | | | d <| j d k r| j! | i n | j" t# | j | | S( Nt POSTRo t keep_blank_valuesc s@ s% | ] \ } } | | d f Vq d S( i N( ( t .0R6 R ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pys <genexpr>Q s R R) i t SignatureVersiont
HmacSHA256t SignatureMethodt TimestampR Rp Rn s {method}
{host}
{path}
R| t hostR. R t safeR( s -_~R s
assword=[^&]*s assword=<redacted>s string to sign: %ss b64-encoded signature: %s($ R R R| t parse_qst bodyRC t queryt dictR R R t strftimet ISO8601t gmtimeR Rt R R! R R R. R R~ R R t quoteR{ t ret subR RA Rb Rc t prepare_bodyR R ( R# Rf Rg t parsedRs Rj t
quoted_paramsR6 R7 t query_stringt redacted_to_signRk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRl J s@ !
c C@ s? t j | j d d t j } | j | t j | j S( NR R ( R R R R t sha256R R R R ( R# Rj R ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRc r s
( RI RJ RK Rl Rc ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR D s (t
HmacV4Authc B@ sh e Z d Z d Z d Z d Z d Z d Z d Z d Z d Z
d Z d
Z RS( sk
AWS signature version 4
http://docs.aws.amazon.com/general/latest/gr/signature-version-4.html
c C@ sE | j s@ | j j d | j j t d j | j j n | j | } t j } t j t
t j | } | j | | } d j
| j d f | } | j | | | | | j | } | j | } | j | }
| j | } d j
| j j | | |
d | | f } | j j d t | d j
d | d j
| t j | j f }
t j d d
|
} | j j d t | t j d j | j d
d t j } x9 | D]1 } | j | t j | j d t j } qW| j |
| j } | j j d | | j! | | | | S( Ns8 service class %s must have a NAME attribute to use sigv4s+ BUG: service class {0} does not have a nameR R s
Ro s canonical request: %ss AWS4-HMAC-SHA256s
assword=[^&]*s assword=<redacted>s string to sign: %ss AWS4{0}R R s
signature: %s(" t NAMER t criticalt __class__RI R R! t
_hash_payloadR R t
ISO8601_BASICR t _build_scopeR{ R R^ t _get_canonical_urit _get_canonical_queryt _get_canonical_headerst _get_signed_headersR| R RA Rb R R t hexdigestR R R R R R Re ( R# Rf Rg t payload_hasht nowt date_headert scopet
credentialt c_urit c_queryRh t s_headerst c_requestRj R t derived_hmact chunkRk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRl ~ sF
c C@ s| t j | j } | j | j d <| j j d d | | j d <| | j d <| j j d rx | j d | j d <n d S( NR R s X-Amz-Content-SHA256s
X-Amz-DateR s X-Amz-Security-Token( R R R R} Rt R R R ( R# Rf R t payload_sha256R R ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR^ s
c C@ sM d j d j | d j | j | d j | f } | | j d <d S( Ns , s AWS4-HMAC-SHA256 Credential={0}s SignedHeaders={0}s
Signature={0}R ( R{ R! R R} ( R# Rf R Rk t auth_header( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRe s
c C@ s | j r | j } n= t j d r6 t j d } n | j j d t d t j d t j | | | j d f } | j j
d d j | | S( Nt AWS_AUTH_REGIONs& a region name is required to use sigv4sw region name is required; either use a config file to supply the service's URL or set AWS_AUTH_REGION in the environments %Y%m%dt aws4_requests scope: %sR ( t region_nameR+ R- R t errorR R R R R RA R{ ( R# Rg t timestampt regionR ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR s c C@ sG t j | j j p d } t j | d d } | j j d | | S( NR R s /~s canonical URI: %s( R t urlsplitR R. R R RA ( R# Rf R. R ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR s c C@ s t j t j | j j d t } g } xZ t | p9 g D]F \ } } | j d j t j | d d t j | d d f q= Wd j | } | j j
d | | S( NR R( R s ~-_.R s canonical query: %s( R t parse_qslR R RC R R R{ R R RA ( R# Rf t
req_paramsRs R6 R7 t c_params( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR s c C@ s[ i } xN | j j D]= \ } } | j d k r | j | | j j <q q W| S( Nt
connections
user-agent( R s
user-agent( R} R R R3 ( R# Rf R} R6 R7 ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt _get_normalized_headers s
#c C@ sz g } | j | } x< t | j D]( \ } } | j d j | | f q( W| j j d t | d j | S( Nt :s canonical headers: %ss
( R R t itemsR R{ R RA t str( R# Rf R} t normalized_headersR6 R7 ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR s c C@ s; | j | } d j t | } | j j d | | S( Nt ;s signed headers: %s( R R{ R R RA ( R# Rf R R ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR s c C@ s | j j d r | j d St j } | j s5 nJt | j d r | j j } | j j d x3 t
r | j j d } | s Pn | j | qi W| j j
| | j j d n t | j d ro| j j d t j d d } x@ t
r5| j j d } | sPn | j | | j | q W| j j d | j
d | j j d
| | _ n | j | j | j j d | j | j S( NR t seeks payload hashing startingi @ s payload hashing donet reads! payload spooling/hashing startingt max_sizei
i s payload spooling/hashing donei s+ re-pointing request body at spooled payloads payload hash: %si ( i ( R R R R R t hasattrt datat tellR RA RC R R R t tempfilet SpooledTemporaryFilet writet infoR ( R# Rf R t
body_positionR t spool( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR s>
(
RI RJ RK Rl R^ Re R R R R R R R ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR x s )
t QueryHmacV4Authc B@ s e Z d Z d Z RS( c C@ s | j j d k rC d | j j d d k rC | j j d n t j | j } | j | j d <| j j d d i d d 6| d
6| d 6| j | d 6} | j j d
r | j d
| d <n | j j d r | j d | d <n | j
| j | d S( NR s form-urlencodeds Content-TypeRo sk Query string authentication and POST form data are generally mutually exclusive; GET is recommended insteadR R s AWS4-HMAC-SHA256s X-Amz-Algorithms X-Amz-Credentials
X-Amz-Dates X-Amz-SignedHeadersR s
X-Amz-ExpiresR s X-Amz-Security-Token( R| R R} R R R R R R Rt R R R R ( R# Rf R R R R Rs ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR^ s c C@ s | j | j i | d 6 d S( Ns X-Amz-Signature( R R ( R# Rf R Rk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRe / s ( RI RJ R^ Re ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR s c C@ sA t j | } t j | j d t } t d | j D S( s
Given a URL, return a dict of parameters and their values. If a
parameter appears more than once all but the first value will be lost.
R c s@ s% | ] \ } } | | d f Vq d S( i N( ( R R6 R ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pys <genexpr>: s ( R R R RC R R ( R R Rs ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR 3 s c C@ s: t j | } t j | d | d | d d d d f S( s^
Return a copy of a URL with its parameters, fragments, and query
string removed.
i i i Ro ( R t
urlunparse( R R ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR = s (# t
__future__R R Ru R t email.utilsR R R R+ R R R Rq R~ t six.moves.urllib_parset movest urllib_parseR t requestbuilderR t requestbuilder.authR t requestbuilder.exceptionsR R R R RN R R R R R R ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt <module> s4 {4