/
lib
/
python2.7
/
site-packages
/
requestbuilder
/
auth
/
Upload File
HOME
� �p/Xc @@ s� d d l m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l j j Z d d l m Z d d l m Z d d l m Z d Z d Z d e f d � � YZ d e f d � � YZ d e f d � � YZ d e f d � � YZ d e f d � � YZ d e f d � � YZ d � Z! d � Z" d S( i ( t absolute_importN( t Arg( t BaseAuth( t AuthErrors %Y-%m-%dT%H:%M:%SZs %Y%m%dT%H%M%SZt HmacKeyAuthc B@ s� e Z d Z e d d d d d d �e d d d d d d �e d d d d d �g Z e d � � Z d � Z d � Z d � Z d � Z RS( s1 Basis for AWS HMAC-based authentication s -Is --access-key-idt destt key_idt metavart KEY_IDs -Ss --secret-keyt secret_keyt KEYs --security-tokent security_tokent TOKENc K@ s� | j d | j j � | j d | j j d � � | j d | j j d � � | j d | j j d � � | j d | j j d � � | | j | � } | j � | S( Nt loglevelR R R t credential_expiration( t setdefaultt logt levelt argst gett configt configure( t clst othert kwargst new( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt from_other1 s c C@ s� | j � | j j d � s+ t d � � n | j j d � sL t d � � n | j j d � r� d } xf d D]> } y! t j j | j d | � } PWqk t k r� qk qk Xqk W| j j d j | j d � � | r� | t j j � k r� t d � � q� n d S( NR s0 missing access key ID; please supply one with -IR s- missing secret key; please supply one with -SR s %Y-%m-%dT%H:%M:%S.%fZs %Y-%m-%dT%H:%M:%SZsO failed to parse credential expiration time '{0}'; proceeding without validations credentials have expired( s %Y-%m-%dT%H:%M:%S.%fZs %Y-%m-%dT%H:%M:%SZ( t _HmacKeyAuth__populate_auth_argsR R R t Nonet datetimet strptimet ValueErrorR t warnt formatt utcnow( t selft expirationt fmt( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR = s& c C@ s# d t j k r t j d � } t j j | � } t j j | � } t | � �� } x� | D]� } | j d d � d } d | k rX | j d d � \ } } | j � d k r� | j j d � r� | j � | j d <q| j � d k r| j j d � r| j � | j d <qqX qX WWd QX| Sd S( Nt AWS_CREDENTIAL_FILEt #i i t =t AWSAccessKeyIdR t AWSSecretKeyR ( t ost environt getenvt patht expandvarst expandusert opent splitt stripR R ( R# R. t credfilet linet keyt val( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt" configure_from_aws_credential_fileU s #c C@ s� | j j d � r4 | j j d � r4 t d � � n | j j d � rh | j j d � rh t d � � n | j � r� | j j d � d St j d � p� t j d � | j d <t j d � p� t j d � | j d <t j d � | j d <t j d � | j d <| j � r | j j d � d S| j � } | rS| j � rS| j j d | � d S| j j d � | j d <| j j d d t �| j d <| j � r�| j j d � d Sd S( s Try to get auth info from each source in turn until one provides both a key ID and a secret key. After each time a source fails to provide enough info we wipe self.args out so we don't wind up mixing info from multiple sources. R R s- missing secret key; please supply one with -Ss0 missing access key ID; please supply one with -Is! using auth info provided directlyNt AWS_ACCESS_KEY_IDt AWS_ACCESS_KEYt AWS_SECRET_ACCESS_KEYt AWS_SECRET_KEYt AWS_SECURITY_TOKENR t AWS_CREDENTIAL_EXPIRATIONR s using auth info from environments+ using auth info from AWS credential file %ss key-ids secret-keyt redacts" using auth info from configuration( R R R t _HmacKeyAuth__reset_unless_readyR t debugR+ R- R8 R t get_user_optiont True( R# t aws_credfile_path( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt __populate_auth_argsi s6 %% c C@ sJ | j j d � r( | j j d � r( t Sx d D] } d | j | <q/ Wt S( s� If both an access key ID and a secret key are set in self.args return True. Otherwise, clear auth info from self.args and return False. R R R R ( s key_ids secret_keys security_tokens credential_expirationN( R R RC R t False( R# t arg( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt __reset_unless_ready� s $ ( t __name__t __module__t __doc__R t ARGSt classmethodR R R8 R R@ ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR ) s -t HmacV1Authc B@ sb e Z d Z e d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z RS( sk S3 REST authentication http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html t aclt lifecyclet locationt loggingt notificationt partNumbert policyt requestPaymentt torrentt uploadIdt uploadst versionIdt versioningt versionst websitec C@ s� | j | � | j | � } | j | | � } | j | | | � } | j j d t | � � | j | j d � � } | j j d | � | j | | � | S( Ns string to sign: %ss utf-8s b64-encoded signature: %s( t _update_request_before_signingt get_canonicalized_headerst get_canonicalized_resourcet _get_string_to_signR RA t reprt sign_stringt encodet _apply_signature( R# t reqt servicet c_headerst c_resourcet to_signt signature( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt apply_to_request� s c C@ s� d } | j j | � t j | t � x! d D] } | j j | d � q- Wt j | j � � } | t j j � } | j | j | j d d d d } | j j d | | � | j | � } | j j d t | � � | j | | � } | j j d t | � � d j | j | j j d d � | j j d d � t j | � | | f � } | j j d t | � � | j | j d � � } | j j d | � | j d | j d <t j | � | j d <| | j d <| j j d � r�| j d | j d <n d S( Nse S3RestAuth.apply_to_request_params is deprecated; use requestbuilder.auth.aws.QueryHmacV1Auth insteadR) t Expirest Signaturei i i i s$ expiration: %i (%f seconds from now)s canonicalized headers: %ss canonicalized resource: %ss s Content-MD5t s Content-Types string to sign: %ss utf-8s b64-encoded signature: %sR R t SecurityToken( s AWSAccessKeyIdRm Rn i@B i@B ( R R t warningst DeprecationWarningt paramst popR t calendart timegmt utctimetupleR R" t microsecondst secondst daysRA R_ Rb R` t joint methodt headersR t sixt text_typeRc Rd R ( R# Rf Rg t expiration_datetimet msgt paramR$ t delta_tt delta_t_secRh Ri Rj Rk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt apply_to_request_params� s: c C@ s� | j s i | _ n t j j � | j d <t j | j � j | j d <| j j d � rp | j d | j d <n | j j d d � d S( Nt Datet HostR s x-amz-security-tokenRn ( R} t emailt utilst formatdatet urlparset urlt netlocR R Rt R ( R# Rf ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR^ � s c C@ sS d j | j j � | j j d d � | j j d d � | j j d � | | f � S( Ns s Content-MD5Ro s Content-TypeR� ( R{ R| t upperR} R ( R# Rf Rh Ri ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRa � s c C@ s$ d j | j d | � | j d <d S( Ns AWS {0}:{1}R t Authorization( R! R R} ( R# Rf Rk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRe � s c C@ sD t j | j � j } t j | j � j } | t | � } | j d � rV d | } n | se d } n t | d d � r� | j } n t | j � } | r'g } x� t | j � � D]o \ } } | | j k r | d k r� | j | � q | j | d | � n | r� | d d j | � 7} q� q� Wn | j j d t | � � | S( Nt /Rs R( t ?t &s canonicalized resource: %s( R� R� R. t endpointt lent endswitht getattrR Rs t _get_params_from_urlt sortedt iteritemst HASHED_PARAMSt appendR{ R RA Rb ( R# Rf Rg t parsed_req_patht parsed_svc_patht resourceRs t subresourcesR6 R7 ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR` � s* !c C@ s i } xq | j j � D]` \ } } | j � j d � r | j | j � g � | | j � j d j | j � � � q q Wg } xB t | j � � D]. \ } } | j d j | d j | � � � q� W| r� d j | � d } n d } | j j d t | � � | S( Ns x-amz-t s {0}:{1}t ,s Ro s canonicalized headers: %s( R} R� t lowert startswithR R� R{ R2 R� R! R RA Rb ( R# Rf t headers_dictR6 R7 t headers_strst valsRh ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR_ s - &c C@ s? t j | j d d t j �} | j | � t j | j � � S( NR t digestmod( t hmacR R t hashlibt sha1t updatet base64t b64encodet digest( R# Rj t req_hmac( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRc & s ( RO RP RQ RR RS RT RU RV RW RX RY RZ R[ R\ R] ( RI RJ RK t setR� Rl R� R^ Ra Re R` R_ Rc ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRN � s $ # t QueryHmacV1Authc B@ s) e Z d Z d � Z d � Z d � Z RS( iX c C@ s� t | j j d � � p | j } t | j � } | j d | d <t t j � | � | d <| j d d � | j t | j � | � d S( Nt timeoutR R) Rm Rn ( t intR R t DEFAULT_TIMEOUTR� R� t timeRt R t prepare_urlt _remove_params_from_url( R# Rf R� Rs ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR^ / s !c C@ sZ t | j � } d j | j j � | j j d d � | j j d d � | d | | f � S( Ns s Content-MD5Ro s Content-TypeRm ( R� R� R{ R| R� R} R ( R# Rf Rh Ri Rs ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRa 8 s c C@ s | j | j i | d 6� d S( NRn ( R� R� ( R# Rf Rk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRe @ s ( RI RJ R� R^ Ra Re ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� , s t QueryHmacV2Authc B@ s e Z d Z d � Z d � Z RS( sk AWS signature version 2 http://docs.aws.amazon.com/general/latest/gr/signature-version-2.html c C@ s5 t j | j � } | j d k rB t j | j p3 d d t �} n t j | j d t �} t d � | j � D� � } | j d | d <d | d <d | d <t j t t j � � | d <| j j d � r� | j d | d <n | j d d � d j d | j d | j j � d | j pd � } g } xZ t | � D]L } t j | | � } | j t j | d d �d t j | d d �� q3Wd j | � } | | 7} t j d d | � } | j j d t | � � | j | � } | j j d | � | | d <| j d k r| j! | i � n | j" t# | j � | � | S( Nt POSTRo t keep_blank_valuesc s@ s% | ] \ } } | | d f Vq d S( i N( ( t .0R6 R� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pys <genexpr>Q s R R) i t SignatureVersiont HmacSHA256t SignatureMethodt TimestampR Rp Rn s {method} {host} {path} R| t hostR. R� t safeR( s -_~R� s assword=[^&]*s assword=<redacted>s string to sign: %ss b64-encoded signature: %s($ R� R� R| t parse_qst bodyRC t queryt dictR� R R� t strftimet ISO8601t gmtimeR Rt R R! R� R� R. R� R~ R R� t quoteR{ t ret subR RA Rb Rc t prepare_bodyR� R� ( R# Rf Rg t parsedRs Rj t quoted_paramsR6 R7 t query_stringt redacted_to_signRk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRl J s@ ! c C@ s? t j | j d d t j �} | j | � t j | j � � S( NR R� ( R� R R R� t sha256R� R� R� R� ( R# Rj R� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRc r s ( RI RJ RK Rl Rc ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� D s (t HmacV4Authc B@ sh e Z d Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z RS( sk AWS signature version 4 http://docs.aws.amazon.com/general/latest/gr/signature-version-4.html c C@ sE | j s@ | j j d | j j � t d j | j j � � � n | j | � } t j � } t j t t j | � � } | j | | � } d j | j d f | � } | j | | | | � | j | � } | j | � } | j | � } | j | � } d j | j j � | | | d | | f � } | j j d t | � � d j d | d j | � t j | � j � f � } t j d d | � } | j j d t | � � t j d j | j d � d t j �} x9 | D]1 } | j | � t j | j � d t j �} q�W| j | � | j � } | j j d | � | j! | | | � | S( Ns8 service class %s must have a NAME attribute to use sigv4s+ BUG: service class {0} does not have a nameR� R s Ro s canonical request: %ss AWS4-HMAC-SHA256s assword=[^&]*s assword=<redacted>s string to sign: %ss AWS4{0}R R� s signature: %s(" t NAMER t criticalt __class__RI R R! t _hash_payloadR� R� t ISO8601_BASICR� t _build_scopeR{ R R^ t _get_canonical_urit _get_canonical_queryt _get_canonical_headerst _get_signed_headersR| R� RA Rb R� R� t hexdigestR� R� R� R R� R� Re ( R# Rf Rg t payload_hasht nowt date_headert scopet credentialt c_urit c_queryRh t s_headerst c_requestRj R� t derived_hmact chunkRk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRl ~ sF c C@ s| t j | j � } | j | j d <| j j d d � | | j d <| | j d <| j j d � rx | j d | j d <n d S( NR� R� s X-Amz-Content-SHA256s X-Amz-DateR s X-Amz-Security-Token( R� R� R� R} Rt R R R ( R# Rf R� t payload_sha256R� R� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR^ � s c C@ sM d j d j | � d j | j | � � d j | � f � } | | j d <d S( Ns , s AWS4-HMAC-SHA256 Credential={0}s SignedHeaders={0}s Signature={0}R� ( R{ R! R� R} ( R# Rf R� Rk t auth_header( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRe � s c C@ s� | j r | j } n= t j d � r6 t j d � } n | j j d � t d � � t j d t j | � � | | j d f } | j j d d j | � � | S( Nt AWS_AUTH_REGIONs& a region name is required to use sigv4sw region name is required; either use a config file to supply the service's URL or set AWS_AUTH_REGION in the environments %Y%m%dt aws4_requests scope: %sR� ( t region_nameR+ R- R t errorR R� R� R� R� RA R{ ( R# Rg t timestampt regionR� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� � s c C@ sG t j | j � j p d } t j | d d �} | j j d | � | S( NR� R� s /~s canonical URI: %s( R� t urlsplitR� R. R� R RA ( R# Rf R. R� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� � s c C@ s� t j t j | j � j d t �} g } xZ t | p9 g � D]F \ } } | j d j t j | d d �t j | d d �f � � q= Wd j | � } | j j d | � | S( NR� R( R� s ~-_.R� s canonical query: %s( R� t parse_qslR� R� RC R� R� R{ R� R RA ( R# Rf t req_paramsRs R6 R7 t c_params( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� � s c C@ s[ i } xN | j j � D]= \ } } | j � d k r | j � | | j � j � <q q W| S( Nt connections user-agent( R� s user-agent( R} R� R� R3 ( R# Rf R} R6 R7 ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt _get_normalized_headers� s #c C@ sz g } | j | � } x< t | j � � D]( \ } } | j d j | | f � � q( W| j j d t | � � d j | � S( Nt :s canonical headers: %ss ( R� R� t itemsR� R{ R RA t str( R# Rf R} t normalized_headersR6 R7 ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� � s c C@ s; | j | � } d j t | � � } | j j d | � | S( Nt ;s signed headers: %s( R� R{ R� R RA ( R# Rf R� R� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� � s c C@ s� | j j d � r | j d St j � } | j s5 nJt | j d � r� | j j � } | j j d � x3 t r� | j j d � } | s� Pn | j | � qi W| j j | � | j j d � n� t | j d � ro| j j d � t j d d � } x@ t r5| j j d � } | sPn | j | � | j | � q� W| j j d � | j d � | j j d � | | _ n | j | j � | j j d | j � � | j � S( NR� t seeks payload hashing startingi @ s payload hashing donet reads! payload spooling/hashing startingt max_sizei i s payload spooling/hashing donei s+ re-pointing request body at spooled payloads payload hash: %si ( i � ( R R R� R� R� t hasattrt datat tellR RA RC R� R� R� t tempfilet SpooledTemporaryFilet writet infoR� ( R# Rf R� t body_positionR� t spool( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� � s> ( RI RJ RK Rl R^ Re R� R� R� R� R� R� R� ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� x s ) t QueryHmacV4Authc B@ s e Z d � Z d � Z RS( c C@ s | j j � d k rC d | j j d d � k rC | j j d � n t j | j � } | j | j d <| j j d d � i d d 6| d 6| d 6| j | � d 6} | j j d � r� | j d | d <n | j j d � r� | j d | d <n | j | j | � d S( NR� s form-urlencodeds Content-TypeRo sk Query string authentication and POST form data are generally mutually exclusive; GET is recommended insteadR� R� s AWS4-HMAC-SHA256s X-Amz-Algorithms X-Amz-Credentials X-Amz-Dates X-Amz-SignedHeadersR� s X-Amz-ExpiresR s X-Amz-Security-Token( R| R� R} R R R R� R� R� Rt R R� R R� ( R# Rf R� R� R� R� Rs ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR^ s c C@ s | j | j i | d 6� d S( Ns X-Amz-Signature( R� R� ( R# Rf R� Rk ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyRe / s ( RI RJ R^ Re ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR s c C@ sA t j | � } t j | j d t �} t d � | j � D� � S( s� Given a URL, return a dict of parameters and their values. If a parameter appears more than once all but the first value will be lost. R� c s@ s% | ] \ } } | | d f Vq d S( i N( ( R� R6 R� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pys <genexpr>: s ( R� R� R� RC R� R� ( R� R� Rs ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� 3 s c C@ s: t j | � } t j | d | d | d d d d f � S( s^ Return a copy of a URL with its parameters, fragments, and query string removed. i i i Ro ( R� t urlunparse( R� R� ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyR� = s (# t __future__R R� Ru R t email.utilsR� R� R� R+ R� R R� Rq R~ t six.moves.urllib_parset movest urllib_parseR� t requestbuilderR t requestbuilder.authR t requestbuilder.exceptionsR R� R� R RN R� R� R� R R� R� ( ( ( s; /usr/lib/python2.7/site-packages/requestbuilder/auth/aws.pyt <module> s4 {�4�