PewddlZddlZddlZddlZddlZddlZddlmZmZddl m Z ddl m Z m Z mZddlmZmZddlmZGddZGd d Zd Zdd ZGd dZdZ ddZdZ ddZdZy)N)create_request_objectprepare_request_dict) OrderedDict)UnknownClientMethodErrorUnknownSignatureVersionError UnsupportedSignatureVersionError) ArnParserdatetime2timestamp) fix_s3_hostceZdZdZ d dZedZedZedZddZ ddZ d Z d Z d d Z e Z dd Zy) RequestSignera0 An object to sign requests before they go out over the wire using one of the authentication mechanisms defined in ``auth.py``. This class fires two events scoped to a service and operation name: * choose-signer: Allows overriding the auth signer name. * before-sign: Allows mutating the request before signing. Together these events allow for customization of the request signing pipeline, including overrides, request path manipulation, and disabling signing per operation. :type service_id: botocore.model.ServiceId :param service_id: The service id for the service, e.g. ``S3`` :type region_name: string :param region_name: Name of the service region, e.g. ``us-east-1`` :type signing_name: string :param signing_name: Service signing name. This is usually the same as the service name, but can differ. E.g. ``emr`` vs. ``elasticmapreduce``. :type signature_version: string :param signature_version: Signature name like ``v4``. :type credentials: :py:class:`~botocore.credentials.Credentials` :param credentials: User credentials with which to sign requests. :type event_emitter: :py:class:`~botocore.hooks.BaseEventHooks` :param event_emitter: Extension mechanism to fire events. Nc||_||_||_||_||_||_t j||_yN) _region_name _signing_name_signature_version _credentials _auth_token _service_idweakrefproxy_event_emitter)self service_id region_name signing_namesignature_version credentials event_emitter auth_tokens 2/usr/lib/python3/dist-packages/botocore/signers.py__init__zRequestSigner.__init__DsG()"3'%%&mmM:c|jSr)rrs r!rzRequestSigner.region_nameXs   r#c|jSr)rr%s r!rzRequestSigner.signature_version\s&&&r#c|jSr)rr%s r!rzRequestSigner.signing_name`s!!!r#c &|j||Sr)sign)roperation_namerequestkwargss r!handlerzRequestSigner.handlerds yy11r#c |}| |j}| |j}|j|||j}|jj dj |jj||||j||||tjk7r|||d} ||| d<|jjdi} |s| jdr| d| d<| jd r| d | d <| jd |j| | d | d  |jdi| } | j!|yy#t$r} |d k7r t| | d} ~ wwxYw)a<Sign a request before it goes out over the wire. :type operation_name: string :param operation_name: The name of the current operation, e.g. ``ListBuckets``. :type request: AWSRequest :param request: The request object to be sent over the wire. :type region_name: str :param region_name: The region to sign the request for. :type signing_type: str :param signing_type: The type of signing to perform. This can be one of three possible values: * 'standard' - This should be used for most requests. * 'presign-url' - This should be used when pre-signing a request. * 'presign-post' - This should be used when pre-signing an S3 post. :type expires_in: int :param expires_in: The number of seconds the presigned url is valid for. This parameter is only valid for signing type 'presign-url'. :type signing_name: str :param signing_name: The name to use for the service when signing. Nzbefore-sign.{}.{})r+rrrrequest_signerr*)rrrexpiressigningregionrridentity_cache cache_keystandardr)rr_choose_signercontextremitformatr hyphenizebotocoreUNSIGNEDget_resolve_identity_cacheget_auth_instancerradd_auth) rr*r+r signing_type expires_inrexplicit_region_namerr,signing_contextauthes r!r)zRequestSigner.signksF +  ++K  --L // L'//     & &  **,n %))/) !   1 1 1 ,*%6F %$.y!%oo11)R@O'O,?,?,I(7(A}%"">2)8)H~&""#34@,,#$45#K0  -t--77 MM' "; 2*0 :-:*;G  s+E E1E,,E1c||d<||d<y)Nr3r4r7)rr,cacher4s r!r@z%RequestSigner._resolve_identity_caches#( '{r#cDddd}|j|d}|jdxs |j}|jdi}|jd|j}|jd|j} |tj ur|j |s||z }|jjd j|jj||| || \} } | *| }|tj ur|j |s||z }|S) ai Allow setting the signature version via the choose-signer event. A value of `botocore.UNSIGNED` means no signing will be performed. :param operation_name: The operation to sign. :param signing_type: The type of signing that the signer is to be used for. :return: The signature version to sign with. z -presign-postz-query) presign-post presign-url auth_typer1rr2zchoose-signer.{}.{})rrrr9) r?rrrr=r>endswithremit_until_responser;rr<) rr*rCr9signing_type_suffix_mapsuffixrr1rrr-responses r!r8zRequestSigner._choose_signers3,## ),,\2>$KK 4O8O8O++i,{{>43E3EF kk(D,=,=> X%6%6 6%..v6  '  //CC ! ( (  **,n &#/D    ( "):)::)226:!V+!  r#c D| |j}tjjj |}| t ||j dur2d}|j|jj}||}|S|j}t|dddur|d} |d} | j| }|d=d} ||j} | |d<|jr4|jtjj!||d<||d <|d i|}|S) a Get an auth instance which can be used to sign a request using the given signature version. :type signing_name: string :param signing_name: Service signing name. This is usually the same as the service name, but can differ. E.g. ``emr`` vs. ``elasticmapreduce``. :type region_name: string :param region_name: Name of the service region, e.g. ``us-east-1`` :type signature_version: string :param signature_version: Signature name like ``v4``. :rtype: :py:class:`~botocore.auth.BaseSigner` :return: Auth instance to sign a request. Nr6TREQUIRES_IDENTITY_CACHEr3r4rr service_namer7)rr=rGAUTH_TYPE_MAPSr?rREQUIRES_TOKENrget_frozen_tokenrgetattrget_credentialsget_frozen_credentialsREQUIRES_REGIONr exceptions NoRegionError) rrrrr,cls frozen_tokenrGrrJkeyfrozen_credentialss r!rAzRequestSigner.get_auth_instancesI*  $ $ 7 7 mm**../@A ;."3     %L+#//@@B |$DK'' 314 8D @+,E%C//4K{# "  "!,!C!C!E  2}     ())7799$/F= !%1F> "}V} r#c|t|}|j|||d|||j|jS)aGenerates a presigned url :type request_dict: dict :param request_dict: The prepared request dictionary returned by ``botocore.awsrequest.prepare_request_dict()`` :type operation_name: str :param operation_name: The operation being signed. :type expires_in: int :param expires_in: The number of seconds the presigned url is valid for. By default it expires in an hour (3600 seconds) :type region_name: string :param region_name: The region name to sign the presigned url. :type signing_name: str :param signing_name: The name to use for the service when signing. :returns: The presigned url rM)rr)prepareurl)r request_dictr*rDrrr+s r!generate_presigned_urlz$RequestSigner.generate_presigned_url:sB:( 5         {{r#rNN)Nr5NN)NN)__name__ __module__ __qualname____doc__r"propertyrrrr-r)r@r8rAget_authrir7r#r!r r !s T;(!!''""2X#t(0!f<@:z!H  (r#r c4eZdZdZdZddZdZ ddZdZy) CloudFrontSigneraA signer to create a signed CloudFront URL. First you create a cloudfront signer based on a normalized RSA signer:: import rsa def rsa_signer(message): private_key = open('private_key.pem', 'r').read() return rsa.sign( message, rsa.PrivateKey.load_pkcs1(private_key.encode('utf8')), 'SHA-1') # CloudFront requires SHA-1 hash cf_signer = CloudFrontSigner(key_id, rsa_signer) To sign with a canned policy:: signed_url = cf_signer.generate_signed_url( url, date_less_than=datetime(2015, 12, 1)) To sign with a custom policy:: signed_url = cf_signer.generate_signed_url(url, policy=my_policy) c ||_||_y)aCreate a CloudFrontSigner. :type key_id: str :param key_id: The CloudFront Key Pair ID :type rsa_signer: callable :param rsa_signer: An RSA signer. Its only input parameter will be the message to be signed, and its output will be the signed content as a binary string. The hash algorithm needed by CloudFront is SHA-1. N)key_id rsa_signer)rrurvs r!r"zCloudFrontSigner.__init__}s $r#Nc|duxr|du}|duxr|du}|s|r d}t|||j||}t|tr|j d}|dt t |zg}n$d|j|jdzg}|j|}|jd|j|jdd|jg|j||S)aCreates a signed CloudFront URL based on given parameters. :type url: str :param url: The URL of the protected object :type date_less_than: datetime :param date_less_than: The URL will expire after that date and time :type policy: str :param policy: The custom policy, possibly built by self.build_policy() :rtype: str :return: The signed URL. Nz=Need to provide either date_less_than or policy, but not bothutf8z Expires=%sz Policy=%sz Signature=z Key-Pair-Id=) ValueError build_policy isinstancestrencodeintr _url_b64encodedecodervextendru _build_url) rrgdate_less_thanpolicyboth_args_suppliedneither_arg_suppliedrHparams signatures r!riz'CloudFrontSigner.generate_presigned_urls,47NF$?F,;V+DI' (&1K3KL${?'C&DE zz-J??r#ctj|jddjddjddS)N+-=_/~)base64 b64encodereplace)rdatas r!rzCloudFrontSigner._url_b64encodes;   T " WT4 WT4 WT4  r#rj) rlrmrnror"rirrzrr7r#r!rsrses*. %$,L= LP(@T r#rsc t|d<y)Ngenerate_db_auth_token)rclass_attributesr,s r!add_generate_db_auth_tokenr1G-.r#c|}||jj}d|d}ddi|dd}d}||d |} t|| |jj d||d d } | t |dS) aGenerates an auth token used to connect to a db with IAM credentials. :type DBHostname: str :param DBHostname: The hostname of the database to connect to. :type Port: int :param Port: The port number the database is listening on. :type DBUsername: str :param DBUsername: The username to log in as. :type Region: str :param Region: The region the database is in. If None, the client region will be used. :return: A presigned url which can be used as an auth token. Nconnect)ActionDBUserrrNGET)url_path query_stringheadersbodymethodzhttps://rizrds-db)r*rhrrDr)metarr_request_signerrilen) r DBHostnamePort DBUsernameRegionr2rrhscheme endpoint_url presigned_urls r!rrs$F ~&&F  LFXj\4&1L|4((?? ! @M V ''r#c"eZdZdZ ddZy)S3PostPresignerc||_yr)r)rr/s r!r"zS3PostPresigner.__init__&s -r#Nc|i}|g}i}tjj}|tj|z}|jtj j |d<g|d<|D]} |dj| t|} || jd<|| jd<|jjd| |d| j|dS) aGenerates the url and the form fields used for a presigned s3 post :type request_dict: dict :param request_dict: The prepared request dictionary returned by ``botocore.awsrequest.prepare_request_dict()`` :type fields: dict :param fields: A dictionary of prefilled form fields to build on top of. :type conditions: list :param conditions: A list of conditions to include in the policy. Each element can be either a list or a structure. For example: [ {"acl": "public-read"}, {"bucket": "mybucket"}, ["starts-with", "$key", "mykey"] ] :type expires_in: int :param expires_in: The number of seconds the presigned post is valid for. :type region_name: string :param region_name: The region name to sign the presigned post to. :rtype: dict :returns: A dictionary with two elements: ``url`` and ``fields``. Url is the url to post to. Fields is a dictionary filled with the form fields and respective values to use when submitting the post. For example: {'url': 'https://mybucket.s3.amazonaws.com 'fields': {'acl': 'public-read', 'key': 'mykey', 'signature': 'mysignature', 'policy': 'mybase64 encoded policy'} } )seconds expiration conditionszs3-presign-post-fieldszs3-presign-post-policy PutObjectrL)rgfields) datetimeutcnow timedeltastrftimer=rGISO8601appendrr9rr)rg) rrhrrrDrr datetime_now expire_daterr+s r!generate_presigned_postz'S3PostPresigner.generate_presigned_post)s^ >F  J ((//1 "X%7%7 %KK *33HMM4I4IJ| "|# 3I < ' ' 2 3( 54:014:01 !! +~ {{f55r#)NNrkN)rlrmrnr"rr7r#r!rr%s.  K6r#rc t|d<y)Nri)rirs r!add_generate_presigned_urlrwrr#c|}|}|i}|}|}dt|d} |j} |j|} |j j j| } |j|| | }tj|jdd} |j| || | \}}}|j|| || |d }|||d <| j||| S#t$r t |wxYw) axGenerate a presigned url given a client, its method, and arguments :type ClientMethod: string :param ClientMethod: The client method to presign for :type Params: dict :param Params: The parameters normally passed to ``ClientMethod``. :type ExpiresIn: int :param ExpiresIn: The number of seconds the presigned url is valid for. By default it expires in an hour (3600 seconds) :type HttpMethod: string :param HttpMethod: The http method to use on the generated url. By default, the http method is whatever is used in the method's model. :returns: The presigned url Tis_presign_requestuse_global_endpoint) method_name api_paramsoperation_modelr9BucketrNignore_signing_regionFrrrr9rset_user_agent_headerr)rhrDr*)_should_use_global_endpointr_PY_TO_OP_NAMEKeyErrorrr service_modelr_emit_api_paramsr is_arnr?_resolve_endpoint_ruleset_convert_to_request_dictri)r ClientMethodParams ExpiresIn HttpMethod client_methodrrD http_methodr9r/r*r bucket_is_arnradditional_headers propertiesrhs r!riri{s],!M F ~JK":4@G ))NB,,];ii--==nMO  " "'#F $$VZZ"%=>M &&#00 '  00'!"# 1L!, X  0 0!% 1 G B&=AABs C!!C7c t|d<y)Nr)rrs r!add_generate_presigned_postrs2I./r#c |}|}|}|} |} |i}n|j}| g} dt|d} t|j} |jj j d} |jd|i| | }tj|jdd}|j| || | \}}}|j|| || |d }| jd |i|jd r"| jd d|dtd  gn| jd|i||d<| j!||| | S)a Builds the url and the form fields used for a presigned s3 post :type Bucket: string :param Bucket: The name of the bucket to presign the post to. Note that bucket related conditions should not be included in the ``conditions`` parameter. :type Key: string :param Key: Key name, optionally add ${filename} to the end to attach the submitted filename. Note that key related conditions and fields are filled out for you and should not be included in the ``Fields`` or ``Conditions`` parameter. :type Fields: dict :param Fields: A dictionary of prefilled form fields to build on top of. Elements that may be included are acl, Cache-Control, Content-Type, Content-Disposition, Content-Encoding, Expires, success_action_redirect, redirect, success_action_status, and x-amz-meta-. Note that if a particular element is included in the fields dictionary it will not be automatically added to the conditions list. You must specify a condition for the element as well. :type Conditions: list :param Conditions: A list of conditions to include in the policy. Each element can be either a list or a structure. For example: [ {"acl": "public-read"}, ["content-length-range", 2, 5], ["starts-with", "$success_action_redirect", ""] ] Conditions that are included may pertain to acl, content-length-range, Cache-Control, Content-Type, Content-Disposition, Content-Encoding, Expires, success_action_redirect, redirect, success_action_status, and/or x-amz-meta-. Note that if you include a condition, you must specify the a valid value in the fields dictionary as well. A value will not be added automatically to the fields dictionary based on the conditions. :type ExpiresIn: int :param ExpiresIn: The number of seconds the presigned post is valid for. :rtype: dict :returns: A dictionary with two elements: ``url`` and ``fields``. Url is the url to post to. Fields is a dictionary filled with the form fields and respective values to use when submitting the post. For example: {'url': 'https://mybucket.s3.amazonaws.com 'fields': {'acl': 'public-read', 'key': 'mykey', 'signature': 'mysignature', 'policy': 'mybase64 encoded policy'} } NTr CreateBucketrrrNrFrbucketz ${filename}z starts-withz$keyrc)rhrrrD)copyrrrrrrrr rr?rrrrPrr)rrKeyFields ConditionsrrrcrrrDr9post_presignerrrrrrrrhs r!rrsBF C FJJ ~ #:4@G %T%9%9:Nii--==nMO  " "f%'#F $$VZZ"%=>M &&#00 '  00'!"# 1Lx() ||M"=K]9K8K2LMN5#,'F5M  1 1! 2 r#c<|jjdk7ry|jjj}|r`|j ddry|j ddk(r$|jjj dk(ry|j ddk(ryy ) NawsFuse_dualstack_endpointus_east_1_regional_endpointregionalz us-east-1addressing_stylevirtualT)r partitionconfigs3r?r)client s3_configs r!rrVs {{% ""%%I ==15 9 MM7 8J F ""..+= ==+ , 9 r#r)NrkN)NNrk)rrrrr= botocore.authbotocore.awsrequestrrbotocore.compatrbotocore.exceptionsrrrbotocore.utilsr r r r rsrrrrrirrrr7r#r!rs K' 9'AAH C C LH3(lO6O6dH AEL^J @DEPr#