7xj4ddlZddlZddlZddlZddlZddlZddlmZmZddl m Z m Z ddl m Z mZmZmZddlmZddlmZmZmZGddZGd d Zd Zd Zdd Z ddZ ddZ ddZGddZdZ ddZ!dZ" ddZ#dZ$dS)N)create_request_objectprepare_request_dict) OrderedDictget_current_datetime)ParamValidationErrorUnknownClientMethodErrorUnknownSignatureVersionError UnsupportedSignatureVersionError)FrozenAuthToken) ArnParserdatetime2timestamp fix_s3_hostceZdZdZ ddZedZedZedZddZ dd Z d Z d Z dd Z e Z ddZdS) RequestSignera0 An object to sign requests before they go out over the wire using one of the authentication mechanisms defined in ``auth.py``. This class fires two events scoped to a service and operation name: * choose-signer: Allows overriding the auth signer name. * before-sign: Allows mutating the request before signing. Together these events allow for customization of the request signing pipeline, including overrides, request path manipulation, and disabling signing per operation. :type service_id: botocore.model.ServiceId :param service_id: The service id for the service, e.g. ``S3`` :type region_name: string :param region_name: Name of the service region, e.g. ``us-east-1`` :type signing_name: string :param signing_name: Service signing name. This is usually the same as the service name, but can differ. E.g. ``emr`` vs. ``elasticmapreduce``. :type signature_version: string :param signature_version: Signature name like ``v4``. :type credentials: :py:class:`~botocore.credentials.Credentials` :param credentials: User credentials with which to sign requests. :type event_emitter: :py:class:`~botocore.hooks.BaseEventHooks` :param event_emitter: Extension mechanism to fire events. Nc||_||_||_||_||_||_t j||_dSN) _region_name _signing_name_signature_version _credentials _auth_token _service_idweakrefproxy_event_emitter)self service_id region_name signing_namesignature_version credentials event_emitter auth_tokens AC:\Projects\Historical\venv\Lib\site-packages\botocore/signers.py__init__zRequestSigner.__init__GsN()"3'%%&mM::c|jSr)rrs r$rzRequestSigner.region_name[s   r&c|jSr)rr(s r$r zRequestSigner.signature_version_s &&r&c|jSr)rr(s r$rzRequestSigner.signing_namecs !!r&c .|||Sr)sign)roperation_namerequestkwargss r$handlerzRequestSigner.handlergs yy111r&standardc 2|}||j}||j}||||j}|jd|jd||||j||||tj kr|||d} ||| d<|j di} |s | dr | d| d <| d r | d | d <| d r | d | d <| d #| | | d | d  |j di| } n*#t$r} |dkrt|| d} ~ wwxYw| |dSdS)a<Sign a request before it goes out over the wire. :type operation_name: string :param operation_name: The name of the current operation, e.g. ``ListBuckets``. :type request: AWSRequest :param request: The request object to be sent over the wire. :type region_name: str :param region_name: The region to sign the request for. :type signing_type: str :param signing_type: The type of signing to perform. This can be one of three possible values: * 'standard' - This should be used for most requests. * 'presign-url' - This should be used when pre-signing a request. * 'presign-post' - This should be used when pre-signing an S3 post. :type expires_in: int :param expires_in: The number of seconds the presigned url is valid for. This parameter is only valid for signing type 'presign-url'. :type signing_name: str :param signing_name: The name to use for the service when signing. Nz before-sign..)r.rrr request_signerr-)rrr expiressigningregionrrrequest_credentialsidentity_cache cache_keyr1r )rr_choose_signercontextremitr hyphenizebotocoreUNSIGNEDget_resolve_identity_cacheget_auth_instancer r add_auth) rr-r.r signing_type expires_inrexplicit_region_namer r/signing_contextauthes r$r,zRequestSigner.signns;F +  +K  -L // L'/     J4+5577 J J. J J%)/) !     1 1 1 ,*%6F %$.y!%o11)R@@O' BO,?,?,I,I B(7(A}%"">22 I)8)H~&""#899 0?)1,-""#344@,,#$45#K0  -t-7777/   :--:*;G   MM' " " " " "C 2 1s E E= E88E=c||d<||d<dS)Nr9r:r<)rr/cacher:s r$rDz%RequestSigner._resolve_identity_caches#( '{r&c2ddd}||d}|dp|j}|di}|d|j}|d|j} |tjur||s||z }|jd |j d ||| || \} } | *| }|tjur||s||z }|S) ai Allow setting the signature version via the choose-signer event. A value of `botocore.UNSIGNED` means no signing will be performed. :param operation_name: The operation to sign. :param signing_type: The type of signing that the signer is to be used for. :return: The signature version to sign with. z -presign-postz-query) presign-post presign-url auth_typer6rr7zchoose-signer.r3)rrr r>) rCrrrrArBendswithremit_until_responserr@) rr-rGr>signing_type_suffix_mapsuffixr r6rrr0responses r$r=zRequestSigner._choose_signersR,## # ),,\2>>$KK 44O8O++i,,{{>43EFF kk(D,=>> X%6 6 6%..v66 7  '  /CC LT-7799 L LN L L%#/ D     ( "):::)226::;"V+!  r&c r||j}tjj|}|t ||jdurO|jr4t|jts|j }n|j}||}|S|p|j } t|dddur(|d} |d} | | } |d=d} | | } | |d<|jr/|jtj||d<||d <|d i|}|S) a Get an auth instance which can be used to sign a request using the given signature version. :type signing_name: string :param signing_name: Service signing name. This is usually the same as the service name, but can differ. E.g. ``emr`` vs. ``elasticmapreduce``. :type region_name: string :param region_name: Name of the service region, e.g. ``us-east-1`` :type signature_version: string :param signature_version: Signature name like ``v4``. :rtype: :py:class:`~botocore.auth.BaseSigner` :return: Auth instance to sign a request. Nr;TREQUIRES_IDENTITY_CACHEr9r:r!r service_namer<)rrArKAUTH_TYPE_MAPSrCr REQUIRES_TOKENr isinstancer get_frozen_tokenrgetattrget_credentialsget_frozen_credentialsREQUIRES_REGIONr exceptions NoRegionError) rrrr r8r/cls frozen_tokenrKr!rNkeyfrozen_credentialss r$rEzRequestSigner.get_auth_instances4  $ $ 7 m*../@AA ;."3    % % 0  /)) 0 $/@@BB #/ 3|$$DK)>T-> 314 8 8D @ @+,E%C//44K{# "  "!,!C!C!E!E  2}   2 ()77999$/F= !%1F> "s}}V}} r&ct|}||||d||||jS)aGenerates a presigned url :type request_dict: dict :param request_dict: The prepared request dictionary returned by ``botocore.awsrequest.prepare_request_dict()`` :type operation_name: str :param operation_name: The operation being signed. :type expires_in: int :param expires_in: The number of seconds the presigned url is valid for. By default it expires in an hour (3600 seconds) :type region_name: string :param region_name: The region name to sign the presigned url. :type signing_name: str :param signing_name: The name to use for the service when signing. :returns: The presigned url rQ)rr,prepareurl)r request_dictr-rHrrr.s r$generate_presigned_urlz$RequestSigner.generate_presigned_urlEsS:( 55           {r&rNN)Nr1NN)rjNN)__name__ __module__ __qualname____doc__r%propertyrr rr0r,rDr=rEget_authror<r&r$rr$s*  T;;;;(!!X!''X'""X"2222Z#Z#Z#Z#x(((.!.!.!h BBBBJ!H  ((((((r&rc6eZdZdZdZddZdZ ddZdZdS) CloudFrontSigneraA signer to create a signed CloudFront URL. First you create a cloudfront signer based on a normalized RSA signer:: import rsa def rsa_signer(message): private_key = open('private_key.pem', 'r').read() return rsa.sign( message, rsa.PrivateKey.load_pkcs1(private_key.encode('utf8')), 'SHA-1') # CloudFront requires SHA-1 hash cf_signer = CloudFrontSigner(key_id, rsa_signer) To sign with a canned policy:: signed_url = cf_signer.generate_signed_url( url, date_less_than=datetime(2015, 12, 1)) To sign with a custom policy:: signed_url = cf_signer.generate_signed_url(url, policy=my_policy) c"||_||_dS)aCreate a CloudFrontSigner. :type key_id: str :param key_id: The CloudFront Key Pair ID :type rsa_signer: callable :param rsa_signer: An RSA signer. Its only input parameter will be the message to be signed, and its output will be the signed content as a binary string. The hash algorithm needed by CloudFront is SHA-1. N)key_id rsa_signer)rrzr{s r$r%zCloudFrontSigner.__init__s $r&NcT|duo|du}|duo|du}|s|rd}t|||||}t|tr|d}|!dt t |g}n,d||dg}| |}| d||dd|j g| ||S)aCreates a signed CloudFront URL based on given parameters. :type url: str :param url: The URL of the protected object :type date_less_than: datetime :param date_less_than: The URL will expire after that date and time :type policy: str :param policy: The custom policy, possibly built by self.build_policy() :rtype: str :return: The signed URL. Nz=Need to provide either date_less_than or policy, but not bothutf8zExpires=zPolicy=z Signature=z Key-Pair-Id=) ValueError build_policyr^strencodeintr _url_b64encodedecoder{extendrz _build_url) rrmdate_less_thanpolicyboth_args_suppliedneither_arg_suppliedrLparams signatures r$roz'CloudFrontSigner.generate_presigned_urlsW,47NF$>??F,;V+DI' (&1K3KL${?'C'C&DE z-J????r&ctj|ddddddS)N+-=_/~)base64 b64encodereplace)rdatas r$rzCloudFrontSigner._url_b64encodesD  T " " WT4 WT4 WT4  r&rp) rqrrrsrtr%rorrrr<r&r$rxrxps. % % %$,$,$,$,L=== LP(@(@(@(@T     r&rxc t|d<dS)Ngenerate_db_auth_token)rclass_attributesr/s r$add_generate_db_auth_tokenr1G-...r&c .t|d<t|d<dS)Ngenerate_db_connect_auth_token$generate_db_connect_admin_auth_token)#dsql_generate_db_connect_auth_token)dsql_generate_db_connect_admin_auth_tokenrs r$'add_dsql_generate_db_auth_token_methodsrs&+56 2;<<rr,rm) rrnrrrHrr datetime_now expire_daterr.s r$generate_presigned_postz'S3PostPresigner.generate_presigned_postsn >F  J,-- "X%7 %K%K%KK *33HM4IJJ| "|# 3 3I < ' ' 2 2 2 2( 554:014:01 !! +~   {f555r&)NNrjN)rqrrrsr%rr<r&r$rrsK...  S6S6S6S6S6S6r&rc t|d<dS)Nro)rors r$add_generate_presigned_urlrrr&rjc|}|}|i}|}|}dt|d} |j} |j|} n#t$rt |wxYw|jj| } ||| | }tj | dd} | | || | \}}}| || || |d }|||d <| ||| S) aIGenerate a presigned url given a client, its method, and arguments .. warning:: For backwards compatibility, S3 presigned URLs use Signature Version 2 by default in regions where S3 supports it. As a result, some ``Params`` entries are not signed. Some headers, including the conditionals and ``Range``, are also silently dropped. It is recommended to configure the S3 client with Signature Version 4 by setting ``signature_version='s3v4'`` in the client's ``Config``. :type ClientMethod: string :param ClientMethod: The client method to presign for :type Params: dict :param Params: The parameters normally passed to ``ClientMethod``. :type ExpiresIn: int :param ExpiresIn: The number of seconds the presigned url is valid for. By default it expires in an hour (3600 seconds) :type HttpMethod: string :param HttpMethod: The http method to use on the generated url. By default, the http method is whatever is used in the method's model. :returns: The presigned url NTis_presign_requestuse_global_endpoint) method_name api_paramsoperation_modelr>BucketrRignore_signing_regionFrrrr>rset_user_agent_headerr)rnrHr-)_should_use_global_endpointr_PY_TO_OP_NAMEKeyErrorrr service_modelr_emit_api_paramsr is_arnrC_resolve_endpoint_ruleset_convert_to_request_dictro)r ClientMethodParamsr HttpMethod client_methodrrH http_methodr>r4r-r bucket_is_arnradditional_headers propertiesrns r$rorosB!M F ~JK":4@@G )NB,]; BBB&=AAAABi-==nMMO  " "'#F $VZZ"%=%=>>M &&#00 '   00'!"# 1L!, X  0 0!% 1  s 5Ac t|d<dS)Nr)rrs r$add_generate_presigned_postrNs2I.///r&c |}|}|}|} |} |i}n|}| g} dt|d} t|j} |jjd} |d|i| | }tj | dd}| | || | \}}}| || || |d }| d |i|d r/| d d|dtd  gn| d|i||d<| ||| | S)aw Builds the url and the form fields used for a presigned s3 post :type Bucket: string :param Bucket: The name of the bucket to presign the post to. Note that bucket related conditions should not be included in the ``conditions`` parameter. :type Key: string :param Key: Key name, optionally add ${filename} to the end to attach the submitted filename. Note that key related conditions and fields are filled out for you and should not be included in the ``Fields`` or ``Conditions`` parameter. :type Fields: dict :param Fields: A dictionary of prefilled form fields to build on top of. Elements that may be included are acl, Cache-Control, Content-Type, Content-Disposition, Content-Encoding, Expires, success_action_redirect, redirect, success_action_status, and x-amz-meta-. Note that if a particular element is included in the fields dictionary it will not be automatically added to the conditions list. You must specify a condition for the element as well. :type Conditions: list :param Conditions: A list of conditions to include in the policy. Each element can be either a list or a structure. For example: .. code:: python [ {"acl": "public-read"}, ["content-length-range", 2, 5], ["starts-with", "$success_action_redirect", ""] ] Conditions that are included may pertain to acl, content-length-range, Cache-Control, Content-Type, Content-Disposition, Content-Encoding, Expires, success_action_redirect, redirect, success_action_status, and/or x-amz-meta-. Note that if you include a condition, you must specify a valid value in the fields dictionary as well. A value will not be added automatically to the fields dictionary based on the conditions. :type ExpiresIn: int :param ExpiresIn: The number of seconds the presigned post is valid for. :rtype: dict :returns: A dictionary with two elements: ``url`` and ``fields``. Url is the url to post to. Fields is a dictionary filled with the form fields and respective values to use when submitting the post. For example: .. code:: python { 'url': 'https://amzn-s3-demo-bucket.s3.amazonaws.com', 'fields': { 'acl': 'public-read', 'key': 'mykey', 'signature': 'mysignature', 'policy': 'mybase64 encoded policy' } } NTr CreateBucketrrrRrFrbucketz ${filename}z starts-withz$keyrh)rnrrrH)copyrrrrrrrr r rCr r rrTrr)rrKeyFields ConditionsrrrhrrrHr>post_presignerrrrrrrrns r$rrRsPF C FJJ ~ #:4@@G %T%9::Ni-==nMMO  " "f%'#F $VZZ"%=%=>>M &&#00 '   00'!"# 1Lx())) ||M""(=K]9K9K8K6K2LMNNNN5#,'''F5M  1 1! 2  r&c|jjdkrdS|jjj}|rc|ddrdS|ddkr|jjjdkrdS|ddkrdSd S) NawsFuse_dualstack_endpointus_east_1_regional_endpointregionalz us-east-1addressing_stylevirtualT)r partitionconfigs3rCr)client s3_configs r$rrs {%%u "%I  ==15 9 9 5 MM7 8 8J F F ".+==5 ==+ , , 9 95 4r&r)Nr)NrjN)NNrj)%rrrrrA botocore.authbotocore.awsrequestrrbotocore.compatrrbotocore.exceptionsrrr r botocore.tokensr botocore.utilsr r rrrxrrrrrrrrrorrrr<r&r$r0s  KKKKKKKK======== ,+++++IIIIIIIIX C C C C C C C C LHHH3(3(3(3(n470(0(0(0(h,/,,/*W6W6W6W6W6W6W6W6tHHH AEWWWWtJJJ @DLLLL^r&