o
    ȷeV                     @   s  d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl	m
Z
 ddlZddlZddlZddlmZmZmZmZ ddlmZ ddlmZ zddlmZ ddlmZ W n eyi   ddlZdZY nw g d	Zg d
ZG dd deZG dd deeZG dd deeZG dd deeZ G dd deeZ!G dd deeZ"G dd deeZ#G dd de#eZ$G dd deZ%G dd deZ&G dd  d e&eZ'G d!d" d"e&eZ(G d#d$ d$e&eZ)G d%d& d&e)eZ*d-d'd(Z+d)d* Z,d+d, Z-dS ).z/
Handles authentication required to AWS and GS
    N)
formatdate)urllibencodebytesparse_qs_safeurlparse)AuthHandler)BotoClientError)sha1)sha256)z-ap-northeast-1z.ap-northeast-1z-ap-southeast-1z.ap-southeast-1z-ap-southeast-2z.ap-southeast-2z
-eu-west-1z
.eu-west-1z-external-1z.external-1z
-sa-east-1z
.sa-east-1z
-us-east-1z
.us-east-1z-us-gov-west-1z.us-gov-west-1z
-us-west-1z
.us-west-1z
-us-west-2z
.us-west-2)z.cn-z.eu-centralz-eu-centralz.ap-northeast-2z-ap-northeast-2z.ap-south-1z-ap-south-1z
.us-east-2z
-us-east-2z-ca-centralz.ca-centralz
.eu-west-2z
-eu-west-2c                   @   sH   e Zd ZdZdd Zdd Zdd Zdd	 Zd
d Zdd Z	dd Z
dS )HmacKeyszKey based Auth handler helper.c                 C   s2   |j d u s
|jd u rtj || _| | d S N)
access_key
secret_keybotoauth_handlerNotReadyToAuthenticatehostupdate_providerselfr   configprovider r   @/var/www/ideatree/venv/lib/python3.10/site-packages/boto/auth.py__init__e   s   
zHmacKeys.__init__c                 C   sL   || _ tj| j jdtd| _tr!tj| j jdtd| _d S d | _d S Nutf-8)	digestmod)		_providerhmacnewr   encodesha_hmacr
   	_hmac_256r   r   r   r   r   r   k   s   
zHmacKeys.update_providerc                 C   s   | j rdS dS )N
HmacSHA256HmacSHA1)r$   r   r   r   r   	algorithmu   s   zHmacKeys.algorithmc                 C   s(   | j rt}nt}tj| jjd|dS r   )r$   r
   r"   r   r    r   r   r!   )r   r   r   r   r   	_get_hmac{   s   zHmacKeys._get_hmacc                 C   s.   |   }||d t| d S Nr   )r*   updater!   r   digestdecodestrip)r   string_to_signnew_hmacr   r   r   sign_string   s   zHmacKeys.sign_stringc                 C   s   t  | j}|d= |d= |S )Nr#   r$   )copy__dict__)r   pickled_dictr   r   r   __getstate__   s   zHmacKeys.__getstate__c                 C   s   || _ | | j d S r   )r4   r   r   )r   dctr   r   r   __setstate__   s   zHmacKeys.__setstate__N)__name__
__module____qualname____doc__r   r   r)   r*   r2   r6   r8   r   r   r   r   r   b   s    
r   c                       s.   e Zd ZdZdgZ fddZdd Z  ZS )AnonAuthHandlerz(
    Implements Anonymous requests.
    anonc                    s   t t| ||| d S r   )superr=   r   r   	__class__r   r   r      s   zAnonAuthHandler.__init__c                 K   s   d S r   r   )r   http_requestkwargsr   r   r   add_auth   s   zAnonAuthHandler.add_auth)r9   r:   r;   r<   
capabilityr   rD   __classcell__r   r   r@   r   r=      s
    r=   c                       8   e Zd ZdZddgZdd Z fddZdd	 Z  ZS )
HmacAuthV1Handlerz:    Implements the HMAC request signing used by S3 and GS.zhmac-v1s3c                 C   *   t | ||| t| ||| d | _d S r   r   r   r   r$   r   r   r   r   r         
zHmacAuthV1Handler.__init__c                       t t| | d | _d S r   )r?   rH   r   r$   r%   r@   r   r   r         
z!HmacAuthV1Handler.update_providerc                 K   s   |j }|j}|j}d|vrtdd|d< | jjr"| jj}| jj||< tj	|||d | j}tj
d|  | |}| jj}	d|	| jj|f }
tj
d|
  |
|d< d S )NDateTusegmtStringToSign:
%s%s %s:%sSignature:
%sAuthorization)headersmethod	auth_pathr   r   security_tokensecurity_token_headerr   utilscanonical_stringlogdebugr2   auth_headerr   )r   rB   rC   rV   rW   rX   keyr0   b64_hmacauth_hdrauthr   r   r   rD      s$   

zHmacAuthV1Handler.add_auth	r9   r:   r;   r<   rE   r   r   rD   rF   r   r   r@   r   rH      s    rH   c                       rG   )
HmacAuthV2HandlerzJ
    Implements the simplified HMAC authorization used by CloudFront.
    zhmac-v2
cloudfrontc                 C   rJ   r   rK   r   r   r   r   r      rL   zHmacAuthV2Handler.__init__c                    rM   r   )r?   re   r   r$   r%   r@   r   r   r      rN   z!HmacAuthV2Handler.update_providerc                 K   sh   |j }d|vrtdd|d< | jjr| jj}| jj||< | |d }| jj}d|| jj|f |d< d S )NrO   TrP   rS   rU   )rV   r   r   rY   rZ   r2   r_   r   )r   rB   rC   rV   r`   ra   rb   r   r   r   rD      s   zHmacAuthV2Handler.add_authrd   r   r   r@   r   re      s    re   c                   @   s(   e Zd ZdZg dZdd Zdd ZdS )HmacAuthV3Handlerz@Implements the new Version 3 HMAC authorization used by Route53.)zhmac-v3route53sesc                 C   $   t | ||| t| ||| d S r   r   r   r   r   r   r   r   r         zHmacAuthV3Handler.__init__c                 K   sr   |j }d|vrtdd|d< | jjr| jj}| jj||< | |d }d| jj }|d|  |f 7 }||d< d S )NrO   TrP   zAWS3-HTTPS AWSAccessKeyId=%s,zAlgorithm=%s,Signature=%sX-Amzn-Authorization)rV   r   r   rY   rZ   r2   r   r)   )r   rB   rC   rV   r`   ra   sr   r   r   rD      s   zHmacAuthV3Handler.add_authN)r9   r:   r;   r<   rE   r   rD   r   r   r   r   rg      s
    rg   c                   @   s>   e Zd ZdZdgZdd Zdd Zdd Zd	d
 Zdd Z	dS )HmacAuthV3HTTPHandlerzK
    Implements the new Version 3 HMAC authorization used by DynamoDB.
    zhmac-v3-httpc                 C   rj   r   rk   r   r   r   r   r     rl   zHmacAuthV3HTTPHandler.__init__c                 C   s<   d| j i}|j D ]\}}| }|dr|||< q
|S )k
        Select the headers from the request that need to be included
        in the StringToSign.
        Hostx-amz)r   rV   itemslower
startswith)r   rB   headers_to_signnamevaluelnamer   r   r   rv     s   

z%HmacAuthV3HTTPHandler.headers_to_signc                    s    t  fdd D }d|S )  
        Return the headers that need to be included in the StringToSign
        in their canonical form by converting all header keys to lower
        case, sorting them in alphabetical order and then joining
        them into a string, separated by newlines.
        c                    s(   g | ]}d |    |  f qS )%s:%srt   r/   .0nrv   r   r   
<listcomp>  s
    

z;HmacAuthV3HTTPHandler.canonical_headers.<locals>.<listcomp>
sortedjoinr   rv   lr   r   r   canonical_headers  s   
z'HmacAuthV3HTTPHandler.canonical_headersc                 C   s8   |  |}| |}d|j|jd|d|jg}||fS )
        Return the canonical StringToSign as well as a dict
        containing the original version of all headers that
        were included in the StringToSign.
        r    )rv   r   r   rW   rX   body)r   rB   rv   r   r0   r   r   r   r0     s   

z$HmacAuthV3HTTPHandler.string_to_signc                 K   s   d|j v r	|j d= tdd|j d< | jjr| jj|j d< | |\}}tjd|  t|	d
 }| |}d| jj }|d	|   7 }|d
d| 7 }|d| 7 }||j d< dS )z
        Add AWS3 authentication to a request.

        :type req: :class`boto.connection.HTTPRequest`
        :param req: The HTTPRequest object.
        rm   TrP   
X-Amz-DateX-Amz-Security-TokenrR   r   zAWS3 AWSAccessKeyId=%s,zAlgorithm=%s,zSignedHeaders=%s,;Signature=%sN)rV   r   r   rY   r0   r   r]   r^   r
   r!   r-   r2   r   r)   r   )r   reqrC   r0   rv   
hash_valuera   rn   r   r   r   rD   ,  s   
	
zHmacAuthV3HTTPHandler.add_authN)
r9   r:   r;   r<   rE   r   rv   r   r0   rD   r   r   r   r   ro      s    ro   c                   @   s   e Zd ZdZdgZ	d+ddZd,ddZd	d
 Zdd Zdd Z	dd Z
dd Zdd Zdd Zdd Zdd Zdd Zdd Zdd  Zd!d" Zd#d$ Zd%d& Zd'd( Zd)d* ZdS )-HmacAuthV4Handlerz:
    Implements the new Version 4 HMAC authorization.
    hmac-v4Nc                 C   s0   t | ||| t| ||| || _|| _d S r   )r   r   r   service_nameregion_name)r   r   r   r   r   r   r   r   r   r   L  s   
zHmacAuthV4Handler.__init__Fc                 C   sP   t |ts
|d}|rt||dt }|S t||dt }|S r+   )
isinstancebytesr!   r   r    r
   	hexdigestr-   )r   r`   msghexsigr   r   r   _signV  s   

zHmacAuthV4Handler._signc                 C   sr   |  | j|}|jdr|jd }d|i}|j D ]\}}| }|dr6t|tr2|	d}|||< q|S )rp   rq   rr   r   )
host_headerr   rV   getrs   rt   ru   r   r   r.   r   rB   host_header_valuerv   rw   rx   ry   r   r   r   rv   `  s   



z!HmacAuthV4Handler.headers_to_signc                 C   s8   |j }|jdk}|dkr|r|dkr|r|S d||f S NhttpsP   i  r{   )portprotocolr   r   rB   r   securer   r   r   r   q  s
   
zHmacAuthV4Handler.host_headerc                 C   sb   t |j }g }|D ] }tj|j| }|tjj	|ddd tjj	|dd  qd
|S )Nr   safe=-_~&)r   paramskeysr   r[   get_utf8_valueappendr   parsequoter   )r   rB   parameter_namespairspnamepvalr   r   r   query_stringx  s   
zHmacAuthV4Handler.query_stringc              	   C   sh   |j dkrdS g }t|jD ] }tj|j| }|dtjj	|ddtjj	|ddf  qd
|S )NPOSTr   %s=%s-_.~r   r   )rW   r   r   r   r[   r   r   r   r   r   r   r   rB   r   paramrx   r   r   r   canonical_query_string  s   


z(HmacAuthV4Handler.canonical_query_stringc                 C   sj   g }|D ])}|   }t|| }d|v r| }n	d|  }|d||f  qdt|S )rz   " r{   r   )rt   r/   strr   splitr   r   )r   rv   	canonicalheaderc_name	raw_valuec_valuer   r   r   r     s   
z#HmacAuthV4Handler.canonical_headersc                 C   s    dd |D }t |}d|S )Nc                 S      g | ]
}d |    qS z%sr|   r}   r   r   r   r         z4HmacAuthV4Handler.signed_headers.<locals>.<listcomp>r   r   r   r   r   r   signed_headers  s   
z HmacAuthV4Handler.signed_headersc                 C   sF   |j }t|dd}tj|}t|dkr!|dr!|d7 }|S )N\/   )	rX   	posixpathnormpathreplacer   r   r   lenendswith)r   rB   path
normalizedencodedr   r   r   canonical_uri  s   zHmacAuthV4Handler.canonical_uric                 C   sN   |j }t|drt|drtjj|tdd S t|ts!|d}t|	 S )Nseekread)hash_algorithmr   r   )
r   hasattrr   r[   compute_hashr
   r   r   r!   r   )r   rB   r   r   r   r   payload  s   

zHmacAuthV4Handler.payloadc                 C   st   |j  g}|| | || | | |}|| |d  || | || | d	|S )Nr   )
rW   upperr   r   r   rv   r   r   r   r   )r   rB   crrv   r   r   r   canonical_request  s   

z#HmacAuthV4Handler.canonical_requestc                 C   sB   | j jg}||j ||j ||j |d d|S )Naws4_requestr   )r   r   r   	timestampr   r   r   )r   rB   scoper   r   r   r     s   


zHmacAuthV4Handler.scopec                 C   s
   | dS )N.)r   r   r   r   r   r   split_host_parts  s   
z"HmacAuthV4Handler.split_host_partsc                 C   sj   |  |}| jd ur| j}|S t|dkr/|d dkrd}|S t|dkr)d}|S |d }|S |d }|S )Nr   zus-govzus-gov-west-1   	us-east-1r   )r   r   r   )r   r   partsr   r   r   r   determine_region_name  s   

	z'HmacAuthV4Handler.determine_region_namec                 C   s*   |  |}| jd ur| j}|S |d }|S )Nr   )r   r   )r   r   r   r   r   r   r   determine_service_name  s   

z(HmacAuthV4Handler.determine_service_namec                 C   st   g }|j d dd |_||j | |j}| |j}||_||_||j ||j |d d|S )Nr   r      r   r   )	rV   r   r   r   r   r   r   r   r   )r   rB   r   r   r   r   r   r   credential_scope  s   

z"HmacAuthV4Handler.credential_scopec                 C   sH   dg}| |jd  | | | | t|d  d|S )r   AWS4-HMAC-SHA256r   r   r   )r   rV   r   r
   r!   r   r   )r   rB   r   stsr   r   r   r0     s
   
z HmacAuthV4Handler.string_to_signc                 C   sX   | j j}| d| d|j}| ||j}| ||j}| |d}| j||ddS )NAWS4r   r   T)r   )r   r   r   r!   r   r   r   )r   rB   r0   r`   k_datek_region	k_service	k_signingr   r   r   	signature  s   zHmacAuthV4Handler.signaturec                 K   sb  d|j v r	|j d= tj }|d|j d< | jjr!| jj|j d< | |}|}d|v r3| |d }|rM|jdkrM||_d|j d< t	t
|j|j d	< n|jd
d |_|r`|jd
 | |_| |}tjd|  | ||}tjd|  | ||}tjd|  | |}	d| | g}
|
d| |	  |
d|  d|
|j d< dS )z
        Add AWS4 authentication to a request.

        :type req: :class`boto.connection.HTTPRequest`
        :param req: The HTTPRequest object.
        rm   %Y%m%dT%H%M%SZr   r   unmangled_reqr   0application/x-www-form-urlencoded; charset=UTF-8Content-TypeContent-Length?r   zCanonicalRequest:
%srR   rT   zAWS4-HMAC-SHA256 Credential=%szSignedHeaders=%sr   ,rU   N)rV   datetimeutcnowstrftimer   rY   r   rW   r   r   r   r   r   r   r   r]   r^   r0   r   rv   r   r   r   r   )r   r   rC   nowqs
qs_to_postr   r0   r   rv   r   r   r   r   rD     s8   
	




zHmacAuthV4Handler.add_auth)NN)F)r9   r:   r;   r<   rE   r   r   rv   r   r   r   r   r   r   r   r   r   r   r   r   r   r0   r   rD   r   r   r   r   r   E  s.    



	
	r   c                       s   e Zd ZdZdgZ fddZdd Zdd Zd	d
 Zdd Z	dd Z
dd Zdd Zdd Z fddZ fddZdddZ  ZS )S3HmacAuthV4HandlerzN
    Implements a variant of Version 4 HMAC authorization specific to S3.
    
hmac-v4-s3c                    s2   t t| j|i | | jr| | j| _d S d S r   )r?   r  r   r   clean_region_name)r   argsrC   r@   r   r   r   O  s   zS3HmacAuthV4Handler.__init__c                 C   s   | dr|dd  S |S )Ns3-r   )ru   )r   r   r   r   r   r  U  s   
z%S3HmacAuthV4Handler.clean_region_namec                 C   s0   t j|j}t j|j}t jj|dd}|S )Nz/~r   )r   r   r   r   unquoter   )r   rB   r   unquotedr   r   r   r   r   [  s   z!S3HmacAuthV4Handler.canonical_uric              	   C   sZ   g }t |jD ] }tj|j| }|dtjj|ddtjj|ddf  qd	|S )Nr   r   r   r   )
r   r   r   r[   r   r   r   r   r   r   r   r   r   r   r   e  s   

z*S3HmacAuthV4Handler.canonical_query_stringc                 C   s<   |j }|jdk}|dkr|r|dkr|r|jS d|j|f S r   )r   r   r   r   r   r   r   r   p  s
   
zS3HmacAuthV4Handler.host_headerc                 C   sF   |  | j|}d|i}|j D ]\}}| }|dvr |||< q|S )rp   rq   )authorization)r   r   rV   rs   rt   r   r   r   r   rv   w  s   z#S3HmacAuthV4Handler.headers_to_signc                 C   s   |  |}| jd ur| j}|S t|dkr$| |d }|dkr"d}|S tt|D ]'\}}| }|dkrD||  }|dkrAd} |S |drQ| |} |S q*|S )Nr   r   rI   r   	amazonawsr  )r   r   r   r  	enumeratereversedrt   ru   )r   r   r   r   offsetpartr   r   r   r     s.   




z)S3HmacAuthV4Handler.determine_region_namec                 C   s   dS )NrI   r   r   r   r   r   r     s   z*S3HmacAuthV4Handler.determine_service_namec           	      C   s   t  |}tj|j}|j|_|jdu ri |_n|j  }||_|j}t|dd}|	 D ]\}}t
|ttfrEt|dkrE|d ||< q.|j| |S )z|
        Returns a copy of the request object with fixed ``auth_path/params``
        attributes from the original.
        NT)keep_blank_valuesr   r   )r3   r   r   r   rX   r   r   queryr   rs   r   listtupler   r,   )	r   r   modified_reqparsed_pathcopy_paramsraw_qsexisting_qsr`   rx   r   r   r   mangle_path_and_params  s&   


z*S3HmacAuthV4Handler.mangle_path_and_paramsc                    s&   |j dr|j d S tt| |S )Nx-amz-content-sha256)rV   r   r?   r  r   )r   rB   r@   r   r   r     s   
zS3HmacAuthV4Handler.payloadc                    s^   d|j vrd|j v r|j d|j d< n| ||j d< | |}tt| j|fd|i|S )Nr  _sha256r   )rV   popr   r  r?   r  rD   )r   r   rC   updated_reqr@   r   r   rD     s   


zS3HmacAuthV4Handler.add_authNc                 C   s  |du rt j  d}| |j}| |j}dd| jj|dd ||f ||dd}| jjr6| jj|d< | 	|}t
d	d
 |D }d||d< |j| | |}	d|	ddd d }	||jd< | ||	}
| ||
}||jd< d|j|j|jtj|jf S )z
        Presign a request using SigV4 query params. Takes in an HTTP request
        and an expiration time in seconds and returns a URL.

        http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html
        Nr   r   z%s/%s/%s/%s/aws4_requestr   r   )zX-Amz-AlgorithmzX-Amz-Credentialr   zX-Amz-ExpiresX-Amz-SignedHeadersr   c                 S   r   r   r|   r}   r   r   r   r     r   z/S3HmacAuthV4Handler.presign.<locals>.<listcomp>r   r  r   z
UNSIGNED-PAYLOADr   zX-Amz-Signaturez%s://%s%s?%s)r   r   r   r   r   r   r   r   rY   rv   r   r   r   r,   r   r   rV   r0   r   r   r   r   r   	urlencode)r   r   expiresiso_dateregionservicer   rv   r   r   r   r   r   r   r   presign  s<   




zS3HmacAuthV4Handler.presignr   )r9   r:   r;   r<   rE   r   r  r   r   r   rv   r   r   r  r   rD   r$  rF   r   r   r@   r   r  I  s    
-*r  c                   @   s.   e Zd ZdZdgZdd Zdd Zdd Zd	S )
STSAnonHandlerz
    Provides pure query construction (no actual signing).

    Used for making anonymous STS request for operations like
    ``assume_role_with_web_identity``.
    zsts-anonc                 C   s   t j|S r   )r   r   r   )r   rx   r   r   r   _escape_value4  s   zSTSAnonHandler._escape_valuec              	   C   sb   t | }|jdd d g }|D ]}tj|| }||d | |d  qd	|S )Nc                 S      |   S r   rt   xr   r   r   <lambda>=      z4STSAnonHandler._build_query_string.<locals>.<lambda>r`   r   r   r   )
r  r   sortr   r[   r   r   r&  r.   r   )r   r   r   r   r`   valr   r   r   _build_query_string;  s    
z"STSAnonHandler._build_query_stringc                 K   s4   |j }| |j}tjd|  d|d< ||_d S )Nzquery_string in body: %sz!application/x-www-form-urlencodedr   )rV   r0  r   r   r]   r^   r   )r   rB   rC   rV   r   r   r   r   rD   D  s   
zSTSAnonHandler.add_authN)r9   r:   r;   r<   rE   r&  r0  rD   r   r   r   r   r%  *  s    	r%  c                   @   s   e Zd ZdZdd ZdS )QuerySignatureHelperzy
    Helper for Query signature based Auth handler.

    Concrete sub class need to implement _calc_sigature method.
    c                 K   s   |j }|j}| jj|d< | j|d< tj |d< | |j|j	|j
|j\}}tjd||f  |j	dkrPd|d< |d tj| |_tt|j|j d	< d S d
|_|jdd |_|jd | d tj| |_d S )NAWSAccessKeyIdSignatureVersion	Timestampquery_string: %s Signature: %sr   r   r   &Signature=r   r   r   r   )rV   r   r   r   r3  r   r[   get_ts_calc_signaturerW   rX   r   r]   r^   r   r   
quote_plusr   r   r   r   r   )r   rB   rC   rV   r   r   r   r   r   r   rD   W  s*   



zQuerySignatureHelper.add_authN)r9   r:   r;   r<   rD   r   r   r   r   r1  P  s    r1  c                   @   s"   e Zd ZdZdZdgZdd ZdS )QuerySignatureV0AuthHandlerzProvides Signature V0 Signingr   zsign-v0c           
      G   s   t jd |  }|d |d  }||d | }|jdd d g }|D ]}t j	|| }|
|d tj|  q*d	|}	|	t| fS )
Nzusing _calc_signature_0Actionr4  r   c                 S   s   t |  | S r   )cmprt   )r*  yr   r   r   r+  z      z=QuerySignatureV0AuthHandler._calc_signature.<locals>.<lambda>)r<  r   r   )r   r]   r^   r*   r,   r!   r   r.  r[   r   r   r   r   r   r   base64	b64encoder-   )
r   r   r  r   rn   r   r   r`   r/  r   r   r   r   r8  t  s   
z+QuerySignatureV0AuthHandler._calc_signatureNr9   r:   r;   r<   r3  rE   r8  r   r   r   r   r:  n  s
    r:  c                   @   s,   e Zd ZdZdZddgZdd Zdd Zd	S )
QuerySignatureV1AuthHandlerz5
    Provides Query Signature V1 Authentication.
    r   zsign-v1mturkc                 O   s:   t j| g|R i | tj| g|R i | d | _d S r   )r1  r   r   r$   )r   r  kwr   r   r   r     s   
z$QuerySignatureV1AuthHandler.__init__c           	      G   s   t jd |  }t| }|jdd d g }|D ]$}||d t j	
|| }|| ||d tj|  qd|}|t| fS )Nzusing _calc_signature_1c                 S   r'  r   r(  r)  r   r   r   r+    r,  z=QuerySignatureV1AuthHandler._calc_signature.<locals>.<lambda>r-  r   r   r   )r   r]   r^   r*   r  r   r.  r,   r!   r[   r   r   r   r   r   r   r?  r@  r-   )	r   r   r  r   r   r   r`   r/  r   r   r   r   r8    s   

z+QuerySignatureV1AuthHandler._calc_signatureN)r9   r:   r;   r<   r3  rE   r   r8  r   r   r   r   rB    s    rB  c                   @   s$   e Zd ZdZdZg dZdd ZdS )QuerySignatureV2AuthHandlerz+Provides Query Signature V2 Authentication.   )zsign-v2ec2rG  emrfpsecssdbiamrdssnssqscloudformationc                 C   s  t jd d|| |f }|  }|  |d< | jjr#| jj|d< t|	 }g }|D ]}	t j
||	 }
|tjj|	ddd tjj|
dd  q-d	|}t jd
|  ||7 }t jd|  ||d t| }t jdt|  t jd|  ||fS )Nzusing _calc_signature_2z	%s
%s
%s
SignatureMethodSecurityTokenr   r   r   r   r   zquery string: %szstring_to_sign: %sr   zlen(b64)=%dzbase64 encoded digest: %s)r   r]   r^   rt   r*   r)   r   rY   r   r   r[   r   r   r   r   r   r   r,   r!   r?  r@  r-   r   )r   r   verbr   server_namer0   r   r   r   r`   r/  r   b64r   r   r   r8    s,   
z+QuerySignatureV2AuthHandler._calc_signatureNrA  r   r   r   r   rE    s
    rE  c                   @   s   e Zd ZdZdgZdd ZdS )POSTPathQSV2AuthHandlerz
    Query Signature V2 Authentication relocating signed query
    into the path and allowing POST requests with Content-Types.
    mwsc                 K   s   | j j|jd< | j|jd< tj |jd< | |j|j|j	|j
\}}tjd||f  |jdkrGtt|j|jd< |jdd|jd< nd	|_|jd
d |_|jd
 | d tj| |_d S )Nr2  r3  r4  r5  r   r   r   z
text/plainr   r   r   r6  )r   r   r   r3  r   r[   r7  r8  rW   rX   r   r]   r^   r   r   r   rV   r   r   r   r   r   r9  )r   r   rC   r   r   r   r   r   rD     s&   


z POSTPathQSV2AuthHandler.add_authN)r9   r:   r;   r<   rE   rD   r   r   r   r   rV    s    rV  c           	   	   C   s   g }t jt|}|D ]}z||| || W q t jjy#   Y qw |s=|}dd |D }t jdt	|t
|f |d S )a  Finds an AuthHandler that is ready to authenticate.

    Lists through all the registered AuthHandlers to find one that is willing
    to handle for the requested capabilities, config and provider.

    :type host: string
    :param host: The name of the host

    :type config:
    :param config:

    :type provider:
    :param provider:

    Returns:
        An implementation of AuthHandler.

    Raises:
        boto.exception.NoAuthHandlerFound
    c                 S   s   g | ]}|j qS r   )r9   )r~   handlerr   r   r   r     r>  z$get_auth_handler.<locals>.<listcomp>zYNo handler was ready to authenticate. %d handlers were checked. %s Check your credentialsr  )r   plugin
get_pluginr   r   r   r   	exceptionNoAuthHandlerFoundr   r   )	r   r   r   requested_capabilityready_handlersauth_handlersrX  checked_handlersnamesr   r   r   get_auth_handler  s"   rb  c                        fdd}|S )Nc                    sj   t jddr
dgS tjdddrdgS t| dr1t| jddr1tD ]}|| jj	v r0dg  S q# | S )	NEC2_USE_SIGV4Fr   rG  	use-sigv4r"  endpointr   )
osenvironr   r   r   r   getattrr"  SIGV4_DETECTrf  )r   testfuncr   r   _wrapper  s   

z(detect_potential_sigv4.<locals>._wrapperr   rm  rn  r   rl  r   detect_potential_sigv4  s   rp  c                    rc  )Nc                    s   t jddr
dgS tjdddrdgS t ds S tD ]}| jv r,dg  S q  j} jdr< jdr@d| }t	|j
}|d	sS|d
sS S |dr\ S t fddtD rk S t drw jrw S dgS )NS3_USE_SIGV4Fr  rI   re  r   zhttp://zhttps://zamazonaws.comzamazonaws.com.cnzs3.amazonaws.comc                 3   s    | ]}| j v V  qd S r   )r   )r~   rk  r(   r   r   	<genexpr>A  s    z=detect_potential_s3sigv4.<locals>._wrapper.<locals>.<genexpr>r>   )rg  rh  r   r   r   r   rj  r   ru   r   netlocr   anyS3_AUTH_DETECTr>   )r   rk  r   rs  rl  r(   r   rn  "  s6   






z*detect_potential_s3sigv4.<locals>._wrapperr   ro  r   rl  r   detect_potential_s3sigv4!  s   )rv  r   ).r<   r?  r   boto.auth_handlerboto.exceptionboto.plugin
boto.utilsr3   r   email.utilsr   r   rg  r   boto.compatr   r   r   r   r   r   hashlibr	   r"   r
   ImportErrorru  rj  objectr   r=   rH   re   rg   ro   r   r  r%  r1  r:  rB  rE  rV  rb  rp  rv  r   r   r   r   <module>   sZ   1#K   b&
2