
    ]gGc                     <   S SK r S SKJr  S SKJrJrJrJrJrJ	r	  S SK
JrJrJrJrJr  S SKJr  S SKJr  S SKJr   " S S	\5      r " S
 S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r\\\\\\\S.rg)    N)BytesIO)SIGNED_HEADERS_BLACKLIST"STREAMING_UNSIGNED_PAYLOAD_TRAILERUNSIGNED_PAYLOAD
BaseSigner_get_body_as_dict_host_from_url)HTTPHeadersawscrtparse_qsurlsplit
urlunsplit)NoCredentialsError)register_feature_id)percent_encode_sequencec                       \ rS rSrSr/ SQr\R                  R                  R                  r
SrSrS rS rS rS rS rS	 rS
 rS rS rS rSrg)CrtSigV4Auth   TAuthorizationz
X-Amz-DateX-Amz-Content-SHA256zX-Amz-Security-Tokenc                 6    Xl         X l        X0l        S U l        g Ncredentials_service_name_region_name_expiration_in_secondsselfr   service_nameregion_names       3/usr/lib/python3/dist-packages/botocore/crt/auth.py__init__CrtSigV4Auth.__init__+       &)'&*#    c                     UR                   R                  S0 5      nUR                  S5      n[        U[        5      =(       a    UR                  S5      S:H  $ Nchecksumrequest_algorithmintrailercontextget
isinstancedictr    requestchecksum_context	algorithms       r#   _is_streaming_checksum_payload+CrtSigV4Auth._is_streaming_checksum_payload1   J    "??..z2>$(()<=	)T*Oy}}T/Bi/OOr'   c                    U R                   c
  [        5       e[        R                  R                  5       R	                  [        R
                  R                  S9nU R                  U5      nU R                  U5        [        R                  R                  R                  U R                   R                  U R                   R                  U R                   R                  S9nU R!                  U5      (       a  ["        nO)U R%                  U5      (       a  U(       a  UnO	S nO[&        nU R)                  U5      (       a%  [        R                  R*                  R,                  nO$[        R                  R*                  R.                  n[        R                  R1                  [        R                  R2                  R4                  U R6                  UU R8                  U R:                  UU R<                  U R>                  U R@                  UUU RB                  S9nU RE                  U5      n[        R                  RG                  X5      n	U	RI                  5         U RK                  X5        g )Ntzinfoaccess_key_idsecret_access_keysession_tokenr6   signature_typecredentials_providerregionservicedateshould_sign_headeruse_double_uri_encodeshould_normalize_uri_pathsigned_body_valuesigned_body_header_typeexpiration_in_seconds)&r   r   datetimeutcnowreplacetimezoneutc_get_existing_sha256_modify_request_before_signingr   authAwsCredentialsProvider
new_static
access_key
secret_keytokenr7   r   _should_sha256_sign_payloadr   !_should_add_content_sha256_headerAwsSignedBodyHeaderTypeX_AMZ_CONTENT_SHA_256NONEAwsSigningConfigAwsSigningAlgorithmV4_SIGNATURE_TYPEr   r   _should_sign_header_USE_DOUBLE_URI_ENCODE_SHOULD_NORMALIZE_URI_PATHr   _crt_request_from_aws_requestaws_sign_requestresult_apply_signing_changes
r    r4   datetime_nowexisting_sha256rC   explicit_payloadbody_headersigning_configcrt_requestfutures
             r#   add_authCrtSigV4Auth.add_auth6   s   #$&&  ((//199$$(( : 

 33G<++G4%{{AALL**55"..99**00  M  
 ..w77A--g66#2 #' /112BCC33II  !++==BBK55kk5588//!5$$&&#77"&"="=&*&E&E.$/"&"="= 6 
 88A--kJ##G9r'   c                    [        UR                  5      nUR                  (       a  UR                  OSnUR                  (       a^  / nUR                  R	                  5        H&  u  pV[        U5      nUR                  U SU 35        M(     US-   SR                  U5      -   nO"UR                  (       a  U SUR                   3n[        R                  R                  UR                  R	                  5       5      nS nUR                  (       a=  [        UR                  S5      (       a  UR                  nO[        UR                  5      n[        R                  R!                  UR"                  UUUS9n	U	$ N/=?&seek)methodpathheadersbody_streamr   urlr|   paramsitemsstrappendjoinqueryr   httpHttpHeadersr}   bodyhasattrr   HttpRequestr{   
r    aws_request	url_partscrt_patharrayparamvaluecrt_headerscrt_body_streamrp   s
             r#   rf   *CrtSigV4Auth._crt_request_from_aws_requesto   2   [__-	%.^^9>>E + 2 2 8 8 :E
waw/0 !;  #~7H__"1Y__$56Hkk--k.A.A.G.G.IJ {''00"-"2"2")+*:*:";kk--%%'	 . 
 r'   c                 `    [         R                  " [        UR                  5      5      Ul        g r   r
   
from_pairslistr}   r    r   signed_crt_requests      r#   ri   #CrtSigV4Auth._apply_signing_changes   $    )44#++,
r'   c                 0    UR                  5       [        ;  $ r   lowerr   r    namekwargss      r#   rc    CrtSigV4Auth._should_sign_header       zz|#;;;r'   c                     U R                    H!  nX!R                  ;   d  M  UR                  U	 M#     SUR                  ;  a#  [        UR                  5      UR                  S'   g g Nhost_PRESIGNED_HEADERS_BLOCKLISTr}   r	   r   r    r4   hs      r#   rS   +CrtSigV4Auth._modify_request_before_signing   T     22AOO#OOA& 3 (&4W[[&AGOOF# )r'   c                 8    UR                   R                  S5      $ Nr   r}   r0   r    r4   s     r#   rR   !CrtSigV4Auth._get_existing_sha256       ""#9::r'   c                 |    UR                   R                  S5      (       d  gUR                  R                  SS5      $ NhttpsTpayload_signing_enabledr   
startswithr/   r0   r   s     r#   rZ   (CrtSigV4Auth._should_sha256_sign_payload   4    {{%%g..
 ""#<dCCr'   c                 
    US L$ r    r    rm   s     r#   r[   .CrtSigV4Auth._should_add_content_sha256_header       t++r'   r   r   r   r   N)__name__
__module____qualname____firstlineno__REQUIRES_REGIONr   r   rT   AwsSignatureTypeHTTP_REQUEST_HEADERSrb   rd   re   r$   r7   rr   rf   ri   rc   rS   rR   rZ   r[   __static_attributes__r   r'   r#   r   r      sh    O$  kk22GGO!!%+P
7:r<
<B;D,r'   r   c                   <   ^  \ rS rSrSrSrS rU 4S jrS rSr	U =r
$ )CrtS3SigV4Auth   Fc                     g r   r   r   s     r#   rR   #CrtS3SigV4Auth._get_existing_sha256       r'   c                 
  > UR                   R                  S5      n[        USS 5      nUc  0 nUR                  SS 5      nUb  U$ SnUR                   R                  S0 5      nUR                  S5      n[        U[        5      (       a  UR                  S5      S:X  a  US	   nUR
                  R                  S
5      (       a  XQR                  ;  a  gUR                   R                  SS5      (       a  g[        TU ]%  U5      $ )Nclient_configs3r   Content-MD5r*   r+   r,   headerr   r   Thas_streaming_inputF)
r/   r0   getattrr1   r2   r   r   r}   superrZ   )	r    r4   r   	s3_configsign_payloadchecksum_headerr5   r6   	__class__s	           r#   rZ   *CrtS3SigV4Auth._should_sha256_sign_payload   s      ++O<M46	 I !}}%>E# ("??..z2>$(()<=	i&&9==+>(+J'/O&&w//oo5 ??4e<< w27;;r'   c                     gNTr   r   s     r#   r[   0CrtS3SigV4Auth._should_add_content_sha256_header   r   r'   r   r   r   r   r   rd   re   rR   rZ   r[   r   __classcell__r   s   @r#   r   r      s$    "!&'<R r'   r   c                       \ rS rSrSr/ SQr\R                  R                  R                  r
SrSrS rS rS rS rS rS	 rS
 rS rS rS rSrg)CrtSigV4AsymAuth   Tr   c                 6    Xl         X l        X0l        S U l        g r   r   r   s       r#   r$   CrtSigV4AsymAuth.__init__   r&   r'   c                    [        S5        U R                  c
  [        5       e[        R                  R	                  5       R                  [        R                  R                  S9nU R                  U5      nU R                  U5        [        R                  R                  R                  U R                  R                  U R                  R                  U R                  R                   S9nU R#                  U5      (       a  [$        nO)U R'                  U5      (       a  U(       a  UnO	S nO[(        nU R+                  U5      (       a%  [        R                  R,                  R.                  nO$[        R                  R,                  R0                  n[        R                  R3                  [        R                  R4                  R6                  U R8                  UU R:                  U R<                  UU R>                  U R@                  U RB                  UUU RD                  S9nU RG                  U5      n[        R                  RI                  X5      n	U	RK                  5         U RM                  X5        g )NSIGV4A_SIGNINGr;   r=   rA   )'r   r   r   rM   rN   rO   rP   rQ   rR   rS   r   rT   rU   rV   rW   rX   rY   r7   r   rZ   r   r[   r\   r]   r^   r_   r`   V4_ASYMMETRICrb   r   r   rc   rd   re   r   rf   rg   rh   ri   rj   s
             r#   rr   CrtSigV4AsymAuth.add_auth   s   ,-#$&&  ((//199$$(( : 

 33G<++G4%{{AALL**55"..99**00  M  
 ..w77A--g66#2 #' /112BCC33II  !++==BBK55kk55CC//!5$$&&#77"&"="=&*&E&E.$/"&"="= 6 
 88A--kJ##G9r'   c                    [        UR                  5      nUR                  (       a  UR                  OSnUR                  (       a^  / nUR                  R	                  5        H&  u  pV[        U5      nUR                  U SU 35        M(     US-   SR                  U5      -   nO"UR                  (       a  U SUR                   3n[        R                  R                  UR                  R	                  5       5      nS nUR                  (       a=  [        UR                  S5      (       a  UR                  nO[        UR                  5      n[        R                  R!                  UR"                  UUUS9n	U	$ ru   r   r   s
             r#   rf   .CrtSigV4AsymAuth._crt_request_from_aws_request5  r   r'   c                 `    [         R                  " [        UR                  5      5      Ul        g r   r   r   s      r#   ri   'CrtSigV4AsymAuth._apply_signing_changesS  r   r'   c                 0    UR                  5       [        ;  $ r   r   r   s      r#   rc   $CrtSigV4AsymAuth._should_sign_headerY  r   r'   c                     U R                    H!  nX!R                  ;   d  M  UR                  U	 M#     SUR                  ;  a#  [        UR                  5      UR                  S'   g g r   r   r   s      r#   rS   /CrtSigV4AsymAuth._modify_request_before_signing\  r   r'   c                 8    UR                   R                  S5      $ r   r   r   s     r#   rR   %CrtSigV4AsymAuth._get_existing_sha256f  r   r'   c                     UR                   R                  S0 5      nUR                  S5      n[        U[        5      =(       a    UR                  S5      S:H  $ r)   r.   r3   s       r#   r7   /CrtSigV4AsymAuth._is_streaming_checksum_payloadi  r9   r'   c                 |    UR                   R                  S5      (       d  gUR                  R                  SS5      $ r   r   r   s     r#   rZ   ,CrtSigV4AsymAuth._should_sha256_sign_payloadn  r   r'   c                 
    US L$ r   r   r   s     r#   r[   2CrtSigV4AsymAuth._should_add_content_sha256_headerx  r   r'   r   N)r   r   r   r   r   r   r   rT   r   r   rb   rd   re   r$   rr   rf   ri   rc   rS   rR   r7   rZ   r[   r   r   r'   r#   r   r      sh    O$  kk22GGO!!%+8:t<
<B;P
D,r'   r   c                   <   ^  \ rS rSrSrSrS rU 4S jrS rSr	U =r
$ )CrtS3SigV4AsymAuthi}  Fc                     g r   r   r   s     r#   rR   'CrtS3SigV4AsymAuth._get_existing_sha256  r   r'   c                 P  > UR                   R                  S5      n[        USS 5      nUc  0 nUR                  SS 5      nUb  U$ UR                  R	                  S5      (       a  SUR
                  ;  a  gUR                   R                  SS5      (       a  g[        TU ]  U5      $ )	Nr   r   r   r   r   Tr   F)r/   r0   r   r   r   r}   r   rZ   )r    r4   r   r   r   r   s        r#   rZ   .CrtS3SigV4AsymAuth._should_sha256_sign_payload  s      ++O<M46	 I !}}%>E# &&w//GOO3 ??4e<< w27;;r'   c                     gr   r   r   s     r#   r[   4CrtS3SigV4AsymAuth._should_add_content_sha256_header  r   r'   r   r   r   s   @r#   r   r   }  s$    "!&"<H r'   r   c                      ^  \ rS rSrSr\R                  R                  R                  r	\4U 4S jjr
U 4S jrU 4S jrSrU =r$ )CrtSigV4AsymQueryAuthi    c                 2   > [         TU ]  XU5        X@l        g r   r   r$   r   r    r   r!   r"   expiresr   s        r#   r$   CrtSigV4AsymQueryAuth.__init__       	K@&-#r'   c                   > [         TU ]  U5        UR                  R                  S5      nUS:X  a  UR                  S	 [	        UR
                  5      n[        UR                  SS9nUR                  5        VVs0 s H
  u  pVXVS   _M     nnnUR                  (       a!  UR                  [        U5      5        SUl	        [        U5      nUn	U	S   U	S   U	S   XS	   4n
[        U
5      Ul        g s  snnf 
Nzcontent-typez0application/x-www-form-urlencoded; charset=utf-8T)keep_blank_valuesr             )r   rS   r}   r0   r   r   r   r   r   dataupdater   r   r   )r    r4   content_typer   query_string_partskv
query_dictnew_query_stringpnew_url_partsr   s              r#   rS   4CrtSigV4AsymQueryAuth._modify_request_before_signing  s    .w7 **>:MM/ W[[)	 &iooN*<*B*B*DE*D$!a1g*D
E << /89GL2:> 1qtQqT+;qTB /1 Fs   ;C1c                    > [         TU ]  X5        [        UR                  5      R                  n[        UR
                  5      n[        US   US   US   X4S   45      Ul        g Nr   r  r  r  r   ri   r   r|   r   r   r   r    r   r   signed_queryr  r   s        r#   ri   ,CrtSigV4AsymQueryAuth._apply_signing_changes  \    &{G 2 7 78>>[__% %adAaD!A$d%KLr'   r   r   r   r   r   DEFAULT_EXPIRESr   rT   r   HTTP_REQUEST_QUERY_PARAMSrb   r$   rS   ri   r   r   r   s   @r#   r  r    s:    Okk22LLO ?N.(0TM Mr'   r  c                   ,    \ rS rSrSrSrSrS rS rSr	g)CrtS3SigV4AsymQueryAuthi  zS3 SigV4A auth using query parameters.
This signer will sign a request using query parameters and signature
version 4A, i.e a "presigned url" signer.
Fc                     gNFr   r   s     r#   rZ   3CrtS3SigV4AsymQueryAuth._should_sha256_sign_payload      
 r'   c                     gr/  r   r   s     r#   r[   9CrtS3SigV4AsymQueryAuth._should_add_content_sha256_header      r'   r   N
r   r   r   r   __doc__rd   re   rZ   r[   r   r   r'   r#   r-  r-    s     #!&r'   r-  c                      ^  \ rS rSrSr\R                  R                  R                  r	\4U 4S jjr
U 4S jrU 4S jrSrU =r$ )CrtSigV4QueryAuthi
  r  c                 2   > [         TU ]  XU5        X@l        g r   r
  r  s        r#   r$   CrtSigV4QueryAuth.__init__  r  r'   c                 P  > [         T
U ]  U5        UR                  R                  S5      nUS:X  a  UR                  S	 [	        UR
                  5      n[        UR                  SS9R                  5        VVs0 s H
  u  pEXES   _M     nnnUR                  (       a"  UR                  UR                  5        0 Ul	        UR                  (       a!  UR                  [        U5      5        SUl        [        U5      nUnUS   US   US   XxS	   4n	[        U	5      Ul        g s  snnf r  )r   rS   r}   r0   r   r   r   r   r   r   r  r  r   r   r   )r    r4   r  r   r  r  r  r  r  r  r   s             r#   rS   0CrtSigV4QueryAuth._modify_request_before_signing  s   .w7 **>:MM/ W[[)	 !4eg
 tG 	 
 >>gnn-GN << /89GL2:> 1qtQqT+;qTB /?
s   9D"c                    > [         TU ]  X5        [        UR                  5      R                  n[        UR
                  5      n[        US   US   US   X4S   45      Ul        g r"  r#  r$  s        r#   ri   (CrtSigV4QueryAuth._apply_signing_changesD  r'  r'   r(  r)  r   s   @r#   r8  r8  
  s:    Okk22LLO ?N..0`M Mr'   r8  c                   ,    \ rS rSrSrSrSrS rS rSr	g)CrtS3SigV4QueryAuthiU  zS3 SigV4 auth using query parameters.
This signer will sign a request using query parameters and signature
version 4, i.e a "presigned url" signer.
Based off of:
http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html
Fc                     gr/  r   r   s     r#   rZ   /CrtS3SigV4QueryAuth._should_sha256_sign_payloada  r1  r'   c                     gr/  r   r   s     r#   r[   5CrtS3SigV4QueryAuth._should_add_content_sha256_headerh  r4  r'   r   Nr5  r   r'   r#   r@  r@  U  s     #!&r'   r@  )v4zv4-queryv4as3v4z
s3v4-querys3v4azs3v4a-query)rM   ior   botocore.authr   r   r   r   r   r	   botocore.compatr
   r   r   r   r   botocore.exceptionsr   botocore.useragentr   botocore.utilsr   r   r   r   r   r  r-  r8  r@  CRT_AUTH_TYPE_MAPSr   r'   r#   <module>rP     s       P O 2 2 2P,: P,f4\ 4nQ,z Q,h/) /dBM, BMJ3 ,HM HMV+ 6 !%* r'   