
    b                     0   S SK r S SKJr  S SKJrJrJrJrJrJ	r	  S SK
JrJrJrJrJr  S SKJr  S SKJr   " S S\5      r " S	 S
\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r " S S\5      r\\\\\\\S.rg)    N)BytesIO)SIGNED_HEADERS_BLACKLIST"STREAMING_UNSIGNED_PAYLOAD_TRAILERUNSIGNED_PAYLOAD
BaseSigner_get_body_as_dict_host_from_url)HTTPHeadersawscrtparse_qsurlsplit
urlunsplit)NoCredentialsError)percent_encode_sequencec                       \ rS rSrSr/ SQr\R                  R                  R                  r
SrSrS rS rS rS rS rS	 rS
 rS rS rS rSrg)CrtSigV4Auth   TAuthorizationz
X-Amz-DateX-Amz-Content-SHA256zX-Amz-Security-Tokenc                 6    Xl         X l        X0l        S U l        g Ncredentials_service_name_region_name_expiration_in_secondsselfr   service_nameregion_names       $lib/third_party/botocore/crt/auth.py__init__CrtSigV4Auth.__init__*       &)'&*#    c                     UR                   R                  S0 5      nUR                  S5      n[        U[        5      =(       a    UR                  S5      S:H  $ Nchecksumrequest_algorithmintrailercontextget
isinstancedictr   requestchecksum_context	algorithms       r"   _is_streaming_checksum_payload+CrtSigV4Auth._is_streaming_checksum_payload0   J    "??..z2>$(()<=	)T*Oy}}T/Bi/OOr&   c                    U R                   c
  [        5       e[        R                  R                  5       R	                  [        R
                  R                  S9nU R                  U5      nU R                  U5        [        R                  R                  R                  U R                   R                  U R                   R                  U R                   R                  S9nU R!                  U5      (       a  ["        nO)U R%                  U5      (       a  U(       a  UnO	S nO[&        nU R)                  U5      (       a%  [        R                  R*                  R,                  nO$[        R                  R*                  R.                  n[        R                  R1                  [        R                  R2                  R4                  U R6                  UU R8                  U R:                  UU R<                  U R>                  U R@                  UUU RB                  S9nU RE                  U5      n[        R                  RG                  X5      n	U	RI                  5         U RK                  X5        g N)tzinfo)access_key_idsecret_access_keysession_token)r5   signature_typecredentials_providerregionservicedateshould_sign_headeruse_double_uri_encodeshould_normalize_uri_pathsigned_body_valuesigned_body_header_typeexpiration_in_seconds)&r   r   datetimeutcnowreplacetimezoneutc_get_existing_sha256_modify_request_before_signingr   authAwsCredentialsProvider
new_static
access_key
secret_keytokenr6   r   _should_sha256_sign_payloadr   !_should_add_content_sha256_headerAwsSignedBodyHeaderTypeX_AMZ_CONTENT_SHA_256NONEAwsSigningConfigAwsSigningAlgorithmV4_SIGNATURE_TYPEr   r   _should_sign_header_USE_DOUBLE_URI_ENCODE_SHOULD_NORMALIZE_URI_PATHr   _crt_request_from_aws_requestaws_sign_requestresult_apply_signing_changes
r   r3   datetime_nowexisting_sha256r@   explicit_payloadbody_headersigning_configcrt_requestfutures
             r"   add_authCrtSigV4Auth.add_auth5   s   #$&&  ((//199$$(( : 

 33G<++G4%{{AALL**55"..99**00  M  
 ..w77A--g66#2 #' /112BCC33II  !++==BBK55kk5588//!5$$&&#77"&"="=&*&E&E.$/"&"="= 6 
 88A--kJ##G9r&   c                    [        UR                  5      nUR                  (       a  UR                  OSnUR                  (       a^  / nUR                  R	                  5        H&  u  pV[        U5      nUR                  U SU 35        M(     US-   SR                  U5      -   nO"UR                  (       a  U SUR                   3n[        R                  R                  UR                  R	                  5       5      nS nUR                  (       a=  [        UR                  S5      (       a  UR                  nO[        UR                  5      n[        R                  R!                  UR"                  UUUS9n	U	$ N/=?&seek)methodpathheadersbody_streamr   urlry   paramsitemsstrappendjoinqueryr   httpHttpHeadersrz   bodyhasattrr   HttpRequestrx   
r   aws_request	url_partscrt_patharrayparamvaluecrt_headerscrt_body_streamrm   s
             r"   rc   *CrtSigV4Auth._crt_request_from_aws_requestn   2   [__-	%.^^9>>E + 2 2 8 8 :E
waw/0 !;  #~7H__"1Y__$56Hkk--k.A.A.G.G.IJ {''00"-"2"2")+*:*:";kk--%%'	 . 
 r&   c                 `    [         R                  " [        UR                  5      5      Ul        g r   r
   
from_pairslistrz   r   r   signed_crt_requests      r"   rf   #CrtSigV4Auth._apply_signing_changes   $    )44#++,
r&   c                 0    UR                  5       [        ;  $ r   lowerr   r   namekwargss      r"   r`    CrtSigV4Auth._should_sign_header       zz|#;;;r&   c                     U R                    H!  nX!R                  ;   d  M  UR                  U	 M#     SUR                  ;  a#  [        UR                  5      UR                  S'   g g Nhost_PRESIGNED_HEADERS_BLOCKLISTrz   r	   r}   r   r3   hs      r"   rP   +CrtSigV4Auth._modify_request_before_signing   T     22AOO#OOA& 3 (&4W[[&AGOOF# )r&   c                 8    UR                   R                  S5      $ Nr   rz   r/   r   r3   s     r"   rO   !CrtSigV4Auth._get_existing_sha256       ""#9::r&   c                 |    UR                   R                  S5      (       d  gUR                  R                  SS5      $ NhttpsTpayload_signing_enabledr}   
startswithr.   r/   r   s     r"   rW   (CrtSigV4Auth._should_sha256_sign_payload   4    {{%%g..
 ""#<dCCr&   c                 
    US L$ r    r   rj   s     r"   rX   .CrtSigV4Auth._should_add_content_sha256_header       t++r&   r   r   r   r   N)__name__
__module____qualname____firstlineno__REQUIRES_REGIONr   r   rQ   AwsSignatureTypeHTTP_REQUEST_HEADERSr_   ra   rb   r#   r6   ro   rc   rf   r`   rP   rO   rW   rX   __static_attributes__r   r&   r"   r   r      sh    O$  kk22GGO!!%+P
7:r<
<B;D,r&   r   c                   <   ^  \ rS rSrSrSrS rU 4S jrS rSr	U =r
$ )CrtS3SigV4Auth   Fc                     g r   r   r   s     r"   rO   #CrtS3SigV4Auth._get_existing_sha256       r&   c                 
  > UR                   R                  S5      n[        USS 5      nUc  0 nUR                  SS 5      nUb  U$ SnUR                   R                  S0 5      nUR                  S5      n[        U[        5      (       a  UR                  S5      S:X  a  US	   nUR
                  R                  S
5      (       a  XQR                  ;  a  gUR                   R                  SS5      (       a  g[        TU ]%  U5      $ )Nclient_configs3r   Content-MD5r)   r*   r+   headerr   r   Thas_streaming_inputF)
r.   r/   getattrr0   r1   r}   r   rz   superrW   )	r   r3   r   	s3_configsign_payloadchecksum_headerr4   r5   	__class__s	           r"   rW   *CrtS3SigV4Auth._should_sha256_sign_payload   s      ++O<M46	 I !}}%>E# ("??..z2>$(()<=	i&&9==+>(+J'/O&&w//oo5 ??4e<< w27;;r&   c                     gNTr   r   s     r"   rX   0CrtS3SigV4Auth._should_add_content_sha256_header   r   r&   r   r   r   r   r   ra   rb   rO   rW   rX   r   __classcell__r   s   @r"   r   r      s$    "!&'<R r&   r   c                       \ rS rSrSr/ SQr\R                  R                  R                  r
SrSrS rS rS rS rS rS	 rS
 rS rS rS rSrg)CrtSigV4AsymAuth   Tr   c                 6    Xl         X l        X0l        S U l        g r   r   r   s       r"   r#   CrtSigV4AsymAuth.__init__   r%   r&   c                    U R                   c
  [        5       e[        R                  R                  5       R	                  [        R
                  R                  S9nU R                  U5      nU R                  U5        [        R                  R                  R                  U R                   R                  U R                   R                  U R                   R                  S9nU R!                  U5      (       a  ["        nO)U R%                  U5      (       a  U(       a  UnO	S nO[&        nU R)                  U5      (       a%  [        R                  R*                  R,                  nO$[        R                  R*                  R.                  n[        R                  R1                  [        R                  R2                  R4                  U R6                  UU R8                  U R:                  UU R<                  U R>                  U R@                  UUU RB                  S9nU RE                  U5      n[        R                  RG                  X5      n	U	RI                  5         U RK                  X5        g r:   )&r   r   rJ   rK   rL   rM   rN   rO   rP   r   rQ   rR   rS   rT   rU   rV   r6   r   rW   r   rX   rY   rZ   r[   r\   r]   V4_ASYMMETRICr_   r   r   r`   ra   rb   r   rc   rd   re   rf   rg   s
             r"   ro   CrtSigV4AsymAuth.add_auth   s   #$&&  ((//199$$(( : 

 33G<++G4%{{AALL**55"..99**00  M  
 ..w77A--g66#2 #' /112BCC33II  !++==BBK55kk55CC//!5$$&&#77"&"="=&*&E&E.$/"&"="= 6 
 88A--kJ##G9r&   c                    [        UR                  5      nUR                  (       a  UR                  OSnUR                  (       a^  / nUR                  R	                  5        H&  u  pV[        U5      nUR                  U SU 35        M(     US-   SR                  U5      -   nO"UR                  (       a  U SUR                   3n[        R                  R                  UR                  R	                  5       5      nS nUR                  (       a=  [        UR                  S5      (       a  UR                  nO[        UR                  5      n[        R                  R!                  UR"                  UUUS9n	U	$ rr   r|   r   s
             r"   rc   .CrtSigV4AsymAuth._crt_request_from_aws_request3  r   r&   c                 `    [         R                  " [        UR                  5      5      Ul        g r   r   r   s      r"   rf   'CrtSigV4AsymAuth._apply_signing_changesQ  r   r&   c                 0    UR                  5       [        ;  $ r   r   r   s      r"   r`   $CrtSigV4AsymAuth._should_sign_headerW  r   r&   c                     U R                    H!  nX!R                  ;   d  M  UR                  U	 M#     SUR                  ;  a#  [        UR                  5      UR                  S'   g g r   r   r   s      r"   rP   /CrtSigV4AsymAuth._modify_request_before_signingZ  r   r&   c                 8    UR                   R                  S5      $ r   r   r   s     r"   rO   %CrtSigV4AsymAuth._get_existing_sha256d  r   r&   c                     UR                   R                  S0 5      nUR                  S5      n[        U[        5      =(       a    UR                  S5      S:H  $ r(   r-   r2   s       r"   r6   /CrtSigV4AsymAuth._is_streaming_checksum_payloadg  r8   r&   c                 |    UR                   R                  S5      (       d  gUR                  R                  SS5      $ r   r   r   s     r"   rW   ,CrtSigV4AsymAuth._should_sha256_sign_payloadl  r   r&   c                 
    US L$ r   r   r   s     r"   rX   2CrtSigV4AsymAuth._should_add_content_sha256_headerv  r   r&   r   N)r   r   r   r   r   r   r   rQ   r   r   r_   ra   rb   r#   ro   rc   rf   r`   rP   rO   r6   rW   rX   r   r   r&   r"   r   r      sh    O$  kk22GGO!!%+7:r<
<B;P
D,r&   r   c                   <   ^  \ rS rSrSrSrS rU 4S jrS rSr	U =r
$ )CrtS3SigV4AsymAuthi{  Fc                     g r   r   r   s     r"   rO   'CrtS3SigV4AsymAuth._get_existing_sha256  r   r&   c                 P  > UR                   R                  S5      n[        USS 5      nUc  0 nUR                  SS 5      nUb  U$ UR                  R	                  S5      (       a  SUR
                  ;  a  gUR                   R                  SS5      (       a  g[        TU ]  U5      $ )	Nr   r   r   r   r   Tr   F)r.   r/   r   r}   r   rz   r   rW   )r   r3   r   r   r   r   s        r"   rW   .CrtS3SigV4AsymAuth._should_sha256_sign_payload  s      ++O<M46	 I !}}%>E# &&w//GOO3 ??4e<< w27;;r&   c                     gr   r   r   s     r"   rX   4CrtS3SigV4AsymAuth._should_add_content_sha256_header  r   r&   r   r   r   s   @r"   r   r   {  s$    "!&"<H r&   r   c                      ^  \ rS rSrSr\R                  R                  R                  r	\4U 4S jjr
U 4S jrU 4S jrSrU =r$ )CrtSigV4AsymQueryAuthi    c                 2   > [         TU ]  XU5        X@l        g r   r   r#   r   r   r   r    r!   expiresr   s        r"   r#   CrtSigV4AsymQueryAuth.__init__       	K@&-#r&   c                   > [         TU ]  U5        UR                  R                  S5      nUS:X  a  UR                  S	 [	        UR
                  5      n[        UR                  SS9nUR                  5        VVs0 s H
  u  pVXVS   _M     nnnUR                  (       a!  UR                  [        U5      5        SUl	        [        U5      nUn	U	S   U	S   U	S   XS	   4n
[        U
5      Ul        g s  snnf 
Nzcontent-typez0application/x-www-form-urlencoded; charset=utf-8T)keep_blank_valuesr             )r   rP   rz   r/   r   r}   r   r   r   dataupdater   r   r   )r   r3   content_typer   query_string_partskv
query_dictnew_query_stringpnew_url_partsr   s              r"   rP   4CrtSigV4AsymQueryAuth._modify_request_before_signing  s    .w7 **>:MM/ W[[)	 &iooN*<*B*B*DE*D$!a1g*D
E << /89GL2:> 1qtQqT+;qTB /1 Fs   ;C1c                    > [         TU ]  X5        [        UR                  5      R                  n[        UR
                  5      n[        US   US   US   X4S   45      Ul        g Nr   r  r  r  r   rf   r   ry   r   r}   r   r   r   r   signed_queryr  r   s        r"   rf   ,CrtSigV4AsymQueryAuth._apply_signing_changes  \    &{G 2 7 78>>[__% %adAaD!A$d%KLr&   r   r   r   r   r   DEFAULT_EXPIRESr   rQ   r   HTTP_REQUEST_QUERY_PARAMSr_   r#   rP   rf   r   r   r   s   @r"   r  r    s:    Okk22LLO ?N.(0TM Mr&   r  c                   ,    \ rS rSrSrSrSrS rS rSr	g)CrtS3SigV4AsymQueryAuthi  zS3 SigV4A auth using query parameters.
This signer will sign a request using query parameters and signature
version 4A, i.e a "presigned url" signer.
Fc                     gNFr   r   s     r"   rW   3CrtS3SigV4AsymQueryAuth._should_sha256_sign_payload      
 r&   c                     gr+  r   r   s     r"   rX   9CrtS3SigV4AsymQueryAuth._should_add_content_sha256_header      r&   r   N
r   r   r   r   __doc__ra   rb   rW   rX   r   r   r&   r"   r)  r)    s     #!&r&   r)  c                      ^  \ rS rSrSr\R                  R                  R                  r	\4U 4S jjr
U 4S jrU 4S jrSrU =r$ )CrtSigV4QueryAuthi  r  c                 2   > [         TU ]  XU5        X@l        g r   r  r  s        r"   r#   CrtSigV4QueryAuth.__init__  r
  r&   c                 P  > [         T
U ]  U5        UR                  R                  S5      nUS:X  a  UR                  S	 [	        UR
                  5      n[        UR                  SS9R                  5        VVs0 s H
  u  pEXES   _M     nnnUR                  (       a"  UR                  UR                  5        0 Ul	        UR                  (       a!  UR                  [        U5      5        SUl        [        U5      nUnUS   US   US   XxS	   4n	[        U	5      Ul        g s  snnf r  )r   rP   rz   r/   r   r}   r   r   r   r~   r  r  r   r   r   )r   r3   r  r   r  r  r  r  r  r  r   s             r"   rP   0CrtSigV4QueryAuth._modify_request_before_signing  s   .w7 **>:MM/ W[[)	 !4eg
 tG 	 
 >>gnn-GN << /89GL2:> 1qtQqT+;qTB /?
s   9D"c                    > [         TU ]  X5        [        UR                  5      R                  n[        UR
                  5      n[        US   US   US   X4S   45      Ul        g r  r  r   s        r"   rf   (CrtSigV4QueryAuth._apply_signing_changesB  r#  r&   r$  r%  r   s   @r"   r4  r4    s:    Okk22LLO ?N..0`M Mr&   r4  c                   ,    \ rS rSrSrSrSrS rS rSr	g)CrtS3SigV4QueryAuthiS  zS3 SigV4 auth using query parameters.
This signer will sign a request using query parameters and signature
version 4, i.e a "presigned url" signer.
Based off of:
http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html
Fc                     gr+  r   r   s     r"   rW   /CrtS3SigV4QueryAuth._should_sha256_sign_payload_  r-  r&   c                     gr+  r   r   s     r"   rX   5CrtS3SigV4QueryAuth._should_add_content_sha256_headerf  r0  r&   r   Nr1  r   r&   r"   r<  r<  S  s     #!&r&   r<  )v4zv4-queryv4as3v4z
s3v4-querys3v4azs3v4a-query)rJ   ior   botocore.authr   r   r   r   r   r	   botocore.compatr
   r   r   r   r   botocore.exceptionsr   botocore.utilsr   r   r   r   r   r  r)  r4  r<  CRT_AUTH_TYPE_MAPSr   r&   r"   <module>rK     s       P O 2 2P,: P,f4\ 4nP,z P,f/) /dBM, BMJ3 ,HM HMV+ 6 !%* r&   