U
    d/e^                      @   s   d Z ddlZddlZddlZddlmZ ddlmZ ddlm	Z	 ddl
mZmZ dZed	Zd+ddZdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd  Zd!d" Zd#d$ Zd%d& Zd'd( Zd)d* ZdS ),z
minio.signer
~~~~~~~~~~~~~~~

This module implements all helpers for AWS Signature version '4' support.

:copyright: (c) 2015 by MinIO, Inc.
:license: Apache 2.0, see LICENSE for more details.

    N)OrderedDict)SplitResult   )time)queryencodesha256_hashzAWS4-HMAC-SHA256z( +)Fc                 C   s$   t | |tj}|r| S | S )z/Return HMacSHA256 digest of given key and data.)hmacnewhashlibsha256	hexdigestdigest)keydatar   Zhasher r   0/tmp/pip-unpacked-wheel-xery97c7/minio/signer.py
_hmac_hash*   s    r   c                 C   s   t |  d| d| dS )zGet scope string./z/aws4_requestr   to_signer_date)dateregionservice_namer   r   r   
_get_scope1   s    r   c                 C   s   i }|   D ]H\}}| }|dkrt|ttfr6|n|g}ddd |D ||< qtt|  }d| }ddd |  D }||fS )zGet canonical headers.)authorizationz
user-agent,c                 S   s   g | ]}t d |qS ) )_MULTI_SPACE_REGEXsub).0valuer   r   r   
<listcomp>A   s    z*_get_canonical_headers.<locals>.<listcomp>;
c                 S   s   g | ]\}}| d | qS ):r   )r   r   r    r   r   r   r!   H   s     )	itemslower
isinstancelisttuplejoinr   sortedkeys)headerscanonical_headersr   valuessigned_headersr   r   r   _get_canonical_headers6   s    
r1   c                 C   s0   | pd} d dd tdd | dD D S )zGet canonical query string. &c                 S   s   g | ]}d  |qS =)r*   )r   pairr   r   r   r!   R   s    z/_get_canonical_query_string.<locals>.<listcomp>c                 S   s   g | ]}| d qS r4   )split)r   paramsr   r   r   r!   T   s     )r*   r+   r7   )queryr   r   r   _get_canonical_query_stringM   s    r:   c                 C   sN   t |\}}t|j}|  d|jp$d d| d| d| d| }t||fS )zGet canonical request hash.r#   r   

)r1   r:   r9   pathr   )methodurlr-   content_sha256r.   r0   canonical_query_stringcanonical_requestr   r   r   _get_canonical_request_hashZ   s
    

*rB   c                 C   s   dt |  d| d| S )zGet string-to-sign.zAWS4-HMAC-SHA256
r#   )r   to_amz_date)r   scopecanonical_request_hashr   r   r   _get_string_to_signq   s    rF   c                 C   sB   t d|   t| }t || }t || }t |dS )zGet signing key.ZAWS4s   aws4_request)r   encoder   r   )
secret_keyr   r   r   Zdate_keyZdate_region_keyZdate_region_service_keyr   r   r   _get_signing_keyy   s    
 rI   c                 C   s   t | | ddS )zGet signature.T)r   )r   rG   )signing_keystring_to_signr   r   r   _get_signature   s    rL   c                 C   s   d|  d| d| d| S )zGet authorization.zAWS4-HMAC-SHA256 Credential=r   z, SignedHeaders=z, Signature=r   )
access_keyrD   r0   	signaturer   r   r   _get_authorization   s    rO   c                 C   s`   t ||| }t||||\}	}
t|||	}t|j||| }t||}t|j||
|}||d< |S )z8Do signature V4 of given request for given service name.Authorization)r   rB   rF   rI   rH   rL   rO   rM   )r   r=   r>   r   r-   credentialsr?   r   rD   rE   r0   rK   rJ   rN   r   r   r   r   _sign_v4   s.          
   rR   c              	   C   s   t d| ||||||S )z0Do signature V4 of given request for S3 service.s3rR   r=   r>   r   r-   rQ   r?   r   r   r   r   
sign_v4_s3   s    
rV   c              	   C   s   t d| ||||||S )z1Do signature V4 of given request for STS service.stsrT   rU   r   r   r   sign_v4_sts   s    
rX   c              
   C   s   t |d | }d|j d }}|jr0|jd nd}	|	d| dt| d| d	| 7 }	t|}
|	|
d
< t|
 }t|	}|  d|jpd d| d| d| d
}t	||fS )z/Get canonical request hash for presign request.r   zhost:hostr3   r2   z2X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=z&X-Amz-Date=z&X-Amz-Expires=z&X-Amz-SignedHeaders=   r#   r;   z
UNSIGNED-PAYLOAD)
r   netlocr9   r   rC   r(   r   r:   r<   r   )r=   r>   rM   rD   r   expiresZx_amz_credentialr.   r0   r9   partsr@   rA   r   r   r   #_get_presign_canonical_request_hash   s     
&r^   c                 C   st   t ||d}t| ||j|||\}}t|||}t|j||d}	t|	|}
t|}|jd t	|
 |d< t
| }|S )z)Do signature V4 of given presign request.rS   z&X-Amz-Signature=rZ   )r   r^   rM   rF   rI   rH   rL   r(   r9   r   r   )r=   r>   r   rQ   r   r\   rD   rE   rK   rJ   rN   r]   r   r   r   
presign_v4  s     
     
r_   c                 C   s   |  dt | d| dS )z;Get credential string of given access key, date and region.r   z/s3/aws4_requestr   )rM   r   r   r   r   r   get_credential_string  s    r`   c                 C   s   t t|||d| S )z0Do signature V4 of given presign POST form-data.rS   )rL   rI   )r   rH   r   r   r   r   r   post_presign_v4!  s    ra   )F) __doc__r
   r   recollectionsr   urllib.parser   r2   r   Zhelpersr   r   ZSIGN_V4_ALGORITHMcompiler   r   r   r1   r:   rB   rF   rI   rL   rO   rR   rV   rX   r^   r_   r`   ra   r   r   r   r   <module>   s2   

'