U
    d/eS                     @   s  d Z ddlZddlZddlZddlZddlZddlZddlZddlm	Z	m
Z
 ddlmZ ddlmZ ddlmZmZ ddlmZ ddlZddlZddlmZ dd	lmZ dd
lmZmZmZ ddlmZm Z  ddl!m"Z" e#edd$ Z%e#edd$ Z&e#edd$ Z'dd Z(d9ddZ)dd Z*G dd dZ+G dd de+Z,G dd de+Z-G dd  d e+Z.G d!d" d"e+Z/G d#d$ d$e+Z0G d%d& d&e+Z1d'd( Z2d)d* Z3G d+d, d,e+Z4G d-d. d.e+Z5G d/d0 d0e+Z6G d1d2 d2e+Z7G d3d4 d4e7Z8G d5d6 d6e7Z9G d7d8 d8e+Z:dS ):zCredential providers.    N)ABCMetaabstractmethod)	timedelta)Path)	urlencodeurlsplit)ElementTree)sha256_hash)sign_v4_sts)from_iso8601utcto_amz_dateutcnow)findfindtext   )Credentials   )minutes   )days)hoursc                 C   sT   t | }t||}t|d}tt|dd}tt|ddt|ddt|dd|S )z&Parse data containing credentials XML.r   
ExpirationTAccessKeyIdSecretAccessKeyZSessionToken)r   
fromstringr   r   r   r   )datanameelementZ
expiration r   ?/tmp/pip-unpacked-wheel-xery97c7/minio/credentials/providers.py_parse_credentials/   s    





r    c                 C   s4   | j ||||d}|jdkr0t| d|j |S )z.Wrapper of urlopen() handles HTTP status code.bodyheaders)         z failed with HTTP status code )urlopenstatus
ValueError)http_clientmethodurlr"   r#   resr   r   r   _urlopen=   s    
r.   c                   C   s$   t jdp"t jdp"tt S )z Return current user home folder.HOMEZUserProfile)osenvirongetstrr   homer   r   r   r   _user_home_dirE   s
    

r5   c                   @   s    e Zd ZdZeZedd ZdS )ProviderzCredential retriever.c                 C   s   dS )z1Retrieve credentials and its expiry if available.Nr   selfr   r   r   retrieveR   s    zProvider.retrieveN)__name__
__module____qualname____doc__r   __metaclass__r   r9   r   r   r   r   r6   N   s   r6   c                   @   s"   e Zd ZdZdddZdd ZdS )	AssumeRoleProviderz Assume-role credential provider.r   Nc                 C   s   || _ || _|| _|pd| _|
p>tjtjddddddgdd	| _d
dt|t	krT|nt	d}|rj||d< |rv||d< |r||d< |	r|	|d< t
|| _t| j| _t|}|| _|j| _|jdkr|jdks|jdkr|jdkr|j| _d | _d S )N    皙?        totalbackoff_factorstatus_forcelistretriesZ
AssumeRole
2011-06-15ActionVersionDurationSecondsRoleArnRoleSessionNamePolicyZ
ExternalIdhttpP   httpsi  )_sts_endpoint_access_key_secret_key_regionurllib3PoolManagerRetry_http_clientr3   _DEFAULT_DURATION_SECONDSr   _bodyr	   _content_sha256r   _urlnetloc_hostschemeporthostname_credentials)r8   sts_endpoint
access_key
secret_keyduration_secondspolicyZregionrole_arnrole_session_nameZexternal_idr*   query_paramsr,   r   r   r   __init__Z   sT    

	

zAssumeRoleProvider.__init__c                 C   s~   | j r| j  s| j S t }td| j| jd| jt|dt| j	| j
| j|}t| jd| j| j|d}t|j d| _ | j S )Retrieve credentials.POSTz!application/x-www-form-urlencoded)zContent-TypeHostz
X-Amz-Dater!   ZAssumeRoleResult)ri   
is_expiredr   r
   rc   r[   re   r   r   rY   rZ   rb   r.   r_   rX   ra   r    r   decode)r8   Zutctimer#   r-   r   r   r   r9      s6     zAssumeRoleProvider.retrieve)r   NNNNNNr:   r;   r<   r=   rr   r9   r   r   r   r   r?   W   s              
0r?   c                   @   s    e Zd ZdZdd Zdd ZdS )ChainedProviderzChained credential provider.c                 C   s   || _ d | _d | _d S N)
_providers	_providerri   )r8   Z	providersr   r   r   rr      s    zChainedProvider.__init__c              	   C   s   | j r| j  s| j S | jrFz| j | _ | j W S  tk
rD   Y nX | jD ]6}z| | _ || _| j W   S  tk
r   Y qLX qLtddS )z4Retrieve credentials from one of available provider.z'All providers fail to fetch credentialsN)ri   rv   r|   r9   r)   r{   )r8   providerr   r   r   r9      s     

zChainedProvider.retrieveNrx   r   r   r   r   ry      s   ry   c                   @   s   e Zd ZdZdd ZdS )EnvAWSProviderz3Credential provider from AWS environment variables.c                 C   s>   t tjdptjdtjdp.tjdtjddS )rs   ZAWS_ACCESS_KEY_IDZAWS_ACCESS_KEYZAWS_SECRET_ACCESS_KEYZAWS_SECRET_KEYZAWS_SESSION_TOKEN)rk   rl   session_tokenr   r0   r1   r2   r7   r   r   r   r9      s    


zEnvAWSProvider.retrieveNr:   r;   r<   r=   r9   r   r   r   r   r~      s   r~   c                   @   s   e Zd ZdZdd ZdS )EnvMinioProviderz5Credential provider from MinIO environment variables.c                 C   s   t tjdtjddS )rs   ZMINIO_ACCESS_KEYZMINIO_SECRET_KEY)rk   rl   r   r7   r   r   r   r9      s    

zEnvMinioProvider.retrieveNr   r   r   r   r   r      s   r   c                   @   s"   e Zd ZdZdddZdd ZdS )AWSConfigProviderz-Credential provider from AWS credential file.Nc                 C   s>   |p t jdp t jt dd| _|p6t jdp6d| _d S )NZAWS_SHARED_CREDENTIALS_FILEz.awscredentialsZAWS_PROFILEdefault)r0   r1   r2   pathjoinr5   	_filename_profile)r8   filenameZprofiler   r   r   rr      s    
zAWSConfigProvider.__init__c                 C   s   t  }|| j |j| jddd}|j| jddd}|j| jddd}|sftd| j d| j |std| j d| j t|||d	S )
z1Retrieve credentials from AWS configuration file.Zaws_access_key_idN)fallbackZaws_secret_access_keyZaws_session_tokenz%access key does not exist in profile z in AWS credential file z%secret key does not exist in profile )r   )configparserConfigParserreadr   r2   r   r)   r   )r8   parserrk   rl   r   r   r   r   r9      s<    zAWSConfigProvider.retrieve)NNrx   r   r   r   r   r      s   
r   c                   @   s"   e Zd ZdZdddZdd ZdS )MinioClientConfigProviderz9Credential provider from MinIO Client configuration file.Nc                 C   s@   |p"t jt tjdkrdndd| _|p8t jdp8d| _	d S )Nwin32Zmcz.mczconfig.jsonZMINIO_ALIASZs3)
r0   r   r   r5   sysplatformr   r1   r2   _alias)r8   r   aliasr   r   r   rr      s    z"MinioClientConfigProvider.__init__c              
   C   s   zt | jdd}t|}W 5 Q R X |dp8|d}|sNtd| j || j}|svtd| j d| j t|d|d	W S  tt	fk
r } ztd
| j |W 5 d}~X Y nX dS )z?Retrieve credential value from MinIO client configuration file.utf-8encodinghostsaliaseszinvalid configuration in file zalias z- not found in MinIO clientconfiguration file Z	accessKeyZ	secretKeyerror in reading file N)
openr   jsonloadr2   r)   r   r   IOErrorOSError)r8   Z	conf_fileconfigr   credsexcr   r   r   r9   +  s(    

z"MinioClientConfigProvider.retrieve)NNrx   r   r   r   r   r     s   
r   c              
   C   s   t j| j}z@tdd t|dD }|D ]}t|j	s.t
|d q.W n6 tjk
r } zt
d| d |W 5 d}~X Y nX dS )z3Check whether host in url points only to localhost.c                 s   s   | ]}|d  d V  qdS )   r   Nr   ).0infor   r   r   	<genexpr>F  s     z'_check_loopback_host.<locals>.<genexpr>Nz is not loopback only hostzHost z is not loopback address)r\   util	parse_urlhostsetsocketgetaddrinfo	ipaddress
ip_addressis_loopbackr)   gaierror)r,   r   addrsaddrr   r   r   r   _check_loopback_hostB  s    r   c              
   C   sp   z4t | dd}| ddW  5 Q R  W S Q R X W n6 ttfk
rj } ztd|  |W 5 d}~X Y nX dS )z'Read and return content of token file. r   r   0)access_token
expires_inr   N)r   r   r   r   r)   )Z
token_filefiler   r   r   r   _get_jwt_tokenN  s
    &r   c                   @   s*   e Zd ZdZd	ddZdd Zdd ZdS )
IamAwsProviderz7Credential provider using IAM roles for Amazon EC2/ECS.Nc                 C   s   || _ |p(tjtjddddddgdd| _tjd	| _tjd
| _	tjd| _
tjd| _tjd| _| jr| jdsd| j | _tjd| _d | _d S )NrA   rB   rC   rD   rE   rF   rG   rK   ZAWS_WEB_IDENTITY_TOKEN_FILEZ
AWS_REGIONZAWS_ROLE_ARNZAWS_ROLE_SESSION_NAMEZ&AWS_CONTAINER_CREDENTIALS_RELATIVE_URI/Z"AWS_CONTAINER_CREDENTIALS_FULL_URI)_custom_endpointr\   r]   r^   r_   r0   r1   r2   _token_file_aws_region	_role_arn_role_session_name_relative_uri
startswith	_full_uriri   )r8   Zcustom_endpointr*   r   r   r   rr   Z  s&    
zIamAwsProvider.__init__c                 C   sz   t | jd|}t|j}|dddkrLt| d|d  d|d t|d |d< t|d |d	 |d
 |d S )z Fetch credentials from EC2/ECS. GETZCodeZSuccessz failed with code z	 message Messager   r   r   Token)	r.   r_   r   loadsr   r2   r)   r   r   )r8   r,   r-   r   r   r   r   fetcho  s    zIamAwsProvider.fetchc                    s    j r j  s j S  j} jrn|s>d} jr>d j d}t fdd| j j jd}|	  _  j S  j
r|sd j
 }nj jr|s j}t| nP|sd}t jd	|}|jd
d}|std| |d|d d 7 } | _  j S )z.Retrieve credentials from WebIdentity/EC2/ECS.zhttps://sts.amazonaws.comzhttps://sts.z.amazonaws.comc                      s
   t  jS rz   )r   r   r   r7   r   r   <lambda>      z)IamAwsProvider.retrieve.<locals>.<lambda>)ro   rp   r*   zhttp://169.254.170.2zAhttp://169.254.169.254/latest/meta-data/iam/security-credentials/r   r   
z%no IAM roles attached to EC2 service r   r   )ri   rv   r   r   r   WebIdentityProviderr   r   r_   r9   r   r   r   r.   r   rw   splitr)   stripr   )r8   r,   r}   r-   Z
role_namesr   r7   r   r9     sD    


zIamAwsProvider.retrieve)NN)r:   r;   r<   r=   rr   r   r9   r   r   r   r   r   W  s   
r   c                   @   s"   e Zd ZdZdddZdd ZdS )LdapIdentityProviderz9Credential provider using AssumeRoleWithLDAPIdentity API.Nc                 C   sL   |d t dd||d | _|p>tjtjddddd	d
gdd| _d | _d S )N?ZAssumeRoleWithLDAPIdentityrM   )rO   rP   ZLDAPUsernameZLDAPPasswordrA   rB   rC   rD   rE   rF   rG   rK   )r   rX   r\   r]   r^   r_   ri   )r8   rj   Zldap_usernameZldap_passwordr*   r   r   r   rr     s    
zLdapIdentityProvider.__init__c                 C   s>   | j r| j  s| j S t| jd| j}t|j d| _ | j S )rs   rt   Z AssumeRoleWithLDAPIdentityResultri   rv   r.   r_   rX   r    r   rw   r8   r-   r   r   r   r9     s     zLdapIdentityProvider.retrieve)Nrx   r   r   r   r   r     s    
r   c                   @   s"   e Zd ZdZdddZdd ZdS )StaticProviderzFixed credential provider.Nc                 C   s   t |||| _d S rz   )r   ri   )r8   rk   rl   r   r   r   r   rr     s    zStaticProvider.__init__c                 C   s   | j S )zReturn passed credentials.)ri   r7   r   r   r   r9     s    zStaticProvider.retrieve)Nrx   r   r   r   r   r     s   
r   c                   @   s:   e Zd ZdZeZdddZedd Zdd	 Z	d
d Z
dS )WebIdentityClientGrantsProviderzABase class for WebIdentity and ClientGrants credentials provider.r   Nc                 C   sT   || _ || _|| _|| _|| _|| _|pFtjtjddddddgdd| _	d | _
d S )	NrA   rB   rC   rD   rE   rF   rG   rK   )_jwt_provider_funcrX   _duration_seconds_policyr   r   r\   r]   r^   r_   ri   )r8   jwt_provider_funcrj   rm   rn   ro   rp   r*   r   r   r   rr     s    
z(WebIdentityClientGrantsProvider.__init__c                 C   s   dS )z-Check if derived class deal with WebIdentity.Nr   r7   r   r   r   _is_web_identity  s    z0WebIdentityClientGrantsProvider._is_web_identityc                 C   s4   | j r| j }|tkrtS |dkr$|S |tk r0tS |S )z"Get DurationSeconds optimal value.r   )r   _MAX_DURATION_SECONDS_MIN_DURATION_SECONDS)r8   Zexpiryr   r   r   _get_duration_seconds  s    z5WebIdentityClientGrantsProvider._get_duration_secondsc                 C   s
  | j r| j  s| j S |  }ddi}| t|dd}|rLt||d< | jr\| j|d< |  rd|d< |d	|d
< | j	r| j	|d< | j
r| j
ntt dd|d< nd|d< |d	|d< | jd t| }t| jd|}t|j |  rdnd| _ | j S )rs   rP   rM   r   r   rQ   rT   ZAssumeRoleWithWebIdentityrO   r   ZWebIdentityTokenrR   .r@   rS   ZAssumeRoleWithClientGrantsr   r   rt   ZAssumeRoleWithWebIdentityResultZ AssumeRoleWithClientGrantsResult)ri   rv   r   r   intr2   r3   r   r   r   r   timereplacerX   r   r.   r_   r    r   rw   )r8   Zjwtrq   rm   r,   r-   r   r   r   r9     s>    

	z(WebIdentityClientGrantsProvider.retrieve)r   NNNN)r:   r;   r<   r=   r   r>   rr   r   r   r   r9   r   r   r   r   r     s           

r   c                       s*   e Zd ZdZd fdd	Zdd Z  ZS )	ClientGrantsProviderz9Credential provider using AssumeRoleWithClientGrants API.r   Nc                    s   t  j|||||d d S )N)r*   )superrr   )r8   r   rj   rm   rn   r*   	__class__r   r   rr   C  s       zClientGrantsProvider.__init__c                 C   s   dS )NFr   r7   r   r   r   r   L  s    z%ClientGrantsProvider._is_web_identity)r   NN)r:   r;   r<   r=   rr   r   __classcell__r   r   r   r   r   @  s        	r   c                   @   s   e Zd ZdZdd ZdS )r   z8Credential provider using AssumeRoleWithWebIdentity API.c                 C   s   dS )NTr   r7   r   r   r   r   S  s    z$WebIdentityProvider._is_web_identityN)r:   r;   r<   r=   r   r   r   r   r   r   P  s   r   c                   @   s"   e Zd ZdZdddZdd ZdS )	CertificateIdentityProviderz8Credential provider using AssumeRoleWithCertificate API.Nr   c                 C   s   t |jdkrtdt||o"|kr(ntd|d tddt|tkrJ|ntd | _|ptj	d|d	|||pvt
 tjd
dddddgdd| _d | _d S )NrW   z!STS endpoint scheme must be HTTPSz;either cert/key file or custom http_client must be providedr   ZAssumeRoleWithCertificaterM   rN   
   CERT_REQUIREDrA   rB   rC   rD   rE   rF   rG   )maxsize	cert_file	cert_reqskey_filekey_passwordca_certsrL   )r   rf   r)   boolr   r3   r`   rX   r\   r]   certifiwherer^   r_   ri   )r8   rj   r   r   r   r   rm   r*   r   r   r   rr   Z  s>    

z$CertificateIdentityProvider.__init__c                 C   s>   | j r| j  s| j S t| jd| j}t|j d| _ | j S )rs   rt   ZAssumeRoleWithCertificateResultr   r   r   r   r   r9     s     z$CertificateIdentityProvider.retrieve)NNNNr   Nrx   r   r   r   r   r   W  s            
)r   )NN);r=   r   r   r   r0   r   r   r   abcr   r   datetimer   pathlibr   urllib.parser   r   Z	xml.etreer   r   r\   Zminio.helpersr	   Zminio.signerr
   Z
minio.timer   r   r   Z	minio.xmlr   r   r   r   r   total_secondsr   r   r`   r    r.   r5   r6   r?   ry   r~   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   <module>   sR   
		V!2%	Z*Z