| Server IP : 104.21.21.239 / Your IP : 216.73.216.55 Web Server : Apache/2.4.68 (Amazon Linux) OpenSSL/3.5.7 System : Linux ip-172-31-69-123.ec2.internal 6.1.177-224.371.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Jul 27 20:28:29 UTC 2026 x86_64 User : ec2-user ( 1000) PHP Version : 8.4.24 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /lib/python3.9/site-packages/awscli/botocore/__pycache__/ |
Upload File : |
a
wA�iN� � @ s" d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dl m
Z
d dl m Z m
Z
mZmZmZmZmZmZmZ d dlmZmZmZmZ d dlmZm Z m Z e� e �Z dZ!dZ"d Z#d
Z$g d �Z%d Z&d
Z'dd� Z(dd� Z)G dd� d�Z*G dd� de*�Z+G dd� de*�Z,G dd� de*�Z-G dd� de*�Z.G d d � d e.�Z/G d d � d e/�Z0G d d!� d!e0�Z1G d"d#� d#e0�Z2G d$d%� d%e.�Z3G d&d'� d'e3�Z4G d(d)� d)e.�Z5G d*d+� d+e+�Z6d dl7Z8d,d-� Z9d.d/� Z:e,e.e8j;j<j=e3e-e-e/e4e5e8j;j<j>e8j;j<j?e0e2e1e6d0�Z@d1d2d3d4d5�ZAd6d7� eA�B� D �ZCdS )8� N)�
formatdate)�sha256) �
MD5_AVAILABLE� HTTPHeaders� encodebytes�ensure_unicode�json�parse_qs�quote�urlsplit�
urlunsplit)�NoAuthTokenError�NoCredentialsError� UnknownSignatureVersionError� UnsupportedSignatureVersionError)�is_valid_ipv6_endpoint_url�normalize_url_path�percent_encode_sequenceZ@e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855i z%Y-%m-%dT%H:%M:%SZz%Y%m%dT%H%M%SZ)�expectztransfer-encodingz
user-agentzx-amzn-trace-idzUNSIGNED-PAYLOADz"STREAMING-UNSIGNED-PAYLOAD-TRAILERc C sZ t | �}|j}t| �r"d|� d�}ddd�}|jd urV|j|�|j�krVd||jf }|S )N�[�]�P i� )�http�httpsz%s:%d)r �hostnamer �port�get�scheme)�url� url_parts�hostZ
default_ports� r! �8/usr/lib/python3.9/site-packages/awscli/botocore/auth.py�_host_from_urlE s
r# c C s: | j }t|t�r"t�|�d��}nt|t�r6t�|�}|S �N�utf-8)�data�
isinstance�bytesr �loads�decode�str)�requestr& r! r! r" �_get_body_as_dictX s
r- c @ s e Zd ZdZdZdd� ZdS )�
BaseSignerFc C s t d��d S )N�add_auth)�NotImplementedError��selfr, r! r! r" r/ i s zBaseSigner.add_authN)�__name__�
__module__� __qualname__�REQUIRES_REGION�REQUIRES_TOKENr/ r! r! r! r" r. e s r. c @ s e Zd ZdZdd� ZdS )� TokenSignerTc C s
|| _ d S �N)�
auth_token)r2 r: r! r! r" �__init__s s zTokenSigner.__init__N)r3 r4 r5 r7 r; r! r! r! r" r8 m s r8 c @ s( e Zd ZdZdd� Zdd� Zdd� ZdS ) � SigV2Authz+
Sign a request with Signature V2.
c C s
|| _ d S r9 �� credentials�r2 r> r! r! r" r; | s zSigV2Auth.__init__c C s t �d� t|j�}|j}t|�dkr*d}|j� d|j� d|� d�}tj | j
j � d�t
d�}g }t|�D ]H}|dkrvqht|| �} |�t|� d�dd �d
t| � d�d d � � qhd �|�}
||
7 }t �d
|� |�|� d�� t�|�� ��� �d�} |
| fS )Nz$Calculating signature using v2 auth.r �/�
r% �Z digestmod� Signature� ��safe�=z-_~�&zString to sign: %s)�logger�debugr r �path�len�method�netloc�hmac�newr> �
secret_key�encoder �sortedr+ �appendr
�join�update�base64� b64encode�digest�stripr* ) r2 r, �params�splitrK �string_to_signZlhmac�pairs�key�value�qsZb64r! r! r" �calc_signature s6
� ���
zSigV2Auth.calc_signaturec C s� | j d u rt� �|jr |j}n|j}| j j|d< d|d< d|d< t�tt�� �|d< | j j rh| j j |d< | �
||�\}}||d< |S ) NZAWSAccessKeyId�2ZSignatureVersion�
HmacSHA256ZSignatureMethodZ TimestampZ
SecurityTokenrC ) r> r r& r[ �
access_key�time�strftime�ISO8601�gmtime�tokenrb )r2 r, r[ ra � signaturer! r! r" r/ � s
zSigV2Auth.add_authN)r3 r4 r5 �__doc__r; rb r/ r! r! r! r" r< w s r< c @ s e Zd Zdd� Zdd� ZdS )� SigV3Authc C s
|| _ d S r9 r= r? r! r! r" r; � s zSigV3Auth.__init__c C s� | j d u rt� �d|jv r"|jd= tdd�|jd< | j jrZd|jv rL|jd= | j j|jd< tj| j j�d�t d�}|�
|jd �d�� t |� � ��
� }d�| j jd|�d��}d |jv r�|jd = ||jd < d S )
N�DateT)Zusegmt�X-Amz-Security-Tokenr% rB z6AWS3-HTTPS AWSAccessKeyId={},Algorithm={},Signature={}rd zX-Amzn-Authorization)r> r �headersr rj rO rP rQ rR r rV r rY rZ �formatre r* )r2 r, Znew_hmacZencoded_signaturerk r! r! r" r/ � s.
���
zSigV3Auth.add_authN)r3 r4 r5 r; r/ r! r! r! r" rm � s rm c @ s� e Zd ZdZdZdd� Zd1dd�Zdd � Zd
d � Zd d
� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0S )2� SigV4Authz+
Sign a request with Signature V4.
Tc C s || _ || _|| _d S r9 )r> � _region_name�
_service_name)r2 r> � service_name� region_namer! r! r" r; � s zSigV4Auth.__init__Fc C s: |r t �||�d�t��� }nt �||�d�t��� }|S r$ )rO rP rR r � hexdigestrY )r2 r_ �msg�hexZsigr! r! r" �_sign� s zSigV4Auth._signc C sL t � }|j�� D ] \}}|�� }|tvr|||< qd|vrHt|j�|d< |S )zk
Select the headers from the request that need to be included
in the StringToSign.
r )r rp �items�lower�SIGNED_HEADERS_BLACKLISTr# r )r2 r, Z
header_map�namer` Zlnamer! r! r" �headers_to_sign� s
zSigV4Auth.headers_to_signc C s& |j r| �|j �S | �t|j��S d S r9 )r[ � _canonical_query_string_params�_canonical_query_string_urlr r r1 r! r! r" �canonical_query_string� s z SigV4Auth.canonical_query_stringc C sp g }|D ].}t || �}|�t|dd�t|dd�f� qg }t|�D ] \}}|�|� d|� �� qDd�|�}|S )Nz-_.~rE rG rH )r+ rT r
rS rU )r2 r[ �
key_val_pairsr_ r` �sorted_key_valsr� r! r! r" r� s �
z(SigV4Auth._canonical_query_string_paramsc C sv d}|j rrg }|j �d�D ]"}|�d�\}}}|�||f� qg }t|�D ] \}}|�|� d|� �� qJd�|�}|S )NrD rH rG )�queryr\ � partitionrT rS rU ) r2 �partsr� r� Zpairr_ �_r` r� r! r! r" r� s
z%SigV4Auth._canonical_query_string_urlc sZ g }t t|��}|D ]:}d�� fdd�|�|�D ��}|�|� dt|�� �� qd�|�S )a
Return the headers that need to be included in the StringToSign
in their canonical form by converting all header keys to lower
case, sorting them in alphabetical order and then joining
them into a string, separated by newlines.
�,c 3 s | ]}� � |�V qd S r9 )�
_header_value)�.0�v�r2 r! r" � <genexpr>/ s z.SigV4Auth.canonical_headers.<locals>.<genexpr>�:rA )rS �setrU Zget_allrT r )r2 r rp Zsorted_header_namesr_ r` r! r� r" �canonical_headers% s �zSigV4Auth.canonical_headersc C s d� |�� �S )N� )rU r\ )r2 r` r! r! r" r� 5 s zSigV4Auth._header_valuec C s t dd� t|�D ��}d�|�S )Nc s s | ]}|� � �� V qd S r9 )r| rZ )r� �nr! r! r" r� > � z+SigV4Auth.signed_headers.<locals>.<genexpr>�;)rS r� rU )r2 r rp r! r! r" �signed_headers= s zSigV4Auth.signed_headersc C s0 |j �di �}|�d�}t|t�o.|�d�dkS )N�checksum�request_algorithm�inZtrailer)�contextr r' �dict)r2 r, �checksum_context� algorithmr! r! r" � _is_streaming_checksum_payloadA s
z(SigV4Auth._is_streaming_checksum_payloadc C s� | � |�rtS | �|�s tS |j}|r|t|d�r||�� }t�|j t
�}t � }t |d�D ]}|�
|� qV|�� }|�|� |S |r�t |��� S tS d S )N�seekr� )r� �"STREAMING_UNSIGNED_PAYLOAD_TRAILER�_should_sha256_sign_payload�UNSIGNED_PAYLOAD�body�hasattr�tell� functools�partial�read�PAYLOAD_BUFFERr �iterrV rw r� �EMPTY_SHA256_HASH)r2 r, Z request_bodyZpositionZread_chunksizer� �chunkZ hex_checksumr! r! r" �payloadF s&
�
zSigV4Auth.payloadc C s |j �d�sdS |j�dd�S )Nr T�payload_signing_enabled)r �
startswithr� r r1 r! r! r" r� ` s z%SigV4Auth._should_sha256_sign_payloadc C s� |j �� g}| �t|j�j�}|�|� |�| �|�� | �|�}|�| � |�d � |�| �
|�� d|j v r||j d }n
| � |�}|�|� d�
|�S )NrA �X-Amz-Content-SHA256)rM �upper�_normalize_url_pathr r rK rT r� r r� r� rp r� rU )r2 r, ZcrrK r Z
body_checksumr! r! r" �canonical_requestj s
zSigV4Auth.canonical_requestc C s t t|�dd�}|S )Nz/~rE )r
r )r2 rK Znormalized_pathr! r! r" r� y s z SigV4Auth._normalize_url_pathc C sN | j jg}|�|jd dd� � |�| j� |�| j� |�d� d�|�S �N� timestampr � � aws4_requestr@ )r> re rT r� rs rt rU �r2 r, �scoper! r! r" r� } s
zSigV4Auth.scopec C sH g }|� |jd dd� � |� | j� |� | j� |� d� d�|�S r� )rT r� rs rt rU r� r! r! r" �credential_scope� s
zSigV4Auth.credential_scopec C sH dg}|� |jd � |� | �|�� |� t|�d���� � d�|�S )z�
Return the canonical StringToSign as well as a dict
containing the original version of all headers that
were included in the StringToSign.
�AWS4-HMAC-SHA256r� r% rA )rT r� r� r rR rw rU )r2 r, r� �stsr! r! r" r] � s
zSigV4Auth.string_to_signc C sd | j j}| �d| �d�|jd dd� �}| �|| j�}| �|| j�}| �|d�}| j||dd�S ) NZAWS4r% r� r r� r� T)ry )r> rQ rz rR r� rs rt )r2 r] r, r_ Zk_dateZk_regionZ k_serviceZ k_signingr! r! r" rk � s � zSigV4Auth.signaturec C s� | j d u rt� �tj�� }|�t�|jd< | �|� | �|�}t �
d� t �
d|� | � ||�}t �
d|� | � ||�}t �
d|� | �
||� d S )Nr� z$Calculating signature using v4 auth.zCanonicalRequest:
%szStringToSign:
%sz
Signature:
%s)r> r �datetime�utcnowrg �SIGV4_TIMESTAMPr� � _modify_request_before_signingr� rI rJ r] rk � _inject_signature_to_request)r2 r, � datetime_nowr� r] rk r! r! r" r/ � s
zSigV4Auth.add_authc C sV d| � |�� �g}| �|�}|�d| �|�� �� |�d|� �� d�|�|jd< |S )Nz AWS4-HMAC-SHA256 Credential=zSignedHeaders=z
Signature=�, �
Authorization)r� r rT r� rU rp )r2 r, rk Zauth_strr r! r! r" r� � s
�z&SigV4Auth._inject_signature_to_requestc C sr d|j v r|j d= | �|� | jjrDd|j v r6|j d= | jj|j d< |j�dd�snd|j v rd|j d= t|j d< d S )Nr� ro r� Tr� )rp �_set_necessary_date_headersr> rj r� r r� r1 r! r! r" r� � s
z(SigV4Auth._modify_request_before_signingc C s| d|j v rV|j d= tj�|jd t�}ttt�|� � ���|j d< d|j v rx|j d= n"d|j v rh|j d= |jd |j d< d S )Nrn r� �
X-Amz-Date)
rp r� �strptimer� r� r �int�calendarZtimegmZ timetuple)r2 r, Zdatetime_timestampr! r! r" r� � s
��
z%SigV4Auth._set_necessary_date_headersN)F)r3 r4 r5 rl r6 r; rz r r� r� r� r� r� r� r� r� r� r� r� r� r� r] rk r/ r� r� r� r! r! r! r" rr � s0
rr c s0 e Zd Z� fdd�Z� fdd�Zdd� Z� ZS )� S3SigV4Authc s2 t � �|� d|jv r |jd= | �|�|jd< d S )Nr� )�superr� rp r� r1 �� __class__r! r" r� � s
z*S3SigV4Auth._modify_request_before_signingc s� |j �d�}t|dd �}|d u r$i }|�dd �}|d ur<|S d}|j �di �}|�d�}t|t�rx|�d�dkrx|d }|j�d
�r�||jvr�d S |j �d d
�r�d
S t� � |�S )N�
client_configZs3r� z Content-MD5r� r� r� �headerr~ r TZhas_streaming_inputF)
r� r �getattrr' r� r r� rp r� r� )r2 r, r� Z s3_configZ sign_payloadZchecksum_headerr� r� r� r! r" r� � s(
��z'S3SigV4Auth._should_sha256_sign_payloadc C s |S r9 r! �r2 rK r! r! r" r� s z S3SigV4Auth._normalize_url_path)r3 r4 r5 r� r� r� �
__classcell__r! r! r� r" r� � s )r� c s8 e Zd ZdZ� fdd�Z� fdd�Z� fdd�Z� ZS )�
S3ExpressAuthTc s t � �|||� || _d S r9 )r� r; Z_identity_cache)r2 r> ru rv �identity_cacher� r! r" r; s zS3ExpressAuth.__init__c s t � �|� d S r9 )r� r/ r1 r� r! r" r/ s zS3ExpressAuth.add_authc s: t � �|� d|jvr$| jj|jd< d|jv r6|jd= d S )Nzx-amz-s3session-tokenro )r� r� rp r> rj r1 r� r! r" r� # s
z,S3ExpressAuth._modify_request_before_signing)r3 r4 r5 �REQUIRES_IDENTITY_CACHEr; r/ r� r� r! r! r� r" r� s r� c @ s e Zd ZdZdd� ZdS )�S3ExpressPostAuthTc C sP t j �� }|�t�|jd< i }|j�dd �d ur:|jd }i }g }|j�dd �d urv|jd }|�dd �d urv|d }||d< d|d< | �|�|d< |jd |d< |�ddi� |�d| �|�i� |�d|jd i� | jj d u�r| jj |d < |�d | jj i� t
� t �
|��d
���d
�|d < | �|d |�|d < ||jd< ||jd< d S )
Nr� �s3-presign-post-fields�s3-presign-post-policy�
conditionsr� �x-amz-algorithm�x-amz-credential�
x-amz-date�X-Amz-S3session-Tokenr% �policy�x-amz-signature�r� r� rg r� r� r r� rT r> rj rW rX r �dumpsrR r* rk �r2 r, r� �fieldsr� r� r! r! r" r/ / s>
���
zS3ExpressPostAuth.add_authN)r3 r4 r5 r� r/ r! r! r! r" r� , s r� c sJ e Zd ZdZdZed�� fdd�
Zdd� Zdd � Zd
d � Zd d
� Z � Z
S )�S3ExpressQueryAuthi, T)�expiresc s t � j||||d� || _d S )N)r� �r� r; �_expires)r2 r> ru rv r� r� r� r! r" r; ] s �zS3ExpressQueryAuth.__init__c
C s |j �d�}d}||kr |j d= | �| �|��}d| �|�|jd | j|d�}| jjd urf| jj|d< t |j
�}t |j dd�}d d
� |�
� D �}|jr�|�|j� i |_d } |jr�|�t|�� d |_|r�t|�d } | � t|�� �}
|} | d
| d | d |
| d f} t| �|_
d S )N� content-type�0application/x-www-form-urlencoded; charset=utf-8r� r� �zX-Amz-AlgorithmzX-Amz-Credentialr� z
X-Amz-ExpireszX-Amz-SignedHeadersr� T��keep_blank_valuesc S s i | ]\}}||d �qS �r r! �r� �kr� r! r! r" �
<dictcomp>� r� zES3ExpressQueryAuth._modify_request_before_signing.<locals>.<dictcomp>rD rH r � � � )rp r r� r r� r� r� r> rj r r r r� r{ r[ rV r& r- r r )
r2 r, � content_typeZblocklisted_content_typer� � auth_paramsr Zquery_string_parts�
query_dict�operation_params�new_query_string�p�
new_url_partsr! r! r" r� n s> ��
� z1S3ExpressQueryAuth._modify_request_before_signingc C s | j d|� �7 _ d S �Nz&X-Amz-Signature=�r �r2 r, rk r! r! r" r� � s z/S3ExpressQueryAuth._inject_signature_to_requestc C s |S r9 r! r� r! r! r" r� � s z&S3ExpressQueryAuth._normalize_url_pathc C s t S r9 �r� r1 r! r! r" r� � s zS3ExpressQueryAuth.payload) r3 r4 r5 �DEFAULT_EXPIRESr� r; r� r� r� r� r� r! r! r� r" r� Y s �Ar� c s4 e Zd ZdZef� fdd� Zdd� Zdd� Z� ZS )�SigV4QueryAuthi c s t � �|||� || _d S r9 r� )r2 r> ru rv r� r� r! r" r; � s zSigV4QueryAuth.__init__c C s� |j �d�}d}||kr |j d= | �| �|��}d| �|�|jd | j|d�}| jjd urf| jj|d< t |j
�}t dd� t |j
d d
��� D ��}d }|jr�|�t|�� d |_|r�t|�d }|t|� } |}
|
d
|
d |
d | |
d f} t| �|_
d S )Nr� r� r� r� r� ro c S s g | ]\}}||d f�qS r� r! r� r! r! r" �
<listcomp>� s �zASigV4QueryAuth._modify_request_before_signing.<locals>.<listcomp>Tr� rD rH r r� r� r� )rp r r� r r� r� r� r> rj r r r� r r� r{ r& rV r- r r ) r2 r, r� Zblacklisted_content_typer� r� r r� r� r� r� r� r! r! r" r� � sD ��
��� � z-SigV4QueryAuth._modify_request_before_signingc C s | j d|� �7 _ d S r� r� r� r! r! r" r�
s z+SigV4QueryAuth._inject_signature_to_request)r3 r4 r5 r� r; r� r� r� r! r! r� r" r � s
�Cr c @ s e Zd ZdZdd� Zdd� ZdS )�S3SigV4QueryAutha S3 SigV4 auth using query parameters.
This signer will sign a request using query parameters and signature
version 4, i.e a "presigned url" signer.
Based off of:
http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html
c C s |S r9 r! r� r! r! r" r� s z$S3SigV4QueryAuth._normalize_url_pathc C s t S r9 r� r1 r! r! r" r� $ s zS3SigV4QueryAuth.payloadN)r3 r4 r5 rl r� r� r! r! r! r" r s r c @ s e Zd ZdZdd� ZdS )�S3SigV4PostAuthz�
Presigns a s3 post
Implementation doc here:
http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-UsingHTTPPOST.html
c C sP t j �� }|�t�|jd< i }|j�dd �d ur:|jd }i }g }|j�dd �d urv|jd }|�dd �d urv|d }||d< d|d< | �|�|d< |jd |d< |�ddi� |�d| �|�i� |�d|jd i� | jj d u�r| jj |d < |�d | jj i� t
� t �
|��d
���d
�|d < | �|d |�|d < ||jd< ||jd< d S )
Nr� r� r� r� r� r� r� r� zx-amz-security-tokenr% r� r� r� r� r! r! r" r/ 4 s:
��
zS3SigV4PostAuth.add_authN�r3 r4 r5 rl r/ r! r! r! r" r , s r c @ s e Zd ZdZdd� ZdS )�
BearerAuthz�
Performs bearer token authorization by placing the bearer token in the
Authorization header as specified by Section 2.1 of RFC 6750.
https://datatracker.ietf.org/doc/html/rfc6750#section-2.1
c C s> | j d u rt� �d| j j� �}d|jv r0|jd= ||jd< d S )NzBearer r� )r: r
rj rp )r2 r, Z auth_headerr! r! r" r/ d s
zBearerAuth.add_authNr r! r! r! r" r \ s r c C sX | D ]D}|dkr t | S |t v r>t | }|tv rH| S qt|d��qt| d��d S )N�smithy.api#noAuth��signature_version)� AUTH_TYPE_TO_SIGNATURE_VERSION�AUTH_TYPE_MAPSr r )Z
auth_traitZ auth_typer r! r! r" �resolve_auth_typeu s
r c s� dd� |D �� dd� | D �}|r6t �dd�|�� �� | � }� fdd�t�|�D �}|D ]2}|dkrrt| S t�|�}|tv rZ| S qZtd�t � ��d��d S ) Nc S s g | ]}|� d �d �qS ��#����r\ �r� r r! r! r" r � r� z2resolve_auth_scheme_preference.<locals>.<listcomp>c S s g | ]}|t vr|�qS r! )� AUTH_PREF_TO_SIGNATURE_VERSIONr r! r! r" r � s �z-Unsupported auth schemes in preference list: r� c s g | ]}|� v r|�qS r! r! r �Zservice_supportedr! r" r � s �ZnoAuthr )
rI rJ rU r� �fromkeysr r r
r rS )Zpreference_listZ auth_optionsZ unsupportedZcombinedZprioritized_schemesr � sig_versionr! r r" � resolve_auth_scheme_preference� s* ��
�
�r )Zv2�v4�v4azv4-queryZv3Zv3httpsZs3v4z
s3v4-queryzs3v4-presign-postZs3v4az s3v4a-queryz v4-s3expresszv4-s3express-queryzv4-s3express-presign-post�bearerr r r Znone)zaws.auth#sigv4zaws.auth#sigv4azsmithy.api#httpBearerAuthr c C s i | ]\}}|� d �d |�qS r r )r� Z auth_schemer r! r! r" r� � s �r� )DrW r� r� r� rO Zloggingrf Z email.utilsr Zhashlibr Zbotocore.compatr r r r r r r
r r Zbotocore.exceptionsr
r r r Zbotocore.utilsr r r Z getLoggerr3 rI r� r� rh r� r} r� r� r# r- r. r8 r< rm rr r� r� r� r� r r r r Zbotocore.crt.authZbotocorer r ZcrtZauthZCrtSigV4AsymAuthZCrtS3SigV4AsymAuthZCrtS3SigV4AsymQueryAuthr
r r{ r r! r! r! r" �<module> s� ,
�
? 6-hS0
#�� �