3
b,                 @   sF  d dl mZ d dlZd dlZyd dlmZ W n  ek
rL   d dlmZ Y nX ddlm	Z	 d dl
mZ ddlmZmZmZ dd	lmZmZmZ dd
lmZ d dlZd dlmZmZ g Zd&ddZejd dd Zejd d'ddZejd dd Zejd dd Zdd Z dd Z!d(d d!Z"ejd! d)d"d#Z#d*d$d%Z$dS )+    )absolute_importN)encodebytes)encodestring   )Config)debug)encode_to_s3decode_from_s3s3_quote)time_to_epochdeunicodisecheck_bucket_name_dns_support)
SortedDict)sha1sha256Fc             C   s   | sdS d}|rdpd}xht | j D ]X}|r8||kr8q&| | }|d
krb|dt|dd|f 7 }q&|d|t| | ddf 7 }q&W |od|d	d  S )a  
    Format URL parameters from a params dict and returns
    ?parm1=val1&parm2=val2 or an empty string if there
    are no parameters.  Output of this function should
    be appended directly to self.resource['uri']
    - Set "always_have_equal" to always have the "=" char for a param even when
    there is no value for it.
    - Set "limited_keys" list to restrict the param string to keys that are
    defined in it.
     =Nz&%s%sT)unicode_outputz&%s=%s?r   )Nr   )sortedkeysr
   )paramsalways_have_equallimited_keysZ	param_strZ	equal_strkeyvalue r   I/oak/stanford/groups/akundaje/marinovg/programs/s3cmd-master/S3/Crypto.pyformat_param_str    s     r   c             C   s,   t j  j}ttjt|| tj j }|S )a{  Sign a string with the secret key, returning base64 encoded results.
    By default the configured secret key is used, but may be overridden as
    an argument.

    Useful for REST authentication. See http://s3.amazonaws.com/doc/s3-developer-guide/RESTAuthentication.html
    string_to_sign should be utf-8 "bytes".
    and returned signature will be utf-8 encoded "bytes".
    )	r   
secret_keyr   hmacnewr   r   digeststrip)string_to_signr   	signaturer   r   r   sign_string_v2<   s    	
r&   GET/c             C   sX  ddddddddd	d
ddddddddg}|dkr:t dd}tj j}| d }||jddd 7 }||jddd 7 }||jddd 7 }xXt|j D ]H}|jdr||d ||  d 7 }|jdr||d ||  d 7 }qW t|ddd}t||d }||7 }||7 }t	d!t
|  ttt|}	t t|j dd}
d"| d |	 |
d#< |
S )$aA  Sign a string with the secret key, returning base64 encoded results.
    By default the configured secret key is used, but may be overridden as
    an argument.

    Useful for REST authentication. See http://s3.amazonaws.com/doc/s3-developer-guide/RESTAuthentication.html
    string_to_sign should be utf-8 "bytes".
    acl	lifecyclelocationloggingZnotification
partNumberpolicyrequestPaymentZtorrentuploadIduploadsZ	versionIdZ
versioningZversionswebsitedeletecorsrestoreNT)ignore_case
zcontent-md5r   zcontent-typedatezx-amz-:zx-emc-F)quote_backslashesr   )r   zSignHeaders: zAWS Authorization)r   r   
access_keygetr   r   
startswithr
   r   r   reprr	   r&   r   listitems)methodcanonical_urir   cur_headersZSUBRESOURCES_TO_INCLUDEr<   r$   headercanonical_querystringr%   new_headersr   r   r   sign_request_v2J   s6    	




rH   c             C   s   t | j | j |dS )aE  Sign a URL in s3://bucket/object form with the given expiry
    time. The object will be accessible via the signed URL until the
    AWS key and secret are revoked or the expiry time is reached, even
    if the object is otherwise private.

    See: http://s3.amazonaws.com/doc/s3-developer-guide/RESTAuthentication.html
    )bucketobjectexpiry)sign_url_base_v2rI   rJ   )url_to_signrK   r   r   r   sign_url_v2}   s    rN   c              K   sR  t j  j}t j  j}t| d | d< t j  j| d< t j  j| d< t| d ddd| d< d| d	< t j  jrpd
| d	< td| d  d|  }d}|r||d | 7 }d}|r||d | 7 }d}td| tt	t
|dd| d< td| d  tt j  j| d rd}nd}|d7 }||  }|r4|dt|dd 7 }|rN|dt|dd 7 }|S )zcShared implementation of sign_url methods. Takes a hash of 'bucket', 'object' and 'expiry' as args.rK   r<   	host_baserJ   FT)r:   r   httpprotohttpsz#Expiry interpreted as epoch time %sz'GET


%(expiry)d
/%(bucket)s/%(object)sr   zresponse-content-disposition=&zresponse-content-type=zSigning plaintext: %r)r   sigzUrlencoded signature: %srI   z/%(proto)s://%(bucket)s.%(host_base)s/%(object)sz/%(proto)s://%(host_base)s/%(bucket)s/%(object)szC?AWSAccessKeyId=%(access_key)s&Expires=%(expiry)d&Signature=%(sig)sz&response-content-disposition=z&response-content-type=)r   content_dispositioncontent_typer   r<   rO   r
   signurl_use_httpsr   r&   r   r   host_bucket)parmsrU   rV   ZsigntextZparam_separatorurlr   r   r   rL      s>    



rL   c             C   s   t j| t|tj S )N)r    r!   r   r   r"   )r   msgr   r   r   sign   s    r\   c             C   s4   t td|  |}t ||}t ||}t |d}|S )z1
    Input: unicode params
    Output: bytes
    ZAWS4aws4_request)r\   r   )r   Z	dateStampZ
regionNameZserviceNameZkDateZkRegionZkServiceZkSigningr   r   r   getSignatureKey   s
    


r^   r   	us-east-1    c             C   s^  d}|d krt dd}tj }|j}	|j}
tjj }|jd}|jd}t|
|||}t|ddd}t	|ddj
d	}t|ttd
krt|j }nttt|j }|||d}d}xL|j D ]@}|dks||jdkrq|| j ||j < |d|j  7 }qW d}x.t|j D ]\}}||d | d 7 }qW |}td|  djt|jd}| d | d | d | d | d | }td|  d}|d | d | d d }|d | d | d ttt|j  }ttj|t|tj }|d d |	 d | d d | d d | }t |j }|j|||d td|  |S )Ns3T)r6   z%Y%m%dT%H%M%SZz%Y%m%dF)r:   r   )r   r   r`   )hostzx-amz-content-sha256z
x-amz-datez$host;x-amz-content-sha256;x-amz-dater;   ;r   r9   r7   zcanonical_headers = %sz,Canonical Request:
%s
----------------------zAWS4-HMAC-SHA256r(   r]    zCredential=,zSignedHeaders=z
Signature=)z
x-amz-dater;   zx-amz-content-sha256zsignature-v4 headers: %s)r   r   r<   r   datetimeutcnowstrftimer^   r
   r   lstriptyper   r	   	hexdigestr   r   splitr#   r   rA   r   joinr    r!   update)rB   rb   rC   r   regionrD   bodyZservicecfgr<   r   tZamzdateZ	datestampZsigning_keyrF   Zpayload_hashZcanonical_headersZsigned_headersrE   Zcanonical_headers_strkvZcanonical_request	algorithmZcredential_scoper$   r%   Zauthorization_headerrG   r   r   r   sign_request_v4   sV    



,,0
rv   c                s   y
t  }W n tk
r&   t j }Y nX tt| d~ |d krhxnt fdddD ]}|j| qTW nH j| |}x8|dkr jt	d|}|sP |t
|8 }|j| qxW W d Q R X |S )Nrbc                  s
    j dS )Ni    )readr   )fr   r   <lambda>  s    z&checksum_sha256_file.<locals>.<lambda>r`   r   i    )r   	Exceptionr!   openr   iterrn   seekrx   minlen)filenameoffsetsizehashchunk	size_leftr   )ry   r   checksum_sha256_file   s"    


r   c             C   sV   y
t  }W n tk
r&   t j }Y nX |d kr<|j|  n|j| |||   |S )N)r   r{   r!   rn   )bufferr   r   r   r   r   r   checksum_sha256_buffer  s    
r   )FN)r'   r(   NN)r'   r   r(   Nr_   Nr`   )r   N)r   N)%
__future__r   sysr    base64r   r   ImportErrorr   r   r,   r   	BaseUtilsr   r	   r
   Utilsr   r   r   r   rf   hashlibr   r   __all__r   appendr&   rH   rN   rL   r\   r^   rv   r   r   r   r   r   r   <module>	   s<   



1

# 
>

