aws-sdk-core 2.11.549

data/lib/aws-sdk-core/shared_credentials.rb

@@ -0,0 +1,71 @@
+module Aws
+  class SharedCredentials
+
+    include CredentialProvider
+
+    # @api private
+    KEY_MAP = {
+      'aws_access_key_id' => 'access_key_id',
+      'aws_secret_access_key' => 'secret_access_key',
+      'aws_session_token' => 'session_token',
+    }
+
+    # Constructs a new SharedCredentials object. This will load AWS access
+    # credentials from an ini file, which supports profiles. The default
+    # profile name is 'default'. You can specify the profile name with the
+    # `ENV['AWS_PROFILE']` or with the `:profile_name` option.
+    #
+    # @option [String] :path Path to the shared file.  Defaults
+    #   to "#{Dir.home}/.aws/credentials".
+    #
+    # @option [String] :profile_name Defaults to 'default' or
+    #   `ENV['AWS_PROFILE']`.
+    #
+    def initialize(options = {})
+      shared_config = Aws.shared_config
+      @path = options[:path]
+      @path ||= shared_config.credentials_path
+      @profile_name = options[:profile_name]
+      @profile_name ||= ENV['AWS_PROFILE']
+      @profile_name ||= shared_config.profile_name
+      if @path && @path == shared_config.credentials_path
+        @credentials = shared_config.credentials(profile: @profile_name)
+      else
+        config = SharedConfig.new(
+          credentials_path: @path,
+          profile_name: @profile_name
+        )
+        @credentials = config.credentials(profile: @profile_name)
+      end
+    end
+
+    # @return [String]
+    attr_reader :path
+
+    # @return [String]
+    attr_reader :profile_name
+
+    # @return [Credentials]
+    attr_reader :credentials
+
+    # @api private
+    def inspect
+      parts = [
+        self.class.name,
+        "profile_name=#{profile_name.inspect}",
+        "path=#{path.inspect}",
+      ]
+      "#<#{parts.join(' ')}>"
+    end
+
+    # @deprecated This method is no longer used.
+    # @return [Boolean] Returns `true` if a credential file
+    #   exists and has appropriate read permissions at {#path}.
+    # @note This method does not indicate if the file found at {#path}
+    #   will be parsable, only if it can be read.
+    def loadable?
+      !path.nil? && File.exist?(path) && File.readable?(path)
+    end
+
+  end
+end

data/lib/aws-sdk-core/shield.rb

@@ -0,0 +1,6 @@
+Aws.add_service(:Shield, {
+  api: "#{Aws::API_DIR}/shield/2016-06-02/api-2.json",
+  docs: "#{Aws::API_DIR}/shield/2016-06-02/docs-2.json",
+  examples: "#{Aws::API_DIR}/shield/2016-06-02/examples-1.json",
+  paginators: "#{Aws::API_DIR}/shield/2016-06-02/paginators-1.json",
+})

data/lib/aws-sdk-core/signer.rb

@@ -0,0 +1,7 @@
+Aws.add_service(:Signer, {
+  api: "#{Aws::API_DIR}/signer/2017-08-25/api-2.json",
+  docs: "#{Aws::API_DIR}/signer/2017-08-25/docs-2.json",
+  examples: "#{Aws::API_DIR}/signer/2017-08-25/examples-1.json",
+  paginators: "#{Aws::API_DIR}/signer/2017-08-25/paginators-1.json",
+  waiters: "#{Aws::API_DIR}/signer/2017-08-25/waiters-2.json",
+})

data/lib/aws-sdk-core/signers/base.rb

@@ -0,0 +1,31 @@
+require 'openssl'
+
+module Aws
+  module Signers
+    class Base
+
+      # @param [Credentials] credentials
+      def initialize(credentials)
+        @credentials = credentials.credentials
+      end
+
+      private
+
+      def sha256_hmac(value)
+        Base64.encode64(
+          OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'),
+            @credentials.secret_access_key, value)
+        ).strip
+      end
+
+      class << self
+
+        # @param [Seahorse::Client::RequestContext] context
+        def sign(context)
+          new(context.config.credentials).sign(context.http_request)
+        end
+
+      end
+    end
+  end
+end

data/lib/aws-sdk-core/signers/s3.rb

@@ -0,0 +1,185 @@
+require 'set'
+require 'time'
+require 'openssl'
+require 'cgi'
+require 'webrick/httputils'
+
+module Aws
+  module Signers
+    class S3
+
+      SIGNED_QUERYSTRING_PARAMS = Set.new(%w(
+
+        acl delete cors lifecycle location logging notification partNumber
+        policy requestPayment restore tagging torrent uploadId uploads
+        versionId versioning versions website replication requestPayment
+        accelerate
+
+        response-content-type response-content-language
+        response-expires response-cache-control
+        response-content-disposition response-content-encoding
+
+      ))
+
+      def self.sign(context)
+        new(
+          context.config.credentials,
+          context.params,
+          context.config.force_path_style
+        ).sign(context.http_request)
+      end
+
+      # @param [CredentialProvider] credentials
+      def initialize(credentials, params, force_path_style)
+        @credentials = credentials.credentials
+        @params = Query::ParamList.new
+        params.each_pair do |param_name, param_value|
+          @params.set(param_name, param_value)
+        end
+        @force_path_style = force_path_style
+      end
+
+      attr_reader :credentials, :params
+
+      def sign(request)
+        if token = credentials.session_token
+          request.headers["X-Amz-Security-Token"] = token
+        end
+        request.headers['Authorization'] = authorization(request)
+      end
+
+      def authorization(request)
+        "AWS #{credentials.access_key_id}:#{signature(request)}"
+      end
+
+      def signature(request)
+        string_to_sign = string_to_sign(request)
+        signature = digest(credentials.secret_access_key, string_to_sign)
+        uri_escape(signature)
+      end
+
+      def digest(secret, string_to_sign)
+        Base64.encode64(hmac(secret, string_to_sign)).strip
+      end
+
+      def hmac(key, value)
+        OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha1'), key, value)
+      end
+
+      # From the S3 developer guide:
+      #
+      #     StringToSign =
+      #       HTTP-Verb ` "\n" `
+      #       content-md5 ` "\n" `
+      #       content-type ` "\n" `
+      #       date ` "\n" `
+      #       CanonicalizedAmzHeaders + CanonicalizedResource;
+      #
+      def string_to_sign(request)
+        [
+          request.http_method,
+          request.headers.values_at('Content-Md5', 'Content-Type').join("\n"),
+          signing_string_date(request),
+          canonicalized_headers(request),
+          canonicalized_resource(request.endpoint),
+        ].flatten.compact.join("\n")
+      end
+
+      def signing_string_date(request)
+        # if a date is provided via x-amz-date then we should omit the
+        # Date header from the signing string (should appear as a blank line)
+        if request.headers.detect{|k,v| k.to_s =~ /^x-amz-date$/i }
+          ''
+        else
+          request.headers['Date'] = Time.now.httpdate
+        end
+      end
+
+      # CanonicalizedAmzHeaders
+      #
+      # See the developer guide for more information on how this element
+      # is generated.
+      #
+      def canonicalized_headers(request)
+        x_amz = request.headers.select{|k, v| k =~ /^x-amz-/i }
+        x_amz = x_amz.collect{|k, v| [k.downcase, v] }
+        x_amz = x_amz.sort_by{|k, v| k }
+        x_amz = x_amz.collect{|k, v| "#{k}:#{v.to_s.strip}" }.join("\n")
+        x_amz == '' ? nil : x_amz
+      end
+
+      # From the S3 developer guide
+      #
+      #     CanonicalizedResource =
+      #       [ "/" ` Bucket ] `
+      #       <HTTP-Request-URI, protocol name up to the querystring> +
+      #       [ sub-resource, if present. e.g. "?acl", "?location",
+      #       "?logging", or "?torrent"];
+      #
+      # @api private
+      def canonicalized_resource(endpoint)
+
+        parts = []
+
+        # virtual hosted-style requests require the hostname to appear
+        # in the canonicalized resource prefixed by a forward slash.
+        if bucket = params[:bucket]
+          bucket = bucket.value
+          ssl = endpoint.scheme == 'https'
+          if Plugins::S3BucketDns.dns_compatible?(bucket, ssl) && !@force_path_style
+            parts << "/#{bucket}"
+          end
+        end
+
+        # append the path name (no querystring)
+        parts << endpoint.path
+
+        # lastly any sub resource querystring params need to be appened
+        # in lexigraphical ordered joined by '&' and prefixed by '?'
+        params = signed_querystring_params(endpoint)
+
+        unless params.empty?
+          parts << '?'
+          parts << params.sort.collect{|p| p.to_s }.join('&')
+        end
+
+        parts.join
+      end
+
+      def signed_querystring_params(endpoint)
+        endpoint.query.to_s.split('&').select do |p|
+          SIGNED_QUERYSTRING_PARAMS.include?(p.split('=')[0])
+        end.map { |p| CGI.unescape(p) }
+      end
+
+      def uri_escape(s)
+
+        #URI.escape(s)
+
+        # URI.escape is deprecated, replacing it with escape from webrick
+        # to squelch the massive number of warnings generated from Ruby.
+        # The following script was used to determine the differences
+        # between the various escape methods available. The webrick
+        # escape only had two differences and it is available in the
+        # standard lib.
+        #
+        #     (0..255).each {|c|
+        #       s = [c].pack("C")
+        #       e = [
+        #         CGI.escape(s),
+        #         ERB::Util.url_encode(s),
+        #         URI.encode_www_form_component(s),
+        #         WEBrick::HTTPUtils.escape_form(s),
+        #         WEBrick::HTTPUtils.escape(s),
+        #         URI.escape(s),
+        #       ]
+        #       next if e.uniq.length == 1
+        #       puts("%5s %5s %5s %5s %5s %5s %5s" % ([s.inspect] + e))
+        #     }
+        #
+        WEBrick::HTTPUtils.escape(s).gsub('%5B', '[').gsub('%5D', ']')
+      end
+
+    end
+  end
+end

data/lib/aws-sdk-core/signers/v2.rb

@@ -0,0 +1,51 @@
+module Aws
+  module Signers
+    class V2 < Base
+
+      # @param [Http::Request] http_request
+      def sign(http_request)
+        params = http_request.body.param_list
+        params.set('AWSAccessKeyId', @credentials.access_key_id)
+        params.set('SecurityToken', @credentials.session_token) if
+          @credentials.session_token
+        params.set('Timestamp', Time.now.utc.strftime('%Y-%m-%dT%H:%M:%SZ'))
+        params.set('SignatureVersion', '2')
+        params.set('SignatureMethod', 'HmacSHA256')
+        params.delete('Signature')
+        params.set('Signature', signature(http_request, params))
+        http_request.body = params.to_io
+      end
+
+      private
+
+      def signature(http_request, params)
+        sha256_hmac(string_to_sign(http_request, params))
+      end
+
+      def string_to_sign(http_request, params)
+        [
+          http_request.http_method,
+          host(http_request.endpoint),
+          path(http_request.endpoint),
+          params.to_s,
+        ].join("\n")
+      end
+
+      def host(endpoint)
+        host = endpoint.host.downcase
+        if
+          (endpoint.scheme == 'http' && endpoint.port != 80) ||
+          (endpoint.scheme == 'https' && endpoint.port != 443)
+        then
+          host += ":#{endpoint.port}"
+        end
+        host
+      end
+
+      def path(endpoint)
+        endpoint.path == '' ? '/' : endpoint.path
+      end
+
+    end
+  end
+end

data/lib/aws-sdk-core/signers/v3.rb

@@ -0,0 +1,34 @@
+require 'time'
+require 'base64'
+require 'openssl'
+
+module Aws
+  # @api private
+  module Signers
+    class V3 < Base
+
+      def sign(http_req)
+
+        date = Time.now.httpdate
+        http_req.headers['Date'] = date
+
+        if @credentials.session_token
+          http_req.headers['X-Amz-Security-Token'] = @credentials.session_token
+        end
+
+        parts = []
+        parts << "AWS3-HTTPS AWSAccessKeyId=#{@credentials.access_key_id}"
+        parts << "Algorithm=HmacSHA256"
+        parts << "Signature=#{signature(date)}"
+        http_req.headers['X-Amzn-Authorization'] = parts.join(',')
+      end
+
+      private
+
+      def signature(date)
+        sha256_hmac(date)
+      end
+
+    end
+  end
+end

data/lib/aws-sdk-core/signers/v4.rb

@@ -0,0 +1,234 @@
+require 'time'
+require 'openssl'
+
+module Aws
+  module Signers
+    class V4
+
+      BLACKLIST_HEADERS = [
+        'cache-control',
+        'content-length',
+        'expect',
+        'max-forwards',
+        'pragma',
+        'te',
+        'if-match',
+        'if-none-match',
+        'if-modified-since',
+        'if-unmodified-since',
+        'if-range',
+        'accept',
+        'authorization',
+        'proxy-authorization',
+        'from',
+        'referer',
+        'user-agent',
+        'x-amzn-trace-id'
+      ]
+
+      def self.sign(context)
+        new(
+          context.config.credentials,
+          context.config.sigv4_name,
+          context.config.sigv4_region
+        ).sign(context.http_request)
+      end
+
+      # @param [Credentials] credentials
+      # @param [String] service_name The name used by the service in
+      #   signing signature version 4 requests.  This is generally
+      #   the endpoint prefix.
+      # @param [String] region The region (e.g. 'us-west-1') the request
+      #   will be made to.
+      def initialize(credentials, service_name, region)
+        @service_name = service_name
+        @credentials = credentials.credentials
+        @region = EndpointProvider.signing_region(region, service_name)
+      end
+
+      # @param [Seahorse::Client::Http::Request] req
+      # @return [Seahorse::Client::Http::Request] the signed request.
+      def sign(req)
+        datetime = Time.now.utc.strftime("%Y%m%dT%H%M%SZ")
+        body_digest = req.headers['X-Amz-Content-Sha256'] || hexdigest(req.body)
+        req.headers['X-Amz-Date'] = datetime
+        req.headers['Host'] = host(req.endpoint)
+        req.headers['X-Amz-Security-Token'] = @credentials.session_token if
+          @credentials.session_token
+        req.headers['X-Amz-Content-Sha256'] ||= body_digest
+        req.headers['Authorization'] = authorization(req, datetime, body_digest)
+        req
+      end
+
+      # Generates an returns a presigned URL.
+      # @param [Seahorse::Client::Http::Request] request
+      # @option options [required, Integer<Seconds>] :expires_in
+      # @option options [optional, String] :body_digest The SHA256 hexdigest of
+      #   the payload to sign.  For S3, this should be the string literal
+      #   `UNSIGNED-PAYLOAD`.
+      # @return [String]
+      # @api private
+      def presigned_url(request, options = {})
+        now = Time.now.utc.strftime("%Y%m%dT%H%M%SZ")
+        body_digest = options[:body_digest] || hexdigest(request.body)
+
+        request.headers['Host'] = host(request.endpoint)
+        request.headers.delete('User-Agent')
+
+        params = Aws::Query::ParamList.new
+
+        request.headers.keys.each do |key|
+          if key.match(/^x-amz/i)
+            params.set(key, request.headers.delete(key))
+          end
+        end
+
+        params.set("X-Amz-Algorithm", "AWS4-HMAC-SHA256")
+        params.set("X-Amz-Credential", credential(now))
+        params.set("X-Amz-Date", now)
+        params.set("X-Amz-Expires", options[:expires_in].to_s)
+        params.set("X-Amz-SignedHeaders", signed_headers(request))
+        params.set('X-Amz-Security-Token', @credentials.session_token) if
+          @credentials.session_token
+
+        endpoint = request.endpoint
+        if endpoint.query
+          endpoint.query += '&' + params.to_s
+        else
+          endpoint.query = params.to_s
+        end
+        endpoint.to_s + '&X-Amz-Signature=' + signature(request, now, body_digest)
+      end
+
+      def authorization(request, datetime, body_digest)
+        parts = []
+        parts << "AWS4-HMAC-SHA256 Credential=#{credential(datetime)}"
+        parts << "SignedHeaders=#{signed_headers(request)}"
+        parts << "Signature=#{signature(request, datetime, body_digest)}"
+        parts.join(', ')
+      end
+
+      def credential(datetime)
+        "#{@credentials.access_key_id}/#{credential_scope(datetime)}"
+      end
+
+      def signature(request, datetime, body_digest)
+        k_secret = @credentials.secret_access_key
+        k_date = hmac("AWS4" + k_secret, datetime[0,8])
+        k_region = hmac(k_date, @region)
+        k_service = hmac(k_region, @service_name)
+        k_credentials = hmac(k_service, 'aws4_request')
+        hexhmac(k_credentials, string_to_sign(request, datetime, body_digest))
+      end
+
+      def string_to_sign(request, datetime, body_digest)
+        parts = []
+        parts << 'AWS4-HMAC-SHA256'
+        parts << datetime
+        parts << credential_scope(datetime)
+        parts << hexdigest(canonical_request(request, body_digest))
+        parts.join("\n")
+      end
+
+      def credential_scope(datetime)
+        parts = []
+        parts << datetime[0,8]
+        parts << @region
+        parts << @service_name
+        parts << 'aws4_request'
+        parts.join("/")
+      end
+
+      def canonical_request(request, body_digest)
+        [
+          request.http_method,
+          path(request.endpoint),
+          normalized_querystring(request.endpoint.query || ''),
+          canonical_headers(request) + "\n",
+          signed_headers(request),
+          body_digest
+        ].join("\n")
+      end
+
+      def path(uri)
+        path = uri.path == '' ? '/' : uri.path
+        if @service_name == 's3'
+          path
+        else
+          Seahorse::Util.uri_path_escape(path)
+        end
+      end
+
+      def normalized_querystring(querystring)
+        params = querystring.split('&')
+        params = params.map { |p| p.match(/=/) ? p : p + '=' }
+        # We have to sort by param name and preserve order of params that
+        # have the same name. Default sort <=> in JRuby will swap members
+        # occasionally when <=> is 0 (considered still sorted), but this
+        # causes our normalized query string to not match the sent querystring.
+        # When names match, we then sort by their original order
+        params = params.each.with_index.sort do |a, b|
+          a, a_offset = a
+          a_name = a.split('=')[0]
+          b, b_offset = b
+          b_name = b.split('=')[0]
+          if a_name == b_name
+            a_offset <=> b_offset
+          else
+            a_name <=> b_name
+          end
+        end.map(&:first).join('&')
+      end
+
+      def signed_headers(request)
+        request.headers.keys.inject([]) do |signed_headers, header_key|
+          header_key = header_key.downcase
+          unless BLACKLIST_HEADERS.include?(header_key)
+            signed_headers << header_key
+          end
+          signed_headers
+        end.sort.join(';')
+      end
+
+      def canonical_headers(request)
+        headers = []
+        request.headers.each_pair do |k,v|
+          k = k.downcase
+          headers << [k,v] unless BLACKLIST_HEADERS.include?(k)
+        end
+        headers = headers.sort_by(&:first)
+        headers.map{|k,v| "#{k}:#{canonical_header_value(v.to_s)}" }.join("\n")
+      end
+
+      def canonical_header_value(value)
+        value.match(/^".*"$/) ? value : value.gsub(/\s+/, ' ').strip
+      end
+
+      def host(uri)
+        if standard_port?(uri)
+          uri.host
+        else
+          "#{uri.host}:#{uri.port}"
+        end
+      end
+
+      def standard_port?(uri)
+        (uri.scheme == 'http' && uri.port == 80) ||
+        (uri.scheme == 'https' && uri.port == 443)
+      end
+
+      def hexdigest(value)
+        Aws::Checksums.sha256_hexdigest(value)
+      end
+
+      def hmac(key, value)
+        OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), key, value)
+      end
+
+      def hexhmac(key, value)
+        OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha256'), key, value)
+      end
+
+    end
+  end
+end