aws-sdk-core 2.0.0.rc1

data/lib/aws/signers/handler.rb

@@ -0,0 +1,18 @@
+module Aws
+  module Signers
+    class Handler
+
+      def initialize(signer)
+        @signer = signer
+      end
+
+      attr_accessor :handler
+
+      def call(context)
+        @signer.sign(context)
+        @handler.call(context)
+      end
+
+    end
+  end
+end

data/lib/aws/signers/s3.rb

@@ -0,0 +1,162 @@
+require 'set'
+require 'time'
+require 'digest/sha1'
+require 'openssl'
+require 'uri'
+
+module Aws
+  module Signers
+    class S3
+
+      SIGNED_QUERYSTRING_PARAMS = Set.new(%w(
+
+        acl delete cors lifecycle location logging notification partNumber
+        policy requestPayment restore tagging torrent uploadId uploads
+        versionId versioning versions website
+
+        response-content-type response-content-language
+        response-expires response-cache-control
+        response-content-disposition response-content-encoding
+
+      ))
+
+      def self.sign(context)
+        new(
+          context.config.credentials,
+          context.params
+        ).sign(context.http_request)
+      end
+
+      # @param [Credentials] credentials
+      def initialize(credentials, params)
+        @credentials = credentials
+        @params = Query::ParamList.new
+        params.each_pair do |param_name, param_value|
+          @params.set(param_name, param_value)
+        end
+      end
+
+      attr_reader :credentials, :params
+
+      def sign(request)
+        if token = credentials.session_token
+          request.headers["X-Amz-Security-Token"] = token
+        end
+        request.headers['Authorization'] = authorization(request)
+      end
+
+      # @param [RequestContext] context
+      def self.sign(context)
+        new(context.config.credentials, context.params).
+          sign(context.http_request)
+      end
+
+      private
+
+      def authorization(request)
+        "AWS #{credentials.access_key_id}:#{signature(request)}"
+      end
+
+      def signature(request)
+        secret = credentials.secret_access_key
+        string_to_sign = string_to_sign(request)
+        signature = digest(credentials.secret_access_key, string_to_sign)
+        URI.escape(signature)
+      end
+
+      def digest(secret, string_to_sign)
+        Base64.encode64(hmac(secret, string_to_sign)).strip
+      end
+
+      def hmac(key, value)
+        OpenSSL::HMAC.digest(OpenSSL::Digest::Digest.new('sha1'), key, value)
+      end
+
+      # From the S3 developer guide:
+      #
+      #     StringToSign =
+      #       HTTP-Verb ` "\n" `
+      #       content-md5 ` "\n" `
+      #       content-type ` "\n" `
+      #       date ` "\n" `
+      #       CanonicalizedAmzHeaders + CanonicalizedResource;
+      #
+      def string_to_sign(request)
+        [
+          request.http_method,
+          request.headers.values_at('Content-Md5', 'Content-Type').join("\n"),
+          signing_string_date(request),
+          canonicalized_headers(request),
+          canonicalized_resource(request),
+        ].flatten.compact.join("\n")
+      end
+
+      def signing_string_date(request)
+        # if a date is provided via x-amz-date then we should omit the
+        # Date header from the signing string (should appear as a blank line)
+        if request.headers.detect{|k,v| k.to_s =~ /^x-amz-date$/i }
+          ''
+        else
+          request.headers['Date'] = Time.now.httpdate
+        end
+      end
+
+      # CanonicalizedAmzHeaders
+      #
+      # See the developer guide for more information on how this element
+      # is generated.
+      #
+      def canonicalized_headers(request)
+        x_amz = request.headers.select{|k, v| k =~ /^x-amz-/i }
+        x_amz = x_amz.collect{|k, v| [k.downcase, v] }
+        x_amz = x_amz.sort_by{|k, v| k }
+        x_amz = x_amz.collect{|k, v| "#{k}:#{v.to_s.strip}" }.join("\n")
+        x_amz == '' ? nil : x_amz
+      end
+
+      # From the S3 developer guide
+      #
+      #     CanonicalizedResource =
+      #       [ "/" ` Bucket ] `
+      #       <HTTP-Request-URI, protocol name up to the querystring> +
+      #       [ sub-resource, if present. e.g. "?acl", "?location",
+      #       "?logging", or "?torrent"];
+      #
+      # @api private
+      def canonicalized_resource(request)
+
+        parts = []
+
+        # virtual hosted-style requests require the hostname to appear
+        # in the canonicalized resource prefixed by a forward slash.
+        if bucket = params[:bucket]
+          ssl = request.endpoint.https?
+          if Plugins::S3BucketDns.dns_compatible?(bucket.name, ssl)
+            parts << "/#{bucket.value}"
+          end
+        end
+
+        # append the path name (no querystring)
+        parts << request.path.split('?')[0]
+
+        # lastly any sub resource querystring params need to be appened
+        # in lexigraphical ordered joined by '&' and prefixed by '?'
+        params = signed_querystring_params(request)
+
+        unless params.empty?
+          parts << '?'
+          parts << params.sort.collect{|p| p.to_s }.join('&')
+        end
+
+        parts.join
+      end
+
+      def signed_querystring_params(request)
+        request.querystring.to_s.split('&').select do |p|
+          SIGNED_QUERYSTRING_PARAMS.include?(p.split('=')[0])
+        end.map { |p| URI.decode(p) }
+      end
+
+    end
+  end
+end

data/lib/aws/signers/v2.rb

@@ -0,0 +1,48 @@
+module Aws
+  module Signers
+    class V2 < Base
+
+      # @param [Http::Request] http_request
+      def sign(http_request)
+        params = http_request.body.param_list
+        params.set('AWSAccessKeyId', @credentials.access_key_id)
+        params.set('SecurityToken', @credentials.session_token) if
+          @credentials.session_token
+        params.set('Timestamp', Time.now.utc.strftime('%Y-%m-%dT%H:%M:%SZ'))
+        params.set('SignatureVersion', '2')
+        params.set('SignatureMethod', 'HmacSHA256')
+        params.delete('Signature')
+        params.set('Signature', signature(http_request, params))
+        http_request.body = params.to_io
+      end
+
+      private
+
+      def signature(http_request, params)
+        sha256_hmac(string_to_sign(http_request, params))
+      end
+
+      def string_to_sign(http_request, params)
+        [
+          http_request.http_method,
+          host(http_request),
+          http_request.pathname,
+          params.to_s,
+        ].join("\n")
+      end
+
+      def host(http_request)
+        endpoint = http_request.endpoint
+        host = endpoint.host.downcase
+        if
+          (endpoint.http? && endpoint.port != 80) ||
+          (endpoint.https? && endpoint.port != 443)
+        then
+          host += ":#{endpoint.port}"
+        end
+        host
+      end
+
+    end
+  end
+end

data/lib/aws/signers/v3.rb

@@ -0,0 +1,34 @@
+require 'time'
+require 'base64'
+require 'openssl'
+
+module Aws
+  # @api private
+  module Signers
+    class V3 < Base
+
+      def sign(http_req)
+
+        date = Time.now.httpdate
+        http_req.headers['Date'] = date
+
+        if @credentials.session_token
+          http_req.headers['X-Amz-Security-Token'] = @credentials.session_token
+        end
+
+        parts = []
+        parts << "AWS3-HTTPS AWSAccessKeyId=#{@credentials.access_key_id}"
+        parts << "Algorithm=HmacSHA256"
+        parts << "Signature=#{signature(date)}"
+        http_req.headers['X-Amzn-Authorization'] = parts.join(',')
+      end
+
+      private
+
+      def signature(date)
+        sha256_hmac(date)
+      end
+
+    end
+  end
+end

data/lib/aws/signers/v4.rb

@@ -0,0 +1,142 @@
+require 'time'
+require 'digest/sha1'
+require 'openssl'
+
+module Aws
+  module Signers
+    class V4
+
+      def self.sign(context)
+        new(
+          context.config.credentials,
+          context.config.sigv4_name,
+          context.config.sigv4_region
+        ).sign(context.http_request)
+      end
+
+      # @param [Credentials] credentials
+      # @param [String] service_name The name used by the service in
+      #   signing signature version 4 requests.  This is generally
+      #   the endpoint prefix.
+      # @param [String] region The region (e.g. 'us-west-1') the request
+      #   will be made to.
+      def initialize(credentials, service_name, region)
+        @credentials = credentials
+        @service_name = service_name
+        @region = region
+      end
+
+      # @param [Seahorse::Client::Http::Request] request
+      # @return [Seahorse::Client::Http::Request] the signed request.
+      def sign(request)
+        datetime = Time.now.utc.strftime("%Y%m%dT%H%M%SZ")
+        request.headers['X-Amz-Date'] = datetime
+        request.headers['Host'] = request.endpoint.host
+        request.headers['X-Amz-Security-Token'] = credentials.session_token if
+          credentials.session_token
+        request.headers['X-Amz-Content-Sha256'] ||= hexdigest(request.body)
+        request.headers['Authorization'] = authorization(request, datetime)
+        request
+      end
+
+      def authorization(request, datetime)
+        parts = []
+        parts << "AWS4-HMAC-SHA256 Credential=#{credentials.access_key_id}/#{credential_scope(datetime)}"
+        parts << "SignedHeaders=#{signed_headers(request)}"
+        parts << "Signature=#{signature(request, datetime)}"
+        parts.join(', ')
+      end
+
+      def signature(request, datetime)
+        k_secret = credentials.secret_access_key
+        k_date = hmac("AWS4" + k_secret, datetime[0,8])
+        k_region = hmac(k_date, region)
+        k_service = hmac(k_region, service_name)
+        k_credentials = hmac(k_service, 'aws4_request')
+        hexhmac(k_credentials, string_to_sign(request, datetime))
+      end
+
+      def string_to_sign(request, datetime)
+        parts = []
+        parts << 'AWS4-HMAC-SHA256'
+        parts << datetime
+        parts << credential_scope(datetime)
+        parts << hexdigest(canonical_request(request))
+        parts.join("\n")
+      end
+
+      def credential_scope(datetime)
+        parts = []
+        parts << datetime[0,8]
+        parts << region
+        parts << service_name
+        parts << 'aws4_request'
+        parts.join("/")
+      end
+
+      def canonical_request(request)
+        [
+          request.http_method,
+          request.pathname,
+          request.querystring,
+          canonical_headers(request) + "\n",
+          signed_headers(request),
+          request.headers['X-Amz-Content-Sha256']
+        ].join("\n")
+      end
+
+      def signed_headers(request)
+        headers = request.headers.keys
+        headers.delete('authorization')
+        headers.sort.join(';')
+      end
+
+      def canonical_headers(request)
+        headers = []
+        request.headers.each_pair do |k,v|
+          k = k.downcase
+          headers << [k,v] unless k == 'authorization'
+        end
+        headers = headers.sort_by(&:first)
+        headers.map{|k,v| "#{k}:#{canonical_header_value(v.to_s)}" }.join("\n")
+      end
+
+      def canonical_header_value(value)
+        value.match(/^".*"$/) ? value : value.gsub(/\s+/, ' ').strip
+      end
+
+      def hexdigest(value)
+        digest = Digest::SHA256.new
+        if value.respond_to?(:read)
+          chunk = nil
+          chunk_size = 1024 * 1024 # 1 megabyte
+          digest.update(chunk) while chunk = value.read(chunk_size)
+          value.rewind
+        else
+          digest.update(value)
+        end
+        digest.hexdigest
+      end
+
+      def hmac(key, value)
+        OpenSSL::HMAC.digest(OpenSSL::Digest::Digest.new('sha256'), key, value)
+      end
+
+      def hexhmac(key, value)
+        OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('sha256'), key, value)
+      end
+
+      private
+
+      # @return [Credentials]
+      attr_reader :credentials
+
+      # @return [String]
+      attr_reader :service_name
+
+      # @return [String]
+      attr_reader :region
+
+    end
+  end
+end

data/lib/aws/structure.rb

@@ -0,0 +1,38 @@
+module Aws
+  # @api private
+  class Structure < Struct
+
+    @classes = {}
+
+    # Yields non-nil property names and values.
+    def each(&block)
+      members.each do |member|
+        value = self[member]
+        yield(member, value) unless value.nil?
+      end
+    end
+    alias each_pair each
+
+    # @overload to_hash()
+    #   @return [Hash]
+    def to_hash(obj = self)
+      case obj
+      when Structure
+        obj.members.inject({}) do |hash, member|
+          hash[member] = to_hash(obj[member]) unless obj[member].nil?
+          hash
+        end
+      when Array then obj.map { |v| to_hash(v) }
+      else obj
+      end
+    end
+
+    # @param [Array<Symbol>] properties
+    # @return [Structure]
+    def self.new(properties, values = [])
+      properties = [:_] if properties.empty?
+      (@classes[properties] ||= super(*properties)).new(*values)
+    end
+
+  end
+end