fog 1.24.0 → 1.25.0

data/lib/fog/aws/requests/storage/delete_object.rb

@@ -14,9 +14,9 @@ module Fog
 
         def delete_object(bucket_name, object_name, options = {})
           if version_id = options.delete('versionId')
-            path = "#{CGI.escape(object_name)}?versionId=#{CGI.escape(version_id)}"
+            query = {'versionId' => version_id}
           else
-            path = CGI.escape(object_name)
+            query = {}
           end
 
           headers = options
@@ -24,9 +24,10 @@ module Fog
             :expects    => 204,
             :headers    => headers,
             :bucket_name => bucket_name,
+            :object_name => object_name,
             :idempotent => true,
             :method     => 'DELETE',
-            :path       => path
+            :query      => query
           })
         end
       end

data/lib/fog/aws/requests/storage/post_object_hidden_fields.rb

@@ -23,12 +23,30 @@ module Fog
         # @see http://docs.amazonwebservices.com/AmazonS3/latest/dev/HTTPPOSTForms.html
         #
         def post_object_hidden_fields(options = {})
-          if options['policy']
-            options['policy'] = Base64.encode64(Fog::JSON.encode(options['policy'])).gsub("\n", "")
-            options['AWSAccessKeyId'] = @aws_access_key_id
-            options['Signature'] = Base64.encode64(@hmac.sign(options['policy'])).gsub("\n", "")
+          options = options.dup
+          if policy = options['policy']
+            date = Fog::Time.now
+            credential = "#{@aws_access_key_id}/#{@signer.credential_scope(date)}"
+            extra_conditions = [
+              {'x-amz-date' => date.to_iso8601_basic},
+              {'x-amz-credential' => credential},
+              {'x-amz-algorithm' => Fog::AWS::SignatureV4::ALGORITHM}
+            ]
+
+            extra_conditions << {'x-amz-security-token' => @aws_session_token } if @aws_session_token
+
+            policy_with_auth_fields = policy.merge('conditions' => policy['conditions'] + extra_conditions)
+
+            options['policy'] = Base64.encode64(Fog::JSON.encode(policy_with_auth_fields)).gsub("\n", "")
+            options['X-Amz-Credential'] = credential
+            options['X-Amz-Date'] = date.to_iso8601_basic
+            options['X-Amz-Algorithm'] = Fog::AWS::SignatureV4::ALGORITHM
+            if @aws_session_token
+              options['X-Amz-Security-Token'] = @aws_session_token         
+            end
+            options['X-Amz-Signature'] = @signer.derived_hmac(date).sign(options['policy']).unpack('H*').first
           end
-          options
+          options          
         end
       end
     end

data/lib/fog/aws/requests/storage/post_object_restore.rb

@@ -33,7 +33,7 @@ module Fog
             :body     => data,
             :method   => 'POST',
             :query    => {'restore' => nil},
-            :path     => CGI.escape(object_name)
+            :object_name  => object_name
           })
         end
       end

data/lib/fog/aws/requests/storage/put_bucket_website.rb

@@ -5,28 +5,56 @@ module Fog
         # Change website configuration for an S3 bucket
         #
         # @param bucket_name [String] name of bucket to modify
-        # @param suffix [String] suffix to append to requests for the bucket
         # @param options [Hash]
-        # @option options key [String] key to use for 4XX class errors
+        # @option options RedirectAllRequestsTo [String] Host name to redirect all requests to - if this is set, other options are ignored
+        # @option options IndexDocument [String] suffix to append to requests for the bucket
+        # @option options ErrorDocument [String] key to use for 4XX class errors
         #
         # @see http://docs.amazonwebservices.com/AmazonS3/latest/API/RESTBucketPUTwebsite.html
 
-        def put_bucket_website(bucket_name, suffix, options = {})
-          data =
-<<-DATA
-<WebsiteConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-    <IndexDocument>
-        <Suffix>#{suffix}</Suffix>
-    </IndexDocument>
-DATA
-
-          if options[:key]
-            data <<
-<<-DATA
-<ErrorDocument>
-    <Key>#{options[:key]}</Key>
-</ErrorDocument>
-DATA
+        def put_bucket_website(bucket_name, options, options_to_be_deprecated = {})
+          options ||= {}
+
+          # Method used to be called with the suffix as the second parameter. Warn user that this is not the case any more and move on
+          if options.is_a?(String)
+            Fog::Logger.deprecation("put_bucket_website with #{options.class} param is deprecated, use put_bucket_website('#{bucket_name}', :IndexDocument => '#{options}') instead [light_black](#{caller.first})[/]")
+            options = { :IndexDocument => options }
+          end
+
+          # Parameter renamed from "key" to "ErrorDocument"
+          if options_to_be_deprecated[:key]
+            Fog::Logger.deprecation("put_bucket_website with three parameters is deprecated, use put_bucket_website('#{bucket_name}', :ErrorDocument => '#{options_to_be_deprecated[:key]}') instead [light_black](#{caller.first})[/]")
+            options[:ErrorDocument] = options_to_be_deprecated[:key]
+          end
+
+          options.merge!(options_to_be_deprecated) { |key, o1, o2| o1 }
+
+          data = "<WebsiteConfiguration xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\">"
+
+          if options[:RedirectAllRequestsTo]
+            # Redirect precludes all other options
+            data << <<-DATA
+                      <RedirectAllRequestsTo>
+                        <HostName>#{options[:RedirectAllRequestsTo]}</HostName>
+                      </RedirectAllRequestsTo>
+                    DATA
+          else
+
+            if options[:IndexDocument]
+            data << <<-DATA
+                      <IndexDocument>
+                        <Suffix>#{options[:IndexDocument]}</Suffix>
+                      </IndexDocument>
+                    DATA
+            end
+
+            if options[:ErrorDocument]
+              data << <<-DATA
+                        <ErrorDocument>
+                          <Key>#{options[:ErrorDocument]}</Key>
+                        </ErrorDocument>
+                      DATA
+            end
           end
 
           data << '</WebsiteConfiguration>'

data/lib/fog/aws/ses.rb

@@ -48,7 +48,6 @@ module Fog
         # ==== Returns
         # * SES object with connection to AWS.
         def initialize(options={})
-          require 'fog/core/parser'
 
           @use_iam_profile = options[:use_iam_profile]
           setup_credentials(options)
@@ -114,7 +113,7 @@ module Fog
           end
         end
 
-        def _requrest(body, headers, idempotent, parser)
+        def _request(body, headers, idempotent, parser)
           @connection.request({
             :body       => body,
             :expects    => 200,

data/lib/fog/aws/signaturev4.rb

@@ -4,6 +4,7 @@ require 'fog/aws/core'
 module Fog
   module AWS
     class SignatureV4
+      ALGORITHM = 'AWS4-HMAC-SHA256'
       def initialize(aws_access_key_id, secret_key, region,service)
         @region = region
         @service = service
@@ -11,33 +12,86 @@ module Fog
         @hmac = Fog::HMAC.new('sha256', 'AWS4' + secret_key)
       end
 
-      def sign(params, date)
+      def signature_parameters(params, date, body_sha = nil)
+        params = params.dup.merge(:query => params[:query].merge(
+          'X-Amz-Algorithm' => ALGORITHM,
+          'X-Amz-Credential' => "#{@aws_access_key_id}/#{credential_scope(date)}",
+          'X-Amz-SignedHeaders' => signed_headers(params[:headers])
+        ))
+        signature_components(params, date, body_sha)
+      end
+
+      def signature_header(params, date, body_sha = nil)
+        components_to_header(signature_components(params, date, body_sha))
+      end
+
+      def sign(params, date) #legacy method name
+        signature_header(params, date)
+      end
+
+      def components_to_header components
+        "#{components['X-Amz-Algorithm']} Credential=#{components['X-Amz-Credential']}, SignedHeaders=#{components['X-Amz-SignedHeaders']}, Signature=#{components['X-Amz-Signature']}" 
+      end
+
+      def signature_components(params, date, body_sha)
         canonical_request = <<-DATA
 #{params[:method].to_s.upcase}
-#{params[:path]}
+#{canonical_path(params[:path])}
 #{canonical_query_string(params[:query])}
 #{canonical_headers(params[:headers])}
 #{signed_headers(params[:headers])}
-#{Digest::SHA256.hexdigest(params[:body] || '')}
+#{body_sha || Digest::SHA256.hexdigest(params[:body] || '')}
 DATA
         canonical_request.chop!
-        credential_scope = "#{date.utc.strftime('%Y%m%d')}/#{@region}/#{@service}/aws4_request"
+        
         string_to_sign = <<-DATA
-AWS4-HMAC-SHA256
+#{ALGORITHM}
 #{date.to_iso8601_basic}
-#{credential_scope}
+#{credential_scope(date)}
 #{Digest::SHA256.hexdigest(canonical_request)}
 DATA
 
         string_to_sign.chop!
-
+        
         signature = derived_hmac(date).sign(string_to_sign)
 
-        "AWS4-HMAC-SHA256 Credential=#{@aws_access_key_id}/#{credential_scope}, SignedHeaders=#{signed_headers(params[:headers])}, Signature=#{signature.unpack('H*').first}"
+        {
+          'X-Amz-Algorithm' => ALGORITHM,
+          'X-Amz-Credential' => "#{@aws_access_key_id}/#{credential_scope(date)}",
+          'X-Amz-SignedHeaders' => signed_headers(params[:headers]),
+          'X-Amz-Signature' => signature.unpack('H*').first
+        }
+      end
+
+      def derived_hmac(date)
+        kDate = @hmac.sign(date.utc.strftime('%Y%m%d'))
+        kRegion = Fog::HMAC.new('sha256', kDate).sign(@region)
+        kService = Fog::HMAC.new('sha256', kRegion).sign(@service)
+        kSigning = Fog::HMAC.new('sha256', kService).sign('aws4_request')
+        Fog::HMAC.new('sha256', kSigning)
+      end
+
+
+      def credential_scope(date)
+        "#{date.utc.strftime('%Y%m%d')}/#{@region}/#{@service}/aws4_request"
       end
 
       protected
 
+      def canonical_path(path)
+        components = path.split(%r{/+}, -1)
+        path = components.inject([]) do |acc, component|
+          case component
+          when '.'   #canonicalize by removing .
+          when '..' then acc.pop#canonicalize by reducing ..
+          else
+            acc << component
+          end
+          acc
+        end.join('/')
+        path.empty? ? '/' : path
+      end
+
       def canonical_query_string(query)
         canonical_query_string = []
         for key in (query || {}).keys.sort_by {|k| k.to_s}
@@ -60,13 +114,6 @@ DATA
         headers.keys.map {|key| key.to_s}.sort.map {|key| key.downcase}.join(';')
       end
 
-      def derived_hmac(date)
-        kDate = @hmac.sign(date.utc.strftime('%Y%m%d'))
-        kRegion = Fog::HMAC.new('sha256', kDate).sign(@region)
-        kService = Fog::HMAC.new('sha256', kRegion).sign(@service)
-        kSigning = Fog::HMAC.new('sha256', kService).sign('aws4_request')
-        Fog::HMAC.new('sha256', kSigning)
-      end
     end
   end
 end

data/lib/fog/aws/simpledb.rb

@@ -70,7 +70,6 @@ module Fog
         # ==== Returns
         # * SimpleDB object with connection to aws.
         def initialize(options={})
-          require 'fog/core/parser'
 
           @use_iam_profile = options[:use_iam_profile]
           setup_credentials(options)

data/lib/fog/aws/sns.rb

@@ -49,12 +49,12 @@ module Fog
         # * SNS object with connection to AWS.
         def initialize(options={})
           @use_iam_profile = options[:use_iam_profile]
-          setup_credentials(options)
           @connection_options     = options[:connection_options] || {}
           @instrumentor       = options[:instrumentor]
           @instrumentor_name  = options[:instrumentor_name] || 'fog.aws.sns'
 
           options[:region] ||= 'us-east-1'
+          @region = options[:region]
           @host = options[:host] || "sns.#{options[:region]}.amazonaws.com"
 
           @path       = options[:path]        || '/'
@@ -62,6 +62,8 @@ module Fog
           @port       = options[:port]        || 443
           @scheme     = options[:scheme]      || 'https'
           @connection = Fog::XML::Connection.new("#{@scheme}://#{@host}:#{@port}#{@path}", @persistent, @connection_options)
+
+          setup_credentials(options)
         end
 
         def reload
@@ -76,7 +78,7 @@ module Fog
           @aws_session_token     = options[:aws_session_token]
           @aws_credentials_expire_at = options[:aws_credentials_expire_at]
 
-          @hmac       = Fog::HMAC.new('sha256', @aws_secret_access_key)
+          @signer = Fog::AWS::SignatureV4.new( @aws_access_key_id, @aws_secret_access_key, @region, 'sns')
         end
 
         def request(params)
@@ -85,12 +87,13 @@ module Fog
           idempotent  = params.delete(:idempotent)
           parser      = params.delete(:parser)
 
-          body = AWS.signed_params(
+          body, headers = AWS.signed_params_v4(
             params,
+            { 'Content-Type' => 'application/x-www-form-urlencoded' },
             {
-              :aws_access_key_id  => @aws_access_key_id,
+              :method             => 'POST',
               :aws_session_token  => @aws_session_token,
-              :hmac               => @hmac,
+              :signer             => @signer,
               :host               => @host,
               :path               => @path,
               :port               => @port
@@ -99,19 +102,19 @@ module Fog
 
           if @instrumentor
             @instrumentor.instrument("#{@instrumentor_name}.request", params) do
-              _request(body, idempotent, parser)
+              _request(body, headers, idempotent, parser)
             end
           else
-            _request(body, idempotent, parser)
+            _request(body, headers, idempotent, parser)
           end
         end
 
-        def _request(body, idempotent, parser)
+        def _request(body, headers, idempotent, parser)
           @connection.request({
             :body       => body,
             :expects    => 200,
             :idempotent => idempotent,
-            :headers    => { 'Content-Type' => 'application/x-www-form-urlencoded' },
+            :headers    => headers,
             :method     => 'POST',
             :parser     => parser
           })

data/lib/fog/aws/sqs.rb

@@ -40,7 +40,7 @@ module Fog
           setup_credentials(options)
           @region = options[:region] || 'us-east-1'
 
-          unless ['ap-northeast-1', 'ap-southeast-1', 'ap-southeast-2', 'eu-west-1', 'us-east-1', 'us-west-1', 'us-west-2', 'sa-east-1'].include?(@region)
+          unless ['ap-northeast-1', 'ap-southeast-1', 'ap-southeast-2', 'eu-central-1', 'eu-west-1', 'us-east-1', 'us-west-1', 'us-west-2', 'sa-east-1'].include?(@region)
             raise ArgumentError, "Unknown region: #{@region.inspect}"
           end
         end
@@ -80,11 +80,11 @@ module Fog
         # * SQS object with connection to AWS.
         def initialize(options={})
           @use_iam_profile = options[:use_iam_profile]
-          setup_credentials(options)
           @instrumentor           = options[:instrumentor]
           @instrumentor_name      = options[:instrumentor_name] || 'fog.aws.sqs'
           @connection_options     = options[:connection_options] || {}
           options[:region] ||= 'us-east-1'
+          @region = options[:region]
           @host = options[:host] || "sqs.#{options[:region]}.amazonaws.com"
 
           @path       = options[:path]        || '/'
@@ -92,6 +92,8 @@ module Fog
           @port       = options[:port]        || 443
           @scheme     = options[:scheme]      || 'https'
           @connection = Fog::XML::Connection.new("#{@scheme}://#{@host}:#{@port}#{@path}", @persistent, @connection_options)
+
+          setup_credentials(options)
         end
 
         def reload
@@ -105,7 +107,8 @@ module Fog
           @aws_secret_access_key  = options[:aws_secret_access_key]
           @aws_session_token      = options[:aws_session_token]
           @aws_credentials_expire_at = options[:aws_credentials_expire_at]
-          @hmac = Fog::HMAC.new('sha256', @aws_secret_access_key)
+
+          @signer = Fog::AWS::SignatureV4.new( @aws_access_key_id, @aws_secret_access_key, @region, 'sqs')
         end
 
         def path_from_queue_url(queue_url)
@@ -119,12 +122,13 @@ module Fog
           parser      = params.delete(:parser)
           path        = params.delete(:path)
 
-          body = AWS.signed_params(
+          body, headers = AWS.signed_params_v4(
             params,
+            { 'Content-Type' => 'application/x-www-form-urlencoded' },
             {
-              :aws_access_key_id  => @aws_access_key_id,
+              :method             => 'POST',
               :aws_session_token  => @aws_session_token,
-              :hmac               => @hmac,
+              :signer             => @signer,
               :host               => @host,
               :path               => path || @path,
               :port               => @port,
@@ -134,19 +138,19 @@ module Fog
 
           if @instrumentor
             @instrumentor.instrument("#{@instrumentor_name}.request", params) do
-              _request(body, idempotent, parser, path)
+              _request(body, headers, idempotent, parser, path)
             end
           else
-            _request(body, idempotent, parser, path)
+            _request(body, headers, idempotent, parser, path)
           end
         end
 
-        def _request(body, idempotent, parser, path)
+        def _request(body, headers, idempotent, parser, path)
           args = {
             :body       => body,
             :expects    => 200,
             :idempotent => idempotent,
-            :headers    => { 'Content-Type' => 'application/x-www-form-urlencoded' },
+            :headers    => headers,
             :method     => 'POST',
             :parser     => parser,
             :path => path

data/lib/fog/aws/storage.rb

@@ -138,20 +138,26 @@ module Fog
         end
 
         def signed_url(params, expires)
-          expires = expires.to_i
+          #convert expires from a point in time to a delta to now
+          now = Fog::Time.now          
+
+          expires = expires.to_i - now.to_i
+          params[:headers] ||= {}
+
+          params[:query]||= {}
+          params[:query]['X-Amz-Expires'] = expires
+          params[:query]['X-Amz-Date'] = now.to_iso8601_basic
+
           if @aws_session_token
-            params[:headers]||= {}
-            params[:headers]['x-amz-security-token'] = @aws_session_token
+            params[:query]['X-Amz-Security-Token'] = @aws_session_token
           end
-          signature = signature(params, expires)
+
           params = request_params(params)
+          params[:headers][:host] = params[:host]
 
-          params[:query] = (params[:query] || {}).merge({
-            'AWSAccessKeyId' => @aws_access_key_id,
-            'Signature' => signature,
-            'Expires' => expires,
-          })
-          params[:query]['x-amz-security-token'] = @aws_session_token if @aws_session_token
+          signature = @signer.signature_parameters(params, now, "UNSIGNED-PAYLOAD")
+
+          params[:query] = (params[:query] || {}).merge(signature)
 
           params_to_url(params)
         end
@@ -217,7 +223,10 @@ module Fog
             if !path_style && COMPLIANT_BUCKET_NAMES !~ bucket_name
               Fog::Logger.warning("fog: the specified s3 bucket name(#{bucket_name}) is not a valid dns name, which will negatively impact performance.  For details see: http://docs.amazonwebservices.com/AmazonS3/latest/dev/BucketRestrictions.html")
               path_style = true
-            end
+            elsif scheme == 'https' && bucket_name =~ /\./
+              Fog::Logger.warning("fog: the specified s3 bucket name(#{bucket_name}) contains a '.' so is not accessible over https as a virtual hosted bucket, which will negatively impact performance.  For details see: http://docs.amazonwebservices.com/AmazonS3/latest/dev/BucketRestrictions.html")
+              path_style = true
+            end  
 
             if path_style
               path = bucket_to_path bucket_name, path
@@ -351,7 +360,6 @@ module Fog
 
         def initialize(options={})
           @use_iam_profile = options[:use_iam_profile]
-          setup_credentials(options)
           if @endpoint = options[:endpoint]
             endpoint = URI.parse(@endpoint)
             @host = endpoint.host
@@ -364,6 +372,7 @@ module Fog
             @port       = options[:port]        || DEFAULT_SCHEME_PORT[@scheme]
           end
           @path_style = options[:path_style] || false
+          setup_credentials(options)
         end
 
         def data
@@ -374,15 +383,13 @@ module Fog
           self.class.data[@region].delete(@aws_access_key_id)
         end
 
-        def signature(params, expires)
-          "foo"
-        end
-
         def setup_credentials(options)
           @aws_access_key_id = options[:aws_access_key_id]
           @aws_secret_access_key = options[:aws_secret_access_key]
           @aws_session_token     = options[:aws_session_token]
           @aws_credentials_expire_at = options[:aws_credentials_expire_at]
+
+          @signer = Fog::AWS::SignatureV4.new( @aws_access_key_id, @aws_secret_access_key, @region, 's3')
         end
       end
 
@@ -408,10 +415,8 @@ module Fog
         # ==== Returns
         # * S3 object with connection to aws.
         def initialize(options={})
-          require 'fog/core/parser'
 
           @use_iam_profile = options[:use_iam_profile]
-          setup_credentials(options)
           @instrumentor       = options[:instrumentor]
           @instrumentor_name  = options[:instrumentor_name] || 'fog.aws.storage'
           @connection_options     = options[:connection_options] || {}
@@ -430,67 +435,14 @@ module Fog
             @scheme     = options[:scheme]      || DEFAULT_SCHEME
             @port       = options[:port]        || DEFAULT_SCHEME_PORT[@scheme]
           end
+
+          setup_credentials(options)
         end
 
         def reload
           @connection.reset if @connection
         end
 
-        def signature(params, expires)
-          headers = params[:headers] || {}
-
-          string_to_sign =
-<<-DATA
-#{params[:method].to_s.upcase}
-#{headers['Content-MD5']}
-#{headers['Content-Type']}
-#{expires}
-DATA
-
-          amz_headers, canonical_amz_headers = {}, ''
-          for key, value in headers
-            if key[0..5] == 'x-amz-'
-              amz_headers[key] = value
-            end
-          end
-          amz_headers = amz_headers.sort {|x, y| x[0] <=> y[0]}
-          for key, value in amz_headers
-            canonical_amz_headers << "#{key}:#{value}\n"
-          end
-          string_to_sign << canonical_amz_headers
-
-          query_string = ''
-          if params[:query]
-            query_args = []
-            for key in params[:query].keys.sort
-              if VALID_QUERY_KEYS.include?(key)
-                value = params[:query][key]
-                if value
-                  query_args << "#{key}=#{value}"
-                else
-                  query_args << key
-                end
-              end
-            end
-            if query_args.any?
-              query_string = '?' + query_args.join('&')
-            end
-          end
-
-          canonical_path = (params[:path] || object_to_path(params[:object_name])).to_s
-          canonical_path = '/' + canonical_path if canonical_path[0..0] != '/'
-          if params[:bucket_name]
-            canonical_resource = "/#{params[:bucket_name]}#{canonical_path}"
-          else
-            canonical_resource = canonical_path
-          end
-          canonical_resource << query_string
-          string_to_sign << canonical_resource
-
-          signed_string = @hmac.sign(string_to_sign)
-          Base64.encode64(signed_string).chomp!
-        end
-
         private
 
         def setup_credentials(options)
@@ -499,7 +451,7 @@ DATA
           @aws_session_token     = options[:aws_session_token]
           @aws_credentials_expire_at = options[:aws_credentials_expire_at]
 
-          @hmac = Fog::HMAC.new('sha1', @aws_secret_access_key)
+          @signer = Fog::AWS::SignatureV4.new( @aws_access_key_id, @aws_secret_access_key, @region, 's3')
         end
 
         def connection(scheme, host, port)
@@ -519,21 +471,43 @@ DATA
         def request(params, &block)
           refresh_credentials_if_expired
 
-          expires = Fog::Time.now.to_date_header
+          date = Fog::Time.now
+
+          params = params.dup
+          params[:headers] = (params[:headers] || {}).dup
 
           params[:headers]['x-amz-security-token'] = @aws_session_token if @aws_session_token
-          signature = signature(params, expires)
+
+          if params[:body].respond_to?(:read)
+            # See http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html
+            params[:headers]['x-amz-content-sha256'] = 'STREAMING-AWS4-HMAC-SHA256-PAYLOAD'
+            params[:headers]['x-amz-decoded-content-length'] = params[:headers].delete 'Content-Length'
+
+            encoding = "aws-chunked"
+
+            encoding += ", #{params[:headers]['Content-Encoding']}" if params[:headers]['Content-Encoding']
+            params[:headers]['Content-Encoding']  = encoding
+          else
+            params[:headers]['x-amz-content-sha256'] ||= Digest::SHA256.hexdigest(params[:body] || '')
+          end
+          params[:headers]['x-amz-date'] = date.to_iso8601_basic
 
           params = request_params(params)
           scheme = params.delete(:scheme)
           host   = params.delete(:host)
           port   = params.delete(:port) || DEFAULT_SCHEME_PORT[scheme]
+          params[:headers]['Host'] = host
 
-          params[:headers]['Date'] = expires
-          params[:headers]['Authorization'] = "AWS #{@aws_access_key_id}:#{signature}"
+          signature_components = @signer.signature_components(params, date, params[:headers]['x-amz-content-sha256'])
+          params[:headers]['Authorization'] = @signer.components_to_header(signature_components)
           # FIXME: ToHashParser should make this not needed
           original_params = params.dup
 
+          if params[:body].respond_to?(:read)
+            body = params.delete :body
+            params[:request_block] = S3Streamer.new(body, signature_components['X-Amz-Signature'], @signer, date)
+          end
+
           if @instrumentor
             @instrumentor.instrument("#{@instrumentor_name}.request", params) do
               _request(scheme, host, port, params, original_params, &block)
@@ -551,6 +525,56 @@ DATA
           Fog::Logger.warning("fog: followed redirect to #{uri.host}, connecting to the matching region will be more performant")
           Fog::XML::Connection.new("#{uri.scheme}://#{uri.host}:#{uri.port}", false, @connection_options).request(original_params, &block)
         end
+
+        # See http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html
+
+        class S3Streamer
+          attr_accessor :body, :signature, :signer, :finished, :date
+          def initialize(body, signature, signer, date)
+            self.body = body
+            self.date = date
+            self.signature = signature
+            self.signer = signer
+            if body.respond_to?(:binmode)
+              body.binmode
+            end
+            if body.respond_to?(:pos=)
+              body.pos = 0
+            end
+          end
+
+          def call
+            if finished
+              ''
+            else
+              next_chunk
+            end
+          end
+
+          def next_chunk
+            data = body.read(0x10000)
+            if data.nil?
+              self.finished = true
+              data = ''
+            end
+            self.signature = sign_chunk(data, signature)
+            "#{data.length.to_s(16)};chunk-signature=#{signature}\r\n#{data}\r\n"
+          end
+
+
+          def sign_chunk(data, previous_signature)
+            string_to_sign = <<-DATA
+AWS4-HMAC-SHA256-PAYLOAD
+#{date.to_iso8601_basic}
+#{signer.credential_scope(date)}
+#{previous_signature}
+#{Digest::SHA256.hexdigest('')}
+#{Digest::SHA256.hexdigest(data)}
+DATA
+            hmac = signer.derived_hmac(date)
+            hmac.sign(string_to_sign.strip).unpack('H*').first
+          end
+        end
       end
     end
   end