# -*- coding: utf-8 -*- from six.moves.urllib.parse import quote, unquote, urlparse, urlencode import hmac import time import hashlib import logging from requests.auth import AuthBase from .cos_comm import to_unicode, to_bytes, to_str logger = logging.getLogger(__name__) def filter_headers(data): """只设置host content-type 还有x开头的头部. :param data(dict): 所有的头部信息. :return(dict): 计算进签名的头部. """ valid_headers = [ "cache-control", "content-disposition", "content-encoding", "content-type", "content-md5", "content-length", "expect", "expires", "host", "if-match", "if-modified-since", "if-none-match", "if-unmodified-since", "origin", "range", "transfer-encoding", "pic-operations", ] headers = {} for i in data: if str.lower(i) in valid_headers or str.lower(i).startswith("x-cos-") or str.lower(i).startswith("x-ci-"): headers[i] = data[i] return headers class CosS3Auth(AuthBase): def __init__(self, conf, key=None, params={}, expire=10000, sign_host=None): self._secret_id = conf._secret_id if conf._secret_id else \ (conf._credential_inst.secret_id if conf._credential_inst else None) self._secret_key = conf._secret_key if conf._secret_key else \ (conf._credential_inst.secret_key if conf._credential_inst else None) self._anonymous = conf._anonymous self._expire = expire self._params = params self._sign_params = conf._sign_params # 如果API指定了是否签名host，则以具体API为准，如果未指定则以配置为准 if sign_host is not None: self._sign_host = bool(sign_host) else: self._sign_host = conf._sign_host if key: key = to_unicode(key) if key[0] == u'/': self._path = key else: self._path = u'/' + key else: self._path = u'/' def __call__(self, r): # 匿名请求直接返回 if self._anonymous: r.headers['Authorization'] = "" logger.debug("anonymous reqeust") return r path = self._path uri_params = {} if self._sign_params: uri_params = self._params headers = filter_headers(r.headers) # 如果headers中不包含host头域，则从url中提取host，并且加入签名计算 if self._sign_host: # 判断headers中是否包含host头域 contain_host = False for i in headers: if str.lower(i) == "host": # 兼容host/Host/HOST等 contain_host = True break # 从url中提取host if not contain_host: url_parsed = urlparse(r.url) if url_parsed.hostname is not None: headers["host"] = url_parsed.hostname # reserved keywords in headers urlencode are -_.~, notice that / should be encoded and space should not be encoded to plus sign(+) headers = dict([(quote(to_bytes(to_str(k)), '-_.~').lower(), quote(to_bytes(to_str(v)), '-_.~')) for k, v in headers.items()]) # headers中的key转换为小写，value进行encode uri_params = dict([(quote(to_bytes(to_str(k)), '-_.~').lower(), quote(to_bytes(to_str(v)), '-_.~')) for k, v in uri_params.items()]) format_str = u"{method}\n{host}\n{params}\n{headers}\n".format( method=r.method.lower(), host=path, params='&'.join(map(lambda tupl: "%s=%s" % (tupl[0], tupl[1]), sorted(uri_params.items()))), headers='&'.join(map(lambda tupl: "%s=%s" % (tupl[0], tupl[1]), sorted(headers.items()))) ) logger.debug("format str: " + format_str) start_sign_time = int(time.time()) sign_time = "{bg_time};{ed_time}".format( bg_time=start_sign_time - 60, ed_time=start_sign_time + self._expire) sha1 = hashlib.sha1() sha1.update(to_bytes(format_str)) str_to_sign = "sha1\n{time}\n{sha1}\n".format( time=sign_time, sha1=sha1.hexdigest()) logger.debug('str_to_sign: ' + str(str_to_sign)) sign_key = hmac.new(to_bytes(self._secret_key), to_bytes( sign_time), hashlib.sha1).hexdigest() sign = hmac.new(to_bytes(sign_key), to_bytes( str_to_sign), hashlib.sha1).hexdigest() logger.debug('sign_key: ' + str(sign_key)) logger.debug('sign: ' + str(sign)) sign_tpl = "q-sign-algorithm=sha1&q-ak={ak}&q-sign-time={sign_time}&q-key-time={key_time}&q-header-list={headers}&q-url-param-list={params}&q-signature={sign}" r.headers['Authorization'] = sign_tpl.format( ak=self._secret_id, sign_time=sign_time, key_time=sign_time, params=';'.join(sorted(uri_params.keys())), headers=';'.join(sorted(headers.keys())), sign=sign ) logger.debug("sign_key" + str(sign_key)) logger.debug(r.headers['Authorization']) logger.debug("request headers: " + str(r.headers)) return r class CosRtmpAuth(AuthBase): def __init__(self, conf, bucket=None, channel=None, params={}, expire=3600, presign_expire=0): self._secret_id = conf._secret_id self._secret_key = conf._secret_key self._token = conf._token self._anonymous = conf._anonymous self._expire = expire self._presign_expire = presign_expire self._params = params if self._token: self._params['q-token'] = self._token self._path = u'/' + bucket + u'/' + channel def get_rtmp_sign(self): # get rtmp string canonicalized_param = '' for k, v in self._params.items(): canonicalized_param += '{key}={value}&'.format(key=k, value=v) if self._presign_expire >= 60: canonicalized_param += 'presign={value}'.format( value=self._presign_expire) canonicalized_param = canonicalized_param.rstrip('&') rtmp_str = u"{path}\n{params}\n".format( path=self._path, params=canonicalized_param) logger.debug("rtmp str: " + rtmp_str) sha1 = hashlib.sha1() sha1.update(to_bytes(rtmp_str)) # get time sign_time = int(time.time()) sign_time_str = "{start_time};{end_time}".format( start_time=sign_time - 60, end_time=sign_time + self._expire) str_to_sign = "sha1\n{time}\n{sha1}\n".format( time=sign_time_str, sha1=sha1.hexdigest()) logger.debug('str_to_sign: ' + str(str_to_sign)) # get sinature signature = hmac.new(to_bytes(self._secret_key), to_bytes( str_to_sign), hashlib.sha1).hexdigest() logger.debug('signature: ' + str(signature)) rtmp_sign = "q-sign-algorithm=sha1&q-ak={ak}&q-sign-time={sign_time}&q-key-time={key_time}&q-signature={sign}".format( ak=self._secret_id, sign_time=sign_time_str, key_time=sign_time_str, sign=signature) if canonicalized_param != '': return rtmp_sign + "&{params}".format(params=canonicalized_param) else: return rtmp_sign if __name__ == "__main__": pass