199 lines
7.4 KiB
Python
199 lines
7.4 KiB
Python
# -*- coding: utf-8 -*-
|
||
|
||
from six.moves.urllib.parse import quote, unquote, urlparse, urlencode
|
||
import hmac
|
||
import time
|
||
import hashlib
|
||
import logging
|
||
from requests.auth import AuthBase
|
||
from .cos_comm import to_unicode, to_bytes, to_str
|
||
|
||
logger = logging.getLogger(__name__)
|
||
|
||
|
||
def filter_headers(data):
|
||
"""只设置host content-type 还有x开头的头部.
|
||
|
||
:param data(dict): 所有的头部信息.
|
||
:return(dict): 计算进签名的头部.
|
||
"""
|
||
valid_headers = [
|
||
"cache-control",
|
||
"content-disposition",
|
||
"content-encoding",
|
||
"content-type",
|
||
"content-md5",
|
||
"content-length",
|
||
"expect",
|
||
"expires",
|
||
"host",
|
||
"if-match",
|
||
"if-modified-since",
|
||
"if-none-match",
|
||
"if-unmodified-since",
|
||
"origin",
|
||
"range",
|
||
"transfer-encoding",
|
||
"pic-operations",
|
||
]
|
||
headers = {}
|
||
for i in data:
|
||
if str.lower(i) in valid_headers or str.lower(i).startswith("x-cos-") or str.lower(i).startswith("x-ci-"):
|
||
headers[i] = data[i]
|
||
return headers
|
||
|
||
|
||
class CosS3Auth(AuthBase):
|
||
|
||
def __init__(self, conf, key=None, params={}, expire=10000, sign_host=None):
|
||
self._secret_id = conf._secret_id if conf._secret_id else \
|
||
(conf._credential_inst.secret_id if conf._credential_inst else None)
|
||
self._secret_key = conf._secret_key if conf._secret_key else \
|
||
(conf._credential_inst.secret_key if conf._credential_inst else None)
|
||
self._anonymous = conf._anonymous
|
||
self._expire = expire
|
||
self._params = params
|
||
self._sign_params = conf._sign_params
|
||
|
||
# 如果API指定了是否签名host，则以具体API为准，如果未指定则以配置为准
|
||
if sign_host is not None:
|
||
self._sign_host = bool(sign_host)
|
||
else:
|
||
self._sign_host = conf._sign_host
|
||
|
||
if key:
|
||
key = to_unicode(key)
|
||
if key[0] == u'/':
|
||
self._path = key
|
||
else:
|
||
self._path = u'/' + key
|
||
else:
|
||
self._path = u'/'
|
||
|
||
def __call__(self, r):
|
||
|
||
# 匿名请求直接返回
|
||
if self._anonymous:
|
||
r.headers['Authorization'] = ""
|
||
logger.debug("anonymous reqeust")
|
||
return r
|
||
|
||
path = self._path
|
||
uri_params = {}
|
||
if self._sign_params:
|
||
uri_params = self._params
|
||
headers = filter_headers(r.headers)
|
||
|
||
# 如果headers中不包含host头域，则从url中提取host，并且加入签名计算
|
||
if self._sign_host:
|
||
|
||
# 判断headers中是否包含host头域
|
||
contain_host = False
|
||
for i in headers:
|
||
if str.lower(i) == "host": # 兼容host/Host/HOST等
|
||
contain_host = True
|
||
break
|
||
|
||
# 从url中提取host
|
||
if not contain_host:
|
||
url_parsed = urlparse(r.url)
|
||
if url_parsed.hostname is not None:
|
||
headers["host"] = url_parsed.hostname
|
||
|
||
# reserved keywords in headers urlencode are -_.~, notice that / should be encoded and space should not be encoded to plus sign(+)
|
||
headers = dict([(quote(to_bytes(to_str(k)), '-_.~').lower(), quote(to_bytes(to_str(v)), '-_.~')) for k, v in
|
||
headers.items()]) # headers中的key转换为小写，value进行encode
|
||
uri_params = dict([(quote(to_bytes(to_str(k)), '-_.~').lower(), quote(to_bytes(to_str(v)), '-_.~')) for k, v in
|
||
uri_params.items()])
|
||
format_str = u"{method}\n{host}\n{params}\n{headers}\n".format(
|
||
method=r.method.lower(),
|
||
host=path,
|
||
params='&'.join(map(lambda tupl: "%s=%s" %
|
||
(tupl[0], tupl[1]), sorted(uri_params.items()))),
|
||
headers='&'.join(map(lambda tupl: "%s=%s" %
|
||
(tupl[0], tupl[1]), sorted(headers.items())))
|
||
)
|
||
logger.debug("format str: " + format_str)
|
||
|
||
start_sign_time = int(time.time())
|
||
sign_time = "{bg_time};{ed_time}".format(
|
||
bg_time=start_sign_time - 60, ed_time=start_sign_time + self._expire)
|
||
sha1 = hashlib.sha1()
|
||
sha1.update(to_bytes(format_str))
|
||
|
||
str_to_sign = "sha1\n{time}\n{sha1}\n".format(
|
||
time=sign_time, sha1=sha1.hexdigest())
|
||
logger.debug('str_to_sign: ' + str(str_to_sign))
|
||
sign_key = hmac.new(to_bytes(self._secret_key), to_bytes(
|
||
sign_time), hashlib.sha1).hexdigest()
|
||
sign = hmac.new(to_bytes(sign_key), to_bytes(
|
||
str_to_sign), hashlib.sha1).hexdigest()
|
||
logger.debug('sign_key: ' + str(sign_key))
|
||
logger.debug('sign: ' + str(sign))
|
||
sign_tpl = "q-sign-algorithm=sha1&q-ak={ak}&q-sign-time={sign_time}&q-key-time={key_time}&q-header-list={headers}&q-url-param-list={params}&q-signature={sign}"
|
||
|
||
r.headers['Authorization'] = sign_tpl.format(
|
||
ak=self._secret_id,
|
||
sign_time=sign_time,
|
||
key_time=sign_time,
|
||
params=';'.join(sorted(uri_params.keys())),
|
||
headers=';'.join(sorted(headers.keys())),
|
||
sign=sign
|
||
)
|
||
logger.debug("sign_key" + str(sign_key))
|
||
logger.debug(r.headers['Authorization'])
|
||
logger.debug("request headers: " + str(r.headers))
|
||
return r
|
||
|
||
|
||
class CosRtmpAuth(AuthBase):
|
||
|
||
def __init__(self, conf, bucket=None, channel=None, params={}, expire=3600, presign_expire=0):
|
||
self._secret_id = conf._secret_id
|
||
self._secret_key = conf._secret_key
|
||
self._token = conf._token
|
||
self._anonymous = conf._anonymous
|
||
self._expire = expire
|
||
self._presign_expire = presign_expire
|
||
self._params = params
|
||
if self._token:
|
||
self._params['q-token'] = self._token
|
||
self._path = u'/' + bucket + u'/' + channel
|
||
|
||
def get_rtmp_sign(self):
|
||
# get rtmp string
|
||
canonicalized_param = ''
|
||
for k, v in self._params.items():
|
||
canonicalized_param += '{key}={value}&'.format(key=k, value=v)
|
||
if self._presign_expire >= 60:
|
||
canonicalized_param += 'presign={value}'.format(
|
||
value=self._presign_expire)
|
||
canonicalized_param = canonicalized_param.rstrip('&')
|
||
rtmp_str = u"{path}\n{params}\n".format(
|
||
path=self._path, params=canonicalized_param)
|
||
logger.debug("rtmp str: " + rtmp_str)
|
||
|
||
sha1 = hashlib.sha1()
|
||
sha1.update(to_bytes(rtmp_str))
|
||
# get time
|
||
sign_time = int(time.time())
|
||
sign_time_str = "{start_time};{end_time}".format(
|
||
start_time=sign_time - 60, end_time=sign_time + self._expire)
|
||
str_to_sign = "sha1\n{time}\n{sha1}\n".format(
|
||
time=sign_time_str, sha1=sha1.hexdigest())
|
||
logger.debug('str_to_sign: ' + str(str_to_sign))
|
||
# get sinature
|
||
signature = hmac.new(to_bytes(self._secret_key), to_bytes(
|
||
str_to_sign), hashlib.sha1).hexdigest()
|
||
logger.debug('signature: ' + str(signature))
|
||
rtmp_sign = "q-sign-algorithm=sha1&q-ak={ak}&q-sign-time={sign_time}&q-key-time={key_time}&q-signature={sign}".format(
|
||
ak=self._secret_id, sign_time=sign_time_str, key_time=sign_time_str, sign=signature)
|
||
if canonicalized_param != '':
|
||
return rtmp_sign + "&{params}".format(params=canonicalized_param)
|
||
else:
|
||
return rtmp_sign
|
||
|
||
|
||
if __name__ == "__main__":
|
||
pass
|