first
This commit is contained in:
Tim Bendt
576
system/vendor/aws/aws-sdk-php/src/Signature/SignatureV4.php
vendored
Executable file
576
system/vendor/aws/aws-sdk-php/src/Signature/SignatureV4.php
vendored
Executable file
@@ -0,0 +1,576 @@
|
||||
<?php
|
||||
namespace Aws\Signature;
|
||||
|
||||
use Aws\Credentials\CredentialsInterface;
|
||||
use AWS\CRT\Auth\Signable;
|
||||
use AWS\CRT\Auth\SignatureType;
|
||||
use AWS\CRT\Auth\Signing;
|
||||
use AWS\CRT\Auth\SigningAlgorithm;
|
||||
use AWS\CRT\Auth\SigningConfigAWS;
|
||||
use AWS\CRT\Auth\StaticCredentialsProvider;
|
||||
use AWS\CRT\HTTP\Request;
|
||||
use Aws\Exception\CommonRuntimeException;
|
||||
use Aws\Exception\CouldNotCreateChecksumException;
|
||||
use GuzzleHttp\Psr7;
|
||||
use Psr\Http\Message\RequestInterface;
|
||||
|
||||
/**
|
||||
* Signature Version 4
|
||||
* @link http://docs.aws.amazon.com/general/latest/gr/signature-version-4.html
|
||||
*/
|
||||
class SignatureV4 implements SignatureInterface
|
||||
{
|
||||
use SignatureTrait;
|
||||
const ISO8601_BASIC = 'Ymd\THis\Z';
|
||||
const UNSIGNED_PAYLOAD = 'UNSIGNED-PAYLOAD';
|
||||
const AMZ_CONTENT_SHA256_HEADER = 'X-Amz-Content-Sha256';
|
||||
|
||||
/** @var string */
|
||||
private $service;
|
||||
|
||||
/** @var string */
|
||||
protected $region;
|
||||
|
||||
/** @var bool */
|
||||
private $unsigned;
|
||||
|
||||
/** @var bool */
|
||||
private $useV4a;
|
||||
|
||||
/**
|
||||
* The following headers are not signed because signing these headers
|
||||
* would potentially cause a signature mismatch when sending a request
|
||||
* through a proxy or if modified at the HTTP client level.
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
protected function getHeaderBlacklist()
|
||||
{
|
||||
return [
|
||||
'cache-control' => true,
|
||||
'content-type' => true,
|
||||
'content-length' => true,
|
||||
'expect' => true,
|
||||
'max-forwards' => true,
|
||||
'pragma' => true,
|
||||
'range' => true,
|
||||
'te' => true,
|
||||
'if-match' => true,
|
||||
'if-none-match' => true,
|
||||
'if-modified-since' => true,
|
||||
'if-unmodified-since' => true,
|
||||
'if-range' => true,
|
||||
'accept' => true,
|
||||
'authorization' => true,
|
||||
'proxy-authorization' => true,
|
||||
'from' => true,
|
||||
'referer' => true,
|
||||
'user-agent' => true,
|
||||
'X-Amz-User-Agent' => true,
|
||||
'x-amzn-trace-id' => true,
|
||||
'aws-sdk-invocation-id' => true,
|
||||
'aws-sdk-retry' => true,
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string $service Service name to use when signing
|
||||
* @param string $region Region name to use when signing
|
||||
* @param array $options Array of configuration options used when signing
|
||||
* - unsigned-body: Flag to make request have unsigned payload.
|
||||
* Unsigned body is used primarily for streaming requests.
|
||||
*/
|
||||
public function __construct($service, $region, array $options = [])
|
||||
{
|
||||
$this->service = $service;
|
||||
$this->region = $region;
|
||||
$this->unsigned = isset($options['unsigned-body']) ? $options['unsigned-body'] : false;
|
||||
$this->useV4a = isset($options['use_v4a']) && $options['use_v4a'] === true;
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritdoc}
|
||||
*/
|
||||
public function signRequest(
|
||||
RequestInterface $request,
|
||||
CredentialsInterface $credentials,
|
||||
$signingService = null
|
||||
) {
|
||||
$ldt = gmdate(self::ISO8601_BASIC);
|
||||
$sdt = substr($ldt, 0, 8);
|
||||
$parsed = $this->parseRequest($request);
|
||||
$parsed['headers']['X-Amz-Date'] = [$ldt];
|
||||
|
||||
if ($token = $credentials->getSecurityToken()) {
|
||||
$parsed['headers']['X-Amz-Security-Token'] = [$token];
|
||||
}
|
||||
$service = isset($signingService) ? $signingService : $this->service;
|
||||
|
||||
if ($this->useV4a) {
|
||||
return $this->signWithV4a($credentials, $request, $service);
|
||||
}
|
||||
|
||||
$cs = $this->createScope($sdt, $this->region, $service);
|
||||
$payload = $this->getPayload($request);
|
||||
|
||||
if ($payload == self::UNSIGNED_PAYLOAD) {
|
||||
$parsed['headers'][self::AMZ_CONTENT_SHA256_HEADER] = [$payload];
|
||||
}
|
||||
|
||||
$context = $this->createContext($parsed, $payload);
|
||||
$toSign = $this->createStringToSign($ldt, $cs, $context['creq']);
|
||||
$signingKey = $this->getSigningKey(
|
||||
$sdt,
|
||||
$this->region,
|
||||
$service,
|
||||
$credentials->getSecretKey()
|
||||
);
|
||||
$signature = hash_hmac('sha256', $toSign, $signingKey);
|
||||
$parsed['headers']['Authorization'] = [
|
||||
"AWS4-HMAC-SHA256 "
|
||||
. "Credential={$credentials->getAccessKeyId()}/{$cs}, "
|
||||
. "SignedHeaders={$context['headers']}, Signature={$signature}"
|
||||
];
|
||||
|
||||
return $this->buildRequest($parsed);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the headers that were used to pre-sign the request.
|
||||
* Used for the X-Amz-SignedHeaders header.
|
||||
*
|
||||
* @param array $headers
|
||||
* @return array
|
||||
*/
|
||||
private function getPresignHeaders(array $headers)
|
||||
{
|
||||
$presignHeaders = [];
|
||||
$blacklist = $this->getHeaderBlacklist();
|
||||
foreach ($headers as $name => $value) {
|
||||
$lName = strtolower($name);
|
||||
if (!isset($blacklist[$lName])
|
||||
&& $name !== self::AMZ_CONTENT_SHA256_HEADER
|
||||
) {
|
||||
$presignHeaders[] = $lName;
|
||||
}
|
||||
}
|
||||
return $presignHeaders;
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritdoc}
|
||||
*/
|
||||
public function presign(
|
||||
RequestInterface $request,
|
||||
CredentialsInterface $credentials,
|
||||
$expires,
|
||||
array $options = []
|
||||
) {
|
||||
$startTimestamp = isset($options['start_time'])
|
||||
? $this->convertToTimestamp($options['start_time'], null)
|
||||
: time();
|
||||
$expiresTimestamp = $this->convertToTimestamp($expires, $startTimestamp);
|
||||
|
||||
if ($this->useV4a) {
|
||||
return $this->presignWithV4a(
|
||||
$request,
|
||||
$credentials,
|
||||
$this->convertExpires($expiresTimestamp, $startTimestamp)
|
||||
);
|
||||
}
|
||||
|
||||
$parsed = $this->createPresignedRequest($request, $credentials);
|
||||
|
||||
$payload = $this->getPresignedPayload($request);
|
||||
$httpDate = gmdate(self::ISO8601_BASIC, $startTimestamp);
|
||||
$shortDate = substr($httpDate, 0, 8);
|
||||
$scope = $this->createScope($shortDate, $this->region, $this->service);
|
||||
$credential = $credentials->getAccessKeyId() . '/' . $scope;
|
||||
if ($credentials->getSecurityToken()) {
|
||||
unset($parsed['headers']['X-Amz-Security-Token']);
|
||||
}
|
||||
$parsed['query']['X-Amz-Algorithm'] = 'AWS4-HMAC-SHA256';
|
||||
$parsed['query']['X-Amz-Credential'] = $credential;
|
||||
$parsed['query']['X-Amz-Date'] = gmdate('Ymd\THis\Z', $startTimestamp);
|
||||
$parsed['query']['X-Amz-SignedHeaders'] = implode(';', $this->getPresignHeaders($parsed['headers']));
|
||||
$parsed['query']['X-Amz-Expires'] = $this->convertExpires($expiresTimestamp, $startTimestamp);
|
||||
$context = $this->createContext($parsed, $payload);
|
||||
$stringToSign = $this->createStringToSign($httpDate, $scope, $context['creq']);
|
||||
$key = $this->getSigningKey(
|
||||
$shortDate,
|
||||
$this->region,
|
||||
$this->service,
|
||||
$credentials->getSecretKey()
|
||||
);
|
||||
$parsed['query']['X-Amz-Signature'] = hash_hmac('sha256', $stringToSign, $key);
|
||||
|
||||
return $this->buildRequest($parsed);
|
||||
}
|
||||
|
||||
/**
|
||||
* Converts a POST request to a GET request by moving POST fields into the
|
||||
* query string.
|
||||
*
|
||||
* Useful for pre-signing query protocol requests.
|
||||
*
|
||||
* @param RequestInterface $request Request to clone
|
||||
*
|
||||
* @return RequestInterface
|
||||
* @throws \InvalidArgumentException if the method is not POST
|
||||
*/
|
||||
public static function convertPostToGet(RequestInterface $request, $additionalQueryParams = "")
|
||||
{
|
||||
if ($request->getMethod() !== 'POST') {
|
||||
throw new \InvalidArgumentException('Expected a POST request but '
|
||||
. 'received a ' . $request->getMethod() . ' request.');
|
||||
}
|
||||
|
||||
$sr = $request->withMethod('GET')
|
||||
->withBody(Psr7\Utils::streamFor(''))
|
||||
->withoutHeader('Content-Type')
|
||||
->withoutHeader('Content-Length');
|
||||
|
||||
// Move POST fields to the query if they are present
|
||||
if ($request->getHeaderLine('Content-Type') === 'application/x-www-form-urlencoded') {
|
||||
$body = (string) $request->getBody() . $additionalQueryParams;
|
||||
$sr = $sr->withUri($sr->getUri()->withQuery($body));
|
||||
}
|
||||
|
||||
return $sr;
|
||||
}
|
||||
|
||||
protected function getPayload(RequestInterface $request)
|
||||
{
|
||||
if ($this->unsigned && $request->getUri()->getScheme() == 'https') {
|
||||
return self::UNSIGNED_PAYLOAD;
|
||||
}
|
||||
// Calculate the request signature payload
|
||||
if ($request->hasHeader(self::AMZ_CONTENT_SHA256_HEADER)) {
|
||||
// Handle streaming operations (e.g. Glacier.UploadArchive)
|
||||
return $request->getHeaderLine(self::AMZ_CONTENT_SHA256_HEADER);
|
||||
}
|
||||
|
||||
if (!$request->getBody()->isSeekable()) {
|
||||
throw new CouldNotCreateChecksumException('sha256');
|
||||
}
|
||||
|
||||
try {
|
||||
return Psr7\Utils::hash($request->getBody(), 'sha256');
|
||||
} catch (\Exception $e) {
|
||||
throw new CouldNotCreateChecksumException('sha256', $e);
|
||||
}
|
||||
}
|
||||
|
||||
protected function getPresignedPayload(RequestInterface $request)
|
||||
{
|
||||
return $this->getPayload($request);
|
||||
}
|
||||
|
||||
protected function createCanonicalizedPath($path)
|
||||
{
|
||||
$doubleEncoded = rawurlencode(ltrim($path, '/'));
|
||||
|
||||
return '/' . str_replace('%2F', '/', $doubleEncoded);
|
||||
}
|
||||
|
||||
private function createStringToSign($longDate, $credentialScope, $creq)
|
||||
{
|
||||
$hash = hash('sha256', $creq);
|
||||
|
||||
return "AWS4-HMAC-SHA256\n{$longDate}\n{$credentialScope}\n{$hash}";
|
||||
}
|
||||
|
||||
private function createPresignedRequest(
|
||||
RequestInterface $request,
|
||||
CredentialsInterface $credentials
|
||||
) {
|
||||
$parsedRequest = $this->parseRequest($request);
|
||||
|
||||
// Make sure to handle temporary credentials
|
||||
if ($token = $credentials->getSecurityToken()) {
|
||||
$parsedRequest['headers']['X-Amz-Security-Token'] = [$token];
|
||||
}
|
||||
|
||||
return $this->moveHeadersToQuery($parsedRequest);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param array $parsedRequest
|
||||
* @param string $payload Hash of the request payload
|
||||
* @return array Returns an array of context information
|
||||
*/
|
||||
private function createContext(array $parsedRequest, $payload)
|
||||
{
|
||||
$blacklist = $this->getHeaderBlacklist();
|
||||
|
||||
// Normalize the path as required by SigV4
|
||||
$canon = $parsedRequest['method'] . "\n"
|
||||
. $this->createCanonicalizedPath($parsedRequest['path']) . "\n"
|
||||
. $this->getCanonicalizedQuery($parsedRequest['query']) . "\n";
|
||||
|
||||
// Case-insensitively aggregate all of the headers.
|
||||
$aggregate = [];
|
||||
foreach ($parsedRequest['headers'] as $key => $values) {
|
||||
$key = strtolower($key);
|
||||
if (!isset($blacklist[$key])) {
|
||||
foreach ($values as $v) {
|
||||
$aggregate[$key][] = $v;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
ksort($aggregate);
|
||||
$canonHeaders = [];
|
||||
foreach ($aggregate as $k => $v) {
|
||||
if (count($v) > 0) {
|
||||
sort($v);
|
||||
}
|
||||
$canonHeaders[] = $k . ':' . preg_replace('/\s+/', ' ', implode(',', $v));
|
||||
}
|
||||
|
||||
$signedHeadersString = implode(';', array_keys($aggregate));
|
||||
$canon .= implode("\n", $canonHeaders) . "\n\n"
|
||||
. $signedHeadersString . "\n"
|
||||
. $payload;
|
||||
|
||||
return ['creq' => $canon, 'headers' => $signedHeadersString];
|
||||
}
|
||||
|
||||
private function getCanonicalizedQuery(array $query)
|
||||
{
|
||||
unset($query['X-Amz-Signature']);
|
||||
|
||||
if (!$query) {
|
||||
return '';
|
||||
}
|
||||
|
||||
$qs = '';
|
||||
ksort($query);
|
||||
foreach ($query as $k => $v) {
|
||||
if (!is_array($v)) {
|
||||
$qs .= rawurlencode($k) . '=' . rawurlencode($v !== null ? $v : '') . '&';
|
||||
} else {
|
||||
sort($v);
|
||||
foreach ($v as $value) {
|
||||
$qs .= rawurlencode($k) . '=' . rawurlencode($value !== null ? $value : '') . '&';
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return substr($qs, 0, -1);
|
||||
}
|
||||
|
||||
private function convertToTimestamp($dateValue, $relativeTimeBase = null)
|
||||
{
|
||||
if ($dateValue instanceof \DateTimeInterface) {
|
||||
$timestamp = $dateValue->getTimestamp();
|
||||
} elseif (!is_numeric($dateValue)) {
|
||||
$timestamp = strtotime($dateValue,
|
||||
$relativeTimeBase === null ? time() : $relativeTimeBase
|
||||
);
|
||||
} else {
|
||||
$timestamp = $dateValue;
|
||||
}
|
||||
|
||||
return $timestamp;
|
||||
}
|
||||
|
||||
private function convertExpires($expiresTimestamp, $startTimestamp)
|
||||
{
|
||||
$duration = $expiresTimestamp - $startTimestamp;
|
||||
|
||||
// Ensure that the duration of the signature is not longer than a week
|
||||
if ($duration > 604800) {
|
||||
throw new \InvalidArgumentException('The expiration date of a '
|
||||
. 'signature version 4 presigned URL must be less than one '
|
||||
. 'week');
|
||||
}
|
||||
|
||||
return $duration;
|
||||
}
|
||||
|
||||
private function moveHeadersToQuery(array $parsedRequest)
|
||||
{
|
||||
//x-amz-user-agent shouldn't be put in a query param
|
||||
unset($parsedRequest['headers']['X-Amz-User-Agent']);
|
||||
|
||||
foreach ($parsedRequest['headers'] as $name => $header) {
|
||||
$lname = strtolower($name);
|
||||
if (substr($lname, 0, 5) == 'x-amz') {
|
||||
$parsedRequest['query'][$name] = $header;
|
||||
}
|
||||
$blacklist = $this->getHeaderBlacklist();
|
||||
if (isset($blacklist[$lname])
|
||||
|| $lname === strtolower(self::AMZ_CONTENT_SHA256_HEADER)
|
||||
) {
|
||||
unset($parsedRequest['headers'][$name]);
|
||||
}
|
||||
}
|
||||
|
||||
return $parsedRequest;
|
||||
}
|
||||
|
||||
private function parseRequest(RequestInterface $request)
|
||||
{
|
||||
// Clean up any previously set headers.
|
||||
/** @var RequestInterface $request */
|
||||
$request = $request
|
||||
->withoutHeader('X-Amz-Date')
|
||||
->withoutHeader('Date')
|
||||
->withoutHeader('Authorization');
|
||||
$uri = $request->getUri();
|
||||
|
||||
return [
|
||||
'method' => $request->getMethod(),
|
||||
'path' => $uri->getPath(),
|
||||
'query' => Psr7\Query::parse($uri->getQuery()),
|
||||
'uri' => $uri,
|
||||
'headers' => $request->getHeaders(),
|
||||
'body' => $request->getBody(),
|
||||
'version' => $request->getProtocolVersion()
|
||||
];
|
||||
}
|
||||
|
||||
private function buildRequest(array $req)
|
||||
{
|
||||
if ($req['query']) {
|
||||
$req['uri'] = $req['uri']->withQuery(Psr7\Query::build($req['query']));
|
||||
}
|
||||
|
||||
return new Psr7\Request(
|
||||
$req['method'],
|
||||
$req['uri'],
|
||||
$req['headers'],
|
||||
$req['body'],
|
||||
$req['version']
|
||||
);
|
||||
}
|
||||
|
||||
private function verifyCRTLoaded()
|
||||
{
|
||||
if (!extension_loaded('awscrt')) {
|
||||
throw new CommonRuntimeException(
|
||||
"AWS Common Runtime for PHP is required to use Signature V4A"
|
||||
. ". Please install it using the instructions found at"
|
||||
. " https://github.com/aws/aws-sdk-php/blob/master/CRT_INSTRUCTIONS.md"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
private function createCRTStaticCredentialsProvider($credentials)
|
||||
{
|
||||
return new StaticCredentialsProvider([
|
||||
'access_key_id' => $credentials->getAccessKeyId(),
|
||||
'secret_access_key' => $credentials->getSecretKey(),
|
||||
'session_token' => $credentials->getSecurityToken(),
|
||||
]);
|
||||
}
|
||||
|
||||
private function removeIllegalV4aHeaders(&$request)
|
||||
{
|
||||
$illegalV4aHeaders = [
|
||||
self::AMZ_CONTENT_SHA256_HEADER,
|
||||
"aws-sdk-invocation-id",
|
||||
"aws-sdk-retry",
|
||||
'x-amz-region-set'
|
||||
];
|
||||
$storedHeaders = [];
|
||||
|
||||
foreach ($illegalV4aHeaders as $header) {
|
||||
if ($request->hasHeader($header)){
|
||||
$storedHeaders[$header] = $request->getHeader($header);
|
||||
$request = $request->withoutHeader($header);
|
||||
}
|
||||
}
|
||||
|
||||
return $storedHeaders;
|
||||
}
|
||||
|
||||
private function CRTRequestFromGuzzleRequest($request)
|
||||
{
|
||||
return new Request(
|
||||
$request->getMethod(),
|
||||
(string) $request->getUri(),
|
||||
[], //leave empty as the query is parsed from the uri object
|
||||
array_map(function ($header) {return $header[0];}, $request->getHeaders())
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param CredentialsInterface $credentials
|
||||
* @param RequestInterface $request
|
||||
* @param $signingService
|
||||
* @return RequestInterface
|
||||
*/
|
||||
protected function signWithV4a(CredentialsInterface $credentials, RequestInterface $request, $signingService)
|
||||
{
|
||||
$this->verifyCRTLoaded();
|
||||
$credentials_provider = $this->createCRTStaticCredentialsProvider($credentials);
|
||||
$signingConfig = new SigningConfigAWS([
|
||||
'algorithm' => SigningAlgorithm::SIGv4_ASYMMETRIC,
|
||||
'signature_type' => SignatureType::HTTP_REQUEST_HEADERS,
|
||||
'credentials_provider' => $credentials_provider,
|
||||
'signed_body_value' => $this->getPayload($request),
|
||||
'region' => "*",
|
||||
'service' => $signingService,
|
||||
'date' => time(),
|
||||
]);
|
||||
|
||||
$removedIllegalHeaders = $this->removeIllegalV4aHeaders($request);
|
||||
$http_request = $this->CRTRequestFromGuzzleRequest($request);
|
||||
|
||||
Signing::signRequestAws(
|
||||
Signable::fromHttpRequest($http_request),
|
||||
$signingConfig, function ($signing_result, $error_code) use (&$http_request) {
|
||||
$signing_result->applyToHttpRequest($http_request);
|
||||
});
|
||||
foreach ($removedIllegalHeaders as $header => $value) {
|
||||
$request = $request->withHeader($header, $value);
|
||||
}
|
||||
|
||||
$sigV4AHeaders = $http_request->headers();
|
||||
foreach ($sigV4AHeaders->toArray() as $h => $v) {
|
||||
$request = $request->withHeader($h, $v);
|
||||
}
|
||||
|
||||
return $request;
|
||||
}
|
||||
|
||||
protected function presignWithV4a(
|
||||
RequestInterface $request,
|
||||
CredentialsInterface $credentials,
|
||||
$expires
|
||||
)
|
||||
{
|
||||
$this->verifyCRTLoaded();
|
||||
$credentials_provider = $this->createCRTStaticCredentialsProvider($credentials);
|
||||
$signingConfig = new SigningConfigAWS([
|
||||
'algorithm' => SigningAlgorithm::SIGv4_ASYMMETRIC,
|
||||
'signature_type' => SignatureType::HTTP_REQUEST_QUERY_PARAMS,
|
||||
'credentials_provider' => $credentials_provider,
|
||||
'signed_body_value' => $this->getPresignedPayload($request),
|
||||
'region' => "*",
|
||||
'service' => $this->service,
|
||||
'date' => time(),
|
||||
'expiration_in_seconds' => $expires
|
||||
]);
|
||||
|
||||
$this->removeIllegalV4aHeaders($request);
|
||||
foreach ($this->getHeaderBlacklist() as $headerName => $headerValue) {
|
||||
if ($request->hasHeader($headerName)) {
|
||||
$request = $request->withoutHeader($headerName);
|
||||
}
|
||||
}
|
||||
|
||||
$http_request = $this->CRTRequestFromGuzzleRequest($request);
|
||||
Signing::signRequestAws(
|
||||
Signable::fromHttpRequest($http_request),
|
||||
$signingConfig, function ($signing_result, $error_code) use (&$http_request) {
|
||||
$signing_result->applyToHttpRequest($http_request);
|
||||
});
|
||||
|
||||
return $request->withUri(
|
||||
new Psr7\Uri($http_request->pathAndQuery())
|
||||
);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user