File: | blib/lib/Net/Amazon/SignatureVersion4.pm |
Coverage: | 96.0% |
line | stmt | bran | cond | sub | pod | time | code |
---|---|---|---|---|---|---|---|
1 | 4 4 4 | 245661 4 96 | use strict; | ||||
2 | 4 4 4 | 10 6 208 | use warnings; | ||||
3 | package Net::Amazon::SignatureVersion4; | ||||||
4 | { | ||||||
5 | $Net::Amazon::SignatureVersion4::VERSION = '0.004'; | ||||||
6 | } | ||||||
7 | 4 4 4 | 1971 6617090 110 | use MooseX::App qw(Config); | ||||
8 | 4 4 4 | 6182229 9334 319 | use Digest::SHA qw(sha256_hex hmac_sha256_hex hmac_sha256 hmac_sha256_base64); | ||||
9 | 4 4 4 | 1206 10085 95 | use POSIX qw(strftime); | ||||
10 | 4 4 4 | 4598 33957 137 | use URI::Encode; | ||||
11 | 4 4 4 | 868 9144 189 | use HTTP::Date; | ||||
12 | 4 4 4 | 74 9 1643 | use 5.010; | ||||
13 | |||||||
14 | # ABSTRACT: Signs requests using Amazon's Signature Version 4. | ||||||
15 | |||||||
16 | |||||||
17 | option 'Access_Key_Id' => ( | ||||||
18 | is => 'rw', | ||||||
19 | isa => 'Str', | ||||||
20 | reader => 'get_Access_Key_ID', | ||||||
21 | predicate => 'has_Access_Key_ID', | ||||||
22 | writer => 'set_Access_Key_ID', | ||||||
23 | ); | ||||||
24 | |||||||
25 | option 'Secret_Access_Key' => ( | ||||||
26 | is => 'rw', | ||||||
27 | isa => 'Str', | ||||||
28 | reader => 'get_Secret_Access_Key', | ||||||
29 | predicate => 'has_Secret_Access_Key', | ||||||
30 | writer => 'set_Secret_Access_Key', | ||||||
31 | ); | ||||||
32 | |||||||
33 | option 'region' => ( | ||||||
34 | is => 'rw', | ||||||
35 | isa => 'Str', | ||||||
36 | writer => 'set_region', | ||||||
37 | reader => 'get_region', | ||||||
38 | default => 'us-east-1', | ||||||
39 | ); | ||||||
40 | |||||||
41 | option 'request' => ( | ||||||
42 | is => 'rw', | ||||||
43 | isa => 'Object', | ||||||
44 | writer => 'set_request', | ||||||
45 | reader => 'get_request', | ||||||
46 | ); | ||||||
47 | |||||||
48 | option 'service' => ( | ||||||
49 | is => 'rw', | ||||||
50 | isa => 'Str', | ||||||
51 | writer => 'set_service', | ||||||
52 | reader => 'get_service', | ||||||
53 | ); | ||||||
54 | |||||||
55 | option 'time' => ( | ||||||
56 | is => 'rw', | ||||||
57 | isa => 'Str', | ||||||
58 | writer => 'set_time', | ||||||
59 | reader => 'get_time', | ||||||
60 | ); | ||||||
61 | |||||||
62 | option 'date_stamp' => ( | ||||||
63 | is => 'rw', | ||||||
64 | isa => 'Str', | ||||||
65 | writer => 'set_date_stamp', | ||||||
66 | reader => 'get_date_stamp', | ||||||
67 | ); | ||||||
68 | |||||||
69 | option 'signed_headers' => ( | ||||||
70 | is => 'rw', | ||||||
71 | isa => 'Str', | ||||||
72 | writer => 'set_signed_headers', | ||||||
73 | reader => 'get_signed_headers', | ||||||
74 | ); | ||||||
75 | |||||||
76 | sub get_authorized_request{ | ||||||
77 | |||||||
78 | 30 | 23864 | my $self=shift; | ||||
79 | 30 | 1963 | my $request=$self->get_request(); | ||||
80 | 30 | 68 | $request->header( Authorization => $self->get_authorization() ); | ||||
81 | 30 | 3136 | return $request | ||||
82 | |||||||
83 | } | ||||||
84 | |||||||
85 | sub get_authorization{ | ||||||
86 | 60 | 23148 | my $self=shift; | ||||
87 | 60 | 129 | my %dk=$self->get_derived_signing_key(); | ||||
88 | 60 | 121 | my $sts=$self->get_string_to_sign(); | ||||
89 | 60 | 152 | $sts=~tr/\r//d; | ||||
90 | 60 | 963 | my $signature=hmac_sha256_hex($sts,$dk{'kSigning'}); | ||||
91 | 60 | 3324 | return "AWS4-HMAC-SHA256 Credential=".$self->get_Access_Key_ID()."/".$self->get_date_stamp()."/".$self->get_region()."/".$self->get_service()."/aws4_request, SignedHeaders=".$self->get_signed_headers().", Signature=$signature"; | ||||
92 | } | ||||||
93 | |||||||
94 | sub get_derived_signing_key{ | ||||||
95 | 61 | 89 | my $self=shift; | ||||
96 | 61 | 117 | $self->get_canonical_request(); # This is a hack to get the date set before using it to derive the signing key. | ||||
97 | 61 | 88 | my %rv=(); | ||||
98 | 61 | 3114 | $rv{'kSecret'}="AWS4".$self->get_Secret_Access_Key(); | ||||
99 | #say("kSecret: ".unpack('H*',$rv{'kSecret'})); | ||||||
100 | 61 | 2928 | $rv{'kDate'}=hmac_sha256($self->get_date_stamp(),$rv{'kSecret'}); | ||||
101 | #say("kDate: ".unpack('H*',$rv{'kDate'})); | ||||||
102 | 61 | 2898 | $rv{'kRegion'}=hmac_sha256($self->get_region(),$rv{'kDate'}); | ||||
103 | #say("kRegion: ".unpack('H*',$rv{'kRegion'})); | ||||||
104 | 61 | 2913 | $rv{'kService'}=hmac_sha256($self->get_service(),$rv{'kRegion'}); | ||||
105 | #say("kService: ".unpack('H*',$rv{'kService'})); | ||||||
106 | 61 | 489 | $rv{'kSigning'}=hmac_sha256("aws4_request",$rv{'kService'}); | ||||
107 | #say("kSigning: ".unpack('H*',$rv{'kSigning'})); | ||||||
108 | 61 | 348 | return %rv; | ||||
109 | } | ||||||
110 | sub get_string_to_sign{ | ||||||
111 | 90 | 22632 | my $self=shift; | ||||
112 | |||||||
113 | 90 | 125 | my $creq=$self->get_canonical_request(); | ||||
114 | 90 | 156 | $creq=~tr/\r//d; | ||||
115 | 90 | 4362 | my $StringToSign="AWS4-HMAC-SHA256\r\n". | ||||
116 | $self->get_time()."\r\n". | ||||||
117 | $self->get_date_stamp()."/". | ||||||
118 | $self->get_region()."/". | ||||||
119 | $self->get_service()."/aws4_request\r\n". | ||||||
120 | sha256_hex($creq); | ||||||
121 | } | ||||||
122 | |||||||
123 | sub get_canonical_request{ | ||||||
124 | 181 | 1135 | my $self=shift; | ||||
125 | 4 4 4 | 1690 19036 3411 | use Data::Dumper; | ||||
126 | |||||||
127 | 181 | 163 | my $method; | ||||
128 | 181 | 213 | my $full_uri=""; | ||||
129 | 181 | 139 | my $version; | ||||
130 | 181 | 204 | my $canonical_query_string=""; | ||||
131 | 181 | 241 | my %headers=(); | ||||
132 | |||||||
133 | 181 | 9800 | foreach my $name ( $self->get_request()->header_field_names() ){ | ||||
134 | 406 | 33492 | my @value=$self->get_request()->header($name); | ||||
135 | 406 | 30594 | next unless (defined $name & defined $value[0]); | ||||
136 | 406 | 685 | if (lc($name) eq 'date'){ | ||||
137 | 181 | 4355 | my $time=str2time($value[0]); | ||||
138 | 181 | 32433 | $self->set_date_stamp(strftime("%Y%m%d", gmtime($time))); | ||||
139 | 181 | 13121 | $self->set_time(strftime("%Y%m%dT%H%M%SZ",gmtime($time))); | ||||
140 | |||||||
141 | } | ||||||
142 | 406 | 568 | foreach my $value (@value){ | ||||
143 | 436 | 1203 | local $/ = " "; | ||||
144 | 436 | 398 | chomp($value); | ||||
145 | 436 | 586 | if (defined $headers{lc($name)}){ | ||||
146 | 30 30 | 25 91 | push @{$headers{lc($name)}}, $value; | ||||
147 | }else{ | ||||||
148 | 406 | 1712 | $headers{lc($name)}=[$value ]; | ||||
149 | } | ||||||
150 | } | ||||||
151 | } | ||||||
152 | 181 | 9045 | $full_uri=$self->get_request()->uri(); | ||||
153 | 181 | 9997 | $full_uri =~ s@^(http|https)://.*?/@/@; | ||||
154 | 181 | 9456 | if ($full_uri=~m/(.*?)\?(.*)/){ | ||||
155 | 60 | 2078 | $full_uri=$1; | ||||
156 | 60 | 94 | $canonical_query_string=$2; | ||||
157 | } | ||||||
158 | 181 | 3893 | my @canonical_query_list; | ||||
159 | 181 | 281 | if ( defined $canonical_query_string){ | ||||
160 | 181 | 435 | if ($canonical_query_string=~m/(.*?)\s.*/){ | ||||
161 | 0 | 0 | $canonical_query_string=$1 | ||||
162 | } | ||||||
163 | 181 | 390 | @canonical_query_list=split(/\&/,$canonical_query_string); | ||||
164 | } | ||||||
165 | 181 | 149 | $canonical_query_string=""; | ||||
166 | 181 | 352 | foreach my $param (sort @canonical_query_list){ | ||||
167 | 84 | 225 | (my $name, my $value)=split(/=/, $param); | ||||
168 | 84 | 124 | $name="" unless (defined $name); | ||||
169 | 84 | 106 | $value="" unless (defined $value); | ||||
170 | 84 | 117 | $canonical_query_string=$canonical_query_string._encode($name)."="._encode($value)."&"; | ||||
171 | } | ||||||
172 | 181 | 366 | $canonical_query_string=substr($canonical_query_string, 0, -1) unless ($canonical_query_string eq ""); | ||||
173 | 181 | 2643 | $full_uri=~tr/\///s; | ||||
174 | 181 | 4101 | my $ends_in_slash=0; | ||||
175 | 181 | 273 | if ($full_uri=~m/\w\/$/){ | ||||
176 | 6 | 6 | $ends_in_slash=1; | ||||
177 | } | ||||||
178 | 181 | 416 | my @uri_source=split /\//, $full_uri; | ||||
179 | 181 | 146 | my @uri_stack; | ||||
180 | 181 | 205 | foreach my $path_component (@uri_source){ | ||||
181 | 135 | 234 | if ($path_component =~ m/^\.$/){ | ||||
182 | 12 | 128 | sleep 0; | ||||
183 | }elsif ($path_component =~ m/^..$/){ | ||||||
184 | 18 | 21 | pop @uri_stack; | ||||
185 | }else{ | ||||||
186 | 105 | 151 | push @uri_stack, $path_component; | ||||
187 | } | ||||||
188 | } | ||||||
189 | 181 | 203 | $full_uri="/"; | ||||
190 | 181 | 162 | foreach my $path_component (@uri_stack){ | ||||
191 | 87 | 106 | $full_uri=$full_uri."$path_component/"; | ||||
192 | } | ||||||
193 | 181 | 170 | $full_uri=~tr/\///s; | ||||
194 | 181 | 255 | chop $full_uri unless ( $full_uri eq "/" ); | ||||
195 | 181 | 212 | if ($ends_in_slash){ | ||||
196 | 6 | 5 | $full_uri=$full_uri."/"; | ||||
197 | } | ||||||
198 | 181 | 141 | my $CanonicalHeaders=""; | ||||
199 | 181 | 157 | my $SignedHeaders=""; | ||||
200 | 181 | 485 | foreach my $header ( sort keys %headers ){ | ||||
201 | 406 | 395 | $CanonicalHeaders=$CanonicalHeaders.lc($header).':'; | ||||
202 | 406 406 | 259 479 | foreach my $element(sort @{$headers{$header}}){ | ||||
203 | 436 | 554 | $CanonicalHeaders=$CanonicalHeaders.($element).","; | ||||
204 | } | ||||||
205 | 406 | 436 | $CanonicalHeaders=substr($CanonicalHeaders, 0, -1); | ||||
206 | 406 | 229 | $CanonicalHeaders=$CanonicalHeaders."\r\n"; | ||||
207 | 406 | 421 | $SignedHeaders=$SignedHeaders.lc($header).";"; | ||||
208 | } | ||||||
209 | |||||||
210 | 181 | 225 | $SignedHeaders=substr($SignedHeaders, 0, -1); | ||||
211 | 181 | 9606 | $self->set_signed_headers($SignedHeaders); | ||||
212 | 181 | 8530 | my $CanonicalRequest = | ||||
213 | $self->get_request()->method() . "\r\n" . | ||||||
214 | $full_uri . "\r\n" . | ||||||
215 | $canonical_query_string . "\r\n" . | ||||||
216 | $CanonicalHeaders . "\r\n" . | ||||||
217 | $SignedHeaders . "\r\n" . | ||||||
218 | sha256_hex($self->get_request()->content()); | ||||||
219 | 181 | 9387 | return $CanonicalRequest; | ||||
220 | } | ||||||
221 | |||||||
222 | sub _encode{ | ||||||
223 | #This method is used to add some additional encodings that are not enforced by the URI::Encode module. AWS expects these. | ||||||
224 | 168 | 4414 | my $encoder = URI::Encode->new(); | ||||
225 | 168 | 116774 | my $rv=shift; | ||||
226 | # %20=%2F%2C%3F%3E%3C%60%22%3B%3A%5C%7C%5D%5B%7B%7D&%40%23%24%25%5E= | ||||||
227 | # + =/ , ? %3E%3C%60%22; : %5C%7C] [ %7B%7D&@ # $ %25%5E= | ||||||
228 | 168 | 3980 | $rv=$encoder->encode($rv); | ||||
229 | 168 | 16913 | $rv=~s/\+/\%20/g; | ||||
230 | 168 | 136 | $rv=~s/\//\%2F/g; | ||||
231 | 168 | 128 | $rv=~s/\,/\%2C/g; | ||||
232 | 168 | 114 | $rv=~s/\?/\%3F/g; | ||||
233 | 168 | 104 | $rv=~s/\;/\%3B/g; | ||||
234 | 168 | 102 | $rv=~s/\:/\%3A/g; | ||||
235 | 168 | 110 | $rv=~s/\]/\%5D/g; | ||||
236 | 168 | 107 | $rv=~s/\[/\%5B/g; | ||||
237 | 168 | 117 | $rv=~s/\@/\%40/g; | ||||
238 | 168 | 98 | $rv=~s/\#/\%23/g; | ||||
239 | 168 | 115 | $rv=~s/\$/\%24/g; | ||||
240 | # $rv=~s///g; | ||||||
241 | 168 | 19455 | return $rv; | ||||
242 | } | ||||||
243 | 1; | ||||||
244 |