3
,[A\
@ s$ d Z ddlmZmZ ddlZddlZddlZddlZddlm Z m
Z
m Z m Z m
Z
ddlmZ y ddlZW n ek
r ddljZY nX ejeZdd Zd(d d
Zd g dd d
fddZdd Zdd Zdd Z da dd Z dd Z dd Z d d Z!d d Z"d)d d!Z#d"d# Z$d$d% Z%d*d&d'Z&dS )+a
oauthlib.oauth1.rfc5849.signature
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This module represents a direct implementation of `section 3.4`_ of the spec.
Terminology:
* Client: software interfacing with an OAuth API
* Server: the API provider
* Resource Owner: the user who is granting authorization to the client
Steps for signing a request:
1. Collect parameters from the uri query, auth header, & body
2. Normalize those parameters
3. Normalize the uri
4. Pass the normalized uri, normalized parameters, and http method to
construct the base string
5. Pass the base string and any keys needed to a signing function
.. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4
)absolute_importunicode_literalsN)
bytes_typeextract_paramssafe_string_equals unicode_type urldecode )utilsc C s> t j| j }|d7 }|t j|7 }|d7 }|t j|7 }|S )aY **String Construction**
Per `section 3.4.1.1`_ of the spec.
For example, the HTTP request::
POST /request?b5=%3D%253D&a3=a&c%40=&a2=r%20b HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded
Authorization: OAuth realm="Example",
oauth_consumer_key="9djdj82h48djs9d2",
oauth_token="kkk9d7dh3k39sjv7",
oauth_signature_method="HMAC-SHA1",
oauth_timestamp="137131201",
oauth_nonce="7d8f3e4a",
oauth_signature="bYT5CMsGcbgUdFHObYMEfcx6bsw%3D"
c2&a3=2+q
is represented by the following signature base string (line breaks
are for display purposes only)::
POST&http%3A%2F%2Fexample.com%2Frequest&a2%3Dr%2520b%26a3%3D2%2520q
%26a3%3Da%26b5%3D%253D%25253D%26c%2540%3D%26c2%3D%26oauth_consumer_
key%3D9djdj82h48djs9d2%26oauth_nonce%3D7d8f3e4a%26oauth_signature_m
ethod%3DHMAC-SHA1%26oauth_timestamp%3D137131201%26oauth_token%3Dkkk
9d7dh3k39sjv7
.. _`section 3.4.1.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.1
&)r
escapeupper) http_methodZbase_string_uriZ%normalized_encoded_request_parameters base_string r /usr/lib/python3.6/signature.pyconstruct_base_string+ s (r c
C s t | tstdtj| \}}}}}}| s4| r s z%collect_parameters..Z
authorizationNc s g | ]} s|d dkr|qS )r Zrealmr )r' i)
with_realmr r
s z&collect_parameters..Zoauth_c S s | d dkS )Nr Zoauth_signaturer )r+ r r r 8 s z$collect_parameters..)
extendr dictitemsgetr
Zparse_authorization_headerr
startswithZunescapeappendlistfilter) Z uri_queryZbodyZheadersZexclude_oauth_signaturer, r% Z
headers_lowerZauthorization_headerZ
bodyparamsZunescaped_paramsr( r) r )r, r collect_parameters s* ;
r7 c C s. dd | D }|j dd |D }dj|S )a
**Parameters Normalization**
Per `section 3.4.1.3.2`_ of the spec.
For example, the list of parameters from the previous section would
be normalized as follows:
Encoded::
+------------------------+------------------+
| Name | Value |
+------------------------+------------------+
| b5 | %3D%253D |
| a3 | a |
| c%40 | |
| a2 | r%20b |
| oauth_consumer_key | 9djdj82h48djs9d2 |
| oauth_token | kkk9d7dh3k39sjv7 |
| oauth_signature_method | HMAC-SHA1 |
| oauth_timestamp | 137131201 |
| oauth_nonce | 7d8f3e4a |
| c2 | |
| a3 | 2%20q |
+------------------------+------------------+
Sorted::
+------------------------+------------------+
| Name | Value |
+------------------------+------------------+
| a2 | r%20b |
| a3 | 2%20q |
| a3 | a |
| b5 | %3D%253D |
| c%40 | |
| c2 | |
| oauth_consumer_key | 9djdj82h48djs9d2 |
| oauth_nonce | 7d8f3e4a |
| oauth_signature_method | HMAC-SHA1 |
| oauth_timestamp | 137131201 |
| oauth_token | kkk9d7dh3k39sjv7 |
+------------------------+------------------+
Concatenated Pairs::
+-------------------------------------+
| Name=Value |
+-------------------------------------+
| a2=r%20b |
| a3=2%20q |
| a3=a |
| b5=%3D%253D |
| c%40= |
| c2= |
| oauth_consumer_key=9djdj82h48djs9d2 |
| oauth_nonce=7d8f3e4a |
| oauth_signature_method=HMAC-SHA1 |
| oauth_timestamp=137131201 |
| oauth_token=kkk9d7dh3k39sjv7 |
+-------------------------------------+
and concatenated together into a single string (line breaks are for
display purposes only)::
a2=r%20b&a3=2%20q&a3=a&b5=%3D%253D&c%40=&c2=&oauth_consumer_key=9dj
dj82h48djs9d2&oauth_nonce=7d8f3e4a&oauth_signature_method=HMAC-SHA1
&oauth_timestamp=137131201&oauth_token=kkk9d7dh3k39sjv7
.. _`section 3.4.1.3.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.2
c S s$ g | ] \}}t j|t j|fqS r )r
r )r' r( r) r r r r- s z(normalize_parameters..c S s g | ]\}}d j ||qS )z{0}={1})format)r' r( r) r r r r- s r )sortjoin)r% Z
key_valuesZparameter_partsr r r normalize_parameters> s Pr; c C s t | |j|jS )N)sign_hmac_sha1
client_secretresource_owner_secret)r clientr r r sign_hmac_sha1_with_client s r@ c C sl | }t j|pd}|d7 }|t j|p&d7 }|jd}|jd}tj||tj}tj|j dd j
dS )aP **HMAC-SHA1**
The "HMAC-SHA1" signature method uses the HMAC-SHA1 signature
algorithm as defined in `RFC2104`_::
digest = HMAC-SHA1 (key, text)
Per `section 3.4.2`_ of the spec.
.. _`RFC2104`: https://tools.ietf.org/html/rfc2104
.. _`section 3.4.2`: https://tools.ietf.org/html/rfc5849#section-3.4.2
r r zutf-8Nr ) r
r encodehmacnewhashlibZsha1binascii
b2a_base64Zdigestdecode)r r= r> textkeyZkey_utf8Z text_utf8 signaturer r r r< s
r< c C s$ t d kr dd lj} | j| jja t S )Nr )_jwtrs1Zjwt.algorithmsZ
algorithmsZ RSAAlgorithmZhashesZSHA1)Zjwtalgor r r _jwt_rs1_signing_algorithm s
rM c C sH t | tr| jd} t }t||}|j| |}tj|dd jdS )ai **RSA-SHA1**
Per `section 3.4.3`_ of the spec.
The "RSA-SHA1" signature method uses the RSASSA-PKCS1-v1_5 signature
algorithm as defined in `RFC3447, Section 8.2`_ (also known as
PKCS#1), using SHA-1 as the hash function for EMSA-PKCS1-v1_5. To
use this method, the client MUST have established client credentials
with the server that included its RSA public key (in a manner that is
beyond the scope of this specification).
.. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3
.. _`RFC3447, Section 8.2`: https://tools.ietf.org/html/rfc3447#section-8.2
zutf-8Nr rA ) r r rB rM _prepare_key_plusZsignrF rG rH )r Zrsa_private_keyalgrJ sr r r
sign_rsa_sha1 s
rQ c C s |j stdt| |j S )Nz4rsa_key is required when using RSA signature method.)Zrsa_keyr rQ )r r? r r r sign_rsa_sha1_with_client s rR c C s, t j| p
d}|d7 }|t j|p"d7 }|S )a Sign a request using plaintext.
Per `section 3.4.4`_ of the spec.
The "PLAINTEXT" method does not employ a signature algorithm. It
MUST be used with a transport-layer mechanism such as TLS or SSL (or
sent over a secure channel with equivalent protections). It does not
utilize the signature base string or the "oauth_timestamp" and
"oauth_nonce" parameters.
.. _`section 3.4.4`: https://tools.ietf.org/html/rfc5849#section-3.4.4
r r )r
r )r= r> rK r r r sign_plaintext s rS c C s t |j|jS )N)rS r= r> )r r? r r r sign_plaintext_with_client$ s rT c C sN t | j}t| j}t| j||}t|||}t|| j}|sJt j
d| |S )a Verify a HMAC-SHA1 signature.
Per `section 3.4`_ of the spec.
.. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4
To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri
attribute MUST be an absolute URI whose netloc part identifies the
origin server or gateway on which the resource resides. Any Host
item of the request argument's headers dict attribute will be
ignored.
.. _`RFC2616 section 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2
z,Verify HMAC-SHA1 failed: sig base string: %s) r; r% r& r! r r r< r rK logdebug)requestr= r> norm_paramsr! r rK matchr r r verify_hmac_sha1( s
rZ c C s t |tr|jd}| j|S )Nzutf-8)r r rH Z prepare_key)rO Zkeystrr r r rN D s
rN c C sl t | j}t| j}t| j||jd}tj| j jd}t
}t ||}|j |||}|sht
jd| |S )af Verify a RSASSA-PKCS #1 v1.5 base64 encoded signature.
Per `section 3.4.3`_ of the spec.
Note this method requires the jwt and cryptography libraries.
.. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3
To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri
attribute MUST be an absolute URI whose netloc part identifies the
origin server or gateway on which the resource resides. Any Host
item of the request argument's headers dict attribute will be
ignored.
.. _`RFC2616 section 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2
zutf-8z+Verify RSA-SHA1 failed: sig base string: %s)r; r% r& r! r r rB rF Z
a2b_base64rK rM rN ZverifyrU rV ) rW Zrsa_public_keyrX r! messageZsigrO rJ Z verify_okr r r verify_rsa_sha1I s
r\ c C s( t ||}t|| j}|s$tjd |S )zVerify a PLAINTEXT signature.
Per `section 3.4`_ of the spec.
.. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4
zVerify PLAINTEXT failed)rS r rK rU rV )rW r= r> rK rY r r r verify_plaintexth s
r] )N)NN)NN)'__doc__Z
__future__r r rF rE rC ZloggingZoauthlib.commonr r r r r r r
r ImportErrorZ urllib.parseparseZ getLogger__name__rU r r& r7 r; r@ r< rL rM rQ rR rS rT rZ rN r\ r] r r r r s<
A
Wzb1#