Auth API revamp (#156)

Updates the python CRT against the AuthRevamp branch of aws-c-auth

Co-authored-by: Bret Ambrose <[email protected]>

awscrt/auth.py

@@ -74,6 +74,14 @@ def __init__(self, access_key_id, secret_access_key, session_token=None):
         super(AwsCredentials, self).__init__()
         self._binding = _awscrt.credentials_new(access_key_id, secret_access_key, session_token)
 
+    @classmethod
+    def _from_binding(cls, binding):
+        """Construct from a pre-existing native object"""
+        credentials = cls.__new__(cls)  # avoid class's default constructor
+        super(cls, credentials).__init__()  # just invoke parent class's __init__()
+        credentials._binding = binding
+        return credentials
+
     @property
     def access_key_id(self):
         return _awscrt.credentials_access_key_id(self._binding)
@@ -168,12 +176,12 @@ def new_static(cls, access_key_id, secret_access_key, session_token=None):
     def get_credentials(self):
         future = Future()
 
-        def _on_complete(error_code, access_key_id, secret_access_key, session_token):
+        def _on_complete(error_code, binding):
             try:
                 if error_code:
                     future.set_exception(awscrt.exceptions.from_code(error_code))
                 else:
-                    credentials = AwsCredentials(access_key_id, secret_access_key, session_token)
+                    credentials = AwsCredentials._from_binding(binding)
                     future.set_result(credentials)
 
             except Exception as e:
@@ -190,34 +198,52 @@ def _on_complete(error_code, access_key_id, secret_access_key, session_token):
 class AwsSigningAlgorithm(IntEnum):
     """AWS signing algorithm enumeration."""
 
-    SigV4Header = 0
-    """Use Signature Version 4 to sign headers."""
-
-    SigV4QueryParam = 1
-    """Use Signature Version 4 to sign query parameters."""
+    V4 = 0
+    """Use Signature Version 4"""
 
 
-class AwsBodySigningConfigType(IntEnum):
-    """Body signing config enumeration"""
+class AwsSignatureType(IntEnum):
+    """Which sort of signature should be computed from the signable."""
 
-    BodySigningOff = 0
+    HTTP_REQUEST_HEADERS = 0
     """
-    No attempts will be made to sign the payload, and no "x-amz-content-sha256"
-    header will be added to the request.
+    A signature for a full HTTP request should be computed,
+    with header updates applied to the signing result.
     """
 
-    BodySigningOn = 1
+    HTTP_REQUEST_QUERY_PARAMS = 1
     """
-    The body will be signed and "x-amz-content-sha256" will contain
-    the value of the signature.
+    A signature for a full HTTP request should be computed,
+    with query param updates applied to the signing result.
     """
 
-    UnsignedPayload = 2
+
+class AwsSignedBodyValueType(IntEnum):
+    """Controls what goes in the canonical request's body value."""
+
+    EMPTY = 0
+    """Use the SHA-256 of the empty string."""
+
+    PAYLOAD = 1
+    """Use the SHA-256 of the actual payload."""
+
+    UNSIGNED_PAYLOAD = 2
+    """Use the literal string "UNSIGNED-PAYLOAD"."""
+
+
+class AwsSignedBodyHeaderType(IntEnum):
     """
-    The body will not be signed, but "x-amz-content-sha256" will contain
-    the value "UNSIGNED-PAYLOAD". This value is currently only used for Amazon S3.
+    Controls if signing adds a header containing the canonical request's signed body value.
+
+    See :class:`AwsSignedBodyValueType`.
     """
 
+    NONE = 0
+    """Do not add a header."""
+
+    X_AMZ_CONTENT_SHA_256 = 1
+    """Add the "x-amz-content-sha-256" header with the canonical request's signed body value"""
+
 
 class AwsSigningConfig(NativeResource):
     """
@@ -228,7 +254,10 @@ class AwsSigningConfig(NativeResource):
     It is good practice to use a new config for each signature, or the date might get too old.
 
     Args:
-        algorithm (AwsSigningAlgorithm): Which signing process to invoke.
+        algorithm (AwsSigningAlgorithm): Which signing algorithm to use.
+
+        signature_type (AwsSignatureType): Which sort of signature should be
+            computed from the signable.
 
         credentials_provider (AwsCredentialsProviderBase): Credentials provider
             to fetch signing credentials with.
@@ -242,53 +271,84 @@ class AwsSigningConfig(NativeResource):
             `datetime.datetime.now(datetime.timezone.utc)` is used.
             Naive dates (lacking timezone info) are assumed to be in local time.
 
-        should_sign_param (Optional[Callable[[str], bool]]):
-            Optional function to control which parameters (header or query) are
+        should_sign_header (Optional[Callable[[str], bool]]):
+            Optional function to control which headers are
             a part of the canonical request.
 
-            Skipping auth-required params will result in an unusable signature.
+            Skipping auth-required headers will result in an unusable signature.
             Headers injected by the signing process are not skippable.
             This function does not override the internal check function
             (x-amzn-trace-id, user-agent), but rather supplements it.
             In particular, a header will get signed if and only if it returns
             true to both the internal check (skips x-amzn-trace-id, user-agent)
             and this function (if defined).
 
-        use_double_uri_encode (bool): Set True to double-encode the resource
-            path when constructing the canonical request. By default, all
-            services except S3 use double encoding.
+        use_double_uri_encode (bool): Whether to double-encode the resource path
+            when constructing the canonical request (assuming the path is already
+            encoded). Default is True. All services except S3 use double encoding.
 
         should_normalize_uri_path (bool): Whether the resource paths are
             normalized when building the canonical request.
 
-        body_signing_type (AwsBodySigningConfigType): Controls how the payload
-            will be signed.
+        signed_body_value_type (AwsSignedBodyValueType): Controls what goes in
+            the canonical request's body value. Default is to use the SHA-256
+            of the actual payload.
+
+        signed_body_header_type (AwsSignedBodyHeaderType): Controls if signing
+            adds a header containing the canonical request's signed body value.
+            Default is to not add a header.
+
+        expiration_in_seconds (Optional[int]): If set, and signature_type is
+            `HTTP_REQUEST_QUERY_PARAMS`, then signing will add "X-Amz-Expires"
+            to the query string, equal to the value specified here.
+
+        omit_session_token (bool): If set True, the "X-Amz-Security-Token"
+            query param is omitted from the canonical request.
+            The default False should be used for most services.
     """
     __slots__ = ('_priv_should_sign_cb')
 
-    _attributes = ('algorithm', 'credentials_provider', 'region', 'service', 'date', 'should_sign_param',
-                   'use_double_uri_encode', 'should_normalize_uri_path', 'body_signing_type')
+    _attributes = (
+        'algorithm',
+        'signature_type',
+        'credentials_provider',
+        'region',
+        'service',
+        'date',
+        'should_sign_header',
+        'use_double_uri_encode',
+        'should_normalize_uri_path',
+        'signed_body_value_type',
+        'signed_body_header_type',
+        'expiration_in_seconds',
+        'omit_session_token',
+    )
 
     def __init__(self,
-                 algorithm,  # type: AwsSigningAlgorithm
-                 credentials_provider,  # type: AwsCredentialsProviderBase
-                 region,  # type: str
-                 service,  # type: str
-                 date=None,  # type: Optional[datetime.datetime]
-                 should_sign_param=None,  # type: Optional[Callable[[str], bool]]
-                 use_double_uri_encode=False,  # type: bool
-                 should_normalize_uri_path=True,  # type: bool
-                 body_signing_type=AwsBodySigningConfigType.BodySigningOn  # type: AwsBodySigningConfigType
+                 algorithm,
+                 signature_type,
+                 credentials_provider,
+                 region,
+                 service,
+                 date=None,
+                 should_sign_header=None,
+                 use_double_uri_encode=True,
+                 should_normalize_uri_path=True,
+                 signed_body_value_type=AwsSignedBodyValueType.PAYLOAD,
+                 signed_body_header_type=AwsSignedBodyHeaderType.NONE,
+                 expiration_in_seconds=None,
+                 omit_session_token=False,
                  ):
-        # type: (...) -> None
 
         assert isinstance(algorithm, AwsSigningAlgorithm)
+        assert isinstance(signature_type, AwsSignatureType)
         assert isinstance(credentials_provider, AwsCredentialsProviderBase)
         assert isinstance_str(region)
         assert isinstance_str(service)
-        assert isinstance(date, datetime.datetime) or date is None
-        assert callable(should_sign_param) or should_sign_param is None
-        assert isinstance(body_signing_type, AwsBodySigningConfigType)
+        assert callable(should_sign_header) or should_sign_header is None
+        assert isinstance(signed_body_value_type, AwsSignedBodyValueType)
+        assert isinstance(signed_body_header_type, AwsSignedBodyHeaderType)
+        assert expiration_in_seconds is None or expiration_in_seconds > 0
 
         super(AwsSigningConfig, self).__init__()
 
@@ -306,25 +366,33 @@ def __init__(self,
                 epoch = datetime.datetime(1970, 1, 1, tzinfo=_utc)
                 timestamp = (date - epoch).total_seconds()
 
-        self._priv_should_sign_cb = should_sign_param
+        self._priv_should_sign_cb = should_sign_header
 
-        if should_sign_param is not None:
-            def should_sign_param_wrapper(name):
-                return should_sign_param(name=name)
+        if should_sign_header is not None:
+            def should_sign_header_wrapper(name):
+                return should_sign_header(name=name)
         else:
-            should_sign_param_wrapper = None
+            should_sign_header_wrapper = None
+
+        if expiration_in_seconds is None:
+            # C layer uses 0 to indicate None
+            expiration_in_seconds = 0
 
         self._binding = _awscrt.signing_config_new(
             algorithm,
+            signature_type,
             credentials_provider,
             region,
             service,
             date,
             timestamp,
-            should_sign_param_wrapper,
+            should_sign_header_wrapper,
             use_double_uri_encode,
             should_normalize_uri_path,
-            body_signing_type)
+            signed_body_value_type,
+            signed_body_header_type,
+            expiration_in_seconds,
+            omit_session_token)
 
     def replace(self, **kwargs):
         """
@@ -336,9 +404,14 @@ def replace(self, **kwargs):
 
     @property
     def algorithm(self):
-        """AwsSigningAlgorithm: Which signing process to invoke"""
+        """AwsSigningAlgorithm: Which signing algorithm to use"""
         return AwsSigningAlgorithm(_awscrt.signing_config_get_algorithm(self._binding))
 
+    @property
+    def signature_type(self):
+        """AwsSignatureType: Which sort of signature should be computed from the signable."""
+        return AwsSignatureType(_awscrt.signing_config_get_signature_type(self._binding))
+
     @property
     def credentials_provider(self):
         """AwsCredentialsProviderBase: Credentials provider to fetch signing credentials with"""
@@ -367,12 +440,12 @@ def date(self):
         return _awscrt.signing_config_get_date(self._binding)
 
     @property
-    def should_sign_param(self):
+    def should_sign_header(self):
         """
         Optional[Callable[[str], bool]]: Optional function to control which
-        parameters (header or query) are a part of the canonical request.
+        headers are a part of the canonical request.
 
-        Skipping auth-required params will result in an unusable signature.
+        Skipping auth-required headers will result in an unusable signature.
         Headers injected by the signing process are not skippable.
         This function does not override the internal check function
         (x-amzn-trace-id, user-agent), but rather supplements it. In particular,
@@ -385,7 +458,7 @@ def should_sign_param(self):
     def use_double_uri_encode(self):
         """
         bool: Whether to double-encode the resource path when constructing
-        the canonical request.
+        the canonical request (assuming the path is already encoded).
 
         By default, all services except S3 use double encoding.
         """
@@ -400,9 +473,38 @@ def should_normalize_uri_path(self):
         return _awscrt.signing_config_get_should_normalize_uri_path(self._binding)
 
     @property
-    def body_signing_type(self):
-        """AwsBodySigningConfigType: Controls how the payload will be signed."""
-        return AwsBodySigningConfigType(_awscrt.signing_config_get_body_signing_type(self._binding))
+    def signed_body_value_type(self):
+        """
+        AwsSignedBodyValueType: Controls what goes in the canonical request's body value.
+        """
+        return AwsSignedBodyValueType(_awscrt.signing_config_get_signed_body_value_type(self._binding))
+
+    @property
+    def signed_body_header_type(self):
+        """
+        AwsSignedBodyHeaderType: Controls if signing adds a header containing
+        the canonical request's signed body value.
+        """
+        return AwsSignedBodyHeaderType(_awscrt.signing_config_get_signed_body_header_type(self._binding))
+
+    @property
+    def expiration_in_seconds(self):
+        """
+        Optional[int]: If set, and signature_type is `HTTP_REQUEST_QUERY_PARAMS`,
+        then signing will add "X-Amz-Expires" to the query string, equal to the
+        value specified here. Otherwise, this is None has no effect.
+        """
+        expiration = _awscrt.signing_config_get_expiration_in_seconds(self._binding)
+        # C layer uses 0 to indicate None
+        return None if expiration == 0 else expiration
+
+    @property
+    def omit_session_token(self):
+        """
+        bool: Whether the "X-Amz-Security-Token" query param is omitted
+        from the canonical request. This should be False for most services.
+        """
+        return _awscrt.signing_config_get_omit_session_token(self._binding)
 
 
 def aws_sign_request(http_request, signing_config):

awscrt/awsiot_mqtt_connection_builder.py

@@ -244,20 +244,17 @@ def websockets_with_default_aws_signing(region, credentials_provider, websocket_
     """
     _check_required_kwargs(**kwargs)
 
-    def _should_sign_param(name, **kwargs):
-        blacklist = ['x-amz-date', 'x-amz-security-token']
-        return not (name.lower() in blacklist)
-
     def _sign_websocket_handshake_request(transform_args, **kwargs):
         # transform_args need to know when transform is done
         try:
             signing_config = awscrt.auth.AwsSigningConfig(
-                algorithm=awscrt.auth.AwsSigningAlgorithm.SigV4QueryParam,
+                algorithm=awscrt.auth.AwsSigningAlgorithm.V4,
+                signature_type=awscrt.auth.AwsSignatureType.HTTP_REQUEST_QUERY_PARAMS,
                 credentials_provider=credentials_provider,
                 region=region,
                 service='iotdevicegateway',
-                should_sign_param=_should_sign_param,
-                body_signing_type=awscrt.auth.AwsBodySigningConfigType.BodySigningOff)
+                omit_session_token=True,  # IoT is weird and does not sign X-Amz-Security-Token
+            )
 
             signing_future = awscrt.auth.aws_sign_request(transform_args.http_request, signing_config)
             signing_future.add_done_callback(lambda x: transform_args.set_done(x.exception()))