|
|
@@ -39,7 +39,7 @@ import hmac
|
|
|
import os
|
|
|
import posixpath
|
|
|
|
|
|
-from boto.compat import urllib, encodebytes, parse_qs_safe
|
|
|
+from boto.compat import urllib, encodebytes, parse_qs_safe, urlparse
|
|
|
from boto.auth_handler import AuthHandler
|
|
|
from boto.exception import BotoClientError
|
|
|
|
|
|
@@ -51,8 +51,32 @@ except ImportError:
|
|
|
sha256 = None
|
|
|
|
|
|
|
|
|
-# Region detection strings to determine if SigV4 should be used
|
|
|
-# by default.
|
|
|
+# Region detection strings to determine if SigV2 should be used
|
|
|
+# by default
|
|
|
+S3_AUTH_DETECT = [
|
|
|
+ '-ap-northeast-1',
|
|
|
+ '.ap-northeast-1',
|
|
|
+ '-ap-southeast-1',
|
|
|
+ '.ap-southeast-1',
|
|
|
+ '-ap-southeast-2',
|
|
|
+ '.ap-southeast-2',
|
|
|
+ '-eu-west-1',
|
|
|
+ '.eu-west-1',
|
|
|
+ '-external-1',
|
|
|
+ '.external-1',
|
|
|
+ '-sa-east-1',
|
|
|
+ '.sa-east-1',
|
|
|
+ '-us-east-1',
|
|
|
+ '.us-east-1',
|
|
|
+ '-us-gov-west-1',
|
|
|
+ '.us-gov-west-1',
|
|
|
+ '-us-west-1',
|
|
|
+ '.us-west-1',
|
|
|
+ '-us-west-2',
|
|
|
+ '.us-west-2'
|
|
|
+]
|
|
|
+
|
|
|
+
|
|
|
SIGV4_DETECT = [
|
|
|
'.cn-',
|
|
|
# In eu-central and ap-northeast-2 we support both host styles for S3
|
|
|
@@ -61,7 +85,13 @@ SIGV4_DETECT = [
|
|
|
'.ap-northeast-2',
|
|
|
'-ap-northeast-2',
|
|
|
'.ap-south-1',
|
|
|
- '-ap-south-1'
|
|
|
+ '-ap-south-1',
|
|
|
+ '.us-east-2',
|
|
|
+ '-us-east-2',
|
|
|
+ '-ca-central',
|
|
|
+ '.ca-central',
|
|
|
+ '.eu-west-2',
|
|
|
+ '-eu-west-2',
|
|
|
]
|
|
|
|
|
|
|
|
|
@@ -1032,13 +1062,38 @@ def detect_potential_s3sigv4(func):
|
|
|
if boto.config.get('s3', 'use-sigv4', False):
|
|
|
return ['hmac-v4-s3']
|
|
|
|
|
|
- if hasattr(self, 'host'):
|
|
|
- # If you're making changes here, you should also check
|
|
|
- # ``boto/iam/connection.py``, as several things there are also
|
|
|
- # endpoint-related.
|
|
|
- for test in SIGV4_DETECT:
|
|
|
- if test in self.host:
|
|
|
- return ['hmac-v4-s3']
|
|
|
-
|
|
|
- return func(self)
|
|
|
+ if not hasattr(self, 'host'):
|
|
|
+ return func(self)
|
|
|
+
|
|
|
+ # Keep the old explicit logic in case somebody was adding to the list.
|
|
|
+ for test in SIGV4_DETECT:
|
|
|
+ if test in self.host:
|
|
|
+ return ['hmac-v4-s3']
|
|
|
+
|
|
|
+ # Use default for non-aws hosts. Adding a url scheme is necessary if
|
|
|
+ # not present for urlparse to properly function.
|
|
|
+ host = self.host
|
|
|
+ if not self.host.startswith('http://') or \
|
|
|
+ self.host.startswith('https://'):
|
|
|
+ host = 'https://' + host
|
|
|
+ netloc = urlparse(host).netloc
|
|
|
+ if not (netloc.endswith('amazonaws.com') or
|
|
|
+ netloc.endswith('amazonaws.com.cn')):
|
|
|
+ return func(self)
|
|
|
+
|
|
|
+ # Use the default for the global endpoint
|
|
|
+ if netloc.endswith('s3.amazonaws.com'):
|
|
|
+ return func(self)
|
|
|
+
|
|
|
+ # Use the default for regions that support sigv4 and sigv2
|
|
|
+ if any(test in self.host for test in S3_AUTH_DETECT):
|
|
|
+ return func(self)
|
|
|
+
|
|
|
+ # Use anonymous if enabled.
|
|
|
+ if hasattr(self, 'anon') and self.anon:
|
|
|
+ return func(self)
|
|
|
+
|
|
|
+ # Default to sigv4 for aws hosts outside of regions that are known
|
|
|
+ # to support sigv2
|
|
|
+ return ['hmac-v4-s3']
|
|
|
return _wrapper
|