o `j@sddlZddlZddlZddlZddlZddlZddlZzddlmZ Wn e y/dZ Ynwddl m Z ddl mZeeZGddde ZGdd d ZdS) N)Session) SaslMechanism)KafkaConfigurationErrorc@sDeZdZddZddZddZddZd d Zd d Zd dZ dS)SaslMechanismAwsMskIamcKsXtdurtd|dddkrtdd|vrtd|d|_d|_d|_d|_dS) Nz+AWS_MSK_IAM requires the "botocore" packagesecurity_protocolSASL_SSLzAWS_MSK_IAM requires SASL_SSLhostz'AWS_MSK_IAM requires host configurationF) BotoSession RuntimeErrorgetrr _auth_is_done_is_authenticated)selfconfigrP/home/djax/ivt_ai_plugin/venv/lib/python3.10/site-packages/kafka/net/sasl/msk.py__init__s  zSaslMechanismAwsMskIam.__init__cCsDt}|}|dstdt|j|j|j|d|j dS)NregionzJUnable to determine region for AWS MSK cluster. Is AWS_DEFAULT_REGION set?)r access_key secret_keyrtoken) r get_credentialsget_frozen_credentialsget_config_variablerAwsMskIamClientr rrr)rsession credentialsrrr _build_client$s  z$SaslMechanismAwsMskIam._build_clientcCs|}td|j|S)Nz'Generating auth token for MSK scope: %s)r logdebug_scope first_message)rclientrrr auth_bytes1sz!SaslMechanismAwsMskIam.auth_bytescCs d|_|dk|_|d|_dS)NTutf-8)rrdecoder)rr&rrrreceive6s zSaslMechanismAwsMskIam.receivecC|jSN)rrrrris_done;zSaslMechanismAwsMskIam.is_donecCr+r,)rr-rrris_authenticated>r/z'SaslMechanismAwsMskIam.is_authenticatedcCs|jstdd|jfS)NzNot authenticated yet!z'Authenticated via SASL / AWS_MSK_IAM %s)r0r rr-rrr auth_detailsAs z#SaslMechanismAwsMskIam.auth_detailsN) __name__ __module__ __qualname__rr r&r*r.r0r1rrrrrs   rc@seZdZejejdZdddZeddZ eddZ ed d Z ed d Z ed dZ eddZeddZeddZddZddZddZdS)rz-._~NcCs~d|_d|_tj|_d|fg|_d|_d|_d|j|_ t j }| d|_ | d|_||_||_||_||_||_d S) aM Arguments: host (str): The hostname of the broker. access_key (str): An AWS_ACCESS_KEY_ID. secret_key (str): An AWS_SECRET_ACCESS_KEY. region (str): An AWS_REGION. token (Optional[str]): An AWS_SESSION_TOKEN if using temporary credentials. zAWS4-HMAC-SHA256900r 2020_10_22z kafka-clusterz {}:Connectz%Y%m%dz%Y%m%dT%H%M%SZN) algorithmexpireshashlibsha256hashfuncheadersversionserviceformatactiondatetimeutcnowstrftime datestamp timestampr rrrr)rr rrrrnowrrrrJs      zAwsMskIamClient.__init__cC d|S)Nz{0.access_key}/{0._scope}r?r-rrr _credentiali zAwsMskIamClient._credentialcCrG)Nz1{0.datestamp}/{0.region}/{0.service}/aws4_requestrHr-rrrr#mrJzAwsMskIamClient._scopecCsdtdd|jDS)z Returns (str): An alphabetically sorted, semicolon-delimited list of lowercase request header names. ;css|] \}}|VqdSr,)lower).0k_rrr xsz2AwsMskIamClient._signed_headers..)joinsortedr<r-rrr_signed_headersqszAwsMskIamClient._signed_headerscCsdtdj|jdS)z Returns (str): A newline-delited list of header names and values. Header names are lowercased.  :)rQmapr<r-rrr_canonical_headerszsz"AwsMskIamClient._canonical_headerscCs*|d}ddd|j|j|j|fS)a' Returns (str): An AWS Signature Version 4 canonical request in the format: r'rTGET/)r; hexdigestrQ_canonical_querystringrWrS)rhashed_payloadrrr_canonical_requests z"AwsMskIamClient._canonical_requestcsg}|djf|djf|djf|djf|djfjr5|djf|djfdfd d |DS) za Returns (str): A '&'-separated list of URI-encoded key/value pairs. ActionzX-Amz-AlgorithmzX-Amz-Credentialz X-Amz-Datez X-Amz-ExpireszX-Amz-Security-TokenzX-Amz-SignedHeaders&c3s,|]\}}|d|VqdS)=N) _uriencode)rMrNvr-rrrPs*z9AwsMskIamClient._canonical_querystring..) appendr@r7rIrEr8rrSrQ)rparamsrr-rr[sz&AwsMskIamClient._canonical_querystringcCsF|d|jd|j}|||j}|||j}||d}|S)z Returns (bytes): An AWS Signature V4 signing key generated from the secret_key, date, region, service, and request type. AWS4r( aws4_request)_hmacrencoderDrr>)rkeyrrr _signing_keys  zAwsMskIamClient._signing_keycCs.||jd}d|j|j|j|fS)z Returns (str): A string used to sign the AWS Signature V4 payload in the format: r(rT)r;r]rhrZrQr7rEr#)rcanonical_request_hashrrr _signing_strs zAwsMskIamClient._signing_strcCstjj||jdS)a Arguments: msg (str): A string to URI-encode. Returns (str): The URI-encoded version of the provided msg, following the encoding rules specified: https://github.com/aws/aws-msk-iam-auth#uriencode )safe)urllibparsequoteUNRESERVED_CHARS)rmsgrrrras zAwsMskIamClient._uriencodecCstj||d|jdS)z Arguments: key (bytes): A key to use for the HMAC digest. msg (str): A value to include in the HMAC digest. Returns (bytes): An HMAC digest of the given key and msg. r( digestmod)hmacnewrhr;digest)rrirrrrrrgszAwsMskIamClient._hmacc Csntj|j|jd|jd}|j|jd|j |j |j |j |j |j|d }|jr-|j|d<tj|dddS)z Returns (bytes): An encoded JSON authentication payload that can be sent to the broker. r(rsz kafka-python) r=r z user-agentr@zx-amz-algorithmzx-amz-credentialz x-amz-datezx-amz-signedheadersz x-amz-expireszx-amz-signaturezx-amz-security-token),rU) separators)rurvrjrlrhr;rZr=r r@r7rIrErSr8rjsondumps)r signaturerrrrrr$s*  zAwsMskIamClient.first_messager,)r2r3r4string ascii_lettersdigitsrqrpropertyrIr#rSrWr]r[rjrlrargr$rrrrrGs,           r)rAr9rurzloggingr}rnbotocore.sessionrr ImportErrorabcr kafka.errorsr getLoggerr2r!rrrrrrs"    0