Skip to content

Instantly share code, notes, and snippets.

@robbat2
Last active December 31, 2015 21:29
Show Gist options
  • Select an option

  • Save robbat2/8047546 to your computer and use it in GitHub Desktop.

Select an option

Save robbat2/8047546 to your computer and use it in GitHub Desktop.
I think the Amazon S3 Browser POST signature examples are wrong, and thus other code written on them might also be wrong. Here is a testcase that tries to validate the examples.
#!/usr/bin/python
# This attempts to valid the S3 authentication examples given by the Amazon S3
# documentation
# Robin Johnson <robbat2@gentoo.org> 2013/12/19
# http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html#RESTAuthenticationExamples
# http://docs.aws.amazon.com/AmazonS3/latest/dev/HTTPPOSTExamples.html#HTTPPOSTExamplesFileUpload
# Testing: API DELETE PASS
# Testing: API GET PASS
# Testing: API PUT PASS
# Testing: API Upload PASS
# Testing: Browser POST #1 FAIL
# > Recieved: gp42sMsv4L5xLO0OjT+56V64o+A=
# > Expected: 0RavWzkygo6QX9caELEqKi9kDbU=
# Testing: Browser POST #2 FAIL
# > Recieved: N62DT1DyNpFffYMtbbcprXYEcO8=
# > Expected: qA7FWXKq6VvU68lI9KdveT1cWgF=
import hmac
import hashlib
import base64
AWSAccessKeyId = "AKIAIOSFODNN7EXAMPLE"
AWSSecretAccessKey = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
testcases = {
# http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html#RESTAuthenticationExamples
"API GET": {
"msg": "GET\n\n\nTue, 27 Mar 2007 19:36:42 +0000\n/johnsmith/photos/puppy.jpg",
"sig": "bWq2s1WEIj+Ydj0vQ697zp+IXMU=",
},
"API PUT": {
"msg": "PUT\n\nimage/jpeg\nTue, 27 Mar 2007 21:15:45 +0000\n/johnsmith/photos/puppy.jpg",
"sig": "MyyxeRY7whkBe+bq8fHCL/2kKUg=",
},
"API DELETE": {
"msg": "DELETE\n\n\nTue, 27 Mar 2007 21:20:26 +0000\n/johnsmith/photos/puppy.jpg",
"sig": "lx3byBScXR6KzyMaifNkardMwNk=",
},
"API Upload": {
"msg": "PUT\n4gJE4saaMU4BqNR0kLY+lw==\napplication/x-download\nTue, 27 Mar 2007 21:06:08 +0000\nx-amz-acl:public-read\nx-amz-meta-checksumalgorithm:crc32\nx-amz-meta-filechecksum:0x02661779\nx-amz-meta-reviewedby:joe@johnsmith.net,jane@johnsmith.net\n/static.johnsmith.net/db-backup.dat.gz",
"sig": "ilyl83RwaSoYIEdixDQcA4OnAnc=",
},
# http://docs.aws.amazon.com/AmazonS3/latest/dev/HTTPPOSTExamples.html#HTTPPOSTExamplesFileUpload
"Browser POST #1": {
"msg": "eyAiZXhwaXJhdGlvbiI6ICIyMDA3LTEyLTAxVDEyOjAwOjAwLjAwMFoiLAogICJjb25kaXRpb25zIjogWwogICAgeyJidWNrZXQiOiAiam9obnNtaXRoIn0sCiAgICBbInN0YXJ0cy13aXRoIiwgIiRrZXkiLCAidXNlci9lcmljLyJdLAogICAgeyJhY2wiOiAicHVibGljLXJlYWQifSwKICAgIHsic3VjY2Vzc19hY3Rpb25fcmVkaXJlY3QiOiAiaHR0cDovL2pvaG5zbWl0aC5zMy5hbWF6b25hd3MuY29tL3N1Y2Nlc3NmdWxfdXBsb2FkLmh0bWwifSwKICAgIFsic3RhcnRzLXdpdGgiLCAiJENvbnRlbnQtVHlwZSIsICJpbWFnZS8iXSwKICAgIHsieC1hbXotbWV0YS11dWlkIjogIjE0MzY1MTIzNjUxMjc0In0sCiAgICBbInN0YXJ0cy13aXRoIiwgIiR4LWFtei1tZXRhLXRhZyIsICIiXQogIF0KfQo=",
"sig": "0RavWzkygo6QX9caELEqKi9kDbU=",
},
"Browser POST #2": {
"msg": "eyAiZXhwaXJhdGlvbiI6ICIyMDA3LTEyLTAxVDEyOjAwOjAwLjAwMFoiLAogICJjb25kaXRpb25zIjogWwogICAgeyJidWNrZXQiOiAiam9obnNtaXRoIn0sCiAgICBbInN0YXJ0cy13aXRoIiwgIiRrZXkiLCAidXNlci9lcmljLyJdLAogICAgeyJhY2wiOiAicHVibGljLXJlYWQifSwKICAgIHsic3VjY2Vzc19hY3Rpb25fcmVkaXJlY3QiOiAiaHR0cDovL2pvaG5zbWl0aC5zMy5hbWF6b25hd3MuY29tL25ld19wb3N0Lmh0bWwifSwKICAgIFsiZXEiLCAiJENvbnRlbnQtVHlwZSIsICJ0ZXh0L2h0bWwiXSwKICAgIHsieC1hbXotbWV0YS11dWlkIjogIjE0MzY1MTIzNjUxMjc0In0sCiAgICBbInN0YXJ0cy13aXRoIiwgIiR4LWFtei1tZXRhLXRhZyIsICIiXQogIF0KfQo=",
"sig": "qA7FWXKq6VvU68lI9KdveT1cWgF="
},
}
def amazon_sig(secretkey, msg):
H = hmac.new(secretkey,None,hashlib.sha1)
H.update(msg)
return base64.standard_b64encode(H.digest())
k = testcases.keys()
k.sort()
for _ in k:
v = testcases[_]
print "Testing: ",_,
actual = amazon_sig(AWSSecretAccessKey, v['msg'])
expected = v['sig']
if actual == expected:
print "PASS"
else:
print "FAIL"
print "> Recieved: ",actual
print "> Expected: ",expected
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment