Merge pull request boto#3833 from houglum/add_anon_s3_conn_config_option

Allows anon auth'n to S3 via a config option.

Author: mfschwartz

boto/auth.py

@@ -98,21 +98,26 @@
 class HmacKeys(object):
     """Key based Auth handler helper."""
 
-    def __init__(self, host, config, provider):
+    def __init__(self, host, config, provider, anon=False):
         if provider.access_key is None or provider.secret_key is None:
-            raise boto.auth_handler.NotReadyToAuthenticate()
+            if not anon:
+                raise boto.auth_handler.NotReadyToAuthenticate()
+            else:
+                self._hmac = None
+                self._hmac_256 = None
         self.host = host
         self.update_provider(provider)
 
     def update_provider(self, provider):
         self._provider = provider
-        self._hmac = hmac.new(self._provider.secret_key.encode('utf-8'),
-                              digestmod=sha)
-        if sha256:
-            self._hmac_256 = hmac.new(self._provider.secret_key.encode('utf-8'),
-                                      digestmod=sha256)
-        else:
-            self._hmac_256 = None
+        if self._provider.secret_key:  # Anonymous handler has no key.
+            self._hmac = hmac.new(self._provider.secret_key.encode('utf-8'),
+                                  digestmod=sha)
+            if sha256:
+                self._hmac_256 = hmac.new(
+                    self._provider.secret_key.encode('utf-8'), digestmod=sha256)
+            else:
+                self._hmac_256 = None
 
     def algorithm(self):
         if self._hmac_256:
@@ -152,7 +157,8 @@ class AnonAuthHandler(AuthHandler, HmacKeys):
     capability = ['anon']
 
     def __init__(self, host, config, provider):
-        super(AnonAuthHandler, self).__init__(host, config, provider)
+        AuthHandler.__init__(self, host, config, provider)
+        HmacKeys.__init__(self, host, config, provider, anon=True)
 
     def add_auth(self, http_request, **kwargs):
         pass

boto/connection.py

@@ -543,6 +543,8 @@ def __init__(self, host, aws_access_key_id=None,
             self.http_connection_kwargs['timeout'] = config.getint(
                 'Boto', 'http_socket_timeout', 70)
 
+        is_anonymous_connection = getattr(self, 'anon', False)
+
         if isinstance(provider, Provider):
             # Allow overriding Provider
             self.provider = provider
@@ -552,7 +554,8 @@ def __init__(self, host, aws_access_key_id=None,
                                      aws_access_key_id,
                                      aws_secret_access_key,
                                      security_token,
-                                     profile_name)
+                                     profile_name,
+                                     anon=is_anonymous_connection)
 
         # Allow config file to override default host, port, and host header.
         if self.provider.host:

boto/provider.py

@@ -179,14 +179,15 @@ class Provider(object):
     }
 
     def __init__(self, name, access_key=None, secret_key=None,
-                 security_token=None, profile_name=None):
+                 security_token=None, profile_name=None, anon=False):
         self.host = None
         self.port = None
         self.host_header = None
         self.access_key = access_key
         self.secret_key = secret_key
         self.security_token = security_token
         self.profile_name = profile_name
+        self.anon = anon
         self.name = name
         self.acl_class = self.AclClassMap[self.name]
         self.canned_acls = self.CannedAclsMap[self.name]
@@ -244,6 +245,9 @@ def set_security_token(self, value):
     security_token = property(get_security_token, set_security_token)
 
     def _credentials_need_refresh(self):
+        if self.anon:
+            return False
+
         if self._credential_expiry_time is None:
             return False
         else:
@@ -264,6 +268,9 @@ def _credentials_need_refresh(self):
 
     def get_credentials(self, access_key=None, secret_key=None,
                         security_token=None, profile_name=None):
+        if self.anon:
+            return
+
         access_key_name, secret_key_name, security_token_name, \
             profile_name_name = self.CredentialMap[self.name]
 

boto/s3/connection.py

@@ -171,20 +171,31 @@ def __init__(self, aws_access_key_id=None, aws_secret_access_key=None,
                  host=NoHostProvided, debug=0, https_connection_factory=None,
                  calling_format=DefaultCallingFormat, path='/',
                  provider='aws', bucket_class=Bucket, security_token=None,
-                 suppress_consec_slashes=True, anon=False,
+                 suppress_consec_slashes=True, anon=None,
                  validate_certs=None, profile_name=None):
+        self.bucket_class = bucket_class
+
+        if isinstance(calling_format, six.string_types):
+            calling_format=boto.utils.find_class(calling_format)()
+        self.calling_format = calling_format
+
+        # Fetching config options at init time, instead of using a class-level
+        # default (set at class declaration time) as the default arg value,
+        # allows our tests to ensure that the config file options are
+        # respected.
+        if anon is None:
+            # Only fetch from the config option if a non-default arg value was
+            # provided.
+            anon = boto.config.getbool('s3', 'no_sign_request', False)
+        self.anon = anon
+
         no_host_provided = False
-        # Try falling back to the boto config file's value, if present.
         if host is NoHostProvided:
             host = boto.config.get('s3', 'host')
             if host is None:
                 host = self.DefaultHost
                 no_host_provided = True
-        if isinstance(calling_format, six.string_types):
-            calling_format=boto.utils.find_class(calling_format)()
-        self.calling_format = calling_format
-        self.bucket_class = bucket_class
-        self.anon = anon
+
         super(S3Connection, self).__init__(host,
                 aws_access_key_id, aws_secret_access_key,
                 is_secure, port, proxy, proxy_port, proxy_user, proxy_pass,

tests/unit/s3/test_connection.py

@@ -59,6 +59,41 @@ def test_generate_url(self):
         url = conn.generate_url(0, 'GET', bucket='examplebucket', key='test.txt')
         self.assertNotIn('Signature=', url)
 
+    def test_anon_default_taken_from_config_opt(self):
+        self.config = {
+            's3': {
+                # Value must be a string for `config.getbool` to not crash.
+                'no_sign_request': 'True',
+            }
+        }
+
+        conn = self.connection_class(
+            aws_access_key_id='less',
+            aws_secret_access_key='more',
+            host='s3.amazonaws.com',
+        )
+        url = conn.generate_url(
+            0, 'GET', bucket='examplebucket', key='test.txt')
+        self.assertNotIn('Signature=', url)
+
+    def test_explicit_anon_arg_overrides_config_value(self):
+        self.config = {
+            's3': {
+                # Value must be a string for `config.getbool` to not crash.
+                'no_sign_request': 'True',
+            }
+        }
+
+        conn = self.connection_class(
+            aws_access_key_id='less',
+            aws_secret_access_key='more',
+            host='s3.amazonaws.com',
+            anon=False
+        )
+        url = conn.generate_url(
+            0, 'GET', bucket='examplebucket', key='test.txt')
+        self.assertIn('Signature=', url)
+
 
 class TestPresigned(MockServiceWithConfigTestCase):
     connection_class = S3Connection