File: //lib/python3/dist-packages/awscli/customizations/cloudtrail/__pycache__/validation.cpython-38.pyc
U
<�^М � @ s� d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dl
m
Z
m Z d dl m
Z
mZ d dlmZ d dlZd dlmZmZ d dlmZ d dlmZ d d lmZ e�e �Z d
Z d Z d d
� Z dd� Z!dd� Z"dd� Z#dd� Z$dd� Z%d,dd�Z&G dd� de'�Z(G d d � d e)�Z*G d d � d e*�Z+G d d!� d!e*�Z,G d"d#� d#e'�Z-G d$d%� d%e'�Z.G d&d'� d'e'�Z/G d(d)� d)e'�Z0G d*d+� d+e�Z1dS )-� N)�error)�datetime� timedelta)�tz�parser)� PyAsn1Error)�get_trail_by_arn�get_account_id_from_arn)� BasicCommand)� ClientError)�ParameterRequiredErrorz%Y%m%dT%H%M%SZz%Y-%m-%dT%H:%M:%SZc C s
| � t�S )z;Returns a formatted date string in a CloudTrail date format)�strftime� DATE_FORMAT��date� r �M/usr/lib/python3/dist-packages/awscli/customizations/cloudtrail/validation.py� format_date( s r c C s
| � t�S )z4Returns a formatted date string meant for CLI output)r
�DISPLAY_DATE_FORMATr r r r �format_display_date- s r c C s | j t�� d�S )z.Returns a normalized date using a UTC timezone)Ztzinfo)�replacer Ztzutcr r r r �normalize_date2 s r c C s | dd� S )z�Extract the timestamp portion of a manifest file.
Manifest file names take the following form:
AWSLogs/{account}/CloudTrail-Digest/{region}/{ymd}/{account}_CloudTrail -Digest_{region}_{name}_region_{date}.json.gz
i��i����r )Z
digest_s3_keyr r r �extract_digest_key_date7 s r c C s2 z t �| �W S tk
r, td| ��Y nX d S )Nz Unable to parse date value: %s)r �parse�
ValueError)Z date_stringr r r �
parse_dateA s r c C s$ t �d�}|�| �s td| ��dS )zlEnsures that the arn looks correct.
ARNs look like: arn:aws:cloudtrail:us-east-1:123456789012:trail/fooz$arn:.+:cloudtrail:.+:\d{12}:trail/.+z Invalid trail ARN provided: %sN)�re�compile�matchr )� trail_arn�patternr r r � assert_cloudtrail_arn_is_validH s
r! c C s� t |� d} |dkrft| |�} t�d| � | d }| �dd�} | d }
|
rf|
sVtd��|�� d d } |�d �d
}|�d �d }|
s�t|�}
t |
||||| d
�}t
||| |||t | �d�S )a� Creates a CloudTrail DigestTraverser and its object graph.
:type cloudtrail_client: botocore.client.CloudTrail
:param cloudtrail_client: Client used to connect to CloudTrail
:type organization_client: botocore.client.organizations
:param organization_client: Client used to connect to Organizations
:type s3_client_provider: S3ClientProvider
:param s3_client_provider: Used to create Amazon S3 client per/region.
:param trail_arn: CloudTrail trail ARN
:param trail_source_region: The scanned region of a trail.
:param on_invalid: Callback that is invoked when validating a digest fails.
:param on_gap: Callback that is invoked when a digest has no link to the
previous digest, but there are more digests to validate. This can
happen when a trail is disabled for a period of time.
:param on_missing: Callback that is invoked when a digest file has been
deleted from Amazon S3 but is supposed to be present.
:param bucket: Amazon S3 bucket of the trail if it is different than the
bucket that is currently associated with the trail.
:param prefix: bucket: Key prefix prepended to each digest and log placed
in the Amazon S3 bucket if it is different than the prefix that is
currently associated with the trail.
:param account_id: The account id for which the digest files are
validated. For normal trails this is the caller account, for
organization trails it is the member accout.
``on_gap``, ``on_invalid``, and ``on_missing`` callbacks are invoked with
the following named arguments:
- ``bucket`: The next S3 bucket.
- ``next_key``: (optional) Next digest key that was found in the bucket.
- ``next_end_date``: (optional) End date of the next found digest.
- ``last_key``: The last digest key that was found.
- ``last_start_date``: (optional) Start date of last found digest.
- ``message``: (optional) Message string about the notification.
NzLoaded trail info: %sZ S3BucketNameZ S3KeyPrefixZIsOrganizationTrailzAMissing required parameter for organization trail: '--account-id'Z OrganizationZId�:� �/���)�
account_id�
trail_name�s3_client_provider�trail_source_region�trail_home_region�organization_id)�digest_provider�starting_bucket�starting_prefix�
on_invalid�on_gap�
on_missing�public_key_provider) r! r �LOG�debug�getr Zdescribe_organization�splitr �DigestProvider�DigestTraverser�PublicKeyProvider)�cloudtrail_client�organization_clientr( r r) r/ r0 r1 �bucket�prefixr& r+ Z
trail_infoZ is_org_trailZ trail_regionr' r, r r r �create_digest_traverserQ sN (
��� � �r> c @ s2 e Zd ZdZd dd�Zdd� Zdd� Zd d
� Zd S )
�S3ClientProviderz�Creates Amazon S3 clients and determines the region name of a client.
This class will cache the location constraints of previously requested
buckets and cache previously created clients for the same region.
� us-east-1c C s || _ || _i | _i | _d S �N)�_session�_get_bucket_location_region�
_client_cache�
_region_cache)�self�sessionZget_bucket_location_regionr r r �__init__� s zS3ClientProvider.__init__c C s | � |�}| �|�S )z=Creates an S3 client that can work with the given bucket name)�_get_bucket_region�_create_client)rF � bucket_name� region_namer r r �
get_client� s
zS3ClientProvider.get_clientc C sB || j kr8| �| j�}|j|d�}|d p,d}|| j |< | j | S )z Returns the region of a bucket)�BucketZLocationConstraintr@ )rE rJ rC Zget_bucket_location)rF rK �client�result�regionr r r rI � s
z#S3ClientProvider._get_bucket_regionc C s, || j kr"| j�d|�}|| j |< | j | S )z5Creates an Amazon S3 client for the given region nameZs3)rD rB �
create_client)rF rL rO r r r rJ � s
z S3ClientProvider._create_clientN)r@ )�__name__�
__module__� __qualname__�__doc__rH rM rI rJ r r r r r? � s
r? c @ s e Zd ZdZdS )� DigestErrorz0Exception raised when a digest fails to validateN)rS rT rU rV r r r r rW � s rW c s e Zd ZdZ� fdd�Z� ZS )�DigestSignatureErrorz3Exception raised when a digest signature is invalidc s d||f }t t| ��|� d S )Nz=Digest file s3://%s/%s INVALID: signature verification failed)�superrX rH �rF r< �key�message�� __class__r r rH � s �z DigestSignatureError.__init__�rS rT rU rV rH �
__classcell__r r r] r rX � s rX c s e Zd ZdZ� fdd�Z� ZS )�InvalidDigestFormatz4Exception raised when a digest has an invalid formatc s d||f }t t| ��|� d S )Nz.Digest file s3://%s/%s INVALID: invalid format)rY ra rH rZ r] r r rH � s �z InvalidDigestFormat.__init__r_ r r r] r ra � s ra c @ s e Zd ZdZdd� Zdd� ZdS )r9 z:Retrieves public keys from CloudTrail within a date range.c C s
|| _ d S rA )�_cloudtrail_client)rF r: r r r rH � s zPublicKeyProvider.__init__c C s6 | j j||d�}|d }t�d|� tdd� |D ��S )a� Loads public keys in a date range into a returned dict.
:type start_date: datetime
:param start_date: Start date of a date range.
:type end_date: datetime
:param end_date: End date of a date range.
:rtype: dict
:return: Returns a dict where each key is the fingerprint of the
public key, and each value is a dict of public key data.
)Z StartTimeZEndTimeZ
PublicKeyListz Loaded public keys in range: %sc s s | ]}|d |fV qdS )Z FingerprintNr )�.0r[ r r r � <genexpr>� s z4PublicKeyProvider.get_public_keys.<locals>.<genexpr>)rb Zlist_public_keysr3 r4 �dict)rF �
start_date�end_date� public_keysZpublic_keys_in_ranger r r �get_public_keys� s � z!PublicKeyProvider.get_public_keysN)rS rT rU rV rH ri r r r r r9 � s r9 c @ s: e Zd ZdZd
dd�Zdd� Zdd� Zd d
� Zd d � ZdS )r7 a5
Retrieves digest keys and digests from Amazon S3.
This class is responsible for determining the full list of digest files
in a bucket and loading digests from the bucket into a JSON decoded
dict. This class is not responsible for validation or iterating from
one digest to the next.
Nc C s, || _ || _|| _|| _|p || _|| _d S rA )�_client_providerr' r& r* r) r+ )rF r( r& r' r* r) r+ r r r rH � s
zDigestProvider.__init__c C s� g }| � ||�}| j�|�}|�d�}|j||d�} | �d�}
tt|��} tt|tdd� ��} t �
| � |��}
|
D ]4}|
� |�rtt
|�}|| kr� q�|| krt|�|� qt|S )a� Returns a list of digest keys in the date range.
This method uses a list_objects API call and provides a Marker
parameter that is calculated based on the start_date provided.
Amazon S3 then returns all keys in the bucket that start after
the given key (non-inclusive). We then iterate over the keys
until the date extracted from the yielded keys is greater than
the given end_date.
Z list_objects)rN ZMarkerzContents[*].Key� )Zhours)�_create_digest_keyrj rM Z
get_paginatorZpaginate�searchr r r r r �_create_digest_key_regexr r �append)rF r< r= rf rg �digestsZmarkerrO Z paginatorZ
page_iteratorZ
key_filterZtarget_start_dateZtarget_end_dateZdigest_key_regexr[ Zextracted_dater r r �load_digest_keys_in_range s&
�
z(DigestProvider.load_digest_keys_in_rangec C s� | j �|�}|j||d�}z,t�|d �� tjdB �}t�|� � �}W n" t
t fk
rh t ||��Y nX d|d ks�d|d kr�t
||��|d d |d< |d d |d< ||fS ) zlLoads a digest by key from S3.
Returns the JSON decode data and GZIP inflated raw content.
�rN ZKey�Body� Z signatureZMetadatazsignature-algorithm�
_signatureZ_signature_algorithm)rj rM �
get_object�zlib�
decompress�read� MAX_WBITS�json�loads�decoder � ZLibErrorra rX )rF r< r[ rO rP �digest� digest_datar r r � fetch_digest# s" �
�
�zDigestProvider.fetch_digestc C sv |t dd� }d}| jt|�|�d�| j| j| jd�}| jrN|d7 }| j|d< |d7 }|jf |�}|rr|d | }|S )
a~ Computes an Amazon S3 key based on the provided data.
The computed is what would have been placed in the S3 bucket if
a log digest were created at a specific time. This computed key
does not have to actually exist as it will only be used to as
a Marker parameter in a list_objects call.
:return: Returns a computed key as a string.
rk )Zminutes�AWSLogs/z%Y/%m/%d)r& r Zymd�
source_region� home_region�name�{organization_id}/r+ z�{account_id}/CloudTrail-Digest/{source_region}/{ymd}/{account_id}_CloudTrail-Digest_{source_region}_{name}_{home_region}_{date}.json.gzr$ ) r r& r r
r) r* r' r+ �format)rF rf �
key_prefixr �template�template_paramsr[ r r r rl : s& �
� z!DigestProvider._create_digest_keyc C s� d}t �| j�t �| j�t �| j�t �| j�d�}| jrJ|d7 }| j|d< |d7 }|jf |�}|rtt �|�d | }d| d S ) z:Creates a regular expression used to match against S3 keysr� )r& r� r� r� r� r+ z�{account_id}/CloudTrail\-Digest/{source_region}/\d+/\d+/\d+/{account_id}_CloudTrail\-Digest_{source_region}_{name}_{home_region}_.+\.json\.gzr$ �^�$)r �escaper& r) r* r' r+ r� )rF r� r� r� r[ r r r rn \ s
�
� z'DigestProvider._create_digest_key_regex)NN) rS rT rU rV rH rq r� rl rn r r r r r7 � s �
""r7 c @ s` e Zd ZdZddddddgZdd d
�Zdd d �Zd
d� Zddd�Zddd�Z dd� Z
dd� Z dS ) r8 z4Retrieves and validates digests within a date range.�digestPublicKeyFingerprint�digestS3Bucket�digestS3Object�previousDigestSignature�
digestEndTime�digestStartTimeNc C sB || _ || _|| _|| _|| _|| _|| _|dkr8t� }|| _dS )a�
:type digest_provider: DigestProvider
:param digest_provider: DigestProvider object
:param starting_bucket: S3 bucket where the digests are stored.
:param starting_prefix: An optional prefix applied to each S3 key.
:param public_key_provider: Provides public keys for a range.
:param digest_validator: Validates digest using a validate method.
:param on_invalid: Callback invoked when a digest is invalid.
:param on_gap: Callback invoked when a digest has no parent, but
there are still more digests to validate.
:param on_missing: Callback invoked when a digest file is missing.
N) r- r. r, �_public_key_provider�_on_gap� _on_invalid� _on_missing�Sha256RSADigestValidator�_digest_validator) rF r, r- r. r2 Zdigest_validatorr/ r0 r1 r r r rH { s zDigestTraverser.__init__c c s� |dkrt �� }t|�}t|�}| j}| j}| �||||�}| �||�}| �|�\}}|}|�r�||k�r�z�| �|||�\} }tt | d ��}| �
dd�}
| V |
dkr�| j ||||| j dd�\}}n$| d }|
|kr�|
}| �||||�}W qZ t
k
�rH } z<| jd d d k�r| �| j ||||| jt| �d
�\}}W 5 d} ~ X Y qZ tk
�r� } z$| j ||||| jt| �d
�\}}W 5 d} ~ X Y qZ tk
�r� } z.| j ||||| jd ||t| �f d
�\}}W 5 d} ~ X Y qZX qZdS ) aa Creates and returns a generator that yields validated digest data.
Each yielded digest dictionary contains information about the digest
and the log file associated with the digest. Digest files are validated
before they are yielded. Whether or not the digest is successfully
validated is stated in the "isValid" key value pair of the yielded
dictionary.
:type start_date: datetime
:param start_date: Date to start validating from (inclusive).
:type start_date: datetime
:param end_date: Date to stop validating at (inclusive).
Nr� ZpreviousDigestS3BucketT)rp r< �last_key�last_start_date�cb�is_cb_conditionalZpreviousDigestS3Object�Error�Code� NoSuchKey)rp r< r� r� r� r\ z"Digest file s3://%s/%s INVALID: %s)r �utcnowr r- r. �
_load_digests�_load_public_keys�_get_last_digest�_load_and_validate_digestr r5 �_find_next_digestr� r �responser� �strrW r� � Exception) rF rf rg r< r= rp rh r[ r� r Zprevious_bucket�er r r �traverse� s� �
� � � � � ��zDigestTraverser.traversec C s | j j||||d�S )N)r< r= rf rg )r, rq )rF r< r= rf rg r r r r� � s �z DigestTraverser._load_digestsFc
C s8 | � ||�\}} |r0|r |r0||||| ||d� || fS )z=Finds the next digest in the bucket and invokes any callback.)r< �next_keyr� �
next_end_dater� r\ )r� )
rF rp r< r� r� r� r� r\ r� r� r r r r� � s �z!DigestTraverser._find_next_digestc C sz |sdS |dkr0|� � }ttt|���}||fS tt|��}|rv|� � }ttt|���}||k r<t�d|� ||fS q<dS )z�Finds the previous digest key (either the last or before before_key)
If no key is provided, the last digest is used. If a digest is found,
the end date of the provider is adjusted to match the found key's end
date.
)NNNzNext found key: %s)�popr r r r3 r4 )rF rp Z
before_keyr� Z
next_key_dateZbefore_key_dater r r r� � s$
�
�
z DigestTraverser._get_last_digestc
C s� | j �||�\}}| jD ]}||krt||��q|d |ksH|d |krXtd||f ��|d }||kr�td||| j j|f ��|| d }| j�|||||� tt |d ��} || fS )z�Loads and validates a digest from S3.
:param public_keys: Public key dictionary of fingerprint to dict.
:return: Returns a tuple of the digest data as a dict and end_date
:rtype: tuple
r� r� zIDigest file s3://%s/%s INVALID: has been moved from its original locationr� zTDigest file s3://%s/%s INVALID: public key not found in region %s for fingerprint %sZValuer� )
r, r� �required_digest_keysra rW r* r� �validater r )
rF rh r< r[ r� r Z required_keyZ fingerprintZpublic_key_hexrg r r r r� � s>
���
��� �z)DigestTraverser._load_and_validate_digestc C s. | j �||�}|s*tdt|�t|�f ��|S )Nz&No public keys found between %s and %s)r� ri � RuntimeErrorr )rF rf rg rh r r r r� s ����z!DigestTraverser._load_public_keys)NNNN)N)NFN)N) rS rT rU rV r� rH r� r� r� r� r� r� r r r r r8 s s* � �
A �
r8 c @ s e Zd ZdZdd� Zdd� ZdS )r� z�
Validates SHA256withRSA signed digests.
The result of validating the digest is inserted into the digest_data
dictionary using the isValid key value pair.
c C s� zFt �|�}tjj|dd�}| �||�}t�|d �}t�|||� W nJ t k
rp t
d|||d f ��Y n" tj j k
r� t
||��Y nX dS )a� Validates a digest file.
Throws a DigestError when the digest is invalid.
:param bucket: Bucket of the digest file
:param key: Key of the digest file
:param public_key: Public key bytes.
:param digest_data: Dict of digest data returned when JSON
decoding a manifest.
:param inflated_digest: Inflated digest file contents as bytes.
ZDER)r� ru zNDigest file s3://%s/%s INVALID: Unable to load PKCS #1 key with fingerprint %sr� N)�base64Z b64decode�rsaZ PublicKeyZ
load_pkcs1�_create_string_to_sign�binasciiZ unhexlify�verifyr rW Zpkcs1ZVerificationErrorrX ) rF r< r[ Z
public_keyr� �inflated_digestZ decoded_keyZto_signZsignature_bytesr r r r� 0 s
��z!Sha256RSADigestValidator.validatec C sP |d }|d krd}d|d |d |d t �|��� |f }t�d|� |�� S )Nr� Znullz%s
%s/%s
%s
%sr� r� r� zDigest string to sign: %s)�hashlib�sha256� hexdigestr3 r4 �encode)rF r� r� Zprevious_signatureZstring_to_signr r r r� N s � z/Sha256RSADigestValidator._create_string_to_signN)rS rT rU rV r� r� r r r r r� ( s r� c s� e Zd ZdZdZdZddddd�d ddd
d�d dd d
�dddd
�dddd
�dddd
�ddddd�gZ� fdd�Zdd � Zd d � Z d d � Z
d!d"� Z d#d$� Z d%d&� Z
d<d(d)�Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Zd8d9� Zd:d;� Z� ZS )=�CloudTrailValidateLogszN
Validates log digests and log files, optionally saving them to disk.
z
validate-logsa�
Validates CloudTrail logs for a given period of time.
This command uses the digest files delivered to your S3 bucket to perform
the validation.
The AWS CLI allows you to detect the following types of changes:
- Modification or deletion of CloudTrail log files.
- Modification or deletion of CloudTrail digest files.
To validate log files with the AWS CLI, the following preconditions must
be met:
- You must have online connectivity to AWS.
- You must have read access to the S3 bucket that contains the digest and
log files.
- The digest and log files must not have been moved from the original S3
location where CloudTrail delivered them.
- For organization trails you must have access to describe-organization to
validate digest files
When you disable Log File Validation, the chain of digest files is broken
after one hour. CloudTrail will not digest log files that were delivered
during a period in which the Log File Validation feature was disabled.
For example, if you enable Log File Validation on January 1, disable it
on January 2, and re-enable it on January 10, digest files will not be
created for the log files delivered from January 3 to January 9. The same
applies whenever you stop CloudTrail logging or delete a trail.
.. note::
Log files that have been downloaded to local disk cannot be validated
with the AWS CLI. The CLI will download all log files each time this
command is executed.
.. note::
This command requires that the role executing the command has
permission to call ListObjects, GetObject, and GetBucketLocation for
each bucket referenced by the trail.
z trail-arnT�stringz.Specifies the ARN of the trail to be validated)r� Zrequired�
cli_type_name� help_textz
start-timez�Specifies that log files delivered on or after the specified UTC timestamp value will be validated. Example: "2015-01-08T05:21:42Z".zend-timez�Optionally specifies that log files delivered on or before the specified UTC timestamp value will be validated. The default value is the current time. Example: "2015-01-08T12:31:41Z".)r� r� r� z s3-bucketz�Optionally specifies the S3 bucket where the digest files are stored. If a bucket name is not specified, the CLI will retrieve it by calling describe_trailsz s3-prefixz�Optionally specifies the optional S3 prefix where the digest files are stored. If not specified, the CLI will determine the prefix automatically by calling describe_trails.z
account-idz�Optionally specifies the account for validating logs. This parameter is needed for organization trails for validating logs for specific account inside an organization�verboseZboolean�
store_truez*Display verbose log validation information)r� r� �actionr� c sz t t| ��|� d | _d| _d | _d | _d | _d | _d | _ d | _
d | _ d | _ d| _
d| _d| _d| _d| _d | _d | _d S )NFr T)rY r� rH r �
is_verbose�
start_time�end_time� s3_bucket� s3_prefixr( r: r& �_source_region�_valid_digests�_invalid_digests� _valid_logs�
_invalid_logs� _is_last_status_double_space�_found_start_time�_found_end_time)rF rG r] r r rH � s$ z CloudTrailValidateLogs.__init__c C s8 | � |� | �|� | �� | jdks0| jdkr4dS dS )Nr rk )� handle_args�setup_services�_callr� r� )rF �args�parsed_globalsr r r � _run_main� s
z CloudTrailValidateLogs._run_mainc C s~ |j | _ |j| _|j| _|j| _|j| _tt|j��| _|j rPtt|j ��| _ ntt
� � �| _ | j| j krrt d��| j| _
d S )NzCInvalid time range specified: start-time must occur before end-time)r r� r� r� r� r& r r r� r� r r� r r� )rF r� r r r r� � s z"CloudTrailValidateLogs.handle_argsc C s^ |j | _t| j| j�| _|j |jd�}| jjd|�| _|jd k rJ|j|d< | jjd|�| _ d S )N)rL r� �
organizations� endpoint_url�
cloudtrail)r� )r� )
rQ r� r? rB r( Z
verify_sslrR r; r� r: )rF r� Z client_argsr r r r� � s( �� ��
��z%CloudTrailValidateLogs.setup_servicesc
C s� t | j| j| j| j| j| j| j| j| j | j
| j d� }| � � |�
| j| j�}|D ]X}| �|� | jd7 _| �d|d |d f � |d s�qP|d D ]}| �|� q�qP| �� d S )N) r r: r; r) r( r< r= r1 r/ r0 r& rk z Digest file s3://%s/%s validr� r� ZlogFiles)r> r r: r; r� r( r� r� �_on_missing_digest�_on_invalid_digest�_on_digest_gapr& �_write_startup_textr� r� r� �_track_found_timesr� �
_write_status�
_download_log�_write_summary_text)rF Z traverserrp r �logr r r r� � s8 �
�� z CloudTrailValidateLogs._callc C s@ t |d �}|| jkr || _| js<t |d �}t|| j�| _d S )Nr� r� )r r� r� r� �minr� )rF r Zdigest_start_timeZdigest_end_timer r r r� s
z)CloudTrailValidateLogs._track_found_timesc
s2 z�| j �|d �}|j|d |d d�� t�tjdB �}t�� }t� fdd�d�D ]}|� |�}|�
|� qR|� � }|r�|�
|� |� � }||d kr�| �
|� n(| jd 7 _| �d
|d |d f � W n` tk
�r } z"| jd d d
kr� | �|� W 5 d} ~ X Y n tk
�r, | �|� Y nX dS )z9 Download a log, decompress, and compare SHA256 checksums�s3Bucket�s3Objectrr rt c s � d � d�S )Nrs i )ry r �r� r r �<lambda> � z6CloudTrailValidateLogs._download_log.<locals>.<lambda>r� Z hashValuerk zLog file s3://%s/%s validr� r� r� N)r( rM rv rw Z
decompressobjrz r� r� �iterrx �update�flushr� �_on_log_invalidr� r� r r� �_on_missing_logr� �_on_invalid_log_format)
rF r� rO Z
gzip_inflaterZ rolling_hash�chunk�dataZremaining_dataZ
computed_hashr� r r� r r� s6 �
�
z$CloudTrailValidateLogs._download_logFc C sT |r4| j r tj�d| � ntj�d| � d| _ n | jrPd| _ tj�d| � d S )Nz%s
z
%s
TFz%s
)r� �sys�stderr�writer� �stdout)rF r\ Zis_errorr r r r� / s z$CloudTrailValidateLogs._write_statusc C s( t j�d| jt| j�t| j�f � d S )Nz5Validating log files for trail %s between %s and %s
)r� r� r� r r r� r� �rF r r r r� : s ���z*CloudTrailValidateLogs._write_startup_textc C s� | j stj�d� tj�dt| j�t| j�f � | jsN| jsNtj�d� d S | j rZ| j
shtj�d� n tj�dt| j �t| j
�f � | � | j| jd� | � | j | j
d� tj�d� d S )N�
z Results requested for %s to %s
zNo digests found
z No valid digests found in range
z Results found for %s to %s:
r r� )r� r� r� r� r r� r� r� r� r� r� � _write_ratior� r� r� r r r r� @ s( �� ��z*CloudTrailValidateLogs._write_summary_textc C sH || }|dkrDt j�d|||f � |dkrDt j�d|||f � d S )Nr z
%d/%d %s files validz, %d/%d %s files INVALID)r� r� r� )rF ZvalidZinvalidr� Ztotalr r r r� S s �z#CloudTrailValidateLogs._write_ratioc K s& | j d7 _ | �d||f d� d S )Nrk z)Digest file s3://%s/%s INVALID: not foundT�r� r� )rF r< r� �kwargsr r r r� [ s ��z)CloudTrailValidateLogs._on_missing_digestc K s( | � dt|d �t|d �f d� d S )Nz;No log files were delivered by CloudTrail between %s and %sr� r� T)r� r )rF r� r r r r� ` s
���z%CloudTrailValidateLogs._on_digest_gapc K s | j d7 _ | �|d� d S )Nrk Tr� )rF r\ r� r r r r� f s z)CloudTrailValidateLogs._on_invalid_digestc C s. | j d7 _ | �d|d |d f d� d S )Nrk z+Log file s3://%s/%s INVALID: invalid formatr� r� T�r� r� �rF Zlog_datar r r r� j s ��z-CloudTrailValidateLogs._on_invalid_log_formatc C s. | j d7 _ | �d|d |d f d� d S )Nrk z5Log file s3://%s/%s INVALID: hash value doesn't matchr� r� Tr� r� r r r r� p s ��z&CloudTrailValidateLogs._on_log_invalidc C s. | j d7 _ | �d|d |d f d� d S )Nrk z&Log file s3://%s/%s INVALID: not foundr� r� Tr� r� r r r r� v s ��z&CloudTrailValidateLogs._on_missing_log)F)rS rT rU rV �NAMEZ DESCRIPTIONZ ARG_TABLErH r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r` r r r] r r� ] sV -��������
r� )NNNNNNN)2r� r� r{ r� Zloggingr r� rw r r~ r r Zdateutilr r Z pyasn1.errorr r� Z&awscli.customizations.cloudtrail.utilsr r Z awscli.customizations.commandsr
Zbotocore.exceptionsr Z
awscli.schemar Z getLoggerrS r3 r r r r r r r r! r> �objectr? r rW rX ra r9 r7 r8 r� r� r r r r �<module>
sX
�
N# 65