/**********************************************************************

 *

 * Name:     cpl_aws.cpp

 * Project:  CPL - Common Portability Library

 * Purpose:  Amazon Web Services routines

 * Author:   Even Rouault <even.rouault at spatialys.com>

 *

 **********************************************************************

 * Copyright (c) 2015, Even Rouault <even.rouault at spatialys.com>

 *

 * SPDX-License-Identifier: MIT

 ****************************************************************************/

//! @cond Doxygen_Suppress

#include "cpl_aws.h"

#include "cpl_json.h"

#include "cpl_vsi_error.h"

#include "cpl_sha1.h"

#include "cpl_sha256.h"

#include "cpl_time.h"

#include "cpl_minixml.h"

#include "cpl_multiproc.h"

#include "cpl_spawn.h"

#include "cpl_http.h"

#include <algorithm>

// #define DEBUG_VERBOSE 1

#ifdef _WIN32

#if defined(HAVE_ATLBASE_H)

bool CPLFetchWindowsProductUUID(

    std::string &osStr);  // defined in cpl_aws_win32.cpp

#endif

const char *CPLGetWineVersion();  // defined in cpl_vsil_win32.cpp

#endif

#ifdef HAVE_CURL

static CPLMutex *ghMutex = nullptr;

static AWSCredentialsSource geCredentialsSource =

    AWSCredentialsSource::UNINITIALIZED;

static std::string gosIAMRole;

static std::string gosGlobalAccessKeyId;

static std::string gosGlobalSecretAccessKey;

static std::string gosGlobalSessionToken;

static GIntBig gnGlobalExpiration = 0;

static std::string gosRegion;

// The below variables are used for credentials retrieved through a STS

// AssumedRole operation

static std::string gosRoleArn;

static std::string gosExternalId;

static std::string gosMFASerial;

static std::string gosRoleSessionName;

static std::string gosSourceProfileAccessKeyId;

static std::string gosSourceProfileSecretAccessKey;

static std::string gosSourceProfileSessionToken;

// The below variables are used for web identity settings in aws/config

static std::string gosRoleArnWebIdentity;

static std::string gosWebIdentityTokenFile;

// The below variables are used for SSO authentication

static std::string gosSSOStartURL;

static std::string gosSSOAccountID;

static std::string gosSSORoleName;

// The below variable is used to store the credential_process command to skip

// re-reading the config file on subsequent credential requests

static std::string gosCredentialProcessCommand;

constexpr const char *AWS_DEBUG_KEY = "AWS";

/************************************************************************/

/*                         CPLGetLowerCaseHex()                         */

/************************************************************************/

static std::string CPLGetLowerCaseHex(const GByte *pabyData, size_t nBytes)

{

    std::string osRet;

    osRet.resize(nBytes * 2);

    constexpr char achHex[] = "0123456789abcdef";

    for (size_t i = 0; i < nBytes; ++i)

    {

        const int nLow = pabyData[i] & 0x0f;

        const int nHigh = (pabyData[i] & 0xf0) >> 4;

        osRet[i * 2] = achHex[nHigh];

        osRet[i * 2 + 1] = achHex[nLow];

    }

    return osRet;

}

/************************************************************************/

/*                       CPLGetLowerCaseHexSHA256()                     */

/************************************************************************/

std::string CPLGetLowerCaseHexSHA256(const void *pabyData, size_t nBytes)

{

    GByte hash[CPL_SHA256_HASH_SIZE] = {};

    CPL_SHA256(static_cast<const GByte *>(pabyData), nBytes, hash);

    return CPLGetLowerCaseHex(hash, CPL_SHA256_HASH_SIZE);

}

/************************************************************************/

/*                       CPLGetLowerCaseHexSHA256()                     */

/************************************************************************/

std::string CPLGetLowerCaseHexSHA256(const std::string &osStr)

{

    return CPLGetLowerCaseHexSHA256(osStr.c_str(), osStr.size());

}

/************************************************************************/

/*                       CPLAWSURLEncode()                              */

/************************************************************************/

std::string CPLAWSURLEncode(const std::string &osURL, bool bEncodeSlash)

{

    std::string osRet;

    for (size_t i = 0; i < osURL.size(); i++)

    {

        char ch = osURL[i];

        if ((ch >= 'A' && ch <= 'Z') || (ch >= 'a' && ch <= 'z') ||

            (ch >= '0' && ch <= '9') || ch == '_' || ch == '-' || ch == '~' ||

            ch == '.')

        {

            osRet += ch;

        }

        else if (ch == '/')

        {

            if (bEncodeSlash)

                osRet += "%2F";

            else

                osRet += ch;

        }

        else

        {

            osRet += CPLSPrintf("%%%02X", static_cast<unsigned char>(ch));

        }

    }

    return osRet;

}

/************************************************************************/

/*                         CPLAWSGetHeaderVal()                         */

/************************************************************************/

std::string CPLAWSGetHeaderVal(const struct curl_slist *psExistingHeaders,

                               const char *pszKey)

{

    std::string osKey(pszKey);

    osKey += ":";

    const struct curl_slist *psIter = psExistingHeaders;

    for (; psIter != nullptr; psIter = psIter->next)

    {

        if (STARTS_WITH(psIter->data, osKey.c_str()))

            return CPLString(psIter->data + osKey.size()).Trim();

    }

    return std::string();

}

/************************************************************************/

/*                 CPLGetAWS_SIGN4_Signature()                          */

/************************************************************************/

// See:

// http://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html

static std::string CPLGetAWS_SIGN4_Signature(

    const std::string &osSecretAccessKey, const std::string &osRegion,

    const std::string &osService, const std::string &osVerb,

    struct curl_slist *&psHeaders, const std::string &osHost,

    const std::string &osCanonicalURI,

    const std::string &osCanonicalQueryString,

    const std::string &osXAMZContentSHA256, bool bAddHeaderAMZContentSHA256,

    const std::string &osTimestamp, std::string &osSignedHeaders)

{

    /* -------------------------------------------------------------------- */

    /*      Compute canonical request string.                               */

    /* -------------------------------------------------------------------- */

    std::string osCanonicalRequest = osVerb + "\n";

    osCanonicalRequest += osCanonicalURI + "\n";

    osCanonicalRequest += osCanonicalQueryString + "\n";

    std::map<std::string, std::string> oSortedMapHeaders;

    oSortedMapHeaders["host"] = osHost;

    if (osXAMZContentSHA256 != "UNSIGNED-PAYLOAD" && bAddHeaderAMZContentSHA256)

    {

        oSortedMapHeaders["x-amz-content-sha256"] = osXAMZContentSHA256;

        oSortedMapHeaders["x-amz-date"] = osTimestamp;

    }

    std::string osCanonicalizedHeaders(

        IVSIS3LikeHandleHelper::BuildCanonicalizedHeaders(oSortedMapHeaders,

                                                          psHeaders, "x-amz-"));

    osCanonicalRequest += osCanonicalizedHeaders + "\n";

    osSignedHeaders.clear();

    std::map<std::string, std::string>::const_iterator oIter =

        oSortedMapHeaders.begin();

    for (; oIter != oSortedMapHeaders.end(); ++oIter)

    {

        if (!osSignedHeaders.empty())

            osSignedHeaders += ";";

        osSignedHeaders += oIter->first;

    }

    osCanonicalRequest += osSignedHeaders + "\n";

    osCanonicalRequest += osXAMZContentSHA256;

#ifdef DEBUG_VERBOSE

    CPLDebug(AWS_DEBUG_KEY, "osCanonicalRequest='%s'",

             osCanonicalRequest.c_str());

#endif

    /* -------------------------------------------------------------------- */

    /*      Compute StringToSign .                                          */

    /* -------------------------------------------------------------------- */

    std::string osStringToSign = "AWS4-HMAC-SHA256\n";

    osStringToSign += osTimestamp + "\n";

    std::string osYYMMDD(osTimestamp);

    osYYMMDD.resize(8);

    std::string osScope = osYYMMDD + "/";

    osScope += osRegion;

    osScope += "/";

    osScope += osService;

    osScope += "/aws4_request";

    osStringToSign += osScope + "\n";

    osStringToSign += CPLGetLowerCaseHexSHA256(osCanonicalRequest);

#ifdef DEBUG_VERBOSE

    CPLDebug(AWS_DEBUG_KEY, "osStringToSign='%s'", osStringToSign.c_str());

#endif

    /* -------------------------------------------------------------------- */

    /*      Compute signing key.                                            */

    /* -------------------------------------------------------------------- */

    GByte abySigningKeyIn[CPL_SHA256_HASH_SIZE] = {};

    GByte abySigningKeyOut[CPL_SHA256_HASH_SIZE] = {};

    std::string osFirstKey(std::string("AWS4") + osSecretAccessKey);

    CPL_HMAC_SHA256(osFirstKey.c_str(), osFirstKey.size(), osYYMMDD.c_str(),

                    osYYMMDD.size(), abySigningKeyOut);

    memcpy(abySigningKeyIn, abySigningKeyOut, CPL_SHA256_HASH_SIZE);

    CPL_HMAC_SHA256(abySigningKeyIn, CPL_SHA256_HASH_SIZE, osRegion.c_str(),

                    osRegion.size(), abySigningKeyOut);

    memcpy(abySigningKeyIn, abySigningKeyOut, CPL_SHA256_HASH_SIZE);

    CPL_HMAC_SHA256(abySigningKeyIn, CPL_SHA256_HASH_SIZE, osService.c_str(),

                    osService.size(), abySigningKeyOut);

    memcpy(abySigningKeyIn, abySigningKeyOut, CPL_SHA256_HASH_SIZE);

    CPL_HMAC_SHA256(abySigningKeyIn, CPL_SHA256_HASH_SIZE, "aws4_request",

                    strlen("aws4_request"), abySigningKeyOut);

    memcpy(abySigningKeyIn, abySigningKeyOut, CPL_SHA256_HASH_SIZE);

#ifdef DEBUG_VERBOSE

    std::string osSigningKey(

        CPLGetLowerCaseHex(abySigningKeyIn, CPL_SHA256_HASH_SIZE));

    CPLDebug(AWS_DEBUG_KEY, "osSigningKey='%s'", osSigningKey.c_str());

#endif

    /* -------------------------------------------------------------------- */

    /*      Compute signature.                                              */

    /* -------------------------------------------------------------------- */

    GByte abySignature[CPL_SHA256_HASH_SIZE] = {};

    CPL_HMAC_SHA256(abySigningKeyIn, CPL_SHA256_HASH_SIZE,

                    osStringToSign.c_str(), osStringToSign.size(),

                    abySignature);

    std::string osSignature(

        CPLGetLowerCaseHex(abySignature, CPL_SHA256_HASH_SIZE));

#ifdef DEBUG_VERBOSE

    CPLDebug(AWS_DEBUG_KEY, "osSignature='%s'", osSignature.c_str());

#endif

    psHeaders = curl_slist_append(

        psHeaders, CPLSPrintf("x-amz-date: %s", osTimestamp.c_str()));

    psHeaders =

        curl_slist_append(psHeaders, CPLSPrintf("x-amz-content-sha256: %s",

                                                osXAMZContentSHA256.c_str()));

    return osSignature;

}

/************************************************************************/

/*                CPLGetAWS_SIGN4_Authorization()                       */

/************************************************************************/

static std::string CPLGetAWS_SIGN4_Authorization(

    const std::string &osSecretAccessKey, const std::string &osAccessKeyId,

    const std::string &osRegion, const std::string &osService,

    const std::string &osVerb, struct curl_slist *&psHeaders,

    const std::string &osHost, const std::string &osCanonicalURI,

    const std::string &osCanonicalQueryString,

    const std::string &osXAMZContentSHA256, bool bAddHeaderAMZContentSHA256,

    const std::string &osTimestamp)

{

    std::string osSignedHeaders;

    std::string osSignature(CPLGetAWS_SIGN4_Signature(

        osSecretAccessKey, osRegion, osService, osVerb, psHeaders, osHost,

        osCanonicalURI, osCanonicalQueryString, osXAMZContentSHA256,

        bAddHeaderAMZContentSHA256, osTimestamp, osSignedHeaders));

    std::string osYYMMDD(osTimestamp);

    osYYMMDD.resize(8);

    /* -------------------------------------------------------------------- */

    /*      Build authorization header.                                     */

    /* -------------------------------------------------------------------- */

    std::string osAuthorization;

    osAuthorization = "AWS4-HMAC-SHA256 Credential=";

    osAuthorization += osAccessKeyId;

    osAuthorization += "/";

    osAuthorization += osYYMMDD;

    osAuthorization += "/";

    osAuthorization += osRegion;

    osAuthorization += "/";

    osAuthorization += osService;

    osAuthorization += "/";

    osAuthorization += "aws4_request";

    osAuthorization += ",";

    osAuthorization += "SignedHeaders=";

    osAuthorization += osSignedHeaders;

    osAuthorization += ",";

    osAuthorization += "Signature=";

    osAuthorization += osSignature;

#ifdef DEBUG_VERBOSE

    CPLDebug(AWS_DEBUG_KEY, "osAuthorization='%s'", osAuthorization.c_str());

#endif

    return osAuthorization;

}

/************************************************************************/

/*                        CPLGetAWS_SIGN4_Timestamp()                   */

/************************************************************************/

std::string CPLGetAWS_SIGN4_Timestamp(GIntBig timestamp)

{

    struct tm brokenDown;

    CPLUnixTimeToYMDHMS(timestamp, &brokenDown);

    char szTimeStamp[80] = {};

    snprintf(szTimeStamp, sizeof(szTimeStamp), "%04d%02d%02dT%02d%02d%02dZ",

             brokenDown.tm_year + 1900, brokenDown.tm_mon + 1,

             brokenDown.tm_mday, brokenDown.tm_hour, brokenDown.tm_min,

             brokenDown.tm_sec);

    return szTimeStamp;

}

/************************************************************************/

/*                         VSIS3HandleHelper()                          */

/************************************************************************/

VSIS3HandleHelper::VSIS3HandleHelper(

    const std::string &osService, const std::string &osSecretAccessKey,

    const std::string &osAccessKeyId, const std::string &osSessionToken,

    const std::string &osS3SessionToken, const std::string &osEndpoint,

    const std::string &osRegion, const std::string &osRequestPayer,

    const std::string &osBucket, const std::string &osObjectKey, bool bUseHTTPS,

    bool bUseVirtualHosting, AWSCredentialsSource eCredentialsSource,

    bool bIsDirectoryBucket)

    : m_osURL(BuildURL(osEndpoint, osBucket, osObjectKey, bUseHTTPS,

                       bUseVirtualHosting)),

      m_osService(osService), m_osSecretAccessKey(osSecretAccessKey),

      m_osAccessKeyId(osAccessKeyId), m_osSessionToken(osSessionToken),

      m_osS3SessionToken(osS3SessionToken), m_osEndpoint(osEndpoint),

      m_osRegion(osRegion), m_osRequestPayer(osRequestPayer),

      m_osBucket(osBucket), m_osObjectKey(osObjectKey), m_bUseHTTPS(bUseHTTPS),

      m_bUseVirtualHosting(bUseVirtualHosting),

      m_bIsDirectoryBucket(bIsDirectoryBucket),

      m_eCredentialsSource(eCredentialsSource)

{

    VSIS3UpdateParams::UpdateHandleFromMap(this);

}

/************************************************************************/

/*                        ~VSIS3HandleHelper()                          */

/************************************************************************/

VSIS3HandleHelper::~VSIS3HandleHelper()

{

    for (size_t i = 0; i < m_osSecretAccessKey.size(); i++)

        m_osSecretAccessKey[i] = 0;

}

/************************************************************************/

/*                           BuildURL()                                 */

/************************************************************************/

std::string VSIS3HandleHelper::BuildURL(const std::string &osEndpoint,

                                        const std::string &osBucket,

                                        const std::string &osObjectKey,

                                        bool bUseHTTPS, bool bUseVirtualHosting)

{

    const char *pszProtocol = (bUseHTTPS) ? "https" : "http";

    if (osBucket.empty())

        return CPLSPrintf("%s://%s", pszProtocol, osEndpoint.c_str());

    else if (bUseVirtualHosting)

        return CPLSPrintf("%s://%s.%s/%s", pszProtocol, osBucket.c_str(),

                          osEndpoint.c_str(),

                          CPLAWSURLEncode(osObjectKey, false).c_str());

    else

        return CPLSPrintf("%s://%s/%s/%s", pszProtocol, osEndpoint.c_str(),

                          osBucket.c_str(),

                          CPLAWSURLEncode(osObjectKey, false).c_str());

}

/************************************************************************/

/*                           RebuildURL()                               */

/************************************************************************/

void VSIS3HandleHelper::RebuildURL()

{

    m_osURL = BuildURL(m_osEndpoint, m_osBucket, m_osObjectKey, m_bUseHTTPS,

                       m_bUseVirtualHosting);

    m_osURL += GetQueryString(false);

}

IVSIS3LikeHandleHelper::IVSIS3LikeHandleHelper() = default;

IVSIS3LikeHandleHelper::~IVSIS3LikeHandleHelper() = default;

/************************************************************************/

/*                        GetBucketAndObjectKey()                       */

/************************************************************************/

bool IVSIS3LikeHandleHelper::GetBucketAndObjectKey(const char *pszURI,

                                                   const char *pszFSPrefix,

                                                   bool bAllowNoObject,

                                                   std::string &osBucket,

                                                   std::string &osObjectKey)

{

    osBucket = pszURI;

    if (osBucket.empty())

    {

        return false;

    }

    size_t nPos = osBucket.find('/');

    if (nPos == std::string::npos)

    {

        if (bAllowNoObject)

        {

            osObjectKey = "";

            return true;

        }

        CPLError(CE_Failure, CPLE_AppDefined,

                 "Filename should be of the form %sbucket/key", pszFSPrefix);

        return false;

    }

    osBucket.resize(nPos);

    osObjectKey = pszURI + nPos + 1;

    return true;

}

/************************************************************************/

/*                      BuildCanonicalizedHeaders()                    */

/************************************************************************/

std::string IVSIS3LikeHandleHelper::BuildCanonicalizedHeaders(

    std::map<std::string, std::string> &oSortedMapHeaders,

    const struct curl_slist *psExistingHeaders, const char *pszHeaderPrefix)

{

    const struct curl_slist *psIter = psExistingHeaders;

    for (; psIter != nullptr; psIter = psIter->next)

    {

        if (STARTS_WITH_CI(psIter->data, pszHeaderPrefix) ||

            STARTS_WITH_CI(psIter->data, "Content-MD5"))

        {

            const char *pszColumn = strstr(psIter->data, ":");

            if (pszColumn)

            {

                CPLString osKey(psIter->data);

                osKey.resize(pszColumn - psIter->data);

                oSortedMapHeaders[osKey.tolower()] =

                    CPLString(pszColumn + strlen(":")).Trim();

            }

        }

    }

    std::string osCanonicalizedHeaders;

    std::map<std::string, std::string>::const_iterator oIter =

        oSortedMapHeaders.begin();

    for (; oIter != oSortedMapHeaders.end(); ++oIter)

    {

        osCanonicalizedHeaders += oIter->first + ":" + oIter->second + "\n";

    }

    return osCanonicalizedHeaders;

}

/************************************************************************/

/*                         GetRFC822DateTime()                          */

/************************************************************************/

std::string IVSIS3LikeHandleHelper::GetRFC822DateTime()

{

    char szDate[64];

    time_t nNow = time(nullptr);

    struct tm tm;

    CPLUnixTimeToYMDHMS(nNow, &tm);

    int nRet = CPLPrintTime(szDate, sizeof(szDate) - 1,

                            "%a, %d %b %Y %H:%M:%S GMT", &tm, "C");

    szDate[nRet] = 0;

    return szDate;

}

/************************************************************************/

/*                        Iso8601ToUnixTime()                           */

/************************************************************************/

static bool Iso8601ToUnixTime(const char *pszDT, GIntBig *pnUnixTime)

{

    int nYear;

    int nMonth;

    int nDay;

    int nHour;

    int nMinute;

    int nSecond;

    if (sscanf(pszDT, "%04d-%02d-%02dT%02d:%02d:%02d", &nYear, &nMonth, &nDay,

               &nHour, &nMinute, &nSecond) == 6)

    {

        struct tm brokendowntime;

        brokendowntime.tm_year = nYear - 1900;

        brokendowntime.tm_mon = nMonth - 1;

        brokendowntime.tm_mday = nDay;

        brokendowntime.tm_hour = nHour;

        brokendowntime.tm_min = nMinute;

        brokendowntime.tm_sec = nSecond;

        *pnUnixTime = CPLYMDHMSToUnixTime(&brokendowntime);

        return true;

    }

    return false;

}

/************************************************************************/

/*                  IsMachinePotentiallyEC2Instance()                   */

/************************************************************************/

enum class EC2InstanceCertainty

{

    YES,

    NO,

    MAYBE

};

static EC2InstanceCertainty IsMachinePotentiallyEC2Instance()

{

#if defined(__linux) || defined(_WIN32)

    const auto IsMachinePotentiallyEC2InstanceFromLinuxHost = []()

    {

        // On the newer Nitro Hypervisor (C5, M5, H1, T3), use

        // /sys/devices/virtual/dmi/id/sys_vendor = 'Amazon EC2' instead.

        // On older Xen hypervisor EC2 instances, a /sys/hypervisor/uuid file

        // will exist with a string beginning with 'ec2'.

        // If the files exist but don't contain the correct content, then we're

        // not EC2 and do not attempt any network access

        // Check for Xen Hypervisor instances

        // This file doesn't exist on Nitro instances

        VSILFILE *fp = VSIFOpenL("/sys/hypervisor/uuid", "rb");

        if (fp != nullptr)

        {

            char uuid[36 + 1] = {0};

            VSIFReadL(uuid, 1, sizeof(uuid) - 1, fp);

            VSIFCloseL(fp);

            return EQUALN(uuid, "ec2", 3) ? EC2InstanceCertainty::YES

                                          : EC2InstanceCertainty::NO;

        }

        // Check for Nitro Hypervisor instances

        // This file may exist on Xen instances with a value of 'Xen'

        // (but that doesn't mean we're on EC2)

        fp = VSIFOpenL("/sys/devices/virtual/dmi/id/sys_vendor", "rb");

        if (fp != nullptr)

        {

            char buf[10 + 1] = {0};

            VSIFReadL(buf, 1, sizeof(buf) - 1, fp);

            VSIFCloseL(fp);

            return EQUALN(buf, "Amazon EC2", 10) ? EC2InstanceCertainty::YES

                                                 : EC2InstanceCertainty::NO;

        }

        // Fallback: Check via the network

        return EC2InstanceCertainty::MAYBE;

    };

#endif

#ifdef __linux

    // Optimization on Linux to avoid the network request

    // See

    // http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/identify_ec2_instances.html

    // Skip if either:

    // - CPL_AWS_AUTODETECT_EC2=NO

    // - CPL_AWS_CHECK_HYPERVISOR_UUID=NO (deprecated)

    if (!CPLTestBool(CPLGetConfigOption("CPL_AWS_AUTODETECT_EC2", "YES")))

    {

        return EC2InstanceCertainty::MAYBE;

    }

    else

    {

        const char *opt =

            CPLGetConfigOption("CPL_AWS_CHECK_HYPERVISOR_UUID", "");

        if (opt[0])

        {

            CPLDebug(AWS_DEBUG_KEY,

                     "CPL_AWS_CHECK_HYPERVISOR_UUID is deprecated. Use "

                     "CPL_AWS_AUTODETECT_EC2 instead");

            if (!CPLTestBool(opt))

            {

                return EC2InstanceCertainty::MAYBE;

            }

        }

    }

    return IsMachinePotentiallyEC2InstanceFromLinuxHost();

#elif defined(_WIN32)

    if (!CPLTestBool(CPLGetConfigOption("CPL_AWS_AUTODETECT_EC2", "YES")))

    {

        return EC2InstanceCertainty::MAYBE;

    }

    // Regular UUID is not valid for WINE, fetch from sysfs instead.

    if (CPLGetWineVersion() != nullptr)

    {

        return IsMachinePotentiallyEC2InstanceFromLinuxHost();

    }

    else

    {

#if defined(HAVE_ATLBASE_H)

        std::string osMachineUUID;

        if (CPLFetchWindowsProductUUID(osMachineUUID))

        {

            if (osMachineUUID.length() >= 3 &&

                EQUALN(osMachineUUID.c_str(), "EC2", 3))

            {

                return EC2InstanceCertainty::YES;

            }

            else if (osMachineUUID.length() >= 8 && osMachineUUID[4] == '2' &&

                     osMachineUUID[6] == 'E' && osMachineUUID[7] == 'C')

            {

                return EC2InstanceCertainty::YES;

            }

            else

            {

                return EC2InstanceCertainty::NO;

            }

        }

#endif

    }

    // Fallback: Check via the network

    return EC2InstanceCertainty::MAYBE;

#else

    // At time of writing EC2 instances can be only Linux or Windows

    return EC2InstanceCertainty::NO;

#endif

}

/************************************************************************/

/*                   ReadAWSTokenFile()                                 */

/************************************************************************/

static bool ReadAWSTokenFile(const std::string &osAWSTokenFile,

                             std::string &awsToken)

{

    GByte *pabyOut = nullptr;

    if (!VSIIngestFile(nullptr, osAWSTokenFile.c_str(), &pabyOut, nullptr, -1))

        return false;

    awsToken = reinterpret_cast<char *>(pabyOut);

    VSIFree(pabyOut);

    // Remove trailing end-of-line character

    if (!awsToken.empty() && awsToken.back() == '\n')

        awsToken.pop_back();

    return !awsToken.empty();

}

/************************************************************************/

/*          GetConfigurationFromAssumeRoleWithWebIdentity()             */

/************************************************************************/

bool VSIS3HandleHelper::GetConfigurationFromAssumeRoleWithWebIdentity(

    bool bForceRefresh, const std::string &osPathForOption,

    const std::string &osRoleArnIn, const std::string &osWebIdentityTokenFileIn,

    std::string &osSecretAccessKey, std::string &osAccessKeyId,

    std::string &osSessionToken)

{

    CPLMutexHolder oHolder(&ghMutex);

    if (!bForceRefresh &&

        geCredentialsSource == AWSCredentialsSource::WEB_IDENTITY)

    {

        time_t nCurTime;

        time(&nCurTime);

        // Try to reuse credentials if they are still valid, but

        // keep one minute of margin...

        if (!gosGlobalAccessKeyId.empty() && nCurTime < gnGlobalExpiration - 60)

        {

            osAccessKeyId = gosGlobalAccessKeyId;

            osSecretAccessKey = gosGlobalSecretAccessKey;

            osSessionToken = gosGlobalSessionToken;

            return true;

        }

    }

    const std::string roleArn =

        !osRoleArnIn.empty() ? osRoleArnIn

                             : VSIGetPathSpecificOption(osPathForOption.c_str(),

                                                        "AWS_ROLE_ARN", "");

    if (roleArn.empty())

    {

        CPLDebug(AWS_DEBUG_KEY,

                 "AWS_ROLE_ARN configuration option not defined");

        return false;

    }

    const std::string webIdentityTokenFile =

        !osWebIdentityTokenFileIn.empty()

            ? osWebIdentityTokenFileIn

            : VSIGetPathSpecificOption(osPathForOption.c_str(),

                                       "AWS_WEB_IDENTITY_TOKEN_FILE", "");

    if (webIdentityTokenFile.empty())

    {

        CPLDebug(

            AWS_DEBUG_KEY,

            "AWS_WEB_IDENTITY_TOKEN_FILE configuration option not defined");

        return false;

    }

    const std::string stsRegionalEndpoints = VSIGetPathSpecificOption(

        osPathForOption.c_str(), "AWS_STS_REGIONAL_ENDPOINTS", "regional");

    std::string osStsDefaultUrl;

    if (stsRegionalEndpoints == "regional")

    {

        const std::string osRegion = VSIGetPathSpecificOption(

            osPathForOption.c_str(), "AWS_REGION", "us-east-1");

        osStsDefaultUrl = "https://sts." + osRegion + ".amazonaws.com";

    }

    else

    {

        osStsDefaultUrl = "https://sts.amazonaws.com";

    }

    const std::string osStsRootUrl(VSIGetPathSpecificOption(

        osPathForOption.c_str(), "CPL_AWS_STS_ROOT_URL",

        osStsDefaultUrl.c_str()));

    // Get token from web identity token file

    std::string webIdentityToken;

    if (!ReadAWSTokenFile(webIdentityTokenFile, webIdentityToken))

    {

        CPLDebug(AWS_DEBUG_KEY, "%s is empty", webIdentityTokenFile.c_str());

        return false;

    }

    // Get credentials from sts AssumeRoleWithWebIdentity

    std::string osExpiration;

    {

        const std::string osSTS_asuume_role_with_web_identity_URL =

            osStsRootUrl +

            "/?Action=AssumeRoleWithWebIdentity&RoleSessionName=gdal"

            "&Version=2011-06-15&RoleArn=" +

            CPLAWSURLEncode(roleArn) +

            "&WebIdentityToken=" + CPLAWSURLEncode(webIdentityToken);

        CPLPushErrorHandler(CPLQuietErrorHandler);

        CPLHTTPResult *psResult = CPLHTTPFetch(

            osSTS_asuume_role_with_web_identity_URL.c_str(), nullptr);

        CPLPopErrorHandler();

        if (psResult)

        {

            if (psResult->nStatus == 0 && psResult->pabyData != nullptr)

            {

                CPLXMLTreeCloser oTree(CPLParseXMLString(

                    reinterpret_cast<char *>(psResult->pabyData)));

                if (oTree)

                {

                    const auto psCredentials = CPLGetXMLNode(

                        oTree.get(),

                        "=AssumeRoleWithWebIdentityResponse."

                        "AssumeRoleWithWebIdentityResult.Credentials");

                    if (psCredentials)

                    {

                        osAccessKeyId =

                            CPLGetXMLValue(psCredentials, "AccessKeyId", "");

                        osSecretAccessKey = CPLGetXMLValue(

                            psCredentials, "SecretAccessKey", "");

                        osSessionToken =

                            CPLGetXMLValue(psCredentials, "SessionToken", "");

                        osExpiration =

                            CPLGetXMLValue(psCredentials, "Expiration", "");

                    }

                }

            }

            CPLHTTPDestroyResult(psResult);

        }

    }

    GIntBig nExpirationUnix = 0;

    if (!osAccessKeyId.empty() && !osSecretAccessKey.empty() &&

        !osSessionToken.empty() &&

        Iso8601ToUnixTime(osExpiration.c_str(), &nExpirationUnix))

    {

        geCredentialsSource = AWSCredentialsSource::WEB_IDENTITY;

        gosGlobalAccessKeyId = osAccessKeyId;

        gosGlobalSecretAccessKey = osSecretAccessKey;

        gosGlobalSessionToken = osSessionToken;

        gnGlobalExpiration = nExpirationUnix;

        CPLDebug(AWS_DEBUG_KEY, "Storing AIM credentials until %s",

                 osExpiration.c_str());

    }

    return !osAccessKeyId.empty() && !osSecretAccessKey.empty() &&

           !osSessionToken.empty();

}

/************************************************************************/

/*                      GetConfigurationFromEC2()                       */

/************************************************************************/

bool VSIS3HandleHelper::GetConfigurationFromEC2(

    bool bForceRefresh, const std::string &osPathForOption,

    std::string &osSecretAccessKey, std::string &osAccessKeyId,

    std::string &osSessionToken)

{

    CPLMutexHolder oHolder(&ghMutex);

    if (!bForceRefresh && geCredentialsSource == AWSCredentialsSource::EC2)

    {

        time_t nCurTime;

        time(&nCurTime);

        // Try to reuse credentials if they are still valid, but

        // keep one minute of margin...

        if (!gosGlobalAccessKeyId.empty() && nCurTime < gnGlobalExpiration - 60)

        {

            osAccessKeyId = gosGlobalAccessKeyId;

            osSecretAccessKey = gosGlobalSecretAccessKey;

            osSessionToken = gosGlobalSessionToken;

            return true;

        }

    }

    std::string osURLRefreshCredentials;

    const std::string osEC2DefaultURL("http://169.254.169.254");

    // coverity[tainted_data]

    const std::string osEC2RootURL(VSIGetPathSpecificOption(

        osPathForOption.c_str(), "CPL_AWS_EC2_API_ROOT_URL",

        osEC2DefaultURL.c_str()));

    // coverity[tainted_data]

    std::string osECSFullURI(VSIGetPathSpecificOption(

        osPathForOption.c_str(), "AWS_CONTAINER_CREDENTIALS_FULL_URI", ""));

    // coverity[tainted_data]

    const std::string osECSRelativeURI(

        osECSFullURI.empty() ? VSIGetPathSpecificOption(

                                   osPathForOption.c_str(),

                                   "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", "")

                             : std::string());

    // coverity[tainted_data]

    const std::string osECSTokenFile(

        (osECSFullURI.empty() && osECSRelativeURI.empty())

            ? std::string()

            : VSIGetPathSpecificOption(osPathForOption.c_str(),

                                       "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",

                                       ""));

    // coverity[tainted_data]

    std::string osECSTokenValue(

        (osECSFullURI.empty() && osECSRelativeURI.empty() &&

         !osECSTokenFile.empty())

            ? std::string()

            : VSIGetPathSpecificOption(osPathForOption.c_str(),

                                       "AWS_CONTAINER_AUTHORIZATION_TOKEN",

                                       ""));

    std::string osECSToken;

    if (!osECSTokenFile.empty())

    {

        if (!ReadAWSTokenFile(osECSTokenFile, osECSToken))

        {

            CPLDebug(AWS_DEBUG_KEY, "%s is empty", osECSTokenFile.c_str());

        }

    }

    else if (!osECSTokenValue.empty())

    {

        osECSToken = std::move(osECSTokenValue);

    }

    std::string osToken;

    if (!osECSFullURI.empty())

    {

        // Cf https://docs.aws.amazon.com/sdkref/latest/guide/feature-container-credentials.html

        osURLRefreshCredentials = std::move(osECSFullURI);

    }

    else if (osEC2RootURL == osEC2DefaultURL && !osECSRelativeURI.empty())

    {

        // See

        // https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html

        osURLRefreshCredentials = "http://169.254.170.2" + osECSRelativeURI;

    }

    else

    {

        const auto eIsEC2 = IsMachinePotentiallyEC2Instance();

        if (eIsEC2 == EC2InstanceCertainty::NO)

            return false;

        // Use IMDSv2 protocol:

        // https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html

        // Retrieve IMDSv2 token

        {

            const std::string osEC2_IMDSv2_api_token_URL =

                osEC2RootURL + "/latest/api/token";

            CPLStringList aosOptions;

            aosOptions.SetNameValue("TIMEOUT", "1");

            aosOptions.SetNameValue("CUSTOMREQUEST", "PUT");

            aosOptions.SetNameValue("HEADERS",

                                    "X-aws-ec2-metadata-token-ttl-seconds: 10");

            CPLPushErrorHandler(CPLQuietErrorHandler);

            CPLHTTPResult *psResult = CPLHTTPFetch(

                osEC2_IMDSv2_api_token_URL.c_str(), aosOptions.List());

            CPLPopErrorHandler();

            if (psResult)

            {

                if (psResult->nStatus == 0 && psResult->pabyData != nullptr)

                {

                    osToken = reinterpret_cast<char *>(psResult->pabyData);

                }

                else

                {

                    // Failure: either we are not running on EC2 (or something

                    // emulating it) or this doesn't implement yet IMDSv2.

                    // Fallback to IMDSv1

                    // /latest/api/token doesn't work inside a Docker container

                    // that has no host networking. Cf

                    // https://community.grafana.com/t/imdsv2-is-not-working-from-docker/65944

                    if (psResult->pszErrBuf != nullptr &&

                        strstr(psResult->pszErrBuf,

                               "Operation timed out after") != nullptr)

                    {

                        aosOptions.Clear();

                        aosOptions.SetNameValue("TIMEOUT", "1");

                        CPLPushErrorHandler(CPLQuietErrorHandler);

                        CPLHTTPResult *psResult2 = CPLHTTPFetch(

                            (osEC2RootURL + "/latest/meta-data").c_str(),

                            aosOptions.List());

                        CPLPopErrorHandler();

                        if (psResult2)

                        {