Only set auth_path once, fixes signing errors

Fixes aws/aws-cli#986

The bug was that the fix_s3_host always sets the auth_path
to the current path of the request.url.  However, in the case
of a retried request, we call fix_s3_host again which changes
the auth_path to the (already modified) request path.  This
generates an auth error.

The fix now is to check if auth_path is set, and if it is, then
we can immediately return.

botocore/handlers.py

@@ -169,6 +169,11 @@ def fix_s3_host(event_name, endpoint, request, auth, **kwargs):
     addressing.  This allows us to avoid 301 redirects for all
     bucket names that can be CNAME'd.
     """
+    if auth.auth_path is not None:
+        # The auth_path has already been applied (this may be a
+        # retried request).  We don't need to perform this
+        # customization again.
+        return
     parts = urlsplit(request.url)
     auth.auth_path = parts.path
     path_parts = parts.path.split('/')

tests/unit/test_handlers.py

@@ -18,7 +18,9 @@
 import mock
 
 import botocore.session
+from botocore.awsrequest import AWSRequest
 from botocore.hooks import first_non_none_response
+from botocore.auth import BaseSigner
 from botocore.compat import quote
 from botocore import handlers
 
@@ -161,6 +163,35 @@ def test_sse_headers(self):
                 params['headers'][prefix + 'key-MD5'],
                 'N7UdGUp1E+RbVvZSTy1R8g==')
 
+    def test_fix_s3_host_initial(self):
+        endpoint = mock.Mock(region_name='us-west-2')
+        request = AWSRequest(
+            method='PUT',headers={},
+            url='https://s3-us-west-2.amazonaws.com/bucket/key.txt'
+        )
+        auth = mock.Mock()
+        auth.auth_path = None
+        handlers.fix_s3_host('foo', endpoint, request, auth)
+        self.assertEqual(request.url, 'https://bucket.s3.amazonaws.com/key.txt')
+        self.assertEqual(auth.auth_path, '/bucket/key.txt')
+
+    def test_fix_s3_host_only_applied_once(self):
+        endpoint = mock.Mock(region_name='us-west-2')
+        request = AWSRequest(
+            method='PUT',headers={},
+            url='https://s3-us-west-2.amazonaws.com/bucket/key.txt'
+        )
+        auth = mock.Mock()
+        auth.auth_path = None
+        handlers.fix_s3_host('foo', endpoint, request, auth)
+        # Calling the handler again should not affect the end result:
+        handlers.fix_s3_host('foo', endpoint, request, auth)
+        self.assertEqual(request.url, 'https://bucket.s3.amazonaws.com/key.txt')
+        # This was a bug previously.  We want to make sure that
+        # calling fix_s3_host() again does not alter the auth_path.
+        # Otherwise we'll get signature errors.
+        self.assertEqual(auth.auth_path, '/bucket/key.txt')
+
 
 class TestRetryHandlerOrder(BaseSessionTest):
     def get_handler_names(self, responses):
@@ -195,7 +226,3 @@ def test_s3_special_case_is_before_other_retry(self):
         self.assertTrue(s3_200_handler < general_retry_handler,
                         "S3 200 error handler was supposed to be before "
                         "the general retry handler, but it was not.")
-
-
-if __name__ == '__main__':
-    unittest.main()