'Calculate HMACs of etags in header value and append to existing list.
The HMACs are calculated in the same way as was done for the object
plaintext etag to generate the value of
X-Object-Sysmeta-Crypto-Etag-Mac when the object was PUT. The object
server can therefore use these HMACs to evaluate conditional requests.
The existing etag values are left in the list of values to match in
case the object was not encrypted when it was PUT. It is unlikely that
a masked etag value would collide with an unmasked value.
:param req: an instance of swob.Request
:param header_name: name of header that has etags to mask
:return: True if any etags were masked, False otherwise'

@contextmanager
def _mask_conditional_etags(self, req, header_name):

    masked = False
    old_etags = req.headers.get(header_name)
    if old_etags:
        keys = self.get_keys(req.environ)
        new_etags = []
        for etag in Match(old_etags).tags:
            if (etag == '*'):
                new_etags.append(etag)
                continue
            masked_etag = _hmac_etag(keys['object'], etag)
            new_etags.extend((('"%s"' % etag), ('"%s"' % masked_etag)))
            masked = True
        req.headers[header_name] = ',    '.join(new_etags)
    try:
        (yield masked)
    finally:
        if old_etags:
            req.headers[header_name] = old_etags
