win32-certstore 0.1.0 → 0.1.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +5 -5
- data/README.md +228 -225
- data/lib/win32/certstore.rb +1 -1
- data/lib/win32/certstore/mixin/assertions.rb +90 -90
- data/lib/win32/certstore/mixin/crypto.rb +203 -203
- data/lib/win32/certstore/mixin/helper.rb +50 -50
- data/lib/win32/certstore/mixin/shell_out.rb +105 -104
- data/lib/win32/certstore/mixin/string.rb +71 -71
- data/lib/win32/certstore/mixin/unicode.rb +50 -50
- data/lib/win32/certstore/store_base.rb +215 -214
- data/lib/win32/certstore/version.rb +6 -6
- metadata +3 -3
data/lib/win32/certstore.rb
CHANGED
|
@@ -1,90 +1,90 @@
|
|
|
1
|
-
#
|
|
2
|
-
# Author:: Piyush Awasthi (<piyush.awasthi@msystechnologies.com>)
|
|
3
|
-
# Copyright:: Copyright (c) 2017 Chef Software, Inc.
|
|
4
|
-
# License:: Apache License, Version 2.0
|
|
5
|
-
#
|
|
6
|
-
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
7
|
-
# you may not use this file except in compliance with the License.
|
|
8
|
-
# You may obtain a copy of the License at
|
|
9
|
-
#
|
|
10
|
-
# http://www.apache.org/licenses/LICENSE-2.0
|
|
11
|
-
#
|
|
12
|
-
# Unless required by applicable law or agreed to in writing, software
|
|
13
|
-
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
14
|
-
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
15
|
-
# See the License for the specific language governing permissions and
|
|
16
|
-
# limitations under the License.
|
|
17
|
-
require "openssl"
|
|
18
|
-
|
|
19
|
-
module Win32
|
|
20
|
-
class Certstore
|
|
21
|
-
module Mixin
|
|
22
|
-
module Assertions
|
|
23
|
-
# Validate certificate store name
|
|
24
|
-
def validate_store(store_name)
|
|
25
|
-
unless valid_store_name.include?(store_name
|
|
26
|
-
raise ArgumentError, "Invalid Certificate Store."
|
|
27
|
-
end
|
|
28
|
-
end
|
|
29
|
-
|
|
30
|
-
# Validate certificate type
|
|
31
|
-
def validate_certificate(cert_file_path)
|
|
32
|
-
unless !cert_file_path.nil? && File.extname(cert_file_path) =~ /.cer|.crt|.pfx|.der/
|
|
33
|
-
raise ArgumentError, "Invalid Certificate format."
|
|
34
|
-
end
|
|
35
|
-
end
|
|
36
|
-
|
|
37
|
-
# Validate certificate Object
|
|
38
|
-
def validate_certificate_obj(cert_obj)
|
|
39
|
-
unless cert_obj.class == OpenSSL::X509::Certificate
|
|
40
|
-
raise ArgumentError, "Invalid Certificate object."
|
|
41
|
-
end
|
|
42
|
-
end
|
|
43
|
-
|
|
44
|
-
# Validate thumbprint
|
|
45
|
-
def validate_thumbprint(cert_thumbprint)
|
|
46
|
-
if cert_thumbprint.nil? || cert_thumbprint.strip.empty?
|
|
47
|
-
raise ArgumentError, "Invalid certificate thumbprint."
|
|
48
|
-
end
|
|
49
|
-
end
|
|
50
|
-
|
|
51
|
-
# Validate certificate name not nil/empty
|
|
52
|
-
def validate!(token)
|
|
53
|
-
raise ArgumentError, "Invalid search token" if !token || token.strip.empty?
|
|
54
|
-
end
|
|
55
|
-
|
|
56
|
-
# Common System call errors
|
|
57
|
-
def lookup_error(failed_operation = nil)
|
|
58
|
-
error_no = FFI::LastError.error
|
|
59
|
-
case error_no
|
|
60
|
-
when 1223
|
|
61
|
-
raise SystemCallError.new("The operation was canceled by the user", error_no)
|
|
62
|
-
when -2146885628
|
|
63
|
-
raise SystemCallError.new("Cannot find object or property", error_no)
|
|
64
|
-
when -2146885629
|
|
65
|
-
raise SystemCallError.new("An error occurred while reading or writing to a file.", error_no)
|
|
66
|
-
when -2146881269
|
|
67
|
-
raise SystemCallError.new("ASN1 bad tag value met. -- Is the certificate in DER format?", error_no)
|
|
68
|
-
when -2146881278
|
|
69
|
-
raise SystemCallError.new("ASN1 unexpected end of data.", error_no)
|
|
70
|
-
when -2147024891
|
|
71
|
-
raise SystemCallError.new("System.UnauthorizedAccessException, Access denied..", error_no)
|
|
72
|
-
else
|
|
73
|
-
raise SystemCallError.new("Unable to #{failed_operation} certificate.", error_no)
|
|
74
|
-
end
|
|
75
|
-
end
|
|
76
|
-
|
|
77
|
-
private
|
|
78
|
-
|
|
79
|
-
# These Are Valid certificate store name
|
|
80
|
-
# CA -> Certification authority certificates.
|
|
81
|
-
# MY -> A certificate store that holds certificates with associated private keys.
|
|
82
|
-
# ROOT -> Root certificates.
|
|
83
|
-
# SPC -> Software Publisher Certificate.
|
|
84
|
-
def valid_store_name
|
|
85
|
-
%w{MY CA ROOT SPC}
|
|
86
|
-
end
|
|
87
|
-
end
|
|
88
|
-
end
|
|
89
|
-
end
|
|
90
|
-
end
|
|
1
|
+
#
|
|
2
|
+
# Author:: Piyush Awasthi (<piyush.awasthi@msystechnologies.com>)
|
|
3
|
+
# Copyright:: Copyright (c) 2017 Chef Software, Inc.
|
|
4
|
+
# License:: Apache License, Version 2.0
|
|
5
|
+
#
|
|
6
|
+
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
7
|
+
# you may not use this file except in compliance with the License.
|
|
8
|
+
# You may obtain a copy of the License at
|
|
9
|
+
#
|
|
10
|
+
# http://www.apache.org/licenses/LICENSE-2.0
|
|
11
|
+
#
|
|
12
|
+
# Unless required by applicable law or agreed to in writing, software
|
|
13
|
+
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
14
|
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
15
|
+
# See the License for the specific language governing permissions and
|
|
16
|
+
# limitations under the License.
|
|
17
|
+
require "openssl"
|
|
18
|
+
|
|
19
|
+
module Win32
|
|
20
|
+
class Certstore
|
|
21
|
+
module Mixin
|
|
22
|
+
module Assertions
|
|
23
|
+
# Validate certificate store name
|
|
24
|
+
def validate_store(store_name)
|
|
25
|
+
unless valid_store_name.include?(store_name.to_s.upcase)
|
|
26
|
+
raise ArgumentError, "Invalid Certificate Store."
|
|
27
|
+
end
|
|
28
|
+
end
|
|
29
|
+
|
|
30
|
+
# Validate certificate type
|
|
31
|
+
def validate_certificate(cert_file_path)
|
|
32
|
+
unless !cert_file_path.nil? && File.extname(cert_file_path) =~ /.cer|.crt|.pfx|.der/
|
|
33
|
+
raise ArgumentError, "Invalid Certificate format."
|
|
34
|
+
end
|
|
35
|
+
end
|
|
36
|
+
|
|
37
|
+
# Validate certificate Object
|
|
38
|
+
def validate_certificate_obj(cert_obj)
|
|
39
|
+
unless cert_obj.class == OpenSSL::X509::Certificate
|
|
40
|
+
raise ArgumentError, "Invalid Certificate object."
|
|
41
|
+
end
|
|
42
|
+
end
|
|
43
|
+
|
|
44
|
+
# Validate thumbprint
|
|
45
|
+
def validate_thumbprint(cert_thumbprint)
|
|
46
|
+
if cert_thumbprint.nil? || cert_thumbprint.strip.empty?
|
|
47
|
+
raise ArgumentError, "Invalid certificate thumbprint."
|
|
48
|
+
end
|
|
49
|
+
end
|
|
50
|
+
|
|
51
|
+
# Validate certificate name not nil/empty
|
|
52
|
+
def validate!(token)
|
|
53
|
+
raise ArgumentError, "Invalid search token" if !token || token.strip.empty?
|
|
54
|
+
end
|
|
55
|
+
|
|
56
|
+
# Common System call errors
|
|
57
|
+
def lookup_error(failed_operation = nil)
|
|
58
|
+
error_no = FFI::LastError.error
|
|
59
|
+
case error_no
|
|
60
|
+
when 1223
|
|
61
|
+
raise SystemCallError.new("The operation was canceled by the user", error_no)
|
|
62
|
+
when -2146885628
|
|
63
|
+
raise SystemCallError.new("Cannot find object or property", error_no)
|
|
64
|
+
when -2146885629
|
|
65
|
+
raise SystemCallError.new("An error occurred while reading or writing to a file.", error_no)
|
|
66
|
+
when -2146881269
|
|
67
|
+
raise SystemCallError.new("ASN1 bad tag value met. -- Is the certificate in DER format?", error_no)
|
|
68
|
+
when -2146881278
|
|
69
|
+
raise SystemCallError.new("ASN1 unexpected end of data.", error_no)
|
|
70
|
+
when -2147024891
|
|
71
|
+
raise SystemCallError.new("System.UnauthorizedAccessException, Access denied..", error_no)
|
|
72
|
+
else
|
|
73
|
+
raise SystemCallError.new("Unable to #{failed_operation} certificate.", error_no)
|
|
74
|
+
end
|
|
75
|
+
end
|
|
76
|
+
|
|
77
|
+
private
|
|
78
|
+
|
|
79
|
+
# These Are Valid certificate store name
|
|
80
|
+
# CA -> Certification authority certificates.
|
|
81
|
+
# MY -> A certificate store that holds certificates with associated private keys.
|
|
82
|
+
# ROOT -> Root certificates.
|
|
83
|
+
# SPC -> Software Publisher Certificate.
|
|
84
|
+
def valid_store_name
|
|
85
|
+
%w{MY CA ROOT AUTHROOT DISALLOWED SPC TRUST TRUSTEDPEOPLE TRUSTEDPUBLISHER CLIENTAUTHISSUER TRUSTEDDEVICES SMARTCARDROOT WEBHOSTING REMOTE\ DESKTOP}
|
|
86
|
+
end
|
|
87
|
+
end
|
|
88
|
+
end
|
|
89
|
+
end
|
|
90
|
+
end
|
|
@@ -1,203 +1,203 @@
|
|
|
1
|
-
#
|
|
2
|
-
# Author:: Nimisha Sharad (<nimisha.sharad@msystechnologies.com>)
|
|
3
|
-
# Copyright:: Copyright (c) 2017 Chef Software, Inc.
|
|
4
|
-
# License:: Apache License, Version 2.0
|
|
5
|
-
#
|
|
6
|
-
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
7
|
-
# you may not use this file except in compliance with the License.
|
|
8
|
-
# You may obtain a copy of the License at
|
|
9
|
-
#
|
|
10
|
-
# http://www.apache.org/licenses/LICENSE-2.0
|
|
11
|
-
#
|
|
12
|
-
# Unless required by applicable law or agreed to in writing, software
|
|
13
|
-
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
14
|
-
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
15
|
-
# See the License for the specific language governing permissions and
|
|
16
|
-
# limitations under the License.
|
|
17
|
-
#
|
|
18
|
-
|
|
19
|
-
require "ffi"
|
|
20
|
-
|
|
21
|
-
module Win32
|
|
22
|
-
class Certstore
|
|
23
|
-
module Mixin
|
|
24
|
-
module Crypto
|
|
25
|
-
extend FFI::Library
|
|
26
|
-
|
|
27
|
-
ffi_lib "Crypt32"
|
|
28
|
-
ffi_convention :stdcall
|
|
29
|
-
|
|
30
|
-
# Attempts to use FFI's attach_function method to link a native Win32
|
|
31
|
-
# function into the calling module. If this fails a dummy method is
|
|
32
|
-
# defined which when called, raises a helpful exception to the end-user.
|
|
33
|
-
module FFI::Library
|
|
34
|
-
def safe_attach_function(win32_func, *args)
|
|
35
|
-
attach_function(win32_func.to_sym, *args)
|
|
36
|
-
rescue FFI::NotFoundError
|
|
37
|
-
define_method(win32_func.to_sym) do |*margs|
|
|
38
|
-
raise NotImplementedError, "This version of Windows does not implement the Win32 function [#{win32_func}]."
|
|
39
|
-
end
|
|
40
|
-
end
|
|
41
|
-
end
|
|
42
|
-
|
|
43
|
-
###############################################
|
|
44
|
-
# Win32 API Constants
|
|
45
|
-
###############################################
|
|
46
|
-
|
|
47
|
-
CERT_CLOSE_STORE_CHECK_FLAG = 0
|
|
48
|
-
CERT_CLOSE_STORE_FORCE_FLAG = 1
|
|
49
|
-
|
|
50
|
-
# cert encoding flags.
|
|
51
|
-
CRYPT_ASN_ENCODING = 0x00000001
|
|
52
|
-
CRYPT_NDR_ENCODING = 0x00000002
|
|
53
|
-
X509_ASN_ENCODING = 0x00000001
|
|
54
|
-
X509_NDR_ENCODING = 0x00000002
|
|
55
|
-
PKCS_7_ASN_ENCODING = 0x00010000
|
|
56
|
-
PKCS_7_NDR_ENCODING = 0x00020000
|
|
57
|
-
PKCS_7_OR_X509_ASN_ENCODING = (PKCS_7_ASN_ENCODING | X509_ASN_ENCODING)
|
|
58
|
-
|
|
59
|
-
# Certificate Display Format
|
|
60
|
-
CERT_NAME_EMAIL_TYPE = 1
|
|
61
|
-
CERT_NAME_RDN_TYPE = 2
|
|
62
|
-
CERT_NAME_ATTR_TYPE = 3
|
|
63
|
-
CERT_NAME_SIMPLE_DISPLAY_TYPE = 4
|
|
64
|
-
CERT_NAME_FRIENDLY_DISPLAY_TYPE = 5
|
|
65
|
-
CERT_NAME_DNS_TYPE = 6
|
|
66
|
-
CERT_NAME_URL_TYPE = 7
|
|
67
|
-
CERT_NAME_UPN_TYPE = 8
|
|
68
|
-
|
|
69
|
-
# Retrieve Certificates flag
|
|
70
|
-
CERT_FIND_SUBJECT_STR = 0x00080007
|
|
71
|
-
CERT_FIND_ISSUER_STR = 0x00080004
|
|
72
|
-
|
|
73
|
-
# List Certificates Flag
|
|
74
|
-
CERT_NAME_ISSUER_FLAG = 0x1
|
|
75
|
-
CERT_NAME_DISABLE_IE4_UTF8_FLAG = 0x00010000
|
|
76
|
-
CERT_NAME_SEARCH_ALL_NAMES_FLAG = 0x2
|
|
77
|
-
CERT_NAME_STR_ENABLE_PUNYCODE_FLAG = 0x00200000
|
|
78
|
-
|
|
79
|
-
# Define ffi pointer
|
|
80
|
-
HCERTSTORE = FFI::TypeDefs[:pointer]
|
|
81
|
-
HCRYPTPROV_LEGACY = FFI::TypeDefs[:pointer]
|
|
82
|
-
PCCERT_CONTEXT = FFI::TypeDefs[:pointer]
|
|
83
|
-
BYTE = FFI::TypeDefs[:pointer]
|
|
84
|
-
DWORD = FFI::TypeDefs[:uint32]
|
|
85
|
-
BLOB = FFI::TypeDefs[:ulong]
|
|
86
|
-
LPSTR = FFI::TypeDefs[:pointer]
|
|
87
|
-
LPCTSTR = FFI::TypeDefs[:pointer]
|
|
88
|
-
BOOL = FFI::TypeDefs[:bool]
|
|
89
|
-
INT_PTR = FFI::TypeDefs[:int]
|
|
90
|
-
LONG = FFI::TypeDefs[:long]
|
|
91
|
-
LPVOID = FFI::TypeDefs[:pointer]
|
|
92
|
-
LPTSTR = FFI::TypeDefs[:pointer]
|
|
93
|
-
LMSTR = FFI::TypeDefs[:pointer]
|
|
94
|
-
PWSTR = FFI::TypeDefs[:pointer]
|
|
95
|
-
LPFILETIME = FFI::TypeDefs[:pointer]
|
|
96
|
-
PCERT_INFO = FFI::TypeDefs[:pointer]
|
|
97
|
-
PCTL_USAGE = FFI::TypeDefs[:pointer]
|
|
98
|
-
PCTL_VERIFY_USAGE_PARA = FFI::TypeDefs[:pointer]
|
|
99
|
-
PCTL_VERIFY_USAGE_STATUS = FFI::TypeDefs[:pointer]
|
|
100
|
-
|
|
101
|
-
class FILETIME < FFI::Struct
|
|
102
|
-
layout :dwLowDateTime, DWORD,
|
|
103
|
-
:dwHighDateTime, DWORD
|
|
104
|
-
end
|
|
105
|
-
|
|
106
|
-
class CRYPT_INTEGER_BLOB < FFI::Struct
|
|
107
|
-
layout :cbData, DWORD, # Count, in bytes, of data
|
|
108
|
-
:pbData, :pointer # Pointer to data buffer
|
|
109
|
-
end
|
|
110
|
-
|
|
111
|
-
class CRYPT_NAME_BLOB < FFI::Struct
|
|
112
|
-
layout :cbData, DWORD, # Count, in bytes, of data
|
|
113
|
-
:pbData, :pointer # Pointer to data buffer
|
|
114
|
-
def initialize(str = nil)
|
|
115
|
-
super(nil)
|
|
116
|
-
if str
|
|
117
|
-
self[:pbData] = FFI::MemoryPointer.new(2, 128)
|
|
118
|
-
end
|
|
119
|
-
end
|
|
120
|
-
end
|
|
121
|
-
|
|
122
|
-
class CERT_EXTENSION < FFI::Struct
|
|
123
|
-
layout :pszObjId, LPTSTR,
|
|
124
|
-
:fCritical, BOOL,
|
|
125
|
-
:Value, CRYPT_INTEGER_BLOB
|
|
126
|
-
end
|
|
127
|
-
|
|
128
|
-
class CRYPT_BIT_BLOB < FFI::Struct
|
|
129
|
-
layout :cbData, DWORD,
|
|
130
|
-
:pbData, BYTE,
|
|
131
|
-
:cUnusedBits, DWORD
|
|
132
|
-
end
|
|
133
|
-
|
|
134
|
-
class CRYPT_ALGORITHM_IDENTIFIER < FFI::Struct
|
|
135
|
-
layout :pszObjId, LPSTR,
|
|
136
|
-
:Parameters, CRYPT_INTEGER_BLOB
|
|
137
|
-
end
|
|
138
|
-
|
|
139
|
-
class CERT_PUBLIC_KEY_INFO < FFI::Struct
|
|
140
|
-
layout :Algorithm, CRYPT_ALGORITHM_IDENTIFIER,
|
|
141
|
-
:PublicKey, CRYPT_BIT_BLOB
|
|
142
|
-
end
|
|
143
|
-
|
|
144
|
-
class CERT_INFO < FFI::Struct
|
|
145
|
-
layout :dwVersion, DWORD,
|
|
146
|
-
:SerialNumber, CRYPT_INTEGER_BLOB,
|
|
147
|
-
:SignatureAlgorithm, CRYPT_ALGORITHM_IDENTIFIER,
|
|
148
|
-
:Issuer, CRYPT_NAME_BLOB,
|
|
149
|
-
:NotBefore, FILETIME,
|
|
150
|
-
:NotAfter, FILETIME,
|
|
151
|
-
:Subject, CRYPT_NAME_BLOB,
|
|
152
|
-
:SubjectPublicKeyInfo, CERT_PUBLIC_KEY_INFO,
|
|
153
|
-
:IssuerUniqueId, CRYPT_BIT_BLOB,
|
|
154
|
-
:SubjectUniqueId, CRYPT_BIT_BLOB,
|
|
155
|
-
:cExtension, DWORD,
|
|
156
|
-
:rgExtension, CERT_EXTENSION
|
|
157
|
-
end
|
|
158
|
-
|
|
159
|
-
class CERT_CONTEXT < FFI::Struct
|
|
160
|
-
layout :dwCertEncodingType, DWORD,
|
|
161
|
-
:pbCertEncoded, BYTE,
|
|
162
|
-
:cbCertEncoded, DWORD,
|
|
163
|
-
:pCertInfo, CERT_INFO,
|
|
164
|
-
:hCertStore, HCERTSTORE
|
|
165
|
-
end
|
|
166
|
-
|
|
167
|
-
###############################################################################
|
|
168
|
-
# Windows Function
|
|
169
|
-
# To know description about below windows function
|
|
170
|
-
# Search Ref: https://msdn.microsoft.com/en-us/library/windows/desktop/aa376560
|
|
171
|
-
###############################################################################
|
|
172
|
-
|
|
173
|
-
# To opens the most common system certificate store
|
|
174
|
-
safe_attach_function :CertOpenSystemStoreW, [HCRYPTPROV_LEGACY, LPCTSTR], HCERTSTORE
|
|
175
|
-
# To close the already open certificate store
|
|
176
|
-
safe_attach_function :CertCloseStore, [HCERTSTORE, DWORD], BOOL
|
|
177
|
-
# To create encoded certificate context
|
|
178
|
-
safe_attach_function :CertCreateCertificateContext, [DWORD, BYTE, DWORD], PCCERT_CONTEXT
|
|
179
|
-
# To retrieves certificates in a certificate store
|
|
180
|
-
safe_attach_function :CertEnumCertificatesInStore, [HCERTSTORE, PCCERT_CONTEXT], PCCERT_CONTEXT
|
|
181
|
-
# To get certificate name
|
|
182
|
-
safe_attach_function :CertGetNameStringW, [PCCERT_CONTEXT, DWORD, DWORD, LPVOID, LPTSTR, DWORD], DWORD
|
|
183
|
-
# To find all of the property identifiers for the specified certificate.
|
|
184
|
-
safe_attach_function :CertEnumCertificateContextProperties, [PCCERT_CONTEXT, DWORD], DWORD
|
|
185
|
-
# Clean up
|
|
186
|
-
safe_attach_function :CertFreeCertificateContext, [PCCERT_CONTEXT], BOOL
|
|
187
|
-
# Add certificate file in certificate store.
|
|
188
|
-
safe_attach_function :CertAddSerializedElementToStore, [HCERTSTORE, :pointer, DWORD, DWORD, DWORD, DWORD, LMSTR, LPVOID], BOOL
|
|
189
|
-
# Add certification to certification store - Ref: https://msdn.microsoft.com/en-us/library/windows/desktop/aa376015(v=vs.85).aspx
|
|
190
|
-
safe_attach_function :CertAddEncodedCertificateToStore, [HCERTSTORE, DWORD, PWSTR, DWORD, INT_PTR, PCCERT_CONTEXT], BOOL
|
|
191
|
-
safe_attach_function :CertSerializeCertificateStoreElement, [PCCERT_CONTEXT, DWORD, :pointer, DWORD], BOOL
|
|
192
|
-
# Duplicates a certificate context by incrementing its reference count
|
|
193
|
-
safe_attach_function :CertDuplicateCertificateContext, [PCCERT_CONTEXT], PCCERT_CONTEXT
|
|
194
|
-
# Delete certification from certification store
|
|
195
|
-
safe_attach_function :CertDeleteCertificateFromStore, [PCCERT_CONTEXT], BOOL
|
|
196
|
-
# To retrieve specific certificates from certificate store
|
|
197
|
-
safe_attach_function :CertFindCertificateInStore, [HCERTSTORE, DWORD, DWORD, DWORD, LPVOID, PCCERT_CONTEXT], PCCERT_CONTEXT
|
|
198
|
-
|
|
199
|
-
safe_attach_function :PFXExportCertStoreEx, [HCERTSTORE, CRYPT_INTEGER_BLOB, LPCTSTR, LPVOID, DWORD], BOOL
|
|
200
|
-
end
|
|
201
|
-
end
|
|
202
|
-
end
|
|
203
|
-
end
|
|
1
|
+
#
|
|
2
|
+
# Author:: Nimisha Sharad (<nimisha.sharad@msystechnologies.com>)
|
|
3
|
+
# Copyright:: Copyright (c) 2017 Chef Software, Inc.
|
|
4
|
+
# License:: Apache License, Version 2.0
|
|
5
|
+
#
|
|
6
|
+
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
7
|
+
# you may not use this file except in compliance with the License.
|
|
8
|
+
# You may obtain a copy of the License at
|
|
9
|
+
#
|
|
10
|
+
# http://www.apache.org/licenses/LICENSE-2.0
|
|
11
|
+
#
|
|
12
|
+
# Unless required by applicable law or agreed to in writing, software
|
|
13
|
+
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
14
|
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
15
|
+
# See the License for the specific language governing permissions and
|
|
16
|
+
# limitations under the License.
|
|
17
|
+
#
|
|
18
|
+
|
|
19
|
+
require "ffi"
|
|
20
|
+
|
|
21
|
+
module Win32
|
|
22
|
+
class Certstore
|
|
23
|
+
module Mixin
|
|
24
|
+
module Crypto
|
|
25
|
+
extend FFI::Library
|
|
26
|
+
|
|
27
|
+
ffi_lib "Crypt32"
|
|
28
|
+
ffi_convention :stdcall
|
|
29
|
+
|
|
30
|
+
# Attempts to use FFI's attach_function method to link a native Win32
|
|
31
|
+
# function into the calling module. If this fails a dummy method is
|
|
32
|
+
# defined which when called, raises a helpful exception to the end-user.
|
|
33
|
+
module FFI::Library
|
|
34
|
+
def safe_attach_function(win32_func, *args)
|
|
35
|
+
attach_function(win32_func.to_sym, *args)
|
|
36
|
+
rescue FFI::NotFoundError
|
|
37
|
+
define_method(win32_func.to_sym) do |*margs|
|
|
38
|
+
raise NotImplementedError, "This version of Windows does not implement the Win32 function [#{win32_func}]."
|
|
39
|
+
end
|
|
40
|
+
end
|
|
41
|
+
end
|
|
42
|
+
|
|
43
|
+
###############################################
|
|
44
|
+
# Win32 API Constants
|
|
45
|
+
###############################################
|
|
46
|
+
|
|
47
|
+
CERT_CLOSE_STORE_CHECK_FLAG = 0
|
|
48
|
+
CERT_CLOSE_STORE_FORCE_FLAG = 1
|
|
49
|
+
|
|
50
|
+
# cert encoding flags.
|
|
51
|
+
CRYPT_ASN_ENCODING = 0x00000001
|
|
52
|
+
CRYPT_NDR_ENCODING = 0x00000002
|
|
53
|
+
X509_ASN_ENCODING = 0x00000001
|
|
54
|
+
X509_NDR_ENCODING = 0x00000002
|
|
55
|
+
PKCS_7_ASN_ENCODING = 0x00010000
|
|
56
|
+
PKCS_7_NDR_ENCODING = 0x00020000
|
|
57
|
+
PKCS_7_OR_X509_ASN_ENCODING = (PKCS_7_ASN_ENCODING | X509_ASN_ENCODING)
|
|
58
|
+
|
|
59
|
+
# Certificate Display Format
|
|
60
|
+
CERT_NAME_EMAIL_TYPE = 1
|
|
61
|
+
CERT_NAME_RDN_TYPE = 2
|
|
62
|
+
CERT_NAME_ATTR_TYPE = 3
|
|
63
|
+
CERT_NAME_SIMPLE_DISPLAY_TYPE = 4
|
|
64
|
+
CERT_NAME_FRIENDLY_DISPLAY_TYPE = 5
|
|
65
|
+
CERT_NAME_DNS_TYPE = 6
|
|
66
|
+
CERT_NAME_URL_TYPE = 7
|
|
67
|
+
CERT_NAME_UPN_TYPE = 8
|
|
68
|
+
|
|
69
|
+
# Retrieve Certificates flag
|
|
70
|
+
CERT_FIND_SUBJECT_STR = 0x00080007
|
|
71
|
+
CERT_FIND_ISSUER_STR = 0x00080004
|
|
72
|
+
|
|
73
|
+
# List Certificates Flag
|
|
74
|
+
CERT_NAME_ISSUER_FLAG = 0x1
|
|
75
|
+
CERT_NAME_DISABLE_IE4_UTF8_FLAG = 0x00010000
|
|
76
|
+
CERT_NAME_SEARCH_ALL_NAMES_FLAG = 0x2
|
|
77
|
+
CERT_NAME_STR_ENABLE_PUNYCODE_FLAG = 0x00200000
|
|
78
|
+
|
|
79
|
+
# Define ffi pointer
|
|
80
|
+
HCERTSTORE = FFI::TypeDefs[:pointer]
|
|
81
|
+
HCRYPTPROV_LEGACY = FFI::TypeDefs[:pointer]
|
|
82
|
+
PCCERT_CONTEXT = FFI::TypeDefs[:pointer]
|
|
83
|
+
BYTE = FFI::TypeDefs[:pointer]
|
|
84
|
+
DWORD = FFI::TypeDefs[:uint32]
|
|
85
|
+
BLOB = FFI::TypeDefs[:ulong]
|
|
86
|
+
LPSTR = FFI::TypeDefs[:pointer]
|
|
87
|
+
LPCTSTR = FFI::TypeDefs[:pointer]
|
|
88
|
+
BOOL = FFI::TypeDefs[:bool]
|
|
89
|
+
INT_PTR = FFI::TypeDefs[:int]
|
|
90
|
+
LONG = FFI::TypeDefs[:long]
|
|
91
|
+
LPVOID = FFI::TypeDefs[:pointer]
|
|
92
|
+
LPTSTR = FFI::TypeDefs[:pointer]
|
|
93
|
+
LMSTR = FFI::TypeDefs[:pointer]
|
|
94
|
+
PWSTR = FFI::TypeDefs[:pointer]
|
|
95
|
+
LPFILETIME = FFI::TypeDefs[:pointer]
|
|
96
|
+
PCERT_INFO = FFI::TypeDefs[:pointer]
|
|
97
|
+
PCTL_USAGE = FFI::TypeDefs[:pointer]
|
|
98
|
+
PCTL_VERIFY_USAGE_PARA = FFI::TypeDefs[:pointer]
|
|
99
|
+
PCTL_VERIFY_USAGE_STATUS = FFI::TypeDefs[:pointer]
|
|
100
|
+
|
|
101
|
+
class FILETIME < FFI::Struct
|
|
102
|
+
layout :dwLowDateTime, DWORD,
|
|
103
|
+
:dwHighDateTime, DWORD
|
|
104
|
+
end
|
|
105
|
+
|
|
106
|
+
class CRYPT_INTEGER_BLOB < FFI::Struct
|
|
107
|
+
layout :cbData, DWORD, # Count, in bytes, of data
|
|
108
|
+
:pbData, :pointer # Pointer to data buffer
|
|
109
|
+
end
|
|
110
|
+
|
|
111
|
+
class CRYPT_NAME_BLOB < FFI::Struct
|
|
112
|
+
layout :cbData, DWORD, # Count, in bytes, of data
|
|
113
|
+
:pbData, :pointer # Pointer to data buffer
|
|
114
|
+
def initialize(str = nil)
|
|
115
|
+
super(nil)
|
|
116
|
+
if str
|
|
117
|
+
self[:pbData] = FFI::MemoryPointer.new(2, 128)
|
|
118
|
+
end
|
|
119
|
+
end
|
|
120
|
+
end
|
|
121
|
+
|
|
122
|
+
class CERT_EXTENSION < FFI::Struct
|
|
123
|
+
layout :pszObjId, LPTSTR,
|
|
124
|
+
:fCritical, BOOL,
|
|
125
|
+
:Value, CRYPT_INTEGER_BLOB
|
|
126
|
+
end
|
|
127
|
+
|
|
128
|
+
class CRYPT_BIT_BLOB < FFI::Struct
|
|
129
|
+
layout :cbData, DWORD,
|
|
130
|
+
:pbData, BYTE,
|
|
131
|
+
:cUnusedBits, DWORD
|
|
132
|
+
end
|
|
133
|
+
|
|
134
|
+
class CRYPT_ALGORITHM_IDENTIFIER < FFI::Struct
|
|
135
|
+
layout :pszObjId, LPSTR,
|
|
136
|
+
:Parameters, CRYPT_INTEGER_BLOB
|
|
137
|
+
end
|
|
138
|
+
|
|
139
|
+
class CERT_PUBLIC_KEY_INFO < FFI::Struct
|
|
140
|
+
layout :Algorithm, CRYPT_ALGORITHM_IDENTIFIER,
|
|
141
|
+
:PublicKey, CRYPT_BIT_BLOB
|
|
142
|
+
end
|
|
143
|
+
|
|
144
|
+
class CERT_INFO < FFI::Struct
|
|
145
|
+
layout :dwVersion, DWORD,
|
|
146
|
+
:SerialNumber, CRYPT_INTEGER_BLOB,
|
|
147
|
+
:SignatureAlgorithm, CRYPT_ALGORITHM_IDENTIFIER,
|
|
148
|
+
:Issuer, CRYPT_NAME_BLOB,
|
|
149
|
+
:NotBefore, FILETIME,
|
|
150
|
+
:NotAfter, FILETIME,
|
|
151
|
+
:Subject, CRYPT_NAME_BLOB,
|
|
152
|
+
:SubjectPublicKeyInfo, CERT_PUBLIC_KEY_INFO,
|
|
153
|
+
:IssuerUniqueId, CRYPT_BIT_BLOB,
|
|
154
|
+
:SubjectUniqueId, CRYPT_BIT_BLOB,
|
|
155
|
+
:cExtension, DWORD,
|
|
156
|
+
:rgExtension, CERT_EXTENSION
|
|
157
|
+
end
|
|
158
|
+
|
|
159
|
+
class CERT_CONTEXT < FFI::Struct
|
|
160
|
+
layout :dwCertEncodingType, DWORD,
|
|
161
|
+
:pbCertEncoded, BYTE,
|
|
162
|
+
:cbCertEncoded, DWORD,
|
|
163
|
+
:pCertInfo, CERT_INFO,
|
|
164
|
+
:hCertStore, HCERTSTORE
|
|
165
|
+
end
|
|
166
|
+
|
|
167
|
+
###############################################################################
|
|
168
|
+
# Windows Function
|
|
169
|
+
# To know description about below windows function
|
|
170
|
+
# Search Ref: https://msdn.microsoft.com/en-us/library/windows/desktop/aa376560
|
|
171
|
+
###############################################################################
|
|
172
|
+
|
|
173
|
+
# To opens the most common system certificate store
|
|
174
|
+
safe_attach_function :CertOpenSystemStoreW, [HCRYPTPROV_LEGACY, LPCTSTR], HCERTSTORE
|
|
175
|
+
# To close the already open certificate store
|
|
176
|
+
safe_attach_function :CertCloseStore, [HCERTSTORE, DWORD], BOOL
|
|
177
|
+
# To create encoded certificate context
|
|
178
|
+
safe_attach_function :CertCreateCertificateContext, [DWORD, BYTE, DWORD], PCCERT_CONTEXT
|
|
179
|
+
# To retrieves certificates in a certificate store
|
|
180
|
+
safe_attach_function :CertEnumCertificatesInStore, [HCERTSTORE, PCCERT_CONTEXT], PCCERT_CONTEXT
|
|
181
|
+
# To get certificate name
|
|
182
|
+
safe_attach_function :CertGetNameStringW, [PCCERT_CONTEXT, DWORD, DWORD, LPVOID, LPTSTR, DWORD], DWORD
|
|
183
|
+
# To find all of the property identifiers for the specified certificate.
|
|
184
|
+
safe_attach_function :CertEnumCertificateContextProperties, [PCCERT_CONTEXT, DWORD], DWORD
|
|
185
|
+
# Clean up
|
|
186
|
+
safe_attach_function :CertFreeCertificateContext, [PCCERT_CONTEXT], BOOL
|
|
187
|
+
# Add certificate file in certificate store.
|
|
188
|
+
safe_attach_function :CertAddSerializedElementToStore, [HCERTSTORE, :pointer, DWORD, DWORD, DWORD, DWORD, LMSTR, LPVOID], BOOL
|
|
189
|
+
# Add certification to certification store - Ref: https://msdn.microsoft.com/en-us/library/windows/desktop/aa376015(v=vs.85).aspx
|
|
190
|
+
safe_attach_function :CertAddEncodedCertificateToStore, [HCERTSTORE, DWORD, PWSTR, DWORD, INT_PTR, PCCERT_CONTEXT], BOOL
|
|
191
|
+
safe_attach_function :CertSerializeCertificateStoreElement, [PCCERT_CONTEXT, DWORD, :pointer, DWORD], BOOL
|
|
192
|
+
# Duplicates a certificate context by incrementing its reference count
|
|
193
|
+
safe_attach_function :CertDuplicateCertificateContext, [PCCERT_CONTEXT], PCCERT_CONTEXT
|
|
194
|
+
# Delete certification from certification store
|
|
195
|
+
safe_attach_function :CertDeleteCertificateFromStore, [PCCERT_CONTEXT], BOOL
|
|
196
|
+
# To retrieve specific certificates from certificate store
|
|
197
|
+
safe_attach_function :CertFindCertificateInStore, [HCERTSTORE, DWORD, DWORD, DWORD, LPVOID, PCCERT_CONTEXT], PCCERT_CONTEXT
|
|
198
|
+
|
|
199
|
+
safe_attach_function :PFXExportCertStoreEx, [HCERTSTORE, CRYPT_INTEGER_BLOB, LPCTSTR, LPVOID, DWORD], BOOL
|
|
200
|
+
end
|
|
201
|
+
end
|
|
202
|
+
end
|
|
203
|
+
end
|