win32-certstore 0.2.2 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fdfde36cb468d1ce15e0d5fd317783347f07c96f0282519b56b86b424d89e92e
-  data.tar.gz: a4ce61aafb784b12bf5e7ee28958221c4318500d78ec2ac23f3d700e7528d466
+  metadata.gz: a571cfa5aea1f77ed28c7711fe81982338d7af42a73f886cfbdfe6df3123fc91
+  data.tar.gz: cb36e5aba55afe58af9a7770f330f276ad7013fe86f7d51dd1d9d372b7a9a598
 SHA512:
-  metadata.gz: 3f1ff03dc3ac803b951179683c48bdef81ea481f12c0a1838e9d236085e4451d2698a3f488da855bbc44bdbf037d6fdc753113309ef0838b2b61fab425cc8040
-  data.tar.gz: 61ac2a5b3f1cbceb606822c07dfdfec2b5b76e1ba91820f4f7571c094f16c10ffeba292e9772abf3938eba537951426d8c8ef8f09ddcf5b1bc74cbf0367435ce
+  metadata.gz: 94138aaef753c7b9830e7374fc80d53ae531c85f14677f3fc72eb4234744ee7c21737b0ee8f41d530deeec0e433196ec1acacc1792468ed0849b995ee0fab754
+  data.tar.gz: 5710436ecefe40dc2883375d4317d333189ef0b7896b27dd3c31e0ccf1beab9d321edab6cae714b365492aec5420853a0ec8d53cb18dd006f61ecfa1e85c8a4a

data/lib/win32/certstore.rb

@@ -53,6 +53,21 @@ module Win32
       cert_add(certstore_handler, certificate_obj)
     end
 
+    # Adds a PFX certificate to certificate store
+    #
+    # @note Unlike other certificates, PFX can be password protected and may contain a private key.
+    #       Therefore we need a different approach to import them.
+    #
+    # @param path [String] Path of the certificate that should be imported
+    # @param password [String] Password of the certificate if it is protected
+    # @param key_properties [Integer] dwFlags used to specify properties of the pfx key, see certstore/store_base.rb cert_add_pfx function
+    #
+    # @return [Boolean]
+    #
+    def add_pfx(path, password, key_properties = 0)
+      cert_add_pfx(certstore_handler, path, password, key_properties)
+    end
+
     # Return `OpenSSL::X509` certificate object
     # @param request [thumbprint<string>] of certificate
     # @return [Object] of certificates in OpenSSL::X509 format
@@ -90,11 +105,7 @@ module Win32
 
     # To close and destroy pointer of open certificate store handler
     def close
-      closed = CertCloseStore(@certstore_handler, CERT_CLOSE_STORE_FORCE_FLAG)
-      unless closed
-        last_error = FFI::LastError.error
-        raise SystemCallError.new("Unable to close the Certificate Store.", last_error)
-      end
+      close_cert_store
       remove_finalizer
     end
 

data/lib/win32/certstore/mixin/assertions.rb

@@ -14,7 +14,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-require "openssl"
+require "openssl" unless defined?(OpenSSL)
 
 module Win32
   class Certstore

data/lib/win32/certstore/mixin/crypto.rb

@@ -16,7 +16,7 @@
 # limitations under the License.
 #
 
-require "ffi"
+require "ffi" unless defined?(FFI)
 
 module Win32
   class Certstore
@@ -68,12 +68,17 @@ module Win32
         CERT_NAME_UPN_TYPE                                  = 8
 
         # Retrieve Certificates flag
+        CERT_COMPARE_ANY                                    = 0
         CERT_COMPARE_SHA1_HASH                              = 1
         CERT_INFO_SUBJECT_FLAG                              = 7
         CERT_COMPARE_NAME_STR_W                             = 8
         CERT_COMPARE_SHIFT                                  = 16
         CERT_FIND_SHA1_HASH                                 = CERT_COMPARE_SHA1_HASH << CERT_COMPARE_SHIFT
         CERT_FIND_SUBJECT_STR                               = CERT_COMPARE_NAME_STR_W << CERT_COMPARE_SHIFT | CERT_INFO_SUBJECT_FLAG
+        CERT_FIND_ANY                                       = CERT_COMPARE_ANY << CERT_COMPARE_SHIFT
+
+        CERT_STORE_ADD_USE_EXISTING                         = 2
+        CERT_STORE_ADD_REPLACE_EXISTING                     = 3
 
         # List Certificates Flag
         CERT_NAME_ISSUER_FLAG                               = 0x1
@@ -108,17 +113,17 @@ module Win32
 
         class FILETIME < FFI::Struct
           layout :dwLowDateTime, DWORD,
-                 :dwHighDateTime, DWORD
+            :dwHighDateTime, DWORD
         end
 
         class CRYPT_INTEGER_BLOB < FFI::Struct
           layout :cbData, DWORD, # Count, in bytes, of data
-                 :pbData, :pointer # Pointer to data buffer
+            :pbData, :pointer # Pointer to data buffer
         end
 
         class CRYPT_NAME_BLOB < FFI::Struct
           layout :cbData, DWORD, # Count, in bytes, of data
-                 :pbData, :pointer # Pointer to data buffer
+            :pbData, :pointer # Pointer to data buffer
           def initialize(str = nil)
             super(nil)
             if str
@@ -129,7 +134,7 @@ module Win32
 
         class CRYPT_HASH_BLOB < FFI::Struct
           layout :cbData, DWORD, # Count, in bytes, of data
-                 :pbData, :pointer # Pointer to data buffer
+            :pbData, :pointer # Pointer to data buffer
 
           def initialize(str = nil)
             super(nil)
@@ -144,49 +149,62 @@ module Win32
           end
         end
 
+        class CRYPT_DATA_BLOB < FFI::Struct
+          layout :cbData, DWORD, # Count, in bytes, of data
+            :pbData, :pointer # Pointer to data buffer
+
+          def initialize(str = nil)
+            super(nil)
+            if str
+              self[:pbData] = FFI::MemoryPointer.from_string(str)
+              self[:cbData] = str.size
+            end
+          end
+        end
+
         class CERT_EXTENSION < FFI::Struct
           layout :pszObjId, LPTSTR,
-                 :fCritical, BOOL,
-                 :Value, CRYPT_INTEGER_BLOB
+            :fCritical, BOOL,
+            :Value, CRYPT_INTEGER_BLOB
         end
 
         class CRYPT_BIT_BLOB < FFI::Struct
           layout :cbData, DWORD,
-                 :pbData, BYTE,
-                 :cUnusedBits, DWORD
+            :pbData, BYTE,
+            :cUnusedBits, DWORD
         end
 
         class CRYPT_ALGORITHM_IDENTIFIER < FFI::Struct
           layout :pszObjId, LPSTR,
-                 :Parameters, CRYPT_INTEGER_BLOB
+            :Parameters, CRYPT_INTEGER_BLOB
         end
 
         class CERT_PUBLIC_KEY_INFO < FFI::Struct
           layout :Algorithm, CRYPT_ALGORITHM_IDENTIFIER,
-                 :PublicKey, CRYPT_BIT_BLOB
+            :PublicKey, CRYPT_BIT_BLOB
         end
 
         class CERT_INFO < FFI::Struct
           layout :dwVersion, DWORD,
-               :SerialNumber, CRYPT_INTEGER_BLOB,
-               :SignatureAlgorithm, CRYPT_ALGORITHM_IDENTIFIER,
-               :Issuer, CRYPT_NAME_BLOB,
-               :NotBefore, FILETIME,
-               :NotAfter, FILETIME,
-               :Subject, CRYPT_NAME_BLOB,
-               :SubjectPublicKeyInfo, CERT_PUBLIC_KEY_INFO,
-               :IssuerUniqueId, CRYPT_BIT_BLOB,
-               :SubjectUniqueId, CRYPT_BIT_BLOB,
-               :cExtension, DWORD,
-               :rgExtension, CERT_EXTENSION
+            :SerialNumber, CRYPT_INTEGER_BLOB,
+            :SignatureAlgorithm, CRYPT_ALGORITHM_IDENTIFIER,
+            :Issuer, CRYPT_NAME_BLOB,
+            :NotBefore, FILETIME,
+            :NotAfter, FILETIME,
+            :Subject, CRYPT_NAME_BLOB,
+            :SubjectPublicKeyInfo, CERT_PUBLIC_KEY_INFO,
+            :IssuerUniqueId, CRYPT_BIT_BLOB,
+            :SubjectUniqueId, CRYPT_BIT_BLOB,
+            :cExtension, DWORD,
+            :rgExtension, CERT_EXTENSION
         end
 
         class CERT_CONTEXT < FFI::Struct
           layout :dwCertEncodingType, DWORD,
-                 :pbCertEncoded, BYTE,
-                 :cbCertEncoded, DWORD,
-                 :pCertInfo, CERT_INFO,
-                 :hCertStore, HCERTSTORE
+            :pbCertEncoded, BYTE,
+            :cbCertEncoded, DWORD,
+            :pCertInfo, CERT_INFO,
+            :hCertStore, HCERTSTORE
         end
 
         ###############################################################################
@@ -224,6 +242,10 @@ module Win32
         safe_attach_function :CertFindCertificateInStore, [HCERTSTORE, DWORD, DWORD, DWORD, LPVOID, PCCERT_CONTEXT], PCCERT_CONTEXT
 
         safe_attach_function :PFXExportCertStoreEx, [HCERTSTORE, CRYPT_INTEGER_BLOB, LPCTSTR, LPVOID, DWORD], BOOL
+
+        # Fetches store handler of a PFX certificate
+        attach_function :PFXImportCertStore, [CRYPT_DATA_BLOB, LPCTSTR, DWORD], HCERTSTORE
+        attach_function :CertAddCertificateContextToStore, [HCERTSTORE, PCCERT_CONTEXT, DWORD, PCCERT_CONTEXT], BOOL
       end
     end
   end

data/lib/win32/certstore/mixin/shell_out.rb

@@ -15,7 +15,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-require "mixlib/shellout"
+require "mixlib/shellout" unless defined?(Mixlib::ShellOut)
 
 module Win32
   class Certstore
@@ -28,6 +28,7 @@ module Win32
           if cmd.error!
             raise Mixlib::ShellOut::ShellCommandFailed, cmd.error!
           end
+
           cmd
         end
 
@@ -96,7 +97,7 @@ module Win32
             "-InputFormat None",
           ]
 
-          "powershell.exe #{flags.join(' ')} -Command \"#{script.gsub('"', '\"')}\""
+          "powershell.exe #{flags.join(" ")} -Command \"#{script.gsub('"', '\"')}\""
         end
       end
     end

data/lib/win32/certstore/store_base.rb

@@ -19,8 +19,8 @@ require_relative "mixin/crypto"
 require_relative "mixin/string"
 require_relative "mixin/shell_out"
 require_relative "mixin/unicode"
-require "openssl"
-require "json"
+require "openssl" unless defined?(OpenSSL)
+require "json" unless defined?(JSON)
 
 module Win32
   class Certstore
@@ -49,6 +49,42 @@ module Win32
         end
       end
 
+      # Adds a PFX certificate to certificate store
+      #
+      # @see https://docs.microsoft.com/en-us/windows/desktop/api/wincrypt/nf-wincrypt-pfximportcertstore PFXImportCertStore function
+      # @see https://docs.microsoft.com/en-us/windows/desktop/api/wincrypt/nf-wincrypt-certaddcertificatecontexttostore CertAddCertificateContextToStore
+      #
+      # @param certstore_handler [FFI::Pointer] Handle of the store where certificate should be imported
+      # @param path [String] Path of the certificate that should be imported
+      # @param password [String] Password of the certificate
+      # @param key_properties [Integer] dwFlags used to specify properties of the pfx key, see link above
+      #
+      # @return [Boolean]
+      #
+      # @raise [SystemCallError] when Crypt API would not be able to perform some action
+      #
+      def cert_add_pfx(certstore_handler, path, password = "", key_properties = 0)
+        cert_added = false
+        # Imports a PFX BLOB and returns the handle of a store
+        pfx_cert_store = PFXImportCertStore(CRYPT_DATA_BLOB.new(File.binread(path)), wstring(password), key_properties)
+        raise if pfx_cert_store.null?
+
+        # Find all the certificate contexts in certificate store and add them ino the store
+        while (cert_context = CertEnumCertificatesInStore(pfx_cert_store, cert_context)) && (not cert_context.null?)
+          # Add certificate context to the certificate store
+          args = add_certcontxt_args(certstore_handler, cert_context)
+          cert_added = CertAddCertificateContextToStore(*args)
+          raise unless cert_added
+        end
+        cert_added
+      rescue
+        lookup_error("Add a PFX")
+      ensure
+        if pfx_cert_store && !pfx_cert_store.null?
+          close_cert_store(pfx_cert_store)
+        end
+      end
+
       # Get certificate from open certificate store and return certificate object
       # certificate_thumbprint => thumbprint is a hash. which could be sha1 or md5.
       def cert_get(certificate_thumbprint)
@@ -89,7 +125,7 @@ module Win32
         begin
           cert_args = cert_find_args(store_handler, thumbprint)
           pcert_context = CertFindCertificateInStore(*cert_args)
-          if !pcert_context.null?
+          unless pcert_context.null?
             cert_delete_flag = CertDeleteCertificateFromStore(CertDuplicateCertificateContext(pcert_context)) || lookup_error
           end
           CertFreeCertificateContext(pcert_context)
@@ -115,6 +151,7 @@ module Win32
       # search_token => CN, RDN or any certificate attribute
       def cert_search(store_handler, search_token)
         raise ArgumentError, "Invalid search token" if !search_token || search_token.strip.empty?
+
         certificate_list = []
         begin
           while (pcert_context = CertEnumCertificatesInStore(store_handler, pcert_context)) && !pcert_context.null?
@@ -130,6 +167,12 @@ module Win32
         certificate_list
       end
 
+      # To close and destroy pointer of open certificate store handler
+      def close_cert_store(certstore_handler = @certstore_handler)
+        closed = CertCloseStore(certstore_handler, CERT_CLOSE_STORE_FORCE_FLAG)
+        lookup_error("close") unless closed
+      end
+
       private
 
       # Build arguments for CertAddEncodedCertificateToStore
@@ -142,6 +185,11 @@ module Win32
         [store_handler, ENCODING_TYPE, 0, CERT_FIND_SHA1_HASH, CRYPT_HASH_BLOB.new(thumbprint), nil]
       end
 
+      # Build arguments for CertAddCertificateContextToStore
+      def add_certcontxt_args(certstore_handler, cert_context)
+        [certstore_handler, cert_context, CERT_STORE_ADD_REPLACE_EXISTING, nil]
+      end
+
       # Match certificate CN exist in cert_rdn
       def is_cn_match?(cert_rdn, certificate_name)
         cert_rdn.read_wstring.match(/(^|\W)#{certificate_name}($|\W)/i)
@@ -172,6 +220,7 @@ module Win32
       # Verify OpenSSL::X509::Certificate object
       def verify_certificate(cert_pem)
         return "Certificate not found" if cert_pem.empty?
+
         valid_duration?(build_openssl_obj(cert_pem))
       end
 

data/lib/win32/certstore/version.rb

@@ -1,6 +1,6 @@
 module Win32
   class Certstore
-    VERSION = "0.2.2".freeze
+    VERSION = "0.4.1".freeze
     MAJOR, MINOR, TINY = VERSION.split(".")
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: win32-certstore
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.4.1
 platform: ruby
 authors:
 - Chef Software
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-01-16 00:00:00.000000000 Z
+date: 2020-08-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -104,8 +104,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Ruby library for accessing the certificate store on Windows.