FM / _win

/var/opt/nydus/ops/oscrypto/_win

Name	Size	Mode	Actions
__pycache__/	-	0755	rm
asymmetric.py	122315	0644	edit dl rm
symmetric.py	30875	0644	edit dl rm
tls.py	59042	0644	edit dl rm
trust_list.py	8144	0644	edit dl rm
util.py	5234	0644	edit dl rm
_advapi32.py	4350	0644	edit dl rm
_advapi32_cffi.py	4600	0644	edit dl rm
_advapi32_ctypes.py	7486	0644	edit dl rm
_cng.py	4503	0644	edit dl rm
_cng_cffi.py	4478	0644	edit dl rm
_cng_ctypes.py	6155	0644	edit dl rm
_crypt32.py	1897	0644	edit dl rm
_crypt32_cffi.py	5920	0644	edit dl rm
_crypt32_ctypes.py	8220	0644	edit dl rm
_decode.py	913	0644	edit dl rm
_kernel32.py	806	0644	edit dl rm
_kernel32_cffi.py	932	0644	edit dl rm
_kernel32_ctypes.py	1269	0644	edit dl rm
_secur32.py	3969	0644	edit dl rm
_secur32_cffi.py	3967	0644	edit dl rm
_secur32_ctypes.py	5305	0644	edit dl rm
__init__.py	0	0644	edit dl rm

Edit: /var/opt/nydus/ops/oscrypto/_win/trust_list.py (8144B)

# coding: utf-8
from __future__ import unicode_literals, division, absolute_import, print_function

import datetime
import hashlib
import struct

from .._asn1 import Certificate
from .._ffi import (
    array_from_pointer,
    buffer_from_bytes,
    bytes_from_buffer,
    cast,
    deref,
    is_null,
    new,
    null,
    struct_from_buffer,
    unwrap,
)
from ._crypt32 import crypt32, Crypt32Const, get_error, handle_error
from .._types import str_cls

__all__ = [
    'extract_from_system',
    'system_path',
]

def system_path():
    return None

def extract_from_system(cert_callback=None, callback_only_on_failure=False):
    """
    Extracts trusted CA certificates from the Windows certificate store

:param cert_callback:
        A callback that is called once for each certificate in the trust store.
        It should accept two parameters: an asn1crypto.x509.Certificate object,
        and a reason. The reason will be None if the certificate is being
        exported, otherwise it will be a unicode string of the reason it won't.

:param callback_only_on_failure:
        A boolean - if the callback should only be called when a certificate is
        not exported.

:raises:
        OSError - when an error is returned by the OS crypto library

:return:
        A list of 3-element tuples:
         - 0: a byte string of a DER-encoded certificate
         - 1: a set of unicode strings that are OIDs of purposes to trust the
              certificate for
         - 2: a set of unicode strings that are OIDs of purposes to reject the
              certificate for
    """

certificates = {}
    processed = {}

now = datetime.datetime.utcnow()

for store in ["ROOT", "CA"]:
        store_handle = crypt32.CertOpenSystemStoreW(null(), store)
        handle_error(store_handle)

context_pointer = null()
        while True:
            context_pointer = crypt32.CertEnumCertificatesInStore(store_handle, context_pointer)
            if is_null(context_pointer):
                break
            context = unwrap(context_pointer)

trust_all = False
            data = None
            digest = None

if context.dwCertEncodingType != Crypt32Const.X509_ASN_ENCODING:
                continue

data = bytes_from_buffer(context.pbCertEncoded, int(context.cbCertEncoded))
            digest = hashlib.sha1(data).digest()
            if digest in processed:
                continue

processed[digest] = True
            cert_info = unwrap(context.pCertInfo)

not_before_seconds = _convert_filetime_to_timestamp(cert_info.NotBefore)
            try:
                not_before = datetime.datetime.fromtimestamp(not_before_seconds)
                if not_before > now:
                    if cert_callback:
                        cert_callback(Certificate.load(data), 'not yet valid')
                    continue
            except (ValueError, OSError):
                # If there is an error converting the not before timestamp,
                # it is almost certainly because it is from too long ago,
                # which means the cert is definitely valid by now.
                pass

not_after_seconds = _convert_filetime_to_timestamp(cert_info.NotAfter)
            try:
                not_after = datetime.datetime.fromtimestamp(not_after_seconds)
                if not_after < now:
                    if cert_callback:
                        cert_callback(Certificate.load(data), 'no longer valid')
                    continue
            except (ValueError, OSError) as e:
                # The only reason we would get an exception here is if the
                # expiration time is so far in the future that it can't be
                # used as a timestamp, or it is before 0. If it is very far
                # in the future, the cert is still valid, so we only raise
                # an exception if the timestamp is less than zero.
                if not_after_seconds < 0:
                    message = e.args[0] + ' - ' + str_cls(not_after_seconds)
                    e.args = (message,) + e.args[1:]
                    raise e

trust_oids = set()
            reject_oids = set()

# Here we grab the extended key usage properties that Windows
            # layers on top of the extended key usage extension that is
            # part of the certificate itself. For highest security, users
            # should only use certificates for the intersection of the two
            # lists of purposes. However, many seen to treat the OS trust
            # list as an override.
            to_read = new(crypt32, 'DWORD *', 0)
            res = crypt32.CertGetEnhancedKeyUsage(
                context_pointer,
                Crypt32Const.CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG,
                null(),
                to_read
            )

# Per the Microsoft documentation, if CRYPT_E_NOT_FOUND is returned
            # from get_error(), it means the certificate is valid for all purposes
            error_code, _ = get_error()
            if not res and error_code != Crypt32Const.CRYPT_E_NOT_FOUND:
                handle_error(res)

if error_code == Crypt32Const.CRYPT_E_NOT_FOUND:
                trust_all = True
            else:
                usage_buffer = buffer_from_bytes(deref(to_read))
                res = crypt32.CertGetEnhancedKeyUsage(
                    context_pointer,
                    Crypt32Const.CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG,
                    cast(crypt32, 'CERT_ENHKEY_USAGE *', usage_buffer),
                    to_read
                )
                handle_error(res)

key_usage_pointer = struct_from_buffer(crypt32, 'CERT_ENHKEY_USAGE', usage_buffer)
                key_usage = unwrap(key_usage_pointer)

# Having no enhanced usage properties means a cert is distrusted
                if key_usage.cUsageIdentifier == 0:
                    if cert_callback:
                        cert_callback(Certificate.load(data), 'explicitly distrusted')
                    continue

oids = array_from_pointer(
                    crypt32,
                    'LPCSTR',
                    key_usage.rgpszUsageIdentifier,
                    key_usage.cUsageIdentifier
                )
                for oid in oids:
                    trust_oids.add(oid.decode('ascii'))

cert = None

# If the certificate is not under blanket trust, we have to
            # determine what purposes it is rejected for by diffing the
            # set of OIDs from the certificate with the OIDs that are
            # trusted.
            if not trust_all:
                cert = Certificate.load(data)
                if cert.extended_key_usage_value:
                    for cert_oid in cert.extended_key_usage_value:
                        oid = cert_oid.dotted
                        if oid not in trust_oids:
                            reject_oids.add(oid)

if cert_callback and not callback_only_on_failure:
                if cert is None:
                    cert = Certificate.load(data)
                cert_callback(cert, None)

certificates[digest] = (data, trust_oids, reject_oids)

result = crypt32.CertCloseStore(store_handle, 0)
        handle_error(result)
        store_handle = None

return certificates.values()

def _convert_filetime_to_timestamp(filetime):
    """
    Windows returns times as 64-bit unsigned longs that are the number
    of hundreds of nanoseconds since Jan 1 1601. This converts it to
    a datetime object.

:param filetime:
        A FILETIME struct object

:return:
        An integer unix timestamp
    """

hundreds_nano_seconds = struct.unpack(
        b'>Q',
        struct.pack(
            b'>LL',
            filetime.dwHighDateTime,
            filetime.dwLowDateTime
        )
    )[0]
    seconds_since_1601 = hundreds_nano_seconds / 10000000
    return seconds_since_1601 - 11644473600  # Seconds from Jan 1 1601 to Jan 1 1970

cmd: