From steven at manross.net  Sun Nov  1 20:12:17 2020
From: steven at manross.net (Steven Manross)
Date: Mon, 2 Nov 2020 01:12:17 +0000
Subject: [python-win32] IIS and ASP: If blocks that span multiple code blocks
Message-ID: <ee11b32e42b644d0b0afa23bf215235e@manross.net>

I was wondering if there's any way to support this style of coding in ASP/Python.

This works in VBScript (but I'm trying to remove all my VBScript), but I seem to be getting hit by the fact that each block of code is being analyzed as a single block of code and the "if" not being able to span multiple code blocks.

#VBScript
<%
If This = "THAT" Then
    Response.Write("BEFORE")
%>
    This does == THAT<BR>
    <!-- #include virtual="/inc/whatever.vbscriptincludefile" -->
<%
    Response.Write("AFTER<BR>")
End If
%>

What I am trying to show you is that in VBScript, an IF block can span the multiple code regions (<% code %>) and conditionally display the HTML in between the IF and END IF if the condition matches

Note that in VBScript if This = "THAT", this VBScript would display:

BEFORE<BR>
This does == THAT<BR>
 *** whatever the include file displayed 
AFTER<BR>

And of course, if This <> "THAT" it wouldn't display anything from above!

However in Python, and a similarly structured code-block:

#Python
<%
if This == "THAT":
    Response.Write("BEFORE<BR>")
%>
    This does == THAT<BR>
    <!-- #include virtual="/inc/whatever.pythonincludefile" -->
<%
Response.Write("AFTER<BR>")
%>

In python, We would get (if This == "THAT"):

BEFORE
This does == THAT<BR>
 *** and whatever the include file displayed (if the include file had no additional logic to filter the data)
AFTER<BR>

However, in python, we would get (if This != "THAT"):

This does == THAT<BR>
 *** and whatever the include file displayed (if the include file had no additional logic to filter the data)
AFTER<BR>

Lastly, if I indent the Response.Write("AFTER<BR>") in this second code block to try and span the code block to the same conditional started in the first code block, I get a syntax error like this:

unexpected indent
/folder/somefile.asp, line ###
    Response.Write("AFTER<BR>")
---^

is there any way around this without doing a lot of other if blocks in each section of <% code %>

It sounds like an RFE to me (and probably not an easy one), but maybe I'm missing something?

IIS on W2016 (most recent patches)
Activestate Python: 3.8.2
pywin32==227

Please and Thank You,
Steven

From skippy.hammond at gmail.com  Mon Nov  2 17:49:41 2020
From: skippy.hammond at gmail.com (Mark Hammond)
Date: Tue, 3 Nov 2020 09:49:41 +1100
Subject: [python-win32] IIS and ASP: If blocks that span multiple code
 blocks
In-Reply-To: <ee11b32e42b644d0b0afa23bf215235e@manross.net>
References: <ee11b32e42b644d0b0afa23bf215235e@manross.net>
Message-ID: <fcef560c-4cbe-2245-9fd7-5861c9464455@gmail.com>

IIS/ASP sends Python different strings to evaluate, and Python evaluates 
them individually. It's much like wanting Python code such as:

if foo:
   bar()

To be handled in Python by using:

 >>> exec("if foo:\n")
 >>> exec("  bar()\n")

Which doesn't work.

The semantics are largely defined by the "Active Scripting" 
specifications. I haven't kept up with that recently, so it's possible 
there have been enhancements to that spec which might make this 
possible, but if there were, they would have been targeted at making 
languages offered directly by MS better than Python.

So I'm afraid that I think you are out of luck.

Cheers,

Mark

On 2/11/2020 12:12 pm, Steven Manross wrote:
> I was wondering if there's any way to support this style of coding in ASP/Python.
> 
> This works in VBScript (but I'm trying to remove all my VBScript), but I seem to be getting hit by the fact that each block of code is being analyzed as a single block of code and the "if" not being able to span multiple code blocks.
> 
> #VBScript
> <%
> If This = "THAT" Then
>      Response.Write("BEFORE")
> %>
>      This does == THAT<BR>
>      <!-- #include virtual="/inc/whatever.vbscriptincludefile" -->
> <%
>      Response.Write("AFTER<BR>")
> End If
> %>
> 
> What I am trying to show you is that in VBScript, an IF block can span the multiple code regions (<% code %>) and conditionally display the HTML in between the IF and END IF if the condition matches
> 
> Note that in VBScript if This = "THAT", this VBScript would display:
> 
> BEFORE<BR>
> This does == THAT<BR>
>   *** whatever the include file displayed
> AFTER<BR>
> 
> And of course, if This <> "THAT" it wouldn't display anything from above!
> 
> However in Python, and a similarly structured code-block:
> 
> #Python
> <%
> if This == "THAT":
>      Response.Write("BEFORE<BR>")
> %>
>      This does == THAT<BR>
>      <!-- #include virtual="/inc/whatever.pythonincludefile" -->
> <%
> Response.Write("AFTER<BR>")
> %>
> 
> In python, We would get (if This == "THAT"):
> 
> BEFORE
> This does == THAT<BR>
>   *** and whatever the include file displayed (if the include file had no additional logic to filter the data)
> AFTER<BR>
> 
> However, in python, we would get (if This != "THAT"):
> 
> This does == THAT<BR>
>   *** and whatever the include file displayed (if the include file had no additional logic to filter the data)
> AFTER<BR>
> 
> Lastly, if I indent the Response.Write("AFTER<BR>") in this second code block to try and span the code block to the same conditional started in the first code block, I get a syntax error like this:
> 
> unexpected indent
> /folder/somefile.asp, line ###
>      Response.Write("AFTER<BR>")
> ---^
> 
> is there any way around this without doing a lot of other if blocks in each section of <% code %>
> 
> It sounds like an RFE to me (and probably not an easy one), but maybe I'm missing something?
> 
> IIS on W2016 (most recent patches)
> Activestate Python: 3.8.2
> pywin32==227
> 
> Please and Thank You,
> Steven
> _______________________________________________
> python-win32 mailing list
> python-win32 at python.org
> https://mail.python.org/mailman/listinfo/python-win32
> 


From steven at manross.net  Tue Nov  3 10:13:24 2020
From: steven at manross.net (Steven Manross)
Date: Tue, 3 Nov 2020 15:13:24 +0000
Subject: [python-win32] IIS and ASP: If blocks that span multiple code
 blocks
In-Reply-To: <fcef560c-4cbe-2245-9fd7-5861c9464455@gmail.com>
References: <ee11b32e42b644d0b0afa23bf215235e@manross.net>
 <fcef560c-4cbe-2245-9fd7-5861c9464455@gmail.com>
Message-ID: <732604db820448aabad819e7e7a8a6a2@manross.net>

Thanks for the reply!

Just an FYI...  This VBScript/ASP code/behavior is probably 10+ years old.

I've already started adapting the python code understanding that it wasn?t likely possible (or was going to take a major RFE that wasn't likely coming any time soon) - and it all works well now.

I hope this helps someone searching the internet for answers to how Python & VBScript in ASP behave differently.

I don?t put it past Microsoft to give their technologies an advantage over other scripting languages when it comes to things like this.

Kudos to everyone's work/documentation on python-win32 and the pywin32 libraries.  This is amazing work, and I super-appreciate it all!  

The coding to translate a VBScript project was pretty seamless, except when it came to "Scripting.Dictionary" objects (some weird edge cases on manipulating items after they were created), and in that case, I just converted to python dictionaries since they are SO flexible and come OOTB without need for COM objects (like in VBScript).

HTH someone

Steven
-----Original Message-----
From: Mark Hammond <skippy.hammond at gmail.com> 
Sent: Monday, November 02, 2020 3:50 PM
To: Steven Manross <steven at manross.net>; python-win32 at python.org
Subject: Re: [python-win32] IIS and ASP: If blocks that span multiple code blocks

IIS/ASP sends Python different strings to evaluate, and Python evaluates them individually. It's much like wanting Python code such as:

if foo:
   bar()

To be handled in Python by using:

 >>> exec("if foo:\n")
 >>> exec("  bar()\n")

Which doesn't work.

The semantics are largely defined by the "Active Scripting" 
specifications. I haven't kept up with that recently, so it's possible there have been enhancements to that spec which might make this possible, but if there were, they would have been targeted at making languages offered directly by MS better than Python.

So I'm afraid that I think you are out of luck.

Cheers,

Mark

On 2/11/2020 12:12 pm, Steven Manross wrote:
> I was wondering if there's any way to support this style of coding in ASP/Python.
> 
> This works in VBScript (but I'm trying to remove all my VBScript), but I seem to be getting hit by the fact that each block of code is being analyzed as a single block of code and the "if" not being able to span multiple code blocks.
> 
> #VBScript
> <%
> If This = "THAT" Then
>      Response.Write("BEFORE")
> %>
>      This does == THAT<BR>
>      <!-- #include virtual="/inc/whatever.vbscriptincludefile" --> <%
>      Response.Write("AFTER<BR>")
> End If
> %>
> 
> What I am trying to show you is that in VBScript, an IF block can span 
> the multiple code regions (<% code %>) and conditionally display the 
> HTML in between the IF and END IF if the condition matches
> 
> Note that in VBScript if This = "THAT", this VBScript would display:
> 
> BEFORE<BR>
> This does == THAT<BR>
>   *** whatever the include file displayed AFTER<BR>
> 
> And of course, if This <> "THAT" it wouldn't display anything from above!
> 
> However in Python, and a similarly structured code-block:
> 
> #Python
> <%
> if This == "THAT":
>      Response.Write("BEFORE<BR>")
> %>
>      This does == THAT<BR>
>      <!-- #include virtual="/inc/whatever.pythonincludefile" --> <%
> Response.Write("AFTER<BR>")
> %>
> 
> In python, We would get (if This == "THAT"):
> 
> BEFORE
> This does == THAT<BR>
>   *** and whatever the include file displayed (if the include file had 
> no additional logic to filter the data) AFTER<BR>
> 
> However, in python, we would get (if This != "THAT"):
> 
> This does == THAT<BR>
>   *** and whatever the include file displayed (if the include file had 
> no additional logic to filter the data) AFTER<BR>
> 
> Lastly, if I indent the Response.Write("AFTER<BR>") in this second code block to try and span the code block to the same conditional started in the first code block, I get a syntax error like this:
> 
> unexpected indent
> /folder/somefile.asp, line ###
>      Response.Write("AFTER<BR>")
> ---^
> 
> is there any way around this without doing a lot of other if blocks in 
> each section of <% code %>
> 
> It sounds like an RFE to me (and probably not an easy one), but maybe I'm missing something?
> 
> IIS on W2016 (most recent patches)
> Activestate Python: 3.8.2
> pywin32==227
> 
> Please and Thank You,
> Steven
> _______________________________________________
> python-win32 mailing list
> python-win32 at python.org
> https://mail.python.org/mailman/listinfo/python-win32
> 


From bobfang1992 at gmail.com  Thu Nov 12 15:32:10 2020
From: bobfang1992 at gmail.com (Bob Fang)
Date: Thu, 12 Nov 2020 20:32:10 +0000
Subject: [python-win32] Server Exectuion Failed
Message-ID: <CANVf7NX+7wsKHFO_RQVrw2wt2H3nz4pA7YKu8BCqX1wq14k90A@mail.gmail.com>

Hi,

I have an application which utilise win32com to control a software
(powerworld if you know what it is). Once I have dispatched a new object I
can see in task manager there is a new process created which is running and
I can call command through the win32com object -- this is what I want to do
and suits me well but I noticed two things:

1. The process I created seems to be persistent and will not die even if I
explicitly deleted my object using `del` in Python. Is there a way to fully
close the process after I am done with my object?

2. There seems to be a maximum number of instance I can create of this app
and after I have reached this number I will get this following error, the
only way to get rid of this error is to restart my Windows machine. I am
just wondering if there is any config I need to change to allow unlimited
number of instances? I think it is also worth mentioning that I run
multiple objects at concurrently with an actor mode library (pykka) and on
each separate thread I call coInitailise, but I am not calling
coUninitialse at this moment. Might this be the cause of the problem here?

pywintypes.com_error: (-2146959355, 'Server execution failed', None, None)


Thanks a lot.

Best,
B
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.python.org/pipermail/python-win32/attachments/20201112/004a74ff/attachment.html>

From timr at probo.com  Thu Nov 12 23:02:58 2020
From: timr at probo.com (Tim Roberts)
Date: Thu, 12 Nov 2020 20:02:58 -0800
Subject: [python-win32] Server Exectuion Failed
In-Reply-To: <CANVf7NX+7wsKHFO_RQVrw2wt2H3nz4pA7YKu8BCqX1wq14k90A@mail.gmail.com>
References: <CANVf7NX+7wsKHFO_RQVrw2wt2H3nz4pA7YKu8BCqX1wq14k90A@mail.gmail.com>
Message-ID: <E48A27E6-6DD4-4301-BADD-8B58BF524B05@probo.com>

On Nov 12, 2020, at 12:32 PM, Bob Fang <bobfang1992 at gmail.com> wrote:
> 
> I have an application which utilise win32com to control a software (powerworld if you know what it is). Once I have dispatched a new object I can see in task manager there is a new process created which is running and I can call command through the win32com object -- this is what I want to do and suits me well but I noticed two things:
> 
> 1. The process I created seems to be persistent and will not die even if I explicitly deleted my object using `del` in Python. Is there a way to fully close the process after I am done with my object?

It?s up to the the application.  Out-of-process servers often provide a ?close? or ?exit? method to tell them to clean up.
? 
Tim Roberts, timr at probo.com
Providenza & Boekelheide, Inc.


From eryksun at gmail.com  Fri Nov 13 15:54:08 2020
From: eryksun at gmail.com (Eryk Sun)
Date: Fri, 13 Nov 2020 14:54:08 -0600
Subject: [python-win32] Help with PySECURITY_DESCRIPTOR
In-Reply-To: <013901d6ac54$965b6250$c31226f0$@bojinov.info>
References: <013901d6ac54$965b6250$c31226f0$@bojinov.info>
Message-ID: <CACL+1atCZndP1jwsU-NUDxcpGY30sWRK-jkh1qJ8Z1gGM2JXKQ@mail.gmail.com>

On 10/27/20, momchil at bojinov.info <momchil at bojinov.info> wrote:
>
> I m trying to store file's acl along with the backup of the file and then
> restore it on the same system

Consider using BackupRead() and BackupWrite() from the win32file
module. These functions support backup and restore of data streams
(default and alternate data streams), attributes, extended attributes,
reparse data, object ID, and security.

GENERIC_READ access includes the READ_CONTROL access that's required
for reading most file security, but GENERIC_WRITE access isn't
sufficient for restoring file security. Writing discretionary
access-control entries and resource attributes requires WRITE_DAC
access. Writing the owner, group, and mandatory label requires
WRITE_OWNER access.  Reading and writing audit entries and writing
central-access-policy identifier entries requires
ACCESS_SYSTEM_SECURITY access, which requires enabling
SeSecurityPrivilege. Typically use GENERIC_WRITE | WRITE_DAC |
WRITE_OWNER.

In general you should backup and restore files using an elevated
administrator account. Enable SeBackupPrivilege and SeRestorePrivilege
in the process access token via OpenProcessToken,
LookupPrivilegeValue, and AdjustTokenPrivileges, found in the
win32security module. Open files with FILE_FLAG_BACKUP_SEMANTICS. This
ensures access in most cases when the backup and restore privileges
are enabled. The restore privilege also allows setting the file owner
to the arbitrary owner of the source file instead being limited to the
current user. Using an elevated logon (high integrity level) also
allows restoring a high integrity level mandatory label on the
destination file in case the source file has mandatory access control
that denies write-up, read-up, or execute-up access.

From momchil at bojinov.info  Fri Nov 13 16:43:39 2020
From: momchil at bojinov.info (momchil at bojinov.info)
Date: Fri, 13 Nov 2020 23:43:39 +0200
Subject: [python-win32] Help with PySECURITY_DESCRIPTOR
In-Reply-To: <CACL+1atCZndP1jwsU-NUDxcpGY30sWRK-jkh1qJ8Z1gGM2JXKQ@mail.gmail.com>
References: <013901d6ac54$965b6250$c31226f0$@bojinov.info>
 <CACL+1atCZndP1jwsU-NUDxcpGY30sWRK-jkh1qJ8Z1gGM2JXKQ@mail.gmail.com>
Message-ID: <001201d6ba06$0ed8aee0$2c8a0ca0$@bojinov.info>

Thank you for this.

I was sent a piece of code and I made it work. It is using win32security.GetFileSecurity

But now you brought up ADS (which I didn't cover) and opening files with backup semantics 

I m using Volume Shadow Copy atm but I don't know what are the benefits of using the backup flag
I need to do some reading on this

Momchil

-----Original Message-----
From: Eryk Sun <eryksun at gmail.com> 
Sent: Friday, November 13, 2020 10:54 PM
To: python-win32 at python.org
Cc: momchil at bojinov.info
Subject: Re: [python-win32] Help with PySECURITY_DESCRIPTOR

On 10/27/20, momchil at bojinov.info <momchil at bojinov.info> wrote:
>
> I m trying to store file's acl along with the backup of the file and 
> then restore it on the same system

Consider using BackupRead() and BackupWrite() from the win32file module. These functions support backup and restore of data streams (default and alternate data streams), attributes, extended attributes, reparse data, object ID, and security.

GENERIC_READ access includes the READ_CONTROL access that's required for reading most file security, but GENERIC_WRITE access isn't sufficient for restoring file security. Writing discretionary access-control entries and resource attributes requires WRITE_DAC access. Writing the owner, group, and mandatory label requires WRITE_OWNER access.  Reading and writing audit entries and writing central-access-policy identifier entries requires ACCESS_SYSTEM_SECURITY access, which requires enabling SeSecurityPrivilege. Typically use GENERIC_WRITE | WRITE_DAC | WRITE_OWNER.

In general you should backup and restore files using an elevated administrator account. Enable SeBackupPrivilege and SeRestorePrivilege in the process access token via OpenProcessToken, LookupPrivilegeValue, and AdjustTokenPrivileges, found in the win32security module. Open files with FILE_FLAG_BACKUP_SEMANTICS. This ensures access in most cases when the backup and restore privileges are enabled. The restore privilege also allows setting the file owner to the arbitrary owner of the source file instead being limited to the current user. Using an elevated logon (high integrity level) also allows restoring a high integrity level mandatory label on the destination file in case the source file has mandatory access control that denies write-up, read-up, or execute-up access.



From mhammond at skippinet.com.au  Sat Nov 14 01:26:00 2020
From: mhammond at skippinet.com.au (Mark Hammond)
Date: Sat, 14 Nov 2020 17:26:00 +1100
Subject: [python-win32] [ANN] pywin32 build 300 released
Message-ID: <76542e09-ee9e-9b6a-9bd6-433795ea667c@skippinet.com.au>

Hi all,
   I'm happy to announce the release of pywin32 build 300. 
Significantly, this is the first release to exclusively support Python 3 
- Python 2 is no longer supported. All Python source files in the repo 
are now in Python 3 syntax. To celebrate, the build numbers have jumped 
to 300 - there will not be a build 229.

There were significant changes in this release - you are encouraged to 
read the changes below carefully

Downloads are available at:

   https://github.com/mhammond/pywin32/releases/tag/b300

and via pypi.

For initial support (eg, to ask questions about the release etc), please 
contact this mailing-list (python-win32 at python.org).  If you want to 
report a bug, please do so at https://github.com/mhammond/pywin32/issues

As always, thanks to everyone who contributed to this release, both in 
terms of code and reporting bugs - there were a number of new 
contributors which is great to see,

Cheers,

Mark.

Changes:

Since build 228:
----------------
* Fixed a bug where win32com.client.VARIANT params were returned in the 
reverse order. This only happened when win32com.client.VARIANT was 
explicitly used (ie, not when normal params were passed) For example:

       arg1 = VARIANT(pythoncom.VT_R4 | pythoncom.VT_BYREF, 2.0)
       arg2 = VARIANT(pythoncom.VT_BOOL | pythoncom.VT_BYREF, True)
       object.SomeFunction(arg1, arg2)

after this call, `arg1.value` was actually the value for `arg2`, and 
vice-versa (#1303, #622).

* Fixed a bug that Pythonwin had an empty `sys.argv` (@kxrob in #1607)

* Fixed a bug that prevented win32process.ReadProcessMemory() from 
working in all scenarios (#1599)

* Changed how Services implemented with 
win32serviceutil.ServiceFramework  report that they have stopped. Now if 
the SvcRun() method (or the SvcDoRun() method, which is called by 
SvcRun() by default) raises on Exception, the Service will report a 
final SERVICE_STOPPED status with a non-zero error code. This will cause 
the Service's recovery actions to be triggered if the Service has the 
"Enable actions for stops with errors" option enabled. (#1563, Lincoln 
Puzey)

* adodbapi connect() method now accepts a "mode" keyword argument which 
is the "Mode" property to set on the ADO "Connection" object before 
opening the Connection. See "ConnectModeEnum" for valid values. (Lincoln 
Puzey)

* The Windows 10 SDK is now used to build the project. This shouldn't 
cause any visible changes, but should make it much easier to build the 
project yourself.

Python 2 is no longer supported - so long, Python 2, you served us well!

Notable changes in this transition:

* Python 3 builds used to erroneously turn "bytes" into a tuple of 
integers instead of a buffer type object. Because this special-casing is 
important for performance when using massive buffers, this has been 
fixed in Python 3 so it matches the old Python 2 behavior. If you use 
arrays of VT_UI1 and expect get back tuples of integers, your code may 
break.

* Pythonwin's default encoding is now utf-8 (#1559)

* The build environment has been greatly simplified - you just need 
Visual Studio and a Windows 10 SDK. (The free compilers probably work 
too, but haven't been tested - let me know your experiences!)


From planders at gmail.com  Sat Nov 14 07:56:48 2020
From: planders at gmail.com (Preston Landers)
Date: Sat, 14 Nov 2020 06:56:48 -0600
Subject: [python-win32] [ANN] pywin32 build 300 released
In-Reply-To: <76542e09-ee9e-9b6a-9bd6-433795ea667c@skippinet.com.au>
References: <76542e09-ee9e-9b6a-9bd6-433795ea667c@skippinet.com.au>
Message-ID: <CAKgs+RWSF1ObdEiPcDLSvK9j_CLkn-=4GSQdzYTJQbpGGUFNrw@mail.gmail.com>

Thank you so much, Mark, and to everyone else who has contributed over
the years. The build environment improvements will be especially
welcome.

regards,
-Preston

On Sat, Nov 14, 2020 at 12:31 AM Mark Hammond <mhammond at skippinet.com.au> wrote:
>
> Hi all,
>    I'm happy to announce the release of pywin32 build 300.
> Significantly, this is the first release to exclusively support Python 3
> - Python 2 is no longer supported. All Python source files in the repo
> are now in Python 3 syntax. To celebrate, the build numbers have jumped
> to 300 - there will not be a build 229.
>
> There were significant changes in this release - you are encouraged to
> read the changes below carefully
>
> Downloads are available at:
>
>    https://github.com/mhammond/pywin32/releases/tag/b300
>
> and via pypi.
>
> For initial support (eg, to ask questions about the release etc), please
> contact this mailing-list (python-win32 at python.org).  If you want to
> report a bug, please do so at https://github.com/mhammond/pywin32/issues
>
> As always, thanks to everyone who contributed to this release, both in
> terms of code and reporting bugs - there were a number of new
> contributors which is great to see,
>
> Cheers,
>
> Mark.
>

From bobfang1992 at gmail.com  Tue Nov 17 18:28:50 2020
From: bobfang1992 at gmail.com (Bob Fang)
Date: Tue, 17 Nov 2020 23:28:50 +0000
Subject: [python-win32] Dispatch in multiple process?
Message-ID: <CANVf7NWyVBbc3ArpxWVY6nLN1dVqvFUEJKYepL3qrPczq8X8zQ@mail.gmail.com>

Hi,

I am using an application and I am using win32com.client.Dispatch to
connect to this application. After some experiments, I think that I often
see the following error when I try to call win32com.client.Dispatch at the
same time from two different processes at the same time. I need to be able
to run this COM application in parallel as I need to speed up the
calculation I am running. I am just wondering if I am calling the same COM
object in two different processes, should we hold a filelock so only one of
them will call the dispatch method at the same time?

The error I am getting is:

pywintypes.com_error: (-2146959355, 'Server execution failed', None, None)


Thanks!
Bob
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.python.org/pipermail/python-win32/attachments/20201117/0dad3e13/attachment.html>

From antoine.ferron at bitlogik.fr  Sun Nov 22 07:16:09 2020
From: antoine.ferron at bitlogik.fr (Antoine FERRON)
Date: Sun, 22 Nov 2020 13:16:09 +0100
Subject: [python-win32] Use TPM from Crypto API
Message-ID: <7BD4F611-C70A-4BF9-A21C-4BEC1386B894@getmailspring.com>

Hello pywin32 maintainers and enthusiasts,

I intend to use a TPM on Windows to generate, store and sign, through the win32 CNG API (NCryptCreatePersistedKey (https://docs.microsoft.com/en-us/windows/win32/api/ncrypt/nf-ncrypt-ncryptcreatepersistedkey) and NCryptSignHash) but within a Python program. When creating a key, one have to provide the hProvider (handle the Key Storage Provider) parameter as "Microsoft Platform Crypto Provider" to select the TPM target.
My first guess was that pywin32 can be the way to go. But going deeper in the docs (http://timgolden.me.uk/pywin32-docs/win32crypt.html) and in the code, I now think that it can only use the "legacy" Crypto API ("CAPI") and not the New Generation ("CNG"), and the TPM "Microsoft Platform Crypto Provider" looks to be only available from the NG interface.
I did the following in Python 3.6.8 :
import win32crypt
print(win32crypt.CryptEnumProviders())
and there only appears legacy key providers, not the new "Microsoft Platform Crypto Provider" needed to select the TPM target. There are missing "NG" providers from those listed from the "certutil -csplist" command.

Can you confirm that TPM "Microsoft Platform Crypto Provider" requires "CNG", and pywin32 is only "CAPI" capable ? Anyway, do you have some ideas in mind to reach my goal ?

_____________________________________
Antoine FERRON
Pr?sident ? BitLogiK

bitlogik.fr (https://bitlogik.fr) ? PGP Key ID#22F95B31 (https://pgp.key-server.io/0xE353957C22F95B31)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.python.org/pipermail/python-win32/attachments/20201122/819c0ec6/attachment.html>

From timr at probo.com  Sun Nov 22 14:14:29 2020
From: timr at probo.com (Tim Roberts)
Date: Sun, 22 Nov 2020 11:14:29 -0800
Subject: [python-win32] Use TPM from Crypto API
In-Reply-To: <7BD4F611-C70A-4BF9-A21C-4BEC1386B894@getmailspring.com>
References: <7BD4F611-C70A-4BF9-A21C-4BEC1386B894@getmailspring.com>
Message-ID: <C7D920B3-A99C-4720-B435-87E1F8622033@probo.com>

On Nov 22, 2020, at 4:16 AM, Antoine FERRON via python-win32 <python-win32 at python.org> wrote:
> 
> Can you confirm that TPM "Microsoft Platform Crypto Provider" requires "CNG", and pywin32 is only "CAPI" capable ?

This is not a Python question at all.  Look at the MSDN documentation page for the CryptEnumProviders API.  You?ll see that it is deprecated, and only accesses the base cryptographic provider and the enhanced cryptographic provider.  Remember that pywin32 is, in almost every case, a relatively thin wrapper around the Windows APIs.


> Anyway, do you have some ideas in mind to reach my goal ?

The APIs from ncrypt.dll are not, as of yet, exposed in pywin32.  You can certainly use ctypes to access them.
? 
Tim Roberts, timr at probo.com
Providenza & Boekelheide, Inc.


From antoine.ferron at bitlogik.fr  Mon Nov 23 17:07:55 2020
From: antoine.ferron at bitlogik.fr (Antoine FERRON)
Date: Mon, 23 Nov 2020 23:07:55 +0100
Subject: [python-win32] Use TPM from Crypto API
In-Reply-To: <C7D920B3-A99C-4720-B435-87E1F8622033@probo.com>
References: <C7D920B3-A99C-4720-B435-87E1F8622033@probo.com>
Message-ID: <ED153FA7-4E19-474B-B1BD-921221C6AA17@getmailspring.com>


On Nov 22 2020, at 8:14 pm, Tim Roberts <timr at probo.com> wrote:
> On Nov 22, 2020, at 4:16 AM, Antoine FERRON via python-win32 <python-win32 at python.org> wrote:
> >
> > Can you confirm that TPM "Microsoft Platform Crypto Provider" requires "CNG", and pywin32 is only "CAPI" capable ?
>
> This is not a Python question at all. Look at the MSDN documentation page for the CryptEnumProviders API. You?ll see that it is deprecated, and only accesses the base cryptographic provider and the enhanced cryptographic provider. Remember that pywin32 is, in almost every case, a relatively thin wrapper around the Windows APIs.

Well, not Python, but related to pywin32. So I understand that win32crypt.CryptEnumProviders in win32 is calling CryptEnumProvidersA (https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptenumprovidersa) which is deprecated (what I call "CAPI"), and I need NCryptEnumStorageProviders (https://docs.microsoft.com/en-us/windows/win32/api/ncrypt/nf-ncrypt-ncryptenumstorageproviders) (what I call "CNG"). So the win32 API is not a fit for this, because it wraps "old" crypto functions.
> > Anyway, do you have some ideas in mind to reach my goal ?
> The APIs from ncrypt.dll are not, as of yet, exposed in pywin32. You can certainly use ctypes to access them.

Yes, I can see 2 ways to reach my goal : one is ffi.dlopen("ncrypt.dll") or CDLL and provides the good ctypes, which can be not so easy (https://stackoverflow.com/questions/59818779/is-there-a-python-module-could-sign-and-verify-data-by-rsa-key-pair-from-certifi/59854465#comment106111779_59854465). the other is to build a small c++ app and call exe fro Python with subprocess.run std in/out. Also an intermediary is do a small c++ app/dll and use ffi to access it, or extend the Python with c++. This "hcrypt" helper maybe a good help (https://github.com/vladp72/hcrypt) for the second way.
> ?
> Tim Roberts, timr at probo.com
> Providenza & Boekelheide, Inc.
Thanks for your time and help, appreciate.

> _______________________________________________
> python-win32 mailing list
python-win32 at python.org
https://mail.python.org/mailman/listinfo/python-win32

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.python.org/pipermail/python-win32/attachments/20201123/e737e84d/attachment.html>