Fix Key Usage bits past decipherOnly

examples/certs/test/ku-bit10-bit12-cert.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDRTCCAi2gAwIBAgIUaiMdBuVAlCAs80mvGaZkwHfABakwDQYJKoZIhvcNAQEL
+BQAwPTEXMBUGA1UEAwwOVGVzdCBLZXkgVXNhZ2UxFTATBgNVBAoMDHdvbGZTU0wg
+VGVzdDELMAkGA1UEBhMCVVMwHhcNMjYxMDE5MjI0NzI5WhcNMzYxMDE2MjI0NzI5
+WjA9MRcwFQYDVQQDDA5UZXN0IEtleSBVc2FnZTEVMBMGA1UECgwMd29sZlNTTCBU
+ZXN0MQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AOmEcaspq6vm7Px6u904lUAgAo+86M2HRPz6k2xWBZUNO8skgBWbi8lpIH2l6Fmi
+sIWbs1K0xckiBImePHxHuai3SDLgEFu2G9ChJrPnPsvRTme7UsQdrqxeKequ1miJ
+PBbJbYuGbbOCYCCzwHQQivUCA5OE35vLn5LqPlHLTB8K6B7QzEuBLtEbbCeBMeAU
+I/JigZFCJ0iykPnCVXUH8IzLortQzG8bSWfhiuIH5tS9paVr4UgptiaY7p75U0+9
+kxB0iJd561pQSD0WH38s2KCk1PU9OR7/5s5dPRZZdt02bFWWxxwPXQvpqf62oZWY
+vrp2Jh2RyrfbDuRThAonYmECAwEAAaM9MDswCQYDVR0TBAIwADAPBgNVHQ8BAf8E
+BQMDAwAoMB0GA1UdDgQWBBQf4UY3BOflOOboN668W/8Ir9ZK1TANBgkqhkiG9w0B
+AQsFAAOCAQEACbqLBNC8N64eEauBdgV/a6C9r2fHJL3rq1OBwqO00fQMaKkzYHVj
+Aj7xE6/M1z3VahegFf1Ek61n/hBZz0m0TDst8omm9eNKX+U9iZDqFHyP2q0TdTNR
+pU2YAO5BNJK3FDPwX3YiRZQSFmCr6ihshVbuovt0NNjgINFvtP2nkfr/GvFwdReW
+YilEVNGLpwYIT3bxva0IyEC7F9zP7Oam4iN0xmlPjuDLXmRDhcTTLBW/Q1wu+cuQ
+Y7o16koWELYXMWIk+P7dEumAKfXLB3MM0xXLwODQN1iGUCVRS3E784NnaP9bvLIt
+mE4YYcGJ1A4XKIin9+6tVJmasjFPWFY0/g==
+-----END CERTIFICATE-----

examples/certs/test/ku-bit15-cert.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDRTCCAi2gAwIBAgIUSlwWKmf/VlqUUR79/M4fXW1qsr0wDQYJKoZIhvcNAQEL
+BQAwPTEXMBUGA1UEAwwOVGVzdCBLZXkgVXNhZ2UxFTATBgNVBAoMDHdvbGZTU0wg
+VGVzdDELMAkGA1UEBhMCVVMwHhcNMjYxMDE5MTg1NjEwWhcNMzYxMDE2MTg1NjEw
+WjA9MRcwFQYDVQQDDA5UZXN0IEtleSBVc2FnZTEVMBMGA1UECgwMd29sZlNTTCBU
+ZXN0MQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ALONJlry3r2z2a2hpidVKCP1X0oShH3c7V0UiRLqfDf5icYU+PoyixpzwZdBlZQc
+Fi5TfHdtaDY1EWL3fXNi4owsJfPUhXum2Lc75LJMOqkd11rJ/cnRL5LF2QGLOhV6
+M9b2BJ+cHoWiOhiRb3l/2fmziY5L0eTwkBtaWAzo/Fg1UBDWqgIt9Bg929H7toJo
+iGa5su60yp27STWfTlZ1HsP0pH94OSYyjq/D8SbMI7lFQiH/5H1xKyL8ijk3jK7g
+f9Z1ft4jx6jau/NkqFMC01GM4Jl/Ewn5Z90aNbqpjltAPDxKUxRSVjv8jCSxn6hu
+92xwYQHyzNEfxfPffgZ1LYkCAwEAAaM9MDswCQYDVR0TBAIwADAPBgNVHQ8BAf8E
+BQMDAIABMB0GA1UdDgQWBBT1YZXHg3/jgX1LTfXZe0tYHdqb+jANBgkqhkiG9w0B
+AQsFAAOCAQEADPSxNQarAPRLxVvp0qDwJ/mFuXRhs8GRn9gewP4TYMbWOZ9isOLB
+nORP8Gk7uIVXQzJzR6h3xhJOwJW/PnL46xdkVjmGLWD4a8OPpuiMG08sTigzLYuP
+v9BCU5q4RDOrAOZFxqiuarglATTDSZ2OpSt3a0EtzWQjZkl9FpbamF5u5sfvOHoB
+qckQ6tGZlwluKc9Q0O6t0lXKdDCNuOVAErSt12u0RaYInNHWRVOhaXIiU4QrVm9l
+6QOdFldqaL1lIAJ480GHsZj5XHiRHezG2x/MfyzrfxTsBKpTpSAbgTIQZ9GFIwqY
+WHOL7edzp+/55d5E+cAh4ZIwWvQ+IfxqHA==
+-----END CERTIFICATE-----

examples/certs/test/ku-bit9-cert.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDRTCCAi2gAwIBAgIUFge0ycNwTXZPgQTz5rybItLYVVswDQYJKoZIhvcNAQEL
+BQAwPTEXMBUGA1UEAwwOVGVzdCBLZXkgVXNhZ2UxFTATBgNVBAoMDHdvbGZTU0wg
+VGVzdDELMAkGA1UEBhMCVVMwHhcNMjYxMDE5MTg1NjEwWhcNMzYxMDE2MTg1NjEw
+WjA9MRcwFQYDVQQDDA5UZXN0IEtleSBVc2FnZTEVMBMGA1UECgwMd29sZlNTTCBU
+ZXN0MQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AMaKQ5rCwfA7oFXoxoJGKa5iUAB4P6m68XtqFjLmHZCETrI1rn2ULRstA4xjVic5
+GaP6ETs5jgWlPZmRnUq5TSS8SWXG9k4bn2k1xS8l+6FLA3vSdK+d3RmWDCuUjD4M
+Vtf4TXP18bUQMeSj1De5uK7AS0q9dzsU0tD2Uglxh0SQQWUkAuAvFsHFR5ZR9Xoo
+559qQm6KVFEulGtGKzJgYGl7MurcJwwgVPQsI/J7fQNyFZEh35TMalSvWfUEwkew
+iBDF+LdqdqErqReie8DHE+rIxhmihT/LGC0Q4qgm1Xj7T9gdOcMPSatUfjavn0MK
+oYPxpWmFfKT/kQ7g8JC3WEMCAwEAAaM9MDswCQYDVR0TBAIwADAPBgNVHQ8BAf8E
+BQMDBoBAMB0GA1UdDgQWBBT6c849Y8mRgxoi6DlQChvmAqFpHTANBgkqhkiG9w0B
+AQsFAAOCAQEAs9iiH+CBWZIZzaV+ICuBQthphjTCX3+RDvcgwiMoADlfcFreOuFP
+L810rDZM9IZ8ZScEqZpkSwp8uwZW7K1VompsF4MM6arU/P646mnSHJFyITvLhxfu
+gEvtF7UHJrP3LnS4j5RENehJ7nEGBF56HbKzRfAxmaEIgxlUflk3PoIK4vAYFz7V
+CqmMA0DQnOYc6iDM7h/ly4EfghwMkt5QeJYt3EST5NEekbYaHNReZiwIidlFHNm7
+beK6nah9isq7cfF1L0RMPoUdnkZGPQyWRfgWkN3chNXGOEKkwWahUqJHxJnAHNcB
+xqKByod1a8Yg6UYbhTGWUqILcnplyKzQYw==
+-----END CERTIFICATE-----

examples/certs/update-certs.sh

@@ -214,6 +214,49 @@ for EXT in unknown unknown-mixed large-arc bad-oid; do
 done
 rm -rf "${TMP_DIR}"
 
+# Generate Key Usage test certs setting bits past decipherOnly (8), which
+# RFC 5280 does not define: digitalSignature plus bit 9 or bit 15, and bits
+# 10 and 12 alone
+printf "Generating test/ku-bit9-cert.pem, test/ku-bit15-cert.pem, "
+printf "test/ku-bit10-bit12-cert.pem\n"
+mkdir -p test
+TMP_DIR="$(mktemp -d)"
+cat > "${TMP_DIR}/openssl.cnf" <<EOF
+[ req ]
+distinguished_name = dn
+prompt = no
+
+[ dn ]
+CN = Test Key Usage
+O = wolfSSL Test
+C = US
+
+[ v3_bit9 ]
+basicConstraints = CA:FALSE
+2.5.29.15 = critical, DER:03:03:06:80:40
+
+[ v3_bit15 ]
+basicConstraints = CA:FALSE
+2.5.29.15 = critical, DER:03:03:00:80:01
+
+[ v3_bit10_bit12 ]
+basicConstraints = CA:FALSE
+2.5.29.15 = critical, DER:03:03:03:00:28
+EOF
+
+for KU in bit9 bit15 bit10-bit12; do
+    openssl req -new -newkey rsa:2048 -nodes -x509 -days 3650 \
+      -keyout "${TMP_DIR}/ku-key.pem" -out "test/ku-${KU}-cert.pem" \
+      -config "${TMP_DIR}/openssl.cnf" -extensions "v3_${KU//-/_}" \
+      >/dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        printf "Failed to generate test/ku-%s-cert.pem\n" "${KU}"
+        rm -rf "${TMP_DIR}"
+        exit 1
+    fi
+done
+rm -rf "${TMP_DIR}"
+
 # Remove text info from intermediate certs, causes issues on Android (WRONG TAG)
 printf "Removing text info from intermediate certs\n"
 sed -i.bak -n '/-----BEGIN CERTIFICATE-----/,$p' ca-cert.pem

native/com_wolfssl_WolfSSLCertificate.c

@@ -2059,8 +2059,10 @@ JNIEXPORT jbooleanArray JNICALL Java_com_wolfssl_WolfSSLCertificate_X509_1get_1k
   (JNIEnv* jenv, jclass jcl, jlong x509Ptr)
 {
     jbooleanArray ret = NULL;
-    jboolean values[9];
+    jboolean values[16];
     unsigned short kuse;
+    int len = 9;
+    int i;
     WOLFSSL_X509* x509 = (WOLFSSL_X509*)(uintptr_t)x509Ptr;
     (void)jcl;
 
@@ -2070,13 +2072,6 @@ JNIEXPORT jbooleanArray JNICALL Java_com_wolfssl_WolfSSLCertificate_X509_1get_1k
 
     kuse = wolfSSL_X509_get_keyUsage(x509);
     if (kuse != 0) {
-        ret = (*jenv)->NewBooleanArray(jenv, 9);
-        if (!ret) {
-            throwWolfSSLJNIException(jenv,
-                "Failed to create boolean array in native X509_get_key_usage");
-            return NULL;
-        }
-
         values[0] = (kuse & KEYUSE_DIGITAL_SIG)? JNI_TRUE : JNI_FALSE;
         values[1] = (kuse & KEYUSE_CONTENT_COMMIT)? JNI_TRUE : JNI_FALSE;
         values[2] = (kuse & KEYUSE_KEY_ENCIPHER)? JNI_TRUE : JNI_FALSE;
@@ -2087,7 +2082,25 @@ JNIEXPORT jbooleanArray JNICALL Java_com_wolfssl_WolfSSLCertificate_X509_1get_1k
         values[7] = (kuse & KEYUSE_ENCIPHER_ONLY)? JNI_TRUE : JNI_FALSE;
         values[8] = (kuse & KEYUSE_DECIPHER_ONLY)? JNI_TRUE : JNI_FALSE;
 
-        (*jenv)->SetBooleanArrayRegion(jenv, ret, 0, 9, values);
+        /* Bits 9-15 have no defines, stored just below KEYUSE_DECIPHER_ONLY */
+        for (i = 9; i < 16; i++) {
+            if (kuse & (KEYUSE_DECIPHER_ONLY >> (i - 8))) {
+                values[i] = JNI_TRUE;
+                len = i + 1;
+            }
+            else {
+                values[i] = JNI_FALSE;
+            }
+        }
+
+        ret = (*jenv)->NewBooleanArray(jenv, len);
+        if (!ret) {
+            throwWolfSSLJNIException(jenv,
+                "Failed to create boolean array in native X509_get_key_usage");
+            return NULL;
+        }
+
+        (*jenv)->SetBooleanArrayRegion(jenv, ret, 0, len, values);
         if ((*jenv)->ExceptionOccurred(jenv)) {
             (*jenv)->ExceptionDescribe(jenv);
             (*jenv)->ExceptionClear(jenv);

src/java/com/wolfssl/WolfSSLCertificate.java

@@ -1992,6 +1992,10 @@ public boolean verify(byte[] pubKey, int pubKeySz)
      *    [7] = KEYUSE_ENCIPHER_ONLY
      *    [8] = KEYUSE_DECIPHER_ONLY
      *
+     * RFC 5280 defines no bits past [8]. The array has 9 elements, extended
+     * to the highest bit set in [9] to [15], ex: 10 elements when bit 9 is
+     * the highest set.
+     *
      * @return arrray of key usages set for certificate, or null
      *
      * @throws IllegalStateException if WolfSSLCertificate has been freed.

src/test/com/wolfssl/provider/jsse/test/WolfSSLX509Test.java

@@ -312,6 +312,29 @@ public void testGetExtendedKeyUsageFreedCert() throws Exception {
         }
     }
 
+    @Test
+    public void testGetKeyUsageMatchesJdk() throws Exception {
+
+        Assume.assumeTrue(WolfSSL.FileSystemEnabled());
+
+        for (String path : new String[] {
+                "examples/certs/test/ku-bit9-cert.pem",
+                "examples/certs/test/ku-bit15-cert.pem",
+                "examples/certs/test/ku-bit10-bit12-cert.pem" }) {
+            WolfSSLCertificate pem = new WolfSSLCertificate(
+                WolfSSLTestCommon.getPath(path), WolfSSL.SSL_FILETYPE_PEM);
+            byte[] der = pem.getDer();
+            pem.free();
+
+            X509Certificate jdkCert = (X509Certificate)CertificateFactory
+                .getInstance("X.509").generateCertificate(
+                    new ByteArrayInputStream(der));
+            boolean[] wolfKu = new WolfSSLX509(der).getKeyUsage();
+            assertNotNull(path, wolfKu);
+            assertArrayEquals(path, jdkCert.getKeyUsage(), wolfKu);
+        }
+    }
+
     @Test
     public void testFreedCertNotReportedAsCA() throws Exception {
 

src/test/com/wolfssl/test/WolfSSLCertificateTest.java

@@ -97,6 +97,12 @@ public class WolfSSLCertificateTest {
         "examples/certs/test/eku-large-arc-cert.pem";
     public static String ekuBadOidCertPem =
         "examples/certs/test/eku-bad-oid-cert.pem";
+    public static String kuBit9CertPem =
+        "examples/certs/test/ku-bit9-cert.pem";
+    public static String kuBit15CertPem =
+        "examples/certs/test/ku-bit15-cert.pem";
+    public static String kuBit10Bit12CertPem =
+        "examples/certs/test/ku-bit10-bit12-cert.pem";
     public static String sanTestUpnCert = null;
     public static String sanTestAllTypesCert = null;
     public static String sanTestAllTypesDer = null;
@@ -169,6 +175,9 @@ public static void setCertPaths() throws WolfSSLException {
             WolfSSLTestCommon.getPath(ekuUnknownMixedCertPem);
         ekuLargeArcCertPem = WolfSSLTestCommon.getPath(ekuLargeArcCertPem);
         ekuBadOidCertPem = WolfSSLTestCommon.getPath(ekuBadOidCertPem);
+        kuBit9CertPem = WolfSSLTestCommon.getPath(kuBit9CertPem);
+        kuBit15CertPem = WolfSSLTestCommon.getPath(kuBit15CertPem);
+        kuBit10Bit12CertPem = WolfSSLTestCommon.getPath(kuBit10Bit12CertPem);
         sanTestUpnCert = sanTestDir + "/san-test-othername-upn.pem";
         sanTestAllTypesCert = sanTestDir + "/san-test-all-types.pem";
         sanTestAllTypesDer = sanTestDir + "/san-test-all-types.der";
@@ -644,6 +653,50 @@ public void test_getKeyUsage() {
         }
     }
 
+    @Test
+    public void test_getKeyUsageUndefinedBits() throws WolfSSLException {
+
+        boolean[] expected;
+        WolfSSLCertificate cert;
+
+        Assume.assumeTrue(WolfSSL.FileSystemEnabled());
+
+        /* digitalSignature and bit 9 */
+        expected = new boolean[10];
+        expected[0] = true;
+        expected[9] = true;
+        cert = new WolfSSLCertificate(kuBit9CertPem, WolfSSL.SSL_FILETYPE_PEM);
+        try {
+            assertArrayEquals(expected, cert.getKeyUsage());
+        } finally {
+            cert.free();
+        }
+
+        /* digitalSignature and bit 15 */
+        expected = new boolean[16];
+        expected[0] = true;
+        expected[15] = true;
+        cert = new WolfSSLCertificate(
+            kuBit15CertPem, WolfSSL.SSL_FILETYPE_PEM);
+        try {
+            assertArrayEquals(expected, cert.getKeyUsage());
+        } finally {
+            cert.free();
+        }
+
+        /* Bits 10 and 12 only */
+        expected = new boolean[13];
+        expected[10] = true;
+        expected[12] = true;
+        cert = new WolfSSLCertificate(
+            kuBit10Bit12CertPem, WolfSSL.SSL_FILETYPE_PEM);
+        try {
+            assertArrayEquals(expected, cert.getKeyUsage());
+        } finally {
+            cert.free();
+        }
+    }
+
     public void test_getExtendedKeyUsage() {
         int i;
         String[] eku;