openssl: Add X509KeyUsage bitflags

Author: DoumanAsh

openssl/src/x509/mod.rs

@@ -50,6 +50,25 @@ pub mod store;
 #[cfg(test)]
 mod tests;
 
+bitflags::bitflags! {
+    /// KeyUsage bitset
+    ///
+    /// Refer to KeyUsage extension for details and meaning of every flag
+    #[derive(Copy, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
+    #[repr(transparent)]
+    pub struct X509KeyUsage: u32 {
+        const DIGITAL_SIGNATURE = ffi::X509v3_KU_DIGITAL_SIGNATURE;
+        const NON_REPUDIATION = ffi::X509v3_KU_NON_REPUDIATION;
+        const KEY_ENCIPHERMENT = ffi::X509v3_KU_KEY_ENCIPHERMENT;
+        const DATA_ENCIPHERMENT = ffi::X509v3_KU_DATA_ENCIPHERMENT;
+        const KEY_AGREEMENT = ffi::X509v3_KU_KEY_AGREEMENT;
+        const KEY_CERT_SIGN = ffi::X509v3_KU_KEY_CERT_SIGN;
+        const CRL_SIGN = ffi::X509v3_KU_CRL_SIGN;
+        const ENCIPHER_ONLY = ffi::X509v3_KU_ENCIPHER_ONLY;
+        const DECIPHER_ONLY = ffi::X509v3_KU_DECIPHER_ONLY;
+    }
+}
+
 /// A type of X509 extension.
 ///
 /// # Safety
@@ -667,6 +686,13 @@ impl X509Ref {
         }
     }
 
+    /// Retrieves set of basic key usage flags within certificate
+    #[corresponds(X509_get_key_usage)]
+    pub fn key_usage(&self) -> X509KeyUsage {
+        let res = unsafe { ffi::X509_get_key_usage(self.as_ptr()) };
+        X509KeyUsage::from_bits_retain(res)
+    }
+
     to_pem! {
         /// Serializes the certificate into a PEM-encoded X509 structure.
         ///

openssl/src/x509/tests.rs

@@ -18,6 +18,7 @@ use crate::x509::store::X509Lookup;
 use crate::x509::store::X509StoreBuilder;
 #[cfg(any(ossl102, boringssl, libressl261))]
 use crate::x509::verify::{X509VerifyFlags, X509VerifyParam};
+use crate::x509::X509KeyUsage;
 #[cfg(any(ossl102, boringssl))]
 use crate::x509::X509PurposeId;
 #[cfg(any(ossl102, boringssl, libressl261))]
@@ -1192,3 +1193,63 @@ fn test_store_all_certificates() {
 
     assert_eq!(store.all_certificates().len(), 1);
 }
+
+#[test]
+fn should_get_x509_key_usage() {
+    let pkey = pkey();
+
+    let mut name = X509Name::builder().unwrap();
+    name.append_entry_by_nid(Nid::COMMONNAME, "key_usage.com")
+        .unwrap();
+    let name = name.build();
+
+    let mut builder = X509::builder().unwrap();
+    builder.set_version(2).unwrap();
+    builder.set_subject_name(&name).unwrap();
+    builder.set_issuer_name(&name).unwrap();
+    builder
+        .set_not_before(&Asn1Time::days_from_now(0).unwrap())
+        .unwrap();
+    builder
+        .set_not_after(&Asn1Time::days_from_now(365).unwrap())
+        .unwrap();
+    builder.set_pubkey(&pkey).unwrap();
+
+    let mut serial = BigNum::new().unwrap();
+    serial.rand(128, MsbOption::MAYBE_ZERO, false).unwrap();
+    builder
+        .set_serial_number(&serial.to_asn1_integer().unwrap())
+        .unwrap();
+
+    let key_usage = KeyUsage::new()
+        .digital_signature()
+        .key_encipherment()
+        .build()
+        .unwrap();
+    builder.append_extension(key_usage).unwrap();
+    builder.sign(&pkey, MessageDigest::sha256()).unwrap();
+
+    let x509 = builder.build();
+
+    assert!(pkey.public_eq(&x509.public_key().unwrap()));
+    assert!(x509.verify(&pkey).unwrap());
+
+    let cn = x509
+        .subject_name()
+        .entries_by_nid(Nid::COMMONNAME)
+        .next()
+        .unwrap();
+    assert_eq!(cn.data().as_slice(), b"key_usage.com");
+
+    let usage = x509.key_usage();
+    assert!(usage.contains(X509KeyUsage::DIGITAL_SIGNATURE));
+    assert!(usage.contains(X509KeyUsage::KEY_ENCIPHERMENT));
+    assert!(!usage.contains(X509KeyUsage::CRL_SIGN));
+    assert!(!usage.contains(X509KeyUsage::NON_REPUDIATION));
+    assert!(!usage.contains(X509KeyUsage::DATA_ENCIPHERMENT));
+    assert!(!usage.contains(X509KeyUsage::KEY_AGREEMENT));
+    assert!(!usage.contains(X509KeyUsage::KEY_CERT_SIGN));
+    assert!(!usage.contains(X509KeyUsage::CRL_SIGN));
+    assert!(!usage.contains(X509KeyUsage::ENCIPHER_ONLY));
+    assert!(!usage.contains(X509KeyUsage::DECIPHER_ONLY));
+}