Fix X509 extension handling (X509V3_ADD_*, extKeyUsage, EC point form) and cipher suite test

src/pk_ec.c

@@ -4749,6 +4749,79 @@ int wolfSSL_EC_KEY_set_public_key(WOLFSSL_EC_KEY *key,
     return ret;
 }
 
+/*
+ * Decode an octet-encoded EC public point into @key.
+ *
+ * The point conversion form of @key is set from the encoding byte so that
+ * re-encoding with wolfSSL_i2o_ECPublicKey() reproduces @buf. Hybrid
+ * encodings have no wolfSSL equivalent and leave the form unchanged.
+ *
+ * Return code compliant with OpenSSL.
+ *
+ * @param [in, out] key  EC key (must already have a group set).
+ * @param [in]      buf  Octet-encoded public point.
+ * @param [in]      len  Length of @buf in bytes.
+ * @param [in]      ctx  BN context. May be NULL.
+ * @return  1 on success.
+ * @return  0 on failure.
+ */
+int wolfSSL_EC_KEY_oct2key(WOLFSSL_EC_KEY *key, const unsigned char *buf,
+    size_t len, WOLFSSL_BN_CTX *ctx)
+{
+    int ret = 1;
+    const WOLFSSL_EC_GROUP *group = NULL;
+    WOLFSSL_EC_POINT *point = NULL;
+
+    WOLFSSL_ENTER("wolfSSL_EC_KEY_oct2key");
+
+    if ((key == NULL) || (buf == NULL) || (len == 0)) {
+        WOLFSSL_MSG("wolfSSL_EC_KEY_oct2key Bad arguments");
+        ret = 0;
+    }
+
+    if (ret == 1) {
+        group = wolfSSL_EC_KEY_get0_group(key);
+        if (group == NULL) {
+            WOLFSSL_MSG("EC_KEY has no group set");
+            ret = 0;
+        }
+    }
+
+    if (ret == 1) {
+        point = wolfSSL_EC_POINT_new((WOLFSSL_EC_GROUP*)group);
+        if (point == NULL) {
+            WOLFSSL_MSG("wolfSSL_EC_POINT_new failed");
+            ret = 0;
+        }
+    }
+
+    if ((ret == 1) &&
+            (wolfSSL_EC_POINT_oct2point(group, point, buf, len, ctx) != 1)) {
+        WOLFSSL_MSG("wolfSSL_EC_POINT_oct2point failed");
+        ret = 0;
+    }
+
+    if ((ret == 1) && (wolfSSL_EC_KEY_set_public_key(key, point) != 1)) {
+        WOLFSSL_MSG("wolfSSL_EC_KEY_set_public_key failed");
+        ret = 0;
+    }
+
+    if (ret == 1) {
+        /* SEC 1: 0x02/0x03 compressed, 0x04 uncompressed. Clearing the low
+         * bit turns the leading byte into the conversion form. Any other
+         * leading byte - hybrid, or the single 0x00 of the point at infinity -
+         * names no form wolfSSL_EC_KEY_set_conv_form() takes, so leave the
+         * key's form alone rather than handing it a value it rejects. */
+        if ((buf[0] == 0x02) || (buf[0] == 0x03) || (buf[0] == 0x04)) {
+            wolfSSL_EC_KEY_set_conv_form(key, buf[0] & ~0x01);
+        }
+    }
+
+    wolfSSL_EC_POINT_free(point);
+
+    return ret;
+}
+
 #ifndef NO_WOLFSSL_STUB
 /* Set the ASN.1 encoding flag against the EC key.
  *