Support secp521r1 and Ed448, expand tests

Add support for the `secp521r1` (P-521) key exchange group and the `Ed448`
signature scheme to broaden the supported cryptographic capabilities.

Update the basic integration tests to verify functionality across multiple
protocol versions (TLS 1.2, TLS 1.3) and cipher suites (AES-128, AES-256,
ChaCha20) rather than relying on default negotiations. Additionally, the test
client now validates the connection by downloading and verifying a specific
file, ensuring accurate data transfer instead of just asserting a successful
handshake.

Assisted-by: Gemini <gemini@google.com>
Signed-off-by: Simo Sorce <simo@redhat.com>

Author: simo5

rustls/ossl/src/keyex.rs

@@ -16,6 +16,7 @@ impl SupportedKxGroup for OsslEcKxGroup {
             NamedGroup::X25519 => EvpPkeyType::X25519,
             NamedGroup::secp256r1 => EvpPkeyType::P256,
             NamedGroup::secp384r1 => EvpPkeyType::P384,
+            NamedGroup::secp521r1 => EvpPkeyType::P521,
             _ => return Err(Error::General("Unsupported KX group".into())),
         };
 
@@ -56,6 +57,9 @@ impl SupportedKxGroup for OsslEcKxGroup {
             NamedGroup::secp384r1 => {
                 EvpPkey::available(osslctx(), EvpPkeyType::P384)
             }
+            NamedGroup::secp521r1 => {
+                EvpPkey::available(osslctx(), EvpPkeyType::P521)
+            }
             _ => false,
         }
     }
@@ -80,7 +84,9 @@ impl ActiveKeyExchange for OsslEcdh {
                     ))?;
                 }
             }
-            NamedGroup::secp256r1 | NamedGroup::secp384r1 => {
+            NamedGroup::secp256r1
+            | NamedGroup::secp384r1
+            | NamedGroup::secp521r1 => {
                 if peer.first() != Some(&0x04) {
                     return Err(Error::PeerMisbehaved(
                         PeerMisbehaved::InvalidKeyShare,
@@ -199,6 +205,8 @@ pub static SECP256R1: OsslEcKxGroup = OsslEcKxGroup(NamedGroup::secp256r1);
 
 pub static SECP384R1: OsslEcKxGroup = OsslEcKxGroup(NamedGroup::secp384r1);
 
+pub static SECP521R1: OsslEcKxGroup = OsslEcKxGroup(NamedGroup::secp521r1);
+
 pub static MLKEM768: OsslKemKxGroup = OsslKemKxGroup(NamedGroup::MLKEM768);
 
 pub static MLKEM1024: OsslKemKxGroup = OsslKemKxGroup(NamedGroup::MLKEM1024);
@@ -220,6 +228,9 @@ pub fn supported_kx_groups() -> Vec<&'static dyn SupportedKxGroup> {
         if EvpPkey::available(osslctx(), EvpPkeyType::X25519) {
             v.push(&X25519);
         }
+        if EvpPkey::available(osslctx(), EvpPkeyType::P521) {
+            v.push(&SECP521R1);
+        }
         if EvpPkey::available(osslctx(), EvpPkeyType::P384) {
             v.push(&SECP384R1);
         }

rustls/ossl/src/signer.rs

@@ -129,9 +129,10 @@ static ECC_SIG_SCHEMES: OnceLock<Vec<SignatureScheme>> = OnceLock::new();
 
 pub fn supported_ecc_sig_schemes() -> &'static [SignatureScheme] {
     let schemes = ECC_SIG_SCHEMES.get_or_init(|| {
-        let mut v = Vec::with_capacity(6);
+        let mut v = Vec::with_capacity(5);
         for s in [
             (SigAlg::Ed25519, SignatureScheme::ED25519),
+            (SigAlg::Ed448, SignatureScheme::ED448),
             (
                 SigAlg::EcdsaSha2_512,
                 SignatureScheme::ECDSA_NISTP521_SHA512,

rustls/ossl/tests/basic.rs

@@ -8,7 +8,11 @@ use std::time::{Duration, SystemTime};
 
 mod common;
 
-fn run_openssl_server_basic(key_args: &[&str]) {
+fn run_openssl_server_basic(
+    key_args: &[&str],
+    version: &'static rustls::SupportedProtocolVersion,
+    cipher_filter: &str,
+) {
     let dir = std::env::temp_dir().join(format!(
         "rustls_ossl_test_{}_{}",
         std::process::id(),
@@ -22,6 +26,11 @@ fn run_openssl_server_basic(key_args: &[&str]) {
     let key_path = dir.join("key.pem");
     let cert_path = dir.join("cert.pem");
 
+    // Generate a file to be served to the client
+    let test_file_path = dir.join("test.txt");
+    let test_content = b"OpenSSL -WWW test file content";
+    std::fs::write(&test_file_path, test_content).unwrap();
+
     // Generate self-signed certificate
     let mut args = vec!["req", "-x509"];
     args.extend_from_slice(key_args);
@@ -50,6 +59,7 @@ fn run_openssl_server_basic(key_args: &[&str]) {
 
     // Start OpenSSL server
     let mut server = Command::new("openssl")
+        .current_dir(&dir)
         .args(&[
             "s_server",
             "-key",
@@ -58,7 +68,7 @@ fn run_openssl_server_basic(key_args: &[&str]) {
             cert_path.to_str().unwrap(),
             "-accept",
             &port.to_string(),
-            "-www",
+            "-WWW",
         ])
         .stdout(Stdio::null())
         .stderr(Stdio::null())
@@ -82,11 +92,19 @@ fn run_openssl_server_basic(key_args: &[&str]) {
     let cert = rustls_pemfile::certs(&mut reader).next().unwrap().unwrap();
 
     // Use the rustls ossl module as CryptoProvider
-    let provider = Arc::new(rustls_ossl::default_provider());
+    let mut provider = rustls_ossl::default_provider();
+    provider
+        .cipher_suites
+        .retain(|cs| format!("{:?}", cs.suite()).contains(cipher_filter));
+    assert!(
+        !provider.cipher_suites.is_empty(),
+        "No cipher suites matched filter"
+    );
+    let provider = Arc::new(provider);
     let verifier = common::PinnedSelfSignedVerifier::new(cert.into_owned());
 
     let config = ClientConfig::builder_with_provider(provider)
-        .with_safe_default_protocol_versions()
+        .with_protocol_versions(&[version])
         .unwrap()
         .dangerous()
         .with_custom_certificate_verifier(Arc::new(verifier))
@@ -99,10 +117,20 @@ fn run_openssl_server_basic(key_args: &[&str]) {
     let mut socket = TcpStream::connect(("127.0.0.1", port)).unwrap();
     let mut stream = rustls::Stream::new(&mut client, &mut socket);
 
-    stream.write_all(b"GET / HTTP/1.0\r\n\r\n").unwrap();
+    stream.write_all(b"GET /test.txt HTTP/1.0\r\n\r\n").unwrap();
     let mut plaintext = Vec::new();
     stream.read_to_end(&mut plaintext).unwrap();
-    std::io::stdout().write_all(&plaintext).unwrap();
+
+    let header_end = plaintext
+        .windows(4)
+        .position(|window| window == b"\r\n\r\n")
+        .expect("Response does not contain HTTP headers");
+
+    let body = &plaintext[header_end + 4..];
+    assert_eq!(
+        body, test_content,
+        "Downloaded content does not match original"
+    );
 
     // Ensure we can properly kill the process and clean up
     server.kill().unwrap();
@@ -111,9 +139,65 @@ fn run_openssl_server_basic(key_args: &[&str]) {
 
 macro_rules! test_openssl_server_basic {
     ($name:ident, $args:expr) => {
-        #[test]
-        fn $name() {
-            run_openssl_server_basic($args);
+        mod $name {
+            use super::*;
+
+            #[cfg(feature = "tls12")]
+            #[test]
+            fn tls12_aes128() {
+                run_openssl_server_basic(
+                    $args,
+                    &rustls::version::TLS12,
+                    "AES_128",
+                );
+            }
+
+            #[cfg(feature = "tls12")]
+            #[test]
+            fn tls12_aes256() {
+                run_openssl_server_basic(
+                    $args,
+                    &rustls::version::TLS12,
+                    "AES_256",
+                );
+            }
+
+            #[cfg(feature = "tls12")]
+            #[test]
+            fn tls12_chacha20() {
+                run_openssl_server_basic(
+                    $args,
+                    &rustls::version::TLS12,
+                    "CHACHA20",
+                );
+            }
+
+            #[test]
+            fn tls13_aes128() {
+                run_openssl_server_basic(
+                    $args,
+                    &rustls::version::TLS13,
+                    "AES_128",
+                );
+            }
+
+            #[test]
+            fn tls13_aes256() {
+                run_openssl_server_basic(
+                    $args,
+                    &rustls::version::TLS13,
+                    "AES_256",
+                );
+            }
+
+            #[test]
+            fn tls13_chacha20() {
+                run_openssl_server_basic(
+                    $args,
+                    &rustls::version::TLS13,
+                    "CHACHA20",
+                );
+            }
         }
     };
 }