Repository: randombit/botan
Pull request #3740 (2023-10-09 08:10:14)

CI: Test nightly Hybrid PQ/T TLS interoperability
This adds a nightly job to run [the PQ/T interoperability tests](https://github.com/randombit/botan/pull/3732) against online (beta) services. We don't do that on normal CI runs to avoid introducing a(nother) direct dependency to 3rd party services there.


Patch:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 9b1f99cc2..78cf9d0d6 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -11,6 +11,12 @@ permissions:
   # implicitly all other scopes not listed become none
 
 on:
+  workflow_dispatch:
+  push:
+    paths:
+      # Run if a pull request changes this workflow to
+      # validate it works properly before merging.
+      - '.github/workflows/nightly.yml'
   schedule:
     # runs every day at 3:23 AM UTC
     - cron:  '23 3 * * *'
@@ -56,6 +62,23 @@ jobs:
       - name: Valgrind Checks
         run: python3 ./src/scripts/ci_build.py --cc=gcc --make-tool=make valgrind-full
 
+  hybrid_tls_interop:
+    name: "PQ/T TLS 1.3"
+
+    runs-on: ubuntu-22.04
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Setup Build Agent
+        uses: ./.github/actions/setup-build-agent
+        with:
+          target: hybrid-tls13-interop-test
+          cache-key: linux-x86_64-hybrid_tls
+
+      - name: Hybrid PQ/T TLS 1.3 Online Interop Checks
+        run: python3 ./src/scripts/ci_build.py --cc=gcc --make-tool=make hybrid-tls13-interop-test
+
   tls_anvil_server_test:
     name: "TLS-Anvil (server)"
 
diff --git a/news.rst b/news.rst
index 586176eac..96a3504d4 100644
--- a/news.rst
+++ b/news.rst
@@ -1,11 +1,11 @@
 Release Notes
 ========================================
 
-Version 3.2.0, 2023-10-09
+Version 3.2.0, Not Yet Released
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 * Add support for (experimental!) post-quantum secure key exchange
-  in TLS 1.3 (GH #3609 #3732 #3733 #3739)
+  in TLS 1.3 (GH #3609 #3732 #3733)
 
 * Add support for TLS PSK (GH #3618)
 
@@ -70,9 +70,6 @@ Version 3.2.0, 2023-10-09
 * Add helper for buffer alignment, and adopt it within the hash function
   implementations. (GH #3693)
 
-* Added support for encoding CRL Distribution Points extension in new
-  certificates (GH #3712)
-
 * Internal refactoring of SHA-3 to support further SHA-3 derived functionality
   (GH #3673)
 
diff --git a/readme.rst b/readme.rst
index ad22a9bf8..8fc6ca66f 100644
--- a/readme.rst
+++ b/readme.rst
@@ -60,9 +60,9 @@ The latest release from the Botan2 release series is
 released on 2022-11-16.
 
 The latest release from the Botan3 release series is
-`3.2.0 <https://botan.randombit.net/releases/Botan-3.2.0.tar.xz>`_
-`(sig) <https://botan.randombit.net/releases/Botan-3.2.0.tar.xz.asc>`_,
-released on 2023-10-09.
+`3.1.1 <https://botan.randombit.net/releases/Botan-3.1.1.tar.xz>`_
+`(sig) <https://botan.randombit.net/releases/Botan-3.1.1.tar.xz.asc>`_,
+released on 2023-07-13.
 
 All releases are signed with a `PGP key <https://botan.randombit.net/pgpkey.txt>`_.
 See the `release notes <https://botan.randombit.net/news.html>`_ for
diff --git a/src/lib/block/aes/aes_ni/info.txt b/src/lib/block/aes/aes_ni/info.txt
index a3c78520d..8e6e69c8d 100644
--- a/src/lib/block/aes/aes_ni/info.txt
+++ b/src/lib/block/aes/aes_ni/info.txt
@@ -7,10 +7,6 @@ name -> "AES-NI"
 brief -> "AES using AES-NI and SIMD instructions"
 </module_info>
 
-<requires>
-simd
-</requires>
-
 <isa>
 sse2
 ssse3
diff --git a/src/lib/x509/x509_ext.cpp b/src/lib/x509/x509_ext.cpp
index 2e8fbf142..f1e1b5b64 100644
--- a/src/lib/x509/x509_ext.cpp
+++ b/src/lib/x509/x509_ext.cpp
@@ -723,9 +723,7 @@ void CRL_ReasonCode::decode_inner(const std::vector<uint8_t>& in) {
 }
 
 std::vector<uint8_t> CRL_Distribution_Points::encode_inner() const {
-   std::vector<uint8_t> output;
-   DER_Encoder(output).start_sequence().encode_list(m_distribution_points).end_cons();
-   return output;
+   throw Not_Implemented("CRL_Distribution_Points encoding");
 }
 
 void CRL_Distribution_Points::decode_inner(const std::vector<uint8_t>& buf) {
@@ -744,22 +742,8 @@ void CRL_Distribution_Points::decode_inner(const std::vector<uint8_t>& buf) {
    m_crl_distribution_urls.push_back(ss.str());
 }
 
-void CRL_Distribution_Points::Distribution_Point::encode_into(DER_Encoder& der) const {
-   if(!m_point.get_attributes().contains("URI")) {
-      throw Not_Implemented("Empty CRL_Distribution_Point encoding");
-   }
-
-   const auto range = m_point.get_attributes().equal_range("URI");
-
-   for(auto i = range.first; i != range.second; ++i) {
-      der.start_sequence()
-         .start_cons(ASN1_Type(0), ASN1_Class::ContextSpecific)
-         .start_cons(ASN1_Type(0), ASN1_Class::ContextSpecific)
-         .add_object(ASN1_Type(6), ASN1_Class::ContextSpecific, i->second)
-         .end_cons()
-         .end_cons()
-         .end_cons();
-   }
+void CRL_Distribution_Points::Distribution_Point::encode_into(DER_Encoder& /*to*/) const {
+   throw Not_Implemented("CRL_Distribution_Points encoding");
 }
 
 void CRL_Distribution_Points::Distribution_Point::decode_from(BER_Decoder& ber) {
diff --git a/src/lib/x509/x509_ext.h b/src/lib/x509/x509_ext.h
index 08a3ecc92..8d3c968d7 100644
--- a/src/lib/x509/x509_ext.h
+++ b/src/lib/x509/x509_ext.h
@@ -401,8 +401,6 @@ class BOTAN_PUBLIC_API(2, 0) CRL_Distribution_Points final : public Certificate_
             void encode_into(DER_Encoder&) const override;
             void decode_from(BER_Decoder&) override;
 
-            explicit Distribution_Point(const AlternativeName& name = AlternativeName()) : m_point(name) {}
-
             const AlternativeName& point() const { return m_point; }
 
          private:
diff --git a/src/scripts/ci_build.py b/src/scripts/ci_build.py
index f73b9461d..33a34e3cd 100755
--- a/src/scripts/ci_build.py
+++ b/src/scripts/ci_build.py
@@ -51,6 +51,7 @@ def known_targets():
         'examples',
         'format',
         'fuzzers',
+        'hybrid-tls13-interop-test',
         'lint',
         'minimized',
         'nist',
@@ -198,6 +199,9 @@ def determine_flags(target, target_os, target_cpu, target_cc, cc_bin, ccache,
     if target == 'codeql':
         test_cmd = None
 
+    if target == 'hybrid-tls13-interop-test':
+        test_cmd = None
+
     if target == 'cross-win64':
         # this test compiles under MinGW but fails when run under Wine
         disabled_tests.append('certstor_system')
@@ -734,6 +738,10 @@ def main(args=None):
                 cmds.append([py_interp, os.path.join(root_dir, 'src/scripts', script)] +
                             args + test_data_arg + [botan_exe])
 
+        if target in ['hybrid-tls13-interop-test']:
+            cmds.append([py_interp, os.path.join(root_dir, 'src/scripts/test_cli.py'),
+                         '--run-online-tests', os.path.join(build_dir, 'botan'), 'pqc_hybrid_tests'])
+
         python_tests = [os.path.join(root_dir, 'src/scripts/test_python.py')]
         if root_dir != '.':
             python_tests.append('--test-data-dir=%s' % root_dir)


Test patch:
diff --git a/src/scripts/test_cli.py b/src/scripts/test_cli.py
index a3a3ba85a..7da461850 100755
--- a/src/scripts/test_cli.py
+++ b/src/scripts/test_cli.py
@@ -1133,7 +1133,6 @@ def cli_tls_online_pqc_hybrid_tests(tmp_dir):
     test_cfg = [
         TestConfig("pq.cloudflareresearch.com", "x25519/Kyber-512-r3/cloudflare"),
         TestConfig("pq.cloudflareresearch.com", "x25519/Kyber-768-r3"),
-        TestConfig("google.com", "x25519/Kyber-768-r3"),
 
         TestConfig("qsc.eu-de.kms.cloud.ibm.com", "secp256r1/Kyber-512-r3"),
         TestConfig("qsc.eu-de.kms.cloud.ibm.com", "secp384r1/Kyber-768-r3"),
diff --git a/src/tests/unit_x509.cpp b/src/tests/unit_x509.cpp
index 6bc3d3fc1..d8cad5aba 100644
--- a/src/tests/unit_x509.cpp
+++ b/src/tests/unit_x509.cpp
@@ -1275,20 +1275,6 @@ Test::Result test_x509_extensions(const Botan::Private_Key& ca_key,
    /* Create the CA object */
    Botan::X509_CA ca(ca_cert, ca_key, hash_fn, sig_padding, Test::rng());
 
-   /* Prepare CDP extension */
-   std::vector<std::string> cdp_urls = {
-      "http://example.com/crl1.pem",
-      "ldap://ldap.example.com/cn=crl1,dc=example,dc=com?certificateRevocationList;binary"};
-
-   std::vector<Botan::Cert_Extension::CRL_Distribution_Points::Distribution_Point> dps;
-
-   for(const auto& uri : cdp_urls) {
-      Botan::AlternativeName cdp_alt_name("", uri);
-      Botan::Cert_Extension::CRL_Distribution_Points::Distribution_Point dp(cdp_alt_name);
-
-      dps.emplace_back(dp);
-   }
-
    auto user_key = make_a_private_key(sig_algo);
 
    Botan::X509_Cert_Options opts("Test User 1/US/Botan Project/Testing");
@@ -1299,7 +1285,6 @@ Test::Result test_x509_extensions(const Botan::Private_Key& ca_key,
    const Botan::OID oid("1.2.3.4.5.6.7.8.9.1");
    const Botan::OID ku_oid = Botan::OID::from_string("X509v3.KeyUsage");
    req_extensions.add(std::make_unique<String_Extension>("AAAAAAAAAAAAAABCDEF"), false);
-   req_extensions.add(std::make_unique<Botan::Cert_Extension::CRL_Distribution_Points>(dps));
    opts.extensions = req_extensions;
    opts.set_padding_scheme(sig_padding);
 
@@ -1325,18 +1310,6 @@ Test::Result test_x509_extensions(const Botan::Private_Key& ca_key,
          "Custom extension value matches in self-signed certificate", string_ext->value(), "AAAAAAAAAAAAAABCDEF");
    }
 
-   // check if CDPs are present in the self-signed cert
-   auto cert_cdps =
-      self_signed_cert.v3_extensions().get_extension_object_as<Botan::Cert_Extension::CRL_Distribution_Points>();
-
-   if(result.confirm("CRL Distribution Points extension present in self-signed certificate",
-                     !cert_cdps->crl_distribution_urls().empty())) {
-      for(const auto& cdp : cert_cdps->distribution_points()) {
-         result.confirm("CDP URI present in self-signed certificate",
-                        std::ranges::find(cdp_urls, cdp.point().get_first_attribute("URI")) != cdp_urls.end());
-      }
-   }
-
    const Botan::PKCS10_Request user_req = Botan::X509::create_cert_req(opts, *user_key, hash_fn, Test::rng());
 
    /* Create a CA-signed certificate */
@@ -1362,17 +1335,6 @@ Test::Result test_x509_extensions(const Botan::Private_Key& ca_key,
          "Custom extension value matches in CA-signed certificate", string_ext->value(), "AAAAAAAAAAAAAABCDEF");
    }
 
-   // check if CDPs are present in the CA-signed cert
-   cert_cdps = ca_signed_cert.v3_extensions().get_extension_object_as<Botan::Cert_Extension::CRL_Distribution_Points>();
-
-   if(result.confirm("CRL Distribution Points extension present in self-signed certificate",
-                     !cert_cdps->crl_distribution_urls().empty())) {
-      for(const auto& cdp : cert_cdps->distribution_points()) {
-         result.confirm("CDP URI present in self-signed certificate",
-                        std::ranges::find(cdp_urls, cdp.point().get_first_attribute("URI")) != cdp_urls.end());
-      }
-   }
-
    return result;
 }