Repository: istio/istio
File: tests/integration/security/pqc/main_test.go (Go)

Code before:
spec:
  hosts:
  - "{{ .Host }}"
  gateways:
  - {{ .CredentialName }}
  http:
  - route:
    - destination:
        host: {{ .ServiceName }}
        port:
          number: 80
`
			credName := "ingress-pqc-credential"
			host := "ingress-pqc.example.com"
			ingressConfig := map[string]string{
				"CredentialName": credName,
				"Host":           host,
				"ServiceName":    fmt.Sprintf("%s.%s.svc.cluster.local", a.Config().Service, internalNs.Name()),
				"GatewayLabel":   i.Settings().IngressGatewayIstioLabel,
			}
			t.ConfigIstio().Eval(internalNs.Name(), ingressConfig, gatewayTmpl).ApplyOrFail(t, apply.Wait)
			ingressutil.CreateIngressKubeSecret(t, credName, ingressutil.TLS, ingressutil.IngressCredentialA, false)

			ing := i.IngressFor(t.Clusters().Default())
			if ing == nil {
				t.Fatalf("failed to find ingress gateway %s", credName)
			}

			t.NewSubTest("request with TLS 1.3 and X25519MLKEM768 succeeds").Run(func(t framework.TestContext) {
				ing.CallOrFail(t, echo.CallOptions{
					HTTP: echo.HTTP{
						Headers: headers.New().WithHost(host).Build(),
					},
					Port: echo.Port{
						Protocol: protocol.HTTPS,
					},
					TLS: echo.TLS{
						CaCert:           ingressutil.CaCertA,
						MinVersion:       "1.3",
						CurvePreferences: []string{"X25519MLKEM768"},
					},
					Check: check.Status(http.StatusOK),
				})
			})

			t.NewSubTest("request with non-PQC curve is rejected").Run(func(t framework.TestContext) {
				ing.CallOrFail(t, echo.CallOptions{
					HTTP: echo.HTTP{
						Headers: headers.New().WithHost(host).Build(),
					},
					Port: echo.Port{

Review comment (bug):
```suggestion
				t.Fatalf("failed to find ingress gateway for cluster %s", t.Clusters().Default().Name())
```

Code after:
  name: {{ .CredentialName }}
spec:
  hosts:
  - "{{ .Host }}"
  gateways:
  - {{ .CredentialName }}
  http:
  - route:
    - destination:
        host: {{ .ServiceName }}
        port:
          number: 80
`
			credName := "ingress-pqc-credential"
			host := "ingress-pqc.example.com"
			ingressConfig := map[string]string{
				"CredentialName": credName,
				"Host":           host,
				"ServiceName":    fmt.Sprintf("%s.%s.svc.cluster.local", a.Config().Service, internalNs.Name()),
				"GatewayLabel":   i.Settings().IngressGatewayIstioLabel,
			}
			t.ConfigIstio().Eval(internalNs.Name(), ingressConfig, gatewayTmpl).ApplyOrFail(t, apply.Wait)
			ingressutil.CreateIngressKubeSecret(t, credName, ingressutil.TLS, ingressutil.IngressCredentialA, false)

			ing := i.IngressFor(t.Clusters().Default())
			if ing == nil {
				t.Fatalf("failed to find ingress gateway for cluster %s", t.Clusters().Default().Name())
			}

			t.NewSubTest("request with TLS 1.3 and X25519MLKEM768 succeeds").Run(func(t framework.TestContext) {
				ing.CallOrFail(t, echo.CallOptions{
					HTTP: echo.HTTP{
						Headers: headers.New().WithHost(host).Build(),
					},
					Port: echo.Port{
						Protocol: protocol.HTTPS,
					},
					TLS: echo.TLS{
						CaCert:           ingressutil.CaCertA,
						MinVersion:       "1.3",
						CurvePreferences: []string{"X25519MLKEM768"},
					},
					Check: check.Status(http.StatusOK),
				})
			})

			t.NewSubTest("request with non-PQC curve is rejected").Run(func(t framework.TestContext) {
				ing.CallOrFail(t, echo.CallOptions{
					HTTP: echo.HTTP{
						Headers: headers.New().WithHost(host).Build(),
					},