Merge 10a2806f12 into 2628ac1884

Update liboqs and oqs-provider submodules - Add X25519MLKEM768 NIST f…

.cirrus.yml

@@ -13,10 +13,10 @@ FreeBSD_task:
     freebsd_instance:
       image_family: freebsd-14-0
   prepare_script:
-    - pkg install -y pkgconf cmake git libsodium $SSL
+    - pkg install -y pkgconf cmake git libsodium cpu_features $SSL
     - git submodule update --init --recursive
   configure_script:
-    - ./configure
+    - CMAKE_FLAGS="-DUSE_SYSTEM_CPU_FEATURES=1" CFLAGS="-I/usr/local/include/cpu_features" ./configure
   build_script:
     - make -j $(sysctl -n hw.ncpu || echo 4) -C build
   test_script:

.github/workflows/linux.yml

@@ -26,6 +26,13 @@ jobs:
         cd build
         cpack -C Release -G DEB 
 
+    - name: Upload DEB packages as artifacts
+      if: github.ref == 'refs/heads/master'
+      uses: actions/upload-artifact@v4
+      with:
+        name: deb-packages
+        path: build/*.deb
+
     - name: Test
       run: |
        .ci/appveyor-deb-install-test.sh

.github/workflows/macos.yml

@@ -7,7 +7,7 @@ jobs:
   build_and_test:
     strategy:
       matrix:
-        os: [macos-14, macos-13, macos-12]
+        os: [macos-15, macos-14, macos-13]
     name: ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     steps:

developer_tools/stbchecker/stbchecker.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net7.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
   </PropertyGroup>
 
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|AnyCPU'">

src/CMakeLists.txt

@@ -127,6 +127,9 @@ if(UNIX)
   if(SE_PIDDIR)
     add_definitions(-DSE_PIDDIR="${SE_PIDDIR}")
   endif()
+
+  # Use system libraries instead of bundled
+  set(USE_SYSTEM_CPU_FEATURES false CACHE BOOL "Use system cpu_features")
 endif()
 
 # Cedar communication module

src/Mayaqua/CMakeLists.txt

@@ -109,8 +109,21 @@ if(UNIX)
       $<$<BOOL:${LIB_RT}>:${LIB_RT}>
   )
 
-  if (CMAKE_SYSTEM_PROCESSOR MATCHES "^(armv7l|aarch64|s390x)$" OR NOT HAVE_SYS_AUXV OR SKIP_CPU_FEATURES)
+  if (NOT HAVE_SYS_AUXV OR SKIP_CPU_FEATURES)
     add_definitions(-DSKIP_CPU_FEATURES)
+  elseif(${CMAKE_SYSTEM_NAME} STREQUAL "FreeBSD" AND NOT CMAKE_SYSTEM_PROCESSOR MATCHES "^(amd64|i386)")
+    message("cpu_features is not available on FreeBSD/${CMAKE_SYSTEM_PROCESSOR}")
+    add_definitions(-DSKIP_CPU_FEATURES)
+  elseif(${CMAKE_SYSTEM_NAME} STREQUAL "Darwin" AND NOT CMAKE_SYSTEM_NAME MATCHES "^(arm64|x86_64)")
+    # macOS runs only on Intel or ARM architecrues, should not reach here
+    add_definitions(-DSKIP_CPU_FEATURES)
+  elseif(${CMAKE_SYSTEM_NAME} STREQUAL "SunOS" OR ${CMAKE_SYSTEM_NAME} STREQUAL "OpenBSD")
+    message("cpu_features is not available on ${CMAKE_SYSTEM_NAME}")
+    add_definitions(-DSKIP_CPU_FEATURES)
+  elseif(USE_SYSTEM_CPU_FEATURES)
+    CHECK_INCLUDE_FILE(cpu_features_macros.h HAVE_CPU_FEATURES)
+    message("-- Using system's cpu_features")
+    target_link_libraries(mayaqua PRIVATE cpu_features)
   else()
     add_subdirectory(3rdparty/cpu_features)
     set_property(TARGET cpu_features PROPERTY POSITION_INDEPENDENT_CODE ON)

src/Mayaqua/Microsoft.c

@@ -4259,7 +4259,7 @@ UINT MsService(char *name, SERVICE_FUNCTION *start, SERVICE_FUNCTION *stop, UINT
 
 		if ((mode == SVC_MODE_INSTALL || mode == SVC_MODE_UNINSTALL || mode == SVC_MODE_START ||
 			mode == SVC_MODE_STOP || mode == SVC_MODE_SERVICE) &&
-			(ms->IsNt == false))
+			(IsNt() == false))
 		{
 			// Tried to use the command for the NT in non-WindowsNT system
 			MsgBox(NULL, MB_ICONSTOP, _UU("SVC_NT_ONLY"));

src/Mayaqua/Microsoft.h

@@ -170,7 +170,6 @@ typedef struct MS
 {
 	HINSTANCE hInst;
 	HINSTANCE hKernel32;
-	bool IsNt;
 	bool IsAdmin;
 	HANDLE hCurrentProcess;
 	UINT CurrentProcessId;

src/Mayaqua/Network.h

@@ -60,7 +60,7 @@ struct DYN_VALUE
 #define	DEFAULT_CIPHER_LIST			"ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDHE+AES256:DHE+AES256:RSA+AES"
 
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#define PQ_GROUP_LIST				"p521_kyber1024:x25519_kyber768:P-521:X25519:P-256"
+#define PQ_GROUP_LIST				"X25519MLKEM768:p521_kyber1024:x25519_kyber768:P-521:X25519:P-256"
 #endif
 
 // SSL logging function

src/vpncmd/vpncmd.c

@@ -6,7 +6,9 @@
 // VPN Command Line Management Utility
 
 #include "Cedar/Cedar.h"
-
+#ifdef OS_WIN32
+#include "Cedar/CMInner.h"
+#endif
 #include "Cedar/Command.h"
 
 #include "Mayaqua/Internat.h"
@@ -39,6 +41,10 @@ int main(int argc, char *argv[])
 #endif
 	InitCedar();
 
+#ifdef OS_WIN32
+	CmExecUiHelperMain();
+#endif
+
 	s = GetCommandLineUniStr();
 
 	if (s == NULL)

systemd/softether-vpnbridge.service

@@ -4,11 +4,8 @@ After=network.target auditd.service
 ConditionPathExists=!@DIR@/softether/vpnbridge/do_not_run
 
 [Service]
-Type=forking
-EnvironmentFile=-@DIR@/softether/vpnbridge
-ExecStart=@DIR@/softether/vpnbridge/vpnbridge start
-ExecStop=@DIR@/softether/vpnbridge/vpnbridge stop
-KillMode=process
+Type=exec
+ExecStart=@DIR@/softether/vpnbridge/vpnbridge execsvc
 Restart=on-failure
 
 # Hardening

systemd/softether-vpnclient.service

@@ -4,11 +4,8 @@ After=network.target auditd.service
 ConditionPathExists=!@DIR@/softether/vpnclient/do_not_run
 
 [Service]
-Type=forking
-EnvironmentFile=-@DIR@/softether/vpnclient
-ExecStart=@DIR@/softether/vpnclient/vpnclient start
-ExecStop=@DIR@/softether/vpnclient/vpnclient stop
-KillMode=process
+Type=exec
+ExecStart=@DIR@/softether/vpnclient/vpnclient execsvc
 Restart=on-failure
 
 # Hardening

systemd/softether-vpnserver.service

@@ -4,12 +4,9 @@ After=network.target auditd.service
 ConditionPathExists=!@DIR@/softether/vpnserver/do_not_run
 
 [Service]
-Type=forking
+Type=exec
 TasksMax=infinity
-EnvironmentFile=-@DIR@/softether/vpnserver
-ExecStart=@DIR@/softether/vpnserver/vpnserver start
-ExecStop=@DIR@/softether/vpnserver/vpnserver stop
-KillMode=process
+ExecStart=@DIR@/softether/vpnserver/vpnserver execsvc
 Restart=on-failure
 
 # Hardening