nts: allow missing SIV support

When compiled with NTS support, don't require a SIV cipher to be always
supported (e.g. due to a different version of a library used for
building). Handle this case with a fatal message instead of crash.
Also, check the support early in the client unit test to prevent a hang.

diff --git a/nts_ke_server.c b/nts_ke_server.c
index ca3c04b34873a05f1ebce85c1e34691fcf38a261..76bb6a39a2f5864f2e8dcaa4e7b0dc4d06fefd46 100644 (file)
--- a/nts_ke_server.c
+++ b/nts_ke_server.c
@@ -433,8 +433,11 @@ generate_key(int index)
     assert(0);
 
   UTI_GetRandomBytesUrandom(server_keys[index].key, key_length);
-  if (!SIV_SetKey(server_keys[index].siv, server_keys[index].key, key_length))
-    assert(0);
+
+  if (!server_keys[index].siv ||
+      !SIV_SetKey(server_keys[index].siv, server_keys[index].key, key_length)) {
+    LOG_FATAL("Could not set SIV key");
+  }
 
   UTI_GetRandomBytes(&server_keys[index].id, sizeof (server_keys[index].id));
 

diff --git a/nts_ntp_server.c b/nts_ntp_server.c
index 6718c5ab138d5097286ed11a185997630f50c620..f4df796b8bfca3dfa7a5d88ed8fa2d68292369ef 100644 (file)
--- a/nts_ntp_server.c
+++ b/nts_ntp_server.c
@@ -67,6 +67,8 @@ NNS_Initialise(void)
 
   server = Malloc(sizeof (struct NtsServer));
   server->siv = SIV_CreateInstance(SERVER_SIV);
+  if (!server->siv)
+    LOG_FATAL("Could not initialise SIV cipher");
 }
 
 /* ================================================== */

diff --git a/test/unit/nts_ntp_client.c b/test/unit/nts_ntp_client.c
index ad76fc826c1fe4832ba898448ca5dd8a56b1f856..448ff7eb74266c2458f666065fd24c2174178a9e 100644 (file)
--- a/test/unit/nts_ntp_client.c
+++ b/test/unit/nts_ntp_client.c
@@ -200,6 +200,8 @@ test_unit(void)
   IPAddr ip_addr;
   int i, j, prev_num_cookies, valid;
 
+  TEST_CHECK(SIV_GetKeyLength(AEAD_AES_SIV_CMAC_256) > 0);
+
   SCK_GetLoopbackIPAddress(AF_INET, &addr.ip_addr);
   addr.port = 0;