From f4662dbaf6b571f8e6302807327bd54ffe131295 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 15 Apr 2025 08:19:58 +0200 Subject: [PATCH 1/4] generate_config_tests.py: remove usage of MBEDTLS_NO_PLATFORM_ENTROPY Signed-off-by: Valerio Setti --- scripts/generate_config_tests.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scripts/generate_config_tests.py b/scripts/generate_config_tests.py index 013fc0680..dcc73c30c 100755 --- a/scripts/generate_config_tests.py +++ b/scripts/generate_config_tests.py @@ -58,7 +58,6 @@ SIMPLE_DEPENDENCIES = { 'MBEDTLS_ERROR_STRERROR_DUMMY': '!MBEDTLS_ERROR_C', 'MBEDTLS_GENPRIME': 'MBEDTLS_RSA_C', 'MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES': 'MBEDTLS_ENTROPY_C', - 'MBEDTLS_NO_PLATFORM_ENTROPY': 'MBEDTLS_ENTROPY_C', 'MBEDTLS_PKCS1_V15': 'MBEDTLS_RSA_C', 'MBEDTLS_PKCS1_V21': 'MBEDTLS_RSA_C', 'MBEDTLS_PSA_CRYPTO_CLIENT': '!MBEDTLS_PSA_CRYPTO_C', @@ -66,6 +65,9 @@ SIMPLE_DEPENDENCIES = { 'MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS': 'MBEDTLS_PSA_CRYPTO_C', } +if build_tree.is_mbedtls_3_6(): + SIMPLE_DEPENDENCIES['MBEDTLS_NO_PLATFORM_ENTROPY'] = 'MBEDTLS_ENTROPY_C' + def dependencies_of_setting(cfg: config_common.Config, setting: config_common.Setting) -> Optional[str]: """Return dependencies without which a setting is not meaningful. From 566659e20e1e411e7e52a00ff9a57c5d3b27e4d4 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Wed, 16 Apr 2025 11:24:11 +0200 Subject: [PATCH 2/4] tests: add functions to force behavior of mbedtls_platform_get_entropy_alt() Signed-off-by: Valerio Setti --- .../include/test/fake_external_rng_for_test.h | 17 +++++++++++++++ tests/src/fake_external_rng_for_test.c | 21 +++++++++++++++++-- 2 files changed, 36 insertions(+), 2 deletions(-) diff --git a/tests/include/test/fake_external_rng_for_test.h b/tests/include/test/fake_external_rng_for_test.h index e3e331d55..f5aa86e92 100644 --- a/tests/include/test/fake_external_rng_for_test.h +++ b/tests/include/test/fake_external_rng_for_test.h @@ -37,4 +37,21 @@ void mbedtls_test_enable_insecure_external_rng(void); void mbedtls_test_disable_insecure_external_rng(void); #endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ +#if defined(MBEDTLS_PLATFORM_GET_ENTROPY_ALT) + +#include + +/* Force return value or entropy content in mbedtls_platform_get_entropy_alt() + * as follows: + * - if fail == 0 && forced_entropy_content == 0 then + * mbedtls_platform_get_entropy_alt() behaves properly. + * - if fail != 0 then MBEDTLS_ERR_ENTROPY_SOURCE_FAILED is returned. + * - if forced_entropy_content != 0 then + * - return value is success (0) but + * - returned entropy_content will be equal to forced_entropy_content. + */ +void mbedtls_test_get_entropy_alt_force(int fail, size_t forced_entropy_content); + +#endif /* MBEDTLS_PLATFORM_GET_ENTROPY_ALT */ + #endif /* FAKE_EXTERNAL_RNG_FOR_TEST_H */ diff --git a/tests/src/fake_external_rng_for_test.c b/tests/src/fake_external_rng_for_test.c index 1eae045f3..d766af164 100644 --- a/tests/src/fake_external_rng_for_test.c +++ b/tests/src/fake_external_rng_for_test.c @@ -54,16 +54,33 @@ psa_status_t mbedtls_psa_external_get_random( #if defined(MBEDTLS_PLATFORM_GET_ENTROPY_ALT) #include -# include +#include + +static int get_entropy_alt_force_failure = 0; +static size_t get_entropy_alt_forced_entropy_content = 0; + +void mbedtls_test_get_entropy_alt_force(int fail, size_t forced_entropy_content) +{ + get_entropy_alt_force_failure = fail; + get_entropy_alt_forced_entropy_content = forced_entropy_content; +} int mbedtls_platform_get_entropy_alt(unsigned char *output, size_t output_size, size_t *output_len, size_t *entropy_content) { + if (get_entropy_alt_force_failure != 0) { + return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED; + } + mbedtls_test_rnd_std_rand(NULL, output, output_size); *output_len = output_size; if (entropy_content != NULL) { - *entropy_content = output_size * 8; + if (get_entropy_alt_forced_entropy_content != 0) { + *entropy_content = get_entropy_alt_forced_entropy_content; + } else { + *entropy_content = output_size * 8; + } } return 0; From 6f0b670d3a28e2fb401562eb04e68245a3302e13 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Wed, 16 Apr 2025 16:30:11 +0200 Subject: [PATCH 3/4] tests: rename mbedtls_platform_get_entropy_alt() Since mbedtls_platform_get_entropy_alt() is being renamed to mbedtls_platform_get_entropy() on the tf-psa-crypto repo, this commit adapts to testing support. Signed-off-by: Valerio Setti --- tests/include/test/fake_external_rng_for_test.h | 6 +++--- tests/src/fake_external_rng_for_test.c | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/tests/include/test/fake_external_rng_for_test.h b/tests/include/test/fake_external_rng_for_test.h index f5aa86e92..330399908 100644 --- a/tests/include/test/fake_external_rng_for_test.h +++ b/tests/include/test/fake_external_rng_for_test.h @@ -41,16 +41,16 @@ void mbedtls_test_disable_insecure_external_rng(void); #include -/* Force return value or entropy content in mbedtls_platform_get_entropy_alt() +/* Force return value or entropy content in mbedtls_platform_get_entropy() * as follows: * - if fail == 0 && forced_entropy_content == 0 then - * mbedtls_platform_get_entropy_alt() behaves properly. + * mbedtls_platform_get_entropy() behaves properly. * - if fail != 0 then MBEDTLS_ERR_ENTROPY_SOURCE_FAILED is returned. * - if forced_entropy_content != 0 then * - return value is success (0) but * - returned entropy_content will be equal to forced_entropy_content. */ -void mbedtls_test_get_entropy_alt_force(int fail, size_t forced_entropy_content); +void mbedtls_test_get_entropy_force(int fail, size_t forced_entropy_content); #endif /* MBEDTLS_PLATFORM_GET_ENTROPY_ALT */ diff --git a/tests/src/fake_external_rng_for_test.c b/tests/src/fake_external_rng_for_test.c index d766af164..f00cb07ba 100644 --- a/tests/src/fake_external_rng_for_test.c +++ b/tests/src/fake_external_rng_for_test.c @@ -2,7 +2,7 @@ * * Helper functions to test external functions: * - mbedtls_psa_external_get_random() - * - mbedtls_platform_get_entropy_alt() + * - mbedtls_platform_get_entropy() * * These functions are provided only for test purposes and they should not be * used for production. @@ -59,14 +59,14 @@ psa_status_t mbedtls_psa_external_get_random( static int get_entropy_alt_force_failure = 0; static size_t get_entropy_alt_forced_entropy_content = 0; -void mbedtls_test_get_entropy_alt_force(int fail, size_t forced_entropy_content) +void mbedtls_test_get_entropy_force(int fail, size_t forced_entropy_content) { get_entropy_alt_force_failure = fail; get_entropy_alt_forced_entropy_content = forced_entropy_content; } -int mbedtls_platform_get_entropy_alt(unsigned char *output, size_t output_size, - size_t *output_len, size_t *entropy_content) +int mbedtls_platform_get_entropy(unsigned char *output, size_t output_size, + size_t *output_len, size_t *entropy_content) { if (get_entropy_alt_force_failure != 0) { return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED; From dbf62a596d64808eefd5126cdf41af7a07357464 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Fri, 18 Apr 2025 10:21:40 +0200 Subject: [PATCH 4/4] tests: fake_external_rng_for_test: use SIZE_MAX to disable wrong entropy contnet Use SIZE_MAX instead of 0 in order to be more future proof. Signed-off-by: Valerio Setti --- tests/src/fake_external_rng_for_test.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/src/fake_external_rng_for_test.c b/tests/src/fake_external_rng_for_test.c index f00cb07ba..60e39e3f1 100644 --- a/tests/src/fake_external_rng_for_test.c +++ b/tests/src/fake_external_rng_for_test.c @@ -57,7 +57,7 @@ psa_status_t mbedtls_psa_external_get_random( #include static int get_entropy_alt_force_failure = 0; -static size_t get_entropy_alt_forced_entropy_content = 0; +static size_t get_entropy_alt_forced_entropy_content = SIZE_MAX; void mbedtls_test_get_entropy_force(int fail, size_t forced_entropy_content) { @@ -76,7 +76,7 @@ int mbedtls_platform_get_entropy(unsigned char *output, size_t output_size, *output_len = output_size; if (entropy_content != NULL) { - if (get_entropy_alt_forced_entropy_content != 0) { + if (get_entropy_alt_forced_entropy_content < SIZE_MAX) { *entropy_content = get_entropy_alt_forced_entropy_content; } else { *entropy_content = output_size * 8;