Add entropy safety switch.
Add a switch that turns entropy collecting off entirely, but enables
mbed TLS to run in an entirely unsafe mode. Enables to test mbed TLS
on platforms that don't have their entropy sources integrated yet.
diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index d31555d..407cd57 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -130,6 +130,17 @@
#error "MBEDTLS_ENTROPY_FORCE_SHA256 defined, but not all prerequisites"
#endif
+#if defined(MBEDTLS_TEST_WO_ENTROPY)
+#warning "MBEDTLS_TEST_WO_ENTROPY defined, this build provides no security!"
+#if !defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
+#error "MBEDTLS_TEST_WO_ENTROPY defined, but not all prerequisites"
+#endif
+#if defined(MBEDTLS_ENTROPY_NV_SEED) || defined(MBEDTLS_ENTROPY_HARDWARE_ALT) || \
+ defined(MBEDTLS_HAVEGE_C)
+#error "MBEDTLS_TEST_WO_ENTROPY defined, but entropy sources too"
+#endif
+#endif
+
#if defined(MBEDTLS_GCM_C) && ( \
!defined(MBEDTLS_AES_C) && !defined(MBEDTLS_CAMELLIA_C) )
#error "MBEDTLS_GCM_C defined, but not all prerequisites"
diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index 0efee04..c42b88d 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -279,6 +279,29 @@
//#define MBEDTLS_AES_DECRYPT_ALT
/**
+ * \def MBEDTLS_TEST_WO_ENTROPY
+ *
+ * Enable testing mbed TLS without access to any entropy. This enables testing
+ * the library before the platforms entropy sources are integrated (, see for
+ * example the MBEDTLS_ENTROPY_HARDWARE_ALT or the MBEDTLS_ENTROPY_NV_SEED
+ * switch).
+ *
+ * WARNING! This switch is extremely DANGEROUS, don't use it in production code
+ * under any circumstances. This switch nullifies any security provided by the
+ * library.
+ */
+//#define MBEDTLS_TEST_WO_ENTROPY
+
+
+/**
+ * \def MBEDTLS_ENTROPY_NV_SEED
+ *
+ * Strong software entropy source. It is not yet implemented,
+ * adding it because it is mutually exclusive with MBEDTLS_TEST_WO_ENTROPY.
+ */
+//#define MBEDTLS_ENTROPY_NV_SEED
+
+/**
* \def MBEDTLS_ENTROPY_HARDWARE_ALT
*
* Uncomment this macro to let mbed TLS use your own implementation of a
diff --git a/include/mbedtls/entropy_poll.h b/include/mbedtls/entropy_poll.h
index dc11911..3fcfef2 100644
--- a/include/mbedtls/entropy_poll.h
+++ b/include/mbedtls/entropy_poll.h
@@ -43,6 +43,14 @@
#define MBEDTLS_ENTROPY_MIN_HARDCLOCK 4 /**< Minimum for mbedtls_timing_hardclock() */
#define MBEDTLS_ENTROPY_MIN_HARDWARE 32 /**< Minimum for the hardware source */
+/**
+ * \brief Entropy poll callback that provides 0 entropy.
+ */
+#if defined(MBEDTLS_TEST_WO_ENTROPY)
+ int mbedtls_zero_entropy_poll( void *data,
+ unsigned char *output, size_t len, size_t *olen );
+#endif
+
#if !defined(MBEDTLS_NO_PLATFORM_ENTROPY)
/**
* \brief Platform-specific entropy poll callback