Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(mbedtls): Add configuration to control dynamic buffer strategy in mbedtls

Browse Source 
Problem:
1. In low-memory scenarios, the dynamic buffer feature can fail due to memory fragmentation.
2. It requires a contiguous 16KB heap chunk, but continuous allocation and deallocation of
the RX buffer can lead to fragmentation.
3. If another component allocates memory between these operations, it can break up the
available 16KB block, causing allocation failure.

Solution:
1. Introduce configurable strategy for using dynamic buffers in TLS connections.
2. For example, convert RX buffers to static after the TLS handshake.
3. Allow users to select the strategy via a new field in the esp_http_client_cfg_t structure.
4. The strategy can be controlled independently for each TLS session.
This commit is contained in:
hrushikesh.bhosale
2025-06-24 17:44:04 +05:30
parent 96567cb17b
commit 636eb4b62f
14 changed files with 236 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp-tls/esp_tls.h
+19 -8
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2017-2025 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -91,6 +91,12 @@ typedef enum {
ESP_TLS_VER_TLS_MAX, /* to indicate max */
} esp_tls_proto_ver_t;
typedef enum {
ESP_TLS_DYN_BUF_RX_STATIC = 1, /*!< Strategy to disable dynamic RX buffer allocations and convert to static allocation post-handshake, reducing memory fragmentation */
ESP_TLS_DYN_BUF_STRATEGY_MAX, /*!< to indicate max */
} esp_tls_dyn_buf_strategy_t;
/**
* @brief ESP-TLS configuration parameters
*
@@ -211,6 +217,11 @@ typedef struct esp_tls_cfg {
const int *ciphersuites_list; /*!< Pointer to a zero-terminated array of IANA identifiers of TLS ciphersuites.
Please check the list validity by esp_tls_get_ciphersuites_list() API */
esp_tls_proto_ver_t tls_version; /*!< TLS protocol version of the connection, e.g., TLS 1.2, TLS 1.3 (default - no preference) */
#if CONFIG_MBEDTLS_DYNAMIC_BUFFER
esp_tls_dyn_buf_strategy_t esp_tls_dyn_buf_strategy; /*!< ESP-TLS dynamic buffer strategy */
#endif
} esp_tls_cfg_t;
#if defined(CONFIG_ESP_TLS_SERVER_SESSION_TICKETS)
@@ -464,7 +475,7 @@ int esp_tls_conn_http_new_async(const char *url, const esp_tls_cfg_t *cfg, esp_t
* - >=0 if write operation was successful, the return value is the number
* of bytes actually written to the TLS/SSL connection.
* - <0 if write operation was not successful, because either an
* error occured or an action must be taken by the calling process.
* error occurred or an action must be taken by the calling process.
* - ESP_TLS_ERR_SSL_WANT_READ/
* ESP_TLS_ERR_SSL_WANT_WRITE.
* if the handshake is incomplete and waiting for data to be available for reading.
@@ -485,7 +496,7 @@ ssize_t esp_tls_conn_write(esp_tls_t *tls, const void *data, size_t datalen);
* - 0 if read operation was not successful. The underlying
* connection was closed.
* - <0 if read operation was not successful, because either an
* error occured or an action must be taken by the calling process.
* error occurred or an action must be taken by the calling process.
*/
ssize_t esp_tls_conn_read(esp_tls_t *tls, void *data, size_t datalen);
@@ -537,7 +548,7 @@ esp_err_t esp_tls_get_conn_sockfd(esp_tls_t *tls, int *sockfd);
*
* @param[in] sockfd sockfd value to set.
*
* @return - ESP_OK on success and value of sockfd for the tls connection shall updated withthe provided value
* @return - ESP_OK on success and value of sockfd for the tls connection shall updated with the provided value
* - ESP_ERR_INVALID_ARG if (tls == NULL || sockfd < 0)
*/
esp_err_t esp_tls_set_conn_sockfd(esp_tls_t *tls, int sockfd);
@@ -549,7 +560,7 @@ esp_err_t esp_tls_set_conn_sockfd(esp_tls_t *tls, int sockfd);
*
* @param[out] conn_state pointer to the connection state value.
*
* @return - ESP_OK on success and value of sockfd for the tls connection shall updated withthe provided value
* @return - ESP_OK on success and value of sockfd for the tls connection shall updated with the provided value
* - ESP_ERR_INVALID_ARG (Invalid arguments)
*/
esp_err_t esp_tls_get_conn_state(esp_tls_t *tls, esp_tls_conn_state_t *conn_state);
@@ -561,7 +572,7 @@ esp_err_t esp_tls_get_conn_state(esp_tls_t *tls, esp_tls_conn_state_t *conn_stat
*
* @param[in] conn_state connection state value to set.
*
* @return - ESP_OK on success and value of sockfd for the tls connection shall updated withthe provided value
* @return - ESP_OK on success and value of sockfd for the tls connection shall updated with the provided value
* - ESP_ERR_INVALID_ARG (Invalid arguments)
*/
esp_err_t esp_tls_set_conn_state(esp_tls_t *tls, esp_tls_conn_state_t conn_state);
@@ -586,7 +597,7 @@ void *esp_tls_get_ssl_context(esp_tls_t *tls);
*
* @return
* - ESP_OK if creating global CA store was successful.
* - ESP_ERR_NO_MEM if an error occured when allocating the mbedTLS resources.
* - ESP_ERR_NO_MEM if an error occurred when allocating the mbedTLS resources.
*/
esp_err_t esp_tls_init_global_ca_store(void);
@@ -605,7 +616,7 @@ esp_err_t esp_tls_init_global_ca_store(void);
*
* @return
* - ESP_OK if adding certificates was successful.
* - Other if an error occured or an action must be taken by the calling process.
* - Other if an error occurred or an action must be taken by the calling process.
*/
esp_err_t esp_tls_set_global_ca_store(const unsigned char *cacert_pem_buf, const unsigned int cacert_pem_bytes);
components/esp-tls/esp_tls_mbedtls.c
+14 -1
View File
@@ -19,7 +19,7 @@
#include <errno.h>
#include "esp_log.h"
#include "esp_check.h"
#include "mbedtls/esp_mbedtls_dynamic.h"
#ifdef CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN
#include "ecdsa/ecdsa_alt.h"
#endif
@@ -104,6 +104,10 @@ esp_err_t esp_create_mbedtls_handle(const char *hostname, size_t hostlen, const
mbedtls_ssl_conf_rng(&tls->conf, mbedtls_ctr_drbg_random, &tls->ctr_drbg);
#if CONFIG_MBEDTLS_DYNAMIC_BUFFER
tls->esp_tls_dyn_buf_strategy = ((esp_tls_cfg_t *)cfg)->esp_tls_dyn_buf_strategy;
#endif
if (tls->role == ESP_TLS_CLIENT) {
esp_ret = set_client_config(hostname, hostlen, (esp_tls_cfg_t *)cfg, tls);
if (esp_ret != ESP_OK) {
@@ -219,6 +223,15 @@ int esp_mbedtls_handshake(esp_tls_t *tls, const esp_tls_cfg_t *cfg)
#endif
ret = mbedtls_ssl_handshake(&tls->ssl);
if (ret == 0) {
#if CONFIG_MBEDTLS_DYNAMIC_BUFFER
if (tls->esp_tls_dyn_buf_strategy != 0) {
ret = esp_mbedtls_dynamic_set_rx_buf_static(&tls->ssl);
if (ret != 0) {
ESP_LOGE(TAG, "esp_mbedtls_dynamic_set_rx_buf_static returned -0x%04X", -ret);
return ret;
}
}
#endif
tls->conn_state = ESP_TLS_DONE;
#ifdef CONFIG_ESP_TLS_USE_DS_PERIPHERAL
components/esp-tls/private_include/esp_tls_private.h
+4
View File
@@ -94,6 +94,10 @@ struct esp_tls {
esp_tls_error_handle_t error_handle; /*!< handle to error descriptor */
#if CONFIG_MBEDTLS_DYNAMIC_BUFFER
esp_tls_dyn_buf_strategy_t esp_tls_dyn_buf_strategy; /*!< ESP-TLS dynamic buffer strategy */
#endif
};
// Function pointer for the server configuration API