Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity
52,121 Commits 25 Branches 192 Tags
release/v6.0
Commit Graph
60 Commits
Author SHA1 Message Date
Ashish Sharma a6adc3b5e8 fix(esp_crt_bundle): match memory allocator in cross-signed callback 
Closes https://github.com/espressif/esp-idf/issues/19053
 2026-09-11 14:10:06 +08:00
Mahavir Jain ec3877cf6c fix(mbedtls): read crt bundle byte-wise to avoid misaligned flash access 
The offset table and the per-cert length fields of the certificate
bundle were read through uint16_t*/uint32_t* casts, which compile to
halfword/word loads at addresses with no alignment guarantee: bundles
supplied via esp_crt_bundle_set() can start anywhere, and cert entries
are byte-packed, so their 16-bit fields land at arbitrary offsets.

On chips with SOC_CPU_MISALIGNED_ACCESS_ON_PMP_MISMATCH_ISSUE (DIG-694:
ESP32-C6/H2/H21) a misaligned load from memory-mapped flash can take a
spurious "Load access fault" when it sits within two instructions of an
access to a differently-permissioned region, observed as a crash in
esp_crt_check_bundle()/CA callback during TLS handshakes with a bundle
that happened to be placed at an odd address.
 2026-09-04 11:06:54 +05:30
harshal.patil 710ce291ac fix(mbedtls): validate cert header extent before reading it in bundle check 
esp_crt_check_bundle() read the 4-byte certificate header (name_len,
key_len) via esp_crt_get_len() after only checking that the cert's
start offset lies inside the bundle, so a crafted bundle whose first
or last certificate starts within the final 3 bytes caused a transient
out-of-bounds read of up to 3 bytes before the extent check rejected
it. Require the whole header to lie inside the bundle before reading
it.
 2026-08-24 20:56:43 +05:30
Ashish Sharma 2e6f9b8b42 fix(mbedtls): validate crypto input lengths (TEE OOB, auth-bypass, overflows) 2026-07-16 18:24:47 +08:00
Ashish Sharma a1f1d90729 fix(esp_crt_bundle): fixes verification with cross signed cert 2026-06-03 11:35:24 +08:00
Ashish Sharma 0d8ff68f8a fix(esp_crt_bundle): fixes a potential memory leak with cross signed certificates 
Closes https://github.com/espressif/esp-idf/issues/18512
Closes https://github.com/espressif/esp-idf/issues/18550
 2026-06-03 11:31:27 +08:00
Ashish Sharma aa88c81dfb fix(wpa_supplicant): revert changes to dpp_crypto 2025-12-19 07:29:08 +08:00
Ashish Sharma f306dbea84 feat(mbedtls): migrates ESP-TEE with PSA APIs 2025-12-19 07:28:33 +08:00
Ashish Sharma c47caf4f0a feat(mbedtls): adds mbedtls alt drivers with PSA 2025-12-19 07:28:33 +08:00
Ashish Sharma b4fea9cccc feat(lwip): migrate to to PSA API interface 2025-12-18 21:18:58 +08:00
Espressif BOT 5891d8acae change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2025-12-11 10:45:57 +05:30
Espressif BOT de99f3cffa change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2025-12-11 10:45:50 +05:30
Ashish Sharma cabb5009f2 feat(esp_crt): adds support for cross signed root certificates 2025-06-26 16:01:11 +08:00
Alexey Lapshin 86ca6ef829 fix(build): fix -Wanalyzer-undefined-behavior-ptrdiff warnings 2025-06-25 18:00:39 +07:00
harshal.patil 6fe38c7efd fix(mbedtls): re-include Comodo AAA Services root 2025-06-16 15:55:39 +05:30
Mahavir Jain 03433aad49 fix(mbedtls): re-include Starfield Class 2 CA 
Some of the endpoints (e.g., httpbin.org) is still relying on the
Starfield Class 2 CA in the chain. Added this root certificate as
a temporary exception and shall be removed in future.
 2025-06-16 15:55:36 +05:30
Espressif BOT da1842ea0f change(mbedtls/crt_bundle): Update esp_cmn_crt_bundle certificates 2025-06-08 13:35:51 +05:30
harshal.patil 65642866bc change(mbedtls/esp_crt_bundle): Remove deprecated certs for the major release version (v6.0) 2025-05-28 23:16:47 +05:30
Espressif BOT e6d92ab49c change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2025-05-28 23:16:47 +05:30
Espressif BOT e08ed84287 change(mbedtls/crt_bundle): Update esp_cmn_crt_bundle certificates 2025-05-26 13:19:57 +05:30
harshal.patilandMahavir Jain 5ae42e6f0b fix(mbedtls/esp_crt_bundle): Suppress non-negative serial number warning 
Co-authored-by: Mahavir Jain <mahavir.jain@espressif.com>
 2025-05-23 09:28:42 +05:30
Ashish Sharma 2fc151d2a9 fix(component/mbedtls): Adds github root cert to cmn_crt_authorities.csv 2025-03-17 14:32:06 +08:00
Espressif BOT a39d8d43ee change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2025-03-05 10:44:47 +08:00
Espressif BOT 7c45809b39 change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2025-01-01 10:00:39 +08:00
Mahavir Jain 849ce255aa fix(esp_crt_bundle): remove expired DST Root CA X3 from bundle 2024-12-19 08:40:16 +05:30
Espressif BOT 24be50e71d change(mbedtls/crt_bundle): Update esp_cmn_crt_bundle certificates 2024-12-18 14:52:09 +05:30
Espressif BOT 001247a29a change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2024-12-13 14:29:37 +08:00
harshal.patilandHanno 3957e59f1a feat(mbedtls/esp_crt_bundle): Move dummy cert to .rodata to save 408B from dram 
Co-authored-by: Hanno <h.binder@web.de>
 2024-10-16 16:21:28 +05:30
harshal.patil b097eb12b3 ci(mbedtls/esp_crt_bundle): Format esp_crt_bundle.c using astyle 2024-10-09 16:08:35 +05:30
Hanno d8e31eb6d0 feat(mbedtls/esp_crt_bundle): Reduced RAM & stack use of cert bundle 
Closes https://github.com/espressif/esp-idf/pull/13204

Signed-off-by: harshal.patil <harshal.patil@espressif.com>
 2024-10-09 16:08:35 +05:30
Espressif BOT d9d303fd6f change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2024-09-25 16:39:46 +08:00
Espressif BOT 62a22f4c89 change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2024-07-03 16:01:50 +05:30
Espressif BOT bebdf7b989 change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2024-03-12 10:00:36 +08:00
Espressif BOT 8f0f7f007c change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2023-12-19 14:40:56 +08:00
Espressif BOT 24446bfab1 change(esp_crt_bundle): Update esp_crt_bundle certificates 2023-10-29 12:21:21 +05:30
Espressif BOT e174fc967e Update common cert authorities csv 2023-03-12 11:00:24 +08:00
Espressif BOT 35cd5ee57b Update esp_crt_bundle certificates 2023-01-11 10:00:31 +08:00
Harshit Malpani e215ede439 mbedtls: Add support to build for linux target 2023-01-04 11:17:29 +05:30
Espressif BOT 91bd4a1f80 Update esp_crt_bundle certificates 2022-10-13 10:00:11 +08:00
Roland Dobai bab3830797 Tools: Fix flake8 version 5 warnings 2022-08-12 08:13:13 +00:00
Espressif BOT 72fe927e85 Update esp_crt_bundle certificates 2022-07-20 10:00:11 +08:00
Espressif BOT 4a56352f56 Update esp_crt_bundle certificates 2022-04-27 11:26:58 +00:00
Aditya Patwardhan c27c6916a7 esp_crt_bundle: Add bounds checking for the "esp_crt_bundle_set" API. 
Closes https://github.com/espressif/esp-idf/issues/8397
 2022-03-31 13:11:11 +05:30
Espressif BOT f51da7dded Update esp_crt_bundle certificates 2022-03-25 10:48:34 +05:30
Mahavir Jain 5f646b1d43 mbedtls: move locally managed root certificates to separate file 
Purpose:
This will allow for easily automating periodic updates to
"cacrt_all.pem" file.

Note:
For now newly created "cacrt_local.pem" contains single "DST Root CA X3"
which we are keeping to manage compatibility with endpoints like
"howsmyssl.com". Please note this Root CA is expired and is not part of
Mozilla’s NSS root certificate store.
 2022-03-21 22:39:24 +05:30
Laukik Hase 52170fba7f esp_crt_bundle: Fix build error 
- When `esp_crt_bundle.h` is included before any config,
  a build error (`esp_err_t` not defined) is observed

Closes https://github.com/espressif/esp-idf/issues/8606
 2022-03-21 09:05:06 +00:00
Laukik HaseandAditya Patwardhan 3925365351 ci: Fix pre-check stage failing tests 
- Updated license headers
- Re-enabled public headers and static analysis checks
- Fix public header file check failure

Co-authored-by: Aditya Patwardhan <aditya.patwardhan@espressif.com>
 2022-03-03 01:37:10 +05:30
Aditya Patwardhan 60b167f2d6 mbedtls-3.1 update: Removed the MBEDTLS_PRIVATE from multiple files 
after they have been again made public in mbedtls-3.1

*Added `MBEDTLS_ALLOW_PRIVATE_ACCESS` in some files.
 2022-03-03 01:37:10 +05:30
Aditya PatwardhanandLaukik Hase 3b71bd7326 mbedtls-3.0: Fixed ESP32 build issues 
- Added MBEDLTS_PRIVATE(...) wherever necessary
- For functions like mbedtls_pk_parse_key(...), it is necessary to pass the RNG function
  pointers as parameter. Solved for dependent components: wpa_supplicant & openSSL
- For libcoap, the SSLv2 ClientHello handshake method has been deprecated, need to handle this.
  Currently, corresponding snippet has been commented.
- Examples tested: hello-world | https_request | wifi_prov_mgr

mbedtls-3.0: Fixed ESP32-C3 & ESP32-S3 build issues
- Removed MBEDTLS_DEPRECATED_REMOVED macro from sha1 port
- DS peripheral: esp_ds_rsa_sign -> removed unsused 'mode' argument
- Added MBEDTLS_PRIVATE(...) wherever required

mbedtls-3.0: Fixed ESP32-S2 build issues
- Fixed outdated function prototypes and usage in mbedlts/port/aes/esp_aes_gcm.c due to changes in GCM module

mbedtls-3.0: Fixed ESP32-H2 build issues

ci: Fixing build stage
- Added MBEDTLS_PRIVATE(...) wherever required
- Added RNG function parameter
- Updated GCM Module changes
- Updated Copyright notices

- Tests:
- build_esp_idf_tests_cmake_esp32
- build_esp_idf_tests_cmake_esp32s2
- build_esp_idf_tests_cmake_esp32c3
- build_esp_idf_tests_cmake_esp32s3

ci: Fixing build stage (mbedtls-related changes)
- Added MBEDTLS_PRIVATE(...) wherever required
- Updated SHAXXX functions
- Updated esp_config according to mbedtls changes

- Tests:
- build_examples_cmake_esp32
- build_examples_cmake_esp32s2
- build_examples_cmake_esp32c3
- build_examples_cmake_esp32s3

ci: Fixing build stage (example-related changes)
- Added MBEDTLS_PRIVATE(...) wherever required
- Updated SHAXXX functions
- Updated esp_config according to mbedtls changes

- Tests:
- build_examples_cmake_esp32
- build_examples_cmake_esp32s2
- build_examples_cmake_esp32c3
- build_examples_cmake_esp32s3

ci: Fixing target_test stage
- Updated test SSL version to TLS_v1_2

- Tests:
- example_test_protocols 1/2

ci: Fixing build stage
- Added checks for MBEDTLS_DHM_C (disabled by default)
- Updated esp_cryptoauthlib submodule
- Updated factory partition size for legacy BLE provisioning example

- Tests:
- build_examples_cmake_esp32
- build_examples_cmake_esp32s2
- build_examples_cmake_esp32c3
- build_examples_cmake_esp32s3

Co-authored-by: Laukik Hase <laukik.hase@espressif.com>
 2022-03-03 01:37:10 +05:30
Aditya Patwardhan 2d1f18efea Updated the cacrt_all.pem file with latest Root certificate list. 2021-10-17 00:01:37 +08:00