Latency-sensitive small-message protocols (notably MQTT: PUBLISH/PUBACK/
PINGREQ) suffer when Nagle's algorithm interacts with the peer's
delayed-ACK: a small write is withheld until the prior segment is ACKed
while the peer holds that ACK up to ~40-200 ms, stalling each small write
until the delayed-ACK timer fires.
Add CONFIG_ESP_TLS_ENABLE_TCP_NODELAY (default n). When enabled,
esp_tls_set_socket_options() sets TCP_NODELAY on the connection socket
alongside the existing SO_*TIMEO / keepalive options, so small records go
out immediately. Non-fatal (a latency hint), so a failure only warns.
Off by default: no behavior change for existing users.
Signed-off-by: Eric Wang <eric@rwx.one>
Restore the use_secure_element field in esp_tls_cfg_t, esp_tls_cfg_server_t
and httpd_ssl_config_t, and esp_transport_ssl_use_secure_element(), as
deprecated no-ops so that existing code keeps compiling. Setting them now
fails at runtime with ESP_ERR_NOT_SUPPORTED, as the feature is accessed
via the esp_key_config_t interface. To be removed in the next major release.
Replace the key-lifetime check with explicit ownership tracking so a
caller-supplied volatile PSA key is also preserved on cleanup, and drop the
DS/HARDWARE_ECDSA compile guard so the ESP_KEY_SOURCE_PSA path is released on
pure secure-element builds.
The DS/ECDSA cleanup added in 8cb64703 is intended for volatile PSA keys
created internally by the DS and ECDSA peripheral paths. Ensure that
during the cleanup, PSA_KEY_LIFETIME_IS_VOLATILE() is checked to avoid
destroying keys the user has added persistently to PSA.
This resolves an issue in the next commit (adding support for
clientkey_psa_id) where a user passes a PSA key id that is then silently
destroyed if CONFIG_ESP_TLS_USE_DS_PERIPHERAL or
CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN happen to be defined.
Signed-off-by: Mike Szczys <michael.szczys@canonical.com>
(cherry picked from commit da51d69013)
Per mbedTLS API contract, mbedtls_pk_context must be explicitly initialized
with mbedtls_pk_init() before calling mbedtls_pk_wrap_psa(). Add the missing
init calls for both the server_key and client_key PSA-backed key code paths.
- esp_tls_mbedtls: require cert when PSA-backed server/client key is set
- esp_tls_mbedtls: drop redundant pk_init/x509_crt_init (calloc handles it)
- psa SE driver: copy callbacks/opaque_key by value (no lifetime coupling)
- psa SE driver: replace atomic CAS with simple null check on register
- psa SE driver: use sig_len from sign callback with bounds validation
- psa SE driver: validate pubkey_len returned by export_pubkey callback
- psa SE driver: check hash sub-alg in RSA PKCS1V15 branch of validate_request
- psa SE driver: align secure_element_register_callbacks doc with value-copy impl
- esp_https_server: initialize server_key in HTTPD_SSL_CONFIG_DEFAULT
- mbedtls: move SECURE_ELEMENT_DRIVER_ENABLED to esp_config.h for parity
with ESP_ECDSA_DRIVER_ENABLED; drop target_compile_definitions
- docs: fix esp_tls_cfg_t -> esp_http_client_config_t cross-reference
- docs: check psa_import_key() status in ESP-TLS PSA example
- hints/error_output: point at CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED
Add ESP_KEY_SOURCE_BUFFER and ESP_KEY_SOURCE_PSA key sources so all
hardware backends (DS, ECDSA, secure element) are accessed via PSA
key IDs through a single esp_tls_cfg_t.client_key field.
Refactor the esp_err_to_name() system to decouple esp_common from
higher-level components. Instead of a monolithic generated table,
each component registers its error codes into a dedicated linker
section (.esp_err_msg_table) via idf_define_esp_err_codes() in its
CMakeLists.txt.
New files:
- tools/err_codes_extract.py: extract ESP_ERR_* defines from headers to CSV
- tools/err_codes_to_c.py: generate C source placing entries into linker section
- tools/err_codes_to_rst.py: generate RST documentation from error codes
- tools/cmake/err_codes.cmake: CMake module providing idf_define_esp_err_codes()
- components/esp_common/include/esp_err_codes.h: esp_err_msg_t typedef
- components/esp_common/src/esp_err_to_name_new.c: new lookup using link-time array
- tools/test_apps/build_system/err_codes_check/: CI test app
Changes:
- Remove all optional component dependencies from esp_common/CMakeLists.txt
- Add .esp_err_msg_table section to all 5 linker scripts
- Register error codes in 18 components via idf_define_esp_err_codes()
- Add new scripts to .gitlab/ci/rules.yml build_check patterns
- use new scripts to generate doc and add CI validation
- Update esp_err.rst to add description of composable code registration
The skip_common_name flag was named for the legacy CN field but actually
suppresses the entire mbedtls_ssl_set_hostname() call -- disabling
hostname matching against CN/SAN AND Server Name Indication. Update the
doxygen to describe the real effect, and emit a per-call WARN inside the
SNI-disable branch so debug-only use does not slip into production
unnoticed.
The session-resumption else-if in set_client_config() short-circuited
the CA verification chain when only client_session was supplied. Remove
the branch so session-only configs fall through to the normal error /
skip-verify path; resumption no longer silently disables CA validation.
platform.c (compiled into the 'builtin' archive) calls
esp_mbedtls_mem_calloc and esp_mbedtls_mem_free directly by name via
the MBEDTLS_PLATFORM_STD_CALLOC/FREE macros in esp_config.h.
Previously, esp_mem.c was compiled into the 'tfpsacrypto' archive, which
appears after 'builtin' in the link command, causing the linker to fail
with undefined reference errors when 'builtin' was processed first.
Moving esp_mem.c into 'builtin' to assure that the function used by
esp_mbedtls_mem_calloc and esp_mbedtls_mem_free are available when
pltform.c is linked.
For Build System v2 on linux target, lwip dependency and ESP_TLS_WITH_LWIP
definition must be conditional on CONFIG_LWIP_ENABLE rather than checking
BUILD_COMPONENTS. v2 uses configuration-driven dependencies.
Added crypto_sha1 and crypto_base64_encode callbacks to esp_tls_stack_ops_t
to allow custom TLS stacks to provide implementations for esp_crypto_* APIs.
