Add a bound-checking case for the two cert-extent rejections in
esp_crt_check_bundle(): a certificate whose declared name/key lengths
run past the end of the bundle, and a last certificate placed so close
to the end that its 4-byte header would straddle the bundle boundary.
esp_crt_check_bundle() read the 4-byte certificate header (name_len,
key_len) via esp_crt_get_len() after only checking that the cert's
start offset lies inside the bundle, so a crafted bundle whose first
or last certificate starts within the final 3 bytes caused a transient
out-of-bounds read of up to 3 bytes before the extent check rejected
it. Require the whole header to lie inside the bundle before reading
it.
With MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS enabled, an in-place
psa_cipher_update() reaches the selected cipher implementation without
defensive buffer copies. The ESP AES PSA driver accepts an in-place
update of any length for CTR (PSA classifies CTR as a stream cipher, so
the driver's block_length is 1), but on targets without the AES
peripheral (e.g. ESP32-C61) the operation falls back to the mbedtls
builtin cipher layer, which rejects in-place updates whose length is
not a multiple of the block size (MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA,
surfacing as PSA_ERROR_INVALID_ARGUMENT).
Round the in-place test length down to a block multiple when
CONFIG_MBEDTLS_HARDWARE_AES is not set; partial-block PSRAM coverage is
retained through the separate-buffer alignment tests.
gen_crt_bundle.py now uses the shared esp-pylib library instead of its own
logging and argument parsing, so its messages look the same as the rest of
the ESP-IDF Python tools.
Extend the CTR test data length to 6433 bytes so the trailing partial
block is exercised with external RAM buffers (which stalls the ESP32-S2
Crypto DMA on an unfixed driver), and add AES-GCM PSRAM tests verified
against internal RAM references.
The ESP32-S2 Crypto DMA in-channel stalls silently when a receive
descriptor list transitions from external to internal RAM. The AES
driver hits this when a PSRAM-output operation has a trailing partial
block, as the internal stream descriptor is linked after the external
RAM data descriptors.
- esp_aes_process_dma(): process the block-aligned part and the partial
block as two separate DMA operations, keeping each descriptor list
uniform
- crypto_dma_ll_reset(): also reset the in-channel (per the TRM receive
reset sequence), otherwise stale state from a preceding external-RAM
operation corrupts the next operation's output
The GCM DMA path is unaffected; it never operates on PSRAM buffers.
gen_crt_bundle.py only parses files ending in .pem or .der, but silently
ignored anything else. A PEM certificate named e.g. ca.crt was skipped
without a word, and since the build invokes the script with -q, even the
"Successfully added 0 certificates" hint was suppressed. The build then
succeeded and embedded a bundle without the certificate, and the problem
only surfaced at runtime as a TLS verification failure.
A file passed directly via --input, which is what
CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE_PATH points at, is now expected
to be a certificate: an unsupported extension raises an InputError and
fails the build with a message naming the file and the two accepted
extensions. Files found while scanning a directory keep being skipped,
as a certificate directory may legitimately contain other files, but a
warning is now printed unconditionally so it is visible in the build log.
Also document the requirement in the Kconfig help text and in the
esp_crt_bundle documentation.
Closes https://github.com/espressif/esp-idf/issues/18933
The offset table and the per-cert length fields of the certificate
bundle were read through uint16_t*/uint32_t* casts, which compile to
halfword/word loads at addresses with no alignment guarantee: bundles
supplied via esp_crt_bundle_set() can start anywhere, and cert entries
are byte-packed, so their 16-bit fields land at arbitrary offsets.
On chips with SOC_CPU_MISALIGNED_ACCESS_ON_PMP_MISMATCH_ISSUE (DIG-694:
ESP32-C6/H2/H21) a misaligned load from memory-mapped flash can take a
spurious "Load access fault" when it sits within two instructions of an
access to a differently-permissioned region, observed as a crash in
esp_crt_check_bundle()/CA callback during TLS handshakes with a bundle
that happened to be placed at an odd address.
The test only runs with MBEDTLS_CONSTANT_TIME_PRIME_GEN disabled:
with the constant-time prime generation that is now the default,
RSA-2048 key generation takes over a minute on most targets (~86 s on
ESP32-S3), exceeding the test timeout and starving the task watchdog.
mbedtls 4.1.1 made the small-factor test in prime generation
constant-time (a CT GCD against the product of primes up to 997, run
for every prime candidate). This makes RSA key generation roughly ten
times slower on ESP chips and starves the idle task since the software
GCD never yields, tripping the task watchdog.
Add MBEDTLS_CONSTANT_TIME_PRIME_GEN under the new "Security hardening"
menu, default y so the upstream constant-time behavior ships as the
secure default. When disabled, esp_config.h defines
MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME and mbedtls uses the pre-3.6.7
variable-time trial division, restoring key generation performance on
devices where no untrusted co-resident code could time key generation.
Remove ~50 duplicate local definitions of ALIGN_UP/ALIGN_DOWN/ALIGN_UP_BY/
ALIGN_DOWN_BY across the codebase and replace them with canonical
ESP_ALIGN_UP/ESP_ALIGN_DOWN from esp_macros.h.
