When CONFIG_ESP_HTTP_CLIENT_STRICT_HEADER_BUFFER is enabled,
esp_http_client_request_send() fails fast when a single request header is
larger than buffer_size_tx, instead of silently emitting a truncated request.
The condition is reported with a dedicated ESP_ERR_HTTP_HEADER_TOO_LONG error
code rather than overloading ESP_ERR_HTTP_WRITE_DATA, so callers can tell a
permanent header-sizing failure apart from a transient write error. errno is
cleared on this path so the async caller (which maps errno == EAGAIN to "retry
later") does not spin retrying a request that can never succeed.
Closes https://github.com/espressif/esp-idf/issues/18639
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add ESP_KEY_SOURCE_BUFFER and ESP_KEY_SOURCE_PSA key sources so all
hardware backends (DS, ECDSA, secure element) are accessed via PSA
key IDs through a single esp_tls_cfg_t.client_key field.
Refactor the esp_err_to_name() system to decouple esp_common from
higher-level components. Instead of a monolithic generated table,
each component registers its error codes into a dedicated linker
section (.esp_err_msg_table) via idf_define_esp_err_codes() in its
CMakeLists.txt.
New files:
- tools/err_codes_extract.py: extract ESP_ERR_* defines from headers to CSV
- tools/err_codes_to_c.py: generate C source placing entries into linker section
- tools/err_codes_to_rst.py: generate RST documentation from error codes
- tools/cmake/err_codes.cmake: CMake module providing idf_define_esp_err_codes()
- components/esp_common/include/esp_err_codes.h: esp_err_msg_t typedef
- components/esp_common/src/esp_err_to_name_new.c: new lookup using link-time array
- tools/test_apps/build_system/err_codes_check/: CI test app
Changes:
- Remove all optional component dependencies from esp_common/CMakeLists.txt
- Add .esp_err_msg_table section to all 5 linker scripts
- Register error codes in 18 components via idf_define_esp_err_codes()
- Add new scripts to .gitlab/ci/rules.yml build_check patterns
- use new scripts to generate doc and add CI validation
- Update esp_err.rst to add description of composable code registration
esp_http_client_set_redirection() now rejects any redirect target whose
scheme is not https:// when the origin is HTTPS. This catches http, ftp,
ws and any other scheme before client state is mutated. Same-host /
https-to-https redirects are unaffected. Apps that intentionally want
mixed-scheme redirects can set disable_auto_redirect=true and handle
HTTP_EVENT_REDIRECT.
According to RFC 7616, nonce-prime and cnonce-prime is used for SHA-256-sess only and not for SHA-256.
This commit updates the check and uses nonce only for "-sess" algorithms.
Regression from 66995965e7
Fixed vulnerability where malicious HTTP servers could trigger OOB reads
by sending empty or very short algorithm fields in WWW-Authenticate headers.
Changes:
- Replace unsafe memcmp() with strcasecmp() for algorithm comparison
- Add algorithm NULL validation at function entry point
- Fix duplicate md5-sess check, add missing SHA-256 check
This commit updated the client closing condition to avoid spurious
dispatching of event HTTP_EVENT_DISCONNECTED while closing closeed connection.
Closes https://github.com/espressif/esp-idf/issues/16070
This commit added new http state HTTP_STATE_CONNECTING, and made states public.
Also added public API to get current state.
Updated state flow in esp_http_client_perform()
Closes https://github.com/espressif/esp-idf/issues/16019
