Replace the key-lifetime check with explicit ownership tracking so a
caller-supplied volatile PSA key is also preserved on cleanup, and drop the
DS/HARDWARE_ECDSA compile guard so the ESP_KEY_SOURCE_PSA path is released on
pure secure-element builds.
(cherry picked from commit 7cdd0b5960)
The DS/ECDSA cleanup added in 8cb64703 is intended for volatile PSA keys
created internally by the DS and ECDSA peripheral paths. Ensure that
during the cleanup, PSA_KEY_LIFETIME_IS_VOLATILE() is checked to avoid
destroying keys the user has added persistently to PSA.
This resolves an issue in the next commit (adding support for
clientkey_psa_id) where a user passes a PSA key id that is then silently
destroyed if CONFIG_ESP_TLS_USE_DS_PERIPHERAL or
CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN happen to be defined.
Signed-off-by: Mike Szczys <michael.szczys@canonical.com>
(cherry picked from commit da51d69013)
(cherry picked from commit f68cfbf8d4)
.build-test-rules.yml restricts esp-tls test_apps to esp32c3 only.
Commit 19a544203b9 accidentally expanded the README to all targets.
(cherry picked from commit b7f53c3868)
Per mbedTLS API contract, mbedtls_pk_context must be explicitly initialized
with mbedtls_pk_init() before calling mbedtls_pk_wrap_psa(). Add the missing
init calls for both the server_key and client_key PSA-backed key code paths.
(cherry picked from commit 005072c87e)
- esp_tls_mbedtls: require cert when PSA-backed server/client key is set
- esp_tls_mbedtls: drop redundant pk_init/x509_crt_init (calloc handles it)
- psa SE driver: copy callbacks/opaque_key by value (no lifetime coupling)
- psa SE driver: replace atomic CAS with simple null check on register
- psa SE driver: use sig_len from sign callback with bounds validation
- psa SE driver: validate pubkey_len returned by export_pubkey callback
- psa SE driver: check hash sub-alg in RSA PKCS1V15 branch of validate_request
- psa SE driver: align secure_element_register_callbacks doc with value-copy impl
- esp_https_server: initialize server_key in HTTPD_SSL_CONFIG_DEFAULT
- mbedtls: move SECURE_ELEMENT_DRIVER_ENABLED to esp_config.h for parity
with ESP_ECDSA_DRIVER_ENABLED; drop target_compile_definitions
- docs: fix esp_tls_cfg_t -> esp_http_client_config_t cross-reference
- docs: check psa_import_key() status in ESP-TLS PSA example
- hints/error_output: point at CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED
(cherry picked from commit 08b567ef3b)
Linker symbol differences (prvtkey_pem_end - prvtkey_pem_start) are not
compile-time constants and cannot be used in static initializers.
(cherry picked from commit 4196734d1a)
Update esp_tls, esp_http_client docs and migration guide to reflect
the new esp_key_config_t interface and secure element PSA driver.
(cherry picked from commit 37808e2386)
Add generic secure element PSA driver with runtime callback registration.
Consolidate Kconfig into single MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED option.
Closes https://github.com/espressif/esp-idf/issues/18388
(cherry picked from commit 1c20f525b4)
Add ESP_KEY_SOURCE_BUFFER and ESP_KEY_SOURCE_PSA key sources so all
hardware backends (DS, ECDSA, secure element) are accessed via PSA
key IDs through a single esp_tls_cfg_t.client_key field.
(cherry picked from commit 36090b7161)
free_up_channels can only be called once for a started transaction.
Double free will undesirely stop the next picked 2D-DMA transaction on the same channel.
Co-authored-by: Cursor <cursoragent@cursor.com>
