The skip_common_name flag was named for the legacy CN field but actually
suppresses the entire mbedtls_ssl_set_hostname() call -- disabling
hostname matching against CN/SAN AND Server Name Indication. Update the
doxygen to describe the real effect, and emit a per-call WARN inside the
SNI-disable branch so debug-only use does not slip into production
unnoticed.
The session-resumption else-if in set_client_config() short-circuited
the CA verification chain when only client_session was supplied. Remove
the branch so session-only configs fall through to the normal error /
skip-verify path; resumption no longer silently disables CA validation.
Added the hidden config in the esp-tls component for the dynamic buffer
strategy configuration feature. So that external components like ota
can findout whether this feature is supported or not
Problem:
1. In low-memory scenarios, the dynamic buffer feature can fail due to memory fragmentation.
2. It requires a contiguous 16KB heap chunk, but continuous allocation and deallocation of
the RX buffer can lead to fragmentation.
3. If another component allocates memory between these operations, it can break up the
available 16KB block, causing allocation failure.
Solution:
1. Introduce configurable strategy for using dynamic buffers in TLS connections.
2. For example, convert RX buffers to static after the TLS handshake.
3. Allow users to select the strategy via a new field in the esp_http_client_cfg_t structure.
4. The strategy can be controlled independently for each TLS session.
Previously the *data parameters of esp_tls_conn_read
was required to be non-NULL after espressif/esp-idf!28358.
This prevents users from using a functionality in esp_tls_conn_read
where calling `esp_tls_conn_read(ctx, NULL, 0);` triggers the
transfer of contents from tcp layer to mbedtls (ssl) layer.
After this the user can read the contents from
esp_tls_get_bytes_avail().
This commit removes the additional NULL check on the data field
to keep this functionality enabled.
* Users can now use libbsd string.h and sys/cdefs.h functionality
(e.g., strlcpy, containerof) on Linux by just including
string.h or sys/cdefs.h. In other words, the includes are the same
on the Linux target as well as on chips targets (ESP32, etc.).
* libbsd linking is done by the linux component (belongs to common
components) now instead of handling it separately in each component
Only pull in direct dependencies for the test apps, reducing build time
as well making it possible for CI to determine if the test should run or not
when dependencies are changed.
- ESP32-WROOM-32SE has been discontinued and marked as NRND
- This change removes all references to ESP32-WROOM-32SE from IDF
- The example has been migrated to esp-cryptoauthlib repository and it
can be used through the component manager
(https://components.espressif.com/components/espressif/esp-cryptoauthlib)
HTTPD_SSL_CONFIG_DEFAULT used to be a MACRO and hence used to return
a const pointer. With a recent change it started not returning a
const variable. This change reverts the function to its MACRO form.
Updated the https_server example to use static declration
Fixed the error that occurred while performing OTA upgrades over
TLS 1.3 connection. After handshake is completed, post-handshake message
is received and internal state is changed. While performing mbedtls_ssl_read(),
it checks handshake state and if it is not MBEDTLS_SSL_HANDSHAKE_OVER,
mbedtls_ssl_handshake is called again.
For ESP certificate bundle case, the certificate failure error from
underlying TLS stack was not being tracked. Added the fix and also
updated example code showcasing how to retrieve it.
Closes https://github.com/espressif/esp-idf/issues/12034
linux/lwip: Wrap some IO posix functions
* to workaourd the FreeRTOS EINTR issue (when building without lwip)
* to correctly choose the sub-system based on fd (when building with
lwip) -- passing control to either linux/system or to lwip
This commit also addapts tapio-if to provide DHCP client by default and
configurable settings for static IP
