The skip_common_name flag was named for the legacy CN field but actually
suppresses the entire mbedtls_ssl_set_hostname() call -- disabling
hostname matching against CN/SAN AND Server Name Indication. Update the
doxygen to describe the real effect, and emit a per-call WARN inside the
SNI-disable branch so debug-only use does not slip into production
unnoticed.
The session-resumption else-if in set_client_config() short-circuited
the CA verification chain when only client_session was supplied. Remove
the branch so session-only configs fall through to the normal error /
skip-verify path; resumption no longer silently disables CA validation.
sec1_new_session()/sec2_new_session() were calling sec*_close_session()
with the *new* session_id parameter instead of the existing
cur_session->id. The close handler validates `cur_session->id ==
session_id` before performing teardown, so the call always failed with
ESP_ERR_INVALID_STATE.
Effect: when a peer started a new provisioning session while another was
already active, the previous session's PSA keys, AES context, SRP handle
and username buffer were leaked instead of being destroyed. The cleared
session struct was overwritten by the new session, leaking the previous
key handles inside PSA Crypto and (for security2) leaking heap memory
for the username and SRP context.
Fix: pass cur_session->id so the close path actually executes the
teardown (psa_destroy_key/psa_cipher_abort/esp_srp_free/free) before the
new session takes over.
Any idf.py invocation could hang indefinitely with no output while
spawning an unbounded chain of "idf.py --version" subprocesses,
eventually exhausting system memory.
During init_cli(), idf.py parses the project's dependencies.lock to
vet trusted component-provided idf_ext.py extensions. If the lock
contains a component whose manifest has an "if: idf_version" clause,
evaluating it calls idf-component-manager's _get_idf_version(). Outside
a CMake build the IDF_VERSION environment variable is not set, so that
function falls back to running "idf.py --version" as a subprocess,
which re-enters init_cli() and recurses without bound.
During a normal CMake build the component manager runs as a subprocess
that already has IDF_VERSION in its environment (see build/config.env),
so the fallback is never reached. The recursion happens only because
idf.py runs component-manager code in-process during its own CLI
startup, outside that context.
Seed IDF_VERSION into os.environ early in init_cli(), before any
dependencies.lock parsing, using the subprocess-free
idf_version_from_cmake() helper. This gives in-process component-manager
code the same IDF_VERSION a CMake build would provide.
Replace the eTaskGetState() polling guard in prvTaskDeleteWithCaps()
with a per-core xTaskGetCurrentTaskHandleForCore() check, so the
predicate matches vTaskDelete()'s immediate-vs-deferred decision. This
closes the taskTASK_SCHEDULED_TO_YIELD race against the IDLE-deferred
TCB cleanup on the SMP preview kernel; behaviour is unchanged on the
default IDF kernel and on single-core targets.
Jiang Jiang Jian
Kapil Gupta
Mahavir Jain
muhaidong
Zhang Hai Peng
zhiweijian
linruihao
Island
harshal.patil
Ashish Sharma
Aditya Patwardhan
ShenWeilong
luoxu
Roland Dobai
Jiang Guang Ming
wuzhenghui
wanglei
hebinglin
zhaoweiliang
yangfeng
Zhang Wen Xu
Sudeep Mohanty
yinqingzhao