Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity
54,804 Commits 25 Branches 192 Tags
ad59a903b76519e82c955cad783ea4eab8b3a900
Commit Graph
61 Commits
Author SHA1 Message Date
Mahavir Jain 6e49bfec02 Merge branch 'fix/crt-bundle-unaligned-reads' into 'master' 
fix(mbedtls): read crt bundle byte-wise to avoid misaligned flash access

Closes IDF-16030

See merge request espressif/esp-idf!51600
 2026-08-12 14:13:45 +05:30
Pranav Sonawane d385023b85 fix(mbedtls): Raise error for certificate files with unsupported extension 
gen_crt_bundle.py only parses files ending in .pem or .der, but silently
ignored anything else. A PEM certificate named e.g. ca.crt was skipped
without a word, and since the build invokes the script with -q, even the
"Successfully added 0 certificates" hint was suppressed. The build then
succeeded and embedded a bundle without the certificate, and the problem
only surfaced at runtime as a TLS verification failure.

A file passed directly via --input, which is what
CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE_PATH points at, is now expected
to be a certificate: an unsupported extension raises an InputError and
fails the build with a message naming the file and the two accepted
extensions. Files found while scanning a directory keep being skipped,
as a certificate directory may legitimately contain other files, but a
warning is now printed unconditionally so it is visible in the build log.

Also document the requirement in the Kconfig help text and in the
esp_crt_bundle documentation.

Closes https://github.com/espressif/esp-idf/issues/18933
 2026-08-12 09:59:28 +05:30
Mahavir Jain 9c3a553115 fix(mbedtls): read crt bundle byte-wise to avoid misaligned flash access 
The offset table and the per-cert length fields of the certificate
bundle were read through uint16_t*/uint32_t* casts, which compile to
halfword/word loads at addresses with no alignment guarantee: bundles
supplied via esp_crt_bundle_set() can start anywhere, and cert entries
are byte-packed, so their 16-bit fields land at arbitrary offsets.

On chips with SOC_CPU_MISALIGNED_ACCESS_ON_PMP_MISMATCH_ISSUE (DIG-694:
ESP32-C6/H2/H21) a misaligned load from memory-mapped flash can take a
spurious "Load access fault" when it sits within two instructions of an
access to a differently-permissioned region, observed as a crash in
esp_crt_check_bundle()/CA callback during TLS handshakes with a bundle
that happened to be placed at an odd address.
 2026-08-12 08:42:49 +05:30
Espressif BOT 8671276304 change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2026-07-31 10:09:00 +05:30
Ashish Sharma 7462e3c30a fix(mbedtls): validate crypto input lengths (TEE OOB, auth-bypass, overflows) 2026-07-03 17:19:05 +08:00
Espressif BOT cdff63e838 change(mbedtls/crt_bundle): Update esp_cmn_crt_bundle certificates 2026-06-10 10:10:43 +05:30
Espressif BOT 7126a31b02 change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2026-06-02 10:06:43 +05:30
Ashish Sharma 0e03327f69 fix(esp_crt_bundle): fixes verification with cross signed cert 2026-05-11 17:44:16 +08:00
Ashish Sharma 737e97340b fix(esp_crt_bundle): fixes a potential memory leak with cross signed certificates 
Closes https://github.com/espressif/esp-idf/issues/18512
Closes https://github.com/espressif/esp-idf/issues/18550
 2026-05-11 17:41:45 +08:00
Espressif BOT 54d4d0b140 change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2026-04-13 16:04:54 +05:30
Ashish Sharma 7f8ae482a8 feat: migrates esp_crt_bundle to PSA APIs 2025-12-30 09:31:49 +05:30
Espressif BOT b49f2fde91 change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2025-12-09 11:27:07 +05:30
Espressif BOT 96eb7ae213 change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2025-11-19 10:00:39 +08:00
Ashish Sharma cabb5009f2 feat(esp_crt): adds support for cross signed root certificates 2025-06-26 16:01:11 +08:00
Alexey Lapshin 86ca6ef829 fix(build): fix -Wanalyzer-undefined-behavior-ptrdiff warnings 2025-06-25 18:00:39 +07:00
harshal.patil 6fe38c7efd fix(mbedtls): re-include Comodo AAA Services root 2025-06-16 15:55:39 +05:30
Mahavir Jain 03433aad49 fix(mbedtls): re-include Starfield Class 2 CA 
Some of the endpoints (e.g., httpbin.org) is still relying on the
Starfield Class 2 CA in the chain. Added this root certificate as
a temporary exception and shall be removed in future.
 2025-06-16 15:55:36 +05:30
Espressif BOT da1842ea0f change(mbedtls/crt_bundle): Update esp_cmn_crt_bundle certificates 2025-06-08 13:35:51 +05:30
harshal.patil 65642866bc change(mbedtls/esp_crt_bundle): Remove deprecated certs for the major release version (v6.0) 2025-05-28 23:16:47 +05:30
Espressif BOT e6d92ab49c change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2025-05-28 23:16:47 +05:30
Espressif BOT e08ed84287 change(mbedtls/crt_bundle): Update esp_cmn_crt_bundle certificates 2025-05-26 13:19:57 +05:30
harshal.patilandMahavir Jain 5ae42e6f0b fix(mbedtls/esp_crt_bundle): Suppress non-negative serial number warning 
Co-authored-by: Mahavir Jain <mahavir.jain@espressif.com>
 2025-05-23 09:28:42 +05:30
Ashish Sharma 2fc151d2a9 fix(component/mbedtls): Adds github root cert to cmn_crt_authorities.csv 2025-03-17 14:32:06 +08:00
Espressif BOT a39d8d43ee change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2025-03-05 10:44:47 +08:00
Espressif BOT 7c45809b39 change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2025-01-01 10:00:39 +08:00
Mahavir Jain 849ce255aa fix(esp_crt_bundle): remove expired DST Root CA X3 from bundle 2024-12-19 08:40:16 +05:30
Espressif BOT 24be50e71d change(mbedtls/crt_bundle): Update esp_cmn_crt_bundle certificates 2024-12-18 14:52:09 +05:30
Espressif BOT 001247a29a change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2024-12-13 14:29:37 +08:00
harshal.patilandHanno 3957e59f1a feat(mbedtls/esp_crt_bundle): Move dummy cert to .rodata to save 408B from dram 
Co-authored-by: Hanno <h.binder@web.de>
 2024-10-16 16:21:28 +05:30
harshal.patil b097eb12b3 ci(mbedtls/esp_crt_bundle): Format esp_crt_bundle.c using astyle 2024-10-09 16:08:35 +05:30
Hanno d8e31eb6d0 feat(mbedtls/esp_crt_bundle): Reduced RAM & stack use of cert bundle 
Closes https://github.com/espressif/esp-idf/pull/13204

Signed-off-by: harshal.patil <harshal.patil@espressif.com>
 2024-10-09 16:08:35 +05:30
Espressif BOT d9d303fd6f change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2024-09-25 16:39:46 +08:00
Espressif BOT 62a22f4c89 change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2024-07-03 16:01:50 +05:30
Espressif BOT bebdf7b989 change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2024-03-12 10:00:36 +08:00
Espressif BOT 8f0f7f007c change(mbedtls/crt_bundle): Update esp_crt_bundle certificates 2023-12-19 14:40:56 +08:00
Espressif BOT 24446bfab1 change(esp_crt_bundle): Update esp_crt_bundle certificates 2023-10-29 12:21:21 +05:30
Espressif BOT e174fc967e Update common cert authorities csv 2023-03-12 11:00:24 +08:00
Espressif BOT 35cd5ee57b Update esp_crt_bundle certificates 2023-01-11 10:00:31 +08:00
Harshit Malpani e215ede439 mbedtls: Add support to build for linux target 2023-01-04 11:17:29 +05:30
Espressif BOT 91bd4a1f80 Update esp_crt_bundle certificates 2022-10-13 10:00:11 +08:00
Roland Dobai bab3830797 Tools: Fix flake8 version 5 warnings 2022-08-12 08:13:13 +00:00
Espressif BOT 72fe927e85 Update esp_crt_bundle certificates 2022-07-20 10:00:11 +08:00
Espressif BOT 4a56352f56 Update esp_crt_bundle certificates 2022-04-27 11:26:58 +00:00
Aditya Patwardhan c27c6916a7 esp_crt_bundle: Add bounds checking for the "esp_crt_bundle_set" API. 
Closes https://github.com/espressif/esp-idf/issues/8397
 2022-03-31 13:11:11 +05:30
Espressif BOT f51da7dded Update esp_crt_bundle certificates 2022-03-25 10:48:34 +05:30
Mahavir Jain 5f646b1d43 mbedtls: move locally managed root certificates to separate file 
Purpose:
This will allow for easily automating periodic updates to
"cacrt_all.pem" file.

Note:
For now newly created "cacrt_local.pem" contains single "DST Root CA X3"
which we are keeping to manage compatibility with endpoints like
"howsmyssl.com". Please note this Root CA is expired and is not part of
Mozilla’s NSS root certificate store.
 2022-03-21 22:39:24 +05:30
Laukik Hase 52170fba7f esp_crt_bundle: Fix build error 
- When `esp_crt_bundle.h` is included before any config,
  a build error (`esp_err_t` not defined) is observed

Closes https://github.com/espressif/esp-idf/issues/8606
 2022-03-21 09:05:06 +00:00
Laukik HaseandAditya Patwardhan 3925365351 ci: Fix pre-check stage failing tests 
- Updated license headers
- Re-enabled public headers and static analysis checks
- Fix public header file check failure

Co-authored-by: Aditya Patwardhan <aditya.patwardhan@espressif.com>
 2022-03-03 01:37:10 +05:30
Aditya Patwardhan 60b167f2d6 mbedtls-3.1 update: Removed the MBEDTLS_PRIVATE from multiple files 
after they have been again made public in mbedtls-3.1

*Added `MBEDTLS_ALLOW_PRIVATE_ACCESS` in some files.
 2022-03-03 01:37:10 +05:30
Aditya PatwardhanandLaukik Hase 3b71bd7326 mbedtls-3.0: Fixed ESP32 build issues 
- Added MBEDLTS_PRIVATE(...) wherever necessary
- For functions like mbedtls_pk_parse_key(...), it is necessary to pass the RNG function
  pointers as parameter. Solved for dependent components: wpa_supplicant & openSSL
- For libcoap, the SSLv2 ClientHello handshake method has been deprecated, need to handle this.
  Currently, corresponding snippet has been commented.
- Examples tested: hello-world | https_request | wifi_prov_mgr

mbedtls-3.0: Fixed ESP32-C3 & ESP32-S3 build issues
- Removed MBEDTLS_DEPRECATED_REMOVED macro from sha1 port
- DS peripheral: esp_ds_rsa_sign -> removed unsused 'mode' argument
- Added MBEDTLS_PRIVATE(...) wherever required

mbedtls-3.0: Fixed ESP32-S2 build issues
- Fixed outdated function prototypes and usage in mbedlts/port/aes/esp_aes_gcm.c due to changes in GCM module

mbedtls-3.0: Fixed ESP32-H2 build issues

ci: Fixing build stage
- Added MBEDTLS_PRIVATE(...) wherever required
- Added RNG function parameter
- Updated GCM Module changes
- Updated Copyright notices

- Tests:
- build_esp_idf_tests_cmake_esp32
- build_esp_idf_tests_cmake_esp32s2
- build_esp_idf_tests_cmake_esp32c3
- build_esp_idf_tests_cmake_esp32s3

ci: Fixing build stage (mbedtls-related changes)
- Added MBEDTLS_PRIVATE(...) wherever required
- Updated SHAXXX functions
- Updated esp_config according to mbedtls changes

- Tests:
- build_examples_cmake_esp32
- build_examples_cmake_esp32s2
- build_examples_cmake_esp32c3
- build_examples_cmake_esp32s3

ci: Fixing build stage (example-related changes)
- Added MBEDTLS_PRIVATE(...) wherever required
- Updated SHAXXX functions
- Updated esp_config according to mbedtls changes

- Tests:
- build_examples_cmake_esp32
- build_examples_cmake_esp32s2
- build_examples_cmake_esp32c3
- build_examples_cmake_esp32s3

ci: Fixing target_test stage
- Updated test SSL version to TLS_v1_2

- Tests:
- example_test_protocols 1/2

ci: Fixing build stage
- Added checks for MBEDTLS_DHM_C (disabled by default)
- Updated esp_cryptoauthlib submodule
- Updated factory partition size for legacy BLE provisioning example

- Tests:
- build_examples_cmake_esp32
- build_examples_cmake_esp32s2
- build_examples_cmake_esp32c3
- build_examples_cmake_esp32s3

Co-authored-by: Laukik Hase <laukik.hase@espressif.com>
 2022-03-03 01:37:10 +05:30