ESP32-C2 and ESP32-C61 have no RSA based Secure Boot V2 support, so the
CI configs that pin the RSA signing scheme and key fail the app signing
scheme/key check on these targets.
- flash_enc_wifi_2.data_partition_verification: add C2/C61 sdkconfig
overlays that switch to the ECDSA P-256 signing scheme and key (no
force-enable needed as Secure Boot V2 itself is not enabled here).
- on_update_no_sb_rsa: disable the build on targets without
SOC_SECURE_BOOT_V2_RSA, mirroring simple_ota_example, since this
config specifically exercises the RSA scheme.
httpd_req_get_hdr_value_str() detected truncation with `val_size < full_size`, where full_size is the strlcpy() return value. strlcpy() returns strlen() of the source (the terminating null is not counted), so truncation actually occurs when strlen(src) >= val_size. At strlen(src) == val_size the value is copied as val_size - 1 chars + NUL (i.e. truncated) yet ESP_OK was returned, so the caller never learned the value was cut.
Use `val_size <= full_size` and correct the misleading comment about strlcpy()'s return value.
Same truncation-reporting class fixed for httpd_cookie_key_value in PR #16202; httpd_req_get_hdr_value_str was missed. No memory-safety impact: strlcpy() null-terminates if val_size > 0.
Handle absent IROM/DROM alignment gap in SPIRAM-XIP memprot tests
Closes IDFCI-5004, IDFCI-11739, and IDFCI-11738
See merge request espressif/esp-idf!50133
- Add nira attr and verification for pasn auth frames
- Refine key clearing and pairing complete logic for pasn verify
- Add NIRA own-service resolution, cached NIK checks, and dynamic
pairing IE construction for bootstrap vs verify paths.
- Replace NAN bootstrap events by private callbacks
Add esp_netif_add_static_neighbor() and esp_netif_remove_static_neighbor(),
gated by CONFIG_LWIP_ND6_SUPPORT_STATIC_ENTRIES. These API's let callers
install/remove permanent IPv6->MAC mappings that bypass Neighbor Discovery
(no NS/NA). The calls run in the TCP/IP context and wrap the underlying lwIP
nd6_add_static_neighbor()/nd6_remove_static_neighbor() functions.
Replace the key-lifetime check with explicit ownership tracking so a
caller-supplied volatile PSA key is also preserved on cleanup, and drop the
DS/HARDWARE_ECDSA compile guard so the ESP_KEY_SOURCE_PSA path is released on
pure secure-element builds.
The DS/ECDSA cleanup added in 8cb64703 is intended for volatile PSA keys
created internally by the DS and ECDSA peripheral paths. Ensure that
during the cleanup, PSA_KEY_LIFETIME_IS_VOLATILE() is checked to avoid
destroying keys the user has added persistently to PSA.
This resolves an issue in the next commit (adding support for
clientkey_psa_id) where a user passes a PSA key id that is then silently
destroyed if CONFIG_ESP_TLS_USE_DS_PERIPHERAL or
CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN happen to be defined.
Signed-off-by: Mike Szczys <michael.szczys@canonical.com>
(cherry picked from commit da51d69013)
Per mbedTLS API contract, mbedtls_pk_context must be explicitly initialized
with mbedtls_pk_init() before calling mbedtls_pk_wrap_psa(). Add the missing
init calls for both the server_key and client_key PSA-backed key code paths.
- esp_tls_mbedtls: require cert when PSA-backed server/client key is set
- esp_tls_mbedtls: drop redundant pk_init/x509_crt_init (calloc handles it)
- psa SE driver: copy callbacks/opaque_key by value (no lifetime coupling)
- psa SE driver: replace atomic CAS with simple null check on register
- psa SE driver: use sig_len from sign callback with bounds validation
- psa SE driver: validate pubkey_len returned by export_pubkey callback
- psa SE driver: check hash sub-alg in RSA PKCS1V15 branch of validate_request
- psa SE driver: align secure_element_register_callbacks doc with value-copy impl
- esp_https_server: initialize server_key in HTTPD_SSL_CONFIG_DEFAULT
- mbedtls: move SECURE_ELEMENT_DRIVER_ENABLED to esp_config.h for parity
with ESP_ECDSA_DRIVER_ENABLED; drop target_compile_definitions
- docs: fix esp_tls_cfg_t -> esp_http_client_config_t cross-reference
- docs: check psa_import_key() status in ESP-TLS PSA example
- hints/error_output: point at CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED
Marius Vikhammer
Mahavir Jain
wuzhenghui
Island
Hu Rui
harshal.patil
Ashish Sharma
Rahul Tank
Benedek Brandschott
Jiang Jiang Jian
sonika.rathi
Sudeep Mohanty
Fu Hanxi
akshat
Martin Vychodil
cjin
morris
Nachiket Kukade
Sajia
Laukik Hase
Linyan Liu
Konstantin Kondrashov
Li Shuai
zhaoweiliang
Wang Meng Yang
Aditya Patwardhan
Mike Szczys