Restore the use_secure_element field in esp_tls_cfg_t, esp_tls_cfg_server_t
and httpd_ssl_config_t, and esp_transport_ssl_use_secure_element(), as
deprecated no-ops so that existing code keeps compiling. Setting them now
fails at runtime with ESP_ERR_NOT_SUPPORTED, as the feature is accessed
via the esp_key_config_t interface. To be removed in the next major release.
No compile-time deprecation attribute on this release branch; the field and
function stay warning-free here and carry only documentation notes.
Replace the key-lifetime check with explicit ownership tracking so a
caller-supplied volatile PSA key is also preserved on cleanup, and drop the
DS/HARDWARE_ECDSA compile guard so the ESP_KEY_SOURCE_PSA path is released on
pure secure-element builds.
(cherry picked from commit 7cdd0b5960)
The DS/ECDSA cleanup added in 8cb64703 is intended for volatile PSA keys
created internally by the DS and ECDSA peripheral paths. Ensure that
during the cleanup, PSA_KEY_LIFETIME_IS_VOLATILE() is checked to avoid
destroying keys the user has added persistently to PSA.
This resolves an issue in the next commit (adding support for
clientkey_psa_id) where a user passes a PSA key id that is then silently
destroyed if CONFIG_ESP_TLS_USE_DS_PERIPHERAL or
CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN happen to be defined.
Signed-off-by: Mike Szczys <michael.szczys@canonical.com>
(cherry picked from commit da51d69013)
(cherry picked from commit f68cfbf8d4)
.build-test-rules.yml restricts esp-tls test_apps to esp32c3 only.
Commit 19a544203b9 accidentally expanded the README to all targets.
(cherry picked from commit b7f53c3868)
Per mbedTLS API contract, mbedtls_pk_context must be explicitly initialized
with mbedtls_pk_init() before calling mbedtls_pk_wrap_psa(). Add the missing
init calls for both the server_key and client_key PSA-backed key code paths.
(cherry picked from commit 005072c87e)
- esp_tls_mbedtls: require cert when PSA-backed server/client key is set
- esp_tls_mbedtls: drop redundant pk_init/x509_crt_init (calloc handles it)
- psa SE driver: copy callbacks/opaque_key by value (no lifetime coupling)
- psa SE driver: replace atomic CAS with simple null check on register
- psa SE driver: use sig_len from sign callback with bounds validation
- psa SE driver: validate pubkey_len returned by export_pubkey callback
- psa SE driver: check hash sub-alg in RSA PKCS1V15 branch of validate_request
- psa SE driver: align secure_element_register_callbacks doc with value-copy impl
- esp_https_server: initialize server_key in HTTPD_SSL_CONFIG_DEFAULT
- mbedtls: move SECURE_ELEMENT_DRIVER_ENABLED to esp_config.h for parity
with ESP_ECDSA_DRIVER_ENABLED; drop target_compile_definitions
- docs: fix esp_tls_cfg_t -> esp_http_client_config_t cross-reference
- docs: check psa_import_key() status in ESP-TLS PSA example
- hints/error_output: point at CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED
(cherry picked from commit 08b567ef3b)
Add ESP_KEY_SOURCE_BUFFER and ESP_KEY_SOURCE_PSA key sources so all
hardware backends (DS, ECDSA, secure element) are accessed via PSA
key IDs through a single esp_tls_cfg_t.client_key field.
(cherry picked from commit 36090b7161)
The skip_common_name flag was named for the legacy CN field but actually
suppresses the entire mbedtls_ssl_set_hostname() call -- disabling
hostname matching against CN/SAN AND Server Name Indication. Update the
doxygen to describe the real effect, and emit a per-call WARN inside the
SNI-disable branch so debug-only use does not slip into production
unnoticed.
The session-resumption else-if in set_client_config() short-circuited
the CA verification chain when only client_session was supplied. Remove
the branch so session-only configs fall through to the normal error /
skip-verify path; resumption no longer silently disables CA validation.
esp_mem.c in the builtin target via
target_sources(builtin PRIVATE ...) called from the parent CMakeLists.
This cross-directory source injection causes CMake's Ninja generator on
Windows to produce unstable TARGET_PDB/RSP_FILE paths across
reconfigures, changing the ninja command hash and forcing a re-archive
of libmbed-builtin.a on every cmake run — even when no source changed.
This broke test_rebuild_source_files.
Fix by adding esp_mem.c to the IDF mbedtls component library
(mbedtls_srcs) instead. The final ELF link uses --start-group, so
builtin's platform.o resolves esp_mbedtls_mem_calloc/free from the
component library regardless of archive order. esp_mem.c is IDF-specific
code (heap_caps_calloc, sdkconfig.h) and belongs in the port layer, not
in any submodule target.
For Build System v2 on linux target, lwip dependency and ESP_TLS_WITH_LWIP
definition must be conditional on CONFIG_LWIP_ENABLE rather than checking
BUILD_COMPONENTS. v2 uses configuration-driven dependencies.
Added crypto_sha1 and crypto_base64_encode callbacks to esp_tls_stack_ops_t
to allow custom TLS stacks to provide implementations for esp_crypto_* APIs.
Ashish Sharma
Jiang Jiang Jian
Aditya Patwardhan
Mike Szczys
Guillaume Souchere
Sudeep Mohanty
Fu Hanxi
harshal.patil
Evgeny Torbin
Marek Fiala
Mahavir Jain