Skip to content

Roll ESP-IDF to 5.4.2. #2932

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 3 commits into
base: master
Choose a base branch
from
Draft

Roll ESP-IDF to 5.4.2. #2932

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ee8069e
Roll ESP-IDF to 5.4.2.
floitsch Oct 18, 2025
78c620c
Update mbedtls config.
floitsch Oct 18, 2025
cd8647a
Update sdkconfigs.
floitsch Oct 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
129 changes: 125 additions & 4 deletions mbedtls/include/default_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1622,6 +1622,46 @@
*/
//#define MBEDTLS_SSL_ASYNC_PRIVATE

/** \def MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME
Copy link
Member Author

@floitsch floitsch Oct 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As per the README in the mbedtls/include directory:
The default_config.h file has been updated to match the one in the mbedtls directory.

The toit_config.h was updated to match these changes. I just applied the same diff.
Unless I screwed it up, the patch to default_config.h should be exactly the same as for toit_config.h. And that diff doesn't actually change anything.

*
* In TLS clients, when a client authenticates a server through its
* certificate, the client normally checks three things:
* - the certificate chain must be valid;
* - the chain must start from a trusted CA;
* - the certificate must cover the server name that is expected by the client.
*
* Omitting any of these checks is generally insecure, and can allow a
* malicious server to impersonate a legitimate server.
*
* The third check may be safely skipped in some unusual scenarios,
* such as networks where eavesdropping is a risk but not active attacks,
* or a private PKI where the client equally trusts all servers that are
* accredited by the root CA.
*
* You should call mbedtls_ssl_set_hostname() with the expected server name
* before starting a TLS handshake on a client (unless the client is
* set up to only use PSK-based authentication, which does not rely on the
* host name). This configuration option controls what happens if a TLS client
* is configured with the authentication mode #MBEDTLS_SSL_VERIFY_REQUIRED
* (default), certificate authentication is enabled and the client does not
* call mbedtls_ssl_set_hostname():
*
* - If this option is unset (default), the connection attempt is aborted
* with the error #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME.
* - If this option is set, the TLS library does not check the server name
* that the certificate is valid for. This is the historical behavior
* of Mbed TLS, but may be insecure as explained above.
*
* Enable this option for strict backward compatibility if you have
* determined that it is secure in the scenario where you are using
* Mbed TLS.
*
* \deprecated This option exists only for backward compatibility and will
* be removed in the next major version of Mbed TLS.
*
*/
//#define MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME

/**
* \def MBEDTLS_SSL_CONTEXT_SERIALIZATION
*
Expand Down Expand Up @@ -1807,6 +1847,11 @@
* running handshake hash) only use PSA crypto if
* #MBEDTLS_USE_PSA_CRYPTO is enabled.
*
* \note In multithreaded applications, you must also enable
* #MBEDTLS_THREADING_C, even if individual TLS contexts are not
* shared between threads, unless only one thread ever calls
* TLS functions.
*
* Uncomment this macro to enable the support for TLS 1.3.
*/
#define MBEDTLS_SSL_PROTO_TLS1_3
Expand Down Expand Up @@ -2125,6 +2170,10 @@
* before calling any function from the SSL/TLS, X.509 or PK modules, except
* for the various mbedtls_xxx_init() functions which can be called at any time.
*
* \warning In multithreaded applications, you must also enable
* #MBEDTLS_THREADING_C, unless only one thread ever calls PSA functions
* (`psa_xxx()`), including indirect calls through SSL/TLS, X.509 or PK.
*
* \note An important and desirable effect of this option is that it allows
* PK, X.509 and TLS to take advantage of PSA drivers. For example, enabling
* this option is what allows use of drivers for ECDSA, ECDH and EC J-PAKE in
Expand Down Expand Up @@ -3213,7 +3262,18 @@
/**
* \def MBEDTLS_PSA_CRYPTO_C
*
* Enable the Platform Security Architecture cryptography API.
* Enable the Platform Security Architecture (PSA) cryptography API.
*
* \note In multithreaded applications, you must enable #MBEDTLS_THREADING_C,
* unless only one thread ever calls `psa_xxx()` functions.
* That includes indirect calls, such as:
* - performing a TLS handshake if support for TLS 1.3 is enabled;
* - using a TLS 1.3 connection;
* - indirect calls from PK, X.509 or SSL functions when
* #MBEDTLS_USE_PSA_CRYPTO is enabled;
* - indirect calls to calculate a hash when #MBEDTLS_MD_C is disabled;
* - any other call to a function that requires calling psa_crypto_init()
* beforehand.
*
* Module: library/psa_crypto.c
*
Expand Down Expand Up @@ -3270,6 +3330,26 @@
*/
#define MBEDTLS_PSA_ITS_FILE_C

/**
* \def MBEDTLS_PSA_STATIC_KEY_SLOTS
*
* Statically preallocate memory to store keys' material in PSA instead
* of allocating it dynamically when required. This allows builds without a
* heap, if none of the enabled cryptographic implementations or other features
* require it.
* This feature affects both volatile and persistent keys which means that
* it's not possible to persistently store a key which is larger than
* #MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE.
*
* \note This feature comes with a (potentially) higher RAM usage since:
* - All the key slots are allocated no matter if they are used or not.
* - Each key buffer's length is #MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE bytes.
*
* Requires: MBEDTLS_PSA_CRYPTO_C
*
*/
//#define MBEDTLS_PSA_STATIC_KEY_SLOTS

/**
* \def MBEDTLS_RIPEMD160_C
*
Expand Down Expand Up @@ -3613,10 +3693,38 @@
* \def MBEDTLS_THREADING_C
*
* Enable the threading abstraction layer.
* By default Mbed TLS assumes it is used in a non-threaded environment or that
* contexts are not shared between threads. If you do intend to use contexts
*
* Traditionally, Mbed TLS assumes it is used in a non-threaded environment or
* that contexts are not shared between threads. If you do intend to use contexts
* between threads, you will need to enable this layer to prevent race
* conditions. See also our Knowledge Base article about threading:
* conditions.
*
* The PSA subsystem has an implicit shared context. Therefore, you must
* enable this option if more than one thread may use any part of
* Mbed TLS that is implemented on top of the PSA subsystem.
*
* You must enable this option in multithreaded applications where more than
* one thread performs any of the following operations:
*
* - Any call to a PSA function (`psa_xxx()`).
* - Any call to a TLS, X.509 or PK function (`mbedtls_ssl_xxx()`,
* `mbedtls_x509_xxx()`, `mbedtls_pkcs7_xxx()`, `mbedtls_pk_xxx()`)
* if `MBEDTLS_USE_PSA_CRYPTO` is enabled (regardless of whether individual
* TLS, X.509 or PK contexts are shared between threads).
* - A TLS 1.3 connection, regardless of the compile-time configuration.
* - Any library feature that calculates a hash, if `MBEDTLS_MD_C` is disabled.
* As an exception, algorithm-specific low-level modules do not require
* threading protection unless the contexts are shared between threads.
* - Any library feature that performs symmetric encryption or decryption,
* if `MBEDTLS_CIPHER_C` is disabled.
* As an exception, algorithm-specific low-level modules do not require
* threading protection unless the contexts are shared between threads.
* - Any use of a cryptographic context if the same context is used in
* multiple threads.
* - Any call to a function where the documentation specifies that
* psa_crypto_init() must be called prior to that function.
*
* See also our Knowledge Base article about threading:
* https://mbed-tls.readthedocs.io/en/latest/kb/development/thread-safety-and-multi-threading
*
* Module: library/threading.c
Expand Down Expand Up @@ -4071,6 +4179,19 @@
*/
//#define MBEDTLS_PSA_KEY_SLOT_COUNT 32

/**
* \def MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE
*
* Define the size (in bytes) of each static key buffer when
* #MBEDTLS_PSA_STATIC_KEY_SLOTS is set. If not
* explicitly defined then it's automatically guessed from available PSA keys
* enabled in the build through PSA_WANT_xxx symbols.
* If required by the application this parameter can be set to higher values
* in order to store larger objects (ex: raw keys), but please note that this
* will increase RAM usage.
*/
//#define MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE 256

/* RSA OPTIONS */
//#define MBEDTLS_RSA_GEN_KEY_MIN_BITS 1024 /**< Minimum RSA key size that can be generated in bits (Minimum possible value is 128 bits) */

Expand Down
129 changes: 125 additions & 4 deletions mbedtls/include/toit_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1622,6 +1622,46 @@
*/
//#define MBEDTLS_SSL_ASYNC_PRIVATE

/** \def MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME
*
* In TLS clients, when a client authenticates a server through its
* certificate, the client normally checks three things:
* - the certificate chain must be valid;
* - the chain must start from a trusted CA;
* - the certificate must cover the server name that is expected by the client.
*
* Omitting any of these checks is generally insecure, and can allow a
* malicious server to impersonate a legitimate server.
*
* The third check may be safely skipped in some unusual scenarios,
* such as networks where eavesdropping is a risk but not active attacks,
* or a private PKI where the client equally trusts all servers that are
* accredited by the root CA.
*
* You should call mbedtls_ssl_set_hostname() with the expected server name
* before starting a TLS handshake on a client (unless the client is
* set up to only use PSK-based authentication, which does not rely on the
* host name). This configuration option controls what happens if a TLS client
* is configured with the authentication mode #MBEDTLS_SSL_VERIFY_REQUIRED
* (default), certificate authentication is enabled and the client does not
* call mbedtls_ssl_set_hostname():
*
* - If this option is unset (default), the connection attempt is aborted
* with the error #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME.
* - If this option is set, the TLS library does not check the server name
* that the certificate is valid for. This is the historical behavior
* of Mbed TLS, but may be insecure as explained above.
*
* Enable this option for strict backward compatibility if you have
* determined that it is secure in the scenario where you are using
* Mbed TLS.
*
* \deprecated This option exists only for backward compatibility and will
* be removed in the next major version of Mbed TLS.
*
*/
//#define MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME

/**
* \def MBEDTLS_SSL_CONTEXT_SERIALIZATION
*
Expand Down Expand Up @@ -1807,6 +1847,11 @@
* running handshake hash) only use PSA crypto if
* #MBEDTLS_USE_PSA_CRYPTO is enabled.
*
* \note In multithreaded applications, you must also enable
* #MBEDTLS_THREADING_C, even if individual TLS contexts are not
* shared between threads, unless only one thread ever calls
* TLS functions.
*
* Uncomment this macro to enable the support for TLS 1.3.
*/
// #define MBEDTLS_SSL_PROTO_TLS1_3
Expand Down Expand Up @@ -2125,6 +2170,10 @@
* before calling any function from the SSL/TLS, X.509 or PK modules, except
* for the various mbedtls_xxx_init() functions which can be called at any time.
*
* \warning In multithreaded applications, you must also enable
* #MBEDTLS_THREADING_C, unless only one thread ever calls PSA functions
* (`psa_xxx()`), including indirect calls through SSL/TLS, X.509 or PK.
*
* \note An important and desirable effect of this option is that it allows
* PK, X.509 and TLS to take advantage of PSA drivers. For example, enabling
* this option is what allows use of drivers for ECDSA, ECDH and EC J-PAKE in
Expand Down Expand Up @@ -3213,7 +3262,18 @@
/**
* \def MBEDTLS_PSA_CRYPTO_C
*
* Enable the Platform Security Architecture cryptography API.
* Enable the Platform Security Architecture (PSA) cryptography API.
*
* \note In multithreaded applications, you must enable #MBEDTLS_THREADING_C,
* unless only one thread ever calls `psa_xxx()` functions.
* That includes indirect calls, such as:
* - performing a TLS handshake if support for TLS 1.3 is enabled;
* - using a TLS 1.3 connection;
* - indirect calls from PK, X.509 or SSL functions when
* #MBEDTLS_USE_PSA_CRYPTO is enabled;
* - indirect calls to calculate a hash when #MBEDTLS_MD_C is disabled;
* - any other call to a function that requires calling psa_crypto_init()
* beforehand.
*
* Module: library/psa_crypto.c
*
Expand Down Expand Up @@ -3270,6 +3330,26 @@
*/
#define MBEDTLS_PSA_ITS_FILE_C

/**
* \def MBEDTLS_PSA_STATIC_KEY_SLOTS
*
* Statically preallocate memory to store keys' material in PSA instead
* of allocating it dynamically when required. This allows builds without a
* heap, if none of the enabled cryptographic implementations or other features
* require it.
* This feature affects both volatile and persistent keys which means that
* it's not possible to persistently store a key which is larger than
* #MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE.
*
* \note This feature comes with a (potentially) higher RAM usage since:
* - All the key slots are allocated no matter if they are used or not.
* - Each key buffer's length is #MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE bytes.
*
* Requires: MBEDTLS_PSA_CRYPTO_C
*
*/
//#define MBEDTLS_PSA_STATIC_KEY_SLOTS

/**
* \def MBEDTLS_RIPEMD160_C
*
Expand Down Expand Up @@ -3613,10 +3693,38 @@
* \def MBEDTLS_THREADING_C
*
* Enable the threading abstraction layer.
* By default Mbed TLS assumes it is used in a non-threaded environment or that
* contexts are not shared between threads. If you do intend to use contexts
*
* Traditionally, Mbed TLS assumes it is used in a non-threaded environment or
* that contexts are not shared between threads. If you do intend to use contexts
* between threads, you will need to enable this layer to prevent race
* conditions. See also our Knowledge Base article about threading:
* conditions.
*
* The PSA subsystem has an implicit shared context. Therefore, you must
* enable this option if more than one thread may use any part of
* Mbed TLS that is implemented on top of the PSA subsystem.
*
* You must enable this option in multithreaded applications where more than
* one thread performs any of the following operations:
*
* - Any call to a PSA function (`psa_xxx()`).
* - Any call to a TLS, X.509 or PK function (`mbedtls_ssl_xxx()`,
* `mbedtls_x509_xxx()`, `mbedtls_pkcs7_xxx()`, `mbedtls_pk_xxx()`)
* if `MBEDTLS_USE_PSA_CRYPTO` is enabled (regardless of whether individual
* TLS, X.509 or PK contexts are shared between threads).
* - A TLS 1.3 connection, regardless of the compile-time configuration.
* - Any library feature that calculates a hash, if `MBEDTLS_MD_C` is disabled.
* As an exception, algorithm-specific low-level modules do not require
* threading protection unless the contexts are shared between threads.
* - Any library feature that performs symmetric encryption or decryption,
* if `MBEDTLS_CIPHER_C` is disabled.
* As an exception, algorithm-specific low-level modules do not require
* threading protection unless the contexts are shared between threads.
* - Any use of a cryptographic context if the same context is used in
* multiple threads.
* - Any call to a function where the documentation specifies that
* psa_crypto_init() must be called prior to that function.
*
* See also our Knowledge Base article about threading:
* https://mbed-tls.readthedocs.io/en/latest/kb/development/thread-safety-and-multi-threading
*
* Module: library/threading.c
Expand Down Expand Up @@ -4071,6 +4179,19 @@
*/
//#define MBEDTLS_PSA_KEY_SLOT_COUNT 32

/**
* \def MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE
*
* Define the size (in bytes) of each static key buffer when
* #MBEDTLS_PSA_STATIC_KEY_SLOTS is set. If not
* explicitly defined then it's automatically guessed from available PSA keys
* enabled in the build through PSA_WANT_xxx symbols.
* If required by the application this parameter can be set to higher values
* in order to store larger objects (ex: raw keys), but please note that this
* will increase RAM usage.
*/
//#define MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE 256

/* RSA OPTIONS */
//#define MBEDTLS_RSA_GEN_KEY_MIN_BITS 1024 /**< Minimum RSA key size that can be generated in bits (Minimum possible value is 128 bits) */

Expand Down
2 changes: 1 addition & 1 deletion third_party/esp-idf
Open in desktop
Submodule esp-idf updated 1610 files
Loading
Loading