Migrate to IDF 5.5.3 candidate
Pin PlatformIO packages and toolchains, rebase protected SDK overrides, and add WebSocket receive regression coverage. Document isolated candidate validation, archive provenance, and remaining gates.
This commit is contained in:
@@ -7,7 +7,7 @@ client ciphersuite setting is changed.
|
||||
## Build contract
|
||||
|
||||
`tools/security_overrides.py` requires the installed ESP-IDF version header to
|
||||
identify **5.5.0**, and checks each complete original source against its reviewed
|
||||
identify **5.5.3**, and checks each complete original source against its reviewed
|
||||
SHA256. Every text substitution must match **exactly once**. The entire input
|
||||
plan is validated before any output is written. A changed SDK, missing source,
|
||||
ambiguous edit, duplicate source, or missing/ambiguous component target fails
|
||||
@@ -80,8 +80,9 @@ Source generator expressions are rejected rather than guessed through.
|
||||
[bfaf4a47fd33da860796feaba6235847acb71127](https://github.com/Mbed-TLS/mbedtls/commit/bfaf4a47fd33da860796feaba6235847acb71127.patch).
|
||||
|
||||
These three patches were fetched from the official repositories and compared
|
||||
with the installed pinned sources on 2026-09-15. No dependency versions or
|
||||
existing original-source hashes changed. The optional WS subprotocol backport
|
||||
with the installed pinned sources on 2026-09-15. That original implementation did not change dependency versions or source hashes;
|
||||
the current 5.5.3 rebase has separately reviewed original hashes (see
|
||||
`docs/idf_553_rebase_review.md`). The optional WS subprotocol backport
|
||||
and separate ASN.1 repeated-OID/empty-value correction are **not** implemented.
|
||||
|
||||
Clients that cannot negotiate this server profile will no longer connect.
|
||||
@@ -109,7 +110,7 @@ entry tuple as well as the default registry. The manifest maps each entry to
|
||||
its component, optional nested target, original and derived source. CMake's
|
||||
`sak_security_replace_source(component original generated nested_target)` handles
|
||||
replacement on the actual source owner, not the IDF mbedTLS wrapper. The current
|
||||
registry has six IDF sources and one project-managed wolfSSH source. Update the
|
||||
registry has seven IDF C sources, two project-managed wolfSSH C sources and one wolfSSH header overlay. Update the
|
||||
corresponding library-specific feature/behavior tests when extending the registry. Multiple
|
||||
sources in the same real component are supported by the replacement function.
|
||||
|
||||
@@ -130,6 +131,42 @@ old generated copies lack the new entries/notice and must not pass. It checks re
|
||||
Ninja registration: exactly one compilation of each derived source, no original
|
||||
compilation, and exact generated bytes. It does **not** run a firmware build.
|
||||
|
||||
### Candidate WebSocket receive regression
|
||||
|
||||
```sh
|
||||
CCACHE_DISABLE=1 python3 -B tests/sdk_security_overrides/run.py --idf-path .pio/idf-candidate-5.5.3/core/packages/framework-espidf
|
||||
CCACHE_DISABLE=1 python3 -B tests/web_serial_performance/run.py --idf-path .pio/idf-candidate-5.5.3/core/packages/framework-espidf
|
||||
```
|
||||
|
||||
Either runner accepts `--build-dir .pio/idf-candidate-5.5.3/app/.pio/build/esp32-s3-devkitc-1-n16r8`
|
||||
for strict existing-build evidence. The performance runner otherwise renders the
|
||||
current hash-verified WS override; it never falls back to vendor WS code.
|
||||
Its build mode verifies exactly one generated compilation input, its HTTPD owner,
|
||||
original-source absence and byte equality with the current override. A stale build
|
||||
missing the WS replacement must fail; parent reconfiguration/build is separate.
|
||||
|
||||
`ws.c` executes complete generated `httpd_ws_get_frame_type`,
|
||||
`httpd_ws_recv_frame`, unmask/check/send-wrapper functions and complete hash-pinned
|
||||
vendor `httpd_recv_with_opt`/`httpd_recv_pending`, not copied conditional snippets.
|
||||
The send endpoint and socket receive callback are bounded doubles. Its 982 cases
|
||||
cover all five header sites (first/second byte, 2/8-byte length, 4-byte mask),
|
||||
negative failure/timeout, EOF, every shorter prefix, split socket reads, pending
|
||||
prefixes plus timeout (positive short returns), successful binary decode, length
|
||||
probe/resume, nontrivial extended lengths, automatic PING/PONG and CLOSE.
|
||||
Input ends at a guard page; output/mask canaries, exact byte consumption and
|
||||
send/callback counts enforce no payload read or output after framing failure.
|
||||
UBSan trap instrumentation is enabled.
|
||||
|
||||
The tests deliberately do **not** assert transactional rollback: failed first-byte
|
||||
reads return `ESP_OK` with final/CLOSE metadata; other failed reads retain already
|
||||
decoded type/final/length or partially received mask bytes. They assert that exact
|
||||
state and that no automatic reply follows failed control framing. Five individual
|
||||
cast removals must fail strict compilation with `sign-compare`; five explicit
|
||||
unsigned-promotion equivalents must compile with warnings-as-errors and then fail
|
||||
behavioral assertions. No diagnostic suppression is used for these mutations.
|
||||
This is host framing evidence, not live sockets, target ABI/timing or firmware
|
||||
integration evidence.
|
||||
|
||||
Coverage:
|
||||
|
||||
- Generator full-source hashes, version, missing/duplicate/ambiguous inputs,
|
||||
|
||||
Reference in New Issue
Block a user