Commander1024/ESP32_Serial_Swiss_Army_Knife
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply Phase 9D security mitigations

Browse Source 
- Add fail-closed wolfSSL small-math policy and vectors
- Backport DHCP, EMS, and X.509 allocation fixes
- Extend source override validation and operational documentation
This commit is contained in:
Commander1024
2026-09-15 23:06:23 +02:00
parent cdc9c7335a
commit c010e1a1d5
22 changed files with 1562 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmake/security_overrides.cmake
+21 -2
View File
@@ -31,11 +31,29 @@ set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS
# Public extension point: the Python Entry registry supplies the mapping. This
# function is backend-agnostic; a later pinned project/vendor source uses it too.
function(sak_security_replace_source component original generated)
function(sak_security_replace_source component original generated nested_target)
idf_component_get_property(_target "${component}" COMPONENT_LIB)
if(NOT TARGET "${_target}")
message(FATAL_ERROR "Security override: missing component target ${component}")
endif()
if(NOT "${nested_target}" STREQUAL "")
if(NOT component STREQUAL "mbedtls" OR
NOT nested_target MATCHES "^(mbedtls|mbedx509|mbedcrypto)$")
message(FATAL_ERROR "Security override: invalid nested target ${component}/${nested_target}")
endif()
if(NOT TARGET "${nested_target}")
message(FATAL_ERROR "Security override: missing nested target ${nested_target}")
endif()
set(_target "${nested_target}")
get_target_property(_imported "${_target}" IMPORTED)
get_target_property(_alias "${_target}" ALIASED_TARGET)
get_target_property(_owner_dir "${_target}" SOURCE_DIR)
get_filename_component(_owner_dir "${_owner_dir}" REALPATH)
get_filename_component(_expected_owner "${_sak_security_idf}/components/mbedtls/mbedtls/library" REALPATH)
if(_imported OR _alias OR NOT _owner_dir STREQUAL _expected_owner)
message(FATAL_ERROR "Security override: unexpected nested target owner ${_target}: ${_owner_dir}")
endif()
endif()
get_target_property(_source_dir "${_target}" SOURCE_DIR)
get_target_property(_sources "${_target}" SOURCES)
get_filename_component(_expected "${original}" REALPATH)
@@ -98,5 +116,6 @@ foreach(_sak_security_id IN LISTS SAK_SECURITY_OVERRIDE_IDS)
sak_security_replace_source(
"${SAK_SECURITY_${_sak_security_id}_COMPONENT}"
"${SAK_SECURITY_${_sak_security_id}_ORIGINAL}"
"${SAK_SECURITY_${_sak_security_id}_GENERATED}")
"${SAK_SECURITY_${_sak_security_id}_GENERATED}"
"${SAK_SECURITY_${_sak_security_id}_TARGET}")
endforeach()