From 232c60d298256210ec4a28effdbd5c6f36d60ae9 Mon Sep 17 00:00:00 2001 From: Vikram Dattu Date: Mon, 27 Jul 2026 15:38:57 +0530 Subject: [PATCH] feat(libsrtp): bump submodule for mbedTLS 4 support; allow IDF v6.0 - Bump libsrtp submodule v2.8.0 (24b3bf8) -> 2_x_dev d33b8ff, the merge of cisco/libsrtp#813 (mbedTLS 4 / PSA Crypto support). The adapters self-select on MBEDTLS_VERSION_MAJOR, so mbedTLS 3 (IDF v5.x) paths are unchanged. - Drop the idf '<6' cap from idf_component.yml; component version 2.8.0 -> 2.8.0~1. - CI: build get_started + test_apps on release-v6.0 too. host_test stays on v5.x: the IDF v6 linux target fails to link PSA apps (libtfpsacrypto.a needs mbedtls_ms_time / esp_mbedtls_mem_* from archives earlier on the link line) - an IDF-side ordering issue, independent of libsrtp. Verified locally: test_apps builds clean for esp32 on IDF v6.0.2 (mbedTLS 4.1.0); the v6 linux host_test link failure reproduces with IDF's own tf-psa-crypto references only. --- .github/workflows/libsrtp__build.yml | 2 +- components/libsrtp/.build-test-rules.yml | 14 ++++---------- components/libsrtp/.cz.yaml | 2 +- components/libsrtp/idf_component.yml | 13 ++++++------- components/libsrtp/libsrtp | 2 +- components/libsrtp/sbom_libsrtp.yml | 4 ++-- 6 files changed, 15 insertions(+), 22 deletions(-) diff --git a/.github/workflows/libsrtp__build.yml b/.github/workflows/libsrtp__build.yml index 0e97bc48cf..090c121765 100644 --- a/.github/workflows/libsrtp__build.yml +++ b/.github/workflows/libsrtp__build.yml @@ -14,7 +14,7 @@ jobs: strategy: fail-fast: false matrix: - idf_ver: ["release-v5.4", "release-v5.5"] + idf_ver: ["release-v5.4", "release-v5.5", "release-v6.0"] app: - { name: "get_started", path: "components/libsrtp/examples/get_started" } - { name: "test_apps", path: "components/libsrtp/test_apps" } diff --git a/components/libsrtp/.build-test-rules.yml b/components/libsrtp/.build-test-rules.yml index 846d727189..754c6d11f4 100644 --- a/components/libsrtp/.build-test-rules.yml +++ b/components/libsrtp/.build-test-rules.yml @@ -5,11 +5,9 @@ # disable rules below skip the build on older IDF releases so the repo-wide # CI matrix (v5.1 / v5.2 / v5.3 / v5.4 / v5.5 / latest) doesn't try them. # -# IDF v6+ is also disabled for now: libsrtp 2.x's mbedTLS adapters -# (aes_gcm_mbedtls.c, aes_icm_mbedtls.c, hmac_mbedtls.c) include the -# classic / headers which moved under the -# TF-PSA-Crypto split in mbedTLS 4.x (shipped by IDF v6+). Re-enable once -# libsrtp adapts or we ship a port-side compatibility shim. +# IDF v6+ (mbedTLS 4.x) is supported: the submodule pin (2_x_dev, +# post-v2.8.0) carries mbedTLS 4 / PSA Crypto adapters (cisco/libsrtp#813) +# which self-select on MBEDTLS_VERSION_MAJOR. components/libsrtp/examples/get_started: enable: @@ -18,8 +16,6 @@ components/libsrtp/examples/get_started: disable: - if: IDF_VERSION_MAJOR <= 5 and IDF_VERSION_MINOR < 4 reason: "libsrtp requires ESP-IDF 5.4+." - - if: IDF_VERSION_MAJOR >= 6 - reason: "libsrtp 2.x mbedTLS adapters not yet ported to mbedTLS 4.x (TF-PSA-Crypto split)." components/libsrtp/test_apps: enable: @@ -28,8 +24,6 @@ components/libsrtp/test_apps: disable: - if: IDF_VERSION_MAJOR <= 5 and IDF_VERSION_MINOR < 4 reason: "libsrtp requires ESP-IDF 5.4+." - - if: IDF_VERSION_MAJOR >= 6 - reason: "libsrtp 2.x mbedTLS adapters not yet ported to mbedTLS 4.x (TF-PSA-Crypto split)." components/libsrtp/host_test: enable: @@ -39,4 +33,4 @@ components/libsrtp/host_test: - if: IDF_VERSION_MAJOR <= 5 and IDF_VERSION_MINOR < 4 reason: "libsrtp requires ESP-IDF 5.4+." - if: IDF_VERSION_MAJOR >= 6 - reason: "libsrtp 2.x mbedTLS adapters not yet ported to mbedTLS 4.x (TF-PSA-Crypto split)." + reason: "IDF v6 linux target fails to link PSA apps: libtfpsacrypto.a needs mbedtls_ms_time/esp_mbedtls_mem_* from archives earlier on the link line (IDF-side ordering issue, not libsrtp)." diff --git a/components/libsrtp/.cz.yaml b/components/libsrtp/.cz.yaml index 91d52c7153..7b831bdbe8 100644 --- a/components/libsrtp/.cz.yaml +++ b/components/libsrtp/.cz.yaml @@ -3,6 +3,6 @@ commitizen: bump_message: 'bump(libsrtp): $current_version -> $new_version' pre_bump_hooks: python ../../ci/changelog.py libsrtp tag_format: libsrtp-v$version - version: 2.8.0 + version: 2.8.0~1 version_files: - idf_component.yml diff --git a/components/libsrtp/idf_component.yml b/components/libsrtp/idf_component.yml index c7645143eb..d687263f07 100644 --- a/components/libsrtp/idf_component.yml +++ b/components/libsrtp/idf_component.yml @@ -1,4 +1,4 @@ -version: "2.8.0" +version: "2.8.0~1" description: "libsrtp (Cisco) wrapper for ESP-IDF — mbedTLS crypto backend with AES-GCM + AES-CM + HMAC-SHA1. SRTP/SRTCP packet protection for WebRTC and other RTP-based protocols." url: https://github.com/espressif/esp-protocols/tree/master/components/libsrtp issues: https://github.com/espressif/esp-protocols/issues @@ -11,12 +11,11 @@ tags: - webrtc - mbedtls dependencies: - # Upper bound is intentional. libsrtp v2.x's mbedTLS adapters use the - # legacy / headers; ESP-IDF v6 ships - # mbedTLS 4 which reorganised those into the TF-PSA-Crypto split. - # Bump the bound once the component tracks a libsrtp release that - # speaks mbedTLS 4 (see cisco/libsrtp#812 for context). - idf: ">=5.4,<6" + # The submodule pin (2_x_dev, post-v2.8.0) carries mbedTLS 4 / PSA + # Crypto support (cisco/libsrtp#813), so ESP-IDF v6 (mbedTLS 4) is + # supported alongside v5.x (mbedTLS 3) — the adapters self-select on + # MBEDTLS_VERSION_MAJOR. + idf: ">=5.4" # SBOM manifest for the wrapped upstream — see sbom_libsrtp.yml. sbom: diff --git a/components/libsrtp/libsrtp b/components/libsrtp/libsrtp index 24b3bf8f19..d33b8ffb14 160000 --- a/components/libsrtp/libsrtp +++ b/components/libsrtp/libsrtp @@ -1 +1 @@ -Subproject commit 24b3bf8f19b6f5ab4cd2bcceb4f4064efca86fd5 +Subproject commit d33b8ffb1491a0b4b58a206889f09800cf7310ab diff --git a/components/libsrtp/sbom_libsrtp.yml b/components/libsrtp/sbom_libsrtp.yml index b9c9ddf27a..01c0bce44b 100644 --- a/components/libsrtp/sbom_libsrtp.yml +++ b/components/libsrtp/sbom_libsrtp.yml @@ -2,9 +2,9 @@ name: libsrtp version: 2.8.0 cpe: cpe:2.3:a:cisco:libsrtp:{}:*:*:*:*:*:*:* supplier: 'Organization: Cisco Systems, Inc. ' -description: Library for the Secure Real-time Transport Protocol (SRTP, RFC 3711) and Secure RTCP (SRTCP). Submodule pinned at upstream release tag v2.8.0 (commit 24b3bf8). One small ESP-IDF specific delta lives in port/crypto_kernel.c — it opts out of the AES-ICM-192 cipher registration when GCM is enabled (saves binary size; AES-CM-128 and AES-GCM cover all WebRTC SRTP suites). +description: Library for the Secure Real-time Transport Protocol (SRTP, RFC 3711) and Secure RTCP (SRTCP). Submodule pinned at upstream 2_x_dev commit d33b8ff (post-v2.8.0; adds mbedTLS 4 / PSA Crypto support, cisco/libsrtp#813). One small ESP-IDF specific delta lives in port/crypto_kernel.c — it opts out of the AES-ICM-192 cipher registration when GCM is enabled (saves binary size; AES-CM-128 and AES-GCM cover all WebRTC SRTP suites). url: https://github.com/cisco/libsrtp -hash: 24b3bf8f19b6f5ab4cd2bcceb4f4064efca86fd5 +hash: d33b8ffb1491a0b4b58a206889f09800cf7310ab cve-exclude-list: - cve: CVE-2023-31222 reason: Resolved in 2.6.0; current pin (v2.8.0) is well past.