chore: import upstream snapshot with attribution

examples/protocols/https_x509_bundle/CMakeLists.txt

@@ -0,0 +1,9 @@
+# The following five lines of boilerplate have to be in your project's
+# CMakeLists in this exact order for cmake to work correctly
+cmake_minimum_required(VERSION 3.22)
+
+
+include($ENV{IDF_PATH}/tools/cmake/project.cmake)
+# "Trim" the build. Include the minimal set of components, main, and anything it depends on.
+idf_build_set_property(MINIMAL_BUILD ON)
+project(https_x509_bundle)

examples/protocols/https_x509_bundle/README.md

@@ -0,0 +1,49 @@
+| Supported Targets | ESP32 | ESP32-C2 | ESP32-C3 | ESP32-C5 | ESP32-C6 | ESP32-C61 | ESP32-H2 | ESP32-P4 | ESP32-S2 | ESP32-S3 |
+| ----------------- | ----- | -------- | -------- | -------- | -------- | --------- | -------- | -------- | -------- | -------- |
+
+# HTTPS x509 Bundle Example
+
+This example shows how to use the ESP certificate bundle utility to embed a bundle of x509 certificates and use them to
+establish a simple HTTPS connection over a secure connection. The path of the certificates are specified using menuconfig.
+
+See the README.md file in the upper level 'examples' directory for more information about examples.
+
+## Example workflow
+- ESP TLS is initialized with the certificate bundle option enabled.
+- The application loops through the given URLs, establishing a secure TLS connection to all of them, verifying the server certificate included.
+
+### Configure the project
+
+* Open the project configuration menu (`idf.py menuconfig`)
+* Configure Wi-Fi or Ethernet under "Example Connection Configuration" menu. See "Establishing Wi-Fi or Ethernet Connection" section in [examples/protocols/README.md](../README.md) for more details.
+* If using a different folder than `certs` for storing certificates then update `Custom Certificate Bundle Path` under `Component config` - `mbedTLS` - `Certificate Bundle`
+
+### Build and Flash
+
+Build the project and flash it to the board, then run monitor tool to view serial output:
+
+```
+idf.py -p PORT flash monitor
+```
+
+(To exit the serial monitor, type ``Ctrl-]``.)
+
+See the Getting Started Guide for full steps to configure and use ESP-IDF to build projects.
+
+## Example Output
+```
+I (0) cpu_start: Starting scheduler on APP CPU.
+I (491) system_api: Base MAC address is not set, read default base MAC address from BLK0 of EFUSE
+I (4051) example_connect: Ethernet Link Up
+I (5971) esp_netif_handlers: eth ip: 192.168.2.137, mask: 255.255.255.0, gw: 192.168.2.2
+I (5971) example_connect: Connected to Ethernet
+I (5971) example_connect: IPv4 address: 192.168.2.137
+I (5971) example_connect: IPv6 address: fe80:0000:0000:0000:bedd:c2ff:fed4:a92b
+I (5981) example: Connecting to 2 URLs
+I (7100) esp-x509-crt-bundle: Certificate validated
+I (8371) example: Connection established to https://www.howsmyssl.com/a/check
+I (11730) esp-x509-crt-bundle: Certificate validated
+I (11821) example: Connection established to https://espressif.com
+I (12821) example: Completed 2 connections
+I (12821) example: Starting over again...
+```

examples/protocols/https_x509_bundle/certs/Digicert_global_root.pem

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDjjCCAnagAwIBAgIQAzrx5qcRqaC7KGSxHQn65TANBgkqhkiG9w0BAQsFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH
+MjAeFw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAwMDBaMGExCzAJBgNVBAYTAlVT
+MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
+b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEcyMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuzfNNNx7a8myaJCtSnX/RrohCgiN9RlUyfuI
+2/Ou8jqJkTx65qsGGmvPrC3oXgkkRLpimn7Wo6h+4FR1IAWsULecYxpsMNzaHxmx
+1x7e/dfgy5SDN67sH0NO3Xss0r0upS/kqbitOtSZpLYl6ZtrAGCSYP9PIUkY92eQ
+q2EGnI/yuum06ZIya7XzV+hdG82MHauVBJVJ8zUtluNJbd134/tJS7SsVQepj5Wz
+tCO7TG1F8PapspUwtP1MVYwnSlcUfIKdzXOS0xZKBgyMUNGPHgm+F6HmIcr9g+UQ
+vIOlCsRnKPZzFBQ9RnbDhxSJITRNrw9FDKZJobq7nMWxM4MphQIDAQABo0IwQDAP
+BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUTiJUIBiV
+5uNu5g/6+rkS7QYXjzkwDQYJKoZIhvcNAQELBQADggEBAGBnKJRvDkhj6zHd6mcY
+1Yl9PMWLSn/pvtsrF9+wX3N3KjITOYFnQoQj8kVnNeyIv/iPsGEMNKSuIEyExtv4
+NeF22d+mQrvHRAiGfzZ0JFrabA0UWTW98kndth/Jsw1HKj2ZL7tcu7XUIOGZX1NG
+Fdtom/DzMNU+MeKNhJ7jitralj41E6Vf8PlwUHBHQRFXGU7Aj64GxJUTFy8bJZ91
+8rGOmaFvE7FBcf6IKshPECBV1/MUReXgRPTqh5Uykw7+U0b6LJ3/iyK5S9kJRaTe
+pLiaWN0bfVKfjllDiIGknibVb63dDcY3fe0Dkhvld1927jyNxF1WW6LZZm6zNTfl
+MrY=
+-----END CERTIFICATE-----

examples/protocols/https_x509_bundle/main/CMakeLists.txt

@@ -0,0 +1,3 @@
+idf_component_register(SRCS "https_x509_bundle_example_main.c"
+                    PRIV_REQUIRES esp-tls esp_wifi nvs_flash
+                    INCLUDE_DIRS ".")

examples/protocols/https_x509_bundle/main/https_x509_bundle_example_main.c

@@ -0,0 +1,114 @@
+/* HTTPS GET Example using plain mbedTLS sockets
+ *
+ * Connects to multiple HTTPS servers and validates their certificates
+ * using the certificate bundle.
+ *
+ * Adapted from the ssl_client1 example in mbedtls.
+ *
+ * Original Copyright (C) 2006-2016, ARM Limited, All Rights Reserved, Apache 2.0 License.
+ * Additions Copyright (C) Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD, Apache 2.0 License.
+ *
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <string.h>
+#include <stdlib.h>
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include "freertos/event_groups.h"
+#include "esp_wifi.h"
+#include "esp_event.h"
+#include "esp_log.h"
+#include "esp_system.h"
+#include "nvs_flash.h"
+#include "protocol_examples_common.h"
+#include "esp_netif.h"
+
+#include "lwip/err.h"
+#include "lwip/sockets.h"
+#include "lwip/sys.h"
+#include "lwip/netdb.h"
+#include "lwip/dns.h"
+
+#include "esp_tls.h"
+#include "esp_crt_bundle.h"
+
+#if CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_FULL
+#define MAX_URLS    8
+#else
+#define MAX_URLS    2
+#endif
+
+static const char *web_urls[MAX_URLS] = {
+    "https://letsencrypt.org",
+    "https://espressif.com",
+#if CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_FULL
+    "https://www.identrust.com",
+    "https://www.globalsign.com",
+    "https://www.sectigo.com",
+    "https://www.digicert.com",
+    "https://www.godaddy.com",
+    "https://rainmaker.espressif.com",  // Amazon
+#endif
+};
+
+static const char *TAG = "example";
+
+static void https_get_task(void *pvParameters)
+{
+    while (1) {
+        int conn_count = 0;
+        ESP_LOGI(TAG, "Connecting to %d URLs", MAX_URLS);
+
+        for (int i = 0; i < MAX_URLS; i++) {
+            esp_tls_cfg_t cfg = {
+                .crt_bundle_attach = esp_crt_bundle_attach,
+            };
+
+            esp_tls_t *tls = esp_tls_init();
+            if (!tls) {
+                ESP_LOGE(TAG, "Failed to allocate esp_tls handle!");
+                goto end;
+            }
+
+            if (esp_tls_conn_http_new_sync(web_urls[i], &cfg, tls) == 1) {
+                ESP_LOGI(TAG, "Connection established to %s", web_urls[i]);
+                conn_count++;
+            } else {
+                ESP_LOGE(TAG, "Could not connect to %s", web_urls[i]);
+            }
+
+            esp_tls_conn_destroy(tls);
+end:
+            vTaskDelay(1000 / portTICK_PERIOD_MS);
+        }
+
+        ESP_LOGI(TAG, "Completed %d connections", conn_count);
+        ESP_LOGI(TAG, "Starting over again...");
+    }
+}
+
+void app_main(void)
+{
+    ESP_ERROR_CHECK(nvs_flash_init());
+    ESP_ERROR_CHECK(esp_netif_init());
+    ESP_ERROR_CHECK(esp_event_loop_create_default());
+
+    /* This helper function configures Wi-Fi or Ethernet, as selected in menuconfig.
+     * Read "Establishing Wi-Fi or Ethernet Connection" section in
+     * examples/protocols/README.md for more information about this function.
+     */
+    ESP_ERROR_CHECK(example_connect());
+
+    xTaskCreate(&https_get_task, "https_get_task", 8192, NULL, 5, NULL);
+}

examples/protocols/https_x509_bundle/main/idf_component.yml

@@ -0,0 +1,3 @@
+dependencies:
+  protocol_examples_common:
+    path: ${IDF_PATH}/examples/common_components/protocol_examples_common

examples/protocols/https_x509_bundle/pytest_https_x509_bundle.py

@@ -0,0 +1,73 @@
+# SPDX-FileCopyrightText: 2022-2026 Espressif Systems (Shanghai) CO LTD
+# SPDX-License-Identifier: Unlicense OR CC0-1.0
+import logging
+import os
+
+import pytest
+from pytest_embedded import Dut
+from pytest_embedded_idf.utils import idf_parametrize
+
+
+@pytest.mark.ethernet
+@idf_parametrize('target', ['esp32'], indirect=['target'])
+def test_examples_protocol_https_x509_bundle(dut: Dut) -> None:
+    """
+    steps: |
+      1. join AP
+      2. connect to multiple URLs
+      3. send http request
+    """
+    # check and log bin size
+    binary_file = os.path.join(dut.app.binary_path, 'https_x509_bundle.bin')
+    bin_size = os.path.getsize(binary_file)
+    logging.info(f'https_x509_bundle_bin_size : {bin_size // 1024}KB')
+    dut.expect(r'IPv4 address: (\d+\.\d+\.\d+\.\d+)[^\d]', timeout=30)
+    # start test
+    num_URLS = int(dut.expect(r'Connecting to (\d+) URLs', timeout=30)[1].decode())
+    for _ in range(num_URLS):
+        dut.expect(r'Connection established to ([\s\S]*)', timeout=30)
+    dut.expect(f'Completed {num_URLS} connections', timeout=60)
+
+
+@pytest.mark.ethernet
+@pytest.mark.parametrize(
+    'config',
+    [
+        'ssldyn',
+    ],
+    indirect=True,
+)
+@idf_parametrize('target', ['esp32'], indirect=['target'])
+def test_examples_protocol_https_x509_bundle_dynamic_buffer(dut: Dut) -> None:
+    # test mbedtls dynamic resource
+    # check and log bin size
+    binary_file = os.path.join(dut.app.binary_path, 'https_x509_bundle.bin')
+    bin_size = os.path.getsize(binary_file)
+    logging.info(f'https_x509_bundle_bin_size : {bin_size // 1024}KB')
+    dut.expect(r'IPv4 address: (\d+\.\d+\.\d+\.\d+)[^\d]', timeout=30)
+    # start test
+    num_URLS = int(dut.expect(r'Connecting to (\d+) URLs', timeout=30)[1].decode())
+    dut.expect(r'Connection established to ([\s\S]*)', timeout=30)
+    dut.expect(f'Completed {num_URLS} connections', timeout=60)
+
+
+@pytest.mark.qemu
+@pytest.mark.parametrize(
+    'config',
+    [
+        'default_crt_bundle',
+    ],
+    indirect=True,
+)
+@idf_parametrize('target', ['esp32'], indirect=['target'])
+def test_examples_protocol_https_x509_bundle_default_crt_bundle_stress_test(dut: Dut) -> None:
+    # check and log bin size
+    binary_file = os.path.join(dut.app.binary_path, 'https_x509_bundle.bin')
+    bin_size = os.path.getsize(binary_file)
+    logging.info(f'https_x509_bundle_bin_size : {bin_size // 1024}KB')
+    dut.expect(r'IPv4 address: (\d+\.\d+\.\d+\.\d+)[^\d]', timeout=30)
+    # start test
+    num_URLS = int(dut.expect(r'Connecting to (\d+) URLs', timeout=30)[1].decode())
+    for _ in range(num_URLS):
+        dut.expect(r'Connection established to ([\s\S]*)', timeout=60)
+    dut.expect(f'Completed {num_URLS} connections', timeout=180)

examples/protocols/https_x509_bundle/sdkconfig.ci

@@ -0,0 +1,12 @@
+CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_NONE=y
+CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE=y
+CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE_PATH="certs"
+
+CONFIG_EXAMPLE_CONNECT_ETHERNET=y
+CONFIG_EXAMPLE_CONNECT_WIFI=n
+CONFIG_ETHERNET_INTERNAL_SUPPORT=y
+CONFIG_ETHERNET_PHY_GENERIC=y
+CONFIG_ETHERNET_MDC_GPIO=23
+CONFIG_ETHERNET_MDIO_GPIO=18
+CONFIG_ETHERNET_PHY_RST_GPIO=5
+CONFIG_ETHERNET_PHY_ADDR=1

examples/protocols/https_x509_bundle/sdkconfig.ci.default_crt_bundle

@@ -0,0 +1,10 @@
+CONFIG_IDF_TARGET="esp32"
+CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY=y
+CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_FULL=y
+
+# QEMU-Related configurations
+CONFIG_EXAMPLE_CONNECT_ETHERNET=y
+CONFIG_EXAMPLE_CONNECT_WIFI=n
+CONFIG_ETHERNET_OPENETH_SUPPORT=y
+CONFIG_ETHERNET_INTERNAL_SUPPORT=n
+CONFIG_ETHERNET_SPI_SUPPORT=n

examples/protocols/https_x509_bundle/sdkconfig.ci.ssldyn

@@ -0,0 +1,14 @@
+CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_NONE=y
+CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE=y
+CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE_PATH="certs"
+CONFIG_MBEDTLS_DYNAMIC_BUFFER=y
+CONFIG_MBEDTLS_DYNAMIC_FREE_CONFIG_DATA=y
+
+CONFIG_EXAMPLE_CONNECT_ETHERNET=y
+CONFIG_EXAMPLE_CONNECT_WIFI=n
+CONFIG_ETHERNET_INTERNAL_SUPPORT=y
+CONFIG_ETHERNET_PHY_GENERIC=y
+CONFIG_ETHERNET_MDC_GPIO=23
+CONFIG_ETHERNET_MDIO_GPIO=18
+CONFIG_ETHERNET_PHY_RST_GPIO=5
+CONFIG_ETHERNET_PHY_ADDR=1

examples/protocols/https_x509_bundle/sdkconfig.defaults

@@ -0,0 +1,5 @@
+# CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_FULL is not set
+# CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_CMN is not set
+CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_NONE=y
+CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE=y
+CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE_PATH="certs"