Skip to content

feat(libsrtp): bump submodule for mbedTLS 4 support; allow IDF v6.0 #1114

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
david-cermak merged 2 commits into from
Aug 18, 2026
Merged

feat(libsrtp): bump submodule for mbedTLS 4 support; allow IDF v6.0 #1114

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5bab29c
feat(libsrtp): bump submodule for mbedTLS 4 support; allow IDF v6.0
vikramdattu Aug 18, 2026
bf40da3
bump(libsrtp): 2.8.0 -> 2.8.0~1
vikramdattu Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/libsrtp__build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
strategy:
fail-fast: false
matrix:
idf_ver: ["release-v5.4", "release-v5.5"]
idf_ver: ["release-v5.4", "release-v5.5", "release-v6.0"]
app:
- { name: "get_started", path: "components/libsrtp/examples/get_started" }
- { name: "test_apps", path: "components/libsrtp/test_apps" }
Expand Down
14 changes: 4 additions & 10 deletions components/libsrtp/.build-test-rules.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,9 @@
# disable rules below skip the build on older IDF releases so the repo-wide
# CI matrix (v5.1 / v5.2 / v5.3 / v5.4 / v5.5 / latest) doesn't try them.
#
# IDF v6+ is also disabled for now: libsrtp 2.x's mbedTLS adapters
# (aes_gcm_mbedtls.c, aes_icm_mbedtls.c, hmac_mbedtls.c) include the
# classic <mbedtls/aes.h> / <mbedtls/gcm.h> headers which moved under the
# TF-PSA-Crypto split in mbedTLS 4.x (shipped by IDF v6+). Re-enable once
# libsrtp adapts or we ship a port-side compatibility shim.
# IDF v6+ (mbedTLS 4.x) is supported: the submodule pin (2_x_dev,
# post-v2.8.0) carries mbedTLS 4 / PSA Crypto adapters (cisco/libsrtp#813)
# which self-select on MBEDTLS_VERSION_MAJOR.

components/libsrtp/examples/get_started:
enable:
Expand All @@ -18,8 +16,6 @@ components/libsrtp/examples/get_started:
disable:
- if: IDF_VERSION_MAJOR <= 5 and IDF_VERSION_MINOR < 4
reason: "libsrtp requires ESP-IDF 5.4+."
- if: IDF_VERSION_MAJOR >= 6
reason: "libsrtp 2.x mbedTLS adapters not yet ported to mbedTLS 4.x (TF-PSA-Crypto split)."

components/libsrtp/test_apps:
enable:
Expand All @@ -28,8 +24,6 @@ components/libsrtp/test_apps:
disable:
- if: IDF_VERSION_MAJOR <= 5 and IDF_VERSION_MINOR < 4
reason: "libsrtp requires ESP-IDF 5.4+."
- if: IDF_VERSION_MAJOR >= 6
reason: "libsrtp 2.x mbedTLS adapters not yet ported to mbedTLS 4.x (TF-PSA-Crypto split)."

components/libsrtp/host_test:
enable:
Expand All @@ -39,4 +33,4 @@ components/libsrtp/host_test:
- if: IDF_VERSION_MAJOR <= 5 and IDF_VERSION_MINOR < 4
reason: "libsrtp requires ESP-IDF 5.4+."
- if: IDF_VERSION_MAJOR >= 6
reason: "libsrtp 2.x mbedTLS adapters not yet ported to mbedTLS 4.x (TF-PSA-Crypto split)."
reason: "IDF v6 linux target fails to link PSA apps: libtfpsacrypto.a needs mbedtls_ms_time/esp_mbedtls_mem_* from archives earlier on the link line (IDF-side ordering issue, not libsrtp)."
2 changes: 1 addition & 1 deletion components/libsrtp/.cz.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,6 @@ commitizen:
bump_message: 'bump(libsrtp): $current_version -> $new_version'
pre_bump_hooks: python ../../ci/changelog.py libsrtp
tag_format: libsrtp-v$version
version: 2.8.0
version: 2.8.0~1
version_files:
- idf_component.yml
6 changes: 6 additions & 0 deletions components/libsrtp/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,11 @@
# Changelog

## [2.8.0~1](https://github.com/espressif/esp-protocols/commits/libsrtp-v2.8.0_1)

### Features

- bump submodule for mbedTLS 4 support; allow IDF v6.0 ([0174d34a](https://github.com/espressif/esp-protocols/commit/0174d34a))

## [2.8.0](https://github.com/espressif/esp-protocols/commits/libsrtp-v2.8.0)

### Features
Expand Down
13 changes: 6 additions & 7 deletions components/libsrtp/idf_component.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
version: "2.8.0"
version: "2.8.0~1"
description: "libsrtp (Cisco) wrapper for ESP-IDF — mbedTLS crypto backend with AES-GCM + AES-CM + HMAC-SHA1. SRTP/SRTCP packet protection for WebRTC and other RTP-based protocols."
url: https://github.com/espressif/esp-protocols/tree/master/components/libsrtp
issues: https://github.com/espressif/esp-protocols/issues
Expand All @@ -11,12 +11,11 @@ tags:
- webrtc
- mbedtls
dependencies:
# Upper bound is intentional. libsrtp v2.x's mbedTLS adapters use the
# legacy <mbedtls/aes.h> / <mbedtls/gcm.h> headers; ESP-IDF v6 ships
# mbedTLS 4 which reorganised those into the TF-PSA-Crypto split.
# Bump the bound once the component tracks a libsrtp release that
# speaks mbedTLS 4 (see cisco/libsrtp#812 for context).
idf: ">=5.4,<6"
# The submodule pin (2_x_dev, post-v2.8.0) carries mbedTLS 4 / PSA
# Crypto support (cisco/libsrtp#813), so ESP-IDF v6 (mbedTLS 4) is
# supported alongside v5.x (mbedTLS 3) — the adapters self-select on
# MBEDTLS_VERSION_MAJOR.
idf: ">=5.4"

@cursor cursor Bot Aug 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Submodule pin missing from commit

High Severity

This commit drops the IDF &lt;6 cap, records SBOM hash d33b8ff, and re-enables IDF v6 builds, but the components/libsrtp/libsrtp gitlink is not updated in the same commit. Checkouts still resolve the old v2.8.0 tree without mbedTLS 4 adapters, so IDF v6 consumers fail to build while metadata claims support.

Additional Locations (2)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit bf40da3. Configure here.

@vikramdattu vikramdattu Aug 18, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

False alarm. The main commit which relaxes the IDF version check also contains the sha update and the tests are extended to IDF 6.0 as well in the same commit


# SBOM manifest for the wrapped upstream — see sbom_libsrtp.yml.
sbom:
Expand Down
2 changes: 1 addition & 1 deletion components/libsrtp/libsrtp
Open in desktop
Submodule libsrtp updated 14 files
+40 −1 .github/workflows/cmake.yml
+36 −1 .github/workflows/meson.yml
+6 −0 README.md
+10 −1 cmake/FindMbedTLS.cmake
+320 −28 crypto/cipher/aes_gcm_mbedtls.c
+169 −7 crypto/cipher/aes_icm_mbedtls.c
+163 −7 crypto/hash/hmac_mbedtls.c
+33 −0 crypto/include/aes_gcm.h
+30 −0 crypto/include/aes_icm_ext.h
+20 −1 include/srtp.h
+1 −0 include/srtp_priv.h
+8 −0 meson.build
+54 −3 srtp/srtp.c
+97 −0 test/srtp_driver.c
4 changes: 2 additions & 2 deletions components/libsrtp/sbom_libsrtp.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@ name: libsrtp
version: 2.8.0
cpe: cpe:2.3:a:cisco:libsrtp:{}:*:*:*:*:*:*:*
supplier: 'Organization: Cisco Systems, Inc. <https://github.com/cisco/libsrtp>'
description: Library for the Secure Real-time Transport Protocol (SRTP, RFC 3711) and Secure RTCP (SRTCP). Submodule pinned at upstream release tag v2.8.0 (commit 24b3bf8). One small ESP-IDF specific delta lives in port/crypto_kernel.c — it opts out of the AES-ICM-192 cipher registration when GCM is enabled (saves binary size; AES-CM-128 and AES-GCM cover all WebRTC SRTP suites).
description: Library for the Secure Real-time Transport Protocol (SRTP, RFC 3711) and Secure RTCP (SRTCP). Submodule pinned at upstream 2_x_dev commit d33b8ff (post-v2.8.0; adds mbedTLS 4 / PSA Crypto support, cisco/libsrtp#813). One small ESP-IDF specific delta lives in port/crypto_kernel.c — it opts out of the AES-ICM-192 cipher registration when GCM is enabled (saves binary size; AES-CM-128 and AES-GCM cover all WebRTC SRTP suites).
url: https://github.com/cisco/libsrtp
hash: 24b3bf8f19b6f5ab4cd2bcceb4f4064efca86fd5
hash: d33b8ffb1491a0b4b58a206889f09800cf7310ab
cve-exclude-list:
- cve: CVE-2023-31222
reason: Resolved in 2.6.0; current pin (v2.8.0) is well past.
Loading