From 61ac515dcf377a6d9a0099da0c1ddd925c8fd2c0 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Fri, 28 Aug 2026 22:46:39 -0500 Subject: [PATCH] Treat a disabled TLS sub-option in sdkconfig_options as no request --- esphome/components/esp32/__init__.py | 11 ++++++++--- .../esp32/config/tls_sdkconfig_peer_cert_n.yaml | 9 +++++++++ .../esp32/config/tls_sdkconfig_tls_disabled_n.yaml | 9 +++++++++ tests/component_tests/esp32/test_esp32.py | 10 +++++++++- 4 files changed, 35 insertions(+), 4 deletions(-) create mode 100644 tests/component_tests/esp32/config/tls_sdkconfig_peer_cert_n.yaml create mode 100644 tests/component_tests/esp32/config/tls_sdkconfig_tls_disabled_n.yaml diff --git a/esphome/components/esp32/__init__.py b/esphome/components/esp32/__init__.py index 69efca27ce..39c36f5a7f 100644 --- a/esphome/components/esp32/__init__.py +++ b/esphome/components/esp32/__init__.py @@ -1857,12 +1857,15 @@ def require_mbedtls_ecp() -> None: def require_mbedtls_peer_cert() -> None: - """Keep the peer certificate after the TLS handshake (CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE).""" + """Keep the peer certificate after the TLS handshake (CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE). + + A user sdkconfig_options value takes precedence. + """ _mbedtls_sdkconfig().peer_cert_required = True def require_mbedtls_pkcs7() -> None: - """Keep mbedTLS PKCS#7 support (CONFIG_MBEDTLS_PKCS7_C).""" + """Keep mbedTLS PKCS#7 support (CONFIG_MBEDTLS_PKCS7_C). A user sdkconfig_options value takes precedence.""" _mbedtls_sdkconfig().pkcs7_required = True @@ -2345,9 +2348,11 @@ _TLS_OPTION_PREFIXES = ("CONFIG_ESP_TLS_", "CONFIG_MBEDTLS_SSL_", "CONFIG_ESP_HT def _user_sdkconfig_wants_tls(options: dict[str, Any]) -> bool: + """True when sdkconfig_options turn TLS on or tune something under it; an `n` is never a request.""" return any( (name in _MBEDTLS_TLS_ON_OPTIONS and value == "y") - or name.startswith(_TLS_OPTION_PREFIXES) + or (name == "CONFIG_MBEDTLS_TLS_DISABLED" and value == "n") + or (name.startswith(_TLS_OPTION_PREFIXES) and value != "n") for name, value in options.items() ) diff --git a/tests/component_tests/esp32/config/tls_sdkconfig_peer_cert_n.yaml b/tests/component_tests/esp32/config/tls_sdkconfig_peer_cert_n.yaml new file mode 100644 index 0000000000..6986968a5f --- /dev/null +++ b/tests/component_tests/esp32/config/tls_sdkconfig_peer_cert_n.yaml @@ -0,0 +1,9 @@ +esphome: + name: test + +esp32: + board: esp32dev + framework: + type: esp-idf + sdkconfig_options: + CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE: n diff --git a/tests/component_tests/esp32/config/tls_sdkconfig_tls_disabled_n.yaml b/tests/component_tests/esp32/config/tls_sdkconfig_tls_disabled_n.yaml new file mode 100644 index 0000000000..54f495ce0a --- /dev/null +++ b/tests/component_tests/esp32/config/tls_sdkconfig_tls_disabled_n.yaml @@ -0,0 +1,9 @@ +esphome: + name: test + +esp32: + board: esp32dev + framework: + type: esp-idf + sdkconfig_options: + CONFIG_MBEDTLS_TLS_DISABLED: n diff --git a/tests/component_tests/esp32/test_esp32.py b/tests/component_tests/esp32/test_esp32.py index ae87e8c3e4..f0f8020288 100644 --- a/tests/component_tests/esp32/test_esp32.py +++ b/tests/component_tests/esp32/test_esp32.py @@ -596,6 +596,14 @@ def test_reconcile_mbedtls_sdkconfig( pytest.param( "tls_sdkconfig_tls_enabled_n.yaml", True, True, id="raw_tls_enabled_n" ), + # Disabling a TLS sub-option is not a request either. + pytest.param( + "tls_sdkconfig_peer_cert_n.yaml", True, True, id="raw_peer_cert_n" + ), + # CONFIG_MBEDTLS_TLS_DISABLED=n is the IDF 5 way to keep TLS. + pytest.param( + "tls_sdkconfig_tls_disabled_n.yaml", False, False, id="raw_tls_disabled_n" + ), # SECURE_SIGNED_APPS selects ECP back on in Kconfig; ESPHome still writes the default. pytest.param("signed_ota_ecdsa256_c6.yaml", True, True, id="signed_ota_ecdsa"), ], @@ -610,7 +618,7 @@ def test_tls_disabled_sdkconfig( """TLS is compiled out unless a component or a raw sdkconfig option asks for it.""" generate_main(component_config_path(config_file)) sdkconfig = CORE.data[KEY_ESP32][KEY_SDKCONFIG_OPTIONS] - assert ("CONFIG_MBEDTLS_TLS_DISABLED" in sdkconfig) is tls_off + assert (sdkconfig.get("CONFIG_MBEDTLS_TLS_DISABLED") is True) is tls_off assert ("CONFIG_MBEDTLS_ECP_C" in sdkconfig) is ecp_off assert ("esp-tls" in CORE.data[KEY_ESP32][KEY_EXCLUDE_COMPONENTS]) is tls_off