feat(libsrtp2): add component (libsrtp 2.8.0 + ESP-IDF mbedTLS port) (IEC-542)

[vikramdattu]

Summary

Adds libsrtp2 — an ESP-IDF wrapper around upstream cisco/libsrtp (the libsrtp 2.x line). Pinned at commit 9fd71ba (post-v2.6, picks up the srtp_remove_stream signature fix). Crypto routes through ESP-IDF's mbedTLS, which means AES protect/unprotect goes through the chip's AES peripheral when CONFIG_MBEDTLS_HARDWARE_AES=y (default on esp32/s2/s3/c3/c5/c6/p4) — no special wrapper-side code needed for HW acceleration.

This is the open-source / source-built libSRTP for ESP-IDF. (Distinct from espressif/esp_libsrtp — that one is a pre-built closed-source binary from esp-adf-libs.)

Why a new component

We've been carrying this as a downstream component (esp_srtp2) on the AWS KVS WebRTC SDK port for ESP32, in production on ESP32-P4 for the camera/WebRTC workstream. Several consumers (KVS, custom WebRTC stacks) want a registry-resolvable libSRTP that isn't tied to the ADF binary distribution. This PR brings that into idf-extra-components so any IDF project can add-dependency espressif/libsrtp2.

Naming

Follows the idf-extra-components convention for upstream-library wrappers — bare upstream project name (like libpng, libsodium, zlib, freetype). The 2 suffix tracks libsrtp's 2.x major version, parallel to catch2.

A handful of search-friendly synonyms (srtp, srtp2, srtcp, esp_srtp, esp_srtp2, esp_libsrtp, esp_libsrtp2, libsrtp, webrtc, rtp, mbedtls, etc.) are in idf_component.yml tags: so the component surfaces under any reasonable registry search.

Commits

1. feat(libsrtp2): add component (libsrtp 2.6 + ESP-IDF mbedTLS port) — wrapper sources, libsrtp/ as a submodule gitlink at 9fd71ba, root .gitmodules entry, single build-time patch (patches/0001-Disable-AES-ICM-192-cipher-when-GCM-is-enabled.patch to save binary size when GCM is enabled).
2. ci: register libsrtp2 in CI manifests — .idf_build_apps.toml, .github/workflows/upload_component.yml directories list, .github/ISSUE_TEMPLATE/bug-report.yml dropdown. Alphabetically inserted. Passes .github/consistency_check.py locally.

Layout

libsrtp2/
├── CMakeLists.txt        # ESP-IDF component registration
├── Kconfig               # crypto-backend + log-level toggles
├── idf_component.yml     # registry manifest (tags, examples, sbom)
├── sbom_libsrtp.yml      # SBOM for the wrapped upstream
├── port/config.h         # libsrtp build-time config tailored for IDF
├── patches/
│   ├── 0001-Disable-AES-ICM-192-cipher-when-GCM-is-enabled.patch
│   └── README.md         # patch ledger
├── examples/get_started/
├── test_apps/            # Unity smoke (esp32 + esp32c3)
├── host_test/            # IDF Linux-target AES-GCM-128 roundtrip
└── libsrtp/              # cisco/libsrtp submodule @ 9fd71ba

Build / test verification (local)

• test_apps/ on esp32: ✅ builds clean
• test_apps/ on esp32c3: ✅ builds clean
• host_test/ on IDF Linux target: ✅ builds clean + binary runs, prints libsrtp2 host_test: PASS, library reports libsrtp2 2.4.2
• examples/get_started/ builds clean
• .github/consistency_check.py passes locally

CI will exercise the same matrix.

Crypto / supported profiles

• AEAD: AEAD_AES_128_GCM, AEAD_AES_256_GCM
• SRTP: AES_CM_128_HMAC_SHA1_80, AES_CM_128_HMAC_SHA1_32
• Backend: mbedTLS (MBEDTLS_HARDWARE_AES-routed where the chip has the peripheral)

Patch ledger

A single ESP-IDF specific patch (patches/0001-Disable-AES-ICM-192-cipher-when-GCM-is-enabled.patch) opts out of the AES-ICM-192 cipher registration. This is the only divergence from upstream and is purely a binary-size optimisation — AES-CM-128 and AES-GCM cover all WebRTC SRTP suites in use today. See patches/README.md for the ledger.

License

Apache-2.0 AND BSD-3-Clause — the ESP-IDF port glue is Apache-2.0; the bundled libsrtp/ submodule remains under upstream's BSD-3-Clause.

What's next

A sibling PR for usrsctp (the userspace SCTP stack, used together with libsrtp2 for WebRTC data channels) is coming next, also following the bare-upstream-name convention. That one has more nuance (we have an upstream PR in flight at sctplab/usrsctp#743 for lwIP support) so I'm landing libsrtp2 first as the simpler, cleaner introduction.

Open to any review feedback on naming, layout, the patch, or anything else.

[vikramdattu]

@euripedesrocha PTAL

[suda-morris]

Can we still name the component "libsrtp," the same as the one used by the upstream?

[suda-morris]

WRT the version, I would prefer to follow the version used by the upstream, so maybe we can use v2.8.0?

[igrr]

Btw, PR description mentions libsrtp 2.6, but the most recent release is 2.8: https://github.com/cisco/libsrtp/releases/tag/v2.8.0

[vikramdattu]

@igrr I will update to v2.8.0
My commit got pinned from aws project and didn't update

[vikramdattu]

@suda-morris though the repo is named srtp all along, the library is actually srtp2
For srtp3, there already is a version espressif/esp_srtp which is actually libsrtp3.
The API is different. Need both separate. Since, that library already uses esp_libsrtp name and not libsrtp3/, I have added the same in the README description. Also esp_srtp/ does mention in their readme that it is version3.

[vikramdattu]

v2.8.0 + the 2.6-in-description nit are addressed in 964fa68. On the naming itself — per discussion with @euripedesrocha we're moving the component to esp-protocols, where it'll be libsrtp tracking cisco's release line. Separate PR coming; I'll cross-link here when it's up.

[igrr]

And I don't think it's necessary to limit this component to 2.x releases of libsrtp. When 3.0 comes out, we can support it as well.

[vikramdattu]

Same argument as here.

The 3.x release version is not out yet, but that is a different lib, API is different and does not fully route via mbedtls.

Kind of mbedtls3 vs 4. So, this should keep 2.x only IMO, while the other lib esp_srtp/ can maintain v3

[vikramdattu]

Same direction — single libsrtp component on esp-protocols tracking cisco's official release line (v2.8.0 today, bumps to 3.0 when cisco tags it).

[vikramdattu]

Sibling PR for the SCTP transport (paired use case for WebRTC data channels): #754 — currently in draft until libsrtp2 here lands.

[Copilot]

Pull request overview

Adds a new libsrtp2 ESP-IDF component wrapping upstream Cisco libsrtp 2.x with an mbedTLS crypto backend, plus registry metadata, examples, CI/build registration, embedded smoke tests, and a Linux-host SRTP roundtrip test.

Changes:

• Introduces the libsrtp2 component build glue, config headers, namespace shim, metadata, license/SBOM files, and upstream submodule registration.
• Adds example, embedded Unity smoke test, and Linux host roundtrip test applications.
• Registers the component in repository-wide build/upload/issue-template configuration.

Reviewed changes

Copilot reviewed 37 out of 37 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
.github/ISSUE_TEMPLATE/bug-report.yml	Adds libsrtp2 to issue component choices.
.github/workflows/upload_component.yml	Adds libsrtp2 to upload list.
.gitmodules	Registers the libsrtp upstream submodule.
.idf_build_apps.toml	Registers libsrtp2 build-test manifest.
libsrtp2/.build-test-rules.yml	Defines CI build matrix and IDF version gates.
libsrtp2/.github/workflows/build.yml	Adds nested build workflow.
libsrtp2/.github/workflows/publish.yml	Adds nested publish workflow.
libsrtp2/CHANGELOG.md	Documents initial component release.
libsrtp2/CMakeLists.txt	Defines ESP-IDF component sources/includes/compile flags.
libsrtp2/Kconfig	Adds libsrtp2 configuration options.
libsrtp2/LICENSE	Adds Apache-2.0 license text for wrapper code.
libsrtp2/NOTICE	Adds third-party attribution metadata.
libsrtp2/README.md	Documents usage, features, tests, source, and license.
libsrtp2/examples/get_started/CMakeLists.txt	Adds example project definition.
libsrtp2/examples/get_started/README.md	Documents example usage.
libsrtp2/examples/get_started/main/CMakeLists.txt	Defines example main component.
libsrtp2/examples/get_started/main/idf_component.yml	Adds example dependency override.
libsrtp2/examples/get_started/main/main.c	Adds minimal init/shutdown example.
libsrtp2/host_test/CMakeLists.txt	Adds Linux host-test project definition.
libsrtp2/host_test/main/CMakeLists.txt	Defines host-test main component.
libsrtp2/host_test/main/host_test_main.c	Adds AES-GCM protect/unprotect smoke test.
libsrtp2/host_test/main/idf_component.yml	Adds host-test dependency override.
libsrtp2/host_test/pytest_libsrtp2_linux.py	Adds pytest runner for Linux host test.
libsrtp2/host_test/sdkconfig.defaults	Configures Linux host target defaults.
libsrtp2/idf_component.yml	Adds component registry manifest and SBOM references.
libsrtp2/include/srtp2/srtp.h	Adds public namespace shim header.
libsrtp2/port/config.h	Adds ESP-IDF libsrtp config header.
libsrtp2/port/crypto_kernel.c	Adds port-side crypto kernel replacement.
libsrtp2/sbom.yml	Adds wrapper SBOM metadata.
libsrtp2/sbom_libsrtp.yml	Adds upstream libsrtp SBOM metadata.
libsrtp2/test_apps/CMakeLists.txt	Adds embedded test project definition.
libsrtp2/test_apps/main/CMakeLists.txt	Defines embedded test main component.
libsrtp2/test_apps/main/idf_component.yml	Adds embedded test dependency override.
libsrtp2/test_apps/main/test_libsrtp2_main.c	Adds Unity smoke tests.
libsrtp2/test_apps/pytest_libsrtp2.py	Adds pytest runner for embedded smoke test.
libsrtp2/test_apps/sdkconfig.defaults	Adds embedded test sdkconfig defaults.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[vikramdattu]

Heads-up — moving this component to espressif/esp-protocols instead of idf-extra-components, per discussion with @euripedesrocha (it naturally sits there alongside libwebsockets and the rest of the WebRTC transport stack).

New PR: espressif/esp-protocols#1060

The new PR has all the feedback from this thread already incorporated:

• Renamed libsrtp2 → libsrtp (cc @suda-morris, @igrr — picks up your suggestion to match the upstream name and not lock to a major version).
• Removed component-local .github/workflows/, dropped patches/ (port/crypto_kernel.c vendored), trimmed targets: list + tags, aligned SBOM/NOTICE/CHANGELOG/port-config to v2.8.0 + 24b3bf8, tightened IDF range to >=5.4,<6, replaced CPU_CISC with CPU_RISC for embedded targets, switched host_test to abort-on-failure, aligned pytest convention with the repo style, added .cz.yaml per esp-protocols CONTRIBUTING.md.

Marking this one as Draft so the discussion stays put but it's not in the active review queue. Will close it once the esp-protocols PR lands.

@igrr @suda-morris @euripedesrocha — please look at #1060 when convenient. The major comments from here are already addressed there, so the review should be light.