Workaround that resolved the crash for me
Overriding wireguard_random_bytes() to bypass mbedTLS entirely and use the
ESP32 hardware RNG directly via esp_fill_random():
#include "esp_random.h"
extern "C" void __wrap_wireguard_random_bytes(void *bytes, size_t size)
{
esp_fill_random(bytes, size);
}build_flags =
-Wl,--wrap=wireguard_random_bytes
(Note: this worked adding -Wl,--wrap=wireguard_random_bytes
to build_flags )
After this change, the tunnel has survived more than 2 hours without any
watchdog crash, across multiple rekey cycles.
Suggested fix
Consider either:
- Using
esp_fill_random() directly instead of the mbedTLS CTR-DRBG stack for
ESP32 targets, since it doesn't require the entropy accumulator setup and
bounds the retry loop implicitly, or
- Adding a bound / timeout / logging to the collision-retry loop in
wireguard_generate_unique_index() so a degraded entropy source fails loudly
instead of hanging the tcpip thread indefinitely.
Happy to provide additional logs or test further changes if useful.
Workaround that resolved the crash for me
Overriding
wireguard_random_bytes()to bypass mbedTLS entirely and use theESP32 hardware RNG directly via
esp_fill_random():build_flags =
-Wl,--wrap=wireguard_random_bytes
(Note: this worked adding
-Wl,--wrap=wireguard_random_bytesto build_flags )
After this change, the tunnel has survived more than 2 hours without any
watchdog crash, across multiple rekey cycles.
Suggested fix
Consider either:
esp_fill_random()directly instead of the mbedTLS CTR-DRBG stack forESP32 targets, since it doesn't require the entropy accumulator setup and
bounds the retry loop implicitly, or
wireguard_generate_unique_index()so a degraded entropy source fails loudlyinstead of hanging the tcpip thread indefinitely.
Happy to provide additional logs or test further changes if useful.