Fixes for STM32H5 demo. Fixes MQTT broker and improrves testing/docs. Expands CI test by dgarske · Pull Request #73 · wolfSSL/wolfip

dgarske · 2026-03-06T18:36:08Z

No description provided.

Copilot

Pull request overview

Updates the STM32H563 demo to better support the wolfMQTT broker on bare-metal (wolfIP TLS + UART logging), expands documentation for broker usage, and adds a fuller CI job that boots the firmware in m33mu and integration-tests multiple services.

Changes:

Configure wolfMQTT broker to use wolfIP-provided TLS context and route broker logs to UART via a custom PRINTF.
Add wolfmqtt_log() UART printf-style logger for WBLOG/broker logging.
Expand STM32H563 CI to build and integration-test echo/HTTPS/TLS-echo/MQTT/SSH in emulation.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
src/port/stm32h563/user_settings.h	Enables broker custom net/TLS integration and custom UART logging macros; raises broker log level.
src/port/stm32h563/main.c	Adds `wolfmqtt_log()` implementation using `vsnprintf` + UART output.
src/port/stm32h563/README.md	Updates build/flash instructions and adds detailed MQTT broker usage/testing docs.
.github/workflows/stm32h563-m33mu.yml	Adds a “full” CI job that emulates the firmware and performs network service checks incl. MQTT.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

src/port/stm32h563/main.c

src/port/stm32h563/user_settings.h

.github/workflows/stm32h563-m33mu.yml

src/port/stm32h563/README.md

Copilot

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 10 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

src/port/stm32h753/user_settings.h

.github/workflows/stm32h563-m33mu.yml

src/wolfip.c

src/port/stm32h753/mqtt_broker.c

src/port/stm32h563/mqtt_broker.c

src/port/stm32h563/tls_server.c

src/port/stm32h563/demo.sh

…ing reset.

dgarske · 2026-03-07T04:42:18Z

src/port/stm32h563/demo.sh

+# ---------------------------------------------------------------------------
+# 5) MQTT Broker
+# ---------------------------------------------------------------------------
+banner "5. MQTT Broker (Port 8883) - TLS 1.3"


This needs to use wolfMQTT

danielinux · 2026-03-07T07:02:40Z

.github/workflows/stm32h563-m33mu.yml

          }
          trap cleanup EXIT

+          sudo modprobe tun


this breaks the test

danielinux · 2026-03-07T07:03:19Z

.github/workflows/stm32h563-m33mu.yml

+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    container:
+      image: ghcr.io/danielinux/m33mu-ci:1.5


1.6 is the working version

danielinux · 2026-03-07T07:03:45Z

.github/workflows/stm32h563-m33mu.yml

+          }
+          trap cleanup EXIT
+
+          sudo modprobe tun


no moprobe in container: this will break the test

Copilot

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-08T00:51:12Z

.github/workflows/stm32h563-m33mu.yml

+      - name: Clone wolfSSL, wolfSSH, wolfMQTT (pinned to stable tags)
+        run: |
+          set -euo pipefail
+          cd ..
+          git clone --depth 1 https://github.com/wolfSSL/wolfssl.git
+          git clone --depth 1 https://github.com/wolfSSL/wolfssh.git
+          git clone --depth 1 https://github.com/wolfSSL/wolfmqtt.git
+


The step title says the wolfSSL/wolfSSH/wolfMQTT clones are “pinned to stable tags”, but the commands clone default branches without a tag/commit checkout. This makes CI non-reproducible and can introduce breakage from upstream changes; consider checking out explicit tags or specific commits (or updating the step description to match reality).

Copilot · 2026-03-08T00:51:13Z

.github/workflows/stm32h563-m33mu.yml

+          echo "=== Test 4: MQTT Broker ==="
+          sleep 5  # allow recovery from TLS echo session
+          # Extract cert from certs.h for mosquitto
+          sed -n '/server_cert_pem\[\]/,/^";$/p' src/port/certs.h \


The cert extraction pipeline likely captures more than just the certificate because certs.h does not contain a line matching ^";$/ (the closing line is of the form "-----END CERTIFICATE-----\\n";). As written, the range can run to EOF and include the embedded private key in /tmp/wolfip_cert.pem, which is both unnecessary and may break --cafile parsing. Consider tightening the extraction to stop at the end-certificate line (or using a more direct grep/sed that only emits the CERTIFICATE PEM block).

Suggested change

sed -n '/server_cert_pem\[\]/,/^";$/p' src/port/certs.h \

sed -n '/server_cert_pem\[\]/,/^"-----END CERTIFICATE-----\\\\n";$/p' src/port/certs.h \

Copilot · 2026-03-08T00:51:13Z

src/port/stm32h563/demo.sh

+BOARD_IP="${1:-192.168.12.11}"
+
+# Validate BOARD_IP to block shell metacharacter injection via eval
+if ! [[ "$BOARD_IP" =~ ^[A-Za-z0-9._-]+$ ]]; then


The BOARD_IP regex allows values starting with -, which can be interpreted as options by commands like ping, nc, and ssh (option injection). Consider rejecting a leading hyphen (e.g., [[ $BOARD_IP != -* ]]) and/or using -- before the host argument where supported.

Suggested change

if ! [[ "$BOARD_IP" =~ ^[A-Za-z0-9._-]+$ ]]; then

if [[ "$BOARD_IP" == -* ]] || ! [[ "$BOARD_IP" =~ ^[A-Za-z0-9._-]+$ ]]; then

Copilot · 2026-03-08T00:51:13Z

src/port/stm32h563/demo.sh

+run_cmd() {
+    cmd_show "$1"
+    echo ""
+    eval "$1" 2>&1 | sed 's/^/    /'


run_cmd executes its argument via eval, which is unnecessary for the fixed command patterns used in this script and expands the attack surface if validation ever regresses. Prefer executing commands directly (or using a bash array for argv) so ${BOARD_IP} stays a single, safely-quoted argument.

Suggested change

eval "$1" 2>&1 | sed 's/^/ /'

bash -c "$1" 2>&1 | sed 's/^/ /'

Copilot · 2026-03-08T00:51:13Z

src/port/stm32h563/main.c

+    va_start(ap, fmt);
+    n = vsnprintf(buf, sizeof(buf), fmt, ap);
+    va_end(ap);
+    uart_puts(buf);
+    if (n >= (int)sizeof(buf))
+        uart_puts("...[truncated]\n");
+}


vsnprintf can return a negative value on encoding error, in which case the contents of buf are unspecified. Consider handling n < 0 explicitly (e.g., emit a fallback message and return) before calling uart_puts(buf).

Copilot · 2026-03-08T00:51:13Z

src/port/va416xx/main.c

+ * wolfIP's internal DHCP state machine only retries for ~4 seconds
+ * (DHCP_DISCOVER_RETRIES=1 x 2s timeout).  After that it sets state to
 * DHCP_OFF and the UDP socket stops accepting unicast DHCP responses
 * (because DHCP_IS_RUNNING becomes false).  We re-init periodically to
 * keep trying, but must space re-inits apart to avoid socket churn
 * (close/reopen loses in-flight responses). */


In this port, the DHCP timing comments/values assume DHCP_DISCOVER_RETRIES=1, but src/port/va416xx/config.h does not override DHCP_DISCOVER_RETRIES/DHCP_REQUEST_RETRIES, so the wolfIP defaults (3) still apply. Either define these retry macros for VA416xx when DHCP is enabled, or update the timing comments/timeout constants to match the actual retry behavior.

Suggested change

* wolfIP's internal DHCP state machine only retries for ~4 seconds

* (DHCP_DISCOVER_RETRIES=1 x 2s timeout). After that it sets state to

* DHCP_OFF and the UDP socket stops accepting unicast DHCP responses

* (because DHCP_IS_RUNNING becomes false). We re-init periodically to

* keep trying, but must space re-inits apart to avoid socket churn

* (close/reopen loses in-flight responses). */

* wolfIP's internal DHCP state machine retries for a finite period based

* on DHCP_DISCOVER_RETRIES and DHCP_REQUEST_RETRIES (wolfIP defaults are 3).

* After the stack gives up it sets state to DHCP_OFF and the UDP socket

* stops accepting unicast DHCP responses (because DHCP_IS_RUNNING becomes

* false). We re-init periodically to keep trying, but must space re-inits

* far enough apart to avoid socket churn (close/reopen loses in-flight

* responses) and to ensure the previous DHCP attempt has fully timed out. */

Copilot · 2026-03-08T00:51:14Z

src/port/stm32h563/Makefile

-
 # Library paths - default to sibling directories (clone alongside pattern)
-WOLFSSL_ROOT ?= $(ROOT)/../wolfssl
+WOLFSSL_ROOT ?= $(ROOT)/../wolfssl-alt


WOLFSSL_ROOT now defaults to $(ROOT)/../wolfssl-alt, but the README/workflows (and the other STM32 port Makefiles) reference cloning wolfssl into ../wolfssl. Unless wolfssl-alt is guaranteed to exist for contributors, this default will break the common build path; consider reverting the default to ../wolfssl (and documenting any alternative fork via an opt-in override).

Suggested change

WOLFSSL_ROOT ?= $(ROOT)/../wolfssl-alt

WOLFSSL_ROOT ?= $(ROOT)/../wolfssl

dgarske self-assigned this Mar 6, 2026

Copilot AI review requested due to automatic review settings March 6, 2026 18:36

Copilot AI reviewed Mar 6, 2026

View reviewed changes

Copilot started reviewing on behalf of dgarske March 6, 2026 20:21 View session

dgarske force-pushed the stm32h5_demo2 branch from da47617 to 7dba257 Compare March 6, 2026 20:25

Copilot AI review requested due to automatic review settings March 6, 2026 23:33

dgarske force-pushed the stm32h5_demo2 branch from 7dba257 to eaec7bc Compare March 6, 2026 23:33

Copilot started reviewing on behalf of dgarske March 6, 2026 23:33 View session

Copilot AI reviewed Mar 6, 2026

View reviewed changes

dgarske added 3 commits March 6, 2026 16:40

Fixes for STM32H5 demo. Fixes MQTT broker and improrves testing/docs.

c8de61c

Fix DHCP timeout fallback to static IP

a484a1c

Peer review and demo fixes. Fix for tcp_ack() issue and t->S not gett…

46bceb3

…ing reset.

dgarske force-pushed the stm32h5_demo2 branch from eaec7bc to 46bceb3 Compare March 7, 2026 00:40

dgarske assigned danielinux and unassigned dgarske Mar 7, 2026

dgarske requested a review from danielinux March 7, 2026 00:59

dgarske assigned dgarske and unassigned danielinux Mar 7, 2026

dgarske commented Mar 7, 2026

View reviewed changes

danielinux approved these changes Mar 7, 2026

View reviewed changes

danielinux requested changes Mar 7, 2026

View reviewed changes

Peer review fixes

2eb80bd

Copilot AI review requested due to automatic review settings March 8, 2026 00:43

Copilot started reviewing on behalf of dgarske March 8, 2026 00:44 View session

Copilot AI reviewed Mar 8, 2026

View reviewed changes

	sed -n '/server_cert_pem\[\]/,/^";$/p' src/port/certs.h \
	sed -n '/server_cert_pem\[\]/,/^"-----END CERTIFICATE-----\\\\n";$/p' src/port/certs.h \

	if ! [[ "$BOARD_IP" =~ ^[A-Za-z0-9._-]+$ ]]; then
	if [[ "$BOARD_IP" == -* ]] \|\| ! [[ "$BOARD_IP" =~ ^[A-Za-z0-9._-]+$ ]]; then

	eval "$1" 2>&1 \| sed 's/^/ /'
	bash -c "$1" 2>&1 \| sed 's/^/ /'

- * wolfIP's internal DHCP state machine only retries for ~4 seconds
- * (DHCP_DISCOVER_RETRIES=1 x 2s timeout).  After that it sets state to
- * DHCP_OFF and the UDP socket stops accepting unicast DHCP responses
- * (because DHCP_IS_RUNNING becomes false).  We re-init periodically to
- * keep trying, but must space re-inits apart to avoid socket churn
- * (close/reopen loses in-flight responses). */
+ * wolfIP's internal DHCP state machine retries for a finite period based
+ * on DHCP_DISCOVER_RETRIES and DHCP_REQUEST_RETRIES (wolfIP defaults are 3).
+ * After the stack gives up it sets state to DHCP_OFF and the UDP socket
+ * stops accepting unicast DHCP responses (because DHCP_IS_RUNNING becomes
+ * false). We re-init periodically to keep trying, but must space re-inits
+ * far enough apart to avoid socket churn (close/reopen loses in-flight
+ * responses) and to ensure the previous DHCP attempt has fully timed out. */

	WOLFSSL_ROOT ?= $(ROOT)/../wolfssl-alt
	WOLFSSL_ROOT ?= $(ROOT)/../wolfssl

Conversation

dgarske commented Mar 6, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dgarske Mar 7, 2026

Choose a reason for hiding this comment

Uh oh!

danielinux Mar 7, 2026

Choose a reason for hiding this comment

Uh oh!

danielinux Mar 7, 2026

Choose a reason for hiding this comment

Uh oh!

danielinux Mar 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants