Use TLS over transport for authentication of peer #227

JacobBarthelmeh · 2025-10-27T19:17:58Z

No description provided.

Copilot

Pull Request Overview

This PR adds TLS transport support to wolfHSM for secure client-server communication. The implementation extends the existing TCP transport with TLS encryption using wolfSSL, supporting both certificate-based and PSK (Pre-Shared Key) authentication methods.

Key Changes:

New TLS transport layer built on top of TCP transport with wolfSSL integration
Support for both mutual TLS authentication and PSK modes
Configuration changes to enable TLS/PSK in the build system

Reviewed Changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
port/posix/posix_transport_tls.h	Header defining TLS transport structures and function declarations
port/posix/posix_transport_tls.c	Implementation of TLS transport client/server functions
port/posix/posix_transport_tcp.c	Exposed HandleConnect function and fixed null pointer check
examples/posix/wh_posix_server/wh_posix_server_cfg.h	Added TLS and PSK configuration function declarations
examples/posix/wh_posix_server/wh_posix_server_cfg.c	Implemented TLS and PSK server configuration with certificate loading
examples/posix/wh_posix_server/wh_posix_server.c	Added TLS/PSK transport options to CLI
examples/posix/wh_posix_server/user_settings.h	Enabled TLS, TLS12, PSK, and debug settings
examples/posix/wh_posix_client/wh_posix_client_cfg.h	Added TLS and PSK client configuration declarations
examples/posix/wh_posix_client/wh_posix_client_cfg.c	Implemented TLS and PSK client configuration with certificate loading
examples/posix/wh_posix_client/wh_posix_client.c	Added TLS/PSK transport options to client CLI

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

examples/posix/wh_posix_server/wh_posix_server_cfg.c

examples/posix/wh_posix_client/wh_posix_client_cfg.c

examples/posix/wh_posix_server/wh_posix_server_cfg.c

port/posix/posix_transport_tls.c

examples/posix/wh_posix_server/user_settings.h

port/posix/posix_transport_tls.c

bigbrett

quick initial skim - I'd like to see test coverage added to this before diving much deeper. Looks very promising though, I'm super excited about this !!!

tools/whnvmtool/Makefile

examples/posix/wh_posix_server/user_settings.h

port/posix/posix_transport_tls.h

port/posix/posix_transport_tls.c

Copilot

Pull Request Overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

port/posix/posix_transport_tls.c

examples/posix/wh_posix_server/wh_posix_server_cfg.c

test/wh_test.c

examples/posix/wh_posix_client/wh_posix_client_cfg.c

Copilot

Pull Request Overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

port/posix/posix_transport_tls.c

port/posix/posix_transport_tcp.c

examples/posix/wh_posix_server/wh_posix_server_cfg.c

JacobBarthelmeh · 2025-11-04T00:01:05Z

Investigating SHE tests with TLS.

bigbrett · 2025-11-04T21:12:45Z

Random thoughts for future work: It would be really cool to have a built-in way to initialize and setup the WOLFSSL_CTX, perhaps even following the config/context paradigm we use elsewhere. Is there any way we can absolve the user from needing to directly manage the context? Or is that a dangerous road to go down? I envision a basic set of wolfSSL configuration options (keys, certs, basic modes) just being supplied in the transport config struct and us taking care of everything else internally.

JacobBarthelmeh · 2025-11-24T17:29:27Z

Rebased on top of recent examples and yaml changes. Assigning back to me until CI tests are passing

billphipps

Just capturing some notes in progress. Good conversation. Let's keep working to figure out the best path forward!

billphipps · 2025-11-13T13:02:04Z

tools/whnvmtool/Makefile

+	@scan-build --exclude $(WOLFSSL_DIR)/wolfcrypt \
+	            --exclude $(WOLFSSL_DIR)/src \


Were these causing issues before this PR? Recommend to add a comment explaining why it is ok to exclude wolfcrypt here. We should probably consider allowing a system library build of wolfssl for tools rather than building from source

I see the --exclude's being in the main wolfHSM branch. Not sure why it would be listed as change in this PR. Maybe from the rebase onto main?

billphipps · 2025-11-13T13:06:45Z

test/wh_test.c

    defined(WOLFHSM_CFG_ENABLE_CLIENT) && defined(WOLFHSM_CFG_TEST_POSIX)
    /* Test driver should run TCP client tests against the example server */
    ret = whTest_ClientTcp();
+#elif defined(WOLFHSM_CFG_TEST_CLIENT_ONLY_TLS) && \


Consider combining the xxx_ONLY_TCP and xxx_ONLY_TLS into CLIENT_ONLY and use additional CFG or CFG_TEST to specify the transport. These CFG_TEST macros should be described in wh_test.h with defaults AND the wh_test.h should be included in user_settings.h and wh_config.h to allow those configurations to be overridden.

billphipps · 2025-11-13T13:08:01Z

test/wh_test.c

+int whPosixClient_ExampleTlsConfig(void* conf)
+{
+    if (whPosixClient_ExampleTlsCommonConfig(conf) != WH_ERROR_OK) {
+        return WH_ERROR_ABORTED;


Consider returning the return value?

billphipps · 2025-11-13T13:09:37Z

test/wh_test.c


 #if defined(WOLFHSM_CFG_TEST_POSIX) && defined(WOLFHSM_CFG_ENABLE_CLIENT)
 #include "port/posix/posix_transport_tcp.h"
+#ifndef WOLFHSM_CFG_NO_CRYPTO


This should also be gated on whether or not TLS is actually needed since the user_settings.h may be different when TLS is needed or not.

billphipps · 2025-11-13T13:11:43Z

test/config/user_settings.h

-/* For cert manager */
-#define NO_TLS
-/* Eliminates need for IO layer since we only use CM */
-#define WOLFSSL_USER_IO


These should be gated on whether the TLS transport is necessary in this build. It should be made very clear which wolfCrypt settings are required ONLY for TLS and which are the ones needed for a slim/test version of wolfHSM

billphipps · 2025-11-17T19:40:09Z

test/wh_test.c

+    rc = wolfSSL_CTX_load_verify_buffer(ctx->ssl_ctx, ca_cert_der_2048,
+                                        sizeof_ca_cert_der_2048,
+                                        CTC_FILETYPE_ASN1);


Recommend to move CA and device certificates into the TLS transport config structure. These buffers (pointers?) or filenames would get copied into the TLS transport context and then used during the TLS transport Init() callback. This would allow you to instantiate and connect in a single wh_Client_Init() call, rather than build parts of the context out of sequence.

JacobBarthelmeh requested a review from Copilot October 27, 2025 19:17

Copilot AI reviewed Oct 27, 2025

View reviewed changes

JacobBarthelmeh self-assigned this Oct 29, 2025

JacobBarthelmeh force-pushed the auth branch 2 times, most recently from e9a4e7e to fcb0a97 Compare October 30, 2025 20:43

JacobBarthelmeh assigned bigbrett and unassigned JacobBarthelmeh Oct 30, 2025

JacobBarthelmeh marked this pull request as ready for review October 30, 2025 21:10

bigbrett requested changes Oct 31, 2025

View reviewed changes

tools/whnvmtool/Makefile Show resolved Hide resolved

examples/posix/wh_posix_server/user_settings.h Outdated Show resolved Hide resolved

port/posix/posix_transport_tls.h Outdated Show resolved Hide resolved

port/posix/posix_transport_tls.c Show resolved Hide resolved

JacobBarthelmeh assigned JacobBarthelmeh and unassigned bigbrett Oct 31, 2025

JacobBarthelmeh requested a review from Copilot November 3, 2025 20:22

Copilot AI reviewed Nov 3, 2025

View reviewed changes

port/posix/posix_transport_tls.c Show resolved Hide resolved

examples/posix/wh_posix_server/wh_posix_server_cfg.c Outdated Show resolved Hide resolved

test/wh_test.c Outdated Show resolved Hide resolved

examples/posix/wh_posix_client/wh_posix_client_cfg.c Outdated Show resolved Hide resolved

JacobBarthelmeh requested a review from Copilot November 3, 2025 21:38

Copilot AI reviewed Nov 3, 2025

View reviewed changes

port/posix/posix_transport_tls.c Show resolved Hide resolved

port/posix/posix_transport_tls.c Show resolved Hide resolved

port/posix/posix_transport_tcp.c Outdated Show resolved Hide resolved

examples/posix/wh_posix_server/wh_posix_server_cfg.c Outdated Show resolved Hide resolved

JacobBarthelmeh assigned bigbrett and JacobBarthelmeh and unassigned JacobBarthelmeh and bigbrett Nov 3, 2025

JacobBarthelmeh assigned bigbrett and unassigned JacobBarthelmeh Nov 4, 2025

bigbrett previously approved these changes Nov 4, 2025

View reviewed changes

bigbrett assigned billphipps and unassigned bigbrett Nov 4, 2025

bigbrett requested a review from billphipps November 4, 2025 19:59

JacobBarthelmeh added 3 commits November 24, 2025 10:21

Use TLS over transport for authentication of peer

d121e84

add test cases and update user_settings.h

c9684e1

handle race condition with connect

61fdaa9

JacobBarthelmeh added 3 commits November 24, 2025 10:23

typo fix, trim down struct, connect fd variable update

5bc33a4

use WOLFSSL_* instead of CTC_* and fix typo

372648e

add SHE test with client only TLS

0272216

JacobBarthelmeh dismissed bigbrett’s stale review via 0272216 November 24, 2025 17:28

JacobBarthelmeh force-pushed the auth branch from 4ab374d to 0272216 Compare November 24, 2025 17:28

JacobBarthelmeh assigned JacobBarthelmeh and unassigned billphipps Nov 24, 2025

update client only test case for TLS

cebfea5

JacobBarthelmeh force-pushed the auth branch from 22ee224 to cebfea5 Compare November 25, 2025 17:16

JacobBarthelmeh assigned billphipps and unassigned JacobBarthelmeh Nov 25, 2025

billphipps requested changes Nov 25, 2025

View reviewed changes

JacobBarthelmeh assigned JacobBarthelmeh and unassigned billphipps Nov 25, 2025

		@scan-build --exclude $(WOLFSSL_DIR)/wolfcrypt \
		--exclude $(WOLFSSL_DIR)/src \

Use TLS over transport for authentication of peer #227

Are you sure you want to change the base?

Use TLS over transport for authentication of peer #227

Uh oh!

Conversation

JacobBarthelmeh commented Oct 27, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bigbrett left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JacobBarthelmeh commented Nov 4, 2025

Uh oh!

bigbrett commented Nov 4, 2025

Uh oh!

JacobBarthelmeh commented Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

billphipps left a comment

Choose a reason for hiding this comment

Uh oh!

billphipps Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

JacobBarthelmeh Nov 26, 2025

Choose a reason for hiding this comment

Uh oh!

billphipps Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

billphipps Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

billphipps Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

billphipps Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

billphipps Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

JacobBarthelmeh commented Nov 24, 2025 •

edited

Loading