Peer review fixes

Author: dgarske

.github/workflows/stm32h563-m33mu.yml

@@ -46,7 +46,6 @@ jobs:
           }
           trap cleanup EXIT
 
-          sudo modprobe tun
           sudo ip tuntap add dev tap0 mode tap
           sudo ip addr add 192.168.12.1/24 dev tap0
           sudo ip link set tap0 up
@@ -115,13 +114,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     container:
-      image: ghcr.io/danielinux/m33mu-ci:1.5
+      image: ghcr.io/danielinux/m33mu-ci:1.6
       options: --privileged
 
     steps:
       - uses: actions/checkout@v4
 
-      - name: Clone wolfSSL, wolfSSH, wolfMQTT (pinned to stable tags)
+      - name: Clone wolfSSL, wolfSSH, wolfMQTT
         run: |
           set -euo pipefail
           cd ..
@@ -162,7 +161,6 @@ jobs:
           }
           trap cleanup EXIT
 
-          sudo modprobe tun
           sudo ip tuntap add dev tap0 mode tap
           sudo ip addr add 192.168.12.1/24 dev tap0
           sudo ip link set tap0 up
@@ -271,7 +269,7 @@ jobs:
           echo "=== Test 4: MQTT Broker ==="
           sleep 5  # allow recovery from TLS echo session
           # Extract cert from certs.h for mosquitto
-          sed -n '/server_cert_pem\[\]/,/^";$/p' src/port/certs.h \
+          sed -n '/server_cert_pem\[\]/,/^"-----END CERTIFICATE-----\\n";$/p' src/port/certs.h \
             | sed 's/^"//; s/"$//; s/\\n$//' \
             | grep -v '^static\|^;' > /tmp/wolfip_cert.pem
           ok=0

src/port/stm32h563/Makefile

@@ -45,7 +45,7 @@ ifeq ($(ENABLE_MQTT),1)
 endif
 
 # Library paths - default to sibling directories (clone alongside pattern)
-WOLFSSL_ROOT ?= $(ROOT)/../wolfssl-alt
+WOLFSSL_ROOT ?= $(ROOT)/../wolfssl
 WOLFSSH_ROOT ?= $(ROOT)/../wolfssh
 WOLFMQTT_ROOT ?= $(ROOT)/../wolfmqtt
 

src/port/stm32h563/demo.sh

@@ -18,7 +18,7 @@ fi
 BOARD_IP="${1:-192.168.12.11}"
 
 # Validate BOARD_IP to block shell metacharacter injection via eval
-if ! [[ "$BOARD_IP" =~ ^[A-Za-z0-9._-]+$ ]]; then
+if [[ "$BOARD_IP" == -* ]] || ! [[ "$BOARD_IP" =~ ^[A-Za-z0-9._-]+$ ]]; then
     echo "Error: Invalid board IP/hostname: $BOARD_IP" >&2
     exit 1
 fi
@@ -81,7 +81,7 @@ pause() {
 run_cmd() {
     cmd_show "$1"
     echo ""
-    eval "$1" 2>&1 | sed 's/^/    /'
+    bash -c "$1" 2>&1 | sed 's/^/    /'
     echo ""
 }
 

src/port/stm32h563/main.c

@@ -412,6 +412,10 @@ void wolfmqtt_log(const char *fmt, ...)
     va_start(ap, fmt);
     n = vsnprintf(buf, sizeof(buf), fmt, ap);
     va_end(ap);
+    if (n < 0) {
+        uart_puts("<wolfmqtt_log: encoding error>\n");
+        return;
+    }
     uart_puts(buf);
     if (n >= (int)sizeof(buf))
         uart_puts("...[truncated]\n");

src/port/va416xx/main.c

@@ -44,12 +44,13 @@ extern volatile uint64_t HAL_time_ms;
 #define RX_BUF_SIZE     1024
 
 /* DHCP timeout: total time to wait for DHCP before static IP fallback.
- * wolfIP's internal DHCP state machine only retries for ~4 seconds
- * (DHCP_DISCOVER_RETRIES=1 x 2s timeout).  After that it sets state to
- * DHCP_OFF and the UDP socket stops accepting unicast DHCP responses
- * (because DHCP_IS_RUNNING becomes false).  We re-init periodically to
- * keep trying, but must space re-inits apart to avoid socket churn
- * (close/reopen loses in-flight responses). */
+ * wolfIP's internal DHCP state machine retries for a finite period based
+ * on DHCP_DISCOVER_RETRIES and DHCP_REQUEST_RETRIES (wolfIP defaults are 3).
+ * After the stack gives up it sets state to DHCP_OFF and the UDP socket
+ * stops accepting unicast DHCP responses (because DHCP_IS_RUNNING becomes
+ * false).  We re-init periodically to keep trying, but must space re-inits
+ * far enough apart to avoid socket churn (close/reopen loses in-flight
+ * responses) and to ensure the previous DHCP attempt has fully timed out. */
 #define DHCP_TIMEOUT_MS     30000U   /* 30s total before static fallback */
 #define DHCP_REINIT_MS      10000U   /* 10s between DHCP re-init attempts */