Repository navigation
lan-tls: the pod's LAN API over TLS, pinning, HTTPS-only - #41
Merged
Merged
Conversation
Port 8443 is TLS only; the default port 8080 tries TLS on 8443 first and falls back to plaintext only when 8443 refuses (firmware without LAN TLS) and nothing is pinned for the pod. Other ports and the USB network adapter (10.237.0.0/16) stay plaintext. The pod's certificate SHA-256 is pinned on first use in known_pods.json next to the CLI config; a different one is a PinMismatchError. TLSCAFile verifies against given roots instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
benchpod lan-tls [show [--pem]] | https-only on|off | regenerate | set-cert --cert --key | trust [--sha256] | forget, for the pod's LAN API over TLS (firmware 3.9.3+). set-cert checks the pair here, uploads it as OTA target "tls" and updates the pin; regenerate updates the pin from the reply. --tls auto|on|off (BENCHPOD_TLS) and --tls-ca (BENCHPOD_TLS_CA) pick the transport and the trust. README: Connection, LAN TLS section, reference. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A full handshake costs the pod ~0.46 s; with the session cache later connections in the same process resume in ~35 ms (HW: 476 ms, then 44/36/32 ms). TestTLSResumesOnThePod runs against a pod when BENCHPOD_TLS_HW_ADDR is set. The rotation test's server disables tickets. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each benchpod run is a new process, so every run paid the pod's full TLS handshake: 0.48 s per command against 0.01 s plaintext (HW, a1f6f2). The ticket and its session state are saved in tls_sessions.json next to the pins (0600, dropped after the pod's one-hour ticket lifetime, and whenever a pin changes); later runs resume: 0.04-0.05 s per command. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
wardviaene
marked this pull request as ready for review
October 16, 2026 16:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Client side of benchpod-firmware#55 (LAN API over TLS on 8443, firmware 3.9.3).
internal/tcpclient/tls.go): default port 8080 now tries TLS on 8443 first and falls back to plaintext only when 8443 refuses and nothing is pinned (old firmware keeps working);:8443is TLS only; other ports and the USB network adapter (10.237.0.0/16) stay plaintext.--tls auto|on|off(BENCHPOD_TLS).~/.config/benchpod-cli/known_pods.json(shared with the SDK); a different one is an error naming both fingerprints andbenchpod lan-tls trust.--tls-ca(BENCHPOD_TLS_CA) verifies chain + name instead.benchpod lan-tls [show [--pem]],https-only on|off,regenerate,set-cert --cert --key(checked locally, uploaded as OTA targettls, pin updated),trust [--sha256],forget.Unit tests: dial plan, TOFU + mismatch + re-trust against a local TLS server, cert/key check. HW-tested, see below.
🤖 Generated with Claude Code
Hardware test (benchpod-a1f6f2, 2026-10-16, Ethernet + USB, no Wi-Fi)