CONFIG_NET_SOCKETS_SOCKOPT_TLS generate build errors when build with nrf9160_ns image

[Haseeb Zaib]

I am using nrf9160.

When I use build flag CONFIG_NET_SOCKETS_SOCKOPT_TLS with build configuration of nrf9160dk_nrf9160 the build is fine.

But when I use nrf9160dk_nrf9160_ns the build fails if CONFIG_NET_SOCKETS_SOCKOPT_TLS is enabled. 

# GPIO
#CONFIG_GPIO=y
#CONFIG_PICOLIBC=y
# Logging
CONFIG_LOG=y

CONFIG_HW_ID_LIBRARY=y


# CONFIG_JSON_LIBRARY=y


# Heap and stacks
CONFIG_HEAP_MEM_POOL_SIZE=4096
CONFIG_MAIN_STACK_SIZE=2048


# # Newlibc
CONFIG_NEWLIB_LIBC=y

CONFIG_NRF_MODEM_LIB=n
# Ethernet
CONFIG_SPI=y
CONFIG_NET_L2_ETHERNET=y
CONFIG_ETH_W5500=y
CONFIG_ETH_W5500_TIMEOUT=10000
CONFIG_ETHERNET_LOG_LEVEL_DBG=y
CONFIG_ETHERNET_LOG_LEVEL_INF=y
CONFIG_NETWORKING=y
CONFIG_NET_IPV6=n
CONFIG_NET_IPV4=y
CONFIG_NET_ARP=y
# #CONFIG_NET_UDP=y
CONFIG_NET_DHCPV4=y
CONFIG_NET_DHCPV4_OPTION_CALLBACKS=y
#CONFIG_NET_NATIVE=y
CONFIG_NET_SOCKETS=y
CONFIG_NET_IF_MAX_IPV4_COUNT=5
CONFIG_NET_SOCKETS_POSIX_NAMES=y
CONFIG_NET_SOCKETS_SOCKOPT_TLS=y
CONFIG_NET_TCP=y
CONFIG_NET_CONNECTION_MANAGER=y
CONFIG_NET_CONNECTION_MANAGER_MONITOR_STACK_SIZE=1024
CONFIG_DNS_RESOLVER=y
CONFIG_DNS_SERVER_IP_ADDRESSES=y
CONFIG_DNS_SERVER1="8.8.8.8"
CONFIG_DNS_RESOLVER_MAX_SERVERS=2
CONFIG_TEST_RANDOM_GENERATOR=y
CONFIG_INIT_STACKS=y
CONFIG_NET_MGMT=y
CONFIG_NET_MGMT_EVENT=y
CONFIG_NET_LOG=y
#CONFIG_POSIX_API=y

CONFIG_TLS_CREDENTIALS=y



# # Enable the MQTT Lib
CONFIG_MQTT_LIB=y
CONFIG_MQTT_LIB_TLS=y
CONFIG_MQTT_KEEPALIVE=1200
CONFIG_MQTT_CLEAN_SESSION=y
#CONFIG_MQTT_LOG_LEVEL_DBG=y

#TLS configuration
CONFIG_NRF_SECURITY=y
#CONFIG_MBEDTLS_LIBRARY=y
CONFIG_MBEDTLS_LIBRARY_NRF_SECURITY=y
CONFIG_MBEDTLS=y
#CONFIG_MBEDTLS_BUILTIN=y
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=60000
# CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN=10000
# CONFIG_MBEDTLS_PEM_CERTIFICATE_FORMAT=y
# CONFIG_MBEDTLS_SERVER_NAME_INDICATION=y
# CONFIG_MBEDTLS_AES_ROM_TABLES=y
# CONFIG_MBEDTLS_TLS_VERSION_1_2=y
# CONFIG_MBEDTLS_HAVE_TIME_DATE=y

ERROR

[Marte Myrvold]

Hi,

Is there a particular reason you want to build for nrf9160dk_nrf9160 instead of nrf9160dk_nrf9160_ns?

TF-M is included when you build for nrf9160dk_nrf9160_ns, and TLS is handled by TF-M. Please note that TF-M is necessary in order to use the modem on the nRF9160, so you should build with _ns.

Best regards,
Marte

[Haseeb Zaib]

Hi, I think you misunderstood my question. 

I am comparing two builds, when I build with nrf9160dk_nrf9160 the build is successfull with CONFIG_NET_SOCKETS_SOCKOPT_TLS 

but when I do samething with nrf9160dk_nrf9160_ns the build fails due to CONFIG_NET_SOCKETS_SOCKOPT_TLS being ON and when I turn off this flag the build is successfull. But I need this flag on to do what I am trying to achieve

[Haseeb Zaib]

and currently for my build I am not using modem and using ethernet but I want to integrate both therefore I know that _ns build is important for that, but to run TLS on ethernet the flag CONFIG_NET_SOCKETS_SOCKOPT_TLS  is also important

[Marte Myrvold]

Hi,

You are correct, I misread the issue.

TLS is typically handled by the modem. When you enable CONFIG_NET_SOCKETS_SOCKOPT_TLS you are offloading TLS to the application. For this, you need to also enable CONFIG_MBEDTLS and CONFIG_MBEDTLS_TLS_LIBRARY. These have some dependencies as well, so I recommend looking at http_server/overlay-tls-nrf91.conf to find which Kconfig options to set.

Best regards,
Marte