net: use recv/send directly instead of wolfSSL's optional wolfIO helpers

wolfIO_Recv and wolfIO_Send are declared under USE_WOLFSSL_IO ||
WOLFSSL_USER_IO || HAVE_HTTP_CLIENT, but defined only under
USE_WOLFSSL_IO, which wolfSSL auto-defines only when none of
WOLFSSL_USER_IO, MICRIUM, WOLFSSL_CONTIKI or WOLFSSL_NO_SOCK is set.
The built-in transport therefore compiled but failed to link against
such a wolfSSL, with undefined references to both symbols.

It now calls recv and send directly and translates errno itself: EINTR
retries, EAGAIN/EWOULDBLOCK map to the caller's WANT_READ or WANT_WRITE,
ECONNRESET and EPIPE to CONN_CLOSED. That covers a superset of what
TranslateIoReturnCode reported, and lets the file drop its
wolfssl/wolfio.h and wolfssl/error-ssl.h includes.

Author: yosuke-wolfssl

docs/ARCHITECTURE.md

@@ -443,7 +443,10 @@ The contract:
   something different from `connect`'s. wolfCert passes only two values.
   `0` asks the call never to block: return `WOLFCERT_ERR_WANT_READ` or
   `WOLFCERT_ERR_WANT_WRITE` rather than wait. `-1` asks it to block until
-  bytes move.
+  bytes move. If your stack has its own receive or send timeout, implement
+  `-1` with a call that lets it apply, rather than an unbounded wait around a
+  non-blocking transfer: the second shape silently discards whatever the
+  application configured.
 - **`disconnect` runs exactly once per successful `connect`**, on every error
   path included. A failed `connect` is never paired with one.
 - **`ctx` is transport-wide** (the stack instance, say), distinct from the

src/http.c

@@ -341,7 +341,8 @@ static int dial(WolfCertConn* c, const char* host, int port, int timeout_ms,
 #else
     if (t == NULL && connect_cb != NULL) {
         rc = wolfcert_legacy_connect(connect_cb, connect_ctx, host, port,
-                                     timeout_ms, &c->handle);
+                                     timeout_ms, c->io_timeout_ms == 0,
+                                     &c->handle);
         if (rc != WOLFCERT_OK)
             return rc;
 

src/internal.h

@@ -318,7 +318,7 @@ extern const WolfCertTransport wolfcert_legacy_transport;
 int  wolfcert_transport_is_fd_backed(const WolfCertTransport* t);
 int  wolfcert_legacy_connect(WolfCertConnectFn cb, void* cb_ctx,
                              const char* host, int port, int timeout_ms,
-                             void** conn);
+                             int nonblocking, void** conn);
 
 int  wolfcert_pem_cert_to_der(const uint8_t* pem, size_t pem_len,
                               WolfCertBuffer* out_der, void* heap);

src/net_posix.c

@@ -31,9 +31,6 @@
 #include <wolfcert/errors.h>
 #include "internal.h"
 
-#include <wolfssl/wolfio.h>
-#include <wolfssl/error-ssl.h>
-
 #include <errno.h>
 #include <limits.h>
 #include <fcntl.h>
@@ -183,26 +180,13 @@ static int posix_wait(int fd, short events, int timeout_ms, int want)
     return WOLFCERT_OK;
 }
 
-/* wolfIO_* return CBIO codes, which carry no direction: WANT_READ and
- * WANT_WRITE are the same value, so the caller supplies `want`. */
-static int map_io(int n, int want)
-{
-    if (n > 0)
-        return n;
-    /* wolfSSL passes a 0-length read straight through, so map it here. */
-    if (n == 0)
-        return WOLFCERT_ERR_CONN_CLOSED;
-
-    switch (n) {
-        case WOLFSSL_CBIO_ERR_WANT_READ:  /* == WANT_WRITE */
-            return want;
-        case WOLFSSL_CBIO_ERR_CONN_CLOSE:
-        case WOLFSSL_CBIO_ERR_CONN_RST:
-            return WOLFCERT_ERR_CONN_CLOSED;
-        default:
-            return WOLFCERT_ERR_IO;
-    }
-}
+/* A failed transfer is an I/O error unless it merely would block, so this is
+ * the one errno the byte path reads. */
+#if defined(EWOULDBLOCK) && EWOULDBLOCK != EAGAIN
+    #define WOLFCERT_WOULDBLOCK(e) ((e) == EAGAIN || (e) == EWOULDBLOCK)
+#else
+    #define WOLFCERT_WOULDBLOCK(e) ((e) == EAGAIN)
+#endif
 
 /* poll() only promises that one byte can move, so the transfer must never
  * block; the wait is poll's job. Sockets the transport owns stay O_NONBLOCK. */
@@ -242,8 +226,8 @@ static int posix_read(void* ctx, void* conn, uint8_t* buf, size_t len,
                       int timeout_ms)
 {
     int fd = (int)(intptr_t)conn;
+    ssize_t n;
     int rc;
-    int n;
 
     (void)ctx;
 
@@ -257,24 +241,30 @@ static int posix_read(void* ctx, void* conn, uint8_t* buf, size_t len,
         if (rc != WOLFCERT_OK)
             return rc;
 
-        /* TranslateIoReturnCode reports EINTR rather than retrying. */
         do {
-            n = wolfIO_Recv(fd, (char*)buf, (int)len, 0);
-        } while (n == WOLFSSL_CBIO_ERR_ISR);
+            n = recv(fd, buf, len, 0);
+        } while (n < 0 && errno == EINTR);
 
-        if (n != WOLFSSL_CBIO_ERR_WANT_READ || timeout_ms >= 0)
-            break;
-    }
+        if (n > 0)
+            return (int)n;
+        if (n == 0)
+            return WOLFCERT_ERR_CONN_CLOSED;
 
-    return map_io(n, WOLFCERT_ERR_WANT_READ);
+        /* poll() can report a readiness the transfer then declines. Only an
+         * unbounded caller waits again; the others report it. */
+        if (!WOLFCERT_WOULDBLOCK(errno))
+            return WOLFCERT_ERR_IO;
+        if (timeout_ms >= 0)
+            return WOLFCERT_ERR_WANT_READ;
+    }
 }
 
 static int posix_write(void* ctx, void* conn, const uint8_t* buf, size_t len,
                        int timeout_ms)
 {
     int fd = (int)(intptr_t)conn;
+    ssize_t n;
     int rc;
-    int n;
 
     (void)ctx;
 
@@ -289,14 +279,19 @@ static int posix_write(void* ctx, void* conn, const uint8_t* buf, size_t len,
             return rc;
 
         do {
-            n = wolfIO_Send(fd, (char*)(uintptr_t)buf, (int)len, 0);
-        } while (n == WOLFSSL_CBIO_ERR_ISR);
+            n = send(fd, buf, len, 0);
+        } while (n < 0 && errno == EINTR);
 
-        if (n != WOLFSSL_CBIO_ERR_WANT_WRITE || timeout_ms >= 0)
-            break;
-    }
+        if (n > 0)
+            return (int)n;
+        if (n == 0)
+            return WOLFCERT_ERR_IO;
 
-    return map_io(n, WOLFCERT_ERR_WANT_WRITE);
+        if (!WOLFCERT_WOULDBLOCK(errno))
+            return WOLFCERT_ERR_IO;
+        if (timeout_ms >= 0)
+            return WOLFCERT_ERR_WANT_WRITE;
+    }
 }
 
 static int posix_disconnect(void* ctx, void* conn)
@@ -314,10 +309,11 @@ const WolfCertTransport wolfcert_posix_transport = {
 };
 
 /* Dial through the deprecated connect_cb, keeping every fd detail in this file.
- * The descriptor becomes ours, so it gets the O_NONBLOCK posix_connect sets. */
+ * The descriptor belongs to the application, so only a non-blocking session
+ * changes its mode; a blocking one leaves it exactly as supplied. */
 int wolfcert_legacy_connect(WolfCertConnectFn cb, void* cb_ctx,
                             const char* host, int port, int timeout_ms,
-                            void** conn)
+                            int nonblocking, void** conn)
 {
     int fd;
 
@@ -328,7 +324,7 @@ int wolfcert_legacy_connect(WolfCertConnectFn cb, void* cb_ctx,
     if (fd < 0)
         return WOLFCERT_ERR_IO;
 
-    if (set_nonblock(fd) != WOLFCERT_OK) {
+    if (nonblocking && set_nonblock(fd) != WOLFCERT_OK) {
         (void)close(fd);
         return WOLFCERT_ERR_IO;
     }
@@ -338,8 +334,61 @@ int wolfcert_legacy_connect(WolfCertConnectFn cb, void* cb_ctx,
 }
 
 /* Byte path for a connection opened by wolfcert_legacy_connect. */
+static int legacy_read(void* ctx, void* conn, uint8_t* buf, size_t len,
+                       int timeout_ms)
+{
+    int fd = (int)(intptr_t)conn;
+    ssize_t n;
+
+    if (timeout_ms >= 0)
+        return posix_read(ctx, conn, buf, len, timeout_ms);
+
+    if (buf == NULL || len == 0)
+        return WOLFCERT_ERR_BAD_ARG;
+    if (len > INT_MAX)
+        len = INT_MAX;
+
+    do {
+        n = recv(fd, buf, len, 0);
+    } while (n < 0 && errno == EINTR);
+
+    if (n > 0)
+        return (int)n;
+    if (n == 0)
+        return WOLFCERT_ERR_CONN_CLOSED;
+
+    /* A would-block here is the descriptor's own timeout expiring. */
+    return WOLFCERT_ERR_IO;
+}
+
+static int legacy_write(void* ctx, void* conn, const uint8_t* buf, size_t len,
+                        int timeout_ms)
+{
+    int fd = (int)(intptr_t)conn;
+    ssize_t n;
+
+    if (timeout_ms >= 0)
+        return posix_write(ctx, conn, buf, len, timeout_ms);
+
+    if (buf == NULL || len == 0)
+        return WOLFCERT_ERR_BAD_ARG;
+    if (len > INT_MAX)
+        len = INT_MAX;
+
+    do {
+        n = send(fd, buf, len, 0);
+    } while (n < 0 && errno == EINTR);
+
+    if (n > 0)
+        return (int)n;
+    if (n == 0)
+        return WOLFCERT_ERR_IO;
+
+    return WOLFCERT_ERR_IO;
+}
+
 const WolfCertTransport wolfcert_legacy_transport = {
-    NULL, posix_read, posix_write, posix_disconnect, NULL
+    NULL, legacy_read, legacy_write, posix_disconnect, NULL
 };
 
 int wolfcert_transport_is_fd_backed(const WolfCertTransport* t)

wolfcert/types.h

@@ -64,7 +64,8 @@ typedef enum {
 } WolfCertEncoding;
 
 /* Deprecated: use WolfCertTransport, never both on one config (BAD_ARG). An
- * fd cannot carry a non-socket handle, which is why this is going away. */
+ * fd cannot carry a non-socket handle, which is why this is going away.
+ * Return it blocking; its own SO_RCVTIMEO / SO_SNDTIMEO then bound the I/O. */
 typedef int (*WolfCertConnectFn)(const char* host, int port,
                                  int timeout_ms, void* ctx);