luna - wolfssl/src/wolfio.c

   1/* wolfio.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22
  23#ifndef WOLFSSL_STRERROR_BUFFER_SIZE
  24#define WOLFSSL_STRERROR_BUFFER_SIZE 256
  25#endif
  26
  27#include <wolfssl/wolfcrypt/libwolfssl_sources.h>
  28
  29#ifndef WOLFCRYPT_ONLY
  30
  31#if defined(HAVE_ERRNO_H) && defined(WOLFSSL_NO_SOCK) && \
  32    (defined(USE_WOLFSSL_IO) || defined(HAVE_HTTP_CLIENT))
  33    /* error codes are needed for TranslateIoReturnCode() and
  34     * wolfIO_TcpConnect() even if defined(WOLFSSL_NO_SOCK), which inhibits
  35     * inclusion of errno.h by wolfio.h.
  36     */
  37    #include <errno.h>
  38#endif
  39
  40#include <wolfssl/internal.h>
  41#include <wolfssl/error-ssl.h>
  42#include <wolfssl/wolfio.h>
  43#include <wolfssl/wolfcrypt/logging.h>
  44
  45
  46#ifdef NUCLEUS_PLUS_2_3
  47/* Holds last Nucleus networking error number */
  48int Nucleus_Net_Errno;
  49#endif
  50
  51#if defined(USE_WOLFSSL_IO) || defined(HAVE_HTTP_CLIENT)
  52    #ifdef USE_WINDOWS_API
  53        #include <winsock2.h>
  54    #else
  55        #if defined(WOLFSSL_LWIP) && !defined(WOLFSSL_APACHE_MYNEWT)
  56        #elif defined(ARDUINO)
  57        #elif defined(FREESCALE_MQX)
  58        #elif defined(FREESCALE_KSDK_MQX)
  59        #elif (defined(WOLFSSL_MDK_ARM) || defined(WOLFSSL_KEIL_TCP_NET))
  60        #elif defined(WOLFSSL_CMSIS_RTOS)
  61        #elif defined(WOLFSSL_CMSIS_RTOSv2)
  62        #elif defined(WOLFSSL_TIRTOS)
  63        #elif defined(FREERTOS_TCP)
  64        #elif defined(WOLFSSL_IAR_ARM)
  65        #elif defined(HAVE_NETX_BSD)
  66        #elif defined(WOLFSSL_VXWORKS)
  67        #elif defined(WOLFSSL_NUCLEUS_1_2)
  68        #elif defined(WOLFSSL_LINUXKM)
  69            /* the requisite linux/net.h is included in wc_port.h, with incompatible warnings masked out. */
  70        #elif defined(WOLFSSL_ATMEL)
  71        #elif defined(INTIME_RTOS)
  72            #include <netdb.h>
  73        #elif defined(WOLFSSL_PRCONNECT_PRO)
  74            #include <netdb.h>
  75            #include <sys/ioctl.h>
  76        #elif defined(WOLFSSL_SGX)
  77        #elif defined(WOLFSSL_APACHE_MYNEWT) && !defined(WOLFSSL_LWIP)
  78        #elif defined(WOLFSSL_DEOS)
  79        #elif defined(WOLFSSL_ZEPHYR)
  80        #elif defined(MICROCHIP_PIC32)
  81        #elif defined(HAVE_NETX)
  82        #elif defined(FUSION_RTOS)
  83        #elif !defined(WOLFSSL_NO_SOCK)
  84            #if defined(HAVE_RTP_SYS)
  85            #elif defined(EBSNET)
  86            #elif defined(NETOS)
  87            #elif !defined(DEVKITPRO) && !defined(WOLFSSL_PICOTCP) \
  88                    && !defined(WOLFSSL_CONTIKI) && !defined(WOLFSSL_WICED) \
  89                    && !defined(WOLFSSL_GNRC) && !defined(WOLFSSL_RIOT_OS)
  90                #ifdef HAVE_NETDB_H
  91                    #include <netdb.h>
  92                #endif
  93                #ifdef __PPU
  94                    #include <netex/errno.h>
  95                #else
  96                    #ifdef HAVE_SYS_IOCTL_H
  97                        #include <sys/ioctl.h>
  98                    #endif
  99                #endif
 100            #endif
 101        #endif
 102
 103    #endif /* USE_WINDOWS_API */
 104#endif /* defined(USE_WOLFSSL_IO) || defined(HAVE_HTTP_CLIENT) */
 105
 106
 107#if defined(HAVE_HTTP_CLIENT)
 108    #include <stdlib.h>   /* strtol() */
 109#endif
 110
 111/*
 112Possible IO enable options:
 113 * WOLFSSL_USER_IO:     Disables default Embed* callbacks and     default: off
 114                        allows user to define their own using
 115                        wolfSSL_CTX_SetIORecv and wolfSSL_CTX_SetIOSend
 116 * USE_WOLFSSL_IO:      Enables the wolfSSL IO functions          default: on
 117 * HAVE_HTTP_CLIENT:    Enables HTTP client API's                 default: off
 118                                     (unless HAVE_OCSP or HAVE_CRL_IO defined)
 119 * HAVE_IO_TIMEOUT:     Enables support for connect timeout       default: off
 120 *
 121 * DTLS_RECEIVEFROM_NO_TIMEOUT_ON_INVALID_PEER: This flag has effect only if
 122 * ASN_NO_TIME is enabled. If enabled invalid peers messages are ignored
 123 * indefinitely. If not enabled EmbedReceiveFrom will return timeout after
 124 * DTLS_RECEIVEFROM_MAX_INVALID_PEER number of packets from invalid peers. When
 125 * enabled, without a timer, EmbedReceivefrom can't check if the timeout is
 126 * expired and it may never return under a continuous flow of invalid packets.
 127 *                                                                default: off
 128 */
 129
 130
 131/* if user writes own I/O callbacks they can define WOLFSSL_USER_IO to remove
 132   automatic setting of default I/O functions EmbedSend() and EmbedReceive()
 133   but they'll still need SetCallback xxx() at end of file
 134*/
 135
 136#if defined(NO_ASN_TIME) && !defined(DTLS_RECEIVEFROM_NO_TIMEOUT_ON_INVALID_PEER) \
 137  && !defined(DTLS_RECEIVEFROM_MAX_INVALID_PEER)
 138#define DTLS_RECEIVEFROM_MAX_INVALID_PEER 10
 139#endif
 140
 141#if defined(USE_WOLFSSL_IO) || defined(HAVE_HTTP_CLIENT)
 142
 143static WC_INLINE int wolfSSL_LastError(int err, SOCKET_T sd)
 144{
 145    (void)sd;
 146
 147    if (err > 0)
 148        return 0;
 149
 150#ifdef USE_WINDOWS_API
 151    return WSAGetLastError();
 152#elif defined(EBSNET)
 153    return xn_getlasterror();
 154#elif defined(WOLFSSL_LINUXKM)
 155    return -err; /* Return provided error value with corrected sign. */
 156#elif defined(WOLFSSL_EMNET)
 157    /* Any negative recv/send return is a SOCKET_ERROR sentinel under
 158     * emNET; the canonical IP_ERR_* lives in the socket SO_ERROR.
 159     * Retrieving it via IP_SOCK_getsockopt works across both emNET
 160     * integrator conventions (native: recv returns IP_ERR_* directly;
 161     * POSIX facade: recv returns -1 with errno set). If the lookup
 162     * itself fails, fall back to IP_ERR_FAULT rather than returning
 163     * the raw -1 sentinel - the latter matches no SOCKET_E* constant
 164     * and would regress into WOLFSSL_CBIO_ERR_GENERAL. */
 165    if (err < 0) {
 166        int sock_err = err;
 167        if (IP_SOCK_getsockopt(sd, SOL_SOCKET, SO_ERROR, &sock_err,
 168                               (int)sizeof(sock_err)) == 0) {
 169            err = sock_err;
 170        }
 171        else if (err == -1) {
 172            err = IP_ERR_FAULT;
 173        }
 174    }
 175    return err;
 176#elif defined(FUSION_RTOS)
 177    #include <fclerrno.h>
 178    return FCL_GET_ERRNO;
 179#elif defined(NUCLEUS_PLUS_2_3)
 180    return Nucleus_Net_Errno;
 181#elif defined(FREESCALE_MQX) || defined(FREESCALE_KSDK_MQX)
 182    if ((err == 0) || (err == -SOCKET_EWOULDBLOCK)) {
 183        return SOCKET_EWOULDBLOCK; /* convert to BSD style wouldblock */
 184    } else {
 185        err = RTCS_geterror(sd);
 186        if ((err == RTCSERR_TCP_CONN_CLOSING) ||
 187            (err == RTCSERR_TCP_CONN_RLSD))
 188        {
 189            err = SOCKET_ECONNRESET;
 190        }
 191        return err;
 192    }
 193#else
 194    return errno;
 195#endif
 196}
 197
 198/* Translates return codes returned from
 199 * send(), recv(), and other network I/O calls.
 200 */
 201static int TranslateIoReturnCode(int err, SOCKET_T sd, int direction)
 202{
 203#if defined(_WIN32) && !defined(__WATCOMC__) && !defined(_WIN32_WCE) && \
 204    !defined(INTIME_RTOS)
 205    size_t errstr_offset;
 206    char errstr[WOLFSSL_STRERROR_BUFFER_SIZE];
 207#endif /* _WIN32 */
 208
 209#if defined(FREESCALE_MQX) || defined(FREESCALE_KSDK_MQX)
 210    if (err > 0)
 211        return err;
 212#else
 213    if (err >= 0)
 214        return err;
 215#endif
 216
 217    err = wolfSSL_LastError(err, sd);
 218
 219#if SOCKET_EWOULDBLOCK != SOCKET_EAGAIN
 220    if ((err == SOCKET_EWOULDBLOCK) || (err == SOCKET_EAGAIN))
 221#else
 222    if (err == SOCKET_EWOULDBLOCK)
 223#endif
 224    {
 225        WOLFSSL_MSG("\tWould block");
 226        if (direction == SOCKET_SENDING)
 227            return WOLFSSL_CBIO_ERR_WANT_WRITE;
 228        else if (direction == SOCKET_RECEIVING)
 229            return WOLFSSL_CBIO_ERR_WANT_READ;
 230        else
 231            return WOLFSSL_CBIO_ERR_GENERAL;
 232    }
 233
 234#ifdef SOCKET_ETIMEDOUT
 235    else if (err == SOCKET_ETIMEDOUT) {
 236        WOLFSSL_MSG("\tTimed out");
 237        if (direction == SOCKET_SENDING)
 238            return WOLFSSL_CBIO_ERR_WANT_WRITE;
 239        else if (direction == SOCKET_RECEIVING)
 240            return WOLFSSL_CBIO_ERR_WANT_READ;
 241        else
 242            return WOLFSSL_CBIO_ERR_TIMEOUT;
 243    }
 244#endif /* SOCKET_ETIMEDOUT */
 245
 246    else if (err == SOCKET_ECONNRESET) {
 247        WOLFSSL_MSG("\tConnection reset");
 248        return WOLFSSL_CBIO_ERR_CONN_RST;
 249    }
 250    else if (err == SOCKET_EINTR) {
 251        WOLFSSL_MSG("\tSocket interrupted");
 252        return WOLFSSL_CBIO_ERR_ISR;
 253    }
 254    else if (err == SOCKET_EPIPE) {
 255        WOLFSSL_MSG("\tBroken pipe");
 256        return WOLFSSL_CBIO_ERR_CONN_CLOSE;
 257    }
 258    else if (err == SOCKET_ECONNABORTED) {
 259        WOLFSSL_MSG("\tConnection aborted");
 260        return WOLFSSL_CBIO_ERR_CONN_CLOSE;
 261    }
 262
 263#if defined(_WIN32) && !defined(__WATCOMC__) && !defined(_WIN32_WCE) && \
 264    !defined(INTIME_RTOS)
 265    strcpy_s(errstr, sizeof(errstr), "\tGeneral error: ");
 266    errstr_offset = strlen(errstr);
 267    FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
 268        NULL,
 269        err,
 270        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
 271        (LPSTR)(errstr + errstr_offset),
 272        (DWORD)(sizeof(errstr) - errstr_offset),
 273        NULL);
 274    WOLFSSL_MSG(errstr);
 275#else
 276    WOLFSSL_MSG_EX("\tGeneral error: %d", err);
 277#endif
 278    return WOLFSSL_CBIO_ERR_GENERAL;
 279}
 280#endif /* USE_WOLFSSL_IO || HAVE_HTTP_CLIENT */
 281
 282#ifdef OPENSSL_EXTRA
 283#ifndef NO_BIO
 284
 285int wolfSSL_BioSend(WOLFSSL* ssl, char *buf, int sz, void *ctx)
 286{
 287    return SslBioSend(ssl, buf, sz, ctx);
 288}
 289
 290int wolfSSL_BioReceive(WOLFSSL* ssl, char* buf, int sz, void* ctx)
 291{
 292    return SslBioReceive(ssl, buf, sz, ctx);
 293}
 294
 295int BioReceiveInternal(WOLFSSL_BIO* biord, WOLFSSL_BIO* biowr, char* buf,
 296                       int sz)
 297{
 298    int recvd = WC_NO_ERR_TRACE(WOLFSSL_CBIO_ERR_GENERAL);
 299
 300    WOLFSSL_ENTER("SslBioReceive");
 301
 302    if (biord == NULL) {
 303        WOLFSSL_MSG("WOLFSSL biord not set");
 304        return WOLFSSL_CBIO_ERR_GENERAL;
 305    }
 306
 307    recvd = wolfSSL_BIO_read(biord, buf, sz);
 308    if (recvd <= 0) {
 309        if (biowr != NULL &&
 310            /* ssl->biowr->wrIdx is checked for Bind9 */
 311            wolfSSL_BIO_method_type(biowr) == WOLFSSL_BIO_BIO &&
 312            wolfSSL_BIO_wpending(biowr) != 0 &&
 313            /* Not sure this pending check is necessary but let's double
 314             * check that the read BIO is empty before we signal a write
 315             * need */
 316            wolfSSL_BIO_supports_pending(biord) &&
 317            wolfSSL_BIO_ctrl_pending(biord) == 0) {
 318            /* Let's signal to the app layer that we have
 319             * data pending that needs to be sent. */
 320            return WOLFSSL_CBIO_ERR_WANT_WRITE;
 321        }
 322        else if (biord->type == WOLFSSL_BIO_SOCKET) {
 323            if (recvd == 0) {
 324                WOLFSSL_MSG("SslBioReceive connection closed");
 325                return WOLFSSL_CBIO_ERR_CONN_CLOSE;
 326            }
 327        #ifdef USE_WOLFSSL_IO
 328            recvd = TranslateIoReturnCode(recvd, biord->num.fd,
 329                                          SOCKET_RECEIVING);
 330        #endif
 331            return recvd;
 332        }
 333
 334        /* If retry and read flags are set, return WANT_READ */
 335        if ((biord->flags & WOLFSSL_BIO_FLAG_READ) &&
 336            (biord->flags & WOLFSSL_BIO_FLAG_RETRY)) {
 337            return WOLFSSL_CBIO_ERR_WANT_READ;
 338        }
 339
 340        WOLFSSL_MSG("BIO general error");
 341        return WOLFSSL_CBIO_ERR_GENERAL;
 342    }
 343
 344    return recvd;
 345}
 346
 347/* Use the WOLFSSL read BIO for receiving data. This is set by the function
 348 * wolfSSL_set_bio and can also be set by wolfSSL_CTX_SetIORecv.
 349 *
 350 * ssl  WOLFSSL struct passed in that has this function set as the receive
 351 *      callback.
 352 * buf  buffer to fill with data read
 353 * sz   size of buf buffer
 354 * ctx  a user set context
 355 *
 356 * returns the amount of data read or want read. See WOLFSSL_CBIO_ERR_* values.
 357 */
 358int SslBioReceive(WOLFSSL* ssl, char* buf, int sz, void* ctx)
 359{
 360    WOLFSSL_ENTER("SslBioReceive");
 361    (void)ctx;
 362    return BioReceiveInternal(ssl->biord, ssl->biowr, buf, sz);
 363}
 364
 365
 366/* Use the WOLFSSL write BIO for sending data. This is set by the function
 367 * wolfSSL_set_bio and can also be set by wolfSSL_CTX_SetIOSend.
 368 *
 369 * ssl  WOLFSSL struct passed in that has this function set as the send callback.
 370 * buf  buffer with data to write out
 371 * sz   size of buf buffer
 372 * ctx  a user set context
 373 *
 374 * returns the amount of data sent or want send. See WOLFSSL_CBIO_ERR_* values.
 375 */
 376int SslBioSend(WOLFSSL* ssl, char *buf, int sz, void *ctx)
 377{
 378    int sent = WC_NO_ERR_TRACE(WOLFSSL_CBIO_ERR_GENERAL);
 379
 380    WOLFSSL_ENTER("SslBioSend");
 381
 382    if (ssl->biowr == NULL) {
 383        WOLFSSL_MSG("WOLFSSL biowr not set");
 384        return WOLFSSL_CBIO_ERR_GENERAL;
 385    }
 386
 387    sent = wolfSSL_BIO_write(ssl->biowr, buf, sz);
 388    if (sent <= 0) {
 389        if (ssl->biowr->type == WOLFSSL_BIO_SOCKET) {
 390        #ifdef USE_WOLFSSL_IO
 391            sent = TranslateIoReturnCode(sent, ssl->biowr->num.fd,
 392                                         SOCKET_SENDING);
 393        #endif
 394            return sent;
 395        }
 396        else if (ssl->biowr->type == WOLFSSL_BIO_BIO) {
 397            if (sent == WOLFSSL_BIO_ERROR) {
 398                WOLFSSL_MSG("\tWould Block");
 399                return WOLFSSL_CBIO_ERR_WANT_WRITE;
 400            }
 401        }
 402
 403        /* If retry and write flags are set, return WANT_WRITE */
 404        if ((ssl->biowr->flags & WOLFSSL_BIO_FLAG_WRITE) &&
 405            (ssl->biowr->flags & WOLFSSL_BIO_FLAG_RETRY)) {
 406            return WOLFSSL_CBIO_ERR_WANT_WRITE;
 407        }
 408
 409        return WOLFSSL_CBIO_ERR_GENERAL;
 410    }
 411    (void)ctx;
 412
 413    return sent;
 414}
 415#endif /* !NO_BIO */
 416#endif /* OPENSSL_EXTRA */
 417
 418
 419#ifdef USE_WOLFSSL_IO
 420
 421#ifndef WOLFSSL_DTLS_ONLY
 422/* The receive embedded callback
 423 *  return : nb bytes read, or error
 424 */
 425int EmbedReceive(WOLFSSL *ssl, char *buf, int sz, void *ctx)
 426{
 427    int recvd;
 428#ifndef WOLFSSL_LINUXKM
 429    int sd = *(int*)ctx;
 430#else
 431    struct socket *sd = (struct socket*)ctx;
 432#endif
 433
 434    recvd = wolfIO_Recv(sd, buf, sz, ssl->rflags);
 435    if (recvd < 0) {
 436        WOLFSSL_MSG("Embed Receive error");
 437    }
 438    else if (recvd == 0) {
 439        WOLFSSL_MSG("Embed receive connection closed");
 440        return WOLFSSL_CBIO_ERR_CONN_CLOSE;
 441    }
 442
 443    return recvd;
 444}
 445
 446/* The send embedded callback
 447 *  return : nb bytes sent, or error
 448 */
 449int EmbedSend(WOLFSSL* ssl, char *buf, int sz, void *ctx)
 450{
 451    int sent;
 452#ifndef WOLFSSL_LINUXKM
 453    int sd = *(int*)ctx;
 454#else
 455    struct socket *sd = (struct socket*)ctx;
 456#endif
 457
 458#ifdef WOLFSSL_MAX_SEND_SZ
 459    if (sz > WOLFSSL_MAX_SEND_SZ)
 460        sz = WOLFSSL_MAX_SEND_SZ;
 461#endif
 462
 463    sent = wolfIO_Send(sd, buf, sz, ssl->wflags);
 464    if (sent < 0) {
 465        WOLFSSL_MSG("Embed Send error");
 466    }
 467
 468    return sent;
 469}
 470#endif /* !WOLFSSL_DTLS_ONLY */
 471
 472
 473#ifdef WOLFSSL_DTLS
 474
 475#include <wolfssl/wolfcrypt/sha.h>
 476
 477#if defined(NUCLEUS_PLUS_2_3)
 478STATIC INT32 nucyassl_recv(INT sd, CHAR *buf, UINT16 sz, INT16 flags)
 479{
 480    int recvd;
 481
 482    /* Read data from socket */
 483    recvd = NU_Recv(sd, buf, sz, flags);
 484    if (recvd < 0) {
 485        if (recvd == NU_NOT_CONNECTED) {
 486            recvd = 0;
 487        } else {
 488            Nucleus_Net_Errno = recvd;
 489            recvd = WOLFSSL_FATAL_ERROR;
 490        }
 491    } else {
 492        Nucleus_Net_Errno = 0;
 493    }
 494
 495    return (recvd);
 496}
 497
 498
 499STATIC int nucyassl_send(INT sd, CHAR *buf, UINT16 sz, INT16 flags)
 500{
 501    int sent;
 502
 503    /* Write data to socket */
 504    sent = NU_Send(sd, buf, sz, flags);
 505
 506    if (sent < 0) {
 507        Nucleus_Net_Errno = sent;
 508        sent = WOLFSSL_FATAL_ERROR;
 509    } else {
 510        Nucleus_Net_Errno = 0;
 511    }
 512
 513    return sent;
 514}
 515
 516#define SELECT_FUNCTION     nucyassl_select
 517
 518int nucyassl_select(INT sd, UINT32 timeout)
 519{
 520    FD_SET readfs;
 521    STATUS status;
 522
 523    /* Init fs data for socket */
 524    NU_FD_Init(&readfs);
 525    NU_FD_Set(sd, &readfs);
 526
 527    /* Wait for data to arrive */
 528    status = NU_Select((sd + 1), &readfs, NU_NULL, NU_NULL,
 529                            (timeout * NU_TICKS_PER_SECOND));
 530
 531    if (status < 0) {
 532        Nucleus_Net_Errno = status;
 533        status = WOLFSSL_FATAL_ERROR;
 534    }
 535
 536    return status;
 537}
 538
 539#define sockaddr_storage    addr_struct
 540#define sockaddr            addr_struct
 541
 542STATIC INT32 nucyassl_recvfrom(INT sd, CHAR *buf, UINT16 sz, INT16 flags,
 543                              SOCKADDR *peer, XSOCKLENT *peersz)
 544{
 545    int recvd;
 546
 547    memset(peer, 0, sizeof(struct addr_struct));
 548
 549    recvd = NU_Recv_From(sd, buf, sz, flags, (struct addr_struct *) peer,
 550                            (INT16*) peersz);
 551    if (recvd < 0) {
 552        Nucleus_Net_Errno = recvd;
 553        recvd = WOLFSSL_FATAL_ERROR;
 554    } else {
 555        Nucleus_Net_Errno = 0;
 556    }
 557
 558    return recvd;
 559
 560}
 561
 562STATIC int nucyassl_sendto(INT sd, CHAR *buf, UINT16 sz, INT16 flags,
 563                          const SOCKADDR *peer, INT16 peersz)
 564{
 565    int sent;
 566
 567    sent = NU_Send_To(sd, buf, sz, flags, (const struct addr_struct *) peer,
 568                            peersz);
 569
 570    if (sent < 0) {
 571        Nucleus_Net_Errno = sent;
 572        sent = WOLFSSL_FATAL_ERROR;
 573    } else {
 574        Nucleus_Net_Errno = 0;
 575    }
 576
 577    return sent;
 578}
 579#endif /* NUCLEUS_PLUS_2_3 */
 580
 581#ifndef DTLS_SENDTO_FUNCTION
 582    #define DTLS_SENDTO_FUNCTION sendto
 583#endif
 584#ifndef DTLS_RECVFROM_FUNCTION
 585    #define DTLS_RECVFROM_FUNCTION recvfrom
 586#endif
 587
 588int sockAddrEqual(
 589    SOCKADDR_S *a, XSOCKLENT aLen, SOCKADDR_S *b, XSOCKLENT bLen)
 590{
 591    if (aLen != bLen)
 592        return 0;
 593
 594    if (a->ss_family != b->ss_family)
 595        return 0;
 596
 597    if (a->ss_family == WOLFSSL_IP4) {
 598
 599        if (aLen < (XSOCKLENT)sizeof(SOCKADDR_IN))
 600            return 0;
 601
 602        if (((SOCKADDR_IN*)a)->sin_port != ((SOCKADDR_IN*)b)->sin_port)
 603            return 0;
 604
 605        if (((SOCKADDR_IN*)a)->sin_addr.s_addr !=
 606            ((SOCKADDR_IN*)b)->sin_addr.s_addr)
 607            return 0;
 608
 609        return 1;
 610    }
 611
 612#ifdef WOLFSSL_IPV6
 613    if (a->ss_family == WOLFSSL_IP6) {
 614        SOCKADDR_IN6 *a6, *b6;
 615
 616        if (aLen < (XSOCKLENT)sizeof(SOCKADDR_IN6))
 617            return 0;
 618
 619        a6 = (SOCKADDR_IN6*)a;
 620        b6 = (SOCKADDR_IN6*)b;
 621
 622        if (((SOCKADDR_IN6*)a)->sin6_port != ((SOCKADDR_IN6*)b)->sin6_port)
 623            return 0;
 624
 625        if (XMEMCMP((void*)&a6->sin6_addr, (void*)&b6->sin6_addr,
 626                sizeof(a6->sin6_addr)) != 0)
 627            return 0;
 628
 629        return 1;
 630    }
 631#endif /* WOLFSSL_IPV6 */
 632
 633    return 0;
 634}
 635
 636#ifndef WOLFSSL_IPV6
 637static int PeerIsIpv6(const SOCKADDR_S *peer, XSOCKLENT len)
 638{
 639    if (len < (XSOCKLENT)sizeof(peer->ss_family))
 640        return 0;
 641    return peer->ss_family == WOLFSSL_IP6;
 642}
 643#endif /* !WOLFSSL_IPV6 */
 644
 645static int isDGramSock(int sfd)
 646{
 647    int type = 0;
 648    /* optvalue 'type' is of size int */
 649    XSOCKLENT length = (XSOCKLENT)sizeof(type);
 650
 651    if (getsockopt(sfd, SOL_SOCKET, SO_TYPE, (XSOCKOPT_TYPE_OPTVAL_TYPE)&type,
 652            &length) == 0 && type != SOCK_DGRAM) {
 653        return 0;
 654    }
 655    else {
 656        return 1;
 657    }
 658}
 659
 660void wolfSSL_SetRecvFrom(WOLFSSL* ssl, WolfSSLRecvFrom recvFrom)
 661{
 662    if (ssl != NULL)
 663        ssl->buffers.dtlsCtx.recvfrom = recvFrom;
 664}
 665
 666void wolfSSL_SetSendTo(WOLFSSL* ssl, WolfSSLSento sendTo)
 667{
 668    if (ssl != NULL)
 669        ssl->buffers.dtlsCtx.sendto = sendTo;
 670}
 671
 672/* The receive embedded callback
 673 *  return : nb bytes read, or error
 674 */
 675int EmbedReceiveFrom(WOLFSSL *ssl, char *buf, int sz, void *ctx)
 676{
 677    WOLFSSL_DTLS_CTX* dtlsCtx = (WOLFSSL_DTLS_CTX*)ctx;
 678    int recvd;
 679    int sd = dtlsCtx->rfd;
 680    int dtls_timeout = wolfSSL_dtls_get_current_timeout(ssl);
 681    byte doDtlsTimeout;
 682    SOCKADDR_S lclPeer;
 683    SOCKADDR_S* peer;
 684    XSOCKLENT peerSz = 0;
 685#ifndef NO_ASN_TIME
 686    word32 start = 0;
 687#elif !defined(DTLS_RECEIVEFROM_NO_TIMEOUT_ON_INVALID_PEER)
 688    word32 invalidPeerPackets = 0;
 689#endif
 690    int newPeer = 0;
 691    int ret = 0;
 692
 693    WOLFSSL_ENTER("EmbedReceiveFrom");
 694    (void)ret; /* possibly unused */
 695
 696    if (sz < 0)
 697        return WOLFSSL_CBIO_ERR_GENERAL;
 698
 699    XMEMSET(&lclPeer, 0, sizeof(lclPeer));
 700
 701#ifdef WOLFSSL_RW_THREADED
 702    if (wc_LockRwLock_Rd(&ssl->buffers.dtlsCtx.peerLock) != 0)
 703        return WOLFSSL_CBIO_ERR_GENERAL;
 704#endif
 705
 706    if (dtlsCtx->connected) {
 707        peer = NULL;
 708    }
 709    else if (dtlsCtx->userSet) {
 710#ifndef WOLFSSL_IPV6
 711        if (PeerIsIpv6((SOCKADDR_S*)dtlsCtx->peer.sa, dtlsCtx->peer.sz)) {
 712            WOLFSSL_MSG("ipv6 dtls peer set but no ipv6 support compiled");
 713            ret = WOLFSSL_CBIO_ERR_GENERAL;
 714        }
 715#endif
 716        peer = &lclPeer;
 717        peerSz = sizeof(lclPeer);
 718    }
 719    else {
 720        /* Store the peer address. It is used to calculate the DTLS cookie. */
 721        newPeer = dtlsCtx->peer.sa == NULL || !ssl->options.dtlsStateful;
 722        peer = &lclPeer;
 723        peerSz = sizeof(lclPeer);
 724    }
 725
 726#ifdef WOLFSSL_RW_THREADED
 727    /* We make a copy above to avoid holding the lock for the entire function */
 728    if (wc_UnLockRwLock(&ssl->buffers.dtlsCtx.peerLock) != 0)
 729        return WOLFSSL_CBIO_ERR_GENERAL;
 730#endif
 731
 732    if (ret != 0)
 733        return ret;
 734
 735    /* Don't use ssl->options.handShakeDone since it is true even if
 736     * we are in the process of renegotiation */
 737    doDtlsTimeout = ssl->options.handShakeState != HANDSHAKE_DONE;
 738
 739#ifdef WOLFSSL_DTLS13
 740    if (ssl->options.dtls && IsAtLeastTLSv1_3(ssl->version)) {
 741        doDtlsTimeout = doDtlsTimeout || ssl->dtls13Rtx.rtxRecords != NULL;
 742#ifdef WOLFSSL_RW_THREADED
 743        ret = wc_LockMutex(&ssl->dtls13Rtx.mutex);
 744        if (ret != 0)
 745            return ret;
 746#endif
 747        doDtlsTimeout = doDtlsTimeout ||
 748            (ssl->dtls13FastTimeout && ssl->dtls13Rtx.seenRecords != NULL);
 749#ifdef WOLFSSL_RW_THREADED
 750        wc_UnLockMutex(&ssl->dtls13Rtx.mutex);
 751#endif
 752    }
 753#endif /* WOLFSSL_DTLS13 */
 754
 755    do {
 756
 757        if (!doDtlsTimeout) {
 758            dtls_timeout = 0;
 759        }
 760        else {
 761#ifndef NO_ASN_TIME
 762            if (start == 0) {
 763                start = LowResTimer();
 764            }
 765            else {
 766                dtls_timeout -= (int) (LowResTimer() - start);
 767                start = LowResTimer();
 768                if (dtls_timeout < 0 || dtls_timeout > DTLS_TIMEOUT_MAX)
 769                    return WOLFSSL_CBIO_ERR_TIMEOUT;
 770            }
 771#endif
 772        }
 773
 774        if (!wolfSSL_get_using_nonblock(ssl)) {
 775        #ifdef USE_WINDOWS_API
 776            DWORD timeout = dtls_timeout * 1000;
 777            #ifdef WOLFSSL_DTLS13
 778            if (wolfSSL_dtls13_use_quick_timeout(ssl) &&
 779                IsAtLeastTLSv1_3(ssl->version))
 780                timeout /= 4;
 781            #endif /* WOLFSSL_DTLS13 */
 782        #else
 783            struct timeval timeout;
 784            XMEMSET(&timeout, 0, sizeof(timeout));
 785            #ifdef WOLFSSL_DTLS13
 786            if (wolfSSL_dtls13_use_quick_timeout(ssl) &&
 787                IsAtLeastTLSv1_3(ssl->version)) {
 788                if (dtls_timeout >= 4)
 789                    timeout.tv_sec = dtls_timeout / 4;
 790                else
 791                    timeout.tv_usec = dtls_timeout * 1000000 / 4;
 792            }
 793            else
 794            #endif /* WOLFSSL_DTLS13 */
 795                timeout.tv_sec = dtls_timeout;
 796        #endif /* USE_WINDOWS_API */
 797            if (setsockopt(sd, SOL_SOCKET, SO_RCVTIMEO, (char*)&timeout,
 798                    sizeof(timeout)) != 0) {
 799                WOLFSSL_MSG("setsockopt rcvtimeo failed");
 800            }
 801        }
 802#ifndef NO_ASN_TIME
 803        else if (IsSCR(ssl)) {
 804            if (ssl->dtls_start_timeout &&
 805                LowResTimer() - ssl->dtls_start_timeout >
 806                    (word32)dtls_timeout) {
 807                ssl->dtls_start_timeout = 0;
 808                return WOLFSSL_CBIO_ERR_TIMEOUT;
 809            }
 810            else if (!ssl->dtls_start_timeout) {
 811                ssl->dtls_start_timeout = LowResTimer();
 812            }
 813        }
 814#endif /* !NO_ASN_TIME */
 815
 816        {
 817            XSOCKLENT inPeerSz = peerSz;
 818            if (dtlsCtx->recvfrom == NULL) {
 819                recvd = (int)DTLS_RECVFROM_FUNCTION(sd, buf, (size_t)sz,
 820                        ssl->rflags, (SOCKADDR*)peer,
 821                        peer != NULL ? &inPeerSz : NULL);
 822            }
 823            else {
 824                recvd = (int)dtlsCtx->recvfrom(sd, buf, (size_t) sz,
 825                        ssl->rflags, (SOCKADDR*) peer,
 826                        peer != NULL ? &inPeerSz : NULL);
 827            }
 828            /* Truncate peerSz. From the RECV(2) man page
 829             * The returned address is truncated if the buffer provided is too
 830             * small; in this case, addrlen will return a value greater than was
 831             * supplied to the call.
 832             */
 833            peerSz = MIN(peerSz, inPeerSz);
 834        }
 835
 836        recvd = TranslateIoReturnCode(recvd, sd, SOCKET_RECEIVING);
 837
 838        if (recvd < 0) {
 839            WOLFSSL_MSG("Embed Receive From error");
 840            if (recvd == WC_NO_ERR_TRACE(WOLFSSL_CBIO_ERR_WANT_READ) &&
 841                !wolfSSL_dtls_get_using_nonblock(ssl)) {
 842                recvd = WOLFSSL_CBIO_ERR_TIMEOUT;
 843            }
 844            return recvd;
 845        }
 846        else if (recvd == 0) {
 847            if (!isDGramSock(sd)) {
 848                /* Closed TCP connection */
 849                recvd = WOLFSSL_CBIO_ERR_CONN_CLOSE;
 850            }
 851            else {
 852                WOLFSSL_MSG("Ignoring 0-length datagram");
 853                continue;
 854            }
 855            return recvd;
 856        }
 857        else if (dtlsCtx->connected) {
 858            /* Nothing to do */
 859        }
 860        else if (dtlsCtx->userSet) {
 861            /* Check we received the packet from the correct peer */
 862            int ignore = 0;
 863#ifdef WOLFSSL_RW_THREADED
 864            if (wc_LockRwLock_Rd(&ssl->buffers.dtlsCtx.peerLock) != 0)
 865                return WOLFSSL_CBIO_ERR_GENERAL;
 866#endif
 867            if (dtlsCtx->peer.sz > 0 &&
 868                (peerSz != (XSOCKLENT)dtlsCtx->peer.sz ||
 869                    !sockAddrEqual(peer, peerSz, (SOCKADDR_S*)dtlsCtx->peer.sa,
 870                        dtlsCtx->peer.sz))) {
 871                WOLFSSL_MSG("    Ignored packet from invalid peer");
 872                ignore = 1;
 873            }
 874#ifdef WOLFSSL_RW_THREADED
 875            if (wc_UnLockRwLock(&ssl->buffers.dtlsCtx.peerLock) != 0)
 876                return WOLFSSL_CBIO_ERR_GENERAL;
 877#endif
 878            if (ignore) {
 879#if defined(NO_ASN_TIME) &&                                                    \
 880    !defined(DTLS_RECEIVEFROM_NO_TIMEOUT_ON_INVALID_PEER)
 881                if (doDtlsTimeout) {
 882                    invalidPeerPackets++;
 883                    if (invalidPeerPackets > DTLS_RECEIVEFROM_MAX_INVALID_PEER)
 884                        return wolfSSL_dtls_get_using_nonblock(ssl)
 885                                   ? WOLFSSL_CBIO_ERR_WANT_READ
 886                                   : WOLFSSL_CBIO_ERR_TIMEOUT;
 887                }
 888#endif /* NO_ASN_TIME && !DTLS_RECEIVEFROM_NO_TIMEOUT_ON_INVALID_PEER */
 889                continue;
 890            }
 891        }
 892        else {
 893            if (newPeer) {
 894                /* Store size of saved address. Locking handled internally. */
 895                if (wolfSSL_dtls_set_peer(ssl, peer, peerSz) != WOLFSSL_SUCCESS)
 896                    return WOLFSSL_CBIO_ERR_GENERAL;
 897                dtlsCtx->userSet = 0;
 898            }
 899#ifndef WOLFSSL_PEER_ADDRESS_CHANGES
 900            else {
 901                ret = 0;
 902    #ifdef WOLFSSL_RW_THREADED
 903                if (wc_LockRwLock_Rd(&ssl->buffers.dtlsCtx.peerLock) != 0)
 904                    return WOLFSSL_CBIO_ERR_GENERAL;
 905    #endif /* WOLFSSL_RW_THREADED */
 906                if (!sockAddrEqual(peer, peerSz, (SOCKADDR_S*)dtlsCtx->peer.sa,
 907                                    dtlsCtx->peer.sz)) {
 908                    ret = WOLFSSL_CBIO_ERR_GENERAL;
 909                }
 910    #ifdef WOLFSSL_RW_THREADED
 911                if (wc_UnLockRwLock(&ssl->buffers.dtlsCtx.peerLock) != 0)
 912                    return WOLFSSL_CBIO_ERR_GENERAL;
 913    #endif /* WOLFSSL_RW_THREADED */
 914                if (ret != 0)
 915                    return ret;
 916            }
 917#endif /* !WOLFSSL_PEER_ADDRESS_CHANGES */
 918        }
 919#ifndef NO_ASN_TIME
 920        ssl->dtls_start_timeout = 0;
 921#endif /* !NO_ASN_TIME */
 922        break;
 923    } while (1);
 924
 925    return recvd;
 926}
 927
 928
 929/* The send embedded callback
 930 *  return : nb bytes sent, or error
 931 */
 932int EmbedSendTo(WOLFSSL* ssl, char *buf, int sz, void *ctx)
 933{
 934    WOLFSSL_DTLS_CTX* dtlsCtx = (WOLFSSL_DTLS_CTX*)ctx;
 935    int sd = dtlsCtx->wfd;
 936    int sent;
 937    const SOCKADDR_S* peer = NULL;
 938    XSOCKLENT peerSz = 0;
 939
 940    WOLFSSL_ENTER("EmbedSendTo");
 941
 942    if (sz < 0)
 943        return WOLFSSL_CBIO_ERR_GENERAL;
 944
 945    if (!isDGramSock(sd)) {
 946        /* Probably a TCP socket. peer and peerSz MUST be NULL and 0 */
 947    }
 948    else if (!dtlsCtx->connected) {
 949        peer   = (const SOCKADDR_S*)dtlsCtx->peer.sa;
 950        peerSz = dtlsCtx->peer.sz;
 951#ifndef WOLFSSL_IPV6
 952        if (PeerIsIpv6(peer, peerSz)) {
 953            WOLFSSL_MSG("ipv6 dtls peer set but no ipv6 support compiled");
 954            return NOT_COMPILED_IN;
 955        }
 956#endif
 957    }
 958
 959    if (dtlsCtx->sendto == NULL) {
 960        sent = (int)DTLS_SENDTO_FUNCTION(sd, buf, (size_t)sz, ssl->wflags,
 961                (const SOCKADDR*)peer, peerSz);
 962    }
 963    else {
 964        sent = (int)dtlsCtx->sendto(sd, buf, (size_t)sz, ssl->wflags,
 965                (const SOCKADDR*)peer, peerSz);
 966    }
 967
 968    sent = TranslateIoReturnCode(sent, sd, SOCKET_SENDING);
 969
 970    if (sent < 0) {
 971        WOLFSSL_MSG("Embed Send To error");
 972    }
 973
 974    return sent;
 975}
 976
 977
 978#ifdef WOLFSSL_MULTICAST
 979
 980/* The alternate receive embedded callback for Multicast
 981 *  return : nb bytes read, or error
 982 */
 983int EmbedReceiveFromMcast(WOLFSSL *ssl, char *buf, int sz, void *ctx)
 984{
 985    WOLFSSL_DTLS_CTX* dtlsCtx = (WOLFSSL_DTLS_CTX*)ctx;
 986    int recvd;
 987    int sd = dtlsCtx->rfd;
 988
 989    WOLFSSL_ENTER("EmbedReceiveFromMcast");
 990
 991    if (sz < 0)
 992        return WOLFSSL_CBIO_ERR_GENERAL;
 993
 994    recvd = (int)DTLS_RECVFROM_FUNCTION(sd, buf, (size_t)sz, ssl->rflags, NULL, NULL);
 995
 996    recvd = TranslateIoReturnCode(recvd, sd, SOCKET_RECEIVING);
 997
 998    if (recvd < 0) {
 999        WOLFSSL_MSG("Embed Receive From error");
1000        if (recvd == WC_NO_ERR_TRACE(WOLFSSL_CBIO_ERR_WANT_READ) &&
1001            !wolfSSL_dtls_get_using_nonblock(ssl)) {
1002            recvd = WOLFSSL_CBIO_ERR_TIMEOUT;
1003        }
1004    }
1005
1006    return recvd;
1007}
1008#endif /* WOLFSSL_MULTICAST */
1009
1010
1011/* The DTLS Generate Cookie callback
1012 *  return : number of bytes copied into buf, or error
1013 */
1014int EmbedGenerateCookie(WOLFSSL* ssl, byte *buf, int sz, void *ctx)
1015{
1016    int sd = ssl->wfd;
1017    SOCKADDR_S peer;
1018    XSOCKLENT peerSz = sizeof(peer);
1019    byte digest[WC_SHA256_DIGEST_SIZE];
1020    int  ret = 0;
1021
1022    (void)ctx;
1023
1024    if (sz < 0)
1025        return BAD_FUNC_ARG;
1026
1027    XMEMSET(&peer, 0, sizeof(peer));
1028    if (getpeername(sd, (SOCKADDR*)&peer, &peerSz) != 0) {
1029        WOLFSSL_MSG("getpeername failed in EmbedGenerateCookie");
1030        return GEN_COOKIE_E;
1031    }
1032
1033    ret = wc_Sha256Hash((byte*)&peer, peerSz, digest);
1034    if (ret != 0)
1035        return ret;
1036
1037    if (sz > WC_SHA256_DIGEST_SIZE)
1038        sz = WC_SHA256_DIGEST_SIZE;
1039    XMEMCPY(buf, digest, (size_t)sz);
1040
1041    return sz;
1042}
1043#endif /* WOLFSSL_DTLS */
1044
1045#ifdef WOLFSSL_SESSION_EXPORT
1046
1047#ifdef WOLFSSL_DTLS
1048    static int EmbedGetPeerDTLS(WOLFSSL* ssl, char* ip, int* ipSz,
1049                                                 unsigned short* port, int* fam)
1050    {
1051        SOCKADDR_S peer;
1052        word32     peerSz;
1053        int        ret;
1054
1055        /* get peer information stored in ssl struct */
1056        peerSz = sizeof(SOCKADDR_S);
1057        if ((ret = wolfSSL_dtls_get_peer(ssl, (void*)&peer, &peerSz))
1058                                                               != WOLFSSL_SUCCESS) {
1059            return ret;
1060        }
1061
1062        /* extract family, ip, and port */
1063        *fam = ((SOCKADDR_S*)&peer)->ss_family;
1064        switch (*fam) {
1065            case WOLFSSL_IP4:
1066                if (XINET_NTOP(*fam, &(((SOCKADDR_IN*)&peer)->sin_addr),
1067                                                           ip, *ipSz) == NULL) {
1068                    WOLFSSL_MSG("XINET_NTOP error");
1069                    return SOCKET_ERROR_E;
1070                }
1071                *port = XNTOHS(((SOCKADDR_IN*)&peer)->sin_port);
1072                break;
1073
1074            case WOLFSSL_IP6:
1075            #ifdef WOLFSSL_IPV6
1076                if (XINET_NTOP(*fam, &(((SOCKADDR_IN6*)&peer)->sin6_addr),
1077                                                           ip, *ipSz) == NULL) {
1078                    WOLFSSL_MSG("XINET_NTOP error");
1079                    return SOCKET_ERROR_E;
1080                }
1081                *port = XNTOHS(((SOCKADDR_IN6*)&peer)->sin6_port);
1082            #endif /* WOLFSSL_IPV6 */
1083                break;
1084
1085            default:
1086                WOLFSSL_MSG("Unknown family type");
1087                return SOCKET_ERROR_E;
1088        }
1089        ip[*ipSz - 1] = '\0'; /* make sure has terminator */
1090        *ipSz = (word16)XSTRLEN(ip);
1091
1092        return WOLFSSL_SUCCESS;
1093    }
1094
1095    static int EmbedSetPeerDTLS(WOLFSSL* ssl, char* ip, int ipSz,
1096                                                   unsigned short port, int fam)
1097    {
1098        int    ret;
1099        SOCKADDR_S addr;
1100
1101        /* sanity checks on arguments */
1102        if (ssl == NULL || ip == NULL || ipSz < 0 || ipSz > MAX_EXPORT_IP) {
1103            return BAD_FUNC_ARG;
1104        }
1105
1106        addr.ss_family = fam;
1107        switch (addr.ss_family) {
1108            case WOLFSSL_IP4:
1109                if (XINET_PTON(addr.ss_family, ip,
1110                                     &(((SOCKADDR_IN*)&addr)->sin_addr)) <= 0) {
1111                    WOLFSSL_MSG("XINET_PTON error");
1112                    return SOCKET_ERROR_E;
1113                }
1114                ((SOCKADDR_IN*)&addr)->sin_port = XHTONS(port);
1115
1116                /* peer sa is free'd in wolfSSL_ResourceFree */
1117                if ((ret = wolfSSL_dtls_set_peer(ssl, (SOCKADDR_IN*)&addr,
1118                                          sizeof(SOCKADDR_IN)))!= WOLFSSL_SUCCESS) {
1119                    WOLFSSL_MSG("Import DTLS peer info error");
1120                    return ret;
1121                }
1122                break;
1123
1124            case WOLFSSL_IP6:
1125            #ifdef WOLFSSL_IPV6
1126                if (XINET_PTON(addr.ss_family, ip,
1127                                   &(((SOCKADDR_IN6*)&addr)->sin6_addr)) <= 0) {
1128                    WOLFSSL_MSG("XINET_PTON error");
1129                    return SOCKET_ERROR_E;
1130                }
1131                ((SOCKADDR_IN6*)&addr)->sin6_port = XHTONS(port);
1132
1133                /* peer sa is free'd in wolfSSL_ResourceFree */
1134                if ((ret = wolfSSL_dtls_set_peer(ssl, (SOCKADDR_IN6*)&addr,
1135                                         sizeof(SOCKADDR_IN6)))!= WOLFSSL_SUCCESS) {
1136                    WOLFSSL_MSG("Import DTLS peer info error");
1137                    return ret;
1138                }
1139            #endif /* WOLFSSL_IPV6 */
1140                break;
1141
1142            default:
1143                WOLFSSL_MSG("Unknown address family");
1144                return BUFFER_E;
1145        }
1146
1147        return WOLFSSL_SUCCESS;
1148    }
1149#endif /* WOLFSSL_DTLS */
1150
1151    /* get the peer information in human readable form (ip, port, family)
1152     * default function assumes BSD sockets
1153     * can be overridden with wolfSSL_CTX_SetIOGetPeer
1154     */
1155    int EmbedGetPeer(WOLFSSL* ssl, char* ip, int* ipSz,
1156                                                 unsigned short* port, int* fam)
1157    {
1158        if (ssl == NULL || ip == NULL || ipSz == NULL ||
1159                                                  port == NULL || fam == NULL) {
1160            return BAD_FUNC_ARG;
1161        }
1162
1163        if (ssl->options.dtls) {
1164        #ifdef WOLFSSL_DTLS
1165            return EmbedGetPeerDTLS(ssl, ip, ipSz, port, fam);
1166        #else
1167            return NOT_COMPILED_IN;
1168        #endif
1169        }
1170        else {
1171            *port = wolfSSL_get_fd(ssl);
1172            ip[0] = '\0';
1173            *ipSz = 0;
1174            *fam  = 0;
1175            return WOLFSSL_SUCCESS;
1176        }
1177    }
1178
1179    /* set the peer information in human readable form (ip, port, family)
1180     * default function assumes BSD sockets
1181     * can be overridden with wolfSSL_CTX_SetIOSetPeer
1182     */
1183    int EmbedSetPeer(WOLFSSL* ssl, char* ip, int ipSz,
1184                                                   unsigned short port, int fam)
1185    {
1186        /* sanity checks on arguments */
1187        if (ssl == NULL || ip == NULL || ipSz < 0 || ipSz > MAX_EXPORT_IP) {
1188            return BAD_FUNC_ARG;
1189        }
1190
1191        if (ssl->options.dtls) {
1192        #ifdef WOLFSSL_DTLS
1193            return EmbedSetPeerDTLS(ssl, ip, ipSz, port, fam);
1194        #else
1195            return NOT_COMPILED_IN;
1196        #endif
1197        }
1198        else {
1199            wolfSSL_set_fd(ssl, port);
1200            (void)fam;
1201            return WOLFSSL_SUCCESS;
1202        }
1203    }
1204#endif /* WOLFSSL_SESSION_EXPORT */
1205
1206#ifdef WOLFSSL_LINUXKM
1207static int linuxkm_send(struct socket *socket, void *buf, int size,
1208    unsigned int flags)
1209{
1210    size_t len;
1211    int ret;
1212    struct kvec vec;
1213    struct msghdr msg = { .msg_flags = flags };
1214
1215    if (size < 0)
1216        return -EINVAL;
1217    if (size == 0)
1218        return 0;
1219
1220    len = (size_t)size;
1221    vec.iov_base = buf;
1222    vec.iov_len  = len;
1223
1224    ret = kernel_sendmsg(socket, &msg, &vec, 1, len);
1225    return ret;
1226}
1227
1228static int linuxkm_recv(struct socket *socket, void *buf, int size,
1229    unsigned int flags)
1230{
1231    size_t len;
1232    int ret;
1233    struct kvec vec;
1234    struct msghdr msg = { .msg_flags = flags };
1235
1236    if (size < 0)
1237        return -EINVAL;
1238    if (size == 0)
1239        return 0;
1240
1241    len = (size_t)size;
1242    vec.iov_base = buf;
1243    vec.iov_len  = len;
1244
1245    ret = kernel_recvmsg(socket, &msg, &vec, 1, len, msg.msg_flags);
1246    return ret;
1247}
1248#endif /* WOLFSSL_LINUXKM */
1249
1250
1251int wolfIO_Recv(SOCKET_T sd, char *buf, int sz, int rdFlags)
1252{
1253    int recvd;
1254
1255    if (sz < 0)
1256        return WOLFSSL_CBIO_ERR_GENERAL;
1257
1258    recvd = (int)RECV_FUNCTION(sd, buf, (size_t)sz, rdFlags);
1259    recvd = TranslateIoReturnCode(recvd, sd, SOCKET_RECEIVING);
1260
1261    return recvd;
1262}
1263
1264int wolfIO_Send(SOCKET_T sd, char *buf, int sz, int wrFlags)
1265{
1266    int sent;
1267
1268    if (sz < 0)
1269        return WOLFSSL_CBIO_ERR_GENERAL;
1270
1271    sent = (int)SEND_FUNCTION(sd, buf, (size_t)sz, wrFlags);
1272    sent = TranslateIoReturnCode(sent, sd, SOCKET_SENDING);
1273
1274    return sent;
1275}
1276
1277#if defined(WOLFSSL_HAVE_BIO_ADDR) && defined(WOLFSSL_DTLS) && defined(OPENSSL_EXTRA)
1278
1279int wolfIO_RecvFrom(SOCKET_T sd, WOLFSSL_BIO_ADDR *addr, char *buf, int sz, int rdFlags)
1280{
1281    int recvd;
1282    socklen_t addr_len = (socklen_t)sizeof(*addr);
1283
1284    if (sz < 0)
1285        return WOLFSSL_CBIO_ERR_GENERAL;
1286
1287    recvd = (int)DTLS_RECVFROM_FUNCTION(sd, buf, (size_t)sz, rdFlags,
1288                                            addr ? &addr->sa : NULL,
1289                                            addr ? &addr_len : 0);
1290    recvd = TranslateIoReturnCode(recvd, sd, SOCKET_RECEIVING);
1291
1292    return recvd;
1293}
1294
1295int wolfIO_SendTo(SOCKET_T sd, WOLFSSL_BIO_ADDR *addr, char *buf, int sz, int wrFlags)
1296{
1297    int sent;
1298    socklen_t addr_len = addr ? wolfSSL_BIO_ADDR_size(addr) : 0;
1299
1300    if (sz < 0)
1301        return WOLFSSL_CBIO_ERR_GENERAL;
1302
1303    sent = (int)DTLS_SENDTO_FUNCTION(sd, buf, (size_t)sz, wrFlags,
1304                                         addr ? &addr->sa : NULL,
1305                                         addr_len);
1306    sent = TranslateIoReturnCode(sent, sd, SOCKET_SENDING);
1307
1308    return sent;
1309}
1310
1311#endif /* WOLFSSL_HAVE_BIO_ADDR && WOLFSSL_DTLS && OPENSSL_EXTRA */
1312
1313#endif /* USE_WOLFSSL_IO */
1314
1315
1316#ifdef HAVE_HTTP_CLIENT
1317
1318#ifndef HAVE_IO_TIMEOUT
1319    #define io_timeout_sec 0
1320#else
1321
1322    #ifndef DEFAULT_TIMEOUT_SEC
1323        #define DEFAULT_TIMEOUT_SEC 0 /* no timeout */
1324    #endif
1325
1326    static int io_timeout_sec = DEFAULT_TIMEOUT_SEC;
1327
1328    void wolfIO_SetTimeout(int to_sec)
1329    {
1330        io_timeout_sec = to_sec;
1331    }
1332
1333    int wolfIO_SetBlockingMode(SOCKET_T sockfd, int non_blocking)
1334    {
1335        int ret = 0;
1336
1337    #ifdef USE_WINDOWS_API
1338        unsigned long blocking = non_blocking;
1339        ret = ioctlsocket(sockfd, FIONBIO, &blocking);
1340        if (ret == SOCKET_ERROR)
1341            ret = WOLFSSL_FATAL_ERROR;
1342    #elif defined(__WATCOMC__) && defined(__OS2__)
1343        if (ioctl(sockfd, FIONBIO, &non_blocking) == -1)
1344            ret = WOLFSSL_FATAL_ERROR;
1345    #else
1346        ret = fcntl(sockfd, F_GETFL, 0);
1347        if (ret >= 0) {
1348            if (non_blocking)
1349                ret |= O_NONBLOCK;
1350            else
1351                ret &= ~O_NONBLOCK;
1352            ret = fcntl(sockfd, F_SETFL, ret);
1353        }
1354    #endif
1355        if (ret < 0) {
1356            WOLFSSL_MSG("wolfIO_SetBlockingMode failed");
1357        }
1358
1359        return ret;
1360    }
1361
1362    int wolfIO_Select(SOCKET_T sockfd, int to_sec)
1363    {
1364        fd_set rfds, wfds;
1365        int nfds = 0;
1366        struct timeval timeout = { (to_sec > 0) ? to_sec : 0, 0};
1367        int ret;
1368
1369    #ifndef USE_WINDOWS_API
1370        nfds = (int)sockfd + 1;
1371
1372        if ((sockfd < 0) || (sockfd >= FD_SETSIZE)) {
1373            WOLFSSL_MSG("socket fd out of FDSET range");
1374            return WOLFSSL_FATAL_ERROR;
1375        }
1376    #endif
1377
1378        FD_ZERO(&rfds);
1379        FD_SET(sockfd, &rfds);
1380        wfds = rfds;
1381
1382        ret = select(nfds, &rfds, &wfds, NULL, &timeout);
1383        if (ret == 0) {
1384    #ifdef DEBUG_HTTP
1385            fprintf(stderr, "Timeout: %d\n", ret);
1386    #endif
1387            return HTTP_TIMEOUT;
1388        }
1389        else if (ret > 0) {
1390            if (FD_ISSET(sockfd, &wfds)) {
1391                if (!FD_ISSET(sockfd, &rfds)) {
1392                    return 0;
1393                }
1394            }
1395        }
1396
1397        WOLFSSL_MSG("Select error");
1398        return SOCKET_ERROR_E;
1399    }
1400#endif /* HAVE_IO_TIMEOUT */
1401
1402static word32 wolfIO_Word16ToString(char* d, word16 number)
1403{
1404    word32 i = 0;
1405    word16 order = 10000;
1406    word16 digit;
1407
1408    if (d == NULL)
1409        return i;
1410
1411    if (number == 0)
1412        d[i++] = '0';
1413    else {
1414        while (order) {
1415            digit = number / order;
1416            if (i > 0 || digit != 0)
1417                d[i++] = (char)digit + '0';
1418            if (digit != 0)
1419                number = (word16) (number % (digit * order));
1420
1421            order = (order > 1) ? order / 10 : 0;
1422        }
1423    }
1424    d[i] = 0; /* null terminate */
1425
1426    return i;
1427}
1428
1429int wolfIO_TcpConnect(SOCKET_T* sockfd, const char* ip, word16 port, int to_sec)
1430{
1431#ifdef HAVE_SOCKADDR
1432    int ret = 0;
1433    SOCKADDR_S addr;
1434    socklen_t sockaddr_len;
1435#if defined(HAVE_GETADDRINFO)
1436    /* use getaddrinfo */
1437    ADDRINFO hints;
1438    ADDRINFO* answer = NULL;
1439    char strPort[6];
1440#else
1441    /* use gethostbyname */
1442#if defined(__GLIBC__) && (__GLIBC__ >= 2) && defined(__USE_MISC) && \
1443    !defined(SINGLE_THREADED)
1444    HOSTENT entry_buf, *entry = NULL;
1445    char *ghbn_r_buf = NULL;
1446    int ghbn_r_errno;
1447#else
1448    HOSTENT *entry;
1449#endif
1450#ifdef WOLFSSL_IPV6
1451    SOCKADDR_IN6 *sin;
1452#else
1453    SOCKADDR_IN *sin;
1454#endif /* WOLFSSL_IPV6 */
1455#endif /* HAVE_GETADDRINFO */
1456
1457    if (sockfd == NULL || ip == NULL) {
1458        return WOLFSSL_FATAL_ERROR;
1459    }
1460
1461#if !defined(HAVE_GETADDRINFO)
1462#ifdef WOLFSSL_IPV6
1463    sockaddr_len = sizeof(SOCKADDR_IN6);
1464#else
1465    sockaddr_len = sizeof(SOCKADDR_IN);
1466#endif /* WOLFSSL_IPV6 */
1467#endif /* !HAVE_GETADDRINFO */
1468    XMEMSET(&addr, 0, sizeof(addr));
1469
1470#ifdef WOLFIO_DEBUG
1471    printf("TCP Connect: %s:%d\n", ip, port);
1472#endif
1473
1474    /* use gethostbyname for c99 */
1475#if defined(HAVE_GETADDRINFO)
1476    XMEMSET(&hints, 0, sizeof(hints));
1477#ifdef WOLFSSL_IPV6
1478    hints.ai_family = AF_UNSPEC; /* detect IPv4 or IPv6 */
1479#else
1480    hints.ai_family = AF_INET;   /* detect only IPv4 */
1481#endif
1482    hints.ai_socktype = SOCK_STREAM;
1483    hints.ai_protocol = IPPROTO_TCP;
1484
1485    if (wolfIO_Word16ToString(strPort, port) == 0) {
1486        WOLFSSL_MSG("invalid port number for responder");
1487        return WOLFSSL_FATAL_ERROR;
1488    }
1489
1490    if (getaddrinfo(ip, strPort, &hints, &answer) < 0 || answer == NULL) {
1491        WOLFSSL_MSG("no addr info for responder");
1492        return WOLFSSL_FATAL_ERROR;
1493    }
1494
1495    sockaddr_len = answer->ai_addrlen;
1496    XMEMCPY(&addr, answer->ai_addr, (size_t)sockaddr_len);
1497    freeaddrinfo(answer);
1498#else
1499#if defined(__GLIBC__) && (__GLIBC__ >= 2) && defined(__USE_MISC) && \
1500    !defined(SINGLE_THREADED)
1501    /* 2048 is a magic number that empirically works.  the header and
1502     * documentation provide no guidance on appropriate buffer size other than
1503     * "if buf is too small, the functions will return ERANGE, and the call
1504     * should be retried with a larger buffer."
1505     */
1506    ghbn_r_buf = (char *)XMALLOC(2048, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1507    if (ghbn_r_buf != NULL) {
1508        gethostbyname_r(ip, &entry_buf, ghbn_r_buf, 2048, &entry, &ghbn_r_errno);
1509    }
1510#else
1511    entry = gethostbyname(ip);
1512#endif
1513
1514    if (entry) {
1515    #ifdef WOLFSSL_IPV6
1516        sin = (SOCKADDR_IN6 *)&addr;
1517        sin->sin6_family = AF_INET6;
1518        sin->sin6_port = XHTONS(port);
1519        XMEMCPY(&sin->sin6_addr, entry->h_addr_list[0], entry->h_length);
1520    #else
1521        sin = (SOCKADDR_IN *)&addr;
1522        sin->sin_family = AF_INET;
1523        sin->sin_port = XHTONS(port);
1524        XMEMCPY(&sin->sin_addr.s_addr, entry->h_addr_list[0],
1525                (size_t)entry->h_length);
1526    #endif
1527    }
1528
1529#if defined(__GLIBC__) && (__GLIBC__ >= 2) && defined(__USE_MISC) && \
1530    !defined(SINGLE_THREADED)
1531    XFREE(ghbn_r_buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1532#endif
1533
1534    if (entry == NULL) {
1535        WOLFSSL_MSG("no addr info for responder");
1536        return WOLFSSL_FATAL_ERROR;
1537    }
1538#endif
1539
1540    *sockfd = (SOCKET_T)wc_socket_cloexec(addr.ss_family, SOCK_STREAM, 0);
1541#ifdef USE_WINDOWS_API
1542    if (*sockfd == SOCKET_INVALID)
1543#else
1544    if (*sockfd <= SOCKET_INVALID)
1545#endif
1546    {
1547        WOLFSSL_MSG("bad socket fd, out of fds?");
1548        *sockfd = SOCKET_INVALID;
1549        return WOLFSSL_FATAL_ERROR;
1550    }
1551
1552#ifdef HAVE_IO_TIMEOUT
1553    /* if timeout value provided then set socket non-blocking */
1554    if (to_sec > 0) {
1555        wolfIO_SetBlockingMode(*sockfd, 1);
1556    }
1557#else
1558    (void)to_sec;
1559#endif /* HAVE_IO_TIMEOUT */
1560
1561    ret = connect(*sockfd, (SOCKADDR *)&addr, sockaddr_len);
1562#ifdef HAVE_IO_TIMEOUT
1563    if ((ret != 0) && (to_sec > 0)) {
1564#ifdef USE_WINDOWS_API
1565        if ((ret == SOCKET_ERROR) &&
1566            (wolfSSL_LastError(ret, *sockfd) == SOCKET_EWOULDBLOCK))
1567#else
1568        if (errno == EINPROGRESS)
1569#endif
1570        {
1571            /* wait for connect to complete */
1572            ret = wolfIO_Select(*sockfd, to_sec);
1573
1574            /* restore blocking mode */
1575            wolfIO_SetBlockingMode(*sockfd, 0);
1576        }
1577    }
1578#endif /* HAVE_IO_TIMEOUT */
1579    if (ret != 0) {
1580        WOLFSSL_MSG("Responder tcp connect failed");
1581        CloseSocket(*sockfd);
1582        *sockfd = SOCKET_INVALID;
1583        return WOLFSSL_FATAL_ERROR;
1584    }
1585    return ret;
1586#else
1587    (void)sockfd;
1588    (void)ip;
1589    (void)port;
1590    (void)to_sec;
1591    return WOLFSSL_FATAL_ERROR;
1592#endif /* HAVE_SOCKADDR */
1593}
1594
1595int wolfIO_TcpBind(SOCKET_T* sockfd, word16 port)
1596{
1597#ifdef HAVE_SOCKADDR
1598    int ret = 0;
1599    SOCKADDR_S addr;
1600#ifdef WOLFSSL_IPV6
1601    socklen_t sockaddr_len = sizeof(SOCKADDR_IN6);
1602    SOCKADDR_IN6 *sin = (SOCKADDR_IN6 *)&addr;
1603#else
1604    socklen_t sockaddr_len = sizeof(SOCKADDR_IN);
1605    SOCKADDR_IN *sin = (SOCKADDR_IN *)&addr;
1606#endif
1607
1608    if (sockfd == NULL || port < 1) {
1609        return WOLFSSL_FATAL_ERROR;
1610    }
1611
1612    XMEMSET(&addr, 0, sizeof(addr));
1613
1614#ifdef WOLFSSL_IPV6
1615    sin->sin6_family = AF_INET6;
1616    sin->sin6_addr = in6addr_any;
1617    sin->sin6_port = XHTONS(port);
1618    *sockfd = (SOCKET_T)wc_socket_cloexec(AF_INET6, SOCK_STREAM, 0);
1619#else
1620    sin->sin_family = AF_INET;
1621    sin->sin_addr.s_addr = INADDR_ANY;
1622    sin->sin_port = XHTONS(port);
1623    *sockfd = (SOCKET_T)wc_socket_cloexec(AF_INET, SOCK_STREAM, 0);
1624#endif
1625
1626#ifdef USE_WINDOWS_API
1627    if (*sockfd == SOCKET_INVALID)
1628#else
1629    if (*sockfd <= SOCKET_INVALID)
1630#endif
1631    {
1632        WOLFSSL_MSG("socket failed");
1633        *sockfd = SOCKET_INVALID;
1634        return WOLFSSL_FATAL_ERROR;
1635    }
1636
1637#if !defined(USE_WINDOWS_API) && !defined(WOLFSSL_MDK_ARM)\
1638                   && !defined(WOLFSSL_KEIL_TCP_NET) && !defined(WOLFSSL_ZEPHYR)
1639    {
1640        int optval  = 1;
1641        XSOCKLENT optlen = sizeof(optval);
1642        ret = setsockopt(*sockfd, SOL_SOCKET, SO_REUSEADDR, &optval, optlen);
1643    }
1644#endif
1645
1646    if (ret == 0)
1647        ret = bind(*sockfd, (SOCKADDR *)sin, sockaddr_len);
1648    if (ret == 0)
1649        ret = listen(*sockfd, SOMAXCONN);
1650
1651    if (ret != 0) {
1652        WOLFSSL_MSG("wolfIO_TcpBind failed");
1653        CloseSocket(*sockfd);
1654        *sockfd = SOCKET_INVALID;
1655        ret = WOLFSSL_FATAL_ERROR;
1656    }
1657
1658    return ret;
1659#else
1660    (void)sockfd;
1661    (void)port;
1662    return WOLFSSL_FATAL_ERROR;
1663#endif /* HAVE_SOCKADDR */
1664}
1665
1666#ifdef HAVE_SOCKADDR
1667int wolfIO_TcpAccept(SOCKET_T sockfd, SOCKADDR* peer_addr, XSOCKLENT* peer_len)
1668{
1669    return (int)wc_accept_cloexec((int)sockfd, peer_addr, peer_len);
1670}
1671#endif /* HAVE_SOCKADDR */
1672
1673#ifndef HTTP_SCRATCH_BUFFER_SIZE
1674    #define HTTP_SCRATCH_BUFFER_SIZE 512
1675#endif
1676#ifndef MAX_URL_ITEM_SIZE
1677    #define MAX_URL_ITEM_SIZE   80
1678#endif
1679
1680int wolfIO_DecodeUrl(const char* url, int urlSz, char* outName, char* outPath,
1681    word16* outPort)
1682{
1683    int result = -1;
1684
1685    if (url == NULL || urlSz == 0) {
1686        if (outName)
1687            *outName = 0;
1688        if (outPath)
1689            *outPath = 0;
1690        if (outPort)
1691            *outPort = 0;
1692    }
1693    else {
1694        int i, cur;
1695
1696        /* need to break the url down into scheme, address, and port */
1697        /*     "http://example.com:8080/" */
1698        /*     "http://[::1]:443/"        */
1699        if (XSTRNCMP(url, "http://", 7) == 0) {
1700            cur = 7;
1701        } else cur = 0;
1702
1703        i = 0;
1704        if (url[cur] == '[') {
1705            cur++;
1706            /* copy until ']' */
1707            while (i < MAX_URL_ITEM_SIZE-1 && cur < urlSz && url[cur] != 0 &&
1708                    url[cur] != ']') {
1709                if (outName)
1710                    outName[i] = url[cur];
1711                i++; cur++;
1712            }
1713            cur++; /* skip ']' */
1714        }
1715        else {
1716            while (i < MAX_URL_ITEM_SIZE-1 && cur < urlSz && url[cur] != 0 &&
1717                    url[cur] != ':' && url[cur] != '/') {
1718                if (outName)
1719                    outName[i] = url[cur];
1720                i++; cur++;
1721            }
1722        }
1723        if (outName)
1724            outName[i] = 0;
1725        /* Need to pick out the path after the domain name */
1726
1727        if (cur < urlSz && url[cur] == ':') {
1728            char port[6];
1729            int j;
1730            word32 bigPort = 0;
1731            i = 0;
1732            cur++;
1733
1734            XMEMSET(port, 0, sizeof(port));
1735
1736            while (i < 6 && cur < urlSz && url[cur] != 0 && url[cur] != '/') {
1737                port[i] = url[cur];
1738                i++; cur++;
1739            }
1740
1741            for (j = 0; j < i; j++) {
1742                if (port[j] < '0' || port[j] > '9') return WOLFSSL_FATAL_ERROR;
1743                bigPort = (bigPort * 10) + (word32)(port[j] - '0');
1744            }
1745            if (outPort)
1746                *outPort = (word16)bigPort;
1747        }
1748        else if (outPort)
1749            *outPort = 80;
1750
1751
1752        if (cur < urlSz && url[cur] == '/') {
1753            i = 0;
1754            while (i < MAX_URL_ITEM_SIZE-1 && cur < urlSz && url[cur] != 0) {
1755                if (outPath)
1756                    outPath[i] = url[cur];
1757                i++; cur++;
1758            }
1759            if (outPath)
1760                outPath[i] = 0;
1761        }
1762        else if (outPath) {
1763            outPath[0] = '/';
1764            outPath[1] = 0;
1765        }
1766
1767        result = 0;
1768    }
1769
1770    return result;
1771}
1772
1773#ifndef WOLFIO_HTTP_MAX_BODY
1774/* Upper bound on an HTTP body that will be buffered in memory. */
1775#define WOLFIO_HTTP_MAX_BODY (32 * 1024 * 1024)
1776#endif
1777
1778static int wolfIO_HttpProcessResponseBuf(WolfSSLGenericIORecvCb ioCb,
1779    void* ioCbCtx, byte **recvBuf, int* recvBufSz, int chunkSz, char* start,
1780    int len, int dynType, void* heap)
1781{
1782    byte* newRecvBuf = NULL;
1783    int newRecvSz;
1784    int pos = 0;
1785
1786    WOLFSSL_MSG("Processing HTTP response");
1787#ifdef WOLFIO_DEBUG
1788    printf("HTTP Chunk %d->%d\n", *recvBufSz, chunkSz);
1789#endif
1790
1791    (void)heap;
1792    (void)dynType;
1793
1794    if (chunkSz < 0 || len < 0) {
1795        WOLFSSL_MSG("wolfIO_HttpProcessResponseBuf invalid chunk or length size");
1796        return MEMORY_E;
1797    }
1798
1799    if (chunkSz > WOLFIO_HTTP_MAX_BODY) {
1800        WOLFSSL_MSG("wolfIO_HttpProcessResponseBuf chunk too large");
1801        return BUFFER_ERROR;
1802    }
1803
1804    if (*recvBufSz < 0 || *recvBufSz > WOLFIO_HTTP_MAX_BODY - chunkSz) {
1805        WOLFSSL_MSG("wolfIO_HttpProcessResponseBuf aggregate body too large");
1806        return BUFFER_ERROR;
1807    }
1808
1809    if (len > chunkSz) {
1810        WOLFSSL_MSG("wolfIO_HttpProcessResponseBuf len exceeds chunk size");
1811        return WOLFSSL_FATAL_ERROR;
1812    }
1813
1814    newRecvSz = *recvBufSz + chunkSz;
1815
1816    if (newRecvSz <= 0) {
1817        WOLFSSL_MSG("wolfIO_HttpProcessResponseBuf new receive size overflow");
1818        return MEMORY_E;
1819    }
1820
1821    newRecvBuf = (byte*)XMALLOC((size_t)newRecvSz, heap, dynType);
1822    if (newRecvBuf == NULL) {
1823        WOLFSSL_MSG("wolfIO_HttpProcessResponseBuf malloc failed");
1824        return MEMORY_E;
1825    }
1826
1827    /* if buffer already exists, then we are growing it */
1828    if (*recvBuf) {
1829        XMEMCPY(&newRecvBuf[pos], *recvBuf, (size_t) *recvBufSz);
1830        XFREE(*recvBuf, heap, dynType);
1831        pos += *recvBufSz;
1832        *recvBuf = NULL;
1833    }
1834
1835    /* copy the remainder of the httpBuf into the respBuf */
1836    if (len != 0) {
1837        if (pos + len <= newRecvSz) {
1838            XMEMCPY(&newRecvBuf[pos], start, (size_t)len);
1839            pos += len;
1840        }
1841        else {
1842            WOLFSSL_MSG("wolfIO_HttpProcessResponseBuf bad size");
1843            XFREE(newRecvBuf, heap, dynType);
1844            return WOLFSSL_FATAL_ERROR;
1845        }
1846    }
1847
1848    /* receive the remainder of chunk */
1849    while (len < chunkSz) {
1850        int rxSz = ioCb((char*)&newRecvBuf[pos], chunkSz-len, ioCbCtx);
1851        if (rxSz > 0) {
1852            len += rxSz;
1853            pos += rxSz;
1854        }
1855        else {
1856            WOLFSSL_MSG("wolfIO_HttpProcessResponseBuf recv failed");
1857            XFREE(newRecvBuf, heap, dynType);
1858            return WOLFSSL_FATAL_ERROR;
1859        }
1860    }
1861
1862    *recvBuf = newRecvBuf;
1863    *recvBufSz = newRecvSz;
1864
1865    return 0;
1866}
1867
1868int wolfIO_HttpProcessResponseGenericIO(WolfSSLGenericIORecvCb ioCb,
1869    void* ioCbCtx, const char** appStrList, unsigned char** respBuf,
1870    unsigned char* httpBuf, int httpBufSz, int dynType, void* heap)
1871{
1872    static const char HTTP_PROTO[] = "HTTP/1.";
1873    static const char HTTP_STATUS_200[] = "200";
1874    int result = 0;
1875    int len = 0;
1876    char *start, *end;
1877    int respBufSz = 0;
1878    int isChunked = 0, chunkSz = 0;
1879    enum phr_state { phr_init, phr_http_start, phr_have_length, phr_have_type,
1880                     phr_wait_end, phr_get_chunk_len, phr_get_chunk_data,
1881                     phr_http_end
1882    } state = phr_init;
1883
1884    WOLFSSL_ENTER("wolfIO_HttpProcessResponse");
1885
1886    *respBuf = NULL;
1887    start = end = NULL;
1888    do {
1889        if (state == phr_get_chunk_data) {
1890            /* get chunk of data */
1891            result = wolfIO_HttpProcessResponseBuf(ioCb, ioCbCtx, respBuf,
1892                &respBufSz, chunkSz, start, len, dynType, heap);
1893
1894            state = (result != 0) ? phr_http_end : phr_get_chunk_len;
1895            end = NULL;
1896            len = 0;
1897        }
1898
1899        /* read data if no \r\n or first time */
1900        if ((start == NULL) || (end == NULL)) {
1901            if (httpBufSz < len + 1) {
1902                return BUFFER_ERROR; /* can't happen, but Coverity thinks it
1903                                      * can.
1904                                      */
1905            }
1906            result = ioCb((char*)httpBuf+len, httpBufSz-len-1, ioCbCtx);
1907            if (result > 0) {
1908                len += result;
1909                start = (char*)httpBuf;
1910                start[len] = 0;
1911            }
1912            else {
1913                if (result == WC_NO_ERR_TRACE(WOLFSSL_CBIO_ERR_WANT_READ)) {
1914                    return OCSP_WANT_READ;
1915                }
1916
1917                WOLFSSL_MSG("wolfIO_HttpProcessResponse recv http from peer failed");
1918                return HTTP_RECV_ERR;
1919            }
1920        }
1921        end = XSTRSTR(start, "\r\n"); /* locate end */
1922
1923        /* handle incomplete rx */
1924        if (end == NULL) {
1925            if (len != 0)
1926                XMEMMOVE(httpBuf, start, (size_t)len);
1927            start = end = NULL;
1928        }
1929        /* when start is "\r\n" */
1930        else if (end == start) {
1931            /* if waiting for end or need chunk len */
1932            if (state == phr_wait_end || state == phr_get_chunk_len) {
1933                state = (isChunked) ? phr_get_chunk_len : phr_http_end;
1934                len -= 2; start += 2; /* skip \r\n */
1935             }
1936             else {
1937                WOLFSSL_MSG("wolfIO_HttpProcessResponse header ended early");
1938                return HTTP_HEADER_ERR;
1939             }
1940        }
1941        else {
1942            *end = 0; /* null terminate */
1943            len -= (int)(end - start) + 2;
1944                /* adjust len to remove the first line including the /r/n */
1945
1946        #ifdef WOLFIO_DEBUG
1947            printf("HTTP Resp: %s\n", start);
1948        #endif
1949
1950            switch (state) {
1951                case phr_init:
1952                    /* length of "HTTP/1.x 200" == 12*/
1953                    if (XSTRLEN(start) < 12) {
1954                        WOLFSSL_MSG("wolfIO_HttpProcessResponse HTTP header "
1955                            "too short.");
1956                        return HTTP_HEADER_ERR;
1957                    }
1958                    if (XSTRNCASECMP(start, HTTP_PROTO,
1959                                     sizeof(HTTP_PROTO) - 1) != 0) {
1960                        WOLFSSL_MSG("wolfIO_HttpProcessResponse HTTP header "
1961                            "doesn't start with HTTP/1.");
1962                        return HTTP_PROTO_ERR;
1963                    }
1964                    /* +2 for HTTP minor version and space between version and
1965                     * status code. */
1966                    start += sizeof(HTTP_PROTO) - 1 + 2 ;
1967                    if (XSTRNCASECMP(start, HTTP_STATUS_200,
1968                                     sizeof(HTTP_STATUS_200) - 1) != 0) {
1969                        WOLFSSL_MSG("wolfIO_HttpProcessResponse HTTP header "
1970                            "doesn't have status code 200.");
1971                        return HTTP_STATUS_ERR;
1972                    }
1973                    state = phr_http_start;
1974                    break;
1975                case phr_http_start:
1976                case phr_have_length:
1977                case phr_have_type:
1978                    if (XSTRNCASECMP(start, "Content-Type:", 13) == 0) {
1979                        int i;
1980
1981                        start += 13;
1982                        while (*start == ' ') start++;
1983
1984                        /* try and match against appStrList */
1985                        i = 0;
1986                        while (appStrList[i] != NULL) {
1987                            if (XSTRNCASECMP(start, appStrList[i],
1988                                                XSTRLEN(appStrList[i])) == 0) {
1989                                break;
1990                            }
1991                            i++;
1992                        }
1993                        if (appStrList[i] == NULL) {
1994                            WOLFSSL_MSG("wolfIO_HttpProcessResponse appstr mismatch");
1995                            return HTTP_APPSTR_ERR;
1996                        }
1997                        state = (state == phr_http_start) ? phr_have_type : phr_wait_end;
1998                    }
1999                    else if (XSTRNCASECMP(start, "Content-Length:", 15) == 0) {
2000                        start += 15;
2001                        while (*start == ' ') start++;
2002                        chunkSz = XATOI(start);
2003                        state = (state == phr_http_start) ? phr_have_length : phr_wait_end;
2004                    }
2005                    else if (XSTRNCASECMP(start, "Transfer-Encoding:", 18) == 0) {
2006                        start += 18;
2007                        while (*start == ' ') start++;
2008                        if (XSTRNCASECMP(start, "chunked", 7) == 0) {
2009                            isChunked = 1;
2010                            state = (state == phr_http_start) ? phr_have_length : phr_wait_end;
2011                        }
2012                    }
2013                    break;
2014                case phr_get_chunk_len:
2015                    chunkSz = (int)strtol(start, NULL, 16); /* hex format */
2016                    state = (chunkSz == 0) ? phr_http_end : phr_get_chunk_data;
2017                    break;
2018                case phr_get_chunk_data:
2019                    /* processing for chunk data done above, since \r\n isn't required */
2020                case phr_wait_end:
2021                case phr_http_end:
2022                    /* do nothing */
2023                    break;
2024            } /* switch (state) */
2025
2026            /* skip to end plus \r\n */
2027            start = end + 2;
2028        }
2029    } while (state != phr_http_end);
2030
2031    if (!isChunked) {
2032        result = wolfIO_HttpProcessResponseBuf(ioCb, ioCbCtx, respBuf,
2033                &respBufSz, chunkSz, start, len, dynType, heap);
2034    }
2035
2036    if (result >= 0) {
2037        result = respBufSz;
2038    }
2039    else {
2040        WOLFSSL_ERROR(result);
2041    }
2042
2043    return result;
2044}
2045
2046static int httpResponseIoCb(char* buf, int sz, void* ctx)
2047{
2048    /* Double cast to silence the compiler int/pointer width msg */
2049    return wolfIO_Recv((SOCKET_T)(uintptr_t)ctx, buf, sz, 0);
2050}
2051
2052int wolfIO_HttpProcessResponse(int sfd, const char** appStrList,
2053    byte** respBuf, byte* httpBuf, int httpBufSz, int dynType, void* heap)
2054{
2055    return wolfIO_HttpProcessResponseGenericIO(httpResponseIoCb,
2056            /* Double cast to silence the compiler int/pointer width msg */
2057            (void*)(uintptr_t)sfd, appStrList, respBuf, httpBuf, httpBufSz,
2058            dynType, heap);
2059}
2060
2061int wolfIO_HttpBuildRequest(const char *reqType, const char *domainName,
2062                               const char *path, int pathLen, int reqSz, const char *contentType,
2063                               byte *buf, int bufSize)
2064{
2065    return wolfIO_HttpBuildRequest_ex(reqType, domainName, path, pathLen, reqSz, contentType, "", buf, bufSize);
2066}
2067
2068int wolfIO_HttpBuildRequest_ex(const char *reqType, const char *domainName,
2069                                const char *path, int pathLen, int reqSz, const char *contentType,
2070                                const char *exHdrs, byte *buf, int bufSize)
2071    {
2072    word32 reqTypeLen, domainNameLen, reqSzStrLen, contentTypeLen, exHdrsLen, maxLen;
2073    char reqSzStr[6];
2074    char* req = (char*)buf;
2075    const char* blankStr = " ";
2076    const char* http11Str = " HTTP/1.1";
2077    const char* hostStr = "\r\nHost: ";
2078    const char* contentLenStr = "\r\nContent-Length: ";
2079    const char* contentTypeStr = "\r\nContent-Type: ";
2080    const char* singleCrLfStr = "\r\n";
2081    const char* doubleCrLfStr = "\r\n\r\n";
2082    word32 blankStrLen, http11StrLen, hostStrLen, contentLenStrLen,
2083        contentTypeStrLen, singleCrLfStrLen, doubleCrLfStrLen;
2084
2085    reqTypeLen = (word32)XSTRLEN(reqType);
2086    domainNameLen = (word32)XSTRLEN(domainName);
2087    reqSzStrLen = wolfIO_Word16ToString(reqSzStr, (word16)reqSz);
2088    contentTypeLen = (word32)XSTRLEN(contentType);
2089
2090    blankStrLen = (word32)XSTRLEN(blankStr);
2091    http11StrLen = (word32)XSTRLEN(http11Str);
2092    hostStrLen = (word32)XSTRLEN(hostStr);
2093    contentLenStrLen = (word32)XSTRLEN(contentLenStr);
2094    contentTypeStrLen = (word32)XSTRLEN(contentTypeStr);
2095
2096    if(exHdrs){
2097        singleCrLfStrLen = (word32)XSTRLEN(singleCrLfStr);
2098        exHdrsLen = (word32)XSTRLEN(exHdrs);
2099    } else {
2100        singleCrLfStrLen = 0;
2101        exHdrsLen = 0;
2102    }
2103
2104    doubleCrLfStrLen = (word32)XSTRLEN(doubleCrLfStr);
2105
2106    /* determine max length and check it */
2107    maxLen =
2108        reqTypeLen +
2109        blankStrLen +
2110        (word32)pathLen +
2111        http11StrLen +
2112        hostStrLen +
2113        domainNameLen +
2114        contentLenStrLen +
2115        reqSzStrLen +
2116        contentTypeStrLen +
2117        contentTypeLen +
2118        singleCrLfStrLen +
2119        exHdrsLen +
2120        doubleCrLfStrLen +
2121        (word32)1 /* null term */;
2122    if (maxLen > (word32)bufSize)
2123        return 0;
2124
2125    XSTRNCPY((char*)buf, reqType, (size_t)bufSize);
2126    buf += reqTypeLen; bufSize -= (int)reqTypeLen;
2127    XSTRNCPY((char*)buf, blankStr, (size_t)bufSize);
2128    buf += blankStrLen; bufSize -= (int)blankStrLen;
2129    XSTRNCPY((char*)buf, path, (size_t)bufSize);
2130    buf += pathLen; bufSize -= (int)pathLen;
2131    XSTRNCPY((char*)buf, http11Str, (size_t)bufSize);
2132    buf += http11StrLen; bufSize -= (int)http11StrLen;
2133    if (domainNameLen > 0) {
2134        XSTRNCPY((char*)buf, hostStr, (size_t)bufSize);
2135        buf += hostStrLen; bufSize -= (int)hostStrLen;
2136        XSTRNCPY((char*)buf, domainName, (size_t)bufSize);
2137        buf += domainNameLen; bufSize -= (int)domainNameLen;
2138    }
2139    if (reqSz > 0 && reqSzStrLen > 0) {
2140        XSTRNCPY((char*)buf, contentLenStr, (size_t)bufSize);
2141        buf += contentLenStrLen; bufSize -= (int)contentLenStrLen;
2142        XSTRNCPY((char*)buf, reqSzStr, (size_t)bufSize);
2143        buf += reqSzStrLen; bufSize -= (int)reqSzStrLen;
2144    }
2145    if (contentTypeLen > 0) {
2146        XSTRNCPY((char*)buf, contentTypeStr, (size_t)bufSize);
2147        buf += contentTypeStrLen; bufSize -= (int)contentTypeStrLen;
2148        XSTRNCPY((char*)buf, contentType, (size_t)bufSize);
2149        buf += contentTypeLen; bufSize -= (int)contentTypeLen;
2150    }
2151    if (exHdrsLen > 0)
2152    {
2153        XSTRNCPY((char *)buf, singleCrLfStr, (size_t)bufSize);
2154        buf += singleCrLfStrLen;
2155        bufSize -= (int)singleCrLfStrLen;
2156        XSTRNCPY((char *)buf, exHdrs, (size_t)bufSize);
2157        buf += exHdrsLen;
2158        bufSize -= (int)exHdrsLen;
2159    }
2160    XSTRNCPY((char*)buf, doubleCrLfStr, (size_t)bufSize);
2161    buf += doubleCrLfStrLen;
2162
2163#ifdef WOLFIO_DEBUG
2164    printf("HTTP %s: %s", reqType, req);
2165#endif
2166
2167    /* calculate actual length based on original and new pointer */
2168    return (int)((char*)buf - req);
2169}
2170
2171
2172#ifdef HAVE_OCSP
2173
2174int wolfIO_HttpBuildRequestOcsp(const char* domainName, const char* path,
2175                                    int ocspReqSz, byte* buf, int bufSize)
2176{
2177    const char *cacheCtl = "Cache-Control: no-cache";
2178    return wolfIO_HttpBuildRequest_ex("POST", domainName, path, (int)XSTRLEN(path),
2179        ocspReqSz, "application/ocsp-request", cacheCtl, buf, bufSize);
2180}
2181
2182static const char* ocspAppStrList[] = {
2183    "application/ocsp-response",
2184    NULL
2185};
2186
2187int wolfIO_HttpProcessResponseOcspGenericIO(
2188    WolfSSLGenericIORecvCb ioCb, void* ioCbCtx, unsigned char** respBuf,
2189    unsigned char* httpBuf, int httpBufSz, void* heap)
2190{
2191    return wolfIO_HttpProcessResponseGenericIO(ioCb, ioCbCtx,
2192          ocspAppStrList, respBuf, httpBuf, httpBufSz, DYNAMIC_TYPE_OCSP, heap);
2193}
2194
2195/* return: >0 OCSP Response Size
2196 *         -1 error */
2197int wolfIO_HttpProcessResponseOcsp(int sfd, byte** respBuf,
2198                                       byte* httpBuf, int httpBufSz, void* heap)
2199{
2200    return wolfIO_HttpProcessResponse(sfd, ocspAppStrList,
2201        respBuf, httpBuf, httpBufSz, DYNAMIC_TYPE_OCSP, heap);
2202}
2203
2204/* in default wolfSSL callback ctx is the heap pointer */
2205int EmbedOcspLookup(void* ctx, const char* url, int urlSz,
2206                        byte* ocspReqBuf, int ocspReqSz, byte** ocspRespBuf)
2207{
2208    SOCKET_T sfd = SOCKET_INVALID;
2209    word16   port;
2210    int      ret = -1;
2211#ifdef WOLFSSL_SMALL_STACK
2212    char*    path;
2213    char*    domainName;
2214#else
2215    char     path[MAX_URL_ITEM_SIZE];
2216    char     domainName[MAX_URL_ITEM_SIZE];
2217#endif
2218
2219#ifdef WOLFSSL_SMALL_STACK
2220    path = (char*)XMALLOC(MAX_URL_ITEM_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
2221    if (path == NULL)
2222        return MEMORY_E;
2223
2224    domainName = (char*)XMALLOC(MAX_URL_ITEM_SIZE, NULL,
2225            DYNAMIC_TYPE_TMP_BUFFER);
2226    if (domainName == NULL) {
2227        XFREE(path, NULL, DYNAMIC_TYPE_TMP_BUFFER);
2228        return MEMORY_E;
2229    }
2230#endif
2231
2232    if (ocspReqBuf == NULL || ocspReqSz == 0) {
2233        WOLFSSL_MSG("OCSP request is required for lookup");
2234    }
2235    else if (ocspRespBuf == NULL) {
2236        WOLFSSL_MSG("Cannot save OCSP response");
2237    }
2238    else if (wolfIO_DecodeUrl(url, urlSz, domainName, path, &port) < 0) {
2239        WOLFSSL_MSG("Unable to decode OCSP URL");
2240    }
2241    else {
2242        /* Note, the library uses the EmbedOcspRespFree() callback to
2243         * free this buffer. */
2244        int   httpBufSz = HTTP_SCRATCH_BUFFER_SIZE;
2245        byte* httpBuf   = (byte*)XMALLOC((size_t)httpBufSz, ctx, DYNAMIC_TYPE_OCSP);
2246
2247        if (httpBuf == NULL) {
2248            WOLFSSL_MSG("Unable to create OCSP response buffer");
2249        }
2250        else {
2251            httpBufSz = wolfIO_HttpBuildRequestOcsp(domainName, path, ocspReqSz,
2252                                                            httpBuf, httpBufSz);
2253
2254            ret = wolfIO_TcpConnect(&sfd, domainName, port, io_timeout_sec);
2255            if (ret != 0) {
2256                WOLFSSL_MSG("OCSP Responder connection failed");
2257            }
2258            else if (wolfIO_Send(sfd, (char*)httpBuf, httpBufSz, 0) !=
2259                                                                    httpBufSz) {
2260                WOLFSSL_MSG("OCSP http request failed");
2261            }
2262            else if (wolfIO_Send(sfd, (char*)ocspReqBuf, ocspReqSz, 0) !=
2263                                                                    ocspReqSz) {
2264                WOLFSSL_MSG("OCSP ocsp request failed");
2265            }
2266            else {
2267                ret = wolfIO_HttpProcessResponseOcsp((int)sfd, ocspRespBuf, httpBuf,
2268                                                 HTTP_SCRATCH_BUFFER_SIZE, ctx);
2269            }
2270            if (sfd != SOCKET_INVALID)
2271                CloseSocket(sfd);
2272            XFREE(httpBuf, ctx, DYNAMIC_TYPE_OCSP);
2273        }
2274    }
2275
2276    WC_FREE_VAR_EX(path, NULL, DYNAMIC_TYPE_TMP_BUFFER);
2277    WC_FREE_VAR_EX(domainName, NULL, DYNAMIC_TYPE_TMP_BUFFER);
2278
2279    return ret;
2280}
2281
2282/* in default callback ctx is heap hint */
2283void EmbedOcspRespFree(void* ctx, byte *resp)
2284{
2285    XFREE(resp, ctx, DYNAMIC_TYPE_OCSP);
2286
2287    (void)ctx;
2288}
2289#endif /* HAVE_OCSP */
2290
2291
2292#if defined(HAVE_CRL) && defined(HAVE_CRL_IO)
2293
2294int wolfIO_HttpBuildRequestCrl(const char* url, int urlSz,
2295    const char* domainName, byte* buf, int bufSize)
2296{
2297    const char *cacheCtl = "Cache-Control: no-cache";
2298    return wolfIO_HttpBuildRequest_ex("GET", domainName, url, urlSz, 0, "",
2299                                   cacheCtl, buf, bufSize);
2300}
2301
2302int wolfIO_HttpProcessResponseCrl(WOLFSSL_CRL* crl, int sfd, byte* httpBuf,
2303    int httpBufSz)
2304{
2305    int ret;
2306    byte *respBuf = NULL;
2307
2308    const char* appStrList[] = {
2309        "application/pkix-crl",
2310        "application/x-pkcs7-crl",
2311        NULL
2312    };
2313
2314
2315    ret = wolfIO_HttpProcessResponse(sfd, appStrList,
2316        &respBuf, httpBuf, httpBufSz, DYNAMIC_TYPE_CRL, crl->heap);
2317    if (ret >= 0) {
2318        ret = BufferLoadCRL(crl, respBuf, ret, WOLFSSL_FILETYPE_ASN1, 0);
2319    }
2320    XFREE(respBuf, crl->heap, DYNAMIC_TYPE_CRL);
2321
2322    return ret;
2323}
2324
2325int EmbedCrlLookup(WOLFSSL_CRL* crl, const char* url, int urlSz)
2326{
2327    SOCKET_T sfd = SOCKET_INVALID;
2328    word16   port;
2329    int      ret = -1;
2330    WC_DECLARE_VAR(domainName, char, MAX_URL_ITEM_SIZE, 0);
2331
2332#ifdef WOLFSSL_SMALL_STACK
2333    domainName = (char*)XMALLOC(MAX_URL_ITEM_SIZE, crl->heap,
2334                                                       DYNAMIC_TYPE_TMP_BUFFER);
2335    if (domainName == NULL) {
2336        return MEMORY_E;
2337    }
2338#endif
2339
2340    if (wolfIO_DecodeUrl(url, urlSz, domainName, NULL, &port) < 0) {
2341        WOLFSSL_MSG("Unable to decode CRL URL");
2342    }
2343    else {
2344        int   httpBufSz = HTTP_SCRATCH_BUFFER_SIZE;
2345        byte* httpBuf   = (byte*)XMALLOC((size_t)httpBufSz, crl->heap,
2346                                                              DYNAMIC_TYPE_CRL);
2347        if (httpBuf == NULL) {
2348            WOLFSSL_MSG("Unable to create CRL response buffer");
2349        }
2350        else {
2351            httpBufSz = wolfIO_HttpBuildRequestCrl(url, urlSz, domainName,
2352                httpBuf, httpBufSz);
2353
2354            ret = wolfIO_TcpConnect(&sfd, domainName, port, io_timeout_sec);
2355            if (ret != 0) {
2356                WOLFSSL_MSG("CRL connection failed");
2357            }
2358            else if (wolfIO_Send(sfd, (char*)httpBuf, httpBufSz, 0)
2359                                                                 != httpBufSz) {
2360                WOLFSSL_MSG("CRL http get failed");
2361            }
2362            else {
2363                ret = wolfIO_HttpProcessResponseCrl(crl, sfd, httpBuf,
2364                                                      HTTP_SCRATCH_BUFFER_SIZE);
2365            }
2366            if (sfd != SOCKET_INVALID)
2367                CloseSocket(sfd);
2368            XFREE(httpBuf, crl->heap, DYNAMIC_TYPE_CRL);
2369        }
2370    }
2371
2372    WC_FREE_VAR_EX(domainName, crl->heap, DYNAMIC_TYPE_TMP_BUFFER);
2373
2374    return ret;
2375}
2376#endif /* HAVE_CRL && HAVE_CRL_IO */
2377
2378#endif /* HAVE_HTTP_CLIENT */
2379
2380
2381
2382void wolfSSL_CTX_SetIORecv(WOLFSSL_CTX *ctx, CallbackIORecv CBIORecv)
2383{
2384    if (ctx) {
2385        ctx->CBIORecv = CBIORecv;
2386    #ifdef OPENSSL_EXTRA
2387        ctx->cbioFlag |= WOLFSSL_CBIO_RECV;
2388    #endif
2389    }
2390}
2391
2392
2393void wolfSSL_CTX_SetIOSend(WOLFSSL_CTX *ctx, CallbackIOSend CBIOSend)
2394{
2395    if (ctx) {
2396        ctx->CBIOSend = CBIOSend;
2397    #ifdef OPENSSL_EXTRA
2398        ctx->cbioFlag |= WOLFSSL_CBIO_SEND;
2399    #endif
2400    }
2401}
2402
2403
2404/* sets the IO callback to use for receives at WOLFSSL level */
2405void wolfSSL_SSLSetIORecv(WOLFSSL *ssl, CallbackIORecv CBIORecv)
2406{
2407    if (ssl) {
2408        ssl->CBIORecv = CBIORecv;
2409    #ifdef OPENSSL_EXTRA
2410        ssl->cbioFlag |= WOLFSSL_CBIO_RECV;
2411    #endif
2412    }
2413}
2414
2415
2416/* sets the IO callback to use for sends at WOLFSSL level */
2417void wolfSSL_SSLSetIOSend(WOLFSSL *ssl, CallbackIOSend CBIOSend)
2418{
2419    if (ssl) {
2420        ssl->CBIOSend = CBIOSend;
2421    #ifdef OPENSSL_EXTRA
2422        ssl->cbioFlag |= WOLFSSL_CBIO_SEND;
2423    #endif
2424    }
2425}
2426
2427void wolfSSL_SSLDisableRead(WOLFSSL *ssl)
2428{
2429    if (ssl) {
2430        ssl->options.disableRead = 1;
2431    }
2432}
2433
2434void wolfSSL_SSLEnableRead(WOLFSSL *ssl)
2435{
2436    if (ssl) {
2437        ssl->options.disableRead = 0;
2438    }
2439}
2440
2441
2442void wolfSSL_SetIOReadCtx(WOLFSSL* ssl, void *rctx)
2443{
2444    if (ssl)
2445        ssl->IOCB_ReadCtx = rctx;
2446}
2447
2448
2449void wolfSSL_SetIOWriteCtx(WOLFSSL* ssl, void *wctx)
2450{
2451    if (ssl)
2452        ssl->IOCB_WriteCtx = wctx;
2453}
2454
2455
2456void* wolfSSL_GetIOReadCtx(WOLFSSL* ssl)
2457{
2458    if (ssl)
2459        return ssl->IOCB_ReadCtx;
2460
2461    return NULL;
2462}
2463
2464
2465void* wolfSSL_GetIOWriteCtx(WOLFSSL* ssl)
2466{
2467    if (ssl)
2468        return ssl->IOCB_WriteCtx;
2469
2470    return NULL;
2471}
2472
2473
2474void wolfSSL_SetIOReadFlags(WOLFSSL* ssl, int flags)
2475{
2476    if (ssl)
2477        ssl->rflags = flags;
2478}
2479
2480
2481void wolfSSL_SetIOWriteFlags(WOLFSSL* ssl, int flags)
2482{
2483    if (ssl)
2484        ssl->wflags = flags;
2485}
2486
2487
2488#ifdef WOLFSSL_DTLS
2489
2490void wolfSSL_CTX_SetGenCookie(WOLFSSL_CTX* ctx, CallbackGenCookie cb)
2491{
2492    if (ctx)
2493        ctx->CBIOCookie = cb;
2494}
2495
2496
2497void wolfSSL_SetCookieCtx(WOLFSSL* ssl, void *ctx)
2498{
2499    if (ssl)
2500        ssl->IOCB_CookieCtx = ctx;
2501}
2502
2503
2504void* wolfSSL_GetCookieCtx(WOLFSSL* ssl)
2505{
2506    if (ssl)
2507        return ssl->IOCB_CookieCtx;
2508
2509    return NULL;
2510}
2511#endif /* WOLFSSL_DTLS */
2512
2513#ifdef WOLFSSL_SESSION_EXPORT
2514
2515void wolfSSL_CTX_SetIOGetPeer(WOLFSSL_CTX* ctx, CallbackGetPeer cb)
2516{
2517    if (ctx)
2518        ctx->CBGetPeer = cb;
2519}
2520
2521
2522void wolfSSL_CTX_SetIOSetPeer(WOLFSSL_CTX* ctx, CallbackSetPeer cb)
2523{
2524    if (ctx)
2525        ctx->CBSetPeer = cb;
2526}
2527
2528#endif /* WOLFSSL_SESSION_EXPORT */
2529
2530
2531#ifdef HAVE_NETX
2532
2533/* The NetX receive callback
2534 *  return :  bytes read, or error
2535 */
2536int NetX_Receive(WOLFSSL *ssl, char *buf, int sz, void *ctx)
2537{
2538    NetX_Ctx* nxCtx = (NetX_Ctx*)ctx;
2539    ULONG left;
2540    ULONG total;
2541    ULONG copied = 0;
2542    UINT  status;
2543
2544    (void)ssl;
2545
2546    if (nxCtx == NULL || nxCtx->nxSocket == NULL) {
2547        WOLFSSL_MSG("NetX Recv NULL parameters");
2548        return WOLFSSL_CBIO_ERR_GENERAL;
2549    }
2550
2551    if (nxCtx->nxPacket == NULL) {
2552        status = nx_tcp_socket_receive(nxCtx->nxSocket, &nxCtx->nxPacket,
2553                                       nxCtx->nxWait);
2554        if (status != NX_SUCCESS) {
2555            WOLFSSL_MSG("NetX Recv receive error");
2556            return WOLFSSL_CBIO_ERR_GENERAL;
2557        }
2558    }
2559
2560    if (nxCtx->nxPacket) {
2561        status = nx_packet_length_get(nxCtx->nxPacket, &total);
2562        if (status != NX_SUCCESS) {
2563            WOLFSSL_MSG("NetX Recv length get error");
2564            return WOLFSSL_CBIO_ERR_GENERAL;
2565        }
2566
2567        left = total - nxCtx->nxOffset;
2568        status = nx_packet_data_extract_offset(nxCtx->nxPacket, nxCtx->nxOffset,
2569                                               buf, sz, &copied);
2570        if (status != NX_SUCCESS) {
2571            WOLFSSL_MSG("NetX Recv data extract offset error");
2572            return WOLFSSL_CBIO_ERR_GENERAL;
2573        }
2574
2575        nxCtx->nxOffset += copied;
2576
2577        if (copied == left) {
2578            WOLFSSL_MSG("NetX Recv Drained packet");
2579            nx_packet_release(nxCtx->nxPacket);
2580            nxCtx->nxPacket = NULL;
2581            nxCtx->nxOffset = 0;
2582        }
2583    }
2584
2585    return copied;
2586}
2587
2588
2589/* The NetX send callback
2590 *  return : bytes sent, or error
2591 */
2592int NetX_Send(WOLFSSL* ssl, char *buf, int sz, void *ctx)
2593{
2594    NetX_Ctx*       nxCtx = (NetX_Ctx*)ctx;
2595    NX_PACKET*      packet;
2596    NX_PACKET_POOL* pool;   /* shorthand */
2597    UINT            status;
2598
2599    (void)ssl;
2600
2601    if (nxCtx == NULL || nxCtx->nxSocket == NULL) {
2602        WOLFSSL_MSG("NetX Send NULL parameters");
2603        return WOLFSSL_CBIO_ERR_GENERAL;
2604    }
2605
2606    pool = nxCtx->nxSocket->nx_tcp_socket_ip_ptr->nx_ip_default_packet_pool;
2607    status = nx_packet_allocate(pool, &packet, NX_TCP_PACKET,
2608                                nxCtx->nxWait);
2609    if (status != NX_SUCCESS) {
2610        WOLFSSL_MSG("NetX Send packet alloc error");
2611        return WOLFSSL_CBIO_ERR_GENERAL;
2612    }
2613
2614    status = nx_packet_data_append(packet, buf, sz, pool, nxCtx->nxWait);
2615    if (status != NX_SUCCESS) {
2616        nx_packet_release(packet);
2617        WOLFSSL_MSG("NetX Send data append error");
2618        return WOLFSSL_CBIO_ERR_GENERAL;
2619    }
2620
2621    status = nx_tcp_socket_send(nxCtx->nxSocket, packet, nxCtx->nxWait);
2622    if (status != NX_SUCCESS) {
2623        nx_packet_release(packet);
2624        WOLFSSL_MSG("NetX Send socket send error");
2625        return WOLFSSL_CBIO_ERR_GENERAL;
2626    }
2627
2628    return sz;
2629}
2630
2631
2632/* like set_fd, but for default NetX context */
2633void wolfSSL_SetIO_NetX(WOLFSSL* ssl, NX_TCP_SOCKET* nxSocket, ULONG waitOption)
2634{
2635    if (ssl) {
2636        ssl->nxCtx.nxSocket = nxSocket;
2637        ssl->nxCtx.nxWait   = waitOption;
2638    }
2639}
2640
2641#endif /* HAVE_NETX */
2642
2643
2644#ifdef MICRIUM
2645
2646/* Micrium uTCP/IP port, using the NetSock API
2647 * TCP and UDP are currently supported with the callbacks below.
2648 *
2649 * WOLFSSL_SESSION_EXPORT is not yet supported, would need EmbedGetPeer()
2650 * and EmbedSetPeer() callbacks implemented.
2651 *
2652 * HAVE_CRL is not yet supported, would need an EmbedCrlLookup()
2653 * callback implemented.
2654 *
2655 * HAVE_OCSP is not yet supported, would need an EmbedOCSPLookup()
2656 * callback implemented.
2657 */
2658
2659/* The Micrium uTCP/IP send callback
2660 * return : bytes sent, or error
2661 */
2662int MicriumSend(WOLFSSL* ssl, char* buf, int sz, void* ctx)
2663{
2664    NET_SOCK_ID sd = *(int*)ctx;
2665    NET_SOCK_RTN_CODE ret;
2666    NET_ERR err;
2667
2668    ret = NetSock_TxData(sd, buf, sz, ssl->wflags, &err);
2669    if (ret < 0) {
2670        WOLFSSL_MSG("Embed Send error");
2671
2672        if (err == NET_ERR_TX) {
2673            WOLFSSL_MSG("\tWould block");
2674            return WOLFSSL_CBIO_ERR_WANT_WRITE;
2675
2676        } else {
2677            WOLFSSL_MSG("\tGeneral error");
2678            return WOLFSSL_CBIO_ERR_GENERAL;
2679        }
2680    }
2681
2682    return ret;
2683}
2684
2685/* The Micrium uTCP/IP receive callback
2686 *  return : nb bytes read, or error
2687 */
2688int MicriumReceive(WOLFSSL *ssl, char *buf, int sz, void *ctx)
2689{
2690    NET_SOCK_ID sd = *(int*)ctx;
2691    NET_SOCK_RTN_CODE ret;
2692    NET_ERR err;
2693
2694    #ifdef WOLFSSL_DTLS
2695    {
2696        int dtls_timeout = wolfSSL_dtls_get_current_timeout(ssl);
2697        /* Don't use ssl->options.handShakeDone since it is true even if
2698         * we are in the process of renegotiation */
2699        byte doDtlsTimeout = ssl->options.handShakeState != HANDSHAKE_DONE;
2700        #ifdef WOLFSSL_DTLS13
2701        if (ssl->options.dtls && IsAtLeastTLSv1_3(ssl->version)) {
2702            doDtlsTimeout =
2703                doDtlsTimeout || ssl->dtls13Rtx.rtxRecords != NULL ||
2704                (ssl->dtls13FastTimeout && ssl->dtls13Rtx.seenRecords != NULL);
2705        }
2706        #endif /* WOLFSSL_DTLS13 */
2707
2708        if (!doDtlsTimeout)
2709            dtls_timeout = 0;
2710
2711        if (!wolfSSL_dtls_get_using_nonblock(ssl)) {
2712            /* needs timeout in milliseconds */
2713            #ifdef WOLFSSL_DTLS13
2714            if (wolfSSL_dtls13_use_quick_timeout(ssl) &&
2715                IsAtLeastTLSv1_3(ssl->version)) {
2716                dtls_timeout = (1000 * dtls_timeout) / 4;
2717            } else
2718            #endif /* WOLFSSL_DTLS13 */
2719                dtls_timeout = 1000 * dtls_timeout;
2720            NetSock_CfgTimeoutRxQ_Set(sd, dtls_timeout, &err);
2721            if (err != NET_SOCK_ERR_NONE) {
2722                WOLFSSL_MSG("NetSock_CfgTimeoutRxQ_Set failed");
2723            }
2724        }
2725    }
2726    #endif /* WOLFSSL_DTLS */
2727
2728    ret = NetSock_RxData(sd, buf, sz, ssl->rflags, &err);
2729    if (ret < 0) {
2730        WOLFSSL_MSG("Embed Receive error");
2731
2732        if (err == NET_ERR_RX || err == NET_SOCK_ERR_RX_Q_EMPTY ||
2733            err == NET_ERR_FAULT_LOCK_ACQUIRE) {
2734            if (!wolfSSL_dtls(ssl) || wolfSSL_dtls_get_using_nonblock(ssl)) {
2735                WOLFSSL_MSG("\tWould block");
2736                return WOLFSSL_CBIO_ERR_WANT_READ;
2737            }
2738            else {
2739                WOLFSSL_MSG("\tSocket timeout");
2740                return WOLFSSL_CBIO_ERR_TIMEOUT;
2741            }
2742
2743        } else if (err == NET_SOCK_ERR_CLOSED) {
2744            WOLFSSL_MSG("Embed receive connection closed");
2745            return WOLFSSL_CBIO_ERR_CONN_CLOSE;
2746
2747        } else {
2748            WOLFSSL_MSG("\tGeneral error");
2749            return WOLFSSL_CBIO_ERR_GENERAL;
2750        }
2751    }
2752
2753    return ret;
2754}
2755
2756/* The Micrium uTCP/IP receivefrom callback
2757 *  return : nb bytes read, or error
2758 */
2759int MicriumReceiveFrom(WOLFSSL *ssl, char *buf, int sz, void *ctx)
2760{
2761    WOLFSSL_DTLS_CTX* dtlsCtx = (WOLFSSL_DTLS_CTX*)ctx;
2762    NET_SOCK_ID       sd = dtlsCtx->rfd;
2763    NET_SOCK_ADDR     peer;
2764    NET_SOCK_ADDR_LEN peerSz = sizeof(peer);
2765    NET_SOCK_RTN_CODE ret;
2766    NET_ERR err;
2767
2768    WOLFSSL_ENTER("MicriumReceiveFrom");
2769
2770#ifdef WOLFSSL_DTLS
2771    {
2772        int dtls_timeout = wolfSSL_dtls_get_current_timeout(ssl);
2773        /* Don't use ssl->options.handShakeDone since it is true even if
2774         * we are in the process of renegotiation */
2775        byte doDtlsTimeout = ssl->options.handShakeState != HANDSHAKE_DONE;
2776
2777        #ifdef WOLFSSL_DTLS13
2778        if (ssl->options.dtls && IsAtLeastTLSv1_3(ssl->version)) {
2779            doDtlsTimeout =
2780                doDtlsTimeout || ssl->dtls13Rtx.rtxRecords != NULL ||
2781                (ssl->dtls13FastTimeout && ssl->dtls13Rtx.seenRecords != NULL);
2782        }
2783        #endif /* WOLFSSL_DTLS13 */
2784
2785        if (!doDtlsTimeout)
2786            dtls_timeout = 0;
2787
2788        if (!wolfSSL_dtls_get_using_nonblock(ssl)) {
2789            /* needs timeout in milliseconds */
2790            #ifdef WOLFSSL_DTLS13
2791            if (wolfSSL_dtls13_use_quick_timeout(ssl) &&
2792                IsAtLeastTLSv1_3(ssl->version)) {
2793                dtls_timeout = (1000 * dtls_timeout) / 4;
2794            } else
2795            #endif /* WOLFSSL_DTLS13 */
2796                dtls_timeout = 1000 * dtls_timeout;
2797            NetSock_CfgTimeoutRxQ_Set(sd, dtls_timeout, &err);
2798            if (err != NET_SOCK_ERR_NONE) {
2799                WOLFSSL_MSG("NetSock_CfgTimeoutRxQ_Set failed");
2800            }
2801        }
2802    }
2803#endif /* WOLFSSL_DTLS */
2804
2805    ret = NetSock_RxDataFrom(sd, buf, sz, ssl->rflags, &peer, &peerSz,
2806                             0, 0, 0, &err);
2807    if (ret < 0) {
2808        WOLFSSL_MSG("Embed Receive From error");
2809
2810        if (err == NET_ERR_RX || err == NET_SOCK_ERR_RX_Q_EMPTY ||
2811            err == NET_ERR_FAULT_LOCK_ACQUIRE) {
2812            if (wolfSSL_dtls_get_using_nonblock(ssl)) {
2813                WOLFSSL_MSG("\tWould block");
2814                return WOLFSSL_CBIO_ERR_WANT_READ;
2815            }
2816            else {
2817                WOLFSSL_MSG("\tSocket timeout");
2818                return WOLFSSL_CBIO_ERR_TIMEOUT;
2819            }
2820        } else {
2821            WOLFSSL_MSG("\tGeneral error");
2822            return WOLFSSL_CBIO_ERR_GENERAL;
2823        }
2824    }
2825    else {
2826        if (dtlsCtx->peer.sz > 0) {
2827            NET_SOCK_ADDR_LEN expectedPeerSz =
2828                (NET_SOCK_ADDR_LEN)dtlsCtx->peer.sz;
2829            if (dtlsCtx->peer.sa == NULL ||
2830                peerSz != expectedPeerSz ||
2831                XMEMCMP(&peer, dtlsCtx->peer.sa, expectedPeerSz) != 0) {
2832                WOLFSSL_MSG("\tIgnored packet from invalid peer");
2833                return WOLFSSL_CBIO_ERR_WANT_READ;
2834            }
2835        }
2836    }
2837
2838    return ret;
2839}
2840
2841/* The Micrium uTCP/IP sendto callback
2842 *  return : nb bytes sent, or error
2843 */
2844int MicriumSendTo(WOLFSSL* ssl, char *buf, int sz, void *ctx)
2845{
2846    WOLFSSL_DTLS_CTX* dtlsCtx = (WOLFSSL_DTLS_CTX*)ctx;
2847    NET_SOCK_ID sd = dtlsCtx->wfd;
2848    NET_SOCK_RTN_CODE ret;
2849    NET_ERR err;
2850
2851    WOLFSSL_ENTER("MicriumSendTo");
2852
2853    ret = NetSock_TxDataTo(sd, buf, sz, ssl->wflags,
2854                           (NET_SOCK_ADDR*)dtlsCtx->peer.sa,
2855                           (NET_SOCK_ADDR_LEN)dtlsCtx->peer.sz,
2856                           &err);
2857    if (err < 0) {
2858        WOLFSSL_MSG("Embed Send To error");
2859
2860        if (err == NET_ERR_TX) {
2861            WOLFSSL_MSG("\tWould block");
2862            return WOLFSSL_CBIO_ERR_WANT_WRITE;
2863
2864        } else {
2865            WOLFSSL_MSG("\tGeneral error");
2866            return WOLFSSL_CBIO_ERR_GENERAL;
2867        }
2868    }
2869
2870    return ret;
2871}
2872
2873/* Micrium DTLS Generate Cookie callback
2874 *  return : number of bytes copied into buf, or error
2875 */
2876#if defined(NO_SHA) && !defined(NO_SHA256)
2877    #define MICRIUM_COOKIE_DIGEST_SIZE WC_SHA256_DIGEST_SIZE
2878#elif !defined(NO_SHA)
2879    #define MICRIUM_COOKIE_DIGEST_SIZE WC_SHA_DIGEST_SIZE
2880#else
2881    #error Must enable either SHA-1 or SHA256 (or both) for Micrium.
2882#endif
2883int MicriumGenerateCookie(WOLFSSL* ssl, byte *buf, int sz, void *ctx)
2884{
2885    NET_SOCK_ADDR peer;
2886    NET_SOCK_ADDR_LEN peerSz = sizeof(peer);
2887    byte digest[MICRIUM_COOKIE_DIGEST_SIZE];
2888    int  ret = 0;
2889
2890    (void)ctx;
2891
2892    XMEMSET(&peer, 0, sizeof(peer));
2893    if (wolfSSL_dtls_get_peer(ssl, (void*)&peer,
2894                              (unsigned int*)&peerSz) != WOLFSSL_SUCCESS) {
2895        WOLFSSL_MSG("getpeername failed in MicriumGenerateCookie");
2896        return GEN_COOKIE_E;
2897    }
2898
2899#if defined(NO_SHA) && !defined(NO_SHA256)
2900    ret = wc_Sha256Hash((byte*)&peer, peerSz, digest);
2901#else
2902    ret = wc_ShaHash((byte*)&peer, peerSz, digest);
2903#endif
2904    if (ret != 0)
2905        return ret;
2906
2907    if (sz > MICRIUM_COOKIE_DIGEST_SIZE)
2908        sz = MICRIUM_COOKIE_DIGEST_SIZE;
2909    XMEMCPY(buf, digest, sz);
2910
2911    return sz;
2912}
2913
2914#endif /* MICRIUM */
2915
2916#if defined(WOLFSSL_APACHE_MYNEWT) && !defined(WOLFSSL_LWIP)
2917
2918#include <os/os_error.h>
2919#include <os/os_mbuf.h>
2920#include <os/os_mempool.h>
2921
2922#define MB_NAME "wolfssl_mb"
2923
2924typedef struct Mynewt_Ctx {
2925        struct mn_socket *mnSocket;          /* send/recv socket handler */
2926        struct mn_sockaddr_in mnSockAddrIn;  /* socket address */
2927        struct os_mbuf *mnPacket;            /* incoming packet handle
2928                                                for short reads */
2929        int reading;                         /* reading flag */
2930
2931        /* private */
2932        void *mnMemBuffer;                   /* memory buffer for mempool */
2933        struct os_mempool mnMempool;         /* mempool */
2934        struct os_mbuf_pool mnMbufpool;      /* mbuf pool */
2935} Mynewt_Ctx;
2936
2937void mynewt_ctx_clear(void *ctx) {
2938    Mynewt_Ctx *mynewt_ctx = (Mynewt_Ctx*)ctx;
2939    if(!mynewt_ctx) return;
2940
2941    if(mynewt_ctx->mnPacket) {
2942        os_mbuf_free_chain(mynewt_ctx->mnPacket);
2943        mynewt_ctx->mnPacket = NULL;
2944    }
2945    os_mempool_clear(&mynewt_ctx->mnMempool);
2946    XFREE(mynewt_ctx->mnMemBuffer, 0, 0);
2947    XFREE(mynewt_ctx, 0, 0);
2948}
2949
2950/* return Mynewt_Ctx instance */
2951void* mynewt_ctx_new() {
2952    int rc = 0;
2953    Mynewt_Ctx *mynewt_ctx;
2954    int mem_buf_count = MYNEWT_VAL(WOLFSSL_MNSOCK_MEM_BUF_COUNT);
2955    int mem_buf_size = MYNEWT_VAL(WOLFSSL_MNSOCK_MEM_BUF_SIZE);
2956    int mempool_bytes = OS_MEMPOOL_BYTES(mem_buf_count, mem_buf_size);
2957
2958    mynewt_ctx = (Mynewt_Ctx *)XMALLOC(sizeof(struct Mynewt_Ctx),
2959                                       NULL, DYNAMIC_TYPE_TMP_BUFFER);
2960    if(!mynewt_ctx) return NULL;
2961
2962    XMEMSET(mynewt_ctx, 0, sizeof(Mynewt_Ctx));
2963    mynewt_ctx->mnMemBuffer = (void *)XMALLOC(mempool_bytes, 0, 0);
2964    if(!mynewt_ctx->mnMemBuffer) {
2965        mynewt_ctx_clear((void*)mynewt_ctx);
2966        return NULL;
2967    }
2968
2969    rc = os_mempool_init(&mynewt_ctx->mnMempool,
2970                         mem_buf_count, mem_buf_size,
2971                         mynewt_ctx->mnMemBuffer, MB_NAME);
2972    if(rc != 0) {
2973        mynewt_ctx_clear((void*)mynewt_ctx);
2974        return NULL;
2975    }
2976    rc = os_mbuf_pool_init(&mynewt_ctx->mnMbufpool, &mynewt_ctx->mnMempool,
2977                           mem_buf_count, mem_buf_size);
2978    if(rc != 0) {
2979        mynewt_ctx_clear((void*)mynewt_ctx);
2980        return NULL;
2981    }
2982
2983    return mynewt_ctx;
2984}
2985
2986static void mynewt_sock_writable(void *arg, int err);
2987static void mynewt_sock_readable(void *arg, int err);
2988static const union mn_socket_cb mynewt_sock_cbs = {
2989    .socket.writable = mynewt_sock_writable,
2990    .socket.readable = mynewt_sock_readable,
2991};
2992static void mynewt_sock_writable(void *arg, int err)
2993{
2994    /* do nothing */
2995}
2996static void mynewt_sock_readable(void *arg, int err)
2997{
2998    Mynewt_Ctx *mynewt_ctx = (Mynewt_Ctx *)arg;
2999    if (err && mynewt_ctx->reading) {
3000        mynewt_ctx->reading = 0;
3001    }
3002}
3003
3004/* The Mynewt receive callback
3005 *  return :  bytes read, or error
3006 */
3007int Mynewt_Receive(WOLFSSL *ssl, char *buf, int sz, void *ctx)
3008{
3009    Mynewt_Ctx *mynewt_ctx = (Mynewt_Ctx*)ctx;
3010    int rc = 0;
3011    struct mn_sockaddr_in from;
3012    struct os_mbuf *m;
3013    int read_sz = 0;
3014    word16 total;
3015
3016    if (mynewt_ctx == NULL || mynewt_ctx->mnSocket == NULL) {
3017        WOLFSSL_MSG("Mynewt Recv NULL parameters");
3018        return WOLFSSL_CBIO_ERR_GENERAL;
3019    }
3020
3021    if(mynewt_ctx->mnPacket == NULL) {
3022        mynewt_ctx->mnPacket = os_mbuf_get_pkthdr(&mynewt_ctx->mnMbufpool, 0);
3023        if(mynewt_ctx->mnPacket == NULL) {
3024            return MEMORY_E;
3025        }
3026
3027        mynewt_ctx->reading = 1;
3028        while(mynewt_ctx->reading && rc == 0) {
3029            rc = mn_recvfrom(mynewt_ctx->mnSocket, &m, (struct mn_sockaddr *) &from);
3030            if(rc == MN_ECONNABORTED) {
3031                rc = 0;
3032                mynewt_ctx->reading = 0;
3033                break;
3034            }
3035            if (!(rc == 0 || rc == MN_EAGAIN)) {
3036                WOLFSSL_MSG("Mynewt Recv receive error");
3037                mynewt_ctx->reading = 0;
3038                break;
3039            }
3040            if(rc == 0) {
3041                int len = OS_MBUF_PKTLEN(m);
3042                if(len == 0) {
3043                    break;
3044                }
3045                rc = os_mbuf_appendfrom(mynewt_ctx->mnPacket, m, 0, len);
3046                if(rc != 0) {
3047                    WOLFSSL_MSG("Mynewt Recv os_mbuf_appendfrom error");
3048                    break;
3049                }
3050                os_mbuf_free_chain(m);
3051                m = NULL;
3052            } else if(rc == MN_EAGAIN) {
3053                /* continue to until reading all of packet data. */
3054                rc = 0;
3055                break;
3056            }
3057        }
3058        if(rc != 0) {
3059            mynewt_ctx->reading = 0;
3060            os_mbuf_free_chain(mynewt_ctx->mnPacket);
3061            mynewt_ctx->mnPacket = NULL;
3062            return rc;
3063        }
3064    }
3065
3066    if(mynewt_ctx->mnPacket) {
3067        total = OS_MBUF_PKTLEN(mynewt_ctx->mnPacket);
3068        read_sz = (total >= sz)? sz : total;
3069
3070        os_mbuf_copydata(mynewt_ctx->mnPacket, 0, read_sz, (void*)buf);
3071        os_mbuf_adj(mynewt_ctx->mnPacket, read_sz);
3072
3073        if (read_sz == total) {
3074            WOLFSSL_MSG("Mynewt Recv Drained packet");
3075            os_mbuf_free_chain(mynewt_ctx->mnPacket);
3076            mynewt_ctx->mnPacket = NULL;
3077        }
3078    }
3079
3080    return read_sz;
3081}
3082
3083/* The Mynewt send callback
3084 *  return : bytes sent, or error
3085 */
3086int Mynewt_Send(WOLFSSL* ssl, char *buf, int sz, void *ctx)
3087{
3088    Mynewt_Ctx *mynewt_ctx = (Mynewt_Ctx*)ctx;
3089    int rc = 0;
3090    struct os_mbuf *m;
3091    int write_sz = 0;
3092    m = os_msys_get_pkthdr(sz, 0);
3093    if (!m) {
3094        WOLFSSL_MSG("Mynewt Send os_msys_get_pkthdr error");
3095        return WOLFSSL_CBIO_ERR_GENERAL;
3096    }
3097    rc = os_mbuf_copyinto(m, 0, buf, sz);
3098    if (rc != 0) {
3099        WOLFSSL_MSG("Mynewt Send os_mbuf_copyinto error");
3100        os_mbuf_free_chain(m);
3101        return rc;
3102    }
3103    rc = mn_sendto(mynewt_ctx->mnSocket, m, (struct mn_sockaddr *)&mynewt_ctx->mnSockAddrIn);
3104    if(rc != 0) {
3105        WOLFSSL_MSG("Mynewt Send mn_sendto error");
3106        os_mbuf_free_chain(m);
3107        return rc;
3108    }
3109    write_sz = sz;
3110    return write_sz;
3111}
3112
3113/* like set_fd, but for default NetX context */
3114void wolfSSL_SetIO_Mynewt(WOLFSSL* ssl, struct mn_socket* mnSocket, struct mn_sockaddr_in* mnSockAddrIn)
3115{
3116    if (ssl && ssl->mnCtx) {
3117        Mynewt_Ctx *mynewt_ctx = (Mynewt_Ctx *)ssl->mnCtx;
3118        mynewt_ctx->mnSocket = mnSocket;
3119        XMEMCPY(&mynewt_ctx->mnSockAddrIn, mnSockAddrIn, sizeof(struct mn_sockaddr_in));
3120        mn_socket_set_cbs(mynewt_ctx->mnSocket, mnSocket, &mynewt_sock_cbs);
3121    }
3122}
3123
3124#endif /* defined(WOLFSSL_APACHE_MYNEWT) && !defined(WOLFSSL_LWIP) */
3125
3126#ifdef WOLFSSL_UIP
3127#include <uip.h>
3128#include <stdio.h>
3129
3130/* uIP TCP/IP port, using the native tcp/udp socket api.
3131 * TCP and UDP are currently supported with the callbacks below.
3132 *
3133 */
3134/* The uIP tcp send callback
3135 * return : bytes sent, or error
3136 */
3137int uIPSend(WOLFSSL* ssl, char* buf, int sz, void* _ctx)
3138{
3139    uip_wolfssl_ctx *ctx = (struct uip_wolfssl_ctx *)_ctx;
3140    int total_written = 0;
3141    (void)ssl;
3142    do {
3143        int ret;
3144        unsigned int bytes_left = sz - total_written;
3145        unsigned int max_sendlen = tcp_socket_max_sendlen(&ctx->conn.tcp);
3146        if (bytes_left > max_sendlen) {
3147            fprintf(stderr, "uIPSend: Send limited by buffer\r\n");
3148            bytes_left = max_sendlen;
3149        }
3150        if (bytes_left == 0) {
3151            fprintf(stderr, "uIPSend: Buffer full!\r\n");
3152            break;
3153        }
3154        ret = tcp_socket_send(&ctx->conn.tcp, (unsigned char *)buf + total_written, bytes_left);
3155        if (ret <= 0)
3156            break;
3157        total_written += ret;
3158    } while(total_written < sz);
3159    if (total_written == 0)
3160        return WOLFSSL_CBIO_ERR_WANT_WRITE;
3161    return total_written;
3162}
3163
3164int uIPSendTo(WOLFSSL* ssl, char* buf, int sz, void* _ctx)
3165{
3166    uip_wolfssl_ctx *ctx = (struct uip_wolfssl_ctx *)_ctx;
3167    int ret = 0;
3168    (void)ssl;
3169    ret = udp_socket_sendto(&ctx->conn.udp, (unsigned char *)buf, sz, &ctx->peer_addr, ctx->peer_port );
3170    if (ret == 0)
3171        return WOLFSSL_CBIO_ERR_WANT_WRITE;
3172    return ret;
3173}
3174
3175/* The uIP uTCP/IP receive callback
3176 *  return : nb bytes read, or error
3177 */
3178int uIPReceive(WOLFSSL *ssl, char *buf, int sz, void *_ctx)
3179{
3180    uip_wolfssl_ctx *ctx = (uip_wolfssl_ctx *)_ctx;
3181    if (!ctx || !ctx->ssl_rx_databuf)
3182        return WOLFSSL_FATAL_ERROR;
3183    (void)ssl;
3184    if (ctx->ssl_rb_len > 0) {
3185        if (sz > ctx->ssl_rb_len - ctx->ssl_rb_off)
3186            sz = ctx->ssl_rb_len - ctx->ssl_rb_off;
3187        XMEMCPY(buf, ctx->ssl_rx_databuf + ctx->ssl_rb_off, sz);
3188        ctx->ssl_rb_off += sz;
3189        if (ctx->ssl_rb_off >= ctx->ssl_rb_len) {
3190            ctx->ssl_rb_len = 0;
3191            ctx->ssl_rb_off = 0;
3192        }
3193        return sz;
3194    } else {
3195        return WOLFSSL_CBIO_ERR_WANT_READ;
3196    }
3197}
3198
3199/* uIP DTLS Generate Cookie callback
3200 *  return : number of bytes copied into buf, or error
3201 */
3202#if defined(NO_SHA) && !defined(NO_SHA256)
3203    #define UIP_COOKIE_DIGEST_SIZE WC_SHA256_DIGEST_SIZE
3204#elif !defined(NO_SHA)
3205    #define UIP_COOKIE_DIGEST_SIZE WC_SHA_DIGEST_SIZE
3206#else
3207    #error Must enable either SHA-1 or SHA256 (or both) for uIP.
3208#endif
3209int uIPGenerateCookie(WOLFSSL* ssl, byte *buf, int sz, void *_ctx)
3210{
3211    uip_wolfssl_ctx *ctx = (uip_wolfssl_ctx *)_ctx;
3212    byte token[32];
3213    byte digest[UIP_COOKIE_DIGEST_SIZE];
3214    int  ret = 0;
3215    XMEMSET(token, 0, sizeof(token));
3216    XMEMCPY(token, &ctx->peer_addr, sizeof(uip_ipaddr_t));
3217    XMEMCPY(token + sizeof(uip_ipaddr_t), &ctx->peer_port, sizeof(word16));
3218#if defined(NO_SHA) && !defined(NO_SHA256)
3219    ret = wc_Sha256Hash(token, sizeof(uip_ipaddr_t) + sizeof(word16), digest);
3220#else
3221    ret = wc_ShaHash(token, sizeof(uip_ipaddr_t) + sizeof(word16), digest);
3222#endif
3223    if (ret != 0)
3224        return ret;
3225    if (sz > UIP_COOKIE_DIGEST_SIZE)
3226        sz = UIP_COOKIE_DIGEST_SIZE;
3227    XMEMCPY(buf, digest, sz);
3228    return sz;
3229}
3230
3231#endif /* WOLFSSL_UIP */
3232
3233#ifdef WOLFSSL_GNRC
3234
3235#include <net/sock.h>
3236#include <net/sock/tcp.h>
3237#include <stdio.h>
3238
3239/* GNRC TCP/IP port, using the native tcp/udp socket api.
3240 * TCP and UDP are currently supported with the callbacks below.
3241 *
3242 */
3243/* The GNRC tcp send callback
3244 * return : bytes sent, or error
3245 */
3246
3247int GNRC_SendTo(WOLFSSL* ssl, char* buf, int sz, void* _ctx)
3248{
3249    sock_tls_t *ctx = (sock_tls_t *)_ctx;
3250    int ret = 0;
3251    (void)ssl;
3252    if (!ctx)
3253        return WOLFSSL_CBIO_ERR_GENERAL;
3254    ret = sock_udp_send(&ctx->conn.udp, (unsigned char *)buf, sz, &ctx->peer_addr);
3255    if (ret == 0)
3256        return WOLFSSL_CBIO_ERR_WANT_WRITE;
3257    return ret;
3258}
3259
3260/* The GNRC TCP/IP receive callback
3261 *  return : nb bytes read, or error
3262 */
3263int GNRC_ReceiveFrom(WOLFSSL *ssl, char *buf, int sz, void *_ctx)
3264{
3265    sock_udp_ep_t ep;
3266    int ret;
3267    word32 timeout = wolfSSL_dtls_get_current_timeout(ssl) * 1000000;
3268    sock_tls_t *ctx = (sock_tls_t *)_ctx;
3269    if (!ctx)
3270        return WOLFSSL_CBIO_ERR_GENERAL;
3271    (void)ssl;
3272    if (wolfSSL_get_using_nonblock(ctx->ssl)) {
3273        timeout = 0;
3274    }
3275    ret = sock_udp_recv(&ctx->conn.udp, buf, sz, timeout, &ep);
3276    if (ret > 0) {
3277        if (ctx->peer_addr.port == 0)
3278            XMEMCPY(&ctx->peer_addr, &ep, sizeof(sock_udp_ep_t));
3279    }
3280    if (ret == -ETIMEDOUT) {
3281        return WOLFSSL_CBIO_ERR_WANT_READ;
3282    }
3283    return ret;
3284}
3285
3286/* GNRC DTLS Generate Cookie callback
3287 *  return : number of bytes copied into buf, or error
3288 */
3289#define GNRC_MAX_TOKEN_SIZE (32)
3290#if defined(NO_SHA) && !defined(NO_SHA256)
3291    #define GNRC_COOKIE_DIGEST_SIZE WC_SHA256_DIGEST_SIZE
3292#elif !defined(NO_SHA)
3293    #define GNRC_COOKIE_DIGEST_SIZE WC_SHA_DIGEST_SIZE
3294#else
3295    #error Must enable either SHA-1 or SHA256 (or both) for GNRC.
3296#endif
3297int GNRC_GenerateCookie(WOLFSSL* ssl, byte *buf, int sz, void *_ctx)
3298{
3299    sock_tls_t *ctx = (sock_tls_t *)_ctx;
3300    if (!ctx)
3301        return WOLFSSL_CBIO_ERR_GENERAL;
3302    byte token[GNRC_MAX_TOKEN_SIZE];
3303    byte digest[GNRC_COOKIE_DIGEST_SIZE];
3304    int  ret = 0;
3305    size_t token_size = sizeof(sock_udp_ep_t);
3306    (void)ssl;
3307    if (token_size > GNRC_MAX_TOKEN_SIZE)
3308        token_size = GNRC_MAX_TOKEN_SIZE;
3309    XMEMSET(token, 0, GNRC_MAX_TOKEN_SIZE);
3310    XMEMCPY(token, &ctx->peer_addr, token_size);
3311#if defined(NO_SHA) && !defined(NO_SHA256)
3312    ret = wc_Sha256Hash(token, token_size, digest);
3313#else
3314    ret = wc_ShaHash(token, token_size, digest);
3315#endif
3316    if (ret != 0)
3317        return ret;
3318    if (sz > GNRC_COOKIE_DIGEST_SIZE)
3319        sz = GNRC_COOKIE_DIGEST_SIZE;
3320    XMEMCPY(buf, digest, sz);
3321    return sz;
3322}
3323
3324#endif /* WOLFSSL_GNRC */
3325
3326#ifdef WOLFSSL_LWIP_NATIVE
3327int LwIPNativeSend(WOLFSSL* ssl, char* buf, int sz, void* ctx)
3328{
3329    err_t ret;
3330    WOLFSSL_LWIP_NATIVE_STATE* nlwip = (WOLFSSL_LWIP_NATIVE_STATE*)ctx;
3331
3332    if (sz < 0 || sz > (int)WOLFSSL_MAX_16BIT) {
3333        return BAD_FUNC_ARG;
3334    }
3335
3336    ret = tcp_write(nlwip->pcb, buf, (u16_t)sz, TCP_WRITE_FLAG_COPY);
3337    if (ret != ERR_OK) {
3338        sz = WOLFSSL_FATAL_ERROR;
3339    }
3340
3341    return sz;
3342}
3343
3344
3345int LwIPNativeReceive(WOLFSSL* ssl, char* buf, int sz, void* ctx)
3346{
3347    struct pbuf *current, *head;
3348    WOLFSSL_LWIP_NATIVE_STATE* nlwip;
3349    int ret = 0;
3350
3351    if (ctx == NULL) {
3352        return WOLFSSL_CBIO_ERR_GENERAL;
3353    }
3354    nlwip = (WOLFSSL_LWIP_NATIVE_STATE*)ctx;
3355
3356    current = nlwip->pbuf;
3357    if (current == NULL || sz > current->tot_len) {
3358        WOLFSSL_MSG("LwIP native pbuf list is null or not enough data, want read");
3359        ret = WOLFSSL_CBIO_ERR_WANT_READ;
3360    }
3361    else {
3362        int read = 0; /* total amount read */
3363        head = nlwip->pbuf; /* save pointer to current head */
3364
3365        /* loop through buffers reading data */
3366        while (current != NULL) {
3367            int len; /* current amount to be read */
3368
3369            len = (current->len - nlwip->pulled < sz) ?
3370                                            (current->len - nlwip->pulled) : sz;
3371
3372            if (read + len > sz) {
3373                /* should never be hit but have sanity check before use */
3374                return WOLFSSL_CBIO_ERR_GENERAL;
3375            }
3376
3377            /* check if is a partial read from before */
3378            XMEMCPY(&buf[read],
3379                   (const char *)&(((char *)(current->payload))[nlwip->pulled]),
3380
3381                    len);
3382            nlwip->pulled = nlwip->pulled + len;
3383            if (nlwip->pulled >= current->len) {
3384                WOLFSSL_MSG("Native LwIP read full pbuf");
3385                nlwip->pbuf = current->next;
3386                current = nlwip->pbuf;
3387                nlwip->pulled = 0;
3388            }
3389            read = read + len;
3390            ret  = read;
3391
3392            /* read enough break out */
3393            if (read >= sz) {
3394                /* if more pbuf's are left in the chain then increment the
3395                 * ref count for next in chain and free all from beginning till
3396                 * next */
3397                if (current != NULL) {
3398                    pbuf_ref(current);
3399                }
3400
3401                /* ack and start free'ing from the current head of the chain */
3402                pbuf_free(head);
3403                break;
3404            }
3405        }
3406    }
3407    WOLFSSL_LEAVE("LwIPNativeReceive", ret);
3408    return ret;
3409}
3410
3411
3412static err_t LwIPNativeReceiveCB(void* cb, struct tcp_pcb* pcb,
3413                                struct pbuf* pbuf, err_t err)
3414{
3415    WOLFSSL_LWIP_NATIVE_STATE* nlwip;
3416
3417    if (cb == NULL || pcb == NULL) {
3418        WOLFSSL_MSG("Expected callback was null, abort");
3419        return ERR_ABRT;
3420    }
3421
3422    nlwip = (WOLFSSL_LWIP_NATIVE_STATE*)cb;
3423    if (pbuf == NULL && err == ERR_OK) {
3424        return ERR_OK;
3425    }
3426
3427    if (nlwip->pbuf == NULL) {
3428        nlwip->pbuf = pbuf;
3429    }
3430    else {
3431        if (nlwip->pbuf != pbuf) {
3432            tcp_recved(nlwip->pcb, pbuf->tot_len);
3433            pbuf_cat(nlwip->pbuf, pbuf); /* add chain to head */
3434        }
3435    }
3436
3437    if (nlwip->recv_fn) {
3438        return nlwip->recv_fn(nlwip->arg, pcb, pbuf, err);
3439    }
3440
3441    WOLFSSL_LEAVE("LwIPNativeReceiveCB", nlwip->pbuf->tot_len);
3442    return ERR_OK;
3443}
3444
3445
3446static err_t LwIPNativeSentCB(void* cb, struct tcp_pcb* pcb, u16_t len)
3447{
3448    WOLFSSL_LWIP_NATIVE_STATE* nlwip;
3449
3450    if (cb == NULL || pcb == NULL) {
3451        WOLFSSL_MSG("Expected callback was null, abort");
3452        return ERR_ABRT;
3453    }
3454
3455    nlwip = (WOLFSSL_LWIP_NATIVE_STATE*)cb;
3456    if (nlwip->sent_fn) {
3457        return nlwip->sent_fn(nlwip->arg, pcb, len);
3458    }
3459    return ERR_OK;
3460}
3461
3462
3463int wolfSSL_SetIO_LwIP(WOLFSSL* ssl, void* pcb,
3464                          tcp_recv_fn recv_fn, tcp_sent_fn sent_fn, void *arg)
3465{
3466    if (ssl == NULL || pcb == NULL)
3467        return BAD_FUNC_ARG;
3468
3469    ssl->lwipCtx.pcb = (struct tcp_pcb *)pcb;
3470    ssl->lwipCtx.recv_fn = recv_fn; /*  recv user callback */
3471    ssl->lwipCtx.sent_fn = sent_fn; /*  sent user callback */
3472    ssl->lwipCtx.arg  = arg;
3473    ssl->lwipCtx.pbuf = 0;
3474    ssl->lwipCtx.pulled = 0;
3475    ssl->lwipCtx.wait   = 0;
3476
3477    /* wolfSSL_LwIP_recv/sent_cb invokes recv/sent user callback in them. */
3478    tcp_recv(pcb, LwIPNativeReceiveCB);
3479    tcp_sent(pcb, LwIPNativeSentCB);
3480    tcp_arg (pcb, (void *)&ssl->lwipCtx);
3481    wolfSSL_SetIOReadCtx(ssl, &ssl->lwipCtx);
3482    wolfSSL_SetIOWriteCtx(ssl, &ssl->lwipCtx);
3483
3484    return ERR_OK;
3485}
3486#endif /* WOLFSSL_LWIP_NATIVE */
3487
3488#ifdef WOLFSSL_ISOTP
3489static int isotp_send_single_frame(struct isotp_wolfssl_ctx *ctx, char *buf,
3490        word16 length)
3491{
3492    /* Length will be at most 7 bytes to get here. Packet is length and type
3493     * for the first byte, then up to 7 bytes of data */
3494    ctx->frame.data[0] = ((byte)length) | (ISOTP_FRAME_TYPE_SINGLE << 4);
3495    XMEMCPY(&ctx->frame.data[1], buf, length);
3496    ctx->frame.length = length + 1;
3497    return ctx->send_fn(&ctx->frame, ctx->arg);
3498}
3499
3500static int isotp_send_flow_control(struct isotp_wolfssl_ctx *ctx,
3501        byte overflow)
3502{
3503    int ret;
3504    /* Overflow is set it if we have been asked to receive more data than the
3505     * user allocated a buffer for */
3506    if (overflow) {
3507        ctx->frame.data[0] = ISOTP_FLOW_CONTROL_ABORT |
3508            (ISOTP_FRAME_TYPE_CONTROL << 4);
3509    } else {
3510        ctx->frame.data[0] = ISOTP_FLOW_CONTROL_CTS |
3511            (ISOTP_FRAME_TYPE_CONTROL << 4);
3512    }
3513    /* Set the number of frames between flow control to infinite */
3514    ctx->frame.data[1] = ISOTP_FLOW_CONTROL_FRAMES;
3515    /* User specified frame delay */
3516    ctx->frame.data[2] = ctx->receive_delay;
3517    ctx->frame.length = ISOTP_FLOW_CONTROL_PACKET_SIZE;
3518    ret = ctx->send_fn(&ctx->frame, ctx->arg);
3519    return ret;
3520}
3521
3522static int isotp_receive_flow_control(struct isotp_wolfssl_ctx *ctx)
3523{
3524    int ret;
3525    enum isotp_frame_type type;
3526    enum isotp_flow_control flow_control;
3527    ret = ctx->recv_fn(&ctx->frame, ctx->arg, ISOTP_DEFAULT_TIMEOUT);
3528    if (ret == 0) {
3529        return WOLFSSL_CBIO_ERR_TIMEOUT;
3530    } else if (ret < 0) {
3531        WOLFSSL_MSG("ISO-TP error receiving flow control packet");
3532        return WOLFSSL_CBIO_ERR_GENERAL;
3533    }
3534    /* Flow control is the frame type and flow response for the first byte,
3535     * number of frames until the next flow control packet for the second
3536     * byte, time between frames for the third byte */
3537    type = ctx->frame.data[0] >> 4;
3538
3539    if (type != ISOTP_FRAME_TYPE_CONTROL) {
3540        WOLFSSL_MSG("ISO-TP frames out of sequence");
3541        return WOLFSSL_CBIO_ERR_GENERAL;
3542    }
3543
3544    flow_control = ctx->frame.data[0] & 0xf;
3545
3546    ctx->flow_counter = 0;
3547    ctx->flow_packets = ctx->frame.data[1];
3548    ctx->frame_delay = ctx->frame.data[2];
3549
3550    return flow_control;
3551}
3552
3553static int isotp_send_consecutive_frame(struct isotp_wolfssl_ctx *ctx)
3554{
3555    /* Sequence is 0 - 15 and then starts again, the first frame has an
3556     * implied sequence of '0' */
3557    ctx->sequence += 1;
3558    if (ctx->sequence > ISOTP_MAX_SEQUENCE_COUNTER) {
3559        ctx->sequence = 0;
3560    }
3561    ctx->flow_counter++;
3562    /* First byte it type and sequence number, up to 7 bytes of data */
3563    ctx->frame.data[0] = ctx->sequence | (ISOTP_FRAME_TYPE_CONSECUTIVE << 4);
3564    if (ctx->buf_length > ISOTP_MAX_CONSECUTIVE_FRAME_DATA_SIZE) {
3565        XMEMCPY(&ctx->frame.data[1], ctx->buf_ptr,
3566                ISOTP_MAX_CONSECUTIVE_FRAME_DATA_SIZE);
3567        ctx->buf_ptr += ISOTP_MAX_CONSECUTIVE_FRAME_DATA_SIZE;
3568        ctx->buf_length -= ISOTP_MAX_CONSECUTIVE_FRAME_DATA_SIZE;
3569        ctx->frame.length = ISOTP_CAN_BUS_PAYLOAD_SIZE;
3570    } else {
3571        XMEMCPY(&ctx->frame.data[1], ctx->buf_ptr, ctx->buf_length);
3572        ctx->frame.length = ctx->buf_length + 1;
3573        ctx->buf_length = 0;
3574    }
3575    return ctx->send_fn(&ctx->frame, ctx->arg);
3576
3577}
3578
3579static int isotp_send_first_frame(struct isotp_wolfssl_ctx *ctx, char *buf,
3580        word16 length)
3581{
3582    int ret;
3583    ctx->sequence = 0;
3584    /* Set to 1 to trigger a flow control straight away, the flow control
3585     * packet will set these properly */
3586    ctx->flow_packets = ctx->flow_counter = 1;
3587    /* First frame has 1 nibble for type, 3 nibbles for length followed by
3588     * 6 bytes for data*/
3589    ctx->frame.data[0] = (length >> 8) | (ISOTP_FRAME_TYPE_FIRST << 4);
3590    ctx->frame.data[1] = length & 0xff;
3591    XMEMCPY(&ctx->frame.data[2], buf, ISOTP_FIRST_FRAME_DATA_SIZE);
3592    ctx->buf_ptr = buf + ISOTP_FIRST_FRAME_DATA_SIZE;
3593    ctx->buf_length = length - ISOTP_FIRST_FRAME_DATA_SIZE;
3594    ctx->frame.length = ISOTP_CAN_BUS_PAYLOAD_SIZE;
3595    ret = ctx->send_fn(&ctx->frame, ctx->arg);
3596    if (ret <= 0) {
3597        WOLFSSL_MSG("ISO-TP error sending first frame");
3598        return WOLFSSL_CBIO_ERR_GENERAL;
3599    }
3600    while(ctx->buf_length) {
3601        /* The receiver can set how often to get a flow control packet. If it
3602         * is time, then get the packet. Note that this will always happen
3603         * after the first packet */
3604        if ((ctx->flow_packets > 0) &&
3605                (ctx->flow_counter == ctx->flow_packets)) {
3606            ret = isotp_receive_flow_control(ctx);
3607        }
3608        /* Frame delay <= 0x7f is in ms, 0xfX is X * 100 us */
3609        if (ctx->frame_delay) {
3610            if (ctx->frame_delay <= ISOTP_MAX_MS_FRAME_DELAY) {
3611                ctx->delay_fn(ctx->frame_delay * 1000);
3612            } else {
3613                ctx->delay_fn((ctx->frame_delay & 0xf) * 100);
3614            }
3615        }
3616        switch (ret) {
3617            /* Clear to send */
3618            case ISOTP_FLOW_CONTROL_CTS:
3619                if (isotp_send_consecutive_frame(ctx) < 0) {
3620                    WOLFSSL_MSG("ISO-TP error sending consecutive frame");
3621                    return WOLFSSL_CBIO_ERR_GENERAL;
3622                }
3623                break;
3624            /* Receiver says "WAIT", so we wait for another flow control
3625             * packet, or abort if we have waited too long */
3626            case ISOTP_FLOW_CONTROL_WAIT:
3627                ctx->wait_counter += 1;
3628                if (ctx->wait_counter > ISOTP_DEFAULT_WAIT_COUNT) {
3629                    WOLFSSL_MSG("ISO-TP receiver told us to wait too many"
3630                            " times");
3631                    return WOLFSSL_CBIO_ERR_WANT_WRITE;
3632                }
3633                break;
3634            /* Receiver is not ready to receive packet, so abort */
3635            case ISOTP_FLOW_CONTROL_ABORT:
3636                WOLFSSL_MSG("ISO-TP receiver aborted transmission");
3637                return WOLFSSL_CBIO_ERR_WANT_WRITE;
3638            default:
3639                WOLFSSL_MSG("ISO-TP got unexpected flow control packet");
3640                return WOLFSSL_CBIO_ERR_GENERAL;
3641        }
3642    }
3643    return 0;
3644}
3645
3646int ISOTP_Send(WOLFSSL* ssl, char* buf, int sz, void* ctx)
3647{
3648    int ret;
3649    struct isotp_wolfssl_ctx *isotp_ctx;
3650    (void) ssl;
3651
3652    if (!ctx) {
3653        WOLFSSL_MSG("ISO-TP requires wolfSSL_SetIO_ISOTP to be called first");
3654        return WOLFSSL_CBIO_ERR_GENERAL;
3655    }
3656    isotp_ctx = (struct isotp_wolfssl_ctx*) ctx;
3657
3658    /* ISO-TP cannot send more than 4095 bytes, this limits the packet size
3659     * and wolfSSL will try again with the remaining data */
3660    if (sz > ISOTP_MAX_DATA_SIZE) {
3661        sz = ISOTP_MAX_DATA_SIZE;
3662    }
3663    /* Can't send whilst we are receiving */
3664    if (isotp_ctx->state != ISOTP_CONN_STATE_IDLE) {
3665        return WOLFSSL_ERROR_WANT_WRITE;
3666    }
3667    isotp_ctx->state = ISOTP_CONN_STATE_SENDING;
3668
3669    /* Assuming normal addressing */
3670    if (sz <= ISOTP_SINGLE_FRAME_DATA_SIZE) {
3671        ret = isotp_send_single_frame(isotp_ctx, buf, (word16)sz);
3672    } else {
3673        ret = isotp_send_first_frame(isotp_ctx, buf, (word16)sz);
3674    }
3675    isotp_ctx->state = ISOTP_CONN_STATE_IDLE;
3676
3677    if (ret == 0) {
3678        return sz;
3679    }
3680    return ret;
3681}
3682
3683static int isotp_receive_single_frame(struct isotp_wolfssl_ctx *ctx)
3684{
3685    byte data_size;
3686
3687    /* 1 nibble for data size which will be 1 - 7 in a regular 8 byte CAN
3688     * packet */
3689    data_size = (byte)ctx->frame.data[0] & 0xf;
3690    if (ctx->receive_buffer_size < (int)data_size) {
3691        WOLFSSL_MSG("ISO-TP buffer is too small to receive data");
3692        return BUFFER_E;
3693    }
3694    XMEMCPY(ctx->receive_buffer, &ctx->frame.data[1], data_size);
3695    return data_size;
3696}
3697
3698static int isotp_receive_multi_frame(struct isotp_wolfssl_ctx *ctx)
3699{
3700    int ret;
3701    word16 data_size;
3702    byte delay = 0;
3703
3704    /* Increase receive timeout for enforced ms delay */
3705    if (ctx->receive_delay <= ISOTP_MAX_MS_FRAME_DELAY) {
3706        delay = ctx->receive_delay;
3707    }
3708    /* Still processing first frame.
3709     * Full data size is lower nibble of first byte for the most significant
3710     * followed by the second byte for the rest. Last 6 bytes are data */
3711    data_size = ((ctx->frame.data[0] & 0xf) << 8) + ctx->frame.data[1];
3712    XMEMCPY(ctx->receive_buffer, &ctx->frame.data[2], ISOTP_FIRST_FRAME_DATA_SIZE);
3713    /* Need to send a flow control packet to either cancel or continue
3714     * transmission of data */
3715    if (ctx->receive_buffer_size < data_size) {
3716        isotp_send_flow_control(ctx, TRUE);
3717        WOLFSSL_MSG("ISO-TP buffer is too small to receive data");
3718        return BUFFER_E;
3719    }
3720    isotp_send_flow_control(ctx, FALSE);
3721
3722    ctx->buf_length = ISOTP_FIRST_FRAME_DATA_SIZE;
3723    ctx->buf_ptr = ctx->receive_buffer + ISOTP_FIRST_FRAME_DATA_SIZE;
3724    data_size -= ISOTP_FIRST_FRAME_DATA_SIZE;
3725    ctx->sequence = 1;
3726
3727    while(data_size) {
3728        enum isotp_frame_type type;
3729        byte sequence;
3730        byte frame_len;
3731        ret = ctx->recv_fn(&ctx->frame, ctx->arg, ISOTP_DEFAULT_TIMEOUT +
3732                (delay / 1000));
3733        if (ret == 0) {
3734            return WOLFSSL_CBIO_ERR_TIMEOUT;
3735        }
3736        type = ctx->frame.data[0] >> 4;
3737        /* Consecutive frames have sequence number as lower nibble */
3738        sequence = ctx->frame.data[0] & 0xf;
3739        if (type != ISOTP_FRAME_TYPE_CONSECUTIVE) {
3740            WOLFSSL_MSG("ISO-TP frames out of sequence");
3741            return WOLFSSL_CBIO_ERR_GENERAL;
3742        }
3743        if (sequence != ctx->sequence) {
3744            WOLFSSL_MSG("ISO-TP frames out of sequence");
3745            return WOLFSSL_CBIO_ERR_GENERAL;
3746        }
3747        /* Last 7 bytes or whatever we got after the first byte is data */
3748        frame_len = ctx->frame.length - 1;
3749        XMEMCPY(ctx->buf_ptr, &ctx->frame.data[1], frame_len);
3750        ctx->buf_ptr += frame_len;
3751        ctx->buf_length += frame_len;
3752        data_size -= frame_len;
3753
3754        /* Sequence is 0 - 15 (first 0 is implied for first packet */
3755        ctx->sequence++;
3756        if (ctx->sequence > ISOTP_MAX_SEQUENCE_COUNTER) {
3757            ctx->sequence = 0;
3758        }
3759    }
3760    return ctx->buf_length;
3761
3762}
3763
3764/* The wolfSSL receive callback, needs to buffer because we need to grab all
3765 * incoming data, even if wolfSSL doesn't want it all yet */
3766int ISOTP_Receive(WOLFSSL* ssl, char* buf, int sz, void* ctx)
3767{
3768    enum isotp_frame_type type;
3769    int ret;
3770    struct isotp_wolfssl_ctx *isotp_ctx;
3771    (void) ssl;
3772
3773    if (!ctx) {
3774        WOLFSSL_MSG("ISO-TP requires wolfSSL_SetIO_ISOTP to be called first");
3775        return WOLFSSL_CBIO_ERR_TIMEOUT;
3776    }
3777    isotp_ctx = (struct isotp_wolfssl_ctx*)ctx;
3778
3779    /* Is buffer empty? If so, fill it */
3780    if (!isotp_ctx->receive_buffer_len) {
3781        /* Can't send whilst we are receiving */
3782        if (isotp_ctx->state != ISOTP_CONN_STATE_IDLE) {
3783            return WOLFSSL_ERROR_WANT_READ;
3784        }
3785        isotp_ctx->state = ISOTP_CONN_STATE_RECEIVING;
3786        do {
3787            ret = isotp_ctx->recv_fn(&isotp_ctx->frame, isotp_ctx->arg,
3788                    ISOTP_DEFAULT_TIMEOUT);
3789        } while (ret == 0);
3790        if (ret == 0) {
3791            isotp_ctx->state = ISOTP_CONN_STATE_IDLE;
3792            return WOLFSSL_CBIO_ERR_TIMEOUT;
3793        } else if (ret < 0) {
3794            isotp_ctx->state = ISOTP_CONN_STATE_IDLE;
3795            WOLFSSL_MSG("ISO-TP receive error");
3796            return WOLFSSL_CBIO_ERR_GENERAL;
3797        }
3798
3799        type = (enum isotp_frame_type) isotp_ctx->frame.data[0] >> 4;
3800
3801        if (type == ISOTP_FRAME_TYPE_SINGLE) {
3802            isotp_ctx->receive_buffer_len =
3803                isotp_receive_single_frame(isotp_ctx);
3804        } else if (type == ISOTP_FRAME_TYPE_FIRST) {
3805            isotp_ctx->receive_buffer_len =
3806                isotp_receive_multi_frame(isotp_ctx);
3807        } else {
3808            /* Should never get here */
3809            isotp_ctx->state = ISOTP_CONN_STATE_IDLE;
3810            WOLFSSL_MSG("ISO-TP frames out of sequence");
3811            return WOLFSSL_CBIO_ERR_GENERAL;
3812        }
3813        if (isotp_ctx->receive_buffer_len <= 1) {
3814            isotp_ctx->state = ISOTP_CONN_STATE_IDLE;
3815            return isotp_ctx->receive_buffer_len;
3816        } else {
3817            isotp_ctx->receive_buffer_ptr = isotp_ctx->receive_buffer;
3818        }
3819        isotp_ctx->state = ISOTP_CONN_STATE_IDLE;
3820    }
3821
3822    /* Return from the buffer */
3823    if (isotp_ctx->receive_buffer_len >= sz) {
3824        XMEMCPY(buf, isotp_ctx->receive_buffer_ptr, sz);
3825        isotp_ctx->receive_buffer_ptr+= sz;
3826        isotp_ctx->receive_buffer_len-= sz;
3827        return sz;
3828    } else {
3829        XMEMCPY(buf, isotp_ctx->receive_buffer_ptr,
3830                isotp_ctx->receive_buffer_len);
3831        sz = isotp_ctx->receive_buffer_len;
3832        isotp_ctx->receive_buffer_len = 0;
3833        return sz;
3834    }
3835}
3836
3837int wolfSSL_SetIO_ISOTP(WOLFSSL *ssl, isotp_wolfssl_ctx *ctx,
3838        can_recv_fn recv_fn, can_send_fn send_fn, can_delay_fn delay_fn,
3839        word32 receive_delay, char *receive_buffer, int receive_buffer_size,
3840        void *arg)
3841{
3842    if (!ctx || !recv_fn || !send_fn || !delay_fn || !receive_buffer) {
3843        WOLFSSL_MSG("ISO-TP has missing required parameter");
3844        return WOLFSSL_CBIO_ERR_GENERAL;
3845    }
3846    ctx->recv_fn = recv_fn;
3847    ctx->send_fn = send_fn;
3848    ctx->arg = arg;
3849    ctx->delay_fn = delay_fn;
3850    ctx->frame_delay = 0;
3851    ctx->receive_buffer = receive_buffer;
3852    ctx->receive_buffer_size = receive_buffer_size;
3853    ctx->receive_buffer_len = 0;
3854    ctx->state = ISOTP_CONN_STATE_IDLE;
3855
3856    wolfSSL_SetIOReadCtx(ssl, ctx);
3857    wolfSSL_SetIOWriteCtx(ssl, ctx);
3858
3859    /* Delay of 100 - 900us is 0xfX where X is value / 100. Delay of
3860     * >= 1000 is divided by 1000. > 127ms is invalid */
3861    if (receive_delay < 1000) {
3862        ctx->receive_delay = 0xf0 + (receive_delay / 100);
3863    } else if (receive_delay <= ISOTP_MAX_MS_FRAME_DELAY * 1000) {
3864        ctx->receive_delay = receive_delay / 1000;
3865    } else {
3866        WOLFSSL_MSG("ISO-TP delay parameter out of bounds");
3867        return WOLFSSL_CBIO_ERR_GENERAL;
3868    }
3869    return 0;
3870}
3871#endif /* WOLFSSL_ISOTP */
3872#endif /* WOLFCRYPT_ONLY */