esp-tls: Fix wolfssl error codes for WANT_READ/WANT_WRITE

wolfSSL error codes are mostly positive numbers, but esp-tls potentially
non-block API (read/write) returns ssize_t, i.e. bytes read/written if
>0, errorcode otherwise. To comply with this API we have to conditionate
the wolfssl return codes to negative numbers, preferably the same codes
as mbedTLS codes.

components/esp-tls/esp_tls_errors.h

@@ -52,13 +52,18 @@ extern "C" {
 #define ESP_ERR_ESP_TLS_SE_FAILED                         (ESP_ERR_ESP_TLS_BASE + 0x1B)  /*< esp-tls use Secure Element returned failed */
 #define ESP_ERR_ESP_TLS_TCP_CLOSED_FIN                    (ESP_ERR_ESP_TLS_BASE + 0x1C)  /*< esp-tls's TPC transport connection has benn closed (in a clean way) */
 
+/**
+* Definition of errors reported from IO API (potentially non-blocking) in case of error:
+* - esp_tls_conn_read()
+* - esp_tls_conn_write()
+*/
 #ifdef CONFIG_ESP_TLS_USING_MBEDTLS
 #define ESP_TLS_ERR_SSL_WANT_READ                          MBEDTLS_ERR_SSL_WANT_READ
 #define ESP_TLS_ERR_SSL_WANT_WRITE                         MBEDTLS_ERR_SSL_WANT_WRITE
 #define ESP_TLS_ERR_SSL_TIMEOUT                            MBEDTLS_ERR_SSL_TIMEOUT
 #elif CONFIG_ESP_TLS_USING_WOLFSSL /* CONFIG_ESP_TLS_USING_MBEDTLS */
-#define ESP_TLS_ERR_SSL_WANT_READ                          WOLFSSL_ERROR_WANT_READ
-#define ESP_TLS_ERR_SSL_WANT_WRITE                         WOLFSSL_ERROR_WANT_WRITE
+#define ESP_TLS_ERR_SSL_WANT_READ                          -0x6900
+#define ESP_TLS_ERR_SSL_WANT_WRITE                         -0x6880
 #define ESP_TLS_ERR_SSL_TIMEOUT                            WOLFSSL_CBIO_ERR_TIMEOUT
 #endif /*CONFIG_ESP_TLS_USING_WOLFSSL */
 
@@ -74,7 +79,6 @@ typedef enum {
     ESP_TLS_ERR_TYPE_ESP,                   /*!< ESP-IDF error type -- esp_err_t  */
     ESP_TLS_ERR_TYPE_WOLFSSL,               /*!< Error code from wolfSSL library */
     ESP_TLS_ERR_TYPE_WOLFSSL_CERT_FLAGS,    /*!< Certificate flags defined in wolfSSL */
-    ESP_TLS_ERR_TYPE_TCP_CONNECTION,        /*!< Errors related to TCP layer, extending errno */
     ESP_TLS_ERR_TYPE_MAX,                   /*!< Last err type -- invalid entry */
 } esp_tls_error_type_t;
 

components/esp-tls/esp_tls_wolfssl.c

@@ -62,6 +62,20 @@ typedef enum x509_file_type {
     FILE_TYPE_SELF_KEY, /* Private key in the self cert-key pair */
 } x509_file_type_t;
 
+/* Error type conversion utility so that esp-tls read/write API to return negative number on error */
+static inline ssize_t esp_tls_convert_wolfssl_err_to_ssize(int wolfssl_error)
+{
+    switch (wolfssl_error) {
+        case WOLFSSL_ERROR_WANT_READ:
+            return ESP_TLS_ERR_SSL_WANT_READ;
+        case WOLFSSL_ERROR_WANT_WRITE:
+            return ESP_TLS_ERR_SSL_WANT_WRITE;
+        default:
+            // Make sure we return a negative number
+            return wolfssl_error>0 ? -wolfssl_error: wolfssl_error;
+    }
+}
+
 /* Checks whether the certificate provided is in pem format or not */
 static esp_err_t esp_load_wolfssl_verify_buffer(esp_tls_t *tls, const unsigned char *cert_buf, unsigned int cert_len, x509_file_type_t type, int *err_ret)
 {
@@ -332,9 +346,9 @@ int esp_wolfssl_handshake(esp_tls_t *tls, const esp_tls_cfg_t *cfg)
         return 1;
     } else {
         int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret);
-        if (err != ESP_TLS_ERR_SSL_WANT_READ && err != ESP_TLS_ERR_SSL_WANT_WRITE) {
-            ESP_LOGE(TAG, "wolfSSL_connect returned -0x%x", -ret);
-            ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, -ret);
+        if (err != WOLFSSL_ERROR_WANT_READ && err != WOLFSSL_ERROR_WANT_WRITE) {
+            ESP_LOGE(TAG, "wolfSSL_connect returned %d, error code: 0x%x", ret, err);
+            ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, -err);
             ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_ESP, ESP_ERR_WOLFSSL_SSL_HANDSHAKE_FAILED);
             if (cfg->cacert_buf != NULL || cfg->use_global_ca_store == true) {
                 /* This is to check whether handshake failed due to invalid certificate*/
@@ -359,10 +373,11 @@ ssize_t esp_wolfssl_read(esp_tls_t *tls, char *data, size_t datalen)
             return 0;
         }
 
-        if (ret != ESP_TLS_ERR_SSL_WANT_READ && ret != ESP_TLS_ERR_SSL_WANT_WRITE) {
+        if (ret != WOLFSSL_ERROR_WANT_READ && ret != WOLFSSL_ERROR_WANT_WRITE) {
             ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, -ret);
             ESP_LOGE(TAG, "read error :%d:", ret);
         }
+        return esp_tls_convert_wolfssl_err_to_ssize(ret);
     }
     return ret;
 }
@@ -372,12 +387,13 @@ ssize_t esp_wolfssl_write(esp_tls_t *tls, const char *data, size_t datalen)
     ssize_t ret = wolfSSL_write( (WOLFSSL *)tls->priv_ssl, (unsigned char *) data, datalen);
     if (ret < 0) {
         ret = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret);
-        if (ret != ESP_TLS_ERR_SSL_WANT_READ  && ret != ESP_TLS_ERR_SSL_WANT_WRITE) {
+        if (ret != WOLFSSL_ERROR_WANT_READ  && ret != WOLFSSL_ERROR_WANT_WRITE) {
             ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, -ret);
             ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_ESP, ESP_ERR_WOLFSSL_SSL_WRITE_FAILED);
             ESP_LOGE(TAG, "write error :%d:", ret);
 
         }
+        return esp_tls_convert_wolfssl_err_to_ssize(ret);
     }
     return ret;
 }
@@ -447,11 +463,12 @@ int esp_wolfssl_server_session_create(esp_tls_cfg_server_t *cfg, int sockfd, esp
     tls->write = esp_wolfssl_write;
     int ret;
     while ((ret = wolfSSL_accept((WOLFSSL *)tls->priv_ssl)) != WOLFSSL_SUCCESS) {
-        if (ret != ESP_TLS_ERR_SSL_WANT_READ && ret != ESP_TLS_ERR_SSL_WANT_WRITE) {
+        ret = wolfSSL_get_error((WOLFSSL *)tls->priv_ssl, ret);
+        if (ret != WOLFSSL_ERROR_WANT_READ && ret != WOLFSSL_ERROR_WANT_WRITE) {
             ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, -ret);
             ESP_LOGE(TAG, "wolfSSL_handshake_server returned %d", ret);
             tls->conn_state = ESP_TLS_FAIL;
-            return ret;
+            return -1;
         }
     }
     return 0;