From b389087ed7e1726b8f584a0fffc20cbb2386c00a Mon Sep 17 00:00:00 2001 From: Emma Stensland Date: Thu, 2 Jul 2026 09:29:16 -0600 Subject: [PATCH] F-5610: fix ENC28J60 TLS server continuing past a NULL WOLFSSL session, and harden ESP32 socket/string handling --- .../main/client-dtls13.c | 7 +- .../main/server-dtls13.c | 2 +- .../main/enc28j60_example_main.c | 25 +++-- .../main/enc28j60_example_main.c | 103 +++++++++--------- .../main/station_example_main.c | 21 ++-- .../main/station_example_main.c | 100 ++++++++++------- 6 files changed, 143 insertions(+), 115 deletions(-) diff --git a/ESP32/DTLS13-wifi-station-client/main/client-dtls13.c b/ESP32/DTLS13-wifi-station-client/main/client-dtls13.c index 749825e9..ec85629b 100644 --- a/ESP32/DTLS13-wifi-station-client/main/client-dtls13.c +++ b/ESP32/DTLS13-wifi-station-client/main/client-dtls13.c @@ -156,7 +156,7 @@ WOLFSSL_ESP_TASK dtls13_smp_client_task(void *pvParameters) ESP_LOGI(TAG, "See ./include/client-dtls13.h to update settings."); ESP_LOGI(TAG, "Setting server address to %s, port %d.", TLS_SMP_SERVER_ADDRESS, SERV_PORT); - memset(&servAddr, 0, sizeof(servAddr)); + XMEMSET(&servAddr, 0, sizeof(servAddr)); servAddr.sin_family = AF_INET; servAddr.sin_port = htons(SERV_PORT); if (inet_pton(AF_INET, TLS_SMP_SERVER_ADDRESS, &servAddr.sin_addr) < 1) { @@ -199,10 +199,11 @@ WOLFSSL_ESP_TASK dtls13_smp_client_task(void *pvParameters) ESP_LOGI(TAG, "Sending message"); - strcpy(sendLine, "Hello World."); + XSTRCPY(sendLine, "Hello World."); /* Send sendLine to the server */ - if (wolfSSL_write(ssl, sendLine, strlen(sendLine)) != strlen(sendLine)) { + if (wolfSSL_write(ssl, sendLine, XSTRLEN(sendLine)) != + XSTRLEN(sendLine)) { err = wolfSSL_get_error(ssl, 0); ESP_LOGE(TAG, "err = %d, %s\n", err, wolfSSL_ERR_reason_error_string(err)); diff --git a/ESP32/DTLS13-wifi-station-server/main/server-dtls13.c b/ESP32/DTLS13-wifi-station-server/main/server-dtls13.c index b19fd488..699fdbab 100644 --- a/ESP32/DTLS13-wifi-station-server/main/server-dtls13.c +++ b/ESP32/DTLS13-wifi-station-server/main/server-dtls13.c @@ -244,7 +244,7 @@ WOLFSSL_ESP_TASK dtls13_smp_server_task(void *pvParameters) /* initialize network vars */ if (ret == WOLFSSL_SUCCESS) { - memset((char *)&servAddr, 0, sizeof(servAddr)); + XMEMSET((char *)&servAddr, 0, sizeof(servAddr)); /* host-to-network-long conversion (htonl) */ /* host-to-network-short conversion (htons) */ servAddr.sin_family = AF_INET; diff --git a/ESP32/TLS13-ENC28J60-client/main/enc28j60_example_main.c b/ESP32/TLS13-ENC28J60-client/main/enc28j60_example_main.c index 580a31f0..4015c4d3 100644 --- a/ESP32/TLS13-ENC28J60-client/main/enc28j60_example_main.c +++ b/ESP32/TLS13-ENC28J60-client/main/enc28j60_example_main.c @@ -125,6 +125,13 @@ TickType_t DelayTicks = 5000 / portTICK_PERIOD_MS; **/ +static void LogSocketError(const char* fmt, int err) +{ + char err_msg[128]; + XSNPRINTF(err_msg, sizeof(err_msg), fmt, err); + WOLFSSL_ERROR_MSG(err_msg); +} + int tls_smp_client_task() { int ret = WOLFSSL_SUCCESS; /* assume success until proven wrong */ int sockfd = 0; /* the socket that will carry our secure connection */ @@ -165,7 +172,7 @@ int tls_smp_client_task() { #endif /* WOLFSSL_TLS13 */ /* Initialize the server address struct with zeros */ - memset(&servAddr, 0, sizeof(servAddr)); + XMEMSET(&servAddr, 0, sizeof(servAddr)); /* Fill in the server address */ servAddr.sin_family = AF_INET; /* using IPv4 */ @@ -220,13 +227,12 @@ int tls_smp_client_task() { * a non-negative integer, the socket file descriptor. */ sockfd = socket(AF_INET, SOCK_STREAM, 0); - if (sockfd > 0) { + if (sockfd >= 0) { WOLFSSL_MSG("socket creation successful\n"); } else { - // TODO show errno + LogSocketError("ERROR: failed to create a socket (errno = %d).\n", errno); ret = WOLFSSL_FAILURE; - WOLFSSL_ERROR_MSG("ERROR: failed to create a socket.\n"); } } else { @@ -258,8 +264,7 @@ int tls_smp_client_task() { WOLFSSL_MSG("sockfd connect successful\n"); } else { - // TODO show errno - WOLFSSL_ERROR_MSG("ERROR: socket connect failed\n"); + LogSocketError("ERROR: socket connect failed (errno = %d)\n", errno); ret = WOLFSSL_FAILURE; } } @@ -697,13 +702,13 @@ int tls_smp_client_task() { */ if (ret == WOLFSSL_SUCCESS) { - memset(buff, 0, BUFF_SIZE); + XMEMSET(buff, 0, BUFF_SIZE); /* get the length of our message, never longer than the declared size */ /* TODO check for zero length */ - len = strnlen(sendMessage, sendMessageSize); + len = XSTRLEN(sendMessage); /* write the message over secure connection to the server */ if (wolfSSL_write(ssl, sendMessage, len) == len) { @@ -783,7 +788,7 @@ int tls_smp_client_task() { if (ret == WOLFSSL_SUCCESS) { /* even though the result should be a zero-terminated string, * we'll clear the receive buffer */ - memset(buff, 0, BUFF_SIZE); + XMEMSET(buff, 0, BUFF_SIZE); /* read the response data from our secure connection */ if (wolfSSL_read(ssl, buff, BUFF_SIZE - 1) > 0) { @@ -946,7 +951,7 @@ int set_time() { int i = 0; for (i = 0; i < NTP_SERVER_COUNT; i++) { const char* thisServer = ntpServerList[i]; - if (strncmp(thisServer, "\x00", 1)) { + if (XSTRNCMP(thisServer, "\x00", 1)) { /* just in case we run out of NTP servers */ break; } diff --git a/ESP32/TLS13-ENC28J60-server/main/enc28j60_example_main.c b/ESP32/TLS13-ENC28J60-server/main/enc28j60_example_main.c index ce54aa31..5adf8d71 100644 --- a/ESP32/TLS13-ENC28J60-server/main/enc28j60_example_main.c +++ b/ESP32/TLS13-ENC28J60-server/main/enc28j60_example_main.c @@ -154,6 +154,13 @@ static void sig_handler(const int sig) { } #endif +static void LogSocketError(const char* fmt, int err) +{ + char err_msg[128]; + XSNPRINTF(err_msg, sizeof(err_msg), fmt, err); + WOLFSSL_ERROR_MSG(err_msg); +} + int tls_smp_server_task() { int ret = WOLFSSL_SUCCESS; /* assume success until proven wrong */ int sockfd = 0; /* the socket that will carry our secure connection */ @@ -190,7 +197,7 @@ int tls_smp_server_task() { #endif /* WOLFSSL_TLS13 */ /* Initialize the server address struct with zeros */ - memset(&servAddr, 0, sizeof(servAddr)); + XMEMSET(&servAddr, 0, sizeof(servAddr)); /* Fill in the server address */ servAddr.sin_family = AF_INET; /* using IPv4 */ @@ -280,13 +287,12 @@ int tls_smp_server_task() { * a non-negative integer, the socket file descriptor. */ sockfd = socket(AF_INET, SOCK_STREAM, 0); - if (sockfd > 0) { + if (sockfd >= 0) { WOLFSSL_MSG("socket creation successful\n"); } else { - // TODO show errno + LogSocketError("ERROR: failed to create a socket (errno = %d).\n", errno); ret = WOLFSSL_FAILURE; - WOLFSSL_ERROR_MSG("ERROR: failed to create a socket.\n"); } } else { @@ -348,9 +354,8 @@ int tls_smp_server_task() { WOLFSSL_MSG("setsockopt re-use addr successful\n"); } else { - // TODO show errno + LogSocketError("ERROR: failed to setsockopt addr on socket (errno = %d).\n", errno); ret = WOLFSSL_FAILURE; - WOLFSSL_ERROR_MSG("ERROR: failed to setsockopt addr on socket.\n"); } } else { @@ -370,10 +375,7 @@ int tls_smp_server_task() { WOLFSSL_MSG("setsockopt re-use port successful\n"); } else { - // TODO show errno - // ret = WOLFSSL_FAILURE; - // TODO what's up with the error? - WOLFSSL_ERROR_MSG("ERROR: failed to setsockopt port on socket. >> IGNORED << \n"); + LogSocketError("ERROR: failed to setsockopt port on socket (errno = %d). >> IGNORED << \n", errno); } } else { @@ -427,8 +429,8 @@ int tls_smp_server_task() { WOLFSSL_MSG("socket bind successful\n"); } else { + LogSocketError("ERROR: failed to bind to socket (errno = %d).\n", errno); ret = WOLFSSL_FAILURE; - WOLFSSL_ERROR_MSG("ERROR: failed to bind to socket.\n"); } } @@ -474,10 +476,10 @@ int tls_smp_server_task() { WOLFSSL_MSG("socket listen successful\n"); } else { + LogSocketError("ERROR: failed to listen to socket (errno = %d).\n", errno); ret = WOLFSSL_FAILURE; - WOLFSSL_ERROR_MSG("ERROR: failed to listen to socket.\n"); } - } + } /* *************************************************************************** @@ -738,21 +740,19 @@ int tls_smp_server_task() { /* Accept client connections */ if ((mConnd = accept(sockfd, (struct sockaddr*)&clientAddr, &size)) == -1) { - // fprintf(stderr, "ERROR: failed to accept the connection\n\n"); - ret = -1; - // TODO goto exit; - WOLFSSL_ERROR_MSG("ERROR: failed socket accept\n"); - ret = WOLFSSL_FAILURE; + WOLFSSL_ERROR_MSG("ERROR: failed socket accept\n"); + ret = WOLFSSL_FAILURE; + break; } /* Create a WOLFSSL object */ if ((ssl = wolfSSL_new(ctx)) == NULL) { - // fprintf(stderr, "ERROR: failed to create WOLFSSL object\n"); - ret = -1; - //TODO goto exit; - WOLFSSL_ERROR_MSG("ERROR: filed wolfSSL_new during loop\n"); + WOLFSSL_ERROR_MSG("ERROR: failed wolfSSL_new during loop\n"); ret = WOLFSSL_FAILURE; - } + close(mConnd); + mConnd = SOCKET_INVALID; + break; + } /* Attach wolfSSL to the socket */ wolfSSL_set_fd(ssl, mConnd); @@ -771,45 +771,42 @@ int tls_smp_server_task() { if ((ret = wolfSSL_accept(ssl)) != WOLFSSL_SUCCESS) { WOLFSSL_ERROR_MSG("ERROR: wolfSSL_accept\n"); ret = WOLFSSL_FAILURE; - // fprintf(stderr, - // "wolfSSL_accept error = %d\n", - // wolfSSL_get_error(ssl, ret)); - // TODO goto exit; } else { WOLFSSL_MSG("Client connected successfully\n"); } - #ifdef HAVE_SECRET_CALLBACK - wolfSSL_FreeArrays(ssl); + if (ret == WOLFSSL_SUCCESS) { + wolfSSL_FreeArrays(ssl); + } #endif /* Read the client data into our buff array */ - memset(buff, 0, sizeof(buff)); - if ((ret = wolfSSL_read(ssl, buff, sizeof(buff) - 1)) < 0) { - // fprintf(stderr, "ERROR: failed to read\n"); - //TODO goto exit; + if (ret == WOLFSSL_SUCCESS) { + XMEMSET(buff, 0, sizeof(buff)); + if (wolfSSL_read(ssl, buff, sizeof(buff) - 1) <= 0) { + WOLFSSL_ERROR_MSG("ERROR: failed to read\n"); + ret = WOLFSSL_FAILURE; + } } - /* Print to stdout any data the client sends */ - // printf("Client: %s\n", buff); + if (ret == WOLFSSL_SUCCESS) { + /* Check for server shutdown command */ + if (XSTRNCMP(buff, "shutdown", 8) == 0) { + mShutdown = 1; + } - /* Check for server shutdown command */ - if (strncmp(buff, "shutdown", 8) == 0) { - // printf("Shutdown command issued!\n"); - mShutdown = 1; - } + /* Write our reply into buff */ + XMEMSET(buff, 0, sizeof(buff)); + XMEMCPY(buff, reply, XSTRLEN(reply)); + len = XSTRLEN(buff); - /* Write our reply into buff */ - memset(buff, 0, sizeof(buff)); - memcpy(buff, reply, strlen(reply)); - len = strnlen(buff, sizeof(buff)); - - /* Reply back to the client */ - if ((ret = wolfSSL_write(ssl, buff, len)) != len) { - // fprintf(stderr, "ERROR: failed to write\n"); - // TODO goto exit; + /* Reply back to the client */ + if (wolfSSL_write(ssl, buff, len) != len) { + WOLFSSL_ERROR_MSG("ERROR: failed to write\n"); + ret = WOLFSSL_FAILURE; + } } /* Cleanup after this connection */ @@ -822,6 +819,12 @@ int tls_smp_server_task() { close(mConnd); /* Close the connection to the client */ mConnd = SOCKET_INVALID; } + + /* A handshake (wolfSSL_accept) or read/write failure on this client's + * connection shouldn't stop the server from accepting the next one. + * Fatal setup failures above (socket accept/wolfSSL_new) already break + * out of the loop. */ + ret = WOLFSSL_SUCCESS; } WOLFSSL_MSG("Shutdown complete\n"); @@ -967,7 +970,7 @@ int set_time() { int i = 0; for (i = 0; i < NTP_SERVER_COUNT; i++) { const char* thisServer = ntpServerList[i]; - if (strncmp(thisServer, "\x00", 1)) { + if (XSTRNCMP(thisServer, "\x00", 1)) { /* just in case we run out of NTP servers */ break; } diff --git a/ESP32/TLS13-wifi_station-client/main/station_example_main.c b/ESP32/TLS13-wifi_station-client/main/station_example_main.c index a35990ed..20e1465b 100644 --- a/ESP32/TLS13-wifi_station-client/main/station_example_main.c +++ b/ESP32/TLS13-wifi_station-client/main/station_example_main.c @@ -9,6 +9,7 @@ #include +#include #include "freertos/FreeRTOS.h" #include "freertos/task.h" #include "freertos/event_groups.h" @@ -192,7 +193,7 @@ int set_time() { int i = 0; for (i = 0; i < NTP_SERVER_COUNT; i++) { const char* thisServer = ntpServerList[i]; - if (strncmp(thisServer, "\x00", 1)) { + if (XSTRNCMP(thisServer, "\x00", 1)) { /* just in case we run out of NTP servers */ break; } @@ -302,7 +303,7 @@ int tls_smp_client_task() { /* Initialize the server address struct with zeros */ - memset(&servAddr, 0, sizeof(servAddr)); + XMEMSET(&servAddr, 0, sizeof(servAddr)); /* Fill in the server address */ servAddr.sin_family = AF_INET; /* using IPv4 */ @@ -357,13 +358,13 @@ int tls_smp_client_task() { * a non-negative integer, the socket file descriptor. */ sockfd = socket(AF_INET, SOCK_STREAM, 0); - if (sockfd > 0) { + if (sockfd >= 0) { ESP_LOGI(TAG,"socket creation successful\n"); } else { - // TODO show errno + ESP_LOGE(TAG, + "ERROR: failed to create a socket (errno = %d).\n", errno); ret = WOLFSSL_FAILURE; - ESP_LOGE(TAG, "ERROR: failed to create a socket.\n"); } } else { @@ -398,8 +399,8 @@ int tls_smp_client_task() { ESP_LOGI(TAG,"sockfd connect successful\n"); } else { - // TODO show errno - ESP_LOGE(TAG, "ERROR: socket connect failed\n"); + ESP_LOGE(TAG, + "ERROR: socket connect failed (errno = %d)\n", errno); ret = WOLFSSL_FAILURE; } } @@ -837,13 +838,13 @@ int tls_smp_client_task() { */ if (ret == WOLFSSL_SUCCESS) { - memset(buff, 0, BUFF_SIZE); + XMEMSET(buff, 0, BUFF_SIZE); /* get the length of our message, never longer than the declared size */ /* TODO check for zero length */ - len = strnlen(sendMessage, sendMessageSize); + len = XSTRLEN(sendMessage); /* write the message over secure connection to the server */ if (wolfSSL_write(ssl, sendMessage, len) == len) { @@ -923,7 +924,7 @@ int tls_smp_client_task() { if (ret == WOLFSSL_SUCCESS) { /* even though the result should be a zero-terminated string, * we'll clear the receive buffer */ - memset(buff, 0, BUFF_SIZE); + XMEMSET(buff, 0, BUFF_SIZE); /* read the response data from our secure connection */ if (wolfSSL_read(ssl, buff, BUFF_SIZE - 1) > 0) { diff --git a/ESP32/TLS13-wifi_station-server/main/station_example_main.c b/ESP32/TLS13-wifi_station-server/main/station_example_main.c index 91044619..9991f558 100644 --- a/ESP32/TLS13-wifi_station-server/main/station_example_main.c +++ b/ESP32/TLS13-wifi_station-server/main/station_example_main.c @@ -9,6 +9,7 @@ #include +#include #include "freertos/FreeRTOS.h" #include "freertos/task.h" #include "freertos/event_groups.h" @@ -196,7 +197,7 @@ int set_time() { int i = 0; for (i = 0; i < NTP_SERVER_COUNT; i++) { const char* thisServer = ntpServerList[i]; - if (strncmp(thisServer, "\x00", 1)) { + if (XSTRNCMP(thisServer, "\x00", 1)) { /* just in case we run out of NTP servers */ break; } @@ -291,6 +292,13 @@ void wifi_init_sta(void) vEventGroupDelete(s_wifi_event_group); } +static void LogSocketError(const char* fmt, int err) +{ + char err_msg[128]; + XSNPRINTF(err_msg, sizeof(err_msg), fmt, err); + WOLFSSL_ERROR_MSG(err_msg); +} + int tls_smp_server_task() { int ret = WOLFSSL_SUCCESS; /* assume success until proven wrong */ int sockfd = 0; /* the socket that will carry our secure connection */ @@ -330,7 +338,7 @@ int tls_smp_server_task() { #endif /* WOLFSSL_TLS13 */ /* Initialize the server address struct with zeros */ - memset(&servAddr, 0, sizeof(servAddr)); + XMEMSET(&servAddr, 0, sizeof(servAddr)); /* Fill in the server address */ servAddr.sin_family = AF_INET; /* using IPv4 */ @@ -427,13 +435,12 @@ int tls_smp_server_task() { * a non-negative integer, the socket file descriptor. */ sockfd = socket(AF_INET, SOCK_STREAM, 0); - if (sockfd > 0) { + if (sockfd >= 0) { WOLFSSL_MSG("socket creation successful\n"); } else { - // TODO show errno + LogSocketError("ERROR: failed to create a socket (errno = %d).\n", errno); ret = WOLFSSL_FAILURE; - WOLFSSL_ERROR_MSG("ERROR: failed to create a socket.\n"); } } else { @@ -501,9 +508,8 @@ int tls_smp_server_task() { WOLFSSL_MSG("setsockopt re-use addr successful\n"); } else { - ESP_LOGE(TAG, "setsockopt failed with code %i", soc_ret); + LogSocketError("ERROR: failed to setsockopt addr on socket (errno = %d).\n", errno); ret = WOLFSSL_FAILURE; - WOLFSSL_ERROR_MSG("ERROR: failed to setsockopt addr on socket.\n"); } } else { @@ -584,8 +590,8 @@ int tls_smp_server_task() { WOLFSSL_MSG("socket bind successful\n"); } else { + LogSocketError("ERROR: failed to bind to socket (errno = %d).\n", errno); ret = WOLFSSL_FAILURE; - WOLFSSL_ERROR_MSG("ERROR: failed to bind to socket.\n"); } } @@ -632,8 +638,8 @@ int tls_smp_server_task() { WOLFSSL_MSG("socket listen successful\n"); } else { + LogSocketError("ERROR: failed to listen to socket (errno = %d).\n", errno); ret = WOLFSSL_FAILURE; - WOLFSSL_ERROR_MSG("ERROR: failed to listen to socket.\n"); } } @@ -913,20 +919,18 @@ int tls_smp_server_task() { /* Accept client connections */ if ((mConnd = accept(sockfd, (struct sockaddr*)&clientAddr, &size)) == -1) { - - ret = -1; - goto exit; WOLFSSL_ERROR_MSG("ERROR: failed socket connection accept\n"); ret = WOLFSSL_FAILURE; + break; } /* Create a WOLFSSL object */ if ((ssl = wolfSSL_new(ctx)) == NULL) { WOLFSSL_ERROR_MSG("ERROR: failed to create WOLFSSL object\n"); - ret = -1; - goto exit; - WOLFSSL_ERROR_MSG("ERROR: failed wolfSSL_new during loop\n"); ret = WOLFSSL_FAILURE; + close(mConnd); + mConnd = SOCKET_INVALID; + break; } /* Attach wolfSSL to the socket */ @@ -945,47 +949,56 @@ int tls_smp_server_task() { /* Establish TLS connection */ if ((ret = wolfSSL_accept(ssl)) != WOLFSSL_SUCCESS) { WOLFSSL_ERROR_MSG("ERROR: wolfSSL_accept\n"); - - ret = WOLFSSL_FAILURE; ESP_LOGE(TAG, "wolfSSL_accept error = %d\n", wolfSSL_get_error(ssl, ret)); - goto exit; + ret = WOLFSSL_FAILURE; } else { WOLFSSL_MSG("Client connected successfully\n"); } #ifdef HAVE_SECRET_CALLBACK - wolfSSL_FreeArrays(ssl); + if (ret == WOLFSSL_SUCCESS) { + wolfSSL_FreeArrays(ssl); + } #endif /* Read the client data into our buff array */ - memset(buff, 0, sizeof(buff)); - if ((ret = wolfSSL_read(ssl, buff, sizeof(buff) - 1)) < 0) { - ESP_LOGE(TAG, "wolfSSL_read error = %d\n", - wolfSSL_get_error(ssl, ret)); - goto exit; + if (ret == WOLFSSL_SUCCESS) { + int readRet; + XMEMSET(buff, 0, sizeof(buff)); + readRet = wolfSSL_read(ssl, buff, sizeof(buff) - 1); + if (readRet <= 0) { + ESP_LOGE(TAG, "wolfSSL_read error = %d\n", + wolfSSL_get_error(ssl, readRet)); + ret = WOLFSSL_FAILURE; + } } - /* Print any data the client sends */ - ESP_LOGI(TAG, "Client: %s\n", buff); + if (ret == WOLFSSL_SUCCESS) { + /* Print any data the client sends */ + ESP_LOGI(TAG, "Client: %s\n", buff); - /* Check for server shutdown command */ - if (strncmp(buff, "shutdown", 8) == 0) { - ESP_LOGI(TAG, "Shutdown command issued!\n"); - mShutdown = 1; - } + /* Check for server shutdown command */ + if (XSTRNCMP(buff, "shutdown", 8) == 0) { + ESP_LOGI(TAG, "Shutdown command issued!\n"); + mShutdown = 1; + } - /* Write our reply into buff */ - memset(buff, 0, sizeof(buff)); - memcpy(buff, reply, strlen(reply)); - len = strnlen(buff, sizeof(buff)); + /* Write our reply into buff */ + XMEMSET(buff, 0, sizeof(buff)); + XMEMCPY(buff, reply, XSTRLEN(reply)); + len = XSTRLEN(buff); - /* Reply back to the client */ - if ((ret = wolfSSL_write(ssl, buff, len)) != len) { - ESP_LOGE(TAG, "wolfSSL_write error = %d\n", - wolfSSL_get_error(ssl, ret)); - goto exit; + /* Reply back to the client */ + { + int writeRet = wolfSSL_write(ssl, buff, len); + if (writeRet != len) { + ESP_LOGE(TAG, "wolfSSL_write error = %d\n", + wolfSSL_get_error(ssl, writeRet)); + ret = WOLFSSL_FAILURE; + } + } } /* Cleanup after this connection */ @@ -998,6 +1011,12 @@ int tls_smp_server_task() { close(mConnd); /* Close the connection to the client */ mConnd = SOCKET_INVALID; } + + /* A handshake (wolfSSL_accept) or read/write failure on this client's + * connection shouldn't stop the server from accepting the next one. + * Fatal setup failures above (socket accept/wolfSSL_new) already break + * out of the loop. */ + ret = WOLFSSL_SUCCESS; } WOLFSSL_MSG("Shutdown complete\n"); @@ -1009,7 +1028,6 @@ int tls_smp_server_task() { * *************************************************************************** */ -exit: if (mConnd != SOCKET_INVALID) { close(mConnd); /* Close the connection to the client */ mConnd = SOCKET_INVALID;