Fix emNET support and add tests

The emNET `wolfSSL_LastError` branches were incorrect. The second one
was never hit and would never compile. The first one inverts error codes
that should not be inverted.

This fixes that code and adds a test with a shim layer to test emNET
calls without using emNET.

Author: LinuxJedi

.github/workflows/emnet-nonblock.yml

@@ -0,0 +1,56 @@
+name: emNET non-blocking handshake test
+
+# START OF COMMON SECTION
+on:
+  push:
+    branches: [ 'master', 'main', 'release/**' ]
+  pull_request:
+    branches: [ '*' ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+# END OF COMMON SECTION
+
+# Build wolfSSL with -DWOLFSSL_EMNET using the clean-room shim in
+# tests/emnet/ (IP/IP.h + emnet_shim.c), link a non-blocking TLS 1.3
+# handshake test with -Wl,--wrap=recv,--wrap=send, and run it. The
+# test exercises the WOLFSSL_EMNET path in wolfSSL_LastError() and
+# asserts that would-block events surface as WANT_READ/WANT_WRITE and
+# the handshake completes, guarding against regressions in the emNET
+# error-translation logic.
+
+jobs:
+  emnet_nonblock:
+    name: wolfSSL emNET non-blocking handshake
+    if: github.repository_owner == 'wolfssl'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Checkout wolfSSL
+        uses: actions/checkout@v4
+
+      - name: Install build deps
+        uses: ./.github/actions/install-apt-deps
+        with:
+          packages: autoconf automake libtool build-essential
+
+      - name: Bootstrap
+        run: ./autogen.sh
+
+      - name: Configure wolfSSL (WOLFSSL_EMNET + emNET shim headers)
+        run: |
+          ./configure \
+            --enable-static --disable-shared \
+            --enable-tls13 --disable-oldtls \
+            --enable-ecc --disable-examples \
+            CFLAGS="-DWOLFSSL_EMNET -I$(pwd)/tests/emnet"
+
+      - name: Build wolfSSL
+        run: make -j$(nproc)
+
+      - name: Build emNET non-blocking test
+        run: make -C tests/emnet
+
+      - name: Run emNET non-blocking test
+        run: make -C tests/emnet run

src/wolfio.c

@@ -151,8 +151,12 @@ static WC_INLINE int wolfSSL_LastError(int err, SOCKET_T sd)
     return WSAGetLastError();
 #elif defined(EBSNET)
     return xn_getlasterror();
-#elif defined(WOLFSSL_LINUXKM) || defined(WOLFSSL_EMNET)
+#elif defined(WOLFSSL_LINUXKM)
     return -err; /* Return provided error value with corrected sign. */
+#elif defined(WOLFSSL_EMNET)
+    /* emNET BSD sockets return the IP_ERR_* value (negative) directly
+     * from send/recv on failure; no translation needed. */
+    return err;
 #elif defined(FUSION_RTOS)
     #include <fclerrno.h>
     return FCL_GET_ERRNO;
@@ -170,10 +174,6 @@ static WC_INLINE int wolfSSL_LastError(int err, SOCKET_T sd)
         }
         return err;
     }
-#elif defined(WOLFSSL_EMNET)
-    /* Get the real socket error */
-    IP_SOCK_getsockopt(sd, SOL_SOCKET, SO_ERROR, &err, (int)sizeof(old));
-    return err;
 #else
     return errno;
 #endif

tests/emnet/IP/IP.h

@@ -0,0 +1,44 @@
+/* IP.h -- clean-room shim for the subset of SEGGER emNET (embOS/IP) API
+ * that wolfSSL's WOLFSSL_EMNET port compiles against. Written from the
+ * public API surface documented in SEGGER UM07001; contains no SEGGER
+ * source.
+ *
+ * Scope: enough to build wolfSSL with -DWOLFSSL_EMNET on a POSIX host
+ * for CI test purposes. Only error constants and IP_SOCK_getsockopt are
+ * provided here; the runtime behaviour of send/recv under emNET is
+ * emulated by emnet_shim.c via linker --wrap.
+ */
+
+#ifndef WOLFSSL_EMNET_SHIM_IP_H
+#define WOLFSSL_EMNET_SHIM_IP_H
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <errno.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* emNET error codes (UM07001). Values match the public ABI. */
+#define IP_ERR_CONN_ABORTED   (-5)
+#define IP_ERR_WOULD_BLOCK    (-6)
+#define IP_ERR_CONN_REFUSED   (-7)
+#define IP_ERR_CONN_RESET     (-8)
+#define IP_ERR_PIPE          (-13)
+#define IP_ERR_FAULT         (-25)
+
+/* BSD-style socket option retrieval. Signature matches the SEGGER API:
+ * length is passed by pointer of type int*, unlike POSIX socklen_t*. */
+int IP_SOCK_getsockopt(int sd, int level, int optname,
+                       void *optval, int *optlen);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* WOLFSSL_EMNET_SHIM_IP_H */

tests/emnet/Makefile

@@ -0,0 +1,52 @@
+# Build the emNET non-blocking handshake test.
+# Requires wolfSSL already configured + built at the repo root with
+# WOLFSSL_EMNET and the emnet IP include path, e.g.:
+#
+#   cd $(repo_root)
+#   ./autogen.sh
+#   ./configure --enable-static --disable-shared --enable-tls13 \
+#               --disable-oldtls CFLAGS="-DWOLFSSL_EMNET \
+#               -I$$(pwd)/tests/emnet"
+#   make
+#   make -C tests/emnet run
+
+CURDIR     := $(shell pwd)
+WOLFSSL_ROOT := $(abspath $(CURDIR)/../..)
+WOLFSSL_LIB := $(WOLFSSL_ROOT)/src/.libs/libwolfssl.a
+
+CC ?= cc
+CFLAGS_TEST := -Wall -Wextra -O2 -g \
+    -DWOLFSSL_EMNET \
+    -I$(CURDIR) \
+    -I$(WOLFSSL_ROOT)
+LDFLAGS_TEST := -Wl,--wrap=recv,--wrap=send
+LIBS_TEST := $(WOLFSSL_LIB) -lpthread -lm
+
+TEST_BIN := emnet_nonblock_test
+
+.PHONY: all run clean check-lib
+
+all: $(TEST_BIN)
+
+check-lib:
+	@if [ ! -f "$(WOLFSSL_LIB)" ]; then \
+	    echo "error: $(WOLFSSL_LIB) not found."; \
+	    echo "Build wolfSSL first (see header of this Makefile)."; \
+	    exit 1; \
+	fi
+
+$(TEST_BIN): emnet_nonblock_test.o emnet_shim.o check-lib
+	$(CC) $(LDFLAGS_TEST) -o $@ emnet_nonblock_test.o emnet_shim.o $(LIBS_TEST)
+
+emnet_nonblock_test.o: emnet_nonblock_test.c
+	$(CC) $(CFLAGS_TEST) -c $< -o $@
+
+emnet_shim.o: emnet_shim.c IP/IP.h
+	$(CC) $(CFLAGS_TEST) -c $< -o $@
+
+# Run from the repo root so the relative cert paths resolve.
+run: $(TEST_BIN)
+	cd $(WOLFSSL_ROOT) && ./tests/emnet/$(TEST_BIN)
+
+clean:
+	rm -f *.o $(TEST_BIN)