port: add a wolfCert transport over wolfIP sockets

[yosuke-wolfssl]

Background

wolfCert's WolfCertTransport vtable lets a target without BSD sockets supply
its own transport, but wolfIP had no implementation of it. EST/SCEP enrolment
on wolfIP was therefore impossible: wolfCert's built-in transport calls
close()/send()/recv() on a POSIX fd, while a wolfIP descriptor is an
index into wolfIP's own table — on a hosted build those calls hit an
unrelated file descriptor.

Changes (src/port/wolfcert_io.c)

One glue file implementing the four callbacks over wolfIP_sock_*, joining
wolfssl_io.c, wolfssh_io.c and wolfmqtt_io.c. It carries no TLS code —
wolfCert bridges wolfSSL's CBIO onto the same read/write, so EST over
HTTPS, SCEP over HTTPS and SCEP over plain HTTP all ride one transport.

• connect resolves a bounded dotted quad locally or via nslookup(),
  then pumps wolfIP_poll() around wolfIP_sock_connect() until established.
• read/write carry the blocking mode in timeout_ms, clamp len to
  INT_MAX, and never return 0.
• disconnect pumps until the FIN handshake completes; wolfIP_sock_close()
  reports -WOLFIP_EAGAIN until then, and wolfCert calls it exactly once.

wolfIP return	Mapped to
> 0	byte count (short transfers passed through)
0 (receive only)	WOLFCERT_ERR_CONN_CLOSED
-1	WOLFCERT_ERR_CONN_CLOSED
-WOLFIP_EAGAIN	WANT_READ/WANT_WRITE, or pump and retry
-WOLFIP_EINVAL	WOLFCERT_ERR_BAD_ARG
other	WOLFCERT_ERR_IO

wolfip.h declares both entry points under WOLFCERT_WOLFIP, and
docs/wolfcert_howto.md documents the integration.

Tests

32 cases in a wolfCert-IO tcase. Mock wolfcert/ headers keep make unit
free of any wolfCert dependency, so the glue is compiled and exercised by
every existing CI job.

Verification

• Unit: 1587/1587, ASan and UBSan clean.
• Compiles against merged wolfCert headers under -Werror -Wextra -Wdeclaration-after-statement; no libc socket or TLS symbols in the object.
• End to end over a utun link against wolfcert-server: EST simpleenroll
  issues a certificate, SCEP GetCACaps succeeds over plain HTTP.

Not in this PR

The top-level build target and CI step follow separately. Five limits need
wolfIP API additions rather than glue changes: no connect-status query, so a
refused connection costs the full timeout; no descriptor generation counter,
so a slot reused during a poll is undetectable; no force-release, so a socket
whose peer never completes FIN is abandoned; no DNS cancel; and no per-lookup
DNS context.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Adds a wolfCert WolfCertTransport implementation backed by wolfIP sockets to enable EST/SCEP enrollment on wolfIP targets without BSD sockets.

Changes:

• Introduces src/port/wolfcert_io.c implementing connect/read/write/disconnect over wolfIP_sock_* plus DNS resolution via nslookup().
• Exposes init/cleanup entry points in wolfip.h under WOLFCERT_WOLFIP.
• Adds a dedicated wolfCert-IO unit-test tcase with mocks to exercise the transport glue.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
wolfip.h	Declares wolfCert transport init/cleanup APIs when WOLFCERT_WOLFIP is enabled.
src/port/wolfcert_io.c	Implements wolfCert transport callbacks over wolfIP sockets, including DNS polling loops and timeout handling.
src/test/unit/unit_tests_wolfcert.c	Adds extensive unit coverage for connect/DNS/read/write/disconnect behaviors.
src/test/unit/unit_shared.c	Adds wolfCert IO mocks and includes the port glue to test internal static state.
src/test/unit/unit.c	Registers the new wolfCert-IO test case with the unit test suite.
src/test/unit/mocks/wolfcert/types.h	Adds minimal mock for WolfCertTransport to keep unit builds free of wolfCert dependency.
src/test/unit/mocks/wolfcert/errors.h	Adds minimal mock error codes used by the glue layer.
Makefile	Adds wolfCert unit test source(s) (but currently also adds src/port/wolfcert_io.c).

Suppressed comments (1)

Makefile:1

• src/test/unit/unit_shared.c includes ../../port/wolfcert_io.c directly (to access internal static state like io_ctxs). Adding src/port/wolfcert_io.c to UNIT_TEST_SRCS compiles the same translation unit twice, which will cause multiple-definition linker errors for wolfCert_Init_wolfIP / wolfCert_Cleanup_wolfIP.

CC?=gcc

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #171

Scan targets checked: wolfip-src, wolfip-bugs

Findings: 4
4 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #171

Scan targets checked: wolfip-src, wolfip-bugs

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.