ssl.c split: cleanup

CMakeLists.txt

@@ -4417,8 +4417,11 @@ if(WOLFSSL_EXAMPLES)
         tests/api/test_dtls.c
         tests/api/test_dtls13.c
         tests/api/test_ssl_cert.c
+        tests/api/test_ssl_crl_ocsp.c
         tests/api/test_ssl_pk.c
         tests/api/test_ssl_ext.c
+        tests/api/test_ssl_rw.c
+        tests/api/test_ssl_hs.c
         tests/api/test_ocsp.c
         tests/api/test_evp.c
         tests/api/test_tls_ext.c

ChangeLog.md

@@ -1,3 +1,79 @@
+# wolfSSL Release (unreleased)
+
+## Enhancements
+
+* **Behavioral change (`wolfSSL_shutdown` when no close_notify can be sent)**:
+  when the connection is already closed or reset and no close_notify was ever
+  sent, the shutdown exchange can never complete.  That case now returns
+  `WOLFSSL_FATAL_ERROR` and records `SOCKET_PEER_CLOSED_E`, so the caller has
+  a reason to query with `wolfSSL_get_error()`.  Previously it returned 0,
+  which is `WOLFSSL_SHUTDOWN_NOT_DONE` under `WOLFSSL_ERROR_CODE_OPENSSL`, so
+  an application looping while the result is 0 never left the loop; such a
+  loop now terminates.  `SOCKET_PEER_CLOSED_E` is used whatever closed the
+  connection, including this side sending a fatal alert, and only when no
+  more specific error has already been recorded.  Under `OPENSSL_EXTRA`,
+  `wolfSSL_get_error()` reports it as `WOLFSSL_ERROR_SYSCALL`, so a locally
+  aborted connection can surface as a syscall error.
+
+* **Behavioral change (`wolfSSL_set0_verify_cert_store` reference handling)**:
+  the handed-over reference is now always consumed.  Previously it was
+  silently dropped - neither stored nor released - when the store passed was
+  the one the object or its context was already using, leaking a reference on
+  every such call.  As `wolfSSL_set0_verify_cert_store()` takes ownership,
+  callers must own a reference before calling; handing over a borrowed
+  pointer, such as one straight from `wolfSSL_CTX_get_cert_store()`, now
+  releases a reference the caller never took and can free a store still in
+  use.  Take a reference with `wolfSSL_X509_STORE_up_ref()` first, or use
+  `wolfSSL_set1_verify_cert_store()`, which takes its own.
+
+* **Behavioral change (`wolfSSL_X509_STORE_up_ref` on a store owned by another
+  object)**: the reference count is now only taken for a store allocated with
+  `wolfSSL_X509_STORE_new()`.  A store that is part of another object, such as
+  the one returned by `wolfSSL_CTX_get_cert_store()` when no store has been
+  set on the context, has no reference count to take - its lifetime is that of
+  the object holding it.  Such a call now returns 1 without touching the
+  count, matching `wolfSSL_X509_STORE_free()`, which already did nothing for
+  such a store.  Previously the count was incremented although it had never
+  been initialized, which on a build using mutexes rather than atomics for
+  reference counting meant locking a mutex that was never set up.  A NULL
+  store still returns 0.
+
+* **Behavioral change (NULL store passed to the verify cert store setters)**:
+  `wolfSSL_set0_verify_cert_store()`, `wolfSSL_set1_verify_cert_store()` and
+  `wolfSSL_CTX_set1_verify_cert_store()` now treat a NULL store as a request
+  to clear any store previously set, releasing the reference held on it and
+  reverting to the store of the context (for an SSL object) or the one the
+  context owns (for a context).  They return 1, and clearing when no store is
+  set is a successful no-op.  Previously a NULL store was rejected with a 0
+  return and no other effect.  This matches OpenSSL, where
+  `SSL_set0_verify_cert_store()` and friends clear the verify store when
+  passed NULL.  The object being set is still required: a NULL `ssl` or `ctx`
+  returns 0 as before.
+
+* **Fix (`wolfSSL_set_accept_state` with `WOLFSSL_BLIND_PRIVATE_KEY`)**: the
+  static-ECC check decoded `ssl->buffers.key` directly.  Under
+  `WOLFSSL_BLIND_PRIVATE_KEY` that buffer is masked, so the decode always
+  failed and the server silently dropped `haveECDSAsig`, `haveECC` and
+  `haveStaticECC`, losing the static ECC cipher suites for a key that was
+  valid.  The key is now unmasked into a plain copy for the check.  An
+  allocation failure while unmasking leaves the capabilities alone rather
+  than withdrawing them, matching what a failure to allocate the `ecc_key`
+  already did.  Only affects builds with `WOLFSSL_BLIND_PRIVATE_KEY`.
+
+* **Behavioral change (`wolfSSL_read_ex` with a NULL object)**: the NULL check
+  is now made in every build rather than only under `OPENSSL_EXTRA`, so
+  `wolfSSL_read_ex(NULL, ...)` returns `BAD_FUNC_ARG` consistently.  Builds
+  without `OPENSSL_EXTRA` previously returned 0, the same value used for "no
+  application data was read", so a caller testing for 0 could not tell the
+  two apart.  Callers that treat any non-1 result as failure are unaffected.
+
+* **Behavioral change (`wolfSSL_write_ex` with a NULL object)**: a NULL object
+  is now rejected with `BAD_FUNC_ARG` rather than reported as 0, matching
+  `wolfSSL_read_ex()` and the rest of the read/write API.  0 is also the value
+  used for "no application data was written", so a caller testing for 0 could
+  not tell the two apart.  Callers that treat any non-1 result as failure are
+  unaffected.
+
 # wolfSSL Release 5.9.2 (Jun 23, 2026)
 
 Release 5.9.2 has been developed according to wolfSSL's development and QA