[cconlon]

This PR changes WolfSSLSession.getError() to return the original wolfSSL error for MATCH_SUITE_ERROR (-501) and SOCKET_PEER_CLOSED_E (-397). With OPENSSL_EXTRA (enabled by --enable-jni), wolfSSL_get_error() converts both to SSL_ERROR_SYSCALL (5), which hides the real cause.

Fixes

• SSLSocket/Engine cipher suite mismatches now report -501 instead of "fatal I/O error in TLS layer (error code: 5)"
• SSLSocket read() now returns -1 instead of 0 when the peer closes the connection without sending close_notify

Also adds WolfSSL.MATCH_SUITE_ERROR and tests for both cases.

Behavior change: on OPENSSL_EXTRA builds, applications that call getError() directly now get MATCH_SUITE_ERROR or SSL_ERROR_SOCKET_PEER_CLOSED instead of SSL_ERROR_SYSCALL in these two cases.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #442

Scan targets checked: wolfssljni-src, wolfssljni-bugs
Coverage: 1 of 7 in-scope changed file(s) opened by the reviewer; not opened: native/com_wolfssl_WolfSSL.h, src/java/com/wolfssl/WolfSSL.java, src/java/com/wolfssl/WolfSSLSession.java, src/test/com/wolfssl/provider/jsse/test/WolfSSLEngineTest.java, src/test/com/wolfssl/provider/jsse/test/WolfSSLSocketTest.java, src/test/com/wolfssl/test/WolfSSLSessionTest.java

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[cconlon]

@claude review

[claude]

I reviewed this PR and didn't find any bugs. On OPENSSL_EXTRA builds it changes what the public WolfSSLSession.getError() returns, and two earlier reviews are still on the thread, so a human look would still be worthwhile.

What was reviewed:

• The native getError remap: wolfSSL_state() is only checked when the result is SSL_ERROR_SYSCALL, and a NULL ssl returns before that branch. Both error macros come from the already-included wolfssl/error-ssl.h.
• Callers in src/java: nothing compares against SSL_ERROR_SYSCALL. WolfSSLSocket.read() already maps SSL_ERROR_SOCKET_PEER_CLOSED with ret == 0 to end of stream, so the -1 fix follows from the remap.
• The new MATCH_SUITE_ERROR (-501) constant matches its define in native/com_wolfssl_WolfSSL.h. The new tests skip when the needed suites are missing and stay within Java 8.

Extended reasoning...

The change touches the JNI error-reporting path in native/com_wolfssl_WolfSSLSession.c, adds one public constant, and adds JUnit tests at the JNI, SSLSocket and SSLEngine layers. It doesn't touch any auth or key handling. It does change what a public API returns: OPENSSL_EXTRA builds now get -501 or -397 instead of 5, which can affect applications that check for SSL_ERROR_SYSCALL. Two earlier bot reviews (COMMENTED) came in with no later commit, and I can't see what they said, so approval is not appropriate.