wolfMQTT broker: ordering, persistence, offline queue, AES-GCM at rest

.github/workflows/broker-check.yml

@@ -63,6 +63,27 @@ jobs:
             cflags: ""
             wolfmqtt_opts: "--enable-v5 --enable-broker --enable-max-qos=0"
             skip_broker_test: "yes"
+          - name: "Broker v5 (ordering / Receive Maximum)"
+            cflags: ""
+            wolfmqtt_opts: "--enable-broker --enable-v5"
+          - name: "Broker v5 strict-serial (inflight=1)"
+            cflags: "-DBROKER_MAX_INFLIGHT_PER_SUB=1"
+            wolfmqtt_opts: "--enable-broker --enable-v5"
+          - name: "Broker v5 static memory"
+            cflags: "-DWOLFMQTT_STATIC_MEMORY"
+            wolfmqtt_opts: "--enable-broker --enable-v5"
+          - name: "Broker with persist"
+            cflags: ""
+            wolfmqtt_opts: "--enable-broker --enable-v5 --enable-broker-persist"
+          - name: "Broker with persist + TLS"
+            cflags: ""
+            wolfmqtt_opts: "--enable-broker --enable-v5 --enable-broker-persist --enable-tls"
+          - name: "Broker with persist + AES-GCM encryption"
+            cflags: ""
+            wolfmqtt_opts: "--enable-broker --enable-v5 --enable-broker-persist --enable-broker-persist-encrypt"
+          - name: "Broker with persist + static memory"
+            cflags: "-DWOLFMQTT_STATIC_MEMORY"
+            wolfmqtt_opts: "--enable-broker --enable-v5 --enable-broker-persist"
 
     steps:
     - name: Install dependencies

.github/workflows/macos-check.yml

@@ -84,5 +84,36 @@ jobs:
     - name: Show logs on failure
       if: failure() || cancelled()
       run: |
-        cat test-suite.log
-        cat scripts/*.log
+        # Copy broker.test tmp dirs ($TMPDIR/tmp.* on macOS, e.g.
+        # /var/folders/.../T/tmp.XXXXXX) into the workspace so the
+        # next step can upload them as an artifact. Globbing the
+        # real /var/folders path directly trips over unreadable
+        # macOS LaunchServices files.
+        mkdir -p ci-logs
+        [ -f test-suite.log ] && cp test-suite.log ci-logs/ || true
+        cp scripts/*.log ci-logs/ 2>/dev/null || true
+        for d in "${TMPDIR%/}"/tmp.* /tmp/tmp.*; do
+            [ -d "$d" ] || continue
+            base=$(basename "$d")
+            mkdir -p "ci-logs/$base"
+            cp "$d"/*.log "ci-logs/$base/" 2>/dev/null || true
+        done
+        echo "=== test-suite.log ==="
+        cat test-suite.log 2>/dev/null || true
+        echo "=== scripts/*.log ==="
+        cat scripts/*.log 2>/dev/null || true
+        echo "=== ci-logs/tmp.*/*.log (broker.test per-test logs) ==="
+        for f in ci-logs/tmp.*/*.log; do
+            [ -f "$f" ] || continue
+            echo "--- $f ---"
+            cat "$f"
+        done
+
+    - name: Upload broker.test logs on failure
+      if: failure() || cancelled()
+      uses: actions/upload-artifact@v4
+      with:
+        name: broker-test-logs-macos
+        path: ci-logs/
+        if-no-files-found: ignore
+        retention-days: 7

configure.ac

@@ -498,6 +498,58 @@ then
 AM_CFLAGS="$AM_CFLAGS -DWOLFMQTT_BROKER_NO_INSECURE"
 fi
 
+# Broker persistent storage (sessions, subs, retained, offline queue).
+# Opt-in; off by default. Adds the hook-based persistence layer plus a
+# default POSIX backend.
+AC_ARG_ENABLE([broker-persist],
+[AS_HELP_STRING([--enable-broker-persist],[Enable broker persistent storage via callback hooks (default: disabled)])],
+[ ENABLED_BROKER_PERSIST=$enableval ],
+[ ENABLED_BROKER_PERSIST=no ]
+)
+if test "x$ENABLED_BROKER_PERSIST" = "xyes"
+then
+    if test "x$ENABLED_BROKER" != "xyes"
+    then
+        AC_MSG_ERROR([--enable-broker-persist requires --enable-broker])
+    fi
+AM_CFLAGS="$AM_CFLAGS -DWOLFMQTT_BROKER_PERSIST"
+fi
+
+# Optional encryption-at-rest for persisted records using wolfCrypt AES-GCM.
+# Requires --enable-broker-persist; off by default.
+AC_ARG_ENABLE([broker-persist-encrypt],
+[AS_HELP_STRING([--enable-broker-persist-encrypt],[Encrypt persisted records with AES-GCM (default: disabled, requires --enable-broker-persist)])],
+[ ENABLED_BROKER_PERSIST_ENCRYPT=$enableval ],
+[ ENABLED_BROKER_PERSIST_ENCRYPT=no ]
+)
+if test "x$ENABLED_BROKER_PERSIST_ENCRYPT" = "xyes"
+then
+    if test "x$ENABLED_BROKER_PERSIST" != "xyes"
+    then
+        AC_MSG_ERROR([--enable-broker-persist-encrypt requires --enable-broker-persist])
+    fi
+AM_CFLAGS="$AM_CFLAGS -DWOLFMQTT_BROKER_PERSIST_ENCRYPT"
+fi
+
+# Development-only fixed-pattern derive_key hook for the CLI broker.
+# Off by default; required to use "-E dev" on encrypt builds. Never
+# enable in a production build - the resulting binary contains a
+# trivially-recoverable AES-GCM key generator that any flip of the
+# CLI argument would substitute for real key management.
+AC_ARG_ENABLE([broker-persist-encrypt-dev-key],
+[AS_HELP_STRING([--enable-broker-persist-encrypt-dev-key],[Link the CLI broker's fixed-pattern "dev" derive_key hook (default: disabled; requires --enable-broker-persist-encrypt; NOT FOR PRODUCTION)])],
+[ ENABLED_BROKER_PERSIST_ENCRYPT_DEV_KEY=$enableval ],
+[ ENABLED_BROKER_PERSIST_ENCRYPT_DEV_KEY=no ]
+)
+if test "x$ENABLED_BROKER_PERSIST_ENCRYPT_DEV_KEY" = "xyes"
+then
+    if test "x$ENABLED_BROKER_PERSIST_ENCRYPT" != "xyes"
+    then
+        AC_MSG_ERROR([--enable-broker-persist-encrypt-dev-key requires --enable-broker-persist-encrypt])
+    fi
+AM_CFLAGS="$AM_CFLAGS -DWOLFMQTT_BROKER_PERSIST_ENCRYPT_DEV_KEY"
+fi
+
 
 AM_CONDITIONAL([HAVE_LIBWOLFSSL], [test "x$ENABLED_TLS" = "xyes"])
 AM_CONDITIONAL([HAVE_LIBCURL], [test "x$ENABLED_CURL" = "xyes"])

examples/pub-sub/mqtt-sub.c

@@ -527,6 +527,13 @@ int sub_client(MQTTCtx *mqttCtx)
                 break;
             }
         }
+    #ifdef WOLFMQTT_NONBLOCK
+        else if (rc == MQTT_CODE_CONTINUE) {
+            /* Non-blocking: no data yet, keep polling. mqtt_check_timeout()
+             * above will convert this to MQTT_CODE_ERROR_TIMEOUT after the
+             * inactivity window, which drives the keep-alive ping branch. */
+        }
+    #endif
         else if (rc != MQTT_CODE_SUCCESS) {
             /* There was an error */
             PRINTF("MQTT Message Wait: %s (%d)",