Add full datagram support for BSD

Make mg_http_ota_cb public, add /ota endpoints to MCU examples

.github/workflows/nightly.yml

@@ -165,7 +165,7 @@ jobs:
     - run: |
         sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
         if [[ "${{ matrix.target }}" == *port* ]]; then source ./test/setup_ga_network.sh ; export ENV="-e Tmp=. -e WINEDEBUG=-all -e HOST_IP -e HOST_IPV6 -e HOST_IFC" ; sed -i -e "s/127.0.0.1//" test/mosquitto.conf; cat test/mosquitto.conf; ./test/setup_mqtt_server.sh ; make -C test port_tap_bridge ; test/port_tap_bridge & sleep 2 ; fi
-        make -C test ${{ matrix.target }} IPV6=${{ matrix.ipv6 }} SSL=${{ matrix.ssl }} MULTIREC=NO
+        make -C test ${{ matrix.target }} IPV6=${{ matrix.ipv6 }} SSL=${{ matrix.ssl }}
 
   miprtxbe:
     runs-on: ubuntu-latest
@@ -180,7 +180,7 @@ jobs:
     - run: |
         sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
         source ./test/setup_ga_network.sh ; export ENV="-e Tmp=. -e WINEDEBUG=-all -e HOST_IP -e HOST_IPV6 -e HOST_IFC -e RTX" ; sed -i -e "s/127.0.0.1//" test/mosquitto.conf ; ./test/setup_mqtt_server.sh ; make -C test port_tap_bridge ; test/port_tap_bridge & sleep 2
-        make -C test mip_port_s390 MULTIREC=NO
+        make -C test mip_port_s390
 
   l2:
     runs-on: ubuntu-latest
@@ -303,6 +303,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        target: [bsd, bsd_nortos]
         cc: [gcc, clang, g++, clang++]
     name: bsd CC=${{ matrix.cc }}
     steps:
@@ -316,7 +317,7 @@ jobs:
         make -C test/bsd shm_tap_bridge
         test/bsd/shm_tap_bridge &
         sleep 2
-        make -C test/bsd CC=${{ matrix.cc }} > log
+        make -C test/bsd ${{ matrix.target }} CC=${{ matrix.cc }} > log
     - if: success() || failure()
       run: |
         cat log
@@ -353,7 +354,7 @@ jobs:
     steps:
     - uses: actions/checkout@v5
       with: { fetch-depth: 2 }
-    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && ./test/setup_mqtt_server.sh && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test s390 SSL=${{ matrix.ssl }} MULTIREC=NO
+    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && ./test/setup_mqtt_server.sh && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test s390 SSL=${{ matrix.ssl }}
   armhf:
     runs-on: ubuntu-latest
     strategy:
@@ -366,7 +367,7 @@ jobs:
     steps:
     - uses: actions/checkout@v5
       with: { fetch-depth: 2 }
-    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && ./test/setup_mqtt_server.sh && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test armhf SSL=${{ matrix.ssl }} MULTIREC=NO
+    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && ./test/setup_mqtt_server.sh && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test armhf SSL=${{ matrix.ssl }}
   unamalgamated-mg_prefix:
     runs-on: ubuntu-latest
     strategy:
@@ -589,10 +590,12 @@ jobs:
               stm32/nucleo-f746zg/minimal
               stm32/nucleo-f746zg/minimal-pppoe
               stm32/nucleo-f756zg/minimal
-              stm32/nucleo-h563zi/minimal
               stm32/nucleo-h723zg/minimal
+              stm32/nucleo-h723zg/minimal-bsd-baremetal
+              stm32/nucleo-h723zg/minimal-bsd-freertos
           - group: stm32-2
             examples: |
+              stm32/nucleo-h563zi/minimal
               stm32/nucleo-h743zi/minimal
               stm32/nucleo-n657x0-q/minimal
               stm32/nucleo-u5a5zj-q/minimal
@@ -633,8 +636,7 @@ jobs:
       matrix:
         example:
           - path: micropython/esp32
-          - path: http/uart-bridge/esp32
+          - path: esp32/uart-bridge
-          - path: http/http-client/esp8266/http-client-server
     name: ${{ matrix.example.path }}
     env:
       GO: 0
@@ -652,7 +654,7 @@ jobs:
         include:
           - group: other
             examples: |
-              mqtt/mqtt-client/microchip/same54-xpro
+              microchip/same54-xpro/mqtt-client
               rp/pico-rmii
               stm32/nucleo-f746zg/minimal-rm2
               stm32/nucleo-f746zg/minimal-rndis
@@ -691,13 +693,13 @@ jobs:
       fail-fast: false
       matrix:
         example:
-          - path: esp32
+          - path: esp32/device-dashboard
     name: ${{ matrix.example.path }}
     steps:
       - uses: actions/checkout@v5
         with: { fetch-depth: 2 }
       - run: echo # nothing specific to install or do
-      - run: make -C tutorials/http/device-dashboard/${{ matrix.example.path }} build
+      - run: make -C tutorials/${{ matrix.example.path }} build
 
 
   device_dashboard_examples_arm:
@@ -709,12 +711,12 @@ jobs:
           - group: none
             cflags: ""
             examples: |
-              http/device-dashboard/microchip/same54-xpro
+              microchip/same54-xpro/device-dashboard
               renesas/ek-ra6m4-make-baremetal-builtin
           - group: builtin
             cflags: -DMG_TLS=MG_TLS_BUILTIN
             examples: |
-              http/device-dashboard/microchip/same54-xpro
+              microchip/same54-xpro/device-dashboard
               renesas/ek-ra6m4-make-baremetal-builtin
     name: device dashboard ARM ${{ matrix.group }}
     steps:
@@ -740,19 +742,19 @@ jobs:
           done
           exit $failed
 
-#  mqtt_dashboard_examples:
+  mqtt_dashboard_examples_arm:
-#    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest
-#    strategy:
+    strategy:
-#      fail-fast: false
+      fail-fast: false
-#      matrix:
+      matrix:
-#        example:
+        example:
-#          - path:
+          - path: rp/pico-rndis-device
-#    name: ${{ matrix.example.path }}
+    name: ${{ matrix.example.path }}
-#    steps:
+    steps:
-#      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5
-#        with: { fetch-depth: 2 }
+        with: { fetch-depth: 2 }
-#      - run: echo # nothing specific to install or do
+      - run: sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
-#      - run: make -C tutorials/${{ matrix.example.path }} build
+      - run: make -C tutorials/${{ matrix.example.path }} build
 
 
 #  dual_examples:

.github/workflows/nightly_tests.yml

@@ -98,8 +98,8 @@ jobs:
       with: { fetch-depth: 2 }
     - name: baremetal
       run: sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
-    - run:  make -C tutorials/http/device-dashboard/microchip/same54-xpro test VCON_API_KEY=${{secrets.VCON_API_KEY}}
+    - run:  make -C tutorials/microchip/same54-xpro/device-dashboard test VCON_API_KEY=${{secrets.VCON_API_KEY}}
-    - run:  make -C tutorials/mqtt/mqtt-client/microchip/same54-xpro test VCON_API_KEY=${{secrets.VCON_API_KEY}}
+    - run:  make -C tutorials/microchip/same54-xpro/mqtt-client test VCON_API_KEY=${{secrets.VCON_API_KEY}}
 
   test_pico_w5500:
     runs-on: ubuntu-latest

.github/workflows/quicktest.yml

@@ -158,7 +158,8 @@ jobs:
           - path: stm32/nucleo-f746zg/minimal
           - path: stm32/nucleo-h563zi/minimal
           - path: stm32/nucleo-h723zg/minimal
-          - path: stm32/nucleo-h723zg/minimal-bsd
+          - path: stm32/nucleo-h723zg/minimal-bsd-baremetal
+          - path: stm32/nucleo-h723zg/minimal-bsd-freertos
           - path: stm32/nucleo-h743zi/minimal
           - path: stm32/stm32h573i-dk/minimal
           - path: ti/ek-tm4c1294xl-make-baremetal-builtin
@@ -184,8 +185,7 @@ jobs:
       fail-fast: false
       matrix:
         example:
-          - path: http/uart-bridge/esp32
+          - path: esp32/uart-bridge
-          - path: http/http-client/esp8266/http-client-server
     name: ${{ matrix.example.path }}
     env:
       GO: 0
@@ -227,7 +227,7 @@ jobs:
       fail-fast: false
       matrix:
         example:
-          - path: esp32
+          - path: esp32/device-dashboard
     name: ${{ matrix.example.path }}
     env:
       GO: 0
@@ -235,12 +235,12 @@ jobs:
       - uses: actions/checkout@v5
         with: { fetch-depth: 2 }
       - run: |
-          if ./test/match_changed_files.sh '^src|tutorials/http/device-dashboard'; then
+          if ./test/match_changed_files.sh '^src|^tutorials/http/device-dashboard|^tutorials/${{ matrix.example.path }}'; then
             echo GO=1 >> $GITHUB_ENV
             # nothing specific to install or do
           fi
       - if: ${{ env.GO == 1 }}
-        run: make -C tutorials/http/device-dashboard/${{ matrix.example.path }} build
+        run: make -C tutorials/${{ matrix.example.path }} build
 
   device_dashboard_examples_arm:
     runs-on: ubuntu-latest
@@ -248,7 +248,7 @@ jobs:
       fail-fast: false
       matrix:
         example:
-          - path: http/device-dashboard/microchip/same54-xpro
+          - path: microchip/same54-xpro/device-dashboard
           - path: renesas/ek-ra6m4-make-baremetal-builtin
           - path: rp/pico-rndis
           - path: rp/pico-w
@@ -267,3 +267,24 @@ jobs:
           fi
       - if: ${{ env.GO == 1 }}
         run: make -C tutorials/${{ matrix.example.path }} build
+
+  mqtt_dashboard_examples_arm:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        example:
+          - path: rp/pico-rndis-device
+    name: ${{ matrix.example.path }}
+    env:
+      GO: 0
+    steps:
+      - uses: actions/checkout@v5
+        with: { fetch-depth: 2 }
+      - run: |
+          if ./test/match_changed_files.sh '^src|^tutorials/mqtt/mqtt-dashboard/device|^tutorials/${{ matrix.example.path }}'; then
+            echo GO=1 >> $GITHUB_ENV
+            sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
+          fi
+      - if: ${{ env.GO == 1 }}
+        run: make -C tutorials/${{ matrix.example.path }} build

.github/workflows/test.yml

@@ -179,7 +179,6 @@ jobs:
         example:
           - path: esp32/uart-bridge
           - path: esp32/micropython
-          - path: esp8266/http-client-server
     name: ${{ matrix.example.path }}
     env:
       GO: 0

AGENTS.md

@@ -1,8 +1,12 @@
-# Mongoose - Embedded Network Library
+# Mongoose: a full-stack embedded networking library
+
+Mongoose is a full-stack embedded networking library for C/C++: a TCP/IP stack
+with drivers, TLS 1.3, an embedded web server (HTTP, WebSocket), MQTT and
+firmware OTA updates in two files, `mongoose.c` and `mongoose.h`. Mongoose runs on
+STM32, NXP and other microcontrollers, on bare metal or with an RTOS, with no
+external dependencies. Use it for cloud connectivity, device web dashboards,
+secure firmware updates and remote control.
 
-Mongoose is an open source, two-file C networking library and embedded web server for
-microcontrollers that combines TCP/IP stack, HTTP, WebSocket, MQTT, TLS 1.3
-stack, built-in firmware OTA updates, and device-dashboard infrastructure.
 License: GPLv2 or commercial.
 Website: https://mongoose.ws/
 GitHub repo: https://github.com/cesanta/mongoose

README.md

@@ -1,4 +1,4 @@
-# Mongoose - Embedded Web Server / Embedded Network Library
+# Mongoose: a full-stack embedded networking library
 
 [![License: GPLv2/Commercial](https://img.shields.io/badge/License-GPLv2%20or%20Commercial-green.svg)](https://opensource.org/licenses/gpl-2.0.php)
 [![Build Status]( https://github.com/cesanta/mongoose/actions/workflows/quicktest.yml/badge.svg)](https://github.com/cesanta/mongoose/actions)
@@ -7,11 +7,17 @@
 
 <img src="https://mongoose.ws/images/logo.svg" width="48" height="48"
 align="left" style="float:left;" />
-Two files. Drop `mongoose.c` and `mongoose.h` into any C/C++ project and get a
+Mongoose is a full-stack embedded networking library for C/C++: a TCP/IP stack
-full network stack — HTTP, WebSocket, MQTT, TLS, firmware OTA
+with drivers, TLS 1.3, an embedded web server (HTTP, WebSocket), MQTT and
-updates, device dashboard — on any microcontroller or desktop OS.
+firmware OTA updates in two files, `mongoose.c` and `mongoose.h`. Mongoose runs on
+STM32, NXP and other microcontrollers, on bare metal or with an RTOS, with no
+external dependencies. Use it for cloud connectivity, device web dashboards,
+secure firmware updates and remote control.
 
-On the market since 2004, used by vast number of open source and commercial
+Use it instead of lwIP + mbedTLS + httpd + an MQTT client + OTA glue code, or
+run it on top of lwIP or Zephyr.
+
+On the market since 2004, used by a vast number of open source and commercial
 products - it even runs on the International Space Station! Features include:
 
 - Cross-platform:
@@ -24,7 +30,7 @@ products - it even runs on the International Space Station! Features include:
 - Source code is both ISO C and ISO C++ compliant
 - Very easy to integrate
 - Own TCP/IP stack for bare metal / RTOS, or run on top of any existing one (lwIP, Zephyr, ...)
-- Built-in TLS 1.3 ECC stack. Also can use external TLS libraries - mbedTLS, OpenSSL, or other
+- Built-in TLS 1.3 stack. Also can use external TLS libraries - mbedTLS, OpenSSL, or other
 - Does not depend on any other software to implement networking
 - Built-in firmware updates for STM32 H5, STM32 H7, NXP IMXRT, RP2040/2350, ESP32 and more
 - Commercial support with proactive security updates; [CRA-compliant](https://mongoose.ws/security/cra-compliance/)
@@ -35,8 +41,32 @@ See https://mongoose.ws/ for complete documentation, videos, case studies, etc.
 
 ## Supported platforms
 
-Mongoose can work on top of any TCP/IP stack that supports BSD sockets API.
+Mongoose has its own built-in TCP/IP stack with drivers, so it needs no
-Platforms supported by the 3rd party TCP/IP stacks:
+additional software to implement networking. The built-in stack runs on bare
+metal and under any RTOS. Platforms supported by the Mongoose built-in TCP/IP
+stack:
+
+| MCU | Connectivity | Notes |
+| :-- | :----------- | :---- |
+| **STM32** | Built-in Ethernet | Ethernet-capable STM32F, STM32H5, STM32H7, STM32N6, STM32C5 variants |
+| **NXP i.MX RT** | Built-in Ethernet | RT102x, RT104x, RT105x, RT106x, RT117x, RT118x (NETC) |
+| **NXP MCX** | Built-in Ethernet | MCXN94x, MCXE247 |
+| **NXP RW612** | Eth, WiFi, 802.15.4 | Separate Ethernet and radio drivers |
+| **Microchip ATSAME54** | Built-in Ethernet | GMAC driver |
+| **Renesas RA** | Built-in Ethernet | RA6M, RA8M |
+| **Infineon XMC** | Built-in Ethernet | XMC4, XMC7 |
+| **Texas Instruments** | Built-in Ethernet | TM4C, TMS570 |
+| **RP2040, RP2350, STM32, others** | CYW43xx Wi-Fi chips | SPI or SDIO; Pico W, Pico 2 W, Pico RM2, Arduino Portenta H7 |
+| **STM32, others** | ST67W6 Wi-Fi modules | SPI; for example, STM32U5 with the ST67W611M1 module |
+| **MCUs with an NXP Wi-Fi SDK port** | NXP Wi-Fi | Requires the SDK's Wi-Fi port implementing the driver's network hooks |
+| **NXP MCXW71** | Built-in 802.15.4 radio | IPv4 over IEEE 802.15.4 |
+| **NXP RW612** | Built-in 802.15.4 radio | IPv4 over IEEE 802.15.4; requires NXP radio firmware |
+| **Any MCU with SPI** | W5500 or W5100 Ethernet chips | External Wiznet MAC+PHY |
+| **MCUs connected to a cellular modem** | Cellular | AT commands and PPP; for example, SIM800 |
+| **MCUs with CMSIS Ethernet drivers** | Ethernet via CMSIS-Driver | Requires CMSIS Ethernet MAC and PHY drivers |
+
+Mongoose can also run on top of any TCP/IP stack that supports the BSD
+sockets API. Platforms supported via 3rd party TCP/IP stacks:
 
 | TCP/IP stack    | Notes |
 | :-------------- | :------- |
@@ -45,23 +75,6 @@ Platforms supported by the 3rd party TCP/IP stacks:
 | **Other**       | Any other TCP/IP stack that supports BSD socket API, for example Amazon FreeRTOS-TCP |
 | **Linux, Mac, Windows**   | Workstations, server, single board computers, embedded Linux devices running on MPUs or FPGAs |
 
-Optionally, Mongoose provides its own built-in TCP/IP stack, eliminating the
-need for additional software to implement networking functionality. The
-built-in stack supports operation in both bare-metal and RTOS environments.
-Platforms supported by the Mongoose built-in TCP/IP stack:
-
-| Hardware       | Notes |
-| :------------- | :------- |
-| **STM32**      | All STM32 MCUs with built-in Ethernet: STM32Fxx, STM32H5xx, STM32H7xx |
-| **NXP**        |  All NXP MCUs with built-in Ethernet: IMXRT102x, IMXRT104x, IMXRT105x, IMXRT106x, IMXRT117x, RW612, MCXN94x   |
-| **Microchip**  | ATSAME54 MCUs with built-int Ethernet  |
-| **Renesas**    | RA5M, RA6M, RA8M MCUs with built-in Ethernet    |
-| **Infineon**   | XMC4, XMC7 MCUs with built-in Ethernet    |
-| **Texas Instruments**  |  TM4C, TMS570 MCUs with built-in Ethernet   |
-| **Cypress WiFi**  | Any MCU with CY43xx WiFi chips, like RP2040 Pico-W, RP2350 Pico2-W, Arduino Portenta    |
-| **Wiznet Ethernet**  | Any MCU that use Wiznet W5500 or Wiznet 5100 MAC+PHY chips    |
-| **Cellular**   | NRF9160, SIM800    |
-
 ## Usage Examples
 
 Below are quick snippets that should give an idea how simple the API is and
@@ -158,6 +171,17 @@ int main() {
 }
 ```
 
+## Licensing
+
+Mongoose is dual-licensed:
+- GPLv2: free for open source projects. Many popular open source projects use
+  Mongoose, for example
+  [SWUpdate](https://github.com/sbabic/swupdate/tree/master/mongoose), the
+  embedded Linux update framework
+- Commercial: for closed-source products. Includes support directly from the
+  engineers who wrote the whole stack, and early security fixes.
+  See [licensing](https://mongoose.ws/licensing/)
+
 ## Commercial use
 - Mongoose is used by hundreds of businesses, from Fortune500 giants like
   Siemens, Schneider Electric, Broadcom, Bosch, Google, Samsung, Qualcomm, Caterpillar to the small businesses
@@ -222,6 +246,13 @@ Technical guides and deep dives into embedded web servers, WebUI integration and
 - [lwIP vs Mongoose - TCP/IP Stack Integration Benchmark](https://mongoose.ws/articles/lwip-vs-mongoose-tcpip-stack-integration/)
 - [Embedded TCP/IP Stacks Comparison](https://mongoose.ws/embedded-tcpip-stack-comparison/)
 - [STM32H5 File System on Internal Flash: LittleFS + Mongoose](https://mongoose.ws/articles/stm32h5-file-system-on-internal-flash/)
+- [Firmware OTA and remote control on NXP FRDM-RW612](https://mongoose.ws/articles/rw612-mdash/)
+- [25000 WebSocket messages per second on STM32 Nucleo-H723ZG](https://mongoose.ws/articles/stm32-websocket-benchmark/)
+- [How to connect STM32 to AWS IoT Core](https://mongoose.ws/articles/stm32-aws-iot/)
+- [How to connect STM32 to Azure IoT Hub](https://mongoose.ws/articles/stm32-azure-iot-hub/)
+- [How to connect STM32 to EMQX](https://mongoose.ws/articles/stm32-emqx/)
+- [STM32 Device Management deep dive: Secure OTA, Remote Control, health monitor](https://mongoose.ws/articles/stm32-mdash-deep-dive/)
+- [STM32 TCP/IP footprint: how much flash and RAM does Mongoose take?](https://mongoose.ws/articles/tcp-ip-footprint/)
 
 
 ## Contributions

SECURITY.md

@@ -0,0 +1,41 @@
+# Security Policy
+
+Mongoose is a full-stack embedded networking library by Cesanta Software Ltd,
+<https://mongoose.ws>. This policy covers how to report vulnerabilities
+and how Cesanta handles them.
+
+## Supported versions
+
+Security fixes go to the `master` branch and the latest release.
+
+## Reporting a vulnerability
+
+Do not report security issues in public GitHub issues. Report them
+privately using GitHub Security Advisories:
+<https://github.com/cesanta/mongoose/security/advisories/new>
+
+Include the Mongoose version or commit, steps or a proof of concept to reproduce, and
+the impact. Cesanta usually responds the same business day.
+
+## Disclosure process
+
+1. Cesanta reviews the report and coordinates a fix with the reporter.
+2. Eligible commercial customers receive a notification and a private fix
+   one month before the CVE becomes public.
+3. The fix and the CVE are then published. The reporter is credited in the
+   GitHub Security Advisory.
+
+## Security testing
+
+- CI on every push, unit tests built with ASAN and UBSan
+- CodeQL static analysis on every commit
+- Continuous fuzzing on OSS-Fuzz, plus nightly libFuzzer runs
+- AI-assisted security review on every pull request
+- Regular review by independent security research groups worldwide
+
+## EU Cyber Resilience Act (CRA)
+
+Mongoose supports CRA compliance for connected products: a documented
+vulnerability handling process (this file), TLS 1.3, signed OTA firmware
+updates, and an SBOM (`sbom.cdx.json`). Details:
+<https://mongoose.ws/security/cra-compliance/>

resources/I-CUBE-Mongoose/.config/mongoose_parameters.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "version": "0.0.1",
+  "componentid": "::Mongoose:Networking Core",
+  "type": "object",
+  "grammarVersion": "3.8.0",
+  "license": "Copyright (c) Cesanta Software Limited",
+  "properties": {
+    "parameters": {
+      "type": "object",
+      "properties": {
+        "info": {
+          "type": "object",
+          "title": "General information",
+          "properties": {
+            "description": {
+              "title": "Middleware description",
+              "type": "string",
+              "actions": [
+                {
+                  "type": "disable",
+                  "condition": "true"
+                }
+              ],
+              "default": "Mongoose networking library: TCP/IP, TLS, HTTP, WebSocket, MQTT, OTA. Edit mongoose_config.h to configure it."
+            }
+          }
+        }
+      }
+    }
+  }
+}

resources/I-CUBE-Mongoose/Cesanta.I-CUBE-Mongoose.pdsc

@@ -1,13 +1,22 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<package schemaVersion="1.7.40" xmlns:xs="http://www.w3.org/2001/XMLSchema-instance" xs:noNamespaceSchemaLocation="PACK.xsd">
+<package schemaVersion="1.7.56" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:stm32="https://developer.st.com/schemas/stm32cube/1.0.0" xsi:noNamespaceSchemaLocation="PACK.xsd">
   <vendor>Cesanta</vendor>
   <name>I-CUBE-Mongoose</name>
-  <description>Mongoose - a lightweight networking library providing TCP/IP stack, TLS, HTTP (Embedded Web Server), WebSocket, MQTT, and Firmware OTA updates. Build production-ready web device dashboards and MQTT cloud connectivity without stitching multiple components together.
+  <description>Mongoose - a full-stack networking library for microcontrollers: Ethernet and Wi-Fi drivers, TCP/IP stack, TLS 1.3, HTTP, WebSocket, MQTT, Modbus, OTA updates and device management, in a two-file C/C++ library, on any RTOS or bare metal.</description>
-  </description>
   <url>https://mongoose.ws/downloads/stm32pack/</url>
   <license>License.txt</license>
   <supportContact>https://mongoose.ws/contact/</supportContact>
+  <environments>
+    <environment name="STM32Cube">
+      <stm32:pack type="MW" friendlyName="Mongoose" shortDesc="Mongoose full-stack networking library">
+        <relocation-info parent="middleware"/>
+        <no-compatibility-constraint/>
+      </stm32:pack>
+    </environment>
+  </environments>
   <releases>
+    <release date="2026-10-21" version="7.23.3">See https://github.com/cesanta/mongoose/releases/tag/7.23</release>
+    <release date="2026-10-19" version="7.23.2">See https://github.com/cesanta/mongoose/releases/tag/7.23</release>
     <release date="2026-09-28" version="7.23.1">See https://github.com/cesanta/mongoose/releases/tag/7.23</release>
     <release date="2026-05-11" version="7.21.7">See https://github.com/cesanta/mongoose/releases/tag/7.21</release>
     <release date="2026-05-05" version="7.21.5">See https://github.com/cesanta/mongoose/releases/tag/7.21</release>
@@ -20,7 +29,7 @@
       <keyword>IMPLEMENTED_WITH_STM32CUBEMX</keyword>
   </keywords>
   <components>
-    <component Cclass="Mongoose" Cgroup="Networking Core" Cversion="7.23.1" maxInstances="1">
+    <component Cclass="Mongoose" Cgroup="Networking Core" Cversion="7.23.3" maxInstances="1">
       <description>Networking Core</description>
       <files>
         <file category="doc" name="README.md"/>
@@ -28,7 +37,15 @@
         <file category="sourceC" name="mongoose.c" />
         <file category="header" name="mongoose_config.h"/>
         <file category="utility" name="README.md" public="false"/>
+        <file category="genAsset" name=".config/mongoose_parameters.json"/>
       </files>
+      <environments>
+        <environment name="STM32Cube">
+          <stm32:component>
+            <middleware-entry-point id="Mongoose" name="Mongoose" category="TCP/IP"/>
+          </stm32:component>
+        </environment>
+      </environments>
     </component>
   </components>
 </package>

resources/I-CUBE-Mongoose/Makefile

@@ -1,10 +1,16 @@
-VERSION = 7.23.1
+VERSION = 7.23.3
 REPO_ROOT = ../..
 MX ?= /Applications/STMicroelectronics/STM32CubeMX.app/Contents/MacOs/STM32CubeMX
-FILES = Cesanta.I-CUBE-Mongoose.pdsc Release_Notes.html mongoose_config.h README.md
+FILES = Cesanta.I-CUBE-Mongoose.pdsc Release_Notes.html mongoose_config.h README.md .config/mongoose_parameters.json
 GENERATED = License.txt mongoose.h mongoose.c
+MX2 ?= $(HOME)/STMicroelectronics/STM32CubeMX2_1.1.2/.bin/cube
+PACKSDIR ?= $(HOME)/Library/Application Support/stm32cube/packs
+MX2CPN ?= STM32C5A3ZGT6
+MX2PROJ = $(CURDIR)/mx2test/test.ioc2
+
+NAME = Cesanta.I-CUBE-Mongoose.$(VERSION)
+PACK = $(NAME).pack
 
-PACK = Cesanta.I-CUBE-Mongoose.$(VERSION).pack
 all: $(PACK)
 
 Cesanta.I-CUBE-Mongoose.$(VERSION).pack: $(FILES) $(GENERATED)
@@ -44,5 +50,19 @@ mongoose.h: Mongoose
 mongoose.c: Mongoose
 	cp $(REPO_ROOT)/mongoose.c $@
 
+test_mx2: $(PACK)
+	-$(MX2) pack remove --cmsis-pack-root "$(PACKSDIR)" $(NAME)
+	rm -f "$(PACKSDIR)/.Download/$(PACK)"
+	$(MX2) pack install --cmsis-pack-root "$(PACKSDIR)" "$(CURDIR)/$(PACK)"
+	export PATH="$(dir $(MX2)):$$PATH"; \
+	PORT=$$(cube lifecycle-mx start-only | sed -n 's/^BACKEND_PORT *//p'); \
+	cube mx project close --port $$PORT -p "$(MX2PROJ)" --discard > /dev/null 2>&1; \
+	rm -rf mx2test && mkdir mx2test && \
+	cube mx project create-from-mcu --port $$PORT --cpn $(MX2CPN) -l "$(CURDIR)/mx2test" -n test --empty-project && \
+	cube mx middleware enable-middleware --port $$PORT -p "$(MX2PROJ)" -n Mongoose | tee mx2test/enable.json && \
+	grep -q '"status": "success"' mx2test/enable.json && \
+	cube mx project save --port $$PORT -p "$(MX2PROJ)" && \
+	cube mx project close --port $$PORT -p "$(MX2PROJ)" --discard
+
 clean:
-	rm -rf *.pack STM32CubeMX/*.$(VERSION)_*.xml $(GENERATED)
+	rm -rf *.pack STM32CubeMX/*.$(VERSION)_*.xml $(GENERATED) mx2test

resources/specs/areas/tls.md

@@ -13,9 +13,10 @@ Primary files:
 - `src/tls_dummy.c`
 - `src/tls_mbed.c`
 - `src/tls_openssl.c`
+- `src/tls_p256_cortex.c`
+- `src/tls_p256.c`
+- `src/tls_p384.c`
 - `src/tls_rsa.c`
-- `src/tls_uecc.c`
-- `src/tls_x25519.c`
 
 Perform a focused security review centered on these files and this security surface.
 
@@ -38,6 +39,6 @@ Trace attacker-controlled TLS peer input through normal client and server execut
 - Verify that wildcard matching is applied only to certificate presented identifiers, not to arbitrary reference identifiers or general DNS glob matching.
 - Review `mg_match` or other glob/matching helpers if used for certificate identity checks, authorization checks, filesystem paths, routing, or topic matching. Flag cases where glob semantics are broader than the security policy requires.
 - Check certificate parsing for DER/PEM boundary errors, length overflows, malformed ASN.1, extension parsing mistakes, name constraints, SAN vs CN precedence, embedded NUL, and invalid string type handling.
-- Review TLS record parsing, handshake transcript handling, key schedule, random generation, ECC/X25519 operations, AES-GCM nonce/tag handling, and error handling for memory safety and authentication failures.
+- Review TLS record parsing, handshake transcript handling, key schedule, random generation, ECC (P-256, P-384) operations, AES-GCM nonce/tag handling, and error handling for memory safety and authentication failures.
 - Flag any behavior that silently falls back from verified TLS to unverified TLS or plaintext.
 - Check that TLS receive/send error paths cannot corrupt connection state, reuse freed buffers, or continue processing unauthenticated plaintext as encrypted data.

sbom.cdx.json

@@ -3,9 +3,9 @@
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
   "serialNumber": "urn:uuid:d3f8b1e2-4a7c-4d9e-bf2a-1c3e5f7a9b0d",
-  "version": 1,
+  "version": 2,
   "metadata": {
-    "timestamp": "2026-08-12T00:00:00Z",
+    "timestamp": "2026-10-13T00:00:00Z",
     "component": {
       "type": "library",
       "bom-ref": "mongoose",
@@ -34,14 +34,31 @@
   "components": [
     {
       "type": "library",
-      "bom-ref": "micro-ecc",
+      "bom-ref": "bearssl-ec",
-      "author": "Kenneth MacKay",
+      "author": "Thomas Pornin",
-      "name": "micro-ecc",
+      "name": "BearSSL EC (P-256, P-384, ECDSA)",
-      "description": "ECC point operations on GF(p) curves (secp256r1). Used by Mongoose built-in TLS 1.3 for ECDH key exchange and ECDSA signatures. Source: src/tls_uecc.c, src/tls_uecc.h.",
+      "description": "P-256 (ec_p256_m31) and P-384 (ec_prime_i31) elliptic curve arithmetic, ECDSA sign and verify, and the i31 bignum code they use, derived from BearSSL. Used by Mongoose built-in TLS 1.3 for ECDHE key exchange and ECDSA signatures, by JWT ES256 and by OTA firmware signature verification. Source: src/tls_p256.c, src/tls_p256.h, src/tls_p384.c, src/tls_p384.h.",
-      "licenses": [ { "expression": "BSD-2-Clause" } ],
+      "licenses": [ { "expression": "MIT" } ],
-      "purl": "pkg:github/kmackay/micro-ecc",
       "externalReferences": [
-        { "type": "vcs", "url": "https://github.com/kmackay/micro-ecc" }
+        { "type": "website", "url": "https://bearssl.org" }
+      ],
+      "properties": [
+        { "name": "upstream-commit", "value": "7bea48e5e850ab4cafbe68d3765cdaba13a86d6f" }
+      ]
+    },
+    {
+      "type": "library",
+      "bom-ref": "p256-cortex-m4",
+      "author": "Emil Lenngren, Shortcut Labs AB",
+      "name": "P256-Cortex-M4",
+      "description": "P-256 ECDH and ECDSA in Cortex-M assembly. Used by Mongoose built-in TLS 1.3 instead of the BearSSL P-256 code on Cortex-M cores with the DSP extension (M4, M7, M33, M55, M85). Source: src/tls_p256_cortex.c.",
+      "licenses": [ { "expression": "MIT" } ],
+      "purl": "pkg:github/Emill/P256-Cortex-M4@ecd3ec2222fc9e18b6b44c86bb7183971a2041fc",
+      "externalReferences": [
+        { "type": "vcs", "url": "https://github.com/Emill/P256-Cortex-M4" }
+      ],
+      "properties": [
+        { "name": "upstream-commit", "value": "ecd3ec2222fc9e18b6b44c86bb7183971a2041fc" }
       ]
     },
     {
@@ -55,17 +72,6 @@
         { "type": "website", "url": "https://bearssl.org" }
       ]
     },
-    {
-      "type": "library",
-      "bom-ref": "strobe-x25519",
-      "author": "Cryptography Research, Inc. / Mike Hamburg",
-      "name": "STROBE x25519 (adapted)",
-      "description": "X25519 Diffie-Hellman function adapted from the STROBE project. Used by Mongoose built-in TLS 1.3 for ECDH key exchange. Source: src/tls_x25519.c.",
-      "licenses": [ { "expression": "MIT" } ],
-      "externalReferences": [
-        { "type": "website", "url": "https://strobe.sourceforge.io/" }
-      ]
-    },
     {
       "type": "library",
       "bom-ref": "sha1-reid",

src/arch.h

@@ -4,7 +4,6 @@
 #define MG_ARCH_UNIX 1          // Linux, BSD, Mac, ...
 #define MG_ARCH_WIN32 2         // Windows
 #define MG_ARCH_ESP32 3         // ESP32
-#define MG_ARCH_ESP8266 4       // ESP8266
 
 #define MG_ARCH_FREERTOS 5      // FreeRTOS <-- DEPRECATED !!!
 
@@ -50,7 +49,6 @@
 #include "arch_armgcc.h"
 #include "arch_cube.h"
 #include "arch_esp32.h"
-#include "arch_esp8266.h"
 #include "arch_rtx.h"
 #include "arch_threadx.h"
 #include "arch_unix.h"

src/arch_cube.h

@@ -32,6 +32,7 @@
 
 #if MG_ENABLE_TCPIP && !defined(MG_ENABLE_DRIVER_STM32F) && \
     !defined(MG_ENABLE_DRIVER_STM32H) && !defined(MG_ENABLE_DRIVER_STM32N) && \
+    !defined(MG_ENABLE_DRIVER_STM32C) && \
     !defined(MG_ENABLE_DRIVER_CYW) && !defined(MG_ENABLE_DRIVER_CYW_SDIO) && \
     !defined(MG_ENABLE_DRIVER_ST67W6)
 #if defined(STM32F1) || defined(STM32F2) || defined(STM32F4) || defined(STM32F7)
@@ -40,6 +41,8 @@
 #define MG_ENABLE_DRIVER_STM32H 1
 #elif defined(STM32N6)
 #define MG_ENABLE_DRIVER_STM32N 1
+#elif defined(STM32C5)
+#define MG_ENABLE_DRIVER_STM32C 1
 #else
 #error Select a driver in mongoose_config.h
 #endif
@@ -56,70 +59,8 @@
 #define MG_OTA MG_OTA_STM32H5
 #elif !defined(MG_OTA) && defined(STM32H7)
 #define MG_OTA MG_OTA_STM32H7
-#endif
+#elif !defined(MG_OTA) && defined(STM32C5)
-
+#define MG_OTA MG_OTA_STM32C5
-// OTA rollback timer via IWDG. Fixed 10 s hang-detection window (prescaler
-// /1024, LSI ~32 kHz: reload = 10 * 32000 / 1024 = 312). mg_ota_poll() feeds
-// the watchdog every 500 ms while in MG_OTA_TESTING state; if the event loop
-// hangs for 10 s, the IWDG fires and the device rolls back.
-// STM32H7 names the peripheral IWDG1; all others use IWDG.
-// The total evaluation period is set by MG_OTA_ROLLBACK_TIMEOUT_SECONDS.
-// STM32H7 names the watchdog peripheral IWDG1; all other families use IWDG.
-#if defined(IWDG1) && !defined(IWDG)
-#define MG_IWDG IWDG1
-#else
-#define MG_IWDG IWDG
-#endif
-// PR=6 → /256 prescaler, RLR=1250 → ~10 s at LSI 32 kHz.
-// Works on F4/F7/H5/H7; uses direct register writes so it is safe before HAL_Init().
-#ifndef MG_OTA_ROLLBACK_TIMER_START
-#define MG_OTA_ROLLBACK_TIMER_START()                                          \
-  do {                                                                         \
-    MG_IWDG->KR = 0xCCCCU;                              /* start + LSI  */    \
-    MG_IWDG->KR = 0x5555U;                              /* unlock PR/RLR */   \
-    MG_IWDG->PR = 6U;                                   /* /256         */    \
-    MG_IWDG->RLR = 1250U;                               /* 10 s         */    \
-    while (MG_IWDG->SR & (IWDG_SR_PVU | IWDG_SR_RVU)) (void) 0;              \
-    MG_IWDG->KR = 0xAAAAU;                              /* reload       */    \
-  } while (0)
-#endif
-
-// Feed (reload) the IWDG. Called from mg_ota_poll() every 500 ms.
-#ifndef MG_OTA_ROLLBACK_TIMER_FEED
-#define MG_OTA_ROLLBACK_TIMER_FEED() (MG_IWDG->KR = 0xAAAAU)
-#endif
-
-// OTA state in a backup register that survives warm resets but clears on POR.
-// STATE_GET reads work without any setup. STATE_SET enables the RTC APB clock
-// and unlocks backup domain write access via direct register writes, so it is
-// safe to call from any context (before or after HAL_Init).
-// H5 (TAMP->BKP0R), H7 (RTC->BKP0R), F4/F7 (RTC->BKP0R).
-#ifndef MG_OTA_STATE_GET
-#if defined(PWR_DBPCR_DBP)
-#define MG_OTA_DBP_ENABLE() (PWR->DBPCR |= PWR_DBPCR_DBP)
-#elif defined(PWR_CR1_DBP)
-#define MG_OTA_DBP_ENABLE() (PWR->CR1 |= PWR_CR1_DBP)
-#else
-#define MG_OTA_DBP_ENABLE() (PWR->CR |= PWR_CR_DBP)
-#endif
-
-#if defined(TAMP)
-#define MG_OTA_STATE_GET()                                           \
-  (RCC->APB3ENR |= RCC_APB3ENR_RTCAPBEN, TAMP->BKP0R)
-#define MG_OTA_STATE_SET(v)                                           \
-  (RCC->APB3ENR |= RCC_APB3ENR_RTCAPBEN, MG_OTA_DBP_ENABLE(),        \
-   (TAMP->BKP0R = (uint32_t) (v)), TAMP->BKP0R)
-#elif defined(RCC_APB4ENR_RTCAPBEN)
-#define MG_OTA_STATE_GET() (RTC->BKP0R)
-#define MG_OTA_STATE_SET(v)                                           \
-  (RCC->APB4ENR |= RCC_APB4ENR_RTCAPBEN, MG_OTA_DBP_ENABLE(),        \
-   (RTC->BKP0R = (uint32_t) (v)))
-#else
-#define MG_OTA_STATE_GET() (RTC->BKP0R)
-#define MG_OTA_STATE_SET(v)                                           \
-  (RCC->APB1ENR |= RCC_APB1ENR_PWREN, MG_OTA_DBP_ENABLE(),           \
-   (RTC->BKP0R = (uint32_t) (v)))
-#endif
 #endif
 
 // use HAL-defined execute-in-ram section

src/arch_esp32.h

@@ -22,10 +22,8 @@
 #include <esp_system.h>
 #include <esp_mac.h>
 #include <esp_idf_version.h>
-#include <esp_ota_ops.h>
+// #include <esp_memory_utils.h>  // For health record coredumps
-#include <esp_task_wdt.h>
+// #include <esp_core_dump.h>     // For health record coredumps
-#include <soc/soc.h>
-#include <soc/rtc_cntl_reg.h>
 
 #define MG_PATH_MAX 128
 
@@ -33,55 +31,8 @@
 #define MG_ENABLE_POSIX_FS 1
 #endif
 
-#ifndef MG_OTA_ESP32_WDT_TIMEOUT_MS
+#ifndef MG_HEALTH_DATA_SIZE
-#define MG_OTA_ESP32_WDT_TIMEOUT_MS 10000U
+#define MG_HEALTH_DATA_SIZE 20
-#endif
-
-static inline void mg_ota_esp32_timer_start(void) {
-#if ESP_IDF_VERSION_MAJOR >= 5
-  esp_task_wdt_config_t cfg = {0};
-  esp_err_t err;
-
-  cfg.timeout_ms = MG_OTA_ESP32_WDT_TIMEOUT_MS;
-  cfg.idle_core_mask = 0;
-  cfg.trigger_panic = true;
-
-  err = esp_task_wdt_init(&cfg);
-  if (err == ESP_ERR_INVALID_STATE) esp_task_wdt_reconfigure(&cfg);
-#else
-  esp_task_wdt_init(MG_OTA_ESP32_WDT_TIMEOUT_MS / 1000U, true);
-#endif
-  esp_task_wdt_add(NULL);
-  esp_task_wdt_reset();
-}
-
-static inline uint32_t mg_ota_esp32_state_set(uint32_t state) {
-  if (state == 0) esp_ota_mark_app_valid_cancel_rollback();
-  REG_WRITE(RTC_CNTL_STORE0_REG, state);
-  return REG_READ(RTC_CNTL_STORE0_REG);
-}
-
-#define MG_OTA_STATE_GET() \
-  REG_READ(RTC_CNTL_STORE0_REG)
-
-#define MG_OTA_STATE_SET(v) mg_ota_esp32_state_set((uint32_t) (v))
-
-#ifndef MG_OTA_ROLLBACK_TIMER_START
-#define MG_OTA_ROLLBACK_TIMER_START() mg_ota_esp32_timer_start()
-#endif
-
-#ifndef MG_OTA_ROLLBACK_TIMER_FEED
-#define MG_OTA_ROLLBACK_TIMER_FEED() \
-  do {                               \
-    (void) esp_task_wdt_reset();     \
-  } while (0)
-#endif
-
-#ifndef MG_OTA_ROLLBACK
-#define MG_OTA_ROLLBACK()                                  \
-  do {                                                     \
-    (void) esp_ota_mark_app_invalid_rollback_and_reboot(); \
-  } while (0)
 #endif
 
 #endif

src/arch_esp8266.h

@@ -1,26 +0,0 @@
-#pragma once
-
-#if MG_ARCH == MG_ARCH_ESP8266
-
-#include <ctype.h>
-#include <dirent.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <limits.h>
-#include <netdb.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <time.h>
-
-#include <esp_system.h>
-
-#define MG_PATH_MAX 128
-
-#endif

src/bsd.h

@@ -4,22 +4,91 @@
 #include "net_builtin.h"
 
 #if MG_ENABLE_BSD_SOCKETS
+void mg_bsd_init(struct mg_mgr *);
+void mg_bsd_poll(struct mg_mgr *);
 
-#ifndef MG_ENABLE_BSD_PROTOTYPES
-#include <arpa/inet.h>
 #include <errno.h>
 #include <fcntl.h>
-#include <netdb.h>
+
-#include <netinet/in.h>
+#ifndef EAGAIN
-#include <netinet/tcp.h>
+#define EAGAIN 11
-#include <poll.h>
+#endif
-#include <sys/select.h>
+#ifndef EWOULDBLOCK
-#include <sys/socket.h>
+#define EWOULDBLOCK EAGAIN
-#include <sys/time.h>
+#endif
-#include <sys/un.h>
+#ifndef EINPROGRESS
+#define EINPROGRESS 36
+#endif
+#ifndef ENOTCONN
+#define ENOTCONN 107
+#endif
+#ifndef ECONNREFUSED
+#define ECONNREFUSED 111
+#endif
+#ifndef ECONNRESET
+#define ECONNRESET 104
+#endif
+#ifndef EADDRINUSE
+#define EADDRINUSE 98
+#endif
+#ifndef ETIMEDOUT
+#define ETIMEDOUT 110
+#endif
+#ifndef EBADF
+#define EBADF 9
+#endif
+#ifndef EMFILE
+#define EMFILE 24
+#endif
+#ifndef ENOMEM
+#define ENOMEM 12
+#endif
+#ifndef EIO
+#define EIO 5
+#endif
+#ifndef EINVAL
+#define EINVAL 22
+#endif
+#ifndef EPERM
+#define EPERM 1
+#endif
+#ifndef EPIPE
+#define EPIPE 32
+#endif
+#ifndef EOPNOTSUPP
+#define EOPNOTSUPP 95
+#endif
+#ifndef EISCONN
+#define EISCONN 106
+#endif
+#ifndef EDESTADDRREQ
+#define EDESTADDRREQ 121
+#endif
+#ifndef EMSGSIZE
+#define EMSGSIZE 90
+#endif
+#ifndef EPROTONOSUPPORT
+#define EPROTONOSUPPORT 93
+#endif
+
+#if defined(__DCC__)
+#pragma pack(1)
 #else
-#include <errno.h>
+#pragma pack(push, 1)
+#endif
+struct mg_bsd_udp_frame {
+  uint32_t ip;
+  uint16_t port, len;
+};
+#if defined(__DCC__)
+#pragma pack(0)
+#else
+#pragma pack(pop)
+#endif
+
+#if MG_ENABLE_BSD_PROTOTYPES
 typedef unsigned int socklen_t;
+typedef unsigned long nfds_t;
 typedef uint32_t in_addr_t;
 struct in_addr { in_addr_t s_addr; };
 struct in6_addr { uint8_t s6_addr[16]; };
@@ -45,7 +114,6 @@ struct hostent {
   int h_length;
   char **h_addr_list;
 };
-#define h_addr h_addr_list[0]
 struct addrinfo {
   int ai_flags;
   int ai_family;
@@ -57,6 +125,32 @@ struct addrinfo {
   struct addrinfo *ai_next;
 };
 struct pollfd { int fd; short events; short revents; };
+
+#if !defined(FD_SET) && !defined(FD_ZERO) && !defined(FD_ISSET)
+#define MG_BSD_SELECT_H
+typedef unsigned long __fd_mask;
+#ifndef FD_SETSIZE
+#define FD_SETSIZE 64
+#endif
+#define _NFDBITS ((int) sizeof(__fd_mask) * 8)
+#define _howmany(x, y) (((x) + ((y) - 1)) / (y))
+typedef struct fd_set {
+  __fd_mask __fds_bits[_howmany(FD_SETSIZE, _NFDBITS)];
+} fd_set;
+#define __fdset_mask(n) ((__fd_mask) 1 << ((n) % _NFDBITS))
+#define FD_CLR(n, p) ((p)->__fds_bits[(n) / _NFDBITS] &= ~__fdset_mask(n))
+#define FD_ISSET(n, p) \
+  (((p)->__fds_bits[(n) / _NFDBITS] & __fdset_mask(n)) != 0)
+#define FD_SET(n, p) ((p)->__fds_bits[(n) / _NFDBITS] |= __fdset_mask(n))
+#define FD_ZERO(p)                                                     \
+  do {                                                                 \
+    fd_set *_p = (p);                                                  \
+    size_t _n = _howmany(FD_SETSIZE, _NFDBITS);                        \
+    while (_n > 0) _p->__fds_bits[--_n] = 0;                           \
+  } while (0)
+#endif
+
+#define h_addr h_addr_list[0]
 #define AF_INET 2
 #define AF_INET6 10
 #define AF_UNSPEC 0
@@ -69,6 +163,7 @@ struct pollfd { int fd; short events; short revents; };
 #define IPPROTO_UDP 17
 #define INADDR_ANY 0
 #define INADDR_LOOPBACK 0x7f000001
+#define INET_ADDRSTRLEN 16
 #define SOL_SOCKET 0xffff
 #define SO_REUSEADDR 2
 #define SO_REUSEPORT 15
@@ -77,79 +172,37 @@ struct pollfd { int fd; short events; short revents; };
 #define SO_BROADCAST 6
 #define SO_RCVBUF 8
 #define SO_SNDBUF 7
+#define SO_NOSIGPIPE 0x1022
 #define TCP_NODELAY 1
 #define MSG_DONTWAIT 0x40
 #define MSG_NOSIGNAL 0x4000
 #define MSG_PEEK 0x02
+#ifndef F_GETFL
 #define F_GETFL 3
+#endif
+#ifndef F_SETFL
 #define F_SETFL 4
-#define O_NONBLOCK 0x0004
+#endif
+#ifndef O_NONBLOCK
+#define O_NONBLOCK 0x4000
+#endif
 #define SHUT_RD 0
 #define SHUT_WR 1
 #define SHUT_RDWR 2
 #define AI_PASSIVE 0x0001
 #define NI_MAXHOST 1025
 #define NI_MAXSERV 32
-#ifndef EAGAIN
-#define EAGAIN 11
-#endif
-#ifndef EWOULDBLOCK
-#define EWOULDBLOCK EAGAIN
-#endif
-#ifndef EINPROGRESS
-#define EINPROGRESS 36
-#endif
-#ifndef ENOTCONN
-#define ENOTCONN 107
-#endif
-#ifndef ECONNREFUSED
-#define ECONNREFUSED 111
-#endif
-#ifndef ECONNRESET
-#define ECONNRESET 104
-#endif
-#ifndef EADDRINUSE
-#define EADDRINUSE 98
-#endif
-#ifndef ETIMEDOUT
-#define ETIMEDOUT 110
-#endif
 #define POLLIN 0x001
 #define POLLOUT 0x004
 #define POLLERR 0x008
 #define POLLHUP 0x010
 #define POLLNVAL 0x020
-uint16_t htons(uint16_t);
-uint16_t ntohs(uint16_t);
-uint32_t htonl(uint32_t);
-uint32_t ntohl(uint32_t);
-#endif  // MG_ENABLE_BSD_PROTOTYPES
 
-#define closesocket(a) close(a)
+#define htons(x) mg_ntohs(x)
+#define ntohs(x) mg_ntohs(x)
+#define htonl(x) mg_ntohl(x)
+#define ntohl(x) mg_ntohl(x)
 
-#ifndef MG_BSD_BACKLOG
-#define MG_BSD_BACKLOG 5
-#endif
-
-#ifndef MG_BSD_CONNECT_TIMEOUT_MS
-#define MG_BSD_CONNECT_TIMEOUT_MS 10000
-#endif
-
-// Mongoose-specific API
-void mg_bsd_init(void);  // must be called before socket()
-void mg_bsd_poll(struct mg_mgr *);  // process pending BSD commands
-
-// Transport backend: implement these OR define MG_ENABLE_FREERTOS for the built-in backend
-void *mg_bsd_transport_new(int domain, int type, int proto);
-void  mg_bsd_transport_free(void *t);
-int   mg_bsd_transport_listen(void *t, const struct sockaddr_in *addr);
-void *mg_bsd_transport_accept(void *t, struct sockaddr_in *peer, bool nonblock);
-ssize_t mg_bsd_transport_recv(void *t, void *buf, size_t len, bool nonblock);
-ssize_t mg_bsd_transport_send(void *t, const void *buf, size_t len, bool nonblock);
-int   mg_bsd_transport_connect(void *t, const struct sockaddr_in *addr, bool nonblock);
-void  mg_bsd_transport_close(void *t);
-
-// Standard BSD socket API
 int socket(int, int, int);
 int bind(int, const struct sockaddr *, socklen_t);
 int listen(int, int);
@@ -157,23 +210,40 @@ int accept(int, struct sockaddr *, socklen_t *);
 int connect(int, const struct sockaddr *, socklen_t);
 ssize_t send(int, const void *, size_t, int);
 ssize_t recv(int, void *, size_t, int);
-ssize_t sendto(int, const void *, size_t, int, const struct sockaddr *, socklen_t);
+ssize_t sendto(int, const void *, size_t, int, const struct sockaddr *,
+               socklen_t);
 ssize_t recvfrom(int, void *, size_t, int, struct sockaddr *, socklen_t *);
 int close(int);
 int shutdown(int, int);
-int fcntl(int, int, int);
 int setsockopt(int, int, int, const void *, socklen_t);
 int getsockopt(int, int, int, void *, socklen_t *);
 int getsockname(int, struct sockaddr *, socklen_t *);
 int getpeername(int, struct sockaddr *, socklen_t *);
 int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
-int poll(struct pollfd *, unsigned int, int);
+int poll(struct pollfd *, nfds_t, int);
 struct hostent *gethostbyname(const char *);
-int getaddrinfo(const char *, const char *, const struct addrinfo *, struct addrinfo **);
+int getaddrinfo(const char *, const char *, const struct addrinfo *,
+                struct addrinfo **);
 void freeaddrinfo(struct addrinfo *);
 int inet_pton(int, const char *, void *);
 const char *inet_ntop(int, const void *, char *, socklen_t);
 in_addr_t inet_addr(const char *);
 char *inet_ntoa(struct in_addr);
+#else
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <poll.h>
+#include <sys/select.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <unistd.h>
+#endif  // MG_ENABLE_BSD_PROTOTYPES
 
+#include <sys/time.h>
+
+#else
+#define mg_bsd_init(mgr)
+#define mg_bsd_poll(mgr)
 #endif  // MG_ENABLE_BSD_SOCKETS

src/config.h

@@ -223,10 +223,28 @@
 #define MG_ENABLE_TCPIP_PRINT_DEBUG_STATS 0
 #endif
 
+#ifndef MG_TLS_RECORD_SIZE
+#define MG_TLS_RECORD_SIZE 16384  // Max plaintext per sent TLS record, builtin
+#endif
+
 #ifndef MG_ENABLE_CHACHA20
 #define MG_ENABLE_CHACHA20 1  // When set to 0, GCM is used. For MG_TLS_BUILTIN
 #endif
 
+// P-256 implementation, for MG_TLS_BUILTIN
+#define MG_P256_LENNGREN 1  // Cortex-M4/M7/M33 asm, see tls_p256_cortex.c
+#define MG_P256_BEAR 3      // Portable C, BearSSL, see tls_p256.c
+
+#ifndef MG_P256
+#if defined(__GNUC__) && defined(__ARM_ARCH_PROFILE) && \
+    __ARM_ARCH_PROFILE == 'M' && defined(__ARM_FEATURE_DSP) && \
+    !defined(__ARM_BIG_ENDIAN)
+#define MG_P256 MG_P256_LENNGREN  // Cortex-M with DSP: M4, M7, M33, M55, M85
+#else
+#define MG_P256 MG_P256_BEAR
+#endif
+#endif
+
 #ifndef MG_ENABLE_HEALTH
 #define MG_ENABLE_HEALTH 0
 #endif

src/dash.c

@@ -533,21 +533,6 @@ static void mg_dash_handle_add(struct mg_connection *c, struct mg_dash *dash,
   }
 }
 
-// Firmware upload callback for mg_http_stream_body(). Uses *p as a flag:
-// non-NULL means an OTA session is open and must be closed by mg_ota_end()
-static bool otacb(struct mg_http_message *hm, struct mg_str *data, void **p) {
-  if (hm != NULL) {  // Start
-    if (!mg_ota_begin(hm->body.len)) return false;
-    *p = (void *) (ptrdiff_t) 1;
-    return true;
-  } else if (data != NULL) {  // Next chunk
-    return mg_ota_write(data->buf, data->len);
-  }
-  if (*p == NULL) return false;  // End. Begin failed, nothing to finish
-  *p = NULL;
-  return mg_ota_end();
-}
-
 static void mg_serve_fs(struct mg_connection *c, struct mg_http_message *hm,
                         struct mg_dash_user *u, bool stream) {
   struct mg_dash *dash = (struct mg_dash *) c->fn_data;
@@ -594,9 +579,9 @@ void mg_dash_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
       mg_serve_fs(c, hm, u, true);
       return;  // Important - the serve_fs() call can invalidate hm
     } else if (mg_match(hm->uri, mg_str("/api/ota"), NULL)) {
-      // Authenticated above. If streaming started, the stream handler owns
+      // Authenticated above. Streaming owns the connection and c->data.
-      // the connection and c->data, so skip the marker check below
+      mg_http_stream_body(c, hm, mg_http_ota_cb, NULL);
-      if (mg_http_stream_body(c, hm, otacb, NULL)) return;
+      return;
     }
     if (d->marker != '\0') mg_log_http_req(c, hm);
   } else if (ev == MG_EV_HTTP_MSG && d->marker != '\0') {

src/dns.c

@@ -263,14 +263,14 @@ static bool mg_dns_send(struct mg_connection *c, const struct mg_str *name,
 bool mg_dnsc_init(struct mg_mgr *mgr, struct mg_dns *dnsc);
 bool mg_dnsc_init(struct mg_mgr *mgr, struct mg_dns *dnsc) {
   if (dnsc->url == NULL) {
-    mg_error(0, "DNS server URL is NULL. Call mg_mgr_init()");
+    MG_ERROR(("DNS server URL is NULL. Call mg_mgr_init()"));
     return false;
   }
   if (dnsc->c == NULL) {
     dnsc->c = mg_connect(mgr, dnsc->url, NULL, NULL);
     if (dnsc->c == NULL) return false;
-    dnsc->c->pfn = dns_cb;
   }
+  dnsc->c->pfn = dns_cb; // do it always, DHCP-assigned DNS bootstrap needs it
   return true;
 }
 

src/drivers/mcxw71.c

@@ -0,0 +1,142 @@
+#include "net_builtin.h"
+
+#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_MCXW71) && \
+    MG_ENABLE_DRIVER_MCXW71
+
+// ZLL, 802.15.4 link layer. See MCXW71 reference manual and NXP
+// ieee_802_15_4 PHY sources: PhyPacketProcessor.c, PhyPlmeData.c, PhyISR.c
+struct mg_zll {
+  volatile uint32_t IRQSTS, PHY_CTRL, EVENT_TMR, TIMESTAMP, T1CMP, T2CMP,
+      T2PRIMECMP, T3CMP, T4CMP, PA_PWR, CHANNEL_NUM0, LQI_AND_RSSI,
+      MACSHORTADDRS0, MACLONGADDRS0_LSB, MACLONGADDRS0_MSB, RX_FRAME_FILTER,
+      CCA_LQI_CTRL, CCA2_CTRL, RESERVED_0, DSM_CTRL, RESERVED_1,
+      MACSHORTADDRS1, MACLONGADDRS1_LSB, MACLONGADDRS1_MSB, DUAL_PAN_CTRL,
+      CHANNEL_NUM1, SAM_CTRL, SAM_TABLE, SAM_MATCH, SAM_FREE_IDX,
+      SEQ_CTRL_STS, ACKDELAY, FILTERFAIL_CODE, RX_WTR_MARK, RESERVED_2,
+      SLOT_PRELOAD, SEQ_STATE, TMR_PRESCALE, LENIENCY_LSB, LENIENCY_MSB,
+      PART_ID, COEX_CTRL, COEX_PRIORITY, ENHACK_CTRL0;
+};
+
+// TrustZone: code built for the secure state (-mcmse) uses the secure alias
+// of the radio registers, 0x5xxxxxxx. Otherwise, the non-secure alias
+#if defined(__ARM_FEATURE_CMSE) && (__ARM_FEATURE_CMSE & 2)
+#define MGI_ZLL ((struct mg_zll *) 0x58A01000)
+#define MGI_PKT_RAM ((volatile uint8_t *) 0x58A08000)
+#else
+#define MGI_ZLL ((struct mg_zll *) 0x48A01000)
+#define MGI_PKT_RAM ((volatile uint8_t *) 0x48A08000)
+#endif
+
+#define MGI_TX_PB MGI_PKT_RAM           // Length byte (incl. FCS), then frame
+#define MGI_RX_PB (MGI_PKT_RAM + 0x80)  // Received frame, no length byte
+
+#define MGI_IRQSTS_SEQIRQ MG_BIT(0)
+#define MGI_IRQSTS_RXIRQ MG_BIT(2)
+#define MGI_IRQSTS_RX_LEN(x) (((x) >> 24) & 0x7f)  // Frame length incl. FCS
+#define MGI_PHY_CTRL_XCVSEQ 7U
+#define MGI_PHY_CTRL_ALL_IRQ_MASKS 0x8007ff00U  // Bits 8..18, 31: mask all IRQs
+#define MGI_SEQ_STATE_MASK 0x1fU
+#define MGI_SEQ_STATE_RX_WU 0x10U         // RX warm up
+#define MGI_SEQ_CTRL_NO_RX_RECYCLE MG_BIT(5)
+#define MGI_FRAME_FILTER 0x70bU  // Beacon, data, command; versions 0..2
+
+enum { MGI_SEQ_IDLE = 0, MGI_SEQ_RX = 1, MGI_SEQ_TX = 2 };  // PHY_CTRL[XCVSEQ]
+#define MGI_TX_TIMEOUT 400U  // Symbols, 16 us: 127 bytes
+
+// Symbol timer, 16 us, 24 bits
+static uint32_t mg_mcxw71_symbols(void) {
+  return MGI_ZLL->EVENT_TMR >> 8;
+}
+
+// Wait for the sequence to end, up to MGI_TX_TIMEOUT symbols
+static bool mg_mcxw71_wait(void) {
+  uint32_t start = mg_mcxw71_symbols();
+  while (((mg_mcxw71_symbols() - start) & 0xffffffU) < MGI_TX_TIMEOUT) {
+    if (MGI_ZLL->IRQSTS & MGI_IRQSTS_SEQIRQ) return true;
+  }
+  return false;
+}
+
+// Stop the current sequence, wait for the sequencer to go idle. See PhyAbort()
+static void mg_mcxw71_idle(void) {
+  if (MGI_ZLL->PHY_CTRL & MGI_PHY_CTRL_XCVSEQ) {
+    while ((MGI_ZLL->SEQ_STATE & MGI_SEQ_STATE_MASK) == MGI_SEQ_STATE_RX_WU)
+      (void) 0;
+    MGI_ZLL->PHY_CTRL &= ~MGI_PHY_CTRL_XCVSEQ;
+    while (MGI_ZLL->SEQ_STATE & MGI_SEQ_STATE_MASK) (void) 0;
+  }
+  MGI_ZLL->IRQSTS = MGI_ZLL->IRQSTS;  // Clear all flags, write 1 to clear
+}
+
+// Start a new sequence: MGI_SEQ_RX or MGI_SEQ_TX
+static void mg_mcxw71_start(uint32_t seq) {
+  MGI_ZLL->IRQSTS = MGI_ZLL->IRQSTS;
+  MGI_ZLL->PHY_CTRL |= seq;
+}
+
+static bool mg_mcxw71_init(struct mg_tcpip_if *ifp) {
+  struct mg_l2_802154_data *d =
+      (struct mg_l2_802154_data *) ifp->driver_data;
+  if (d == NULL || d->channel < 11 || d->channel > 26) {
+    MG_ERROR(("Set driver_data, channel 11..26"));
+    return false;
+  }
+  MGI_ZLL->SEQ_CTRL_STS |= MGI_SEQ_CTRL_NO_RX_RECYCLE;
+  MGI_ZLL->PHY_CTRL = MGI_PHY_CTRL_ALL_IRQ_MASKS;  // Mask all IRQs, we poll
+  MGI_ZLL->IRQSTS = MGI_ZLL->IRQSTS;
+  MGI_ZLL->SAM_CTRL = 0;
+  MGI_ZLL->RX_FRAME_FILTER = MGI_FRAME_FILTER;
+  MGI_ZLL->TMR_PRESCALE = 5;  // 16 us timebase, one symbol
+  MGI_ZLL->CHANNEL_NUM0 = d->channel;
+  MGI_ZLL->MACSHORTADDRS0 = (0xfffeU << 16) | d->pan_id;  // Filter by PAN ID
+  MGI_ZLL->PA_PWR = 0x3f;  // PA slices, max output power
+  mg_mcxw71_start(MGI_SEQ_RX);
+  return true;
+}
+
+// Send one radio frame: MAC header and payload, no FCS
+static size_t mg_mcxw71_send(const uint8_t *p, size_t len,
+                             struct mg_tcpip_if *ifp) {
+  size_t i;
+  bool ok;
+  mg_mcxw71_idle();
+  MGI_TX_PB[0] = (uint8_t) (len + 2);  // FCS is added by hardware
+  for (i = 0; i < len; i++) MGI_TX_PB[i + 1] = p[i];  // 8-bit access only
+  mg_mcxw71_start(MGI_SEQ_TX);
+  ok = mg_mcxw71_wait();
+  mg_mcxw71_idle();
+  mg_mcxw71_start(MGI_SEQ_RX);
+  (void) ifp;
+  return ok ? len : 0;
+}
+
+static size_t mg_mcxw71_tx(const void *buf, size_t len,
+                           struct mg_tcpip_if *ifp) {
+  return mg_l2_802154_tx(ifp, buf, len, mg_mcxw71_send);
+}
+
+static size_t mg_mcxw71_rx(void *buf, size_t len, struct mg_tcpip_if *ifp) {
+  uint32_t irqsts = MGI_ZLL->IRQSTS;
+  uint8_t f[125];
+  size_t i, n = 0;
+  if ((irqsts & MGI_IRQSTS_SEQIRQ) == 0) return 0;  // Still receiving
+  if (irqsts & MGI_IRQSTS_RXIRQ) {
+    n = MGI_IRQSTS_RX_LEN(irqsts);
+    n = n >= 2 ? n - 2 : 0;  // Strip FCS
+    if (n > sizeof(f)) n = sizeof(f);
+    for (i = 0; i < n; i++) f[i] = MGI_RX_PB[i];
+  }
+  mg_mcxw71_idle();
+  mg_mcxw71_start(MGI_SEQ_RX);
+  return mg_l2_802154_rx(ifp, f, n, buf, len);
+}
+
+static bool mg_mcxw71_poll(struct mg_tcpip_if *ifp, bool s1) {
+  (void) ifp, (void) s1;
+  return true;  // Radio link is always up
+}
+
+struct mg_tcpip_driver mg_tcpip_driver_mcxw71 = {mg_mcxw71_init, mg_mcxw71_tx,
+                                                 mg_mcxw71_rx, mg_mcxw71_poll};
+
+#endif

src/drivers/mcxw71.h

@@ -0,0 +1,25 @@
+#pragma once
+
+#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_MCXW71) && \
+    MG_ENABLE_DRIVER_MCXW71
+
+// NXP MCXW71 IEEE 802.15.4 radio, ZLL link layer, as an Ethernet interface:
+// Ethernet frames are split into radio frames, see mg_l2_802154_tx().
+// The transceiver (XCVR) must be set up for 802.15.4 before mg_tcpip_init(),
+// see hal_radio_init() in the FRDM-MCXW71 tutorial.
+// driver_data: struct mg_l2_802154_data, channel and PAN ID set
+
+#define MG_TCPIP_DRIVER_INIT(mgr)                                    \
+  do {                                                               \
+    static struct mg_l2_802154_data driver_data_;                  \
+    static struct mg_tcpip_if mif_;                                  \
+    driver_data_.channel = MG_L2_802154_CHANNEL;                   \
+    driver_data_.pan_id = MG_L2_802154_PAN_ID;                     \
+    mif_.driver = &mg_tcpip_driver_mcxw71;                           \
+    mif_.driver_data = &driver_data_;                                \
+    MG_SET_MAC_ADDRESS(mif_.mac);                                    \
+    mg_tcpip_init(mgr, &mif_);                                       \
+    MG_INFO(("Driver: mcxw71, channel %d", MG_L2_802154_CHANNEL)); \
+  } while (0)
+
+#endif

src/drivers/rw612_154.c

@@ -0,0 +1,450 @@
+#include "net_builtin.h"
+
+#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_RW612_154) && \
+    MG_ENABLE_DRIVER_RW612_154
+
+// The 802.15.4 radio runs NXP combo firmware on CPU2, an OpenThread RCP. We
+// are CPU3. Messages go through the IMU mailbox: IMU messages carry IMUMC
+// messages, IMUMC messages carry HDLC framed Spinel. See NXP sources:
+// mcuxsdk-core drivers/imu/fsl_imu.c, mcux-component
+// imu_adapter/fsl_adapter_imu.c, connectivity framework
+// platform/rw61x/fwk_platform_hdlc.c; OpenThread src/lib/spinel/spinel.h
+
+// IMU message FIFO registers, one block per direction. See fsl_imu.h
+struct mg_rw612_imu {
+  volatile uint32_t WR_MSG, RD_MSG, STATUS, CNTL, RD_MSG_DBG;
+};
+#define MGI_IMU ((struct mg_rw612_imu *) 0x443ff804)       // CPU3 -> CPU2
+#define MGI_IMU_PEER ((struct mg_rw612_imu *) 0x443ff818)  // CPU2 -> CPU3
+#define MGI_IMU_LOCKED MG_BIT(0)          // STATUS: FIFO locked
+#define MGI_IMU_ALMOST_FULL MG_BIT(1)     // STATUS: FIFO almost full
+#define MGI_IMU_EMPTY MG_BIT(3)           // STATUS: FIFO empty
+#define MGI_IMU_WR_PTR(s) (((s) >> 16) & 15U)
+#define MGI_IMU_INT_CLR MG_BIT(0)         // CNTL: clear message ready IRQ
+#define MGI_IMU_FLUSH MG_BIT(16)          // CNTL: flush send FIFO
+#define MGI_IMU_WAIT_FOR_ACK MG_BIT(17)   // CNTL: lock send FIFO
+#define MGI_IMU_WATERMARK(x) ((uint32_t) (x) << 20)
+#define MGI_IMU_WATERMARK_MASK (15U << 20)
+
+// IMU message: header, then payload words. See IMU_Msg_t
+struct mg_rw612_msg {
+  uint8_t type, subtype, seq, len;  // len: number of payload words
+  uint32_t payload[8];
+};
+
+// Mailbox in SMU2 shared memory, at the address CPU2 firmware expects
+struct mg_rw612_mbox {
+  uint32_t magic[2];             // Sync pattern: [0] CPU2, [1] us
+  struct mg_rw612_msg q[2][16];  // Message slots: [0] CPU2 -> us, [1] ours
+};
+#define MGI_MBOX ((volatile struct mg_rw612_mbox *) 0x443c0000)
+#define MGI_TXBUF 0x443c1508U  // Our IMUMC buffers: 16 x 264 bytes
+#define MGI_TXBUF_CNT 16
+#define MGI_TXBUF_LEN 264U
+#define MGI_SLEEP_FLAG (*(volatile uint32_t *) 0x443c2588)
+#define MGI_SYNC_MAGIC 0xabcdef89U
+
+// IMUMC message, carried in IMU payload words. See imumc_std_msg
+struct mg_rw612_imumc {
+  uint32_t src, dst;  // Endpoint addresses
+  uint16_t rfu, idx;  // Reserved
+  uint16_t len;       // Payload length, bytes
+  uint16_t flags;     // Message flags
+  uint32_t data;      // Payload buffer address
+};
+#define MGI_EPT_LOCAL 10   // Our 802.15.4 endpoint
+#define MGI_EPT_REMOTE 20  // Firmware 802.15.4 endpoint
+
+enum { MGI_MSG_CONTROL = 0, MGI_MSG_IMUMC = 8 };  // IMU message types
+enum {                                            // Control message subtypes
+  MGI_CTL_SYNC = 1,
+  MGI_CTL_SYNC_ACK = 2,
+  MGI_CTL_ACK_FOR_UNLOCK = 3,
+  MGI_CTL_CMD_BUF_ADDR = 6,
+  MGI_CTL_EPT_QUERY = 11,
+  MGI_CTL_EPT_QUERY_RSP = 12,
+  MGI_CTL_BUF_FREE = 13
+};
+
+// Spinel commands, properties and statuses we use
+enum { MGI_CMD_RESET = 1, MGI_CMD_GET = 2, MGI_CMD_SET = 3, MGI_CMD_IS = 6 };
+enum {
+  MGI_PROP_LAST_STATUS = 0,
+  MGI_PROP_NCP_VERSION = 2,
+  MGI_PROP_PHY_ENABLED = 0x20,
+  MGI_PROP_PHY_CHAN = 0x21,
+  MGI_PROP_PANID = 0x36,
+  MGI_PROP_RAW_STREAM = 0x37,
+  MGI_PROP_STREAM_RAW = 0x71
+};
+#define MGI_RESET_STACK 2         // RESET argument: reset the RCP stack only
+#define MGI_STATUS_RESET_MIN 112  // LAST_STATUS: RCP has reset
+#define MGI_STATUS_RESET_MAX 127
+#define MGI_TX_TIMEOUT_MS 200  // Wait for transmit done, incl. retries
+#define MGI_RSP_TIMEOUT_MS 500
+#define MGI_RXQ_CNT 16  // A whole Ethernet frame, 15 radio frames
+
+// Driver state, one radio
+struct mg_rw612 {
+  bool up;                  // IMU link synchronised
+  bool ept_ready;           // IMUMC endpoints connected
+  bool reset;               // RCP reported a reset
+  uint8_t seq;              // IMU message sequence number
+  uint16_t free_bufs;       // Free IMUMC buffers, bit per buffer
+  uint8_t hdlc[300];        // HDLC frame being received, unescaped
+  size_t hlen;              // Bytes in hdlc
+  bool esc;                 // Previous byte was an escape
+  uint8_t tid;              // Spinel transaction ID of the pending request
+  bool rsp;                 // Response to the pending request received
+  uint32_t rsp_status;      // Its status, if LAST_STATUS, else 0
+  char version[64];         // RCP version string
+  uint8_t rxq[MGI_RXQ_CNT][127];  // Received frames, no FCS
+  uint8_t rxlen[MGI_RXQ_CNT];     // Their lengths
+  uint8_t rxhead, rxtail;         // Queue indexes
+};
+static struct mg_rw612 s_rw612;
+
+static void mg_rw612_imu_send(uint8_t type, uint8_t subtype,
+                              const uint32_t *payload, uint8_t len) {
+  volatile struct mg_rw612_msg *m;
+  uint64_t expire = mg_millis() + 100;
+  uint8_t i;
+  while ((MGI_IMU->STATUS & (MGI_IMU_ALMOST_FULL | MGI_IMU_LOCKED)) &&
+         mg_millis() < expire) {
+    (void) 0;
+  }
+  m = &MGI_MBOX->q[1][MGI_IMU_WR_PTR(MGI_IMU->STATUS)];
+  m->type = type, m->subtype = subtype, m->seq = s_rw612.seq++, m->len = len;
+  for (i = 0; i < len; i++) m->payload[i] = payload[i];
+  MGI_IMU->WR_MSG = (uint32_t) (uintptr_t) m;
+}
+
+static void mg_rw612_control(uint8_t subtype, uint32_t a, uint32_t b,
+                             uint8_t len) {
+  uint32_t payload[2] = {a, b};
+  mg_rw612_imu_send(MGI_MSG_CONTROL, subtype, payload, len);
+}
+
+static void mg_rw612_queue_rx(const uint8_t *frame, size_t len) {
+  struct mg_rw612 *s = &s_rw612;
+  uint8_t next = (uint8_t) ((s->rxhead + 1) % MGI_RXQ_CNT);
+  if (next == s->rxtail || len > sizeof(s->rxq[0])) return;  // Full: drop
+  memcpy(s->rxq[s->rxhead], frame, len);
+  s->rxlen[s->rxhead] = (uint8_t) len;
+  s->rxhead = next;
+}
+
+// Spinel packed unsigned integer: 7 bits per byte, LSB first
+static size_t mg_rw612_unpack(const uint8_t *p, size_t len, uint32_t *v) {
+  size_t i;
+  *v = 0;
+  for (i = 0; i < len && i < 4; i++) {
+    *v |= (uint32_t) (p[i] & 0x7f) << (7 * i);
+    if ((p[i] & 0x80) == 0) return i + 1;
+  }
+  return 0;
+}
+
+// Handle a received Spinel frame: header, command, property, value
+static void mg_rw612_spinel(const uint8_t *f, size_t len) {
+  struct mg_rw612 *s = &s_rw612;
+  uint32_t cmd, prop, status = 0;
+  size_t n, ofs = 1;
+  uint8_t tid = f[0] & 15;
+  if (len < 3 || (n = mg_rw612_unpack(f + ofs, len - ofs, &cmd)) == 0) return;
+  ofs += n;
+  if ((n = mg_rw612_unpack(f + ofs, len - ofs, &prop)) == 0) return;
+  ofs += n;
+  if (cmd != MGI_CMD_IS) return;
+  if (prop == MGI_PROP_STREAM_RAW && tid == 0 && len - ofs >= 2) {
+    size_t flen = (size_t) (f[ofs] | (f[ofs + 1] << 8));  // Incl. FCS
+    if (flen >= 2 && ofs + 2 + flen <= len) {
+      mg_rw612_queue_rx(f + ofs + 2, flen - 2);
+    }
+  } else if (prop == MGI_PROP_LAST_STATUS) {
+    mg_rw612_unpack(f + ofs, len - ofs, &status);
+    if (tid == 0 && status >= MGI_STATUS_RESET_MIN &&
+        status <= MGI_STATUS_RESET_MAX) {
+      s->reset = true;
+    }
+  } else if (prop == MGI_PROP_NCP_VERSION) {
+    n = len - ofs < sizeof(s->version) - 1 ? len - ofs : sizeof(s->version) - 1;
+    memcpy(s->version, f + ofs, n);
+    s->version[n] = '\0';
+  }
+  if (tid != 0 && tid == s->tid) s->rsp = true, s->rsp_status = status;
+}
+
+// HDLC-lite: 0x7e delimits frames, 0x7d escapes, FCS-16 at the end
+static uint16_t mg_rw612_fcs(uint16_t fcs, uint8_t c) {
+  int i;
+  fcs ^= c;
+  for (i = 0; i < 8; i++) fcs = (fcs & 1) ? (fcs >> 1) ^ 0x8408 : fcs >> 1;
+  return fcs;
+}
+
+static void mg_rw612_hdlc_rx(const uint8_t *p, size_t len) {
+  struct mg_rw612 *s = &s_rw612;
+  size_t i, j;
+  for (i = 0; i < len; i++) {
+    uint8_t c = p[i];
+    if (c == 0x7e) {
+      if (s->hlen >= 3) {
+        uint16_t fcs = 0xffff;
+        for (j = 0; j < s->hlen; j++) fcs = mg_rw612_fcs(fcs, s->hdlc[j]);
+        if (fcs == 0xf0b8) mg_rw612_spinel(s->hdlc, s->hlen - 2);
+      }
+      s->hlen = 0, s->esc = false;
+    } else if (c == 0x7d) {
+      s->esc = true;
+    } else if (s->hlen < sizeof(s->hdlc)) {
+      s->hdlc[s->hlen++] = s->esc ? c ^ 0x20 : c;
+      s->esc = false;
+    }
+  }
+}
+
+static void mg_rw612_control_rx(volatile struct mg_rw612_msg *m) {
+  struct mg_rw612 *s = &s_rw612;
+  switch (m->subtype) {
+    case MGI_CTL_ACK_FOR_UNLOCK:
+      MGI_IMU->CNTL &= ~MGI_IMU_WAIT_FOR_ACK;
+      break;
+    case MGI_CTL_SYNC:  // As HAL_ImuCtrlHandler(): acknowledge twice
+      mg_rw612_control(MGI_CTL_SYNC_ACK, 0, 0, 0);
+      mg_rw612_control(MGI_CTL_SYNC_ACK, 0, 0, 0);
+      s->up = true;
+      break;
+    case MGI_CTL_SYNC_ACK:
+    case MGI_CTL_CMD_BUF_ADDR:
+      s->up = true;
+      break;
+    case MGI_CTL_EPT_QUERY: {  // Firmware asks if our endpoint exists
+      bool ours = m->payload[0] == MGI_EPT_LOCAL;
+      mg_rw612_control(MGI_CTL_EPT_QUERY_RSP, m->payload[0], ours, 2);
+      if (ours) s->ept_ready = true;
+      break;
+    }
+    case MGI_CTL_EPT_QUERY_RSP:
+      if (m->payload[0] == MGI_EPT_REMOTE && m->payload[1] != 0) {
+        s->ept_ready = true;
+      }
+      break;
+    case MGI_CTL_BUF_FREE: {  // Firmware is done with one of our buffers
+      uint32_t i = (m->payload[0] - MGI_TXBUF) / MGI_TXBUF_LEN;
+      if (i < MGI_TXBUF_CNT) s->free_bufs |= (uint16_t) MG_BIT(i);
+      break;
+    }
+    default:
+      break;
+  }
+}
+
+// Process all received IMU messages. See HAL_ImuReceive()
+static void mg_rw612_poll_imu(void) {
+  bool unlock = false;
+  while ((MGI_IMU_PEER->STATUS & MGI_IMU_EMPTY) == 0) {
+    struct mg_rw612_msg m;
+    volatile struct mg_rw612_msg *p;
+    uint8_t i;
+    MGI_SLEEP_FLAG &= ~1U;
+    p = (volatile struct mg_rw612_msg *) (uintptr_t) MGI_IMU->RD_MSG;
+    if (MGI_IMU_PEER->STATUS & MGI_IMU_LOCKED) unlock = true;
+    if (p == NULL) continue;
+    m.type = p->type, m.subtype = p->subtype, m.len = p->len;
+    for (i = 0; i < 8; i++) m.payload[i] = p->payload[i];
+    if (m.type == MGI_MSG_CONTROL) {
+      mg_rw612_control_rx(&m);
+    } else if (m.type == MGI_MSG_IMUMC) {
+      struct mg_rw612_imumc im;
+      memcpy(&im, m.payload, sizeof(im));
+      if (im.dst == MGI_EPT_LOCAL) {
+        mg_rw612_hdlc_rx((const uint8_t *) (uintptr_t) im.data, im.len);
+      }
+      mg_rw612_control(MGI_CTL_BUF_FREE, im.data, 0, 1);
+    }
+  }
+  MGI_IMU->CNTL |= MGI_IMU_INT_CLR;
+  MGI_SLEEP_FLAG |= 1U;
+  if (unlock) mg_rw612_control(MGI_CTL_ACK_FOR_UNLOCK, 0, 0, 0);
+}
+
+// Send bytes to the firmware endpoint, in IMUMC buffer sized chunks
+static bool mg_rw612_imumc_send(const uint8_t *p, size_t len) {
+  struct mg_rw612 *s = &s_rw612;
+  while (len > 0) {
+    size_t n = len < MGI_TXBUF_LEN ? len : MGI_TXBUF_LEN;
+    uint64_t expire = mg_millis() + 100;
+    struct mg_rw612_imumc im;
+    uint32_t i;
+    while (s->free_bufs == 0) {
+      mg_rw612_poll_imu();
+      if (mg_millis() > expire) return false;
+    }
+    for (i = 0; (s->free_bufs & MG_BIT(i)) == 0; i++) (void) 0;
+    s->free_bufs &= (uint16_t) ~MG_BIT(i);
+    memset(&im, 0, sizeof(im));
+    im.src = MGI_EPT_LOCAL, im.dst = MGI_EPT_REMOTE, im.len = (uint16_t) n;
+    im.data = MGI_TXBUF + i * MGI_TXBUF_LEN;
+    memcpy((void *) (uintptr_t) im.data, p, n);
+    mg_rw612_imu_send(MGI_MSG_IMUMC, 0, (uint32_t *) &im, sizeof(im) / 4);
+    p += n, len -= n;
+  }
+  return true;
+}
+
+// Send a Spinel frame, HDLC encoded, and wait for the response with the
+// same transaction ID. Return false on timeout
+static bool mg_rw612_request(uint8_t *f, size_t len, uint32_t timeout_ms) {
+  struct mg_rw612 *s = &s_rw612;
+  uint8_t buf[2 * 160 + 6];
+  uint16_t fcs = 0xffff;
+  size_t i, n = 0;
+  uint64_t expire = mg_millis() + timeout_ms;
+  s->tid = (uint8_t) (s->tid % 15 + 1);
+  f[0] = (uint8_t) (0x80 | s->tid);  // Header: flag, interface 0, TID
+  s->rsp = false;
+  buf[n++] = 0x7e;
+  for (i = 0; i < len + 2 && n + 3 < sizeof(buf); i++) {
+    uint8_t c;
+    if (i < len) {
+      c = f[i], fcs = mg_rw612_fcs(fcs, c);
+    } else {
+      c = (uint8_t) (i == len ? ~fcs & 0xff : ~fcs >> 8);
+    }
+    if (c == 0x7e || c == 0x7d || c == 0x11 || c == 0x13 || c == 0xf8) {
+      buf[n++] = 0x7d, c ^= 0x20;
+    }
+    buf[n++] = c;
+  }
+  buf[n++] = 0x7e;
+  if (!mg_rw612_imumc_send(buf, n)) return false;
+  while (!s->rsp && mg_millis() < expire) mg_rw612_poll_imu();
+  return s->rsp;
+}
+
+static bool mg_rw612_set(uint32_t prop, const uint8_t *val, size_t len) {
+  uint8_t f[16];
+  if (len > sizeof(f) - 3) return false;
+  f[1] = MGI_CMD_SET, f[2] = (uint8_t) prop;  // Properties used are < 0x80
+  memcpy(f + 3, val, len);
+  return mg_rw612_request(f, len + 3, MGI_RSP_TIMEOUT_MS) &&
+         s_rw612.rsp_status == 0;
+}
+
+// Log an init error, return false
+static bool mg_rw612_fail(const char *msg) {
+  MG_ERROR(("%s", msg));
+  return false;
+}
+
+static bool mg_rw612_154_init(struct mg_tcpip_if *ifp) {
+  struct mg_rw612 *s = &s_rw612;
+  struct mg_l2_802154_data *d =
+      (struct mg_l2_802154_data *) ifp->driver_data;
+  uint8_t f[8], one = 1, pan[2];
+  uint64_t expire;
+  if (d == NULL || d->channel < 11 || d->channel > 26) {
+    MG_ERROR(("Set driver_data, channel 11..26"));
+    return false;
+  }
+  if (MGI_MBOX->magic[0] != MGI_SYNC_MAGIC) {
+    MG_ERROR(("Radio firmware is not running on CPU2"));
+    return false;
+  }
+  memset(s, 0, sizeof(*s));
+  s->free_bufs = 0xffff;
+  // Reset our send FIFO, drop stale messages. See IMU_Init()
+  MGI_IMU->CNTL |= MGI_IMU_FLUSH;
+  MGI_IMU->CNTL &= ~(MGI_IMU_FLUSH | MGI_IMU_WAIT_FOR_ACK);
+  MGI_IMU->CNTL = (MGI_IMU->CNTL & ~MGI_IMU_WATERMARK_MASK) |
+                  MGI_IMU_WATERMARK(15);
+  while ((MGI_IMU_PEER->STATUS & MGI_IMU_EMPTY) == 0) (void) MGI_IMU->RD_MSG;
+  // Synchronise the IMU link, then connect the IMUMC endpoints
+  MGI_MBOX->magic[1] = MGI_SYNC_MAGIC;
+  mg_rw612_control(MGI_CTL_SYNC, 0, 0, 0);
+  expire = mg_millis() + 1000;
+  while (!s->up && mg_millis() < expire) mg_rw612_poll_imu();
+  if (!s->up) return mg_rw612_fail("IMU sync timeout");
+  expire = mg_millis() + 2000;
+  while (!s->ept_ready && mg_millis() < expire) {
+    uint64_t retry = mg_millis() + 100;
+    mg_rw612_control(MGI_CTL_EPT_QUERY, MGI_EPT_REMOTE, 0, 1);
+    while (!s->ept_ready && mg_millis() < retry) mg_rw612_poll_imu();
+  }
+  if (!s->ept_ready) return mg_rw612_fail("IMUMC endpoint timeout");
+  // Reset the RCP stack, wait for its reset status, read its version
+  f[1] = MGI_CMD_RESET, f[2] = MGI_RESET_STACK;
+  mg_rw612_request(f, 3, MGI_RSP_TIMEOUT_MS);
+  expire = mg_millis() + 1000;
+  while (!s->reset && mg_millis() < expire) mg_rw612_poll_imu();
+  if (!s->reset) return mg_rw612_fail("RCP reset timeout");
+  f[1] = MGI_CMD_GET, f[2] = MGI_PROP_NCP_VERSION;
+  mg_rw612_request(f, 3, MGI_RSP_TIMEOUT_MS);
+  MG_INFO(("RCP: %s", s->version));
+  if (!mg_rw612_set(MGI_PROP_PHY_ENABLED, &one, 1)) {
+    return mg_rw612_fail("PHY enable failed");
+  }
+  pan[0] = (uint8_t) d->pan_id, pan[1] = (uint8_t) (d->pan_id >> 8);
+  if (!mg_rw612_set(MGI_PROP_PHY_CHAN, &d->channel, 1) ||
+      !mg_rw612_set(MGI_PROP_PANID, pan, 2)) {
+    return mg_rw612_fail("Channel or PAN ID set failed");
+  }
+  if (!mg_rw612_set(MGI_PROP_RAW_STREAM, &one, 1)) {
+    return mg_rw612_fail("Raw stream enable failed");
+  }
+  return true;
+}
+
+// Send one radio frame: MAC header and payload, no FCS
+static size_t mg_rw612_send(const uint8_t *p, size_t len,
+                            struct mg_tcpip_if *ifp) {
+  struct mg_l2_802154_data *d =
+      (struct mg_l2_802154_data *) ifp->driver_data;
+  uint8_t f[3 + 2 + 127 + 4];
+  size_t n = 3;
+  f[1] = MGI_CMD_SET, f[2] = MGI_PROP_STREAM_RAW;
+  f[n++] = (uint8_t) (len + 2), f[n++] = 0;  // PSDU length, incl. FCS
+  memcpy(f + n, p, len), n += len;
+  f[n++] = 0, f[n++] = 0;  // FCS, filled in by the radio
+  f[n++] = d->channel;
+  f[n++] = 4;  // Max CSMA backoffs
+  f[n++] = 0;  // Max frame retries: broadcast frames are not acknowledged
+  f[n++] = 1;  // CSMA-CA enabled
+  if (!mg_rw612_request(f, n, MGI_TX_TIMEOUT_MS)) {
+    MG_ERROR(("TX timeout"));
+    return 0;
+  }
+  if (s_rw612.rsp_status != 0) {
+    MG_VERBOSE(("TX failed, status %lu", (unsigned long) s_rw612.rsp_status));
+    return 0;
+  }
+  return len;
+}
+
+static size_t mg_rw612_154_tx(const void *buf, size_t len,
+                              struct mg_tcpip_if *ifp) {
+  return mg_l2_802154_tx(ifp, buf, len, mg_rw612_send);
+}
+
+static size_t mg_rw612_154_rx(void *buf, size_t len, struct mg_tcpip_if *ifp) {
+  struct mg_rw612 *s = &s_rw612;
+  size_t res = 0;
+  mg_rw612_poll_imu();
+  while (s->rxtail != s->rxhead && res == 0) {
+    res = mg_l2_802154_rx(ifp, s->rxq[s->rxtail], s->rxlen[s->rxtail], buf,
+                          len);
+    s->rxtail = (uint8_t) ((s->rxtail + 1) % MGI_RXQ_CNT);
+  }
+  return res;
+}
+
+static bool mg_rw612_154_poll(struct mg_tcpip_if *ifp, bool s1) {
+  (void) ifp, (void) s1;
+  return s_rw612.up;
+}
+
+struct mg_tcpip_driver mg_tcpip_driver_rw612_154 = {
+    mg_rw612_154_init, mg_rw612_154_tx, mg_rw612_154_rx, mg_rw612_154_poll};
+
+#endif

src/drivers/rw612_154.h

@@ -0,0 +1,29 @@
+#pragma once
+
+#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_RW612_154) && \
+    MG_ENABLE_DRIVER_RW612_154
+
+// NXP RW612 IEEE 802.15.4 radio, as an Ethernet interface: Ethernet frames
+// are split into radio frames, see mg_l2_802154_tx(). The radio runs on
+// CPU2: NXP BLE/802.15.4 combo firmware, an OpenThread radio co-processor
+// (RCP). The firmware must be loaded and running before mg_tcpip_init(), see
+// the FRDM-RW612 eth_radio_bridge tutorial. The driver talks to it over the
+// CPU2 <-> CPU3 IMU mailbox: IMUMC messages carrying HDLC framed Spinel.
+// driver_data: struct mg_l2_802154_data, channel and PAN ID set
+
+#ifndef MG_TCPIP_DRIVER_INIT
+#define MG_TCPIP_DRIVER_INIT(mgr)                                       \
+  do {                                                                  \
+    static struct mg_l2_802154_data driver_data_;                     \
+    static struct mg_tcpip_if mif_;                                     \
+    driver_data_.channel = MG_L2_802154_CHANNEL;                      \
+    driver_data_.pan_id = MG_L2_802154_PAN_ID;                        \
+    mif_.driver = &mg_tcpip_driver_rw612_154;                           \
+    mif_.driver_data = &driver_data_;                                   \
+    MG_SET_MAC_ADDRESS(mif_.mac);                                       \
+    mg_tcpip_init(mgr, &mif_);                                          \
+    MG_INFO(("Driver: rw612_154, channel %d", MG_L2_802154_CHANNEL)); \
+  } while (0)
+#endif
+
+#endif

src/drivers/st67w6.c

@@ -365,7 +365,7 @@ static bool st67w6_init(uint8_t *mac) {
   }
   // set clock, who cares ???
   if (!st67w6_at_cmd("AT+GET_CLOCK\r\n", 14)) return false;
-  MG_DEBUG(("%.*s", s_at_resp_len, at_resp));  // TODO(scaprile): --> VERBOSE
+  MG_VERBOSE(("%.*s", s_at_resp_len, at_resp));
   // BT-ENABLED DEPENDENCY
 
   // MODULE DEPENDENCY

src/drivers/stm32h.c

@@ -2,6 +2,7 @@
 
 #if MG_ENABLE_TCPIP && (MG_ENABLE_DRIVER_STM32H || MG_ENABLE_DRIVER_MCXN || \
                         MG_ENABLE_DRIVER_STM32N)
+// STM32C: vendor modded single-queue Synopsys v5.4, same settings as STM32H
 // STM32H: vendor modded single-queue Synopsys v4.2
 // STM32N: dual-queue GbE Synopsys v5.2 with no hash table option, 64-bit AXI
 // MCXNx4x: dual-queue Synopsys v5.2 with no hash table option
@@ -310,7 +311,7 @@ static uint32_t s_rxno;
 #if MG_ENABLE_DRIVER_MCXN
 void ETHERNET_IRQHandler(void);
 void ETHERNET_IRQHandler(void) {
-#elif MG_ENABLE_DRIVER_STM32H
+#elif MG_ENABLE_DRIVER_STM32H && !MG_ENABLE_DRIVER_STM32C
 void ETH_IRQHandler(void);
 void ETH_IRQHandler(void) {
 #else
@@ -339,8 +340,10 @@ void ETH1_IRQHandler(void) {
   }
   ETH->DMACSR =
       MG_BIT(7) | MG_BIT(8);  // Clear possible RBU RPS while processing
-  ETH->DMACRDTPR =
+  // Resume RX: tail is the last descriptor given back to DMA. It must differ
-      (uint32_t) (uintptr_t) &s_rxdesc[ETH_DESC_CNT - 1];  // and resume RX
+  // from the DMA current descriptor, or some DMAs, e.g. STM32C5, stay suspended
+  ETH->DMACRDTPR = (uint32_t) (uintptr_t) &s_rxdesc[(s_rxno + ETH_DESC_CNT - 1) %
+                                                    ETH_DESC_CNT];
 }
 
 struct mg_tcpip_driver mg_tcpip_driver_stm32h = {

src/drivers/stm32h.h

@@ -4,6 +4,13 @@
 #if !defined(MG_ENABLE_DRIVER_STM32H)
 #define MG_ENABLE_DRIVER_STM32H 0
 #endif
+#if !defined(MG_ENABLE_DRIVER_STM32C)
+#define MG_ENABLE_DRIVER_STM32C 0
+#endif
+#if MG_ENABLE_DRIVER_STM32C  // STM32C5: STM32H5 MAC, the IRQ is ETH1
+#undef MG_ENABLE_DRIVER_STM32H
+#define MG_ENABLE_DRIVER_STM32H 1
+#endif
 #if !defined(MG_ENABLE_DRIVER_MCXN)
 #define MG_ENABLE_DRIVER_MCXN 0
 #endif
@@ -43,9 +50,11 @@ struct mg_tcpip_driver_stm32h_data {
 #define MG_DRIVER_MDC_CR 4
 #endif
 
-#if MG_ENABLE_DRIVER_STM32H && MG_ARCH == MG_ARCH_CUBE && !defined(MG_ENABLE_ETH_IRQ)
+#if MG_ENABLE_DRIVER_STM32H && !MG_ENABLE_DRIVER_STM32C && \
+    MG_ARCH == MG_ARCH_CUBE && !defined(MG_ENABLE_ETH_IRQ)
 #define MG_ENABLE_ETH_IRQ() NVIC_EnableIRQ(ETH_IRQn)
-#elif MG_ENABLE_DRIVER_STM32N && MG_ARCH == MG_ARCH_CUBE && !defined(MG_ENABLE_ETH_IRQ)
+#elif (MG_ENABLE_DRIVER_STM32N || MG_ENABLE_DRIVER_STM32C) && \
+    MG_ARCH == MG_ARCH_CUBE && !defined(MG_ENABLE_ETH_IRQ)
 #define MG_ENABLE_ETH_IRQ() NVIC_EnableIRQ(ETH1_IRQn)
 #elif !defined(MG_ENABLE_ETH_IRQ)
 #define MG_ENABLE_ETH_IRQ()

src/flash.c

@@ -4,7 +4,7 @@
 #include "ota.h"
 #ifdef MG_OTA_PUBLIC_KEY
 #include "sha256.h"
-#include "tls_uecc.h"
+#include "tls_p256.h"
 #endif
 
 #if MG_OTA != MG_OTA_NONE && MG_OTA != MG_OTA_CUSTOM
@@ -76,9 +76,8 @@ bool mg_ota_flash_end(struct mg_flash *flash) {
         uint8_t hash[32];
         size_t fw_size = s_size - 68;  // strip 64-byte sig + 4-byte magic
         mg_sha256(hash, (uint8_t *) base, fw_size);
-        ok = mg_uecc_verify(s_pubkey, hash, sizeof(hash),
+        ok = mg_p256_verify(s_pubkey, hash, sizeof(hash),
-                            (uint8_t *) base + fw_size,
+                            (uint8_t *) base + fw_size) == 1;
-                            mg_uecc_secp256r1()) == 1;
         MG_INFO(("Signature: %s", ok ? "ok" : "fail"));
       } else {
         ok = false;

src/health.c

@@ -6,19 +6,19 @@
 struct mg_health mg_health_record MG_HEALTH_RAM;
 
 // STM32 H723 support. Needs the _estack symbol from the linker script
-#if MG_ENABLE_HEALTH && defined(STM32H723xx_H)
+#if MG_ENABLE_HEALTH && (defined(STM32H7_DEV_ID) || defined(STM32H5) || defined(STM32C5))
 // Fault handler body. Runs in exception context: no printf, no malloc, no
 // blocking calls. Copies the unwind registers and raw stack into the health
 // record, then resets.
 // "used" keeps the linker from garbage-collecting this section: the only
 // reference is the "b fault_c" branch in the naked handler below
 __attribute__((used, noinline)) static void fault_c(uint32_t *frame,
-                                                     uint32_t exc_return) {
+                                                    uint32_t exc_return) {
   extern uint32_t _estack;
   uint32_t *stack = frame + 8 + ((exc_return & (1U << 4)) ? 0 : 18);
   uint32_t *r = mg_health_record.data;
 
-  if (frame[7] & (1U << 9)) stack++;  // Eight-byte stack alignment padding
+  if (frame[7] & (1U << 9)) stack++;    // Eight-byte stack alignment padding
   r[0] = (uint32_t) (uintptr_t) stack;  // SP
   r[1] = frame[5];                      // LR
   r[2] = frame[6];                      // PC
@@ -48,6 +48,54 @@ void BusFault_Handler(void) __attribute__((alias("HardFault_Handler")));
 void UsageFault_Handler(void) __attribute__((alias("HardFault_Handler")));
 #endif
 
+// Start a new boot: validate the record, count the boot, store the reset
+// reason. The current boot moves to prev_* slots first, so the previous
+// boot's uptime and reason stay readable. Called by MG_HEALTH_INIT()
+void mg_health_init(void) {
+  char magic[] = MG_HEALTH_MAGIC;
+  // struct mg_health *h = mg_health_get();
+  if (!mg_health_valid()) {  // First boot, or RAM lost its contents
+    memset(&mg_health_record, 0, sizeof(mg_health_record));
+    memcpy(mg_health_record.magic, magic, sizeof(mg_health_record.magic));
+  }
+
+#if 0 && MG_ARCH == MG_ARCH_ESP32 && CONFIG_ESP_COREDUMP_ENABLE_TO_FLASH
+  {
+    // After a crash, copy the backtrace from the core dump in flash: the same
+    // addresses the panic handler prints as "Backtrace: PC:SP PC:SP ...".
+    // The core dump stays in flash, so check the reset reason, otherwise an
+    // old crash is reported on every boot
+    static esp_core_dump_summary_t s;  // Big on RISC-V, keep it off the stack
+    esp_reset_reason_t rr = esp_reset_reason();
+    uint32_t *out = mg_health_record.data;
+    size_t n = 0, max = MG_HEALTH_DATA_SIZE;
+    if (rr != ESP_RST_PANIC && rr != ESP_RST_INT_WDT && rr != ESP_RST_TASK_WDT)
+      return;  // Not a crash that went through the panic handler
+    if (max == 0 || esp_core_dump_get_summary(&s) != ESP_OK) return;
+
+    mg_health_record.cpuid = 42;  // ESP32
+    mg_health_record.reset_reason = MG_HEALTH_RESET_FAULT;
+
+    memset(out, 0, sizeof(mg_health_record.data));
+    out[n++] = s.exc_pc;
+#if CONFIG_IDF_TARGET_ARCH_XTENSA
+    for (uint32_t i = 0; i < s.exc_bt_info.depth && n < max; i++) {
+      if (s.exc_bt_info.bt[i] != s.exc_pc) out[n++] = s.exc_bt_info.bt[i];
+    }
+#elif CONFIG_IDF_TARGET_ARCH_RISCV
+    // No unwinder: take the return address, then words on the stack that
+    // point into executable memory (a heuristic, may include stale values)
+    if (n < max) out[n++] = s.ex_info.ra;
+    for (uint32_t i = 0; i + 4 <= s.exc_bt_info.dump_size && n < max; i += 4) {
+      uint32_t w;
+      memcpy(&w, &s.exc_bt_info.stackdump[i], sizeof(w));  // Byte array
+      if (esp_ptr_executable((void *) (uintptr_t) w)) out[n++] = w;
+    }
+#endif
+  }
+#endif
+}
+
 static size_t print_uint32(void (*fn)(char, void *), void *arg, va_list *ap) {
   size_t n = va_arg(*ap, size_t);
   uint32_t *p = va_arg(*ap, uint32_t *);

src/health.h

@@ -9,6 +9,18 @@
 #define MG_HEALTH_MAGIC {'M', 'G', 'H', '3'}  // '3' is the layout version
 #endif
 
+#if !defined(MG_HEALTH_RAM) && (defined(STM32H7_DEV_ID) || defined(STM32H5) || defined(STM32C5))
+#define MG_HEALTH_RAM __attribute__((section(".mg_health")))
+#endif
+
+#if !defined(MG_HEALTH_DATA_SIZE) && (defined(STM32H7_DEV_ID) || defined(STM32H5) || defined(STM32C5))
+#define MG_HEALTH_DATA_SIZE 250
+#endif
+
+#ifndef MG_HEALTH_DATA_SIZE
+#define MG_HEALTH_DATA_SIZE 10
+#endif
+
 // Places the record in RAM that survives a reset. Define in mongoose_config.h
 // to match the linker script, e.g. __attribute__((section(".mg_health")))
 #ifndef MG_HEALTH_RAM
@@ -29,10 +41,6 @@ enum mg_health_reason {
   MG_HEALTH_RESET_FAULT         // Fault handler ran, see regs[] and saved_stack
 };
 
-#ifndef MG_HEALTH_DATA_SIZE
-#define MG_HEALTH_DATA_SIZE 20
-#endif
-
 struct mg_health {
   char magic[4];          // MG_HEALTH_MAGIC when the record holds valid data
   uint32_t reset_reason;  // enum mg_health_reason that started this boot
@@ -68,17 +76,6 @@ static inline const char *mg_health_reason_str(int reason) {
   }
 }
 
-// Start a new boot: validate the record, count the boot, store the reset
-// reason. The current boot moves to prev_* slots first, so the previous
-// boot's uptime and reason stay readable. Called by MG_HEALTH_INIT()
-static inline void mg_health_init(void) {
-  char magic[] = MG_HEALTH_MAGIC;
-  // struct mg_health *h = mg_health_get();
-  if (!mg_health_valid()) {  // First boot, or RAM lost its contents
-    memset(&mg_health_record, 0, sizeof(mg_health_record));
-    memcpy(mg_health_record.magic, magic, sizeof(mg_health_record.magic));
-  }
-}
-
 #define MG_HEALTH_INIT() mg_health_init()
 extern size_t mg_print_crash_record(mg_pfn_t, void *, va_list *);
+extern void mg_health_init(void);

src/http.c

@@ -879,8 +879,8 @@ void mg_http_serve_upload(struct mg_connection *c, struct mg_http_message *hm,
     fs->rm(path);  // MG_FS_WRITE appends, not truncates: drop any old file
     if ((fd = mg_fs_open(fs, path, MG_FS_WRITE)) == NULL) {
       MG_ERROR(("Cannot open %s for upload", path));
-    } else if (!mg_http_stream_body(c, hm, serve_upload_cb, fd)) {
+    } else {
-      mg_fs_close(fd);
+      mg_http_stream_body(c, hm, serve_upload_cb, fd);
     }
   }
 }
@@ -1014,6 +1014,7 @@ struct mg_upload_state {
   size_t received;  // Number of body bytes received so far
   void *user_data;  // Passed to cb, free for cb to use
   bool failed;      // Set when cb returned false
+  bool finished;    // End callback has been called
 };
 
 // Event handler installed by mg_http_stream_body(). Feeds the body to the
@@ -1021,18 +1022,18 @@ struct mg_upload_state {
 // handler: the connection is closed after the reply.
 static void mg_stream_handler(struct mg_connection *c, int ev, void *ev_data) {
   struct mg_upload_state *us = (struct mg_upload_state *) c->data;
-    bool (*fn)(struct mg_http_message *, struct mg_str *, void **) =
+  bool (*fn)(struct mg_http_message *, struct mg_str *, void **) =
       (bool (*)(struct mg_http_message *, struct mg_str *, void **))
       (ptrdiff_t) c->fn_data;
   (void) ev_data;
   if (ev == MG_EV_CLOSE || ev == MG_EV_ERROR) {
-    if (us->received < us->expected) {
+    if (!us->finished) {
       // Connection dropped mid-upload. Let cb clean up, e.g. call mg_ota_end()
-      us->received = us->expected;  // MG_EV_ERROR is followed by MG_EV_CLOSE
+      us->finished = true;  // MG_EV_ERROR is followed by MG_EV_CLOSE
       fn(NULL, NULL, &us->user_data);
     }
-  } else if (ev == MG_EV_READ && !c->is_draining) {
+  } else if (ev == MG_EV_READ && !c->is_draining && !us->finished) {
-    if (c->recv.len > 0 && us->received < us->expected) {
+    if (!us->failed && c->recv.len > 0 && us->received < us->expected) {
       // Got some uploaded data. Feed by 512-byte aligned chunks, for OTA
       size_t left = us->expected - us->received, r = c->recv.len;
       size_t aligned = r < left ? MG_ROUND_DOWN(r, 512) : left;
@@ -1043,10 +1044,13 @@ static void mg_stream_handler(struct mg_connection *c, int ev, void *ev_data) {
       us->received += aligned;
       mg_iobuf_del(&c->recv, 0, aligned);  // Shift the unprocessed tail
     }
-    if (us->received >= us->expected) {
+    if (!us->finished && (us->failed || us->received >= us->expected)) {
       // Finished upload. Always call cb, even after error, so it can clean up
+      us->finished = true;
       us->failed |= !fn(NULL, NULL, &us->user_data);
-      if (!c->is_client) {
+      if (c->is_client && us->failed) {
+        mg_error(c, "Body streaming failed");
+      } else if (!c->is_client) {
         mg_http_reply(c, us->failed ? 500 : 200, NULL, "%zu %s\n",
                       us->received, us->failed ? "fail" : "ok");
       }
@@ -1055,48 +1059,54 @@ static void mg_stream_handler(struct mg_connection *c, int ev, void *ev_data) {
   }
 }
 
-bool mg_http_stream_body(struct mg_connection *c, struct mg_http_message *hm,
+void mg_http_stream_body(struct mg_connection *c, struct mg_http_message *hm,
                          bool (*cb)(struct mg_http_message *, struct mg_str *,
-                                    void **user_data),
+                                    void **),
                          void *user_data) {
   struct mg_upload_state *us = (struct mg_upload_state *) c->data;
-  struct mg_str *te = mg_http_get_header(hm, "Transfer-Encoding");
+  int code = 0;
-  bool handled = false;
+  size_t head_len = hm->head.len;
 
   // Catch upload requests early, without buffering whole body. Called on the
   // MG_EV_HTTP_HDRS event: we've received all HTTP headers but not necessarily
   // the full HTTP body
-  if (hm->body.len == (size_t) ~0 ||
+  if (!c->is_client && mg_strcmp(hm->method, mg_str("POST")) != 0 &&
-      (te != NULL && mg_strcasecmp(*te, mg_str("chunked")) == 0)) {
+      mg_strcmp(hm->method, mg_str("PUT")) != 0) {
-    // Unknown length or chunked, cannot stream. Leave it to the caller
+    code = 405;
-  } else if (!c->is_client &&
+  } else if (mg_http_get_header(hm, "Transfer-Encoding") != NULL) {
-             mg_strcmp(hm->method, mg_str("POST")) != 0 &&
+    code = 400;
-             mg_strcmp(hm->method, mg_str("PUT")) != 0) {
+  } else if (hm->body.len == (size_t) ~0 ||
-    // Not an upload request. Leave it to the caller
+             (!c->is_client && mg_http_get_header(hm, "Content-Length") == NULL)) {
+    code = 411;
   } else if (sizeof(*us) > sizeof(c->data)) {
-    if (!c->is_client) {  // Nobody to reply to on a client connection
+    code = 500;
-      c->pfn = NULL;
+  }
-      mg_http_reply(c, 500, NULL, "data too small\n");
+  c->pfn = NULL;  // Take ownership even when validation fails
-      c->is_draining = 1;
+  if (code != 0) {
-      cb(NULL, NULL, &user_data);  // Let cb release user_data, start skipped
+    c->fn = NULL;
-      handled = true;
+    c->fn_data = NULL;
+    mg_iobuf_del(&c->recv, 0, c->recv.len);
+    cb(NULL, NULL, &user_data);  // Release resources even if start was skipped
+    if (c->is_client) {
+      mg_error(c, "%s", mg_http_status_code_str(code));
+    } else {
+      mg_http_reply(c, code, code == 405 ? "Allow: POST, PUT\r\n" : NULL, "");
     }
+    c->is_draining = 1;
   } else {
-    c->pfn = NULL;  // Silence HTTP protocol handler
     memset(us, 0, sizeof(*us));
     us->expected = hm->body.len;  // Store number of bytes we expect
     us->user_data = user_data;
+    c->fn = mg_stream_handler;
+    c->fn_data = (void *) (ptrdiff_t) cb;
     us->failed = !cb(hm, NULL, &us->user_data);  // Call before deleting headers
-    if (mg_http_get_header(hm, "Expect") != NULL) {
+    if (!c->is_client && !us->failed && !us->finished &&
+        mg_http_get_header(hm, "Expect") != NULL) {
       mg_http_reply(c, 100, NULL, "");  // If curl expects, we continue
     }
-    mg_iobuf_del(&c->recv, 0, hm->head.len);  // Delete HTTP headers
+    mg_iobuf_del(&c->recv, 0, head_len);  // Delete HTTP headers
-    c->fn = mg_stream_handler;                // We own the connection from now
-    c->fn_data = (void *) (ptrdiff_t) cb;
     mg_call(c, MG_EV_READ, &c->recv.len);  // Process the body bytes we have
-    handled = true;
   }
-  return handled;
 }
 
 static bool is_hex_digit(int c) {

src/http.h

@@ -205,29 +205,32 @@ int mg_http_status(const struct mg_http_message *hm);
 
 // Streams a POST/PUT body to a callback as it arrives, without buffering it.
 // Call it from an MG_EV_HTTP_HDRS handler, after matching the request, e.g.
-// with mg_match(). Returns true if it took over the connection, false if the
+// with mg_match(). Always takes over the connection. Invalid requests receive
-// request is not POST/PUT, is chunked, or has no Content-Length.
+// an HTTP error; client-side failures call mg_error(). Replies and connection
+// draining are handled internally, including callback failures.
 //
 // Callback upload_fn(hm, data, user_data) is called:
 //   - at start: hm is set. Open the file, set *user_data.
 //   - per chunk: data is set, 512 byte aligned except the last. Not called
 //     again after a failure.
-//   - at end: both NULL. Always called once, also when the connection drops
+//   - at end: both NULL. Always called exactly once, including validation
-//     early, so release resources here. A truncated body looks like a complete
+//     failures before start and connections that drop early. Release resources
-//     one: validate before committing.
+//     here. A truncated body looks like a complete one: validate before
-// Return true on success, false on error.
+//     committing.
+// The callback returns true on success, false on error. A failure stops
+// streaming immediately and calls the end callback before closing.
 // Example:
-//   if (ev == MG_EV_HTTP_HDRS && mg_match(hm->uri, mg_str("/fs/*"), NULL) {
+//   if (ev == MG_EV_HTTP_HDRS && mg_match(hm->uri, mg_str("/fs/*"), NULL)) {
-//     mg_http_stream_body(c, hm, upload, NULL));
+//     mg_http_stream_body(c, hm, upload, NULL);
 //   }
 // Full example:
 //   tutorials/http/file-upload-single-post
 // Related APIs:
 //   mg_http_listen(), mg_http_next_multipart()
 // Notes:
-//   After it returns true, this function hijacks the connection. Existing event
+//   The existing event handler is no longer called. hm is invalid after this
-//   handler not called, hm is invalid, c->data and c->fn_data are modified
+//   call; c->data and c->fn_data are reserved for streaming state.
-bool mg_http_stream_body(struct mg_connection *c, struct mg_http_message *hm,
+void mg_http_stream_body(struct mg_connection *c, struct mg_http_message *hm,
                          bool (*upload_fn)(struct mg_http_message *,
                                            struct mg_str *, void **user_data),
                          void *user_data);

src/jwt.c

@@ -7,7 +7,7 @@
 #include "util.h"
 
 #if MG_TLS == MG_TLS_BUILTIN
-#include "tls_uecc.h"
+#include "tls_p256.h"
 #endif
 
 static size_t jwt_split(struct mg_str jwt, struct mg_str *h, struct mg_str *p,
@@ -95,39 +95,14 @@ size_t mg_jwt_verify_hs256(struct mg_str jwt, const struct mg_jwt_opts *opts,
 }
 
 #if MG_TLS == MG_TLS_BUILTIN
-typedef struct {
-  MG_UECC_HashContext uECC;
-  mg_sha256_ctx sha256;
-} jwt_hash_ctx;
-
-static void jwt_hash_init(const MG_UECC_HashContext *ctx) {
-  jwt_hash_ctx *c = (jwt_hash_ctx *) ctx;
-  mg_sha256_init(&c->sha256);
-}
-
-static void jwt_hash_update(const MG_UECC_HashContext *ctx, const uint8_t *msg,
-                            unsigned len) {
-  jwt_hash_ctx *c = (jwt_hash_ctx *) ctx;
-  mg_sha256_update(&c->sha256, msg, len);
-}
-
-static void jwt_hash_finish(const MG_UECC_HashContext *ctx, uint8_t *hash) {
-  jwt_hash_ctx *c = (jwt_hash_ctx *) ctx;
-  mg_sha256_final(hash, &c->sha256);
-}
-
 size_t mg_jwt_sign_es256(const struct mg_jwt_opts *opts, char *buf,
                          size_t len) {
-  uint8_t hash[32], sig[64], tmp[2 * 32 + 64];
+  uint8_t hash[32], sig[64];
-  jwt_hash_ctx ctx = {
-      {jwt_hash_init, jwt_hash_update, jwt_hash_finish, 64, 32, tmp},
-      {{0}, 0, 0, {0}}};
   size_t n = jwt_header_payload("ES256", opts, buf, len);
   size_t m;
   if (n == 0 || n + 1 >= len) return 0;
   mg_sha256(hash, (uint8_t *) buf, n);
-  if (mg_uecc_sign_deterministic(opts->private_key, hash, sizeof(hash),
+  if (mg_p256_sign(opts->private_key, hash, sizeof(hash), sig) != 1)
-                                 &ctx.uECC, sig, mg_uecc_secp256r1()) != 1)
     return 0;
   buf[n++] = '.';
   m = mg_base64url_encode(sig, sizeof(sig), buf + n, len - n);
@@ -143,8 +118,7 @@ size_t mg_jwt_verify_es256(struct mg_str jwt, const struct mg_jwt_opts *opts,
   if (mg_base64url_decode(s.buf, s.len, (char *) sig, sizeof(sig)) != 64)
     return 0;
   mg_sha256(hash, (uint8_t *) jwt.buf, n);
-  if (mg_uecc_verify(opts->public_key, hash, sizeof(hash), sig,
+  if (mg_p256_verify(opts->public_key, hash, sizeof(hash), sig) != 1)
-                     mg_uecc_secp256r1()) != 1)
     return 0;
   return mg_base64url_decode(p.buf, p.len, buf, len);
 }

src/l2_802154.c

@@ -0,0 +1,60 @@
+#include "l2.h"
+#include "net_builtin.h"
+
+#if MG_ENABLE_TCPIP
+
+// Radio frame: 802.15.4 MAC header, 15 bytes: data frame, PAN ID compression,
+// broadcast destination, our EUI-64 made from MAC as source. Then 2 bytes:
+// tag, fragment index << 4 | last fragment index. Then data. 125 bytes max,
+// 127 minus FCS
+#define MGI_802154_HDR 17
+#define MGI_802154_DATA (125 - MGI_802154_HDR)
+
+size_t mg_l2_802154_tx(struct mg_tcpip_if *ifp, const void *buf, size_t len,
+                       size_t (*send_fn)(const uint8_t *, size_t,
+                                      struct mg_tcpip_if *)) {
+  struct mg_l2_802154_data *d =
+      (struct mg_l2_802154_data *) ifp->driver_data;
+  const uint8_t *p = (const uint8_t *) buf, *m = ifp->mac;
+  uint8_t f[MGI_802154_HDR + MGI_802154_DATA];
+  size_t i, n, last = (len - 1) / MGI_802154_DATA;
+  if (len == 0 || last > 15) return 0;
+  d->tag++;
+  for (i = 0; i <= last; i++) {
+    n = i == last ? len - i * MGI_802154_DATA : MGI_802154_DATA;
+    f[0] = 0x41, f[1] = 0xd8, f[2] = d->seq++;  // 2006 frame, see above
+    f[3] = (uint8_t) d->pan_id, f[4] = (uint8_t) (d->pan_id >> 8);
+    f[5] = f[6] = 0xff;
+    f[7] = m[5], f[8] = m[4], f[9] = m[3], f[10] = 0xfe, f[11] = 0xff;
+    f[12] = m[2], f[13] = m[1], f[14] = m[0];  // Little endian EUI-64
+    f[15] = d->tag, f[16] = (uint8_t) ((i << 4) | last);
+    memcpy(f + MGI_802154_HDR, p + i * MGI_802154_DATA, n);
+    if (send_fn(f, MGI_802154_HDR + n, ifp) == 0) return 0;
+  }
+  return len;
+}
+
+size_t mg_l2_802154_rx(struct mg_tcpip_if *ifp, const uint8_t *f, size_t n,
+                       void *buf, size_t len) {
+  struct mg_l2_802154_data *d =
+      (struct mg_l2_802154_data *) ifp->driver_data;
+  size_t idx, last;
+  if (n <= MGI_802154_HDR || f[0] != 0x41 || f[1] != 0xd8 ||
+      f[3] != (uint8_t) d->pan_id || f[4] != (uint8_t) (d->pan_id >> 8))
+    return 0;  // Not ours
+  idx = f[16] >> 4, last = f[16] & 15;
+  if (idx == 0) d->rxtag = f[15], d->rxnext = 0, d->rxlen = 0;
+  if (idx == 0) memcpy(d->rxsrc, f + 7, sizeof(d->rxsrc));
+  n -= MGI_802154_HDR;
+  if (idx != d->rxnext || idx > last || f[15] != d->rxtag ||
+      memcmp(d->rxsrc, f + 7, sizeof(d->rxsrc)) != 0 ||
+      d->rxlen + n > sizeof(d->rxbuf))
+    return 0;  // Missed a fragment, or from another sender
+  memcpy(d->rxbuf + d->rxlen, f + MGI_802154_HDR, n);
+  d->rxlen = (uint16_t) (d->rxlen + n), d->rxnext++;
+  if (idx < last || d->rxlen > len) return 0;
+  memcpy(buf, d->rxbuf, d->rxlen);
+  return d->rxlen;
+}
+
+#endif

src/mdash.c

@@ -156,14 +156,21 @@ void mg_mdash_init(struct mg_mgr *mgr) {
 }
 
 void mg_mdash_poll(struct mg_mgr *mgr) {
+#if MG_TLS == MG_TLS_NONE
+  (void) mgr, (void) mg_mdash_fn;  // mdash needs wss://, nothing to do
+#else
   static uint64_t timer = 0;
-  if (mg_mdash_conn == NULL && mg_timer_expired(&timer, 1000, mg_millis())) {
+  // No RPC handlers means mdash was never set up, or mg_mdash_free() ran.
+  // No key means mdash would reject us, so do not connect at all
+  if (mg_mdash_conn == NULL && mgr->rpcs != NULL && MG_MDASH_KEY[0] != '\0' &&
+      mg_timer_expired(&timer, 1000, mg_millis())) {
     MG_INFO(("Connecting to %s", MG_MDASH_URL));
     mg_mdash_conn = mg_ws_connect(mgr, MG_MDASH_URL, mg_mdash_fn, NULL,
                                   "Origin: %s\r\n"
                                   "Authorization: Bearer %s\r\n",
                                   MG_MDASH_URL, MG_MDASH_KEY);
   }
+#endif
 }
 
 void mg_mdash_free(struct mg_mgr *mgr) {

src/mqtt.c

@@ -438,6 +438,16 @@ int mg_mqtt_parse(const uint8_t *buf, size_t len, uint8_t version,
     case MQTT_CMD_CONNACK:
       if (end - p < 2) return MQTT_MALFORMED;
       m->ack = p[1];
+      p += 2;
+      if (version == 5) {
+        if (p >= end) return MQTT_MALFORMED;
+        len_len = (uint32_t) decode_varint(p, (size_t) (end - p), &tmp);
+        if (!len_len) return MQTT_MALFORMED;
+        m->props_size = (size_t) tmp;
+        m->props_start = (size_t) (p + len_len - buf);
+        p += len_len + m->props_size;
+        if (p > end) return MQTT_MALFORMED;
+      }
       break;
     case MQTT_CMD_PUBACK:
     case MQTT_CMD_PUBREC:

src/net.c

@@ -299,10 +299,10 @@ void mg_mgr_free(struct mg_mgr *mgr) {
   while (t != NULL) tmp = t->next, mg_free(t), t = tmp;
   mgr->timers = NULL;  // Important. Next call to poll won't touch timers
   for (c = mgr->conns; c != NULL; c = c->next) c->is_closing = 1;
-  mg_mgr_poll(mgr, 0);
 #if MG_ENABLE_MDASH
-  mg_mdash_free(mgr);
+  mg_mdash_free(mgr);  // Before the final poll, so mdash does not reconnect
 #endif
+  mg_mgr_poll(mgr, 0);
 #if MG_ENABLE_FREERTOS_TCP
   FreeRTOS_DeleteSocketSet(mgr->ss);
 #endif

src/net.h

@@ -92,11 +92,12 @@ struct mg_connection {
   unsigned is_mqtt5 : 1;          // MQTT5 connection (set by mg_mqtt_login)
   unsigned is_hexdumping : 1;     // Log hex dump of all in/out traffic
   unsigned is_draining : 1;       // Flush send buffer, then close
-  unsigned is_closing : 1;        // Close and free immediately on next poll
+  unsigned is_closing : 1;        // Request Close and free on next poll
   unsigned is_full : 1;           // Pause incoming reads until cleared
   unsigned is_tls_throttled : 1;  // TLS write was throttled; retry pending
   unsigned is_readable : 1;       // Socket is ready to read (epoll/select)
   unsigned is_writable : 1;       // Socket is ready to write (epoll/select)
+  unsigned is_bsd : 1;            // Built-in TCP/IP stack BSD socket
 };
 
 // Runs one iteration of the event loop.

src/net_builtin.c

@@ -1,4 +1,5 @@
 #include "net_builtin.h"
+#include "bsd.h"
 #include "profile.h"
 
 #if MG_ENABLE_TCPIP
@@ -31,16 +32,16 @@
 #endif
 
 struct connstate {
-  uint32_t seq, ack;                      // TCP seq/ack counters
+  uint32_t seq, ack;   // TCP seq/ack counters
-  uint64_t timer;                         // TCP timer (see 'ttype' below)
+  uint64_t timer;      // TCP timer (see 'ttype' below)
-  uint64_t txq_timer;                     // TCP retransmission timer (RFC-6298, 5)
+  uint64_t txq_timer;  // TCP retransmission timer (RFC-6298, 5)
-  uint32_t acked;                         // Last ACK-ed number
+  uint32_t acked;      // Last ACK-ed number
-  size_t unacked;                         // Not acked bytes
+  size_t unacked;      // Not acked bytes
-  uint32_t maxseq;                        // Max send seq (ack + window)
+  uint32_t maxseq;     // Max send seq (ack + window)
-  uint32_t txq_seq;                       // Sequence of first txq record (RFC-9293, 3.8)
+  uint32_t txq_seq;    // Sequence of first txq record (RFC-9293, 3.8)
-  uint32_t txq_una;                       // Oldest unacknowledged sequence (RFC-9293, 3.4)
+  uint32_t txq_una;    // Oldest unacknowledged sequence (RFC-9293, 3.4)
-  uint16_t win;                           // destination current window size
+  uint16_t win;        // destination current window size
-  uint16_t dmss;                          // destination MSS (from TCP opts)
+  uint16_t dmss;       // destination MSS (from TCP opts)
   uint8_t mac[sizeof(struct mg_l2addr)];  // Peer hw address
   uint8_t ttype;                          // Timer type:
 #define MIP_TTYPE_KEEPALIVE 0  // Connection is idle for long, send keepalive
@@ -54,6 +55,8 @@ struct connstate {
   bool twclosure;        // 3-way closure done
   bool retransmit;       // Retain sent data until acknowledged
   bool is_full;          // Advertise a zero receive window
+  bool is_closing;       // Finished, remove connection (TCP after FIN)
+  bool send_rst;         // Send RST before removing a TCP connection
   struct mg_iobuf txq;   // Length-prefixed sent TCP segments (RFC-9293, 3.8)
 };
 
@@ -310,6 +313,8 @@ static bool tcpcsum_ok(void *d, void *t) {
           0);
 }
 
+#define MG_IPISLOCAL(i, a) ((a & i->mask) == (i->ip & i->mask))
+
 #if MG_ENABLE_IPV6
 static uint16_t p6csum(void *d, void *p, uint8_t proto, size_t plen) {
   uint32_t sum;
@@ -418,12 +423,13 @@ static void onstatechange(struct mg_tcpip_if *ifp) {
       ifp->is_ip_changed = false;
     }
   } else if (ifp->state == MG_TCPIP_STATE_IP) {
-    if (ifp->gw != 0 && ifp->l2type == MG_TCPIP_L2_ETH)
+    if (ifp->l2type == MG_TCPIP_L2_ETH) {
-      mg_tcpip_arp_request(ifp, ifp->gw, NULL);  // unsolicited GW ARP request
+      ifp->gw_ready = false;  // remove any prior state
+      if (ifp->gw != 0)  // send an unsolicited GW ARP request
+        mg_tcpip_arp_request(ifp, ifp->gw, NULL);
+    }
   } else if (ifp->state == MG_TCPIP_STATE_UP) {
     srand((unsigned int) mg_millis());
-  } else if (ifp->state == MG_TCPIP_STATE_DOWN) {
-    MG_ERROR(("Link down"));
   }
   mg_tcpip_call(ifp, MG_TCPIP_EV_STATE_CHANGE, &ifp->state);
 }
@@ -603,6 +609,36 @@ static void l2addr_resolved(struct mg_connection *c);
 static uint8_t *get_return_l2addr(struct mg_tcpip_if *ifp, struct mg_addr *rem,
                                   bool is_udp, struct pkt *pkt);
 
+#if MG_ENABLE_BSD_SOCKETS
+static uint8_t *sendto_cache_find(struct mg_tcpip_if *ifp, uint32_t ip) {
+  struct mg_tcpip_sendto_entry *a;
+  for (a = ifp->sendto; a < ifp->sendto + MG_TCPIP_SENDTO_CACHE_SIZE; a++) {
+    if (a->ip == ip) return (uint8_t *) &a->addr;
+  }
+  return NULL;
+}
+
+static void sendto_cache_add(struct mg_tcpip_if *ifp, uint32_t ip,
+                             const uint8_t *addr) {
+  struct mg_tcpip_sendto_entry *a;
+  for (a = ifp->sendto; a < ifp->sendto + MG_TCPIP_SENDTO_CACHE_SIZE; a++) {
+    if (a->ip == ip) return;  // already cached, skip
+    if (a->ip == 0) break;    // not present, first empty slot
+  }
+  if (a == ifp->sendto + MG_TCPIP_SENDTO_CACHE_SIZE) { // no room
+    memmove(ifp->sendto, ifp->sendto + 1,
+            sizeof(ifp->sendto[0]) * (MG_TCPIP_SENDTO_CACHE_SIZE - 1));
+    a--; // make room and point to last entry (just made)
+  }
+  a->ip = ip; // populate this entry
+  memcpy(&a->addr, addr, sizeof(a->addr));
+}
+
+static void sendto_cache_clear(struct mg_tcpip_if *ifp) {
+  memset(ifp->sendto, 0, sizeof(ifp->sendto));
+}
+#endif
+
 // RFC826, ARP assumes Ethernet MAC addresses
 static void rx_arp(struct mg_tcpip_if *ifp, struct pkt *pkt) {
   if (pkt->arp->op == mg_htons(1) && pkt->arp->tpa == ifp->ip) {
@@ -672,6 +708,7 @@ static void rx_icmp(struct mg_tcpip_if *ifp, struct pkt *pkt) {
 }
 
 static void setdns4(struct mg_tcpip_if *ifp, uint32_t *ip);
+static void conndns4(struct mg_tcpip_if *ifp, uint32_t ip);
 
 static bool dhcp_opt_len_ok(uint8_t len, uint8_t *p, uint8_t *end) {
   return (len >= 4 && (len & 3) == 0 && p + 6 < end);
@@ -732,16 +769,15 @@ static void rx_dhcp_client(struct mg_tcpip_if *ifp, struct pkt *pkt) {
       uint64_t rand;
       ifp->lease_expire = ifp->now + (uint64_t) lease * 1000;
       MG_INFO(("Lease: %u sec (%lld)", lease, ifp->lease_expire / 1000));
-      // assume DHCP server = router until ARP resolves
-      memcpy(ifp->gwmac, mg_l2_getaddr(ifp, pkt->l2), sizeof(ifp->gwmac));
-      ifp->gw_ready = true;  // NOTE(): actual gw ARP won't retry now
       if (ifp->ip != ip) ifp->is_ip_changed = true;
       ifp->ip = ip, ifp->gw = gw, ifp->mask = mask;
       ifp->state = MG_TCPIP_STATE_IP;  // BOUND state
       mg_random(&rand, sizeof(rand));
       srand((unsigned int) (rand + mg_millis()));
       if (ifp->enable_req_dns && dns != 0) {
-        setdns4(ifp, &dns);
+        setdns4(ifp, &dns);         // configure the provided DNS
+        if (MG_IPISLOCAL(ifp, dns)) // connect to a local DNS at this point
+          conndns4(ifp, dns);
         mg_tcpip_call(ifp, MG_TCPIP_EV_DHCP_DNS, &dns);
       }
       if (ifp->enable_req_sntp && sntp != 0)
@@ -792,7 +828,7 @@ static void rx_dhcp_server(struct mg_tcpip_if *ifp, struct pkt *pkt) {
     res.xid = pkt->dhcp->xid;
     mac = mg_l2_getaddr(ifp, pkt->l2);
     if (ifp->enable_get_gateway) {
-      ifp->gw = res.yiaddr;  // set gw IP, best-effort gwmac as DHCP server's
+      ifp->gw = res.yiaddr;  // set gw IP, and MAC
       memcpy(ifp->gwmac, mac, sizeof(ifp->gwmac));
     }
     tx_udp4(ifp, mac, ifp->ip, mg_htons(67), op == 1 ? ~0U : res.yiaddr,
@@ -809,7 +845,7 @@ static struct ip6 *tx_ip6(struct mg_tcpip_if *ifp, uint8_t *l2_dst,
   struct ip6 *ip6 = (struct ip6 *) mg_l2_header(ifp, MG_TCPIP_L2PROTO_IPV6,
                                                 ifp->mac, l2_dst, l2p);
   memset(ip6, 0, sizeof(*ip6));
-  ip6->ver = (uint8_t) (0x60 | (dscp >> 2)); // Version 6, traffic class
+  ip6->ver = (uint8_t) (0x60 | (dscp >> 2));  // Version 6, traffic class
   ip6->label[0] = (uint8_t) (dscp << 6);
   ip6->plen = mg_htons((uint16_t) plen);
   ip6->next = next;
@@ -1049,6 +1085,7 @@ static void rx_ndp_ra(struct mg_tcpip_if *ifp, struct pkt *pkt) {
     if (gotprefix && !fill_global(ifp, prefix, prefix_len)) return;
     if (changed) ifp->is_ip6_changed = true;
     ifp->gw6[0] = pkt->ip6->src[0], ifp->gw6[1] = pkt->ip6->src[1];
+    ifp->gw6_ready = false;  // Remove any prior state
     if (gotl2addr) memcpy(ifp->gw6mac, l2, sizeof(ifp->gw6mac));
     if (gotl2addr || ifp->l2type == MG_TCPIP_L2_PPP ||
         ifp->l2type == MG_TCPIP_L2_PPPoE) {
@@ -1063,10 +1100,8 @@ static void rx_ndp_ra(struct mg_tcpip_if *ifp, struct pkt *pkt) {
            mtu));
       ifp->mtu = (uint16_t) mtu;
     }
-    if (ifp->state6 != MG_TCPIP_STATE_READY) {
+    if (ifp->state6 != MG_TCPIP_STATE_READY)
-      tx_ndp_ns(ifp, ifp->gw6, NULL);  // unsolicited GW hwaddr resolution
       ifp->state6 = MG_TCPIP_STATE_IP;
-    }
     onstate6change(ifp);
   }
 }
@@ -1182,7 +1217,7 @@ static uint8_t *get_return_l2addr(struct mg_tcpip_if *ifp, struct mg_addr *rem,
   } else
 #endif
   {
-    if (ifp->ip != 0 && ((rem->addr.ip4 & ifp->mask) == (ifp->ip & ifp->mask)))
+    if (ifp->ip != 0 && MG_IPISLOCAL(ifp, rem->addr.ip4))
       return mg_l2_getaddr(ifp, pkt->l2);  // same LAN, get from frame
     if (ifp->gw_ready)                     // use the router
       return ifp->gwmac;                   // ignore source address in frame
@@ -1192,33 +1227,74 @@ static uint8_t *get_return_l2addr(struct mg_tcpip_if *ifp, struct mg_addr *rem,
   return NULL;
 }
 
+static void proto_error(struct mg_connection *c, bool r, const char *f, ...) {
+  char buf[64];
+  va_list ap;
+  struct connstate *s = (struct connstate *) (c + 1);
+  va_start(ap, f);
+  mg_vsnprintf(buf, sizeof(buf), f, &ap);
+  va_end(ap);
+  MG_ERROR(("%lu %ld %s", c->id, c->fd, buf));
+  c->is_closing = 1;  // Stop Mongoose I/O
+  s->is_closing = 1;  // Transport-terminal; do not send FIN
+  if (r && !c->is_udp) s->send_rst = true;  // honot TCP RST request
+  mg_call(c, MG_EV_ERROR, buf);
+}
+
 static bool rx_udp(struct mg_tcpip_if *ifp, struct pkt *pkt) {
   struct mg_connection *c = getpeer(ifp->mgr, pkt, true);
   struct connstate *s;
+  struct mg_addr rem;
   uint8_t *l2addr;
+  size_t len = pkt->pay.len;
   if (c == NULL) return false;  // No UDP listener on this port
   s = (struct connstate *) (c + 1);
-  c->rem.port = pkt->udp->sport;
 #if MG_ENABLE_IPV6
   if (c->loc.is_ip6) {  // matching of v4/v6 to dest is done bt getpeer()
     if (!udp6csum_ok(pkt->ip6, pkt->udp)) return false;
-    c->rem.addr.ip6[0] = pkt->ip6->src[0],
+    if (c->is_bsd && c->is_client &&
-    c->rem.addr.ip6[1] = pkt->ip6->src[1], c->rem.is_ip6 = true;
+        (c->rem.port != pkt->udp->sport ||
+         !MG_IP6MATCH(c->rem.addr.ip6, pkt->ip6->src)))
+      return true;
+    rem.addr.ip6[0] = pkt->ip6->src[0],
+    rem.addr.ip6[1] = pkt->ip6->src[1], rem.is_ip6 = true;
   } else
 #endif
   {
     if (!udpcsum_ok(pkt->ip, pkt->udp)) return false;
-    c->rem.addr.ip4 = pkt->ip->src;
+    if (c->is_bsd && c->is_client &&
+        (c->rem.port != pkt->udp->sport || c->rem.addr.ip4 != pkt->ip->src))
+      return true;
+    rem.addr.ip4 = pkt->ip->src, rem.is_ip6 = false;
   }
-  if ((l2addr = get_return_l2addr(ifp, &c->rem, true, pkt)) == NULL)
+  rem.port = pkt->udp->sport;
+  if (!c->is_bsd || c->is_client) c->rem = rem;
+  if ((l2addr = get_return_l2addr(ifp, &rem, true, pkt)) == NULL)
     return false;  // safety net for lousy networks
-  memcpy(s->mac, l2addr, sizeof(s->mac));
+  if (!c->is_bsd || c->is_client) memcpy(s->mac, l2addr, sizeof(s->mac));
+#if MG_ENABLE_BSD_SOCKETS
+  if (c->is_bsd && !rem.is_ip6 && MG_IPISLOCAL(ifp, rem.addr.ip4))
+    sendto_cache_add(ifp, rem.addr.ip4, l2addr);
+#endif
+#if MG_ENABLE_BSD_SOCKETS
+  if (c->is_bsd) len += sizeof(struct mg_bsd_udp_frame);
+#endif
   if (c->recv.len >= MG_MAX_RECV_SIZE) {
-    mg_error(c, "max_recv_buf_size reached");
+    proto_error(c, false, "max_recv_buf_size reached");
-  } else if (c->recv.size - c->recv.len < pkt->pay.len &&
+  } else if (c->recv.size - c->recv.len < len &&
-             !mg_iobuf_resize(&c->recv, c->recv.len + pkt->pay.len)) {
+             !mg_iobuf_resize(&c->recv, c->recv.len + len)) {
-    mg_error(c, "oom");
+    proto_error(c, false, "oom");
   } else {
+#if MG_ENABLE_BSD_SOCKETS
+    if (c->is_bsd) {
+      struct mg_bsd_udp_frame *h =
+          (struct mg_bsd_udp_frame *) &c->recv.buf[c->recv.len];
+      h->ip = rem.addr.ip4;
+      h->port = rem.port;
+      h->len = (uint16_t) pkt->pay.len;
+      c->recv.len += sizeof(*h);
+    }
+#endif
     memcpy(&c->recv.buf[c->recv.len], pkt->pay.buf, pkt->pay.len);
     c->recv.len += pkt->pay.len;
     mg_call(c, MG_EV_READ, &pkt->pay.len);
@@ -1278,7 +1354,7 @@ static size_t tx_tcp(struct mg_tcpip_if *ifp, uint8_t *l2_dst,
   tcp->off = (uint8_t) (hlen / 4 << 4);
 #if MG_ENABLE_IPV6
   if (ip_dst->is_ip6) {
-   tcp->csum = p6csum(ip6, tcp, 6, hlen + len);
+    tcp->csum = p6csum(ip6, tcp, 6, hlen + len);
   } else
 #endif
   {
@@ -1491,7 +1567,7 @@ static void handle_tls_recv(struct mg_connection *c) {
   size_t min = avail > MG_MAX_RECV_SIZE ? MG_MAX_RECV_SIZE : avail;
   struct mg_iobuf *io = &c->recv;  // allocated on first avail > 0
   if (io->size - io->len < min && !mg_iobuf_resize(io, io->len + min)) {
-    mg_error(c, "oom");
+    proto_error(c, true, "oom");
   } else {
     // Decrypt data directly into c->recv. If io->buf = NULL or
     // io->len = io->size (no room), there can be outstanding data that can't be
@@ -1500,7 +1576,7 @@ static void handle_tls_recv(struct mg_connection *c) {
     long n = mg_tls_recv(c, io->buf != NULL ? &io->buf[io->len] : io->buf,
                          io->size - io->len);
     if (n == MG_IO_ERR) {
-      mg_error(c, "TLS recv error");
+      proto_error(c, true, "TLS recv error");
     } else if (n > 0) {
       // Decrypted successfully - trigger MG_EV_READ
       io->len += (size_t) n;
@@ -1544,7 +1620,7 @@ static void retransmit(struct mg_connection *c) {
       tx_tcp(ifp, s->mac, &c->loc, &c->rem, c->dscp, TH_PUSH | TH_ACK,
              mg_htonl(s->txq_seq), mg_htonl(s->ack),
              s->is_full ? 0 : MG_TCPIP_WIN, buf, len) == (size_t) -1) {
-    mg_error(c, "retransmit");
+    proto_error(c, false, "retransmit"); // should RST, but sending just failed
     return;
   }
   // Back off RTO after every timeout (RFC-6298, 5.5)
@@ -1577,15 +1653,11 @@ static void read_conn(struct mg_connection *c, struct pkt *pkt) {
     s->ack = (uint32_t) (mg_htonl(pkt->tcp->seq) + pkt->pay.len + 1);
     s->fin_rcvd = true;
     if (c->is_draining && s->ttype == MIP_TTYPE_FIN) {
-      if (s->seq == mg_htonl(pkt->tcp->ack)) {  // Simultaneous closure ?
+      // Simultaneous closure ?
-        s->seq++;                               // Yes. Increment our SEQ
-      } else {                                  // Otherwise,
-        s->seq = mg_htonl(pkt->tcp->ack);       // Set to peer's ACK
-      }
       s->twclosure = true;
     } else {
       // Peer closed first: send ACK only, enter CLOSE_WAIT.
-      // The connection loop will call init_closure after pending send data
+      // The connection loop will initiate closure after pending send data
       // is flushed, then send our FIN.
       c->is_draining = 1;
     }
@@ -1619,18 +1691,11 @@ static void read_conn(struct mg_connection *c, struct pkt *pkt) {
       s->twclosure = true;
   }
   if (pkt->pay.len == 0) return;
-  if (io->size - io->len < pkt->pay.len &&
+  if (!c->is_closing && io->size - io->len < pkt->pay.len &&
       !mg_iobuf_resize(io, io->len + pkt->pay.len)) {
-    mg_error(c, "oom");
+    proto_error(c, true, "oom");
     return;  // drop it
   }
-  // Copy TCP payload into the IO buffer. If the connection is plain text,
-  // we copy to c->recv. If the connection is TLS, this data is encrypted,
-  // therefore we copy that encrypted data to the c->rtls iobuffer instead,
-  // and then call mg_tls_recv() to decrypt it. NOTE: mg_tls_recv() will
-  // call back mg_io_recv() which grabs raw data from c->rtls
-  memcpy(&io->buf[io->len], pkt->pay.buf, pkt->pay.len);
-  io->len += pkt->pay.len;
   MG_VERBOSE(("%lu SEQ %x -> %x", c->id, mg_htonl(pkt->tcp->seq), s->ack));
   if (!(pkt->tcp->flags & TH_FIN)) {  // FIN already advanced s->ack
     // Advance ACK counter
@@ -1638,7 +1703,8 @@ static void read_conn(struct mg_connection *c, struct pkt *pkt) {
     s->unacked += pkt->pay.len;
   }
   // size_t diff = s->acked <= s->ack ? s->ack - s->acked : s->ack;
-  if (s->unacked > MG_TCPIP_WIN / 2 && s->acked != s->ack) {
+  if ((s->unacked > MG_TCPIP_WIN / 2 && s->acked != s->ack) ||
+      s->ttype == MIP_TTYPE_FIN) {
     // Send ACK immediately
     MG_VERBOSE(("%lu imm ACK %lu", c->id, s->acked));
     tx_tcp(c->mgr->ifp, s->mac, &c->loc, &c->rem, c->dscp, TH_ACK,
@@ -1651,6 +1717,14 @@ static void read_conn(struct mg_connection *c, struct pkt *pkt) {
     // if not already running, setup a timer to send an ACK later
     if (s->ttype != MIP_TTYPE_ACK) settmout(c, MIP_TTYPE_ACK);
   }
+  if (c->is_closing) return; // we have a "closed socket", ignore data
+  // Copy TCP payload into the IO buffer. If the connection is plain text,
+  // we copy to c->recv. If the connection is TLS, this data is encrypted,
+  // therefore we copy that encrypted data to the c->rtls iobuffer instead,
+  // and then call mg_tls_recv() to decrypt it. NOTE: mg_tls_recv() will
+  // call back mg_io_recv() which grabs raw data from c->rtls
+  memcpy(&io->buf[io->len], pkt->pay.buf, pkt->pay.len);
+  io->len += pkt->pay.len;
   if (c->is_tls) {
     c->is_tls_hs ? mg_tls_handshake(c) : handle_tls_recv(c);
   } else {
@@ -1759,11 +1833,11 @@ static void rx_tcp(struct mg_tcpip_if *ifp, struct pkt *pkt) {
     if (c->is_tls_hs) mg_tls_handshake(c);
     if (!c->is_tls_hs) c->is_tls = 0;  // user did not call mg_tls_init()
   } else if (c != NULL && c->is_connecting && pkt->tcp->flags != TH_ACK) {
-    mg_error(c, "connection refused");
+    proto_error(c, false, "connection refused");
   } else if (c != NULL && pkt->tcp->flags & TH_RST) {
     uint32_t seqno = mg_ntohl(pkt->tcp->seq);
     if (seqno >= s->ack && seqno < (s->ack + MG_TCPIP_WIN))  // RFC-9293 3.5.3
-      mg_error(c, "peer RST");  // RFC-1122 4.2.2.13
+      proto_error(c, false, "peer RST");  // RFC-1122 4.2.2.13
   } else if (c != NULL) {
     // process segment
     s->tmiss = 0;                         // Reset missed keep-alive counter
@@ -1845,7 +1919,7 @@ static void rx_ip(struct mg_tcpip_if *ifp, struct pkt *pkt) {
     if (pkt->ip->proto == 17) pkt->udp = (struct udp *) (pkt->pay.buf);
     if (pkt->ip->proto == 6) pkt->tcp = (struct tcp *) (pkt->pay.buf);
     c = getpeer(ifp->mgr, pkt, false);
-    if (c) mg_error(c, "Received fragmented packet");
+    if (c) proto_error(c, false, "Received fragmented packet");
   } else if (pkt->ip->proto == 1) {
     pkt->icmp = (struct icmp *) (pkt->pay.buf);
     if (pkt->pay.len < sizeof(*pkt->icmp)) return;
@@ -1928,7 +2002,7 @@ static void rx_ip6(struct mg_tcpip_if *ifp, struct pkt *pkt) {
         if (nhdr[0] == 17) pkt->udp = (struct udp *) (pkt->pay.buf);
         if (nhdr[0] == 6) pkt->tcp = (struct tcp *) (pkt->pay.buf);
         c = getpeer(ifp->mgr, pkt, false);
-        if (c) mg_error(c, "Received fragmented packet");
+        if (c) proto_error(c, false, "Received fragmented packet");
       }
         return;
       case 59:  // No Next Header 4.7
@@ -2122,7 +2196,7 @@ static void mg_tcpip_poll(struct mg_tcpip_if *ifp, uint64_t now) {
   }
   // Handle gw ARP request timeout, order is important
   if (expired_1000ms && ifp->state == MG_TCPIP_STATE_IP) {
-    ifp->state = MG_TCPIP_STATE_READY;  // keep best-effort MAC or poison mark
+    ifp->state = MG_TCPIP_STATE_READY;  // gw MAC not resolved, we'll retry
     onstatechange(ifp);
   }
   if (expired_1000ms && ifp->state == MG_TCPIP_STATE_READY && !ifp->gw_ready &&
@@ -2131,10 +2205,10 @@ static void mg_tcpip_poll(struct mg_tcpip_if *ifp, uint64_t now) {
 #if MG_ENABLE_IPV6
   // Handle gw NS/NA req/resp timeout, order is important
   if (expired_1000ms && ifp->state6 == MG_TCPIP_STATE_IP) {
-    ifp->state6 = MG_TCPIP_STATE_READY;  // keep best-effort MAC or poison mark
+    ifp->state6 = MG_TCPIP_STATE_READY;  // gw6 MAC not resolved, we'll retry
     onstate6change(ifp);
   }
-  if (expired_1000ms && ifp->state == MG_TCPIP_STATE_READY && !ifp->gw6_ready &&
+  if (expired_1000ms && ifp->state6 == MG_TCPIP_STATE_READY && !ifp->gw6_ready &&
       (ifp->gw6[0] != 0 || ifp->gw6[1] != 0))
     tx_ndp_ns(ifp, ifp->gw6, NULL);  // retry GW hwaddr resolution
 #endif
@@ -2193,7 +2267,7 @@ static void mg_tcpip_poll(struct mg_tcpip_if *ifp, uint64_t now) {
     }
     if (ifp->now > s->timer) {
       if (s->ttype == MIP_TTYPE_ARP) {
-        mg_error(c, "ARP timeout");
+        proto_error(c, false, "ARP timeout");
       } else if (c->is_udp) {
         continue;
       } else if (s->ttype == MIP_TTYPE_ACK && s->acked != s->ack) {
@@ -2202,13 +2276,13 @@ static void mg_tcpip_poll(struct mg_tcpip_if *ifp, uint64_t now) {
                mg_htonl(s->ack), s->is_full ? 0 : MG_TCPIP_WIN, NULL, 0);
         s->acked = s->ack;
       } else if (s->ttype == MIP_TTYPE_SYN) {
-        mg_error(c, "Connection timeout");
+        proto_error(c, false, "Connection timeout");
       } else if (s->ttype == MIP_TTYPE_FIN) {
-        c->is_closing = 1;
+        s->is_closing = 1;
         continue;
       } else {
         if (s->tmiss++ > 2) {
-          mg_error(c, "keepalive");
+          proto_error(c, false, "keepalive");
         } else {
           MG_VERBOSE(("%lu keepalive", c->id));
           tx_tcp(ifp, s->mac, &c->loc, &c->rem, c->dscp, TH_ACK,
@@ -2268,9 +2342,20 @@ void mg_tcpip_init(struct mg_mgr *mgr, struct mg_tcpip_if *ifp) {
     MG_DEBUG(("Builtin TCP/IP init done. Queue size: %zu, extra conn size: %zu",
               ifp->recv_queue.size, mgr->extraconnsize));
   }
+  mg_bsd_init(mgr);
+}
+
+static void close_conn(struct mg_connection *c) {
+  struct connstate *s = (struct connstate *) (c + 1);
+#if MG_ENABLE_BSD_SOCKETS
+  if (c->is_bsd && c->is_udp) sendto_cache_clear(c->mgr->ifp);
+#endif
+  mg_iobuf_free(&s->txq);
+  mg_close_conn(c);
 }
 
 void mg_tcpip_free(struct mg_tcpip_if *ifp) {
+  while (ifp->mgr->conns != NULL) close_conn(ifp->mgr->conns); // TCP FIN wait
   mg_free(ifp->recv_queue.buf);
   mg_free(ifp->tx.buf);
   mg_free(ifp->dns4_url);
@@ -2286,6 +2371,11 @@ static void send_syn(struct mg_connection *c) {
 static void l2addr_resolved(struct mg_connection *c) {
   if (c->is_udp) {
     c->is_connecting = 0;
+#if MG_ENABLE_BSD_SOCKETS
+    if (c->is_bsd)
+      sendto_cache_add(c->mgr->ifp, c->rem.addr.ip4,
+                       ((struct connstate *) (c + 1))->mac);
+#endif
     mg_call(c, MG_EV_CONNECT, NULL);
   } else {
     send_syn(c);
@@ -2300,20 +2390,25 @@ void mg_connect_resolved(struct mg_connection *c) {
   s->retransmit = ifp->enable_tcp_retransmit;
   s->txq.align = MG_TCPIP_TXQ_ALIGN;
   c->is_resolving = 0;
-  if (ifp->eport < MG_EPHEMERAL_PORT_BASE) ifp->eport = MG_EPHEMERAL_PORT_BASE;
+  if (c->loc.port == 0) {
-  c->loc.port = mg_htons(ifp->eport++);
+    if (ifp->eport < MG_EPHEMERAL_PORT_BASE)
+      ifp->eport = MG_EPHEMERAL_PORT_BASE;
+    c->loc.port = mg_htons(ifp->eport++);
+  }  // otherwise retain an existing bound port
 #if MG_ENABLE_IPV6
   if (c->rem.is_ip6) {
-    if (c->rem.addr.ip6[0] == ifp->ip6ll[0]) {  // same local LAN, use ll
+    if (c->loc.addr.ip6[0] == 0 && c->loc.addr.ip6[1] == 0 &&
+        c->rem.addr.ip6[0] == ifp->ip6ll[0]) {  // same local LAN, use ll
       c->loc.addr.ip6[0] = ifp->ip6ll[0], c->loc.addr.ip6[1] = ifp->ip6ll[1];
-    } else {  // use global address
+    } else if (c->loc.addr.ip6[0] == 0 && c->loc.addr.ip6[1] == 0) {
+      // Use global address
       c->loc.addr.ip6[0] = ifp->ip6[0], c->loc.addr.ip6[1] = ifp->ip6[1];
-    }
+    } // otherwise retain an existing bound address
     c->loc.is_ip6 = true;
   } else
 #endif
   {
-    c->loc.addr.ip4 = ifp->ip;
+    if (c->loc.addr.ip4 == 0) c->loc.addr.ip4 = ifp->ip;
   }
   MG_DEBUG(("%lu %M -> %M", c->id, mg_print_ip_port, &c->loc, mg_print_ip_port,
             &c->rem));
@@ -2337,23 +2432,32 @@ void mg_connect_resolved(struct mg_connection *c) {
       memcpy(s->mac, ifp->gw6mac, sizeof(s->mac));
       l2addr_resolved(c);
     } else {
-      MG_ERROR(("No IPv6 gateway, can't connect"));
+      mg_error(c, "No IPv6 gateway, can't connect");
     }
 #endif
   } else {
     uint32_t rem_ip = c->rem.addr.ip4;
-    if (ifp->ip && ((rem_ip & ifp->mask) == (ifp->ip & ifp->mask)) &&
+    if (ifp->ip && MG_IPISLOCAL(ifp, rem_ip) &&
         rem_ip != ifp->gw) {  // skip if gw (onstatechange -> ARP)
-      // If we're in the same LAN, fire an ARP lookup.
+        // We're in the same LAN
-      MG_DEBUG(("%lu ARP lookup...", c->id));
+#if MG_ENABLE_BSD_SOCKETS
-      mg_tcpip_arp_request(ifp, rem_ip, NULL);
+      if (c->is_bsd && c->is_udp && // see if we already have L2 data
-      settmout(c, MIP_TTYPE_ARP);
+          (l2addr = sendto_cache_find(ifp, rem_ip)) != NULL) {
-      c->is_arplooking = 1;
+        memcpy(s->mac, l2addr, sizeof(s->mac));
+        l2addr_resolved(c);
+      } else
+#endif
+      {  // fire an ARP lookup
+        MG_DEBUG(("%lu ARP lookup...", c->id));
+        mg_tcpip_arp_request(ifp, rem_ip, NULL);
+        settmout(c, MIP_TTYPE_ARP);
+        c->is_arplooking = 1;
+      }
     } else if (ifp->gw_ready) {
       memcpy(s->mac, ifp->gwmac, sizeof(s->mac));
       l2addr_resolved(c);
     } else {
-      MG_ERROR(("No gateway, can't connect"));
+      mg_error(c, "No gateway, can't connect");
     }
   }
 }
@@ -2368,33 +2472,40 @@ bool mg_open_listener(struct mg_connection *c, const char *url) {
 }
 
 static void write_conn(struct mg_connection *c) {
-  long len = c->is_tls ? mg_tls_send(c, c->send.buf, c->send.len)
+  long len;
-                       : mg_io_send(c, c->send.buf, c->send.len);
+  size_t off = 0;
+  bool empty = false;
+#if MG_ENABLE_BSD_SOCKETS
+  struct mg_bsd_udp_frame *h;
+  if (c->is_bsd && c->is_udp) {
+    if (c->is_connecting) return;
+    h = (struct mg_bsd_udp_frame *) c->send.buf;
+    assert(c->send.len >= sizeof(*h));
+    assert(h->len <= c->send.len - sizeof(*h));
+    c->rem.port = h->port;
+    c->rem.is_ip6 = false;
+    if (!c->is_client && c->rem.addr.ip4 != h->ip) {
+      c->rem.addr.ip4 = h->ip;
+      mg_connect_resolved(c);
+      if (c->is_connecting) return;
+    }
+    len = mg_io_send(c, h + 1, h->len);
+    off = sizeof(*h), empty = h->len == 0;
+  } else
+#endif
+  {
+    len = c->is_tls ? mg_tls_send(c, c->send.buf, c->send.len)
+                    : mg_io_send(c, c->send.buf, c->send.len);
+  }
   // TODO(): mg_tls_send() may return 0 forever on steady OOM
   if (len == MG_IO_ERR) {
-    mg_error(c, "tx err");
+    proto_error(c, false, "tx err");
-  } else if (len > 0) {
+  } else if (len > 0 || empty) {
-    mg_iobuf_del(&c->send, 0, (size_t) len);
+    mg_iobuf_del(&c->send, 0, off + (size_t) len);
     mg_call(c, MG_EV_WRITE, &len);
   }
 }
 
-static void init_closure(struct mg_connection *c) {
-  struct connstate *s = (struct connstate *) (c + 1);
-  if (c->is_listening == false && c->is_connecting == false) {
-    tx_tcp(c->mgr->ifp, s->mac, &c->loc, &c->rem, c->dscp, TH_FIN | TH_ACK,
-           mg_htonl(s->seq), mg_htonl(s->ack), s->is_full ? 0 : MG_TCPIP_WIN,
-           NULL, 0);
-    settmout(c, MIP_TTYPE_FIN);
-  }
-}
-
-static void close_conn(struct mg_connection *c) {
-  struct connstate *s = (struct connstate *) (c + 1);
-  mg_iobuf_free(&s->txq);
-  mg_close_conn(c);
-}
-
 static bool can_write(struct mg_connection *c) {
   return c->is_connecting == 0 && c->is_resolving == 0 && c->send.len > 0 &&
          c->is_tls_hs == 0 && c->is_arplooking == 0;
@@ -2415,29 +2526,50 @@ void mg_mgr_poll(struct mg_mgr *mgr, int ms) {
                   !c->is_listening && !c->is_connecting;
     tmp = c->next;
     mg_call(c, MG_EV_POLL, &now);
-    MG_VERBOSE(("%lu .. %c%c%c%c%c %lu %lu", c->id, c->is_tls ? 'T' : 't',
+    MG_VERBOSE(("%lu .. %c%c%c%c%c%c %lu %lu", c->id, c->is_tls ? 'T' : 't',
                 c->is_connecting ? 'C' : 'c', c->is_tls_hs ? 'H' : 'h',
                 c->is_resolving ? 'R' : 'r', c->is_closing ? 'C' : 'c',
-                mg_tls_pending(c), c->rtls.len));
+                s->is_closing ? 'F' : 'f', mg_tls_pending(c), c->rtls.len));
-    // order is important, TLS conn close with > 1 record in buffer (below)
+    if (!c->is_closing) {
-    if (is_tls && (c->rtls.len > 0 || mg_tls_pending(c) > 0))
+      // order is important, TLS conn close with > 1 record in buffer (below)
+      if (is_tls && (c->rtls.len > 0 || mg_tls_pending(c) > 0))
       c->is_tls_hs ? mg_tls_handshake(c) : handle_tls_recv(c);
-    if (can_write(c)) write_conn(c);
+      if (can_write(c)) write_conn(c);
-    if (is_tls && c->send.len == 0) flush = mg_tls_flush(c);
+      if (is_tls && c->send.len == 0) flush = mg_tls_flush(c);
-    if (flush == MG_IO_ERR) mg_error(c, "tx err");
-    if (c->is_draining && c->send.len == 0) {
-      if (c->is_udp) c->is_closing = 1;
-      if (!c->is_udp && flush == 0 && s->txq.len == 0 &&
-          s->ttype != MIP_TTYPE_FIN)
-        init_closure(c);
     }
+    if (flush == MG_IO_ERR) proto_error(c, false, "tx err"); // should RST but
+    if (c->is_draining && c->send.len == 0 &&
+        (c->is_udp ||
+         (flush == 0 && s->txq.len == 0 && s->ttype != MIP_TTYPE_FIN)))
+      c->is_closing = 1;
     // For non-TLS, close immediately upon completing the 3-way closure
     // For TLS, handle any pending data (above) until MIP_TTYPE_FIN expires
     if (s->twclosure &&
-        (!c->is_tls || (c->rtls.len == 0 && mg_tls_pending(c) == 0)))
+        (!c->is_tls || (c->rtls.len == 0 && mg_tls_pending(c) == 0))) {
-      c->is_closing = 1;
+      s->is_closing = 1;
-    if (c->is_closing) close_conn(c);
+    } else if (c->is_closing && !s->is_closing) {
+      if (c->is_udp || c->is_listening || c->is_resolving || c->is_arplooking ||
+          c->is_connecting) {
+        close_conn(c);
+        continue;
+      } else if (s->ttype != MIP_TTYPE_FIN) {  // active TCP: initiate closure
+        size_t tx = tx_tcp(c->mgr->ifp, s->mac, &c->loc, &c->rem, c->dscp,
+                           TH_FIN | TH_ACK, mg_htonl(s->seq), mg_htonl(s->ack),
+                           s->is_full ? 0 : MG_TCPIP_WIN, NULL, 0);
+        if (tx == (size_t) -1) {
+          s->is_closing = 1;
+        } else if (tx > 0) {
+          s->seq++;
+          settmout(c, MIP_TTYPE_FIN);
+        }  // else tx = 0, should recover later or we have worse problems
+      }
+    }
+    if (s->send_rst)  // proto_error requested TCP RST, send it and close
+      tx_tcp(c->mgr->ifp, s->mac, &c->loc, &c->rem, c->dscp, TH_RST,
+             mg_htonl(s->seq), 0, 0, NULL, 0);
+    if (s->is_closing) close_conn(c);  // then removes the conn
   }
+  mg_bsd_poll(mgr);
   (void) ms;
 }
 
@@ -2445,10 +2577,10 @@ bool mg_send(struct mg_connection *c, const void *buf, size_t len) {
   struct mg_tcpip_if *ifp = c->mgr->ifp;
   bool res = false;
   if (!c->loc.is_ip6 && (ifp->ip == 0 || ifp->state != MG_TCPIP_STATE_READY)) {
-    mg_error(c, "net down");
+    proto_error(c, false, "net down");
 #if MG_ENABLE_IPV6
   } else if (c->loc.is_ip6 && ifp->state6 != MG_TCPIP_STATE_READY) {
-    mg_error(c, "net down");
+    proto_error(c, false, "net down");
 #endif
   } else if (c->is_udp && (c->is_arplooking || c->is_resolving)) {
     // Fail to send, no target MAC or IP
@@ -2482,10 +2614,31 @@ static void setdns4(struct mg_tcpip_if *ifp, uint32_t *ip) {
   MG_DEBUG(("Set DNS URL to %s", dnsc->url));
   if (ifp->mgr->use_dns6) return;
   if (dnsc->c != NULL) mg_close_conn(dnsc->c);
-  if (!mg_dnsc_init(ifp->mgr, dnsc))  // create DNS connection
-    MG_ERROR(("DNS connection creation failed"));
 }
 
+static void conndns4(struct mg_tcpip_if *ifp, uint32_t ip) {
+  struct mg_connection *c;
+  struct mg_dns *dnsc = &ifp->mgr->dns4;
+  if (ifp->mgr->use_dns6) return;
+  if ((c = mg_alloc_conn(ifp->mgr)) == NULL) {
+    MG_ERROR(("OOM, DNS connection creation failed"));
+    return;
+  } // mg_connect_svc() would block us, so we bypass it here
+  LIST_ADD_HEAD(struct mg_connection, &ifp->mgr->conns, c);
+  c->is_udp = true;
+  c->fd = (void *) (size_t) MG_INVALID_SOCKET;
+  c->is_client = true;
+  dnsc->c = c;
+  mg_call(c, MG_EV_OPEN, (void *) dnsc->url);
+  MG_DEBUG(("%lu %ld %s", c->id, c->fd, dnsc->url));
+  c->rem.addr.ip4 = ip;
+  c->rem.port = mg_htons(53);
+  mg_connect_resolved(c);
+  mg_dnsc_init(ifp->mgr, dnsc); // will fill c->pfn = dns_cb
+}
+
+
+
 void mg_tcpip_mapip(struct mg_connection *c, struct mg_addr *ip) {
   struct connstate *s = (struct connstate *) (c + 1);
   uint8_t *l2addr = tcpip_mapip(c->mgr->ifp, ip);

src/net_builtin.h

@@ -26,6 +26,17 @@ struct mg_tcpip_driver {
 typedef void (*mg_tcpip_event_handler_t)(struct mg_tcpip_if *ifp, int ev,
                                          void *ev_data);
 
+#if MG_ENABLE_BSD_SOCKETS
+#ifndef MG_TCPIP_SENDTO_CACHE_SIZE
+#define MG_TCPIP_SENDTO_CACHE_SIZE 4
+#endif
+
+struct mg_tcpip_sendto_entry {
+  uint32_t ip;
+  struct mg_l2addr addr;
+};
+#endif
+
 // clang-format off
 // Events delivered to mg_tcpip_if.fn (user) and mg_tcpip_if.pfn (driver).
 // Each entry shows the ev_data type to cast inside the handler.
@@ -88,6 +99,9 @@ struct mg_tcpip_if {
   enum mg_l2type l2type;                    // Layer-2 type: Ethernet, PPP, etc. (see l2.h)
   union mg_l2data l2data;                   // Layer-2 config and state (see l2.h)
   char *dns4_url;                           // Active DNS server URL (set from DHCP or config)
+#if MG_ENABLE_BSD_SOCKETS
+  struct mg_tcpip_sendto_entry sendto[MG_TCPIP_SENDTO_CACHE_SIZE];  // Local IPv4 neighbors
+#endif
   uint64_t now;                             // Current time in ms (updated each mg_mgr_poll)
   uint64_t timer_1000ms;                    // Timestamp of last 1-second tick
   uint64_t lease_expire;                    // DHCP lease expiry time in ms
@@ -154,6 +168,41 @@ extern struct mg_tcpip_driver mg_tcpip_driver_nxp_wifi;
 extern struct mg_tcpip_driver mg_tcpip_driver_st67w6;
 extern struct mg_tcpip_driver mg_tcpip_driver_atcmd;
 extern struct mg_tcpip_driver mg_tcpip_driver_netc;
+extern struct mg_tcpip_driver mg_tcpip_driver_mcxw71;
+extern struct mg_tcpip_driver mg_tcpip_driver_rw612_154;
+
+// IEEE 802.15.4 radio channel and PAN ID. Settable in mongoose_config.h
+#ifndef MG_L2_802154_CHANNEL
+#define MG_L2_802154_CHANNEL 15  // 11..26
+#endif
+#ifndef MG_L2_802154_PAN_ID
+#define MG_L2_802154_PAN_ID 0xabcd
+#endif
+
+// driver_data for IEEE 802.15.4 radio drivers. The interface is Ethernet:
+// each Ethernet frame is split into broadcast radio frames, and reassembled
+// on the other side, see mg_l2_802154_tx() and mg_l2_802154_rx()
+struct mg_l2_802154_data {
+  uint8_t channel;        // User-set channel, 11..26
+  uint16_t pan_id;        // User-set PAN ID
+  uint8_t seq, tag;       // MAC sequence number, tag of the last sent frame
+  uint8_t rxtag, rxnext;  // Frame being reassembled: tag, next fragment
+  uint8_t rxsrc[8];       // Its sender
+  uint16_t rxlen;         // Its bytes received so far
+  uint8_t rxbuf[1514];    // Reassembly buffer, one Ethernet frame
+};
+
+// Splits an Ethernet frame into radio frames, sends each by calling send().
+// Called by radio drivers' tx(). Return len, or 0 on error
+size_t mg_l2_802154_tx(struct mg_tcpip_if *ifp, const void *buf, size_t len,
+                       size_t (*send)(const uint8_t *, size_t,
+                                      struct mg_tcpip_if *));
+
+// Adds a received radio frame f of n bytes to the frame being reassembled.
+// Called by radio drivers' rx(). Return the Ethernet frame length, copied to
+// buf, when it is complete, otherwise 0
+size_t mg_l2_802154_rx(struct mg_tcpip_if *ifp, const uint8_t *f, size_t n,
+                       void *buf, size_t len);
 
 // SPI bus abstraction for SPI-attached network chips (e.g. W5500).
 // Populate and assign to the driver's driver_data field.

src/ota.c

@@ -208,9 +208,7 @@ static void s_firmware_fn(struct mg_connection *c, int ev, void *ev_data) {
                (unsigned long) hm->body.len, (unsigned long) s_ota->size);
     } else {
       MG_DEBUG(("Beginning OTA (%lu bytes)", (unsigned long) s_ota->size));
-      if (!mg_http_stream_body(c, hm, s_firmware_cb, NULL)) {
+      mg_http_stream_body(c, hm, s_firmware_cb, NULL);
-        mg_error(c, "Cannot stream firmware");
-      }
     }
   } else if (ev == MG_EV_ERROR) {
     s_ota->fn((char *) ev_data);
@@ -243,6 +241,21 @@ void mg_ota_url_check(struct mg_mgr *mgr, const char *json_url,
   }
 }
 
+// Uses *p as a flag: non-NULL means an OTA session is open and must be
+// closed by mg_ota_end()
+bool mg_http_ota_cb(struct mg_http_message *hm, struct mg_str *data, void **p) {
+  if (hm != NULL) {  // Start
+    if (!mg_ota_begin(hm->body.len)) return false;
+    *p = (void *) (ptrdiff_t) 1;
+    return true;
+  } else if (data != NULL) {  // Next chunk
+    return mg_ota_write(data->buf, data->len);
+  }
+  if (*p == NULL) return false;  // End. Begin failed, nothing to finish
+  *p = NULL;
+  return mg_ota_end();
+}
+
 void mg_ota_poll(struct mg_mgr *mgr) {
   static uint64_t t = 5000;  // Fire first time 5 sec after boot
 

src/ota.h

@@ -26,6 +26,7 @@
 #pragma once
 
 #include "arch.h"
+#include "http.h"
 #include "net.h"
 
 // Supported OTA targets
@@ -34,6 +35,7 @@
 #define MG_OTA_STM32H7 2            // STM32 H7
 #define MG_OTA_STM32H7_DUAL_CORE 3  // STM32 H7 dual core
 #define MG_OTA_STM32F 4             // STM32 F7/F4/F2
+#define MG_OTA_STM32C5 5            // STM32 C5, same flash controller as H5
 #define MG_OTA_CH32V307 100         // WCH CH32V307
 #define MG_OTA_U2A 200              // Renesas U2A16, U2A8, U2A6
 #define MG_OTA_RT1020 300           // IMXRT1020
@@ -43,6 +45,7 @@
 #define MG_OTA_RT1170 304           // IMXRT1170
 #define MG_OTA_RT1180 305           // IMXRT1180
 #define MG_OTA_MCXN 310             // MCXN947
+#define MG_OTA_MCXW71 311           // MCXW71
 #define MG_OTA_RW612 320            // FRDM-RW612
 #define MG_OTA_FLASH 900            // OTA via internal flash
 #define MG_OTA_ESP32 910            // ESP32 OTA implementation
@@ -72,6 +75,18 @@ bool mg_ota_write(const void *buf, size_t len);
 // Ends the OTA process and commits the written firmware.
 bool mg_ota_end(void);
 
+// Push-based OTA: mg_http_stream_body() callback that flashes the request
+//
+// ```c
+// if (ev == MG_EV_HTTP_HDRS) {
+//   struct mg_http_message *hm = (struct mg_http_message *) ev_data;
+//   if (mg_match(hm->uri, mg_str("/ota"), NULL)) {
+//     mg_http_stream_body(c, hm, mg_http_ota_cb, NULL);
+//   }
+// }
+// ```
+bool mg_http_ota_cb(struct mg_http_message *hm, struct mg_str *data, void **p);
+
 // MG_OTA_ROLLBACK: swap firmware banks and reset. On flash-based OTA, the
 // default calls swap_fn() (no-op on single-bank) then resets. Override in
 // mongoose_config.h for platforms without mg_flash (ESP32, PicoSDK, etc.).

src/ota_mcxw71.c

@@ -0,0 +1,181 @@
+#include "flash.h"
+#include "log.h"
+#include "ota.h"
+
+#if MG_OTA == MG_OTA_MCXW71
+
+// MCXW71SRM, section 11.2: ROM flash API, 8 KB sectors, 16-byte phrases,
+// 128-byte pages. Only the CM33 application flash is used; RF flash and IFR
+// (including the write-once ROM configuration) are left alone.
+struct mg_mcxw71_flash_config {
+  struct {
+    uint32_t base, size, blocks;
+    uint32_t ifr_base, ifr_size;
+  } mem[2];
+};
+
+struct mg_mcxw71_flash_api {
+  uint32_t (*init)(struct mg_mcxw71_flash_config *);
+  uint32_t (*erase)(struct mg_mcxw71_flash_config *, void *, uint32_t, uint32_t,
+                    uint32_t);
+  uint32_t (*phrase)(struct mg_mcxw71_flash_config *, void *, uint32_t,
+                     uint32_t *, uint32_t);
+  uint32_t (*page)(struct mg_mcxw71_flash_config *, void *, uint32_t,
+                   uint32_t *, uint32_t);
+};
+
+// The flash API pointer is the second entry in the ROM API table.
+#define MG_MCXW71_FLASH_API \
+  (*(const struct mg_mcxw71_flash_api *const *) 0x14816fe4U)
+#define MG_MCXW71_ERASE_KEY 0x6b65666cU  // FOUR_CHAR_CODE('l', 'f', 'e', 'k')
+
+static struct mg_mcxw71_flash_config s_mcxw71_config;
+static size_t s_mcxw71_size, s_mcxw71_received, s_mcxw71_pending;
+static uint32_t s_mcxw71_buf[4];
+static bool s_mcxw71_failed;
+
+static bool mg_mcxw71_write(void *, const void *, size_t);
+static bool mg_mcxw71_swap(void);
+static struct mg_flash s_mg_flash_mcxw71 = {
+    (void *) 0, 0x100000, 8192, 16, mg_mcxw71_write, mg_mcxw71_swap};
+struct mg_flash *mg_flash = &s_mg_flash_mcxw71;
+
+// Everything called while flash is busy, or after the application has been
+// erased, must execute from RAM or ROM. Do not log or call libc here.
+MG_IRAM static bool mg_mcxw71_write(void *addr, const void *buf, size_t len) {
+  uintptr_t dst = (uintptr_t) addr;
+  const volatile uint8_t *src = (const volatile uint8_t *) buf;
+  uint32_t irq, status = 0;
+  if (dst >= s_mg_flash_mcxw71.size || len > s_mg_flash_mcxw71.size - dst ||
+      (dst % 16) != 0 || (len % 16) != 0)
+    return false;
+
+  irq = __get_PRIMASK();
+  __disable_irq();
+  while (len > 0 && status == 0) {
+    uint32_t words[32];  // ROM needs a word-aligned source in RAM
+    volatile uint8_t *p = (volatile uint8_t *) words;
+    size_t i, n = (dst % 128) == 0 && len >= 128 ? 128 : 16;
+    for (i = 0; i < n; i++) p[i] = src[i];
+
+    // Match the MCUXpresso ROM wrappers' cache maintenance. Interrupts stay
+    // masked until the flash command completes and stale cache data is gone.
+    MCM->CPCR2 |= MCM_CPCR2_CCBC_MASK;
+    __DSB();
+    __ISB();
+    if ((dst % 8192) == 0) {
+      status = MG_MCXW71_FLASH_API->erase(
+          &s_mcxw71_config, FMU0, (uint32_t) dst, 8192, MG_MCXW71_ERASE_KEY);
+    }
+    if (status == 0) {
+      if (n == 128) {
+        status = MG_MCXW71_FLASH_API->page(&s_mcxw71_config, FMU0,
+                                           (uint32_t) dst, words, 128);
+      } else {
+        status = MG_MCXW71_FLASH_API->phrase(&s_mcxw71_config, FMU0,
+                                             (uint32_t) dst, words, 16);
+      }
+    }
+    MCM->CPCR2 |= MCM_CPCR2_CCBC_MASK;
+    __DSB();
+    __ISB();
+    dst += n, src += n, len -= n;
+  }
+  __set_PRIMASK(irq);
+  return status == 0;
+}
+
+static bool mg_mcxw71_swap(void) {
+  // The common helper verifies the staged image before the RAM copy below.
+  // A failed write must never commit, even if all expected bytes arrived.
+  return !s_mcxw71_failed;
+}
+
+MG_IRAM static void mg_mcxw71_apply(size_t size) {
+  size_t ofs, half = s_mg_flash_mcxw71.size / 2;
+  __disable_irq();
+  SysTick->CTRL = 0;
+  for (ofs = 0; ofs < size; ofs += 8192) {
+    if (!mg_mcxw71_write((void *) (uintptr_t) ofs,
+                         (const void *) (uintptr_t) (half + ofs), 8192)) {
+      // The application may already be erased. Stay in RAM for debugger
+      // recovery rather than return to partially overwritten flash.
+      for (;;) __NOP();
+    }
+  }
+  __DSB();
+  SCB->AIRCR = 0x05fa0004U;
+  __DSB();
+  for (;;) __NOP();
+}
+
+bool mg_ota_begin(size_t new_firmware_size) {
+  uint32_t status;
+  if (s_mcxw71_size != 0 || new_firmware_size == 0) return false;
+  status = MG_MCXW71_FLASH_API->init(&s_mcxw71_config);
+  if (status != 0 || s_mcxw71_config.mem[0].base != 0 ||
+      s_mcxw71_config.mem[0].size < 16384 ||
+      (s_mcxw71_config.mem[0].size % 16384) != 0) {
+    MG_ERROR(("Flash init failed: %lu", (unsigned long) status));
+    return false;
+  }
+  s_mg_flash_mcxw71.size = s_mcxw71_config.mem[0].size;
+  if (!mg_ota_flash_begin(new_firmware_size, &s_mg_flash_mcxw71)) return false;
+  s_mcxw71_size = new_firmware_size;
+  s_mcxw71_received = s_mcxw71_pending = 0;
+  s_mcxw71_failed = false;
+  return true;
+}
+
+bool mg_ota_write(const void *buf, size_t len) {
+  const uint8_t *p = (const uint8_t *) buf;
+  uint8_t *pending = (uint8_t *) s_mcxw71_buf;
+  if (s_mcxw71_size == 0 || s_mcxw71_failed) return false;
+  if (len > s_mcxw71_size - s_mcxw71_received || (len > 0 && buf == NULL)) {
+    s_mcxw71_failed = true;
+    return false;
+  }
+  s_mcxw71_received += len;
+  if (s_mcxw71_pending > 0) {
+    size_t n = 16 - s_mcxw71_pending;
+    if (n > len) n = len;
+    if (n > 0) memcpy(pending + s_mcxw71_pending, p, n);
+    s_mcxw71_pending += n;
+    if (n > 0) p += n;
+    len -= n;
+    if (s_mcxw71_pending == 16) {
+      s_mcxw71_failed = !mg_ota_flash_write(pending, 16, &s_mg_flash_mcxw71);
+      s_mcxw71_pending = 0;
+    }
+  }
+  if (!s_mcxw71_failed && len >= 16) {
+    size_t n = MG_ROUND_DOWN(len, 16);
+    s_mcxw71_failed = !mg_ota_flash_write(p, n, &s_mg_flash_mcxw71);
+    p += n, len -= n;
+  }
+  if (!s_mcxw71_failed && len > 0) {
+    memcpy(pending + s_mcxw71_pending, p, len);
+    s_mcxw71_pending += len;
+  }
+  return !s_mcxw71_failed;
+}
+
+bool mg_ota_end(void) {
+  bool ok;
+  size_t size = s_mcxw71_size;
+  if (size == 0) return false;
+  if (s_mcxw71_received != size) s_mcxw71_failed = true;
+  if (!s_mcxw71_failed && s_mcxw71_pending > 0) {
+    s_mcxw71_failed =
+        !mg_ota_flash_write(s_mcxw71_buf, s_mcxw71_pending, &s_mg_flash_mcxw71);
+  }
+  ok = mg_ota_flash_end(&s_mg_flash_mcxw71);
+  s_mcxw71_size = s_mcxw71_pending = 0;
+  if (ok) {
+    MG_INFO(("Applying %lu bytes from staging flash", (unsigned long) size));
+    mg_mcxw71_apply(size);
+  }
+  return false;
+}
+
+#endif

src/ota_stm32h5.c

@@ -2,7 +2,7 @@
 #include "log.h"
 #include "ota.h"
 
-#if MG_OTA == MG_OTA_STM32H5
+#if MG_OTA == MG_OTA_STM32H5 || MG_OTA == MG_OTA_STM32C5
 
 static bool mg_stm32h5_write(void *, const void *, size_t);
 static bool mg_stm32h5_swap(void);

src/printf.c

@@ -71,8 +71,10 @@ char *mg_mprintf(const char *fmt, ...) {
 }
 
 void mg_pfn_stdout(char c, void *param) {
+#if MG_ENABLE_POSIX_FS
   putchar(c);
-  (void) param;
+#endif
+  (void) param, (void) c;
 }
 
 static size_t print_ip4(void (*out)(char, void *), void *arg, uint8_t *p) {

src/sntp.h

@@ -29,7 +29,6 @@ uint64_t mg_now(void);
 //     MG_INFO(("every second"));
 //   }
 // Full examples:
-//   tutorials/http/http-server/arduino/teensy41-http,
 //   tutorials/mqtt/mqtt-client
 // Related APIs:
 //   mg_millis(), mg_now()

src/sock.c

@@ -299,7 +299,11 @@ static long recv_raw(struct mg_connection *c, void *buf, size_t len) {
     union usa usa;
     socklen_t slen = tousa(&c->rem, &usa);
     n = recvfrom(FD(c), (char *) buf, len, 0, &usa.sa, &slen);
-    if (n > 0) tomgaddr(&usa, &c->rem, slen != sizeof(usa.sin));
+    if (n > 0) {
+      struct mg_addr rem;
+      tomgaddr(&usa, &rem, slen != sizeof(usa.sin));
+      c->rem = rem;
+    }
   } else {
     n = recv(FD(c), (char *) buf, len, MSG_NONBLOCKING);
   }

src/tls.h

@@ -90,7 +90,7 @@ void mg_tls_ctx_free(struct mg_mgr *);
 #if MG_TLS == MG_TLS_BUILTIN
 // Extracts a 32-byte P-256 private scalar from EC PRIVATE KEY or PKCS#8 PRIVATE
 // KEY input. Accepts PEM or DER. Returns key size, or 0 on error.
-size_t mg_uecc_parse_private_key(struct mg_str key, uint8_t *buf, size_t len);
+size_t mg_p256_parse_private_key(struct mg_str key, uint8_t *buf, size_t len);
 #endif
 
 // Low-level IO primitives used by TLS layer

src/tls_builtin.c

@@ -6,8 +6,8 @@
 #include "tls_aes128.h"
 #include "tls_chacha20.h"
 #include "tls_rsa.h"
-#include "tls_uecc.h"
+#include "tls_p256.h"
-#include "tls_x25519.h"
+#include "tls_p384.h"
 #include "util.h"
 
 #if MG_TLS == MG_TLS_BUILTIN
@@ -61,6 +61,7 @@ enum mg_tls_hs_state {
 
   // Server state machine:
   MG_TLS_STATE_SERVER_START,       // Wait for ClientHello
+  MG_TLS_STATE_SERVER_RETRY,       // Wait for ClientHello after HelloRetry
   MG_TLS_STATE_SERVER_WAIT_CERT,   // Wait for Certificate
   MG_TLS_STATE_SERVER_WAIT_CV,     // Wait for CertificateVerify
   MG_TLS_STATE_SERVER_NEGOTIATED,  // Wait for Finish
@@ -106,9 +107,9 @@ struct tls_data {
 
   uint8_t random[32];      // client random from ClientHello
   uint8_t session_id[32];  // client session ID between the handshake states
-  uint8_t x25519_cli[32];  // client X25519 key between the handshake states
   uint8_t p256_cli[32];    // client P-256 key between the handshake states
-  uint8_t x25519_sec[32];  // ECDHE secret (X25519 or P-256) between the states
+  uint8_t p256_peer[64];   // server: client P-256 public key X || Y
+  uint8_t ecdhe_sec[32];   // P-256 ECDHE shared secret between the states
 
   bool skip_verification;    // do not perform checks on server certificate
   bool cert_requested;       // client received a CertificateRequest
@@ -132,6 +133,8 @@ struct tls_data {
   size_t pubkeysz;           // size of the server public key
   uint8_t sighash[32];       // calculated signature verification hash
   uint8_t sighash384[48];    // same, SHA-384, for ecdsa_secp384r1_sha384
+  uint64_t hs_start;         // mg_millis() when the handshake started
+  uint64_t hs_proc;          // ms spent processing handshake messages
 
   struct tls_enc enc;       // actual keys in use at this time
   struct tls_enc app_keys;  // storage during two-way auth handshake
@@ -323,7 +326,7 @@ static void mg_tls_derive_secret(const char *label, uint8_t *key, size_t keysz,
   memmove(hash, secret, hashsz);
 }
 
-// at this point we have x25519 shared secret, we can generate a set of derived
+// at this point we have ECDHE shared secret, we can generate a set of derived
 // handshake encryption keys
 static void mg_tls_generate_handshake_keys(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
@@ -344,12 +347,11 @@ static void mg_tls_generate_handshake_keys(struct mg_connection *c) {
   mg_tls_derive_secret("tls13 derived", early_secret, 32, zeros_sha256_digest,
                        32, pre_extract_secret, 32);
   mg_hmac_sha256(tls->enc.handshake_secret, pre_extract_secret,
-                 sizeof(pre_extract_secret), tls->x25519_sec,
+                 sizeof(pre_extract_secret), tls->ecdhe_sec,
-                 sizeof(tls->x25519_sec));
+                 sizeof(tls->ecdhe_sec));
   // ECDHE keys and secret are not needed anymore, wipe for forward secrecy
-  mg_bzero(tls->x25519_cli, sizeof(tls->x25519_cli));
   mg_bzero(tls->p256_cli, sizeof(tls->p256_cli));
-  mg_bzero(tls->x25519_sec, sizeof(tls->x25519_sec));
+  mg_bzero(tls->ecdhe_sec, sizeof(tls->ecdhe_sec));
   mg_tls_hexdump("hs secret", tls->enc.handshake_secret, 32);
 
   // mg_sha256_final is not idempotent, need to copy sha256 context to calculate
@@ -467,7 +469,7 @@ static bool mg_tls_encrypt(struct mg_connection *c, const uint8_t *msg,
       c->is_client ? tls->enc.client_write_iv : tls->enc.server_write_iv;
 
   if (msgsz > 16384) {
-    MG_ERROR(("msg longer than recordsz"));
+    mg_error(c, "msg longer than recordsz");
     return false;
   }
 
@@ -512,19 +514,20 @@ static bool mg_tls_encrypt(struct mg_connection *c, const uint8_t *msg,
 
 static void verbose_alert(uint8_t *buf) {
   uint8_t level = buf[0], desc = buf[1];
-  MG_INFO(("TLS ALERT received: level=%d, desc=%d (%s)", level, desc,
+  MG_LOG(desc == 0 ? MG_LL_VERBOSE : MG_LL_INFO,  // close_notify is normal
-           desc == 0    ? "close_notify"
+         ("TLS ALERT received: level=%d, desc=%d (%s)", level, desc,
-           : desc == 10 ? "unexpected_message"
+          desc == 0    ? "close_notify"
-           : desc == 20 ? "bad_record_mac"
+          : desc == 10 ? "unexpected_message"
-           : desc == 21 ? "decryption_failed"
+          : desc == 20 ? "bad_record_mac"
-           : desc == 40 ? "handshake_failure"
+          : desc == 21 ? "decryption_failed"
-           : desc == 42 ? "bad_certificate"
+          : desc == 40 ? "handshake_failure"
-           : desc == 43 ? "unsupported_certificate"
+          : desc == 42 ? "bad_certificate"
-           : desc == 44 ? "certificate_revoked"
+          : desc == 43 ? "unsupported_certificate"
-           : desc == 45 ? "certificate_expired"
+          : desc == 44 ? "certificate_revoked"
-           : desc == 46 ? "certificate_unknown"
+          : desc == 45 ? "certificate_expired"
-           : desc == 48 ? "unknown_ca"
+          : desc == 46 ? "certificate_unknown"
-                        : "unknown"));
+          : desc == 48 ? "unknown_ca"
+                       : "unknown"));
 }
 
 // read an encrypted record, decrypt it in place
@@ -659,7 +662,8 @@ static void mg_tls_calc_cert_verify_hash(struct mg_connection *c,
   if (hash384 != NULL) mg_sha384(hash384, sig_content, sizeof(sig_content));
 }
 
-// read and parse ClientHello record
+// read and parse ClientHello record. Return 0 if it has a P-256 key share,
+// 1 if it does not and HelloRetryRequest must be sent, negative otherwise
 static int mg_tls_server_recv_hello(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   struct mg_iobuf *rio = &c->rtls;
@@ -669,9 +673,13 @@ static int mg_tls_server_recv_hello(struct mg_connection *c) {
   uint16_t ext_len;
   uint8_t *ext;
   uint16_t msgsz;
+  bool have_p256 = false;
+  bool is_retry = tls->state == MG_TLS_STATE_SERVER_RETRY;
 
-  if (!mg_tls_got_record(c)) {
+  for (;;) {
-    return MG_IO_WAIT;
+    if (!mg_tls_got_record(c)) return MG_IO_WAIT;
+    if (!is_retry || rio->buf[0] != MG_TLS_CHANGE_CIPHER) break;
+    mg_tls_drop_record(c);  // compatibility mode CCS before 2nd ClientHello
   }
   if (rio->buf[0] != MG_TLS_HANDSHAKE || rio->buf[5] != MG_TLS_CLIENT_HELLO) {
     mg_error(c, "not a client hello packet");
@@ -715,16 +723,21 @@ static int mg_tls_server_recv_hello(struct mg_connection *c) {
       goto fail;
     for (k = 0; k < key_exchange_len;) {
       uint16_t m = MG_LOAD_BE16(key_exchange + k + 2);
+      uint16_t group = MG_LOAD_BE16(key_exchange + k);
       if (((uint32_t) m + k + 4) > key_exchange_len) goto fail;
-      if (m == 32 && key_exchange[k] == 0x00 && key_exchange[k + 1] == 0x1d) {
+      // secp256r1, uncompressed point 0x04 || X || Y
-        memmove(tls->x25519_cli, key_exchange + k + 4, m);
+      if (group == 0x0017 && m == 65 && key_exchange[k + 4] == 0x04) {
-        mg_tls_drop_record(c);
+        memmove(tls->p256_peer, key_exchange + k + 5, 64);
-        return 0;
+        have_p256 = true;
       }
       k += (uint16_t) (m + 4);
     }
     j += (uint16_t) (n + 4);
   }
+  if (have_p256 || !is_retry) {  // No P-256 share: ask for it, but only once
+    mg_tls_drop_record(c);
+    return have_p256 ? 0 : 1;
+  }
 fail:
   mg_error(c, "bad client hello");
   return -1;
@@ -738,58 +751,98 @@ fail:
 static bool mg_tls_server_send_hello(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   struct mg_iobuf *wio = &tls->send;
+  uint8_t hello[155], pub[65], prv[32], hdr[5] = {0x16, 0x03, 0x03, 0, 0};
+  size_t n = sizeof(hello);  // ServerHello length, including 4-byte header
 
-  // clang-format off
+  // calculate P-256 keyshare and the shared secret
-  uint8_t msg_server_hello[122] = {
+  pub[0] = 0x04;  // uncompressed point 0x04 || X || Y
-      // server hello, tls 1.2
+  if (!mg_p256_make_key(pub + 1, prv) ||
-      0x02, 0x00, 0x00, 0x76, 0x03, 0x03,
+      !mg_p256_shared_secret(tls->p256_peer, prv, tls->ecdhe_sec)) {
-      // random (32 bytes)
+    mg_bzero(prv, sizeof(prv));
-      PLACEHOLDER_32B,
-      // session ID length + session ID (32 bytes)
-      0x20, PLACEHOLDER_32B,
-#if MG_ENABLE_CHACHA20
-      // TLS_CHACHA20_POLY1305_SHA256 + no compression
-      0x13, 0x03, 0x00,
-#else
-      // TLS_AES_128_GCM_SHA256 + no compression
-      0x13, 0x01, 0x00,
-#endif
-      // extensions + keyshare
-      0x00, 0x2e, 0x00, 0x33, 0x00, 0x24, 0x00, 0x1d, 0x00, 0x20,
-      // x25519 keyshare
-      PLACEHOLDER_32B,
-      // supported versions (tls1.3 == 0x304)
-      0x00, 0x2b, 0x00, 0x02, 0x03, 0x04};
-  // clang-format on
-
-  // calculate keyshare
-  uint8_t x25519_pub[X25519_BYTES];
-  uint8_t x25519_prv[X25519_BYTES];
-  if (!mg_random(x25519_prv, sizeof(x25519_prv))) mg_error(c, "RNG");
-  if( mg_tls_x25519(x25519_pub, x25519_prv, X25519_BASE_POINT, 1) < 0 || mg_tls_x25519(tls->x25519_sec, x25519_prv, tls->x25519_cli, 1) < 0) {
     mg_error(c, "bad key");
     return false;
   }
-  mg_tls_hexdump("s x25519 sec", tls->x25519_sec, sizeof(tls->x25519_sec));
+  mg_bzero(prv, sizeof(prv));
+  mg_tls_hexdump("s ecdhe sec", tls->ecdhe_sec, sizeof(tls->ecdhe_sec));
 
-  // fill in the gaps: random + session ID + keyshare
+  hello[0] = 0x02;  // server hello, tls 1.2
-  memmove(msg_server_hello + 6, tls->random, sizeof(tls->random));
+  MG_STORE_BE24(hello + 1, n - 4);
-  memmove(msg_server_hello + 39, tls->session_id, sizeof(tls->session_id));
+  hello[4] = 0x03, hello[5] = 0x03;
-  memmove(msg_server_hello + 84, x25519_pub, sizeof(x25519_pub));
+  if (!mg_random(hello + 6, 32)) {  // server random, RFC 8446 4.1.3
+    mg_error(c, "RNG");
+    return false;
+  }
+  hello[38] = 0x20;  // session ID length + session ID (32 bytes)
+  memmove(hello + 39, tls->session_id, sizeof(tls->session_id));
+#if MG_ENABLE_CHACHA20
+  hello[71] = 0x13, hello[72] = 0x03;  // TLS_CHACHA20_POLY1305_SHA256
+#else
+  hello[71] = 0x13, hello[72] = 0x01;  // TLS_AES_128_GCM_SHA256
+#endif
+  hello[73] = 0x00;                      // no compression
+  MG_STORE_BE16(hello + 74, 65 + 14);    // extensions length
+  MG_STORE_BE16(hello + 76, 0x0033);     // key share
+  MG_STORE_BE16(hello + 78, 65 + 4);
+  MG_STORE_BE16(hello + 80, 0x0017);     // secp256r1
+  MG_STORE_BE16(hello + 82, 65);
+  memmove(hello + 84, pub, sizeof(pub));
+  memmove(hello + 149, "\x00\x2b\x00\x02\x03\x04", 6);  // tls1.3 == 0x304
+  MG_STORE_BE16(hdr + 3, n);
 
   // server hello message
-  if (mg_iobuf_add(wio, wio->len, "\x16\x03\x03\x00\x7a", 5) == 0 ||
+  if (mg_iobuf_add(wio, wio->len, hdr, sizeof(hdr)) == 0 ||
-      mg_iobuf_add(wio, wio->len, msg_server_hello, sizeof(msg_server_hello)) ==
+      mg_iobuf_add(wio, wio->len, hello, n) == 0)
-          0)
     return false;
-  mg_sha256_update(&tls->sha256, msg_server_hello, sizeof(msg_server_hello));
+  mg_sha256_update(&tls->sha256, hello, n);
 
-  // change cipher message
+  // change cipher message, unless it was already sent after HelloRetryRequest
-  if (mg_iobuf_add(wio, wio->len, "\x14\x03\x03\x00\x01\x01", 6) == 0)
+  if (tls->state != MG_TLS_STATE_SERVER_RETRY &&
+      mg_iobuf_add(wio, wio->len, "\x14\x03\x03\x00\x01\x01", 6) == 0)
     return false;
   return true;
 }
 
+// HelloRetryRequest random, SHA-256 of "HelloRetryRequest", RFC 8446 4.1.3
+static const uint8_t hrr_random[32] = {
+    0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c,
+    0x02, 0x1e, 0x65, 0xb8, 0x91, 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb,
+    0x8c, 0x5e, 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c};
+
+// put HelloRetryRequest record into wio buffer, asking for a P-256 key share.
+// Replace ClientHello in the transcript with message_hash, RFC 8446 4.4.1
+static bool mg_tls_server_send_hrr(struct mg_connection *c) {
+  struct tls_data *tls = (struct tls_data *) c->tls;
+  struct mg_iobuf *wio = &tls->send;
+  uint8_t hrr[88], hdr[5] = {0x16, 0x03, 0x03, 0, sizeof(hrr)};
+  uint8_t mh[4 + 32] = {0xfe, 0, 0, 32};  // message_hash(ClientHello1)
+
+  hrr[0] = 0x02;  // server hello, tls 1.2
+  MG_STORE_BE24(hrr + 1, sizeof(hrr) - 4);
+  hrr[4] = 0x03, hrr[5] = 0x03;
+  memmove(hrr + 6, hrr_random, sizeof(hrr_random));
+  hrr[38] = 0x20;  // session ID length + session ID (32 bytes)
+  memmove(hrr + 39, tls->session_id, sizeof(tls->session_id));
+#if MG_ENABLE_CHACHA20
+  hrr[71] = 0x13, hrr[72] = 0x03;  // TLS_CHACHA20_POLY1305_SHA256
+#else
+  hrr[71] = 0x13, hrr[72] = 0x01;  // TLS_AES_128_GCM_SHA256
+#endif
+  hrr[73] = 0x00;  // no compression
+  // extensions: supported versions tls1.3, key share secp256r1 (group only)
+  memmove(hrr + 74, "\x00\x0c\x00\x2b\x00\x02\x03\x04\x00\x33\x00\x02\x00\x17",
+          14);
+
+  mg_sha256_final(mh + 4, &tls->sha256);
+  mg_sha256_init(&tls->sha256);
+  mg_sha256_update(&tls->sha256, mh, sizeof(mh));
+  mg_sha256_update(&tls->sha256, hrr, sizeof(hrr));
+
+  // HelloRetryRequest message, followed by change cipher message
+  return mg_iobuf_add(wio, wio->len, hdr, sizeof(hdr)) != 0 &&
+         mg_iobuf_add(wio, wio->len, hrr, sizeof(hrr)) != 0 &&
+         mg_iobuf_add(wio, wio->len, "\x14\x03\x03\x00\x01\x01", 6) != 0;
+}
+
 static bool mg_tls_server_send_ext(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   // server extensions
@@ -799,14 +852,10 @@ static bool mg_tls_server_send_ext(struct mg_connection *c) {
 }
 
 // signature algorithms we actually support: ecdsa_secp256r1_sha256,
-// ecdsa_secp384r1_sha384 (if enabled), rsa_pss_rsae_sha256, rsa_pkcs1_sha256
+// ecdsa_secp384r1_sha384, rsa_pss_rsae_sha256, rsa_pkcs1_sha256
 static const uint8_t secp256r1_sig_algs[] = {
-#if MG_UECC_SUPPORTS_secp384r1
     0x00, 0x0d, 0x00, 0x0a, 0x00, 0x08, 0x04, 0x03,
     0x05, 0x03, 0x08, 0x04, 0x04, 0x01};
-#else
-    0x00, 0x0d, 0x00, 0x08, 0x00, 0x06, 0x04, 0x03, 0x08, 0x04, 0x04, 0x01};
-#endif
 
 static bool mg_tls_server_send_cert_request(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
@@ -878,28 +927,6 @@ static bool mg_tls_send_cert(struct mg_connection *c, bool is_client) {
   return res;
 }
 
-// type adapter between uECC hash context and our sha256 implementation
-typedef struct SHA256_HashContext {
-  MG_UECC_HashContext uECC;
-  mg_sha256_ctx ctx;
-} SHA256_HashContext;
-
-static void init_SHA256(const MG_UECC_HashContext *base) {
-  SHA256_HashContext *c = (SHA256_HashContext *) base;
-  mg_sha256_init(&c->ctx);
-}
-
-static void update_SHA256(const MG_UECC_HashContext *base,
-                          const uint8_t *message, unsigned message_size) {
-  SHA256_HashContext *c = (SHA256_HashContext *) base;
-  mg_sha256_update(&c->ctx, message, message_size);
-}
-static void finish_SHA256(const MG_UECC_HashContext *base,
-                          uint8_t *hash_result) {
-  SHA256_HashContext *c = (SHA256_HashContext *) base;
-  mg_sha256_final(hash_result, &c->ctx);
-}
-
 static void mg_tls_mgf1(uint8_t *mask, size_t mask_len, const uint8_t *seed,
                         size_t seed_len) {
   uint32_t counter = 0;
@@ -1103,19 +1130,19 @@ static bool mg_tls_send_cert_verify(struct mg_connection *c, bool is_client) {
 
     // Check bounds
     if (emlen > sizeof(em) || verifysz > sizeof(verify)) {
-      MG_ERROR(("RSA key too large for static buffers"));
+      mg_error(c, "RSA key too large for static buffers");
       return false;
     }
 
     if (!mg_tls_pss_encode(hash, sizeof(hash), &rn, em)) {
-      MG_ERROR(("Failed PSS encode"));
+      mg_error(c, "Failed PSS encode");
       return false;
     }
 
     // Validate PSS encoded message format
     if (em[emlen - 1] != 0xbc) {
-      MG_ERROR(("Invalid PSS encoding: last byte is 0x%02x, expected 0xbc",
+      mg_error(c, "Invalid PSS encoding: last byte is 0x%02x, expected 0xbc",
-                em[emlen - 1]));
+                em[emlen - 1]);
       return false;
     }
 
@@ -1128,7 +1155,7 @@ static bool mg_tls_send_cert_verify(struct mg_connection *c, bool is_client) {
     // Sign directly into the verify buffer (verify + 8 = signature location)
     memset(verify + 8, 0, emlen);  // Initialize signature area
     if (!mg_tls_rsa_sign(tls, em, emlen, verify + 8)) {
-      MG_ERROR(("Failed RSA sign"));
+      mg_error(c, "Failed RSA sign");
       return false;
     }
 
@@ -1142,15 +1169,13 @@ static bool mg_tls_send_cert_verify(struct mg_connection *c, bool is_client) {
   } else {
     // EC certificate verify packet
     uint8_t verify[82] = {0x0f, 0x00, 0x00, 0x00, 0x04, 0x03, 0x00, 0x00};
-    uint8_t tmp[2 * 32 + 64] = {0};
-    struct SHA256_HashContext ctx = {
-        {&init_SHA256, &update_SHA256, &finish_SHA256, 64, 32, tmp},
-        {{0}, 0, 0, {0}}};
     size_t sigsz, verifysz = 0;
     int neg1, neg2;
     uint8_t sig[64] = {0};
-    mg_uecc_sign_deterministic(tls->ec_key, hash, sizeof(hash), &ctx.uECC, sig,
+    if (!mg_p256_sign(tls->ec_key, hash, sizeof(hash), sig)) {
-                               mg_uecc_secp256r1());
+      mg_error(c, "P-256 sign");
+      return false;
+    }
 
     neg1 = !!(sig[0] & 0x80);
     neg2 = !!(sig[32] & 0x80);
@@ -1213,9 +1238,6 @@ static bool mg_tls_client_send_hello(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   struct mg_iobuf *wio = &tls->send;
 
-  uint8_t x25519_pub[X25519_BYTES];
-  uint8_t p256_pub[64];  // X || Y, sent as an uncompressed point 0x04 || X || Y
-
   // - "signature algorithms we actually support", see above
   //   uint8_t secp256r1_sig_algs[]
   // - all popular signature algorithms (if we don't care about verification)
@@ -1227,11 +1249,11 @@ static bool mg_tls_client_send_hello(struct mg_connection *c) {
                                 0xfe, 0x00, 0x00, 0xfe};
 
   // clang-format off
-  uint8_t msg_client_hello[216] = {
+  uint8_t msg_client_hello[178] = {
       // TLS Client Hello header reported as TLS1.2 (5)
-      0x16, 0x03, 0x03, 0x00, 0xfe,
+      0x16, 0x03, 0x03, 0x00, 0xd8,
       // client hello, tls 1.2 (6)
-      0x01, 0x00, 0x00, 0x8c, 0x03, 0x03,
+      0x01, 0x00, 0x00, 0xd4, 0x03, 0x03,
       // random (32 bytes)
       PLACEHOLDER_32B,
       // session ID length + session ID (32 bytes)
@@ -1248,17 +1270,15 @@ static bool mg_tls_client_send_hello(struct mg_connection *c) {
       0x01, 0x00,
       // extensions + keyshare
       0x00, 0xfe,
-      // keyshare: x25519
-      0x00, 0x33, 0x00, 0x6b, 0x00, 0x69, 0x00, 0x1d, 0x00, 0x20,
-      PLACEHOLDER_32B,
       // keyshare: secp256r1, uncompressed point
+      0x00, 0x33, 0x00, 0x47, 0x00, 0x45,
       0x00, 0x17, 0x00, 0x41, 0x04, PLACEHOLDER_32B, PLACEHOLDER_32B,
-      // supported groups (x25519, secp256r1)
+      // supported groups (secp256r1)
-      0x00, 0x0a, 0x00, 0x06, 0x00, 0x04, 0x00, 0x1d, 0x00, 0x17,
+      0x00, 0x0a, 0x00, 0x04, 0x00, 0x02, 0x00, 0x17,
       // supported versions (tls1.3 == 0x304)
       0x00, 0x2b, 0x00, 0x03, 0x02, 0x03, 0x04,
       // session ticket (none)
-      0x00, 0x23, 0x00, 0x00, // 215 bytes till here
+      0x00, 0x23, 0x00, 0x00, // 177 bytes till here
 	};
   // clang-format on
   const char *hostname = tls->hostname;
@@ -1271,11 +1291,11 @@ static bool mg_tls_client_send_hello(struct mg_connection *c) {
 
   // patch ClientHello with correct hostname ext length (if any)
   MG_STORE_BE16(msg_client_hello + 3,
-                hostname_extsz + 254 - 9 - 34 + sig_alg_sz);
+                hostname_extsz + 216 - 9 - 34 + sig_alg_sz);
   MG_STORE_BE16(msg_client_hello + 7,
-                hostname_extsz + 250 - 9 - 34 + sig_alg_sz);
+                hostname_extsz + 212 - 9 - 34 + sig_alg_sz);
   MG_STORE_BE16(msg_client_hello + 82,
-                hostname_extsz + 175 - 9 - 34 + sig_alg_sz);
+                hostname_extsz + 137 - 9 - 34 + sig_alg_sz);
 
   if (hostnamesz > 0) {
     MG_STORE_BE16(server_name_ext + 2, hostnamesz + 5);
@@ -1283,21 +1303,20 @@ static bool mg_tls_client_send_hello(struct mg_connection *c) {
     MG_STORE_BE16(server_name_ext + 7, hostnamesz);
   }
 
-  // calculate keyshares
+  // calc+fill keyshare; X || Y, sent as an uncompressed point 0x04 || X || Y
-  if (!mg_random(tls->x25519_cli, sizeof(tls->x25519_cli))) mg_error(c, "RNG");
+  if (!mg_p256_make_key(msg_client_hello + 95, tls->p256_cli)) {
-  mg_tls_x25519(x25519_pub, tls->x25519_cli, X25519_BASE_POINT, 1);
-  if (!mg_uecc_make_key(p256_pub, tls->p256_cli, mg_uecc_secp256r1())) {
     mg_error(c, "P-256 key");
-    return false;  // Do not send uninitialised p256_pub
+    return false;
   }
 
-  // fill in the gaps: random + session ID + keyshares
+  // fill in the gaps: random + session ID
-  if (!mg_random(tls->session_id, sizeof(tls->session_id))) mg_error(c, "RNG");
+  if (!mg_random(tls->session_id, sizeof(tls->session_id)) ||
-  if (!mg_random(tls->random, sizeof(tls->random))) mg_error(c, "RNG");
+      !mg_random(tls->random, sizeof(tls->random))) {
+    mg_error(c, "RNG");
+    return false;
+  }
   memmove(msg_client_hello + 11, tls->random, sizeof(tls->random));
   memmove(msg_client_hello + 44, tls->session_id, sizeof(tls->session_id));
-  memmove(msg_client_hello + 94, x25519_pub, sizeof(x25519_pub));
-  memmove(msg_client_hello + 131, p256_pub, sizeof(p256_pub));
 
   // client hello message
   if (mg_iobuf_add(wio, wio->len, msg_client_hello, sizeof(msg_client_hello)) ==
@@ -1370,26 +1389,17 @@ static int mg_tls_client_recv_hello(struct mg_connection *c) {
     key_exchange_len = MG_LOAD_BE16(ext + j + 6);
     key_exchange = ext + j + 8;
     if (key_exchange_len > ext_len2 - 4) goto fail;
-    if (group == 0x001d) {  // x25519
+    if (group != 0x0017) {  // secp256r1, uncompressed point 0x04 || X || Y
-      if (key_exchange_len != 32 ||
-          mg_tls_x25519(tls->x25519_sec, tls->x25519_cli, key_exchange, 1) <
-              0) {
-        mg_error(c, "bad key");
-        return -1;
-      }
-    } else if (group == 0x0017) {  // secp256r1, uncompressed point 0x04 || X || Y
-      if (key_exchange_len != 65 || key_exchange[0] != 0x04 ||
-          !mg_uecc_valid_public_key(key_exchange + 1, mg_uecc_secp256r1()) ||
-          !mg_uecc_shared_secret(key_exchange + 1, tls->p256_cli,
-                                 tls->x25519_sec, mg_uecc_secp256r1())) {
-        mg_error(c, "bad key");
-        return -1;
-      }
-    } else {
       mg_error(c, "bad key exchange group");
       return -1;
     }
-    // mg_tls_hexdump("c ecdhe sec", tls->x25519_sec, 32);
+    if (key_exchange_len != 65 || key_exchange[0] != 0x04 ||
+        !mg_p256_shared_secret(key_exchange + 1, tls->p256_cli,
+                               tls->ecdhe_sec)) {  // Validates the point
+      mg_error(c, "bad key");
+      return -1;
+    }
+    // mg_tls_hexdump("c ecdhe sec", tls->ecdhe_sec, 32);
     mg_tls_drop_record(c);
     /* generate handshake keys */
     mg_tls_generate_handshake_keys(c);
@@ -1714,7 +1724,6 @@ static int mg_tls_verify_cert_signature(const struct mg_tls_cert *cert,
       MG_ERROR(("cert verification error"));
       return 0;
     }
-#if MG_UECC_SUPPORTS_secp256r1
     if (issuer->pubkey.len == 64) {
       const uint32_t N = 32;
       if (a.len > N) a.value += (a.len - N), a.len = N; // padding
@@ -1723,13 +1732,9 @@ static int mg_tls_verify_cert_signature(const struct mg_tls_cert *cert,
       memmove(sig + (N - a.len), a.value, a.len);
       memset(sig + N, 0, N - b.len);
       memmove(sig + N + (N - b.len), b.value, b.len);
-      return mg_uecc_verify((uint8_t *) issuer->pubkey.buf, cert->tbshash,
+      return mg_p256_verify((uint8_t *) issuer->pubkey.buf, cert->tbshash,
-                            (unsigned) cert->tbshashsz, sig,
+                            cert->tbshashsz, sig);
-                            mg_uecc_secp256r1());
+    } else if (issuer->pubkey.len == 96) {
-    } else
-#endif
-#if MG_UECC_SUPPORTS_secp384r1
-    if (issuer->pubkey.len == 96) {
       const uint32_t N = 48;
       if (a.len > N) a.value += (a.len - N), a.len = N;  // padding
       if (b.len > N) b.value += (b.len - N), b.len = N;
@@ -1737,12 +1742,9 @@ static int mg_tls_verify_cert_signature(const struct mg_tls_cert *cert,
       memmove(sig + (N - a.len), a.value, a.len);
       memset(sig + N, 0, N - b.len);
       memmove(sig + N + (N - b.len), b.value, b.len);
-      return mg_uecc_verify((uint8_t *) issuer->pubkey.buf, cert->tbshash,
+      return mg_p384_verify((uint8_t *) issuer->pubkey.buf, cert->tbshash,
-                            (unsigned) cert->tbshashsz, sig,
+                            cert->tbshashsz, sig);
-                            mg_uecc_secp384r1());
+    } else {
-    } else
-#endif
-    {
       MG_ERROR(("unsupported public key length: %d", issuer->pubkey.len));
       return 0;
     }
@@ -1931,6 +1933,18 @@ static int mg_tls_recv_cert(struct mg_connection *c, bool is_client) {
         }  // else r = 0 or -2 => subj not found or pubkey not matching
       }
 
+      // Single CA: accept the chain if the CA itself is in it, e.g. a
+      // cross-signed copy of the root. Same subject and same public key
+      // means the same trusted key, and the links below ci are verified
+      if (tls->ca_der.len > 0 && ca.subj.len == ci->subj.len &&
+          memcmp(ca.subj.value, ci->subj.value, ca.subj.len) == 0 &&
+          ca.pubkey.len == ci->pubkey.len &&
+          memcmp(ca.pubkey.buf, ci->pubkey.buf, ca.pubkey.len) == 0) {
+        found_ca = true;
+        MG_VERBOSE(("CA found in chain at depth %d", certnum - 1));
+        break;
+      }
+
       if (certnum == sizeof(certs) / sizeof(certs[0]) - 1) {
         mg_error(c, "too many certificates in the chain");
         return -1;
@@ -2028,8 +2042,7 @@ static int mg_tls_recv_cert_verify(struct mg_connection *c) {
         return -1;
       }
       MG_VERBOSE(("certificate verification successful (RSA)"));
-    } else if (sigalg == 0x0403 ||
+    } else if (sigalg == 0x0403 || sigalg == 0x0503) {
-               (sigalg == 0x0503 && MG_UECC_SUPPORTS_secp384r1)) {
       // ecdsa_secp256r1_sha256 or ecdsa_secp384r1_sha384. Extract certificate
       // signature and verify it using pubkey and sighash
       bool is384 = sigalg == 0x0503;
@@ -2062,15 +2075,12 @@ static int mg_tls_recv_cert_verify(struct mg_connection *c) {
       memmove(sig + (N - r.len), r.value, r.len);
       memmove(sig + N + (N - s.len), s.value, s.len);
 
-#if MG_UECC_SUPPORTS_secp384r1
       if (is384) {
-        ok = mg_uecc_verify(tls->pubkey, tls->sighash384,
+        ok = mg_p384_verify(tls->pubkey, tls->sighash384,
-                            sizeof(tls->sighash384), sig, mg_uecc_secp384r1());
+                            sizeof(tls->sighash384), sig);
-      } else
+      } else {
-#endif
+        ok = mg_p256_verify(tls->pubkey, tls->sighash, sizeof(tls->sighash),
-      {
+                            sig);
-        ok = mg_uecc_verify(tls->pubkey, tls->sighash, sizeof(tls->sighash),
-                            sig, mg_uecc_secp256r1());
       }
       if (ok != 1) {
         mg_error(c, "failed to verify EC certificate (certverify)");
@@ -2087,8 +2097,8 @@ static int mg_tls_recv_cert_verify(struct mg_connection *c) {
       //   0809 = rsa_pss_pss_sha256
       //   080A = rsa_pss_pss_sha384
       //   080B = rsa_pss_pss_sha512
-      MG_ERROR(("unsupported certverify signature scheme: %x of %d bytes",
+      mg_error(c, "unsupported certverify signature scheme: %x of %d bytes",
-                sigalg, siglen));
+                sigalg, siglen);
       return -1;
     }
   }
@@ -2174,16 +2184,23 @@ static bool mg_tls_client_handshake(struct mg_connection *c) {
 
 static bool mg_tls_server_handshake(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
+  int r;
   switch (tls->state) {
     case MG_TLS_STATE_SERVER_START:
-      if (mg_tls_server_recv_hello(c) < 0) break;
+    case MG_TLS_STATE_SERVER_RETRY:
+      if ((r = mg_tls_server_recv_hello(c)) < 0) break;
+      if (r == 1) {  // No P-256 key share, ask for it
+        if (!mg_tls_server_send_hrr(c)) return false;
+        tls->state = MG_TLS_STATE_SERVER_RETRY;
+        break;
+      }
       if (!mg_tls_server_send_hello(c)) return false;
       mg_tls_generate_handshake_keys(c);
       if (!mg_tls_server_send_ext(c)) return false;
       if (tls->is_twoway && !mg_tls_server_send_cert_request(c)) return false;
-      if (!mg_tls_send_cert(c, false) || !mg_tls_send_cert_verify(c, false) ||
+      if (!mg_tls_send_cert(c, false)) return false;
-          !mg_tls_server_send_finish(c))
+      if (!mg_tls_send_cert_verify(c, false)) return false;
-        return false;
+      if (!mg_tls_server_send_finish(c)) return false;
       if (tls->is_twoway) {
         // generate application keys at this point, keep using handshake keys
         struct tls_enc hs_keys = tls->enc;
@@ -2224,16 +2241,27 @@ void mg_tls_handshake(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   long n;
   bool res;
+  uint64_t t;
   if (c->is_closing) return;  // we don't clear rx buf, so ignore what's left
   if (tls->is_sntp_pending) return;
+  t = mg_millis();
   if (c->is_client) {
     // will clear is_hs when sending last chunk
     res = mg_tls_client_handshake(c);
   } else {
     res = mg_tls_server_handshake(c);
   }
-  if (!res) {
+  tls->hs_proc += mg_millis() - t;
-    mg_error(c, "TLS OOM");
+  if (res && !c->is_tls_hs) {
+    // CPU: key exchange, signing, certificate verification. Wait: the rest of
+    // the total, waiting for the peer and the network
+    unsigned long total = (unsigned long) (mg_millis() - tls->hs_start);
+    unsigned long cpu = (unsigned long) tls->hs_proc;
+    MG_DEBUG(("%lu TLS handshake done in %lu ms: %lu ms CPU, %lu ms peer wait",
+              c->id, total, cpu, total > cpu ? total - cpu : 0));
+  }
+  if (!res) { // already mg_error()ed at handshake helper ?
+    if (!c->is_closing) mg_error(c, "TLS OOM"); // No, do it
     return;
   }
   while (tls->send.len > 0 &&
@@ -2650,7 +2678,7 @@ static int mg_parse_pem_certs(const struct mg_str pem, struct mg_str **ders) {
   return count;
 }
 
-size_t mg_uecc_parse_private_key(struct mg_str key, uint8_t *buf, size_t len) {
+size_t mg_p256_parse_private_key(struct mg_str key, uint8_t *buf, size_t len) {
   struct mg_str der = mg_str_n(NULL, 0);
   size_t n = 0;
   if (buf == NULL || len < 32) return 0;
@@ -2690,6 +2718,7 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
     mg_error(c, "tls oom");
     return;
   }
+  tls->hs_start = mg_millis();
 
   tls->state =
       c->is_client ? MG_TLS_STATE_CLIENT_START : MG_TLS_STATE_SERVER_START;
@@ -2733,7 +2762,7 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
     if (!c->is_client) tls->is_twoway = true;  // server + CA: two-way auth
   }
 
-  if (opts->cert.buf == NULL) {
+  if (opts->cert.buf == NULL || opts->cert.len == 0) {
     MG_VERBOSE(("No certificate provided"));
     goto xit;
   }
@@ -2762,7 +2791,7 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
   }
 
   // parse PEM or DER EC key
-  if (opts->key.buf == NULL) {
+  if (opts->key.buf == NULL || opts->key.len == 0) {
     mg_error(c, "Certificate provided without a private key");
     return;
   }
@@ -2875,11 +2904,15 @@ long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) {
   long n = MG_IO_WAIT;
   bool was_throttled = c->is_tls_throttled;  // see #3074
   if (!was_throttled) {                      // encrypt new data
+    size_t i, rs = MG_TLS_RECORD_SIZE > 16384 ? 16384 : MG_TLS_RECORD_SIZE;
     if (len > MG_IO_SIZE) len = MG_IO_SIZE;
-    if (len > 16384) len = 16384;
+    for (i = 0; i < len; i += rs) {  // Split into records, send them at once
-    if (!mg_tls_encrypt(c, (const uint8_t *) buf, len, MG_TLS_APP_DATA))
+      size_t m = len - i < rs ? len - i : rs;
-      return 0;  // returning 0 means an OOM condition (iobuf couldn't resize),
+      if (!mg_tls_encrypt(c, (const uint8_t *) buf + i, m, MG_TLS_APP_DATA))
-                 // yet this is so far recoverable, let the caller decide
+        return 0;  // returning 0 means an OOM condition (iobuf couldn't
+                   // resize), yet this is so far recoverable, let the caller
+                   // decide
+    }
   }  // else, resend outstanding encrypted data in tls->send
   while (tls->send.len > 0 &&
          (n = mg_io_send(c, tls->send.buf, tls->send.len)) > 0) {

src/tls_chacha20.c

@@ -60,9 +60,6 @@ static PORTABLE_8439_DECL void poly1305_finish(poly1305_context *ctx,
 // ******* END:   poly1305-donna/poly1305-donna.h ********
 // ******* BEGIN: chacha-portable.c ********
 
-#include <assert.h>
-#include <string.h>
-
 // this is a fresh implementation of chacha20, based on the description in
 // rfc8349 it's such a nice compact algorithm that it is easy to do. In
 // relationship to other c implementation this implementation:

src/tls_p256.h

@@ -0,0 +1,181 @@
+// P-256 API, mg_p256_*(), used by built-in TLS, JWT and OTA. Implemented by
+// BearSSL code below (MG_P256=MG_P256_BEAR) or tls_p256_cortex.c (LENNGREN)
+// BearSSL code: https://bearssl.org commit 7bea48e. Shared bignum and ECDSA
+// code is always compiled, it is also used by P-384, see tls_p384.c
+//
+// Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
+// Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+//
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+// BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+// ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+//
+// Mongoose changes: br_ / BR_ names are prefixed with mg_ / MG_, as are the
+// constant-time helpers from inner.h (NOT, MUX, EQ, ...). Structs are not
+// typedef-ed. ECDSA signing takes the caller's k instead of HMAC-DRBG, k is
+// computed by mg_p256_sign() (RFC 6979). ECDSA functions take the curve id and
+// public key directly
+#pragma once
+
+#include "arch.h"
+#include "config.h"
+#include "str.h"
+#include "tls.h"
+
+#if MG_TLS == MG_TLS_BUILTIN || defined(MG_OTA_PUBLIC_KEY)
+
+#define MG_BR_EC_secp256r1 23  // Curve IDs, same as TLS named groups
+#define MG_BR_EC_secp384r1 24
+#define MG_BR_MAX_EC_SIZE 384  // Largest supported curve, bits
+
+// From BearSSL inc/bearssl_ec.h: an EC implementation
+struct mg_br_ec_impl {
+  uint32_t supported_curves;  // Bit mask of curve IDs
+  const unsigned char *(*generator)(int curve, size_t *len);
+  const unsigned char *(*order)(int curve, size_t *len);
+  size_t (*xoff)(int curve, size_t *len);
+  uint32_t (*mul)(unsigned char *G, size_t Glen, const unsigned char *x,
+                  size_t xlen, int curve);
+  size_t (*mulgen)(unsigned char *R, const unsigned char *x, size_t xlen,
+                   int curve);
+  uint32_t (*muladd)(unsigned char *A, const unsigned char *B, size_t len,
+                     const unsigned char *x, size_t xlen,
+                     const unsigned char *y, size_t ylen, int curve);
+};
+
+// From BearSSL src/inner.h: constant-time helpers
+static inline uint32_t MG_BR_NOT(uint32_t ctl) {
+  return ctl ^ 1;
+}
+static inline uint32_t MG_BR_MUX(uint32_t ctl, uint32_t x, uint32_t y) {
+  return y ^ (-ctl & (x ^ y));
+}
+static inline uint32_t MG_BR_EQ(uint32_t x, uint32_t y) {
+  uint32_t q = x ^ y;
+  return MG_BR_NOT((q | -q) >> 31);
+}
+static inline uint32_t MG_BR_NEQ(uint32_t x, uint32_t y) {
+  uint32_t q = x ^ y;
+  return (q | -q) >> 31;
+}
+static inline uint32_t MG_BR_GT(uint32_t x, uint32_t y) {
+  uint32_t z = y - x;
+  return (z ^ ((x ^ y) & (x ^ z))) >> 31;
+}
+#define MG_BR_GE(x, y) MG_BR_NOT(MG_BR_GT(y, x))
+#define MG_BR_LT(x, y) MG_BR_GT(y, x)
+static inline int32_t MG_BR_CMP(uint32_t x, uint32_t y) {
+  return (int32_t) MG_BR_GT(x, y) | -(int32_t) MG_BR_GT(y, x);
+}
+static inline uint32_t MG_BR_BIT_LENGTH(uint32_t x) {
+  uint32_t k, c;
+  k = MG_BR_NEQ(x, 0);
+  c = MG_BR_GT(x, 0xFFFF), x = MG_BR_MUX(c, x >> 16, x), k += c << 4;
+  c = MG_BR_GT(x, 0x00FF), x = MG_BR_MUX(c, x >> 8, x), k += c << 3;
+  c = MG_BR_GT(x, 0x000F), x = MG_BR_MUX(c, x >> 4, x), k += c << 2;
+  c = MG_BR_GT(x, 0x0003), x = MG_BR_MUX(c, x >> 2, x), k += c << 1;
+  k += MG_BR_GT(x, 0x0001);
+  return k;
+}
+#define MG_BR_MUL31(x, y) ((uint64_t) (x) * (uint64_t) (y))
+#define MG_BR_MUL31_lo(x, y) \
+  (((uint32_t) (x) * (uint32_t) (y)) & (uint32_t) 0x7FFFFFFF)
+#define MG_BR_CCOPY mg_br_ccopy
+void mg_br_ccopy(uint32_t ctl, void *dst, const void *src, size_t len);
+uint32_t mg_br_divrem(uint32_t hi, uint32_t lo, uint32_t d, uint32_t *r);
+static inline uint32_t mg_br_rem(uint32_t hi, uint32_t lo, uint32_t d) {
+  uint32_t r;
+  mg_br_divrem(hi, lo, d, &r);
+  return r;
+}
+static inline uint32_t mg_br_div(uint32_t hi, uint32_t lo, uint32_t d) {
+  uint32_t r;
+  return mg_br_divrem(hi, lo, d, &r);
+}
+static inline void mg_br_enc32be(void *dst, uint32_t x) {
+  unsigned char *buf = (unsigned char *) dst;
+  buf[0] = (unsigned char) (x >> 24), buf[1] = (unsigned char) (x >> 16);
+  buf[2] = (unsigned char) (x >> 8), buf[3] = (unsigned char) x;
+}
+static inline void mg_br_i31_zero(uint32_t *x, uint32_t bit_len) {
+  *x++ = bit_len;
+  memset(x, 0, ((bit_len + 31) >> 5) * sizeof *x);
+}
+
+// Big integers, "i31" format, see BearSSL src/inner.h
+uint32_t mg_br_i31_add(uint32_t *a, const uint32_t *b, uint32_t ctl);
+uint32_t mg_br_i31_sub(uint32_t *a, const uint32_t *b, uint32_t ctl);
+uint32_t mg_br_i31_bit_length(uint32_t *x, size_t xlen);
+uint32_t mg_br_i31_decode_mod(uint32_t *x, const void *src, size_t len,
+                              const uint32_t *m);
+void mg_br_i31_decode(uint32_t *x, const void *src, size_t len);
+void mg_br_i31_encode(void *dst, size_t len, const uint32_t *x);
+void mg_br_i31_from_monty(uint32_t *x, const uint32_t *m, uint32_t m0i);
+void mg_br_i31_to_monty(uint32_t *x, const uint32_t *m);
+uint32_t mg_br_i31_iszero(const uint32_t *x);
+void mg_br_i31_modpow(uint32_t *x, const unsigned char *e, size_t elen,
+                      const uint32_t *m, uint32_t m0i, uint32_t *t1,
+                      uint32_t *t2);
+void mg_br_i31_montymul(uint32_t *d, const uint32_t *x, const uint32_t *y,
+                        const uint32_t *m, uint32_t m0i);
+void mg_br_i31_muladd_small(uint32_t *x, uint32_t z, const uint32_t *m);
+uint32_t mg_br_i31_ninv31(uint32_t x);
+void mg_br_i31_rshift(uint32_t *x, int count);
+
+// ECDSA, see BearSSL src/ec/ecdsa_i31_*.c. q is an uncompressed point
+void mg_br_ecdsa_i31_bits2int(uint32_t *x, const void *src, size_t len,
+                              uint32_t ebitlen);
+uint32_t mg_br_ecdsa_i31_vrfy_raw(const struct mg_br_ec_impl *impl, int curve,
+                                  const void *hash, size_t hash_len,
+                                  const unsigned char *q, size_t qlen,
+                                  const void *sig, size_t sig_len);
+size_t mg_br_ecdsa_i31_sign_raw(const struct mg_br_ec_impl *impl, int curve,
+                                const void *hash, size_t hash_len,
+                                const unsigned char *x, size_t xlen,
+                                const unsigned char *k, void *sig);
+
+// P-256 (secp256r1) API. Keys and signatures are big endian byte strings,
+// a public key is X || Y, a signature is r || s. Functions return 1 on
+// success, 0 on failure
+
+// Generate a random key pair, using mg_random()
+int mg_p256_make_key(uint8_t public_key[64], uint8_t private_key[32]);
+
+// Compute public key from a private key. Return 0 if private key is invalid
+int mg_p256_compute_public_key(const uint8_t private_key[32],
+                               uint8_t public_key[64]);
+
+// ECDH. Validates the peer public key, returns 0 if it is not on the curve
+int mg_p256_shared_secret(const uint8_t public_key[64],
+                          const uint8_t private_key[32], uint8_t secret[32]);
+
+// ECDSA sign with a deterministic k, RFC 6979 with HMAC-SHA256
+int mg_p256_sign(const uint8_t private_key[32], const uint8_t *hash,
+                 size_t hash_size, uint8_t signature[64]);
+
+// ECDSA verify. Validates the public key
+int mg_p256_verify(const uint8_t public_key[64], const uint8_t *hash,
+                   size_t hash_size, const uint8_t signature[64]);
+
+// Internal: ECDSA sign with a given k, 32 bytes big endian, in [1, n-1].
+// Provided by the selected implementation, used by mg_p256_sign()
+int mg_p256_sign_with_k(const uint8_t private_key[32], const uint8_t *hash,
+                        size_t hash_size, const uint8_t k[32],
+                        uint8_t signature[64]);
+#endif  // MG_TLS == MG_TLS_BUILTIN || defined(MG_OTA_PUBLIC_KEY)

src/tls_p384.c

@@ -0,0 +1,834 @@
+// P-384 from BearSSL, https://bearssl.org commit 7bea48e
+// P-384 signature verification, used by built-in TLS for certificates and
+// CertificateVerify. Shared bignum and ECDSA code is in tls_p256.c
+//
+// Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+//
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+// BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+// ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+//
+// Mongoose changes: br_ / BR_ names are prefixed with mg_ / MG_, static
+// functions with p384_. Trimmed to P-384. Structs are not typedef-ed
+
+#include "tls_p384.h"
+#include "tls_p256.h"
+
+#if MG_TLS == MG_TLS_BUILTIN || defined(MG_OTA_PUBLIC_KEY)
+
+// From BearSSL src/ec/ec_secp384r1.c
+static const unsigned char P384_N[] = {
+	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
+	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
+	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
+	0xC7, 0x63, 0x4D, 0x81, 0xF4, 0x37, 0x2D, 0xDF, 
+	0x58, 0x1A, 0x0D, 0xB2, 0x48, 0xB0, 0xA7, 0x7A, 
+	0xEC, 0xEC, 0x19, 0x6A, 0xCC, 0xC5, 0x29, 0x73
+};
+
+static const unsigned char P384_G[] = {
+	0x04, 0xAA, 0x87, 0xCA, 0x22, 0xBE, 0x8B, 0x05,
+	0x37, 0x8E, 0xB1, 0xC7, 0x1E, 0xF3, 0x20, 0xAD,
+	0x74, 0x6E, 0x1D, 0x3B, 0x62, 0x8B, 0xA7, 0x9B,
+	0x98, 0x59, 0xF7, 0x41, 0xE0, 0x82, 0x54, 0x2A,
+	0x38, 0x55, 0x02, 0xF2, 0x5D, 0xBF, 0x55, 0x29,
+	0x6C, 0x3A, 0x54, 0x5E, 0x38, 0x72, 0x76, 0x0A,
+	0xB7, 0x36, 0x17, 0xDE, 0x4A, 0x96, 0x26, 0x2C,
+	0x6F, 0x5D, 0x9E, 0x98, 0xBF, 0x92, 0x92, 0xDC,
+	0x29, 0xF8, 0xF4, 0x1D, 0xBD, 0x28, 0x9A, 0x14,
+	0x7C, 0xE9, 0xDA, 0x31, 0x13, 0xB5, 0xF0, 0xB8,
+	0xC0, 0x0A, 0x60, 0xB1, 0xCE, 0x1D, 0x7E, 0x81,
+	0x9D, 0x7A, 0x43, 0x1D, 0x7C, 0x90, 0xEA, 0x0E,
+	0x5F
+};
+
+
+// From BearSSL src/ec/ec_prime_i31.c
+/*
+ * Parameters for supported curves (field modulus, and 'b' equation
+ * parameter; both values use the 'i31' format, and 'b' is in Montgomery
+ * representation).
+ */
+
+static const uint32_t P384_P[] = {
+	0x0000018C,
+	0x7FFFFFFF, 0x00000001, 0x00000000, 0x7FFFFFF8,
+	0x7FFFFFEF, 0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF,
+	0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF,
+	0x00000FFF
+};
+
+static const uint32_t P384_R2[] = {
+	0x0000018C,
+	0x00000000, 0x00000080, 0x7FFFFE00, 0x000001FF,
+	0x00000800, 0x00000000, 0x7FFFE000, 0x00001FFF,
+	0x00008000, 0x00008000, 0x00000000, 0x00000000,
+	0x00000000
+};
+
+static const uint32_t P384_B[] = {
+	0x0000018C,
+	0x6E666840, 0x070D0392, 0x5D810231, 0x7651D50C,
+	0x17E218D6, 0x1B192002, 0x44EFE441, 0x3A524E2B,
+	0x2719BA5F, 0x41F02209, 0x36C5643E, 0x5813EFFE,
+	0x000008A5
+};
+
+struct p384_curve_params {
+	const uint32_t *p;
+	const uint32_t *b;
+	const uint32_t *R2;
+	uint32_t p0i;
+	size_t point_len;
+};
+
+static inline const struct p384_curve_params *
+p384_id_to_curve(int curve)
+{
+	static const struct p384_curve_params pp = {
+		P384_P, P384_B, P384_R2, 0x00000001,  97
+	};
+
+	(void)curve;
+	return &pp;
+}
+
+#define I31_LEN   ((MG_BR_MAX_EC_SIZE + 61) / 31)
+
+/*
+ * Type for a point in Jacobian coordinates:
+ * -- three values, x, y and z, in Montgomery representation
+ * -- affine coordinates are X = x / z^2 and Y = y / z^3
+ * -- for the point at infinity, z = 0
+ */
+struct p384_jacobian {
+	uint32_t c[3][I31_LEN];
+};
+
+/*
+ * We use a custom interpreter that uses a dozen registers, and
+ * only six operations:
+ *    MSET(d, a)       copy a into d
+ *    MADD(d, a)       d = d+a (modular)
+ *    MSUB(d, a)       d = d-a (modular)
+ *    MMUL(d, a, b)    d = a*b (Montgomery multiplication)
+ *    MINV(d, a, b)    invert d modulo p; a and b are used as scratch registers
+ *    MTZ(d)           clear return value if d = 0
+ * Destination of MMUL (d) must be distinct from operands (a and b).
+ * There is no such constraint for MSUB and MADD.
+ *
+ * Registers include the operand coordinates, and temporaries.
+ */
+#define MSET(d, a)      (0x0000 + ((d) << 8) + ((a) << 4))
+#define MADD(d, a)      (0x1000 + ((d) << 8) + ((a) << 4))
+#define MSUB(d, a)      (0x2000 + ((d) << 8) + ((a) << 4))
+#define MMUL(d, a, b)   (0x3000 + ((d) << 8) + ((a) << 4) + (b))
+#define MINV(d, a, b)   (0x4000 + ((d) << 8) + ((a) << 4) + (b))
+#define MTZ(d)          (0x5000 + ((d) << 8))
+#define ENDCODE         0
+
+/*
+ * Registers for the input operands.
+ */
+#define P1x    0
+#define P1y    1
+#define P1z    2
+#define P2x    3
+#define P2y    4
+#define P2z    5
+
+/*
+ * Alternate names for the first input operand.
+ */
+#define Px     0
+#define Py     1
+#define Pz     2
+
+/*
+ * Temporaries.
+ */
+#define t1     6
+#define t2     7
+#define t3     8
+#define t4     9
+#define t5    10
+#define t6    11
+#define t7    12
+
+/*
+ * Extra scratch registers available when there is no second operand (e.g.
+ * for "double" and "affine").
+ */
+#define t8     3
+#define t9     4
+#define t10    5
+
+/*
+ * Doubling formulas are:
+ *
+ *   s = 4*x*y^2
+ *   m = 3*(x + z^2)*(x - z^2)
+ *   x' = m^2 - 2*s
+ *   y' = m*(s - x') - 8*y^4
+ *   z' = 2*y*z
+ *
+ * If y = 0 (P has order 2) then this yields infinity (z' = 0), as it
+ * should. This case should not happen anyway, because our curves have
+ * prime order, and thus do not contain any point of order 2.
+ *
+ * If P is infinity (z = 0), then again the formulas yield infinity,
+ * which is correct. Thus, this code works for all points.
+ *
+ * Cost: 8 multiplications
+ */
+static const uint16_t p384_code_double[] = {
+	/*
+	 * Compute z^2 (in t1).
+	 */
+	MMUL(t1, Pz, Pz),
+
+	/*
+	 * Compute x-z^2 (in t2) and then x+z^2 (in t1).
+	 */
+	MSET(t2, Px),
+	MSUB(t2, t1),
+	MADD(t1, Px),
+
+	/*
+	 * Compute m = 3*(x+z^2)*(x-z^2) (in t1).
+	 */
+	MMUL(t3, t1, t2),
+	MSET(t1, t3),
+	MADD(t1, t3),
+	MADD(t1, t3),
+
+	/*
+	 * Compute s = 4*x*y^2 (in t2) and 2*y^2 (in t3).
+	 */
+	MMUL(t3, Py, Py),
+	MADD(t3, t3),
+	MMUL(t2, Px, t3),
+	MADD(t2, t2),
+
+	/*
+	 * Compute x' = m^2 - 2*s.
+	 */
+	MMUL(Px, t1, t1),
+	MSUB(Px, t2),
+	MSUB(Px, t2),
+
+	/*
+	 * Compute z' = 2*y*z.
+	 */
+	MMUL(t4, Py, Pz),
+	MSET(Pz, t4),
+	MADD(Pz, t4),
+
+	/*
+	 * Compute y' = m*(s - x') - 8*y^4. Note that we already have
+	 * 2*y^2 in t3.
+	 */
+	MSUB(t2, Px),
+	MMUL(Py, t1, t2),
+	MMUL(t4, t3, t3),
+	MSUB(Py, t4),
+	MSUB(Py, t4),
+
+	ENDCODE
+};
+
+/*
+ * Addtions formulas are:
+ *
+ *   u1 = x1 * z2^2
+ *   u2 = x2 * z1^2
+ *   s1 = y1 * z2^3
+ *   s2 = y2 * z1^3
+ *   h = u2 - u1
+ *   r = s2 - s1
+ *   x3 = r^2 - h^3 - 2 * u1 * h^2
+ *   y3 = r * (u1 * h^2 - x3) - s1 * h^3
+ *   z3 = h * z1 * z2
+ *
+ * If both P1 and P2 are infinity, then z1 == 0 and z2 == 0, implying that
+ * z3 == 0, so the result is correct.
+ * If either of P1 or P2 is infinity, but not both, then z3 == 0, which is
+ * not correct.
+ * h == 0 only if u1 == u2; this happens in two cases:
+ * -- if s1 == s2 then P1 and/or P2 is infinity, or P1 == P2
+ * -- if s1 != s2 then P1 + P2 == infinity (but neither P1 or P2 is infinity)
+ *
+ * Thus, the following situations are not handled correctly:
+ * -- P1 = 0 and P2 != 0
+ * -- P1 != 0 and P2 = 0
+ * -- P1 = P2
+ * All other cases are properly computed. However, even in "incorrect"
+ * situations, the three coordinates still are properly formed field
+ * elements.
+ *
+ * The returned flag is cleared if r == 0. This happens in the following
+ * cases:
+ * -- Both points are on the same horizontal line (same Y coordinate).
+ * -- Both points are infinity.
+ * -- One point is infinity and the other is on line Y = 0.
+ * The third case cannot happen with our curves (there is no valid point
+ * on line Y = 0 since that would be a point of order 2). If the two
+ * source points are non-infinity, then remains only the case where the
+ * two points are on the same horizontal line.
+ *
+ * This allows us to detect the "P1 == P2" case, assuming that P1 != 0 and
+ * P2 != 0:
+ * -- If the returned value is not the point at infinity, then it was properly
+ * computed.
+ * -- Otherwise, if the returned flag is 1, then P1+P2 = 0, and the result
+ * is indeed the point at infinity.
+ * -- Otherwise (result is infinity, flag is 0), then P1 = P2 and we should
+ * use the 'double' code.
+ *
+ * Cost: 16 multiplications
+ */
+static const uint16_t p384_code_add[] = {
+	/*
+	 * Compute u1 = x1*z2^2 (in t1) and s1 = y1*z2^3 (in t3).
+	 */
+	MMUL(t3, P2z, P2z),
+	MMUL(t1, P1x, t3),
+	MMUL(t4, P2z, t3),
+	MMUL(t3, P1y, t4),
+
+	/*
+	 * Compute u2 = x2*z1^2 (in t2) and s2 = y2*z1^3 (in t4).
+	 */
+	MMUL(t4, P1z, P1z),
+	MMUL(t2, P2x, t4),
+	MMUL(t5, P1z, t4),
+	MMUL(t4, P2y, t5),
+
+	/*
+	 * Compute h = u2 - u1 (in t2) and r = s2 - s1 (in t4).
+	 */
+	MSUB(t2, t1),
+	MSUB(t4, t3),
+
+	/*
+	 * Report cases where r = 0 through the returned flag.
+	 */
+	MTZ(t4),
+
+	/*
+	 * Compute u1*h^2 (in t6) and h^3 (in t5).
+	 */
+	MMUL(t7, t2, t2),
+	MMUL(t6, t1, t7),
+	MMUL(t5, t7, t2),
+
+	/*
+	 * Compute x3 = r^2 - h^3 - 2*u1*h^2.
+	 * t1 and t7 can be used as scratch registers.
+	 */
+	MMUL(P1x, t4, t4),
+	MSUB(P1x, t5),
+	MSUB(P1x, t6),
+	MSUB(P1x, t6),
+
+	/*
+	 * Compute y3 = r*(u1*h^2 - x3) - s1*h^3.
+	 */
+	MSUB(t6, P1x),
+	MMUL(P1y, t4, t6),
+	MMUL(t1, t5, t3),
+	MSUB(P1y, t1),
+
+	/*
+	 * Compute z3 = h*z1*z2.
+	 */
+	MMUL(t1, P1z, P2z),
+	MMUL(P1z, t1, t2),
+
+	ENDCODE
+};
+
+/*
+ * Check that the point is on the curve. This code snippet assumes the
+ * following conventions:
+ * -- Coordinates x and y have been freshly decoded in P1 (but not
+ * converted to Montgomery coordinates yet).
+ * -- P2x, P2y and P2z are set to, respectively, R^2, b*R and 1.
+ */
+static const uint16_t p384_code_check[] = {
+
+	/* Convert x and y to Montgomery representation. */
+	MMUL(t1, P1x, P2x),
+	MMUL(t2, P1y, P2x),
+	MSET(P1x, t1),
+	MSET(P1y, t2),
+
+	/* Compute x^3 in t1. */
+	MMUL(t2, P1x, P1x),
+	MMUL(t1, P1x, t2),
+
+	/* Subtract 3*x from t1. */
+	MSUB(t1, P1x),
+	MSUB(t1, P1x),
+	MSUB(t1, P1x),
+
+	/* Add b. */
+	MADD(t1, P2y),
+
+	/* Compute y^2 in t2. */
+	MMUL(t2, P1y, P1y),
+
+	/* Compare y^2 with x^3 - 3*x + b; they must match. */
+	MSUB(t1, t2),
+	MTZ(t1),
+
+	/* Set z to 1 (in Montgomery representation). */
+	MMUL(P1z, P2x, P2z),
+
+	ENDCODE
+};
+
+/*
+ * Conversion back to affine coordinates. This code snippet assumes that
+ * the z coordinate of P2 is set to 1 (not in Montgomery representation).
+ */
+static const uint16_t p384_code_affine[] = {
+
+	/* Save z*R in t1. */
+	MSET(t1, P1z),
+
+	/* Compute z^3 in t2. */
+	MMUL(t2, P1z, P1z),
+	MMUL(t3, P1z, t2),
+	MMUL(t2, t3, P2z),
+
+	/* Invert to (1/z^3) in t2. */
+	MINV(t2, t3, t4),
+
+	/* Compute y. */
+	MSET(t3, P1y),
+	MMUL(P1y, t2, t3),
+
+	/* Compute (1/z^2) in t3. */
+	MMUL(t3, t2, t1),
+
+	/* Compute x. */
+	MSET(t2, P1x),
+	MMUL(P1x, t2, t3),
+
+	ENDCODE
+};
+
+static uint32_t
+p384_run_code(struct p384_jacobian *P1, const struct p384_jacobian *P2,
+	const struct p384_curve_params *cc, const uint16_t *code)
+{
+	uint32_t r;
+	uint32_t t[13][I31_LEN];
+	size_t u;
+
+	r = 1;
+
+	/*
+	 * Copy the two operands in the dedicated registers.
+	 */
+	memcpy(t[P1x], P1->c, 3 * I31_LEN * sizeof(uint32_t));
+	memcpy(t[P2x], P2->c, 3 * I31_LEN * sizeof(uint32_t));
+
+	/*
+	 * Run formulas.
+	 */
+	for (u = 0;; u ++) {
+		unsigned op, d, a, b;
+
+		op = code[u];
+		if (op == 0) {
+			break;
+		}
+		d = (op >> 8) & 0x0F;
+		a = (op >> 4) & 0x0F;
+		b = op & 0x0F;
+		op >>= 12;
+		switch (op) {
+			uint32_t ctl;
+			size_t plen;
+			unsigned char tp[(MG_BR_MAX_EC_SIZE + 7) >> 3];
+
+		case 0:
+			memcpy(t[d], t[a], I31_LEN * sizeof(uint32_t));
+			break;
+		case 1:
+			ctl = mg_br_i31_add(t[d], t[a], 1);
+			ctl |= MG_BR_NOT(mg_br_i31_sub(t[d], cc->p, 0));
+			mg_br_i31_sub(t[d], cc->p, ctl);
+			break;
+		case 2:
+			mg_br_i31_add(t[d], cc->p, mg_br_i31_sub(t[d], t[a], 1));
+			break;
+		case 3:
+			mg_br_i31_montymul(t[d], t[a], t[b], cc->p, cc->p0i);
+			break;
+		case 4:
+			plen = (cc->p[0] - (cc->p[0] >> 5) + 7) >> 3;
+			mg_br_i31_encode(tp, plen, cc->p);
+			tp[plen - 1] -= 2;
+			mg_br_i31_modpow(t[d], tp, plen,
+				cc->p, cc->p0i, t[a], t[b]);
+			break;
+		default:
+			r &= ~mg_br_i31_iszero(t[d]);
+			break;
+		}
+	}
+
+	/*
+	 * Copy back result.
+	 */
+	memcpy(P1->c, t[P1x], 3 * I31_LEN * sizeof(uint32_t));
+	return r;
+}
+
+static void
+p384_set_one(uint32_t *x, const uint32_t *p)
+{
+	size_t plen;
+
+	plen = (p[0] + 63) >> 5;
+	memset(x, 0, plen * sizeof *x);
+	x[0] = p[0];
+	x[1] = 0x00000001;
+}
+
+static void
+p384_point_zero(struct p384_jacobian *P, const struct p384_curve_params *cc)
+{
+	memset(P, 0, sizeof *P);
+	P->c[0][0] = P->c[1][0] = P->c[2][0] = cc->p[0];
+}
+
+static inline void
+p384_point_double(struct p384_jacobian *P, const struct p384_curve_params *cc)
+{
+	p384_run_code(P, P, cc, p384_code_double);
+}
+
+static inline uint32_t
+p384_point_add(struct p384_jacobian *P1, const struct p384_jacobian *P2, const struct p384_curve_params *cc)
+{
+	return p384_run_code(P1, P2, cc, p384_code_add);
+}
+
+static void
+p384_point_mul(struct p384_jacobian *P, const unsigned char *x, size_t xlen,
+	const struct p384_curve_params *cc)
+{
+	/*
+	 * We do a simple double-and-add ladder with a 2-bit window
+	 * to make only one add every two doublings. We thus first
+	 * precompute 2P and 3P in some local buffers.
+	 *
+	 * We always perform two doublings and one addition; the
+	 * addition is with P, 2P and 3P and is done in a temporary
+	 * array.
+	 *
+	 * The addition code cannot handle cases where one of the
+	 * operands is infinity, which is the case at the start of the
+	 * ladder. We therefore need to maintain a flag that controls
+	 * this situation.
+	 */
+	uint32_t qz;
+	struct p384_jacobian P2, P3, Q, T, U;
+
+	memcpy(&P2, P, sizeof P2);
+	p384_point_double(&P2, cc);
+	memcpy(&P3, P, sizeof P3);
+	p384_point_add(&P3, &P2, cc);
+
+	p384_point_zero(&Q, cc);
+	qz = 1;
+	while (xlen -- > 0) {
+		int k;
+
+		for (k = 6; k >= 0; k -= 2) {
+			uint32_t bits;
+			uint32_t bnz;
+
+			p384_point_double(&Q, cc);
+			p384_point_double(&Q, cc);
+			memcpy(&T, P, sizeof T);
+			memcpy(&U, &Q, sizeof U);
+			bits = (*x >> k) & (uint32_t)3;
+			bnz = MG_BR_NEQ(bits, 0);
+			MG_BR_CCOPY(MG_BR_EQ(bits, 2), &T, &P2, sizeof T);
+			MG_BR_CCOPY(MG_BR_EQ(bits, 3), &T, &P3, sizeof T);
+			p384_point_add(&U, &T, cc);
+			MG_BR_CCOPY(bnz & qz, &Q, &T, sizeof Q);
+			MG_BR_CCOPY(bnz & ~qz, &Q, &U, sizeof Q);
+			qz &= ~bnz;
+		}
+		x ++;
+	}
+	memcpy(P, &Q, sizeof Q);
+}
+
+/*
+ * Decode point into Jacobian coordinates. This function does not support
+ * the point at infinity. If the point is invalid then this returns 0, but
+ * the coordinates are still set to properly formed field elements.
+ */
+static uint32_t
+p384_point_decode(struct p384_jacobian *P, const void *src, size_t len, const struct p384_curve_params *cc)
+{
+	/*
+	 * Points must use uncompressed format:
+	 * -- first byte is 0x04;
+	 * -- coordinates X and Y use unsigned big-endian, with the same
+	 *    length as the field modulus.
+	 *
+	 * We don't support hybrid format (uncompressed, but first byte
+	 * has value 0x06 or 0x07, depending on the least significant bit
+	 * of Y) because it is rather useless, and explicitly forbidden
+	 * by PKIX (RFC 5480, section 2.2).
+	 *
+	 * We don't support compressed format either, because it is not
+	 * much used in practice (there are or were patent-related
+	 * concerns about point compression, which explains the lack of
+	 * generalised support). Also, point compression support would
+	 * need a bit more code.
+	 */
+	const unsigned char *buf;
+	size_t plen, zlen;
+	uint32_t r;
+	struct p384_jacobian Q;
+
+	buf = (const unsigned char *)src;
+	p384_point_zero(P, cc);
+	plen = (cc->p[0] - (cc->p[0] >> 5) + 7) >> 3;
+	if (len != 1 + (plen << 1)) {
+		return 0;
+	}
+	r = mg_br_i31_decode_mod(P->c[0], buf + 1, plen, cc->p);
+	r &= mg_br_i31_decode_mod(P->c[1], buf + 1 + plen, plen, cc->p);
+
+	/*
+	 * Check first byte.
+	 */
+	r &= MG_BR_EQ(buf[0], 0x04);
+	/* obsolete
+	r &= MG_BR_EQ(buf[0], 0x04) | (MG_BR_EQ(buf[0] & 0xFE, 0x06)
+		& ~(uint32_t)(buf[0] ^ buf[plen << 1]));
+	*/
+
+	/*
+	 * Convert coordinates and check that the point is valid.
+	 */
+	zlen = ((cc->p[0] + 63) >> 5) * sizeof(uint32_t);
+	memcpy(Q.c[0], cc->R2, zlen);
+	memcpy(Q.c[1], cc->b, zlen);
+	p384_set_one(Q.c[2], cc->p);
+	r &= ~p384_run_code(P, &Q, cc, p384_code_check);
+	return r;
+}
+
+/*
+ * Encode a point. This method assumes that the point is correct and is
+ * not the point at infinity. Encoded size is always 1+2*plen, where
+ * plen is the field modulus length, in bytes.
+ */
+static void
+p384_point_encode(void *dst, const struct p384_jacobian *P, const struct p384_curve_params *cc)
+{
+	unsigned char *buf;
+	uint32_t xbl;
+	size_t plen;
+	struct p384_jacobian Q, T;
+
+	buf = (unsigned char *)dst;
+	xbl = cc->p[0];
+	xbl -= (xbl >> 5);
+	plen = (xbl + 7) >> 3;
+	buf[0] = 0x04;
+	memcpy(&Q, P, sizeof *P);
+	p384_set_one(T.c[2], cc->p);
+	p384_run_code(&Q, &T, cc, p384_code_affine);
+	mg_br_i31_encode(buf + 1, plen, Q.c[0]);
+	mg_br_i31_encode(buf + 1 + plen, plen, Q.c[1]);
+}
+
+static const unsigned char *
+p384_api_generator(int curve, size_t *len)
+{
+	(void)curve;
+	*len = sizeof P384_G;
+	return P384_G;
+}
+
+static const unsigned char *
+p384_api_order(int curve, size_t *len)
+{
+	(void)curve;
+	*len = sizeof P384_N;
+	return P384_N;
+}
+
+static size_t
+p384_api_xoff(int curve, size_t *len)
+{
+	p384_api_generator(curve, len);
+	*len >>= 1;
+	return 1;
+}
+
+static uint32_t
+p384_api_mul(unsigned char *G, size_t Glen,
+	const unsigned char *x, size_t xlen, int curve)
+{
+	uint32_t r;
+	const struct p384_curve_params *cc;
+	struct p384_jacobian P;
+
+	cc = p384_id_to_curve(curve);
+	if (Glen != cc->point_len) {
+		return 0;
+	}
+	r = p384_point_decode(&P, G, Glen, cc);
+	p384_point_mul(&P, x, xlen, cc);
+	p384_point_encode(G, &P, cc);
+	return r;
+}
+
+static size_t
+p384_api_mulgen(unsigned char *R,
+	const unsigned char *x, size_t xlen, int curve)
+{
+	const unsigned char *G;
+	size_t Glen;
+
+	G = p384_api_generator(curve, &Glen);
+	memcpy(R, G, Glen);
+	p384_api_mul(R, Glen, x, xlen, curve);
+	return Glen;
+}
+
+static uint32_t
+p384_api_muladd(unsigned char *A, const unsigned char *B, size_t len,
+	const unsigned char *x, size_t xlen,
+	const unsigned char *y, size_t ylen, int curve)
+{
+	uint32_t r, t, z;
+	const struct p384_curve_params *cc;
+	struct p384_jacobian P, Q;
+
+	/*
+	 * TODO: see about merging the two ladders. Right now, we do
+	 * two independent point multiplications, which is a bit
+	 * wasteful of CPU resources (but yields short code).
+	 */
+
+	cc = p384_id_to_curve(curve);
+	if (len != cc->point_len) {
+		return 0;
+	}
+	r = p384_point_decode(&P, A, len, cc);
+	if (B == NULL) {
+		size_t Glen;
+
+		B = p384_api_generator(curve, &Glen);
+	}
+	r &= p384_point_decode(&Q, B, len, cc);
+	p384_point_mul(&P, x, xlen, cc);
+	p384_point_mul(&Q, y, ylen, cc);
+
+	/*
+	 * We want to compute P+Q. Since the base points A and B are distinct
+	 * from infinity, and the multipliers are non-zero and lower than the
+	 * curve order, then we know that P and Q are non-infinity. This
+	 * leaves two special situations to test for:
+	 * -- If P = Q then we must use p384_point_double().
+	 * -- If P+Q = 0 then we must report an error.
+	 */
+	t = p384_point_add(&P, &Q, cc);
+	p384_point_double(&Q, cc);
+	z = mg_br_i31_iszero(P.c[2]);
+
+	/*
+	 * If z is 1 then either P+Q = 0 (t = 1) or P = Q (t = 0). So we
+	 * have the following:
+	 *
+	 *   z = 0, t = 0   return P (normal addition)
+	 *   z = 0, t = 1   return P (normal addition)
+	 *   z = 1, t = 0   return Q (a 'double' case)
+	 *   z = 1, t = 1   report an error (P+Q = 0)
+	 */
+	MG_BR_CCOPY(z & ~t, &P, &Q, sizeof Q);
+	p384_point_encode(A, &P, cc);
+	r &= ~(z & t);
+
+	return r;
+}
+
+static const struct mg_br_ec_impl mg_br_ec_prime_i31 = {
+	(uint32_t)1 << MG_BR_EC_secp384r1,
+	&p384_api_generator,
+	&p384_api_order,
+	&p384_api_xoff,
+	&p384_api_mul,
+	&p384_api_mulgen,
+	&p384_api_muladd
+};
+
+// See tls_p384.h
+int mg_p384_verify(const uint8_t public_key[96], const uint8_t *hash,
+                   size_t hash_size, const uint8_t signature[96]) {
+  unsigned char q[97];
+  q[0] = 0x04;
+  memcpy(q + 1, public_key, 96);
+  return mg_br_ecdsa_i31_vrfy_raw(&mg_br_ec_prime_i31, MG_BR_EC_secp384r1, hash,
+                                  hash_size, q, sizeof(q), signature, 96) == 1;
+}
+
+// Undefine local macros, mongoose.c is one translation unit
+#undef I31_LEN
+#undef MSET
+#undef MADD
+#undef MSUB
+#undef MMUL
+#undef MINV
+#undef MTZ
+#undef ENDCODE
+#undef P1x
+#undef P1y
+#undef P1z
+#undef P2x
+#undef P2y
+#undef P2z
+#undef Px
+#undef Py
+#undef Pz
+#undef t1
+#undef t2
+#undef t3
+#undef t4
+#undef t5
+#undef t6
+#undef t7
+#undef t8
+#undef t9
+#undef t10
+#endif  // MG_TLS == MG_TLS_BUILTIN || defined(MG_OTA_PUBLIC_KEY)

src/tls_p384.h

@@ -0,0 +1,40 @@
+// P-384 from BearSSL, https://bearssl.org commit 7bea48e
+// P-384 signature verification, used by built-in TLS for certificates and
+// CertificateVerify. Shared bignum and ECDSA code is in tls_p256.c
+//
+// Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+//
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+// BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+// ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+//
+// Mongoose changes: br_ / BR_ names are prefixed with mg_ / MG_, static
+// functions with p384_. Trimmed to P-384. Structs are not typedef-ed
+#pragma once
+
+#include "arch.h"
+#include "config.h"
+#include "tls.h"
+
+#if MG_TLS == MG_TLS_BUILTIN || defined(MG_OTA_PUBLIC_KEY)
+// Verify ECDSA P-384 signature r || s over hash. Public key is X || Y.
+// Return 1 on success, 0 on failure
+int mg_p384_verify(const uint8_t public_key[96], const uint8_t *hash,
+                   size_t hash_size, const uint8_t signature[96]);
+#endif  // MG_TLS == MG_TLS_BUILTIN || defined(MG_OTA_PUBLIC_KEY)

src/tls_uecc.h

@@ -1,659 +0,0 @@
-#pragma once
-#include "arch.h"
-
-/* Copyright 2014, Kenneth MacKay. Licensed under the BSD 2-clause license. */
-
-#ifndef _UECC_H_
-#define _UECC_H_
-
-/* Platform selection options.
-If MG_UECC_PLATFORM is not defined, the code will try to guess it based on
-compiler macros. Possible values for MG_UECC_PLATFORM are defined below: */
-#define mg_uecc_arch_other 0
-#define mg_uecc_x86 1
-#define mg_uecc_x86_64 2
-#define mg_uecc_arm 3
-#define mg_uecc_arm_thumb 4
-#define mg_uecc_arm_thumb2 5
-#define mg_uecc_arm64 6
-#define mg_uecc_avr 7
-
-/* If desired, you can define MG_UECC_WORD_SIZE as appropriate for your platform
-(1, 4, or 8 bytes). If MG_UECC_WORD_SIZE is not explicitly defined then it will
-be automatically set based on your platform. */
-
-/* Optimization level; trade speed for code size.
-   Larger values produce code that is faster but larger.
-   Currently supported values are 0 - 4; 0 is unusably slow for most
-   applications. Optimization level 4 currently only has an effect ARM platforms
-   where more than one curve is enabled. */
-#ifndef MG_UECC_OPTIMIZATION_LEVEL
-#define MG_UECC_OPTIMIZATION_LEVEL 2
-#endif
-
-/* MG_UECC_SQUARE_FUNC - If enabled (defined as nonzero), this will cause a
-specific function to be used for (scalar) squaring instead of the generic
-multiplication function. This can make things faster somewhat faster, but
-increases the code size. */
-#ifndef MG_UECC_SQUARE_FUNC
-#define MG_UECC_SQUARE_FUNC 0
-#endif
-
-/* MG_UECC_VLI_NATIVE_LITTLE_ENDIAN - If enabled (defined as nonzero), this will
-switch to native little-endian format for *all* arrays passed in and out of the
-public API. This includes public and private keys, shared secrets, signatures
-and message hashes. Using this switch reduces the amount of call stack memory
-used by uECC, since less intermediate translations are required. Note that this
-will *only* work on native little-endian processors and it will treat the
-uint8_t arrays passed into the public API as word arrays, therefore requiring
-the provided byte arrays to be word aligned on architectures that do not support
-unaligned accesses. IMPORTANT: Keys and signatures generated with
-MG_UECC_VLI_NATIVE_LITTLE_ENDIAN=1 are incompatible with keys and signatures
-generated with MG_UECC_VLI_NATIVE_LITTLE_ENDIAN=0; all parties must use the same
-endianness. */
-#ifndef MG_UECC_VLI_NATIVE_LITTLE_ENDIAN
-#define MG_UECC_VLI_NATIVE_LITTLE_ENDIAN 0
-#endif
-
-/* Curve support selection. Set to 0 to remove that curve. */
-#ifndef MG_UECC_SUPPORTS_secp160r1
-#define MG_UECC_SUPPORTS_secp160r1 0
-#endif
-#ifndef MG_UECC_SUPPORTS_secp192r1
-#define MG_UECC_SUPPORTS_secp192r1 0
-#endif
-#ifndef MG_UECC_SUPPORTS_secp224r1
-#define MG_UECC_SUPPORTS_secp224r1 0
-#endif
-#ifndef MG_UECC_SUPPORTS_secp256r1
-#define MG_UECC_SUPPORTS_secp256r1 1
-#endif
-#ifndef MG_UECC_SUPPORTS_secp256k1
-#define MG_UECC_SUPPORTS_secp256k1 0
-#endif
-#ifndef MG_UECC_SUPPORTS_secp384r1
-#define MG_UECC_SUPPORTS_secp384r1 1
-#endif
-
-/* Specifies whether compressed point format is supported.
-   Set to 0 to disable point compression/decompression functions. */
-#ifndef MG_UECC_SUPPORT_COMPRESSED_POINT
-#define MG_UECC_SUPPORT_COMPRESSED_POINT 1
-#endif
-
-struct MG_UECC_Curve_t;
-typedef const struct MG_UECC_Curve_t *MG_UECC_Curve;
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#if MG_UECC_SUPPORTS_secp160r1
-MG_UECC_Curve mg_uecc_secp160r1(void);
-#endif
-#if MG_UECC_SUPPORTS_secp192r1
-MG_UECC_Curve mg_uecc_secp192r1(void);
-#endif
-#if MG_UECC_SUPPORTS_secp224r1
-MG_UECC_Curve mg_uecc_secp224r1(void);
-#endif
-#if MG_UECC_SUPPORTS_secp256r1
-MG_UECC_Curve mg_uecc_secp256r1(void);
-#endif
-#if MG_UECC_SUPPORTS_secp256k1
-MG_UECC_Curve mg_uecc_secp256k1(void);
-#endif
-#if MG_UECC_SUPPORTS_secp384r1
-MG_UECC_Curve mg_uecc_secp384r1(void);
-#endif
-
-/* MG_UECC_RNG_Function type
-The RNG function should fill 'size' random bytes into 'dest'. It should return 1
-if 'dest' was filled with random data, or 0 if the random data could not be
-generated. The filled-in values should be either truly random, or from a
-cryptographically-secure PRNG.
-
-A correctly functioning RNG is required before calling mg_uecc_make_key() or
-mg_uecc_sign().
-
-Setting a correctly functioning RNG function improves the resistance to
-side-channel attacks for mg_uecc_shared_secret() and
-mg_uecc_sign_deterministic().
-*/
-typedef int (*MG_UECC_RNG_Function)(uint8_t *dest, unsigned size);
-
-// Mongoose: mg_uecc_make_key() and mg_uecc_sign() use mg_random() when no
-// explicit uECC RNG is installed. If mg_random() cannot provide a strong source,
-// those operations fail. Deterministic signing works without RNG, but only an
-// explicit uECC RNG enables its optional side-channel blinding.
-
-/* mg_uecc_set_rng() function.
-Set the function that will be used to generate random bytes. The RNG function
-should return 1 if the random data was generated, or 0 if the random data could
-not be generated.
-
-Mongoose: this overrides the default mg_random() fallback used by
-mg_uecc_make_key() and mg_uecc_sign(). Do not call mg_uecc_set_rng() unless the
-application must provide its own cryptographic RNG.
-
-Inputs:
-    rng_function - The function that will be used to generate random bytes.
-*/
-void mg_uecc_set_rng(MG_UECC_RNG_Function rng_function);
-
-/* mg_uecc_get_rng() function.
-
-Returns the function that will be used to generate random bytes.
-*/
-MG_UECC_RNG_Function mg_uecc_get_rng(void);
-
-/* mg_uecc_curve_private_key_size() function.
-
-Returns the size of a private key for the curve in bytes.
-*/
-int mg_uecc_curve_private_key_size(MG_UECC_Curve curve);
-
-/* mg_uecc_curve_public_key_size() function.
-
-Returns the size of a public key for the curve in bytes.
-*/
-int mg_uecc_curve_public_key_size(MG_UECC_Curve curve);
-
-/* mg_uecc_make_key() function.
-Create a public/private key pair.
-
-Outputs:
-    public_key  - Will be filled in with the public key. Must be at least 2 *
-the curve size (in bytes) long. For example, if the curve is secp256r1,
-public_key must be 64 bytes long. private_key - Will be filled in with the
-private key. Must be as long as the curve order; this is typically the same as
-the curve size, except for secp160r1. For example, if the curve is secp256r1,
-private_key must be 32 bytes long.
-
-                  For secp160r1, private_key must be 21 bytes long! Note that
-the first byte will almost always be 0 (there is about a 1 in 2^80 chance of it
-being non-zero).
-
-Returns 1 if the key pair was generated successfully, 0 if an error occurred.
-*/
-int mg_uecc_make_key(uint8_t *public_key, uint8_t *private_key,
-                     MG_UECC_Curve curve);
-
-/* mg_uecc_shared_secret() function.
-Compute a shared secret given your secret key and someone else's public key. If
-the public key is not from a trusted source and has not been previously
-verified, you should verify it first using mg_uecc_valid_public_key(). Note: It
-is recommended that you hash the result of mg_uecc_shared_secret() before using
-it for symmetric encryption or HMAC.
-
-Inputs:
-    public_key  - The public key of the remote party.
-    private_key - Your private key.
-
-Outputs:
-    secret - Will be filled in with the shared secret value. Must be the same
-size as the curve size; for example, if the curve is secp256r1, secret must be
-32 bytes long.
-
-Returns 1 if the shared secret was generated successfully, 0 if an error
-occurred.
-*/
-int mg_uecc_shared_secret(const uint8_t *public_key, const uint8_t *private_key,
-                          uint8_t *secret, MG_UECC_Curve curve);
-
-#if MG_UECC_SUPPORT_COMPRESSED_POINT
-/* mg_uecc_compress() function.
-Compress a public key.
-
-Inputs:
-    public_key - The public key to compress.
-
-Outputs:
-    compressed - Will be filled in with the compressed public key. Must be at
-least (curve size + 1) bytes long; for example, if the curve is secp256r1,
-                 compressed must be 33 bytes long.
-*/
-void mg_uecc_compress(const uint8_t *public_key, uint8_t *compressed,
-                      MG_UECC_Curve curve);
-
-/* mg_uecc_decompress() function.
-Decompress a compressed public key.
-
-Inputs:
-    compressed - The compressed public key.
-
-Outputs:
-    public_key - Will be filled in with the decompressed public key.
-*/
-void mg_uecc_decompress(const uint8_t *compressed, uint8_t *public_key,
-                        MG_UECC_Curve curve);
-#endif /* MG_UECC_SUPPORT_COMPRESSED_POINT */
-
-/* mg_uecc_valid_public_key() function.
-Check to see if a public key is valid.
-
-Note that you are not required to check for a valid public key before using any
-other uECC functions. However, you may wish to avoid spending CPU time computing
-a shared secret or verifying a signature using an invalid public key.
-
-Inputs:
-    public_key - The public key to check.
-
-Returns 1 if the public key is valid, 0 if it is invalid.
-*/
-int mg_uecc_valid_public_key(const uint8_t *public_key, MG_UECC_Curve curve);
-
-/* mg_uecc_compute_public_key() function.
-Compute the corresponding public key for a private key.
-
-Inputs:
-    private_key - The private key to compute the public key for
-
-Outputs:
-    public_key - Will be filled in with the corresponding public key
-
-Returns 1 if the key was computed successfully, 0 if an error occurred.
-*/
-int mg_uecc_compute_public_key(const uint8_t *private_key, uint8_t *public_key,
-                               MG_UECC_Curve curve);
-
-/* mg_uecc_sign() function.
-Generate an ECDSA signature for a given hash value.
-
-Usage: Compute a hash of the data you wish to sign (SHA-2 is recommended) and
-pass it in to this function along with your private key.
-
-Inputs:
-    private_key  - Your private key.
-    message_hash - The hash of the message to sign.
-    hash_size    - The size of message_hash in bytes.
-
-Outputs:
-    signature - Will be filled in with the signature value. Must be at least 2 *
-curve size long. For example, if the curve is secp256r1, signature must be 64
-bytes long.
-
-Returns 1 if the signature generated successfully, 0 if an error occurred.
-*/
-int mg_uecc_sign(const uint8_t *private_key, const uint8_t *message_hash,
-                 unsigned hash_size, uint8_t *signature, MG_UECC_Curve curve);
-
-/* MG_UECC_HashContext structure.
-This is used to pass in an arbitrary hash function to
-mg_uecc_sign_deterministic(). The structure will be used for multiple hash
-computations; each time a new hash is computed, init_hash() will be called,
-followed by one or more calls to update_hash(), and finally a call to
-finish_hash() to produce the resulting hash.
-
-The intention is that you will create a structure that includes
-MG_UECC_HashContext followed by any hash-specific data. For example:
-
-typedef struct SHA256_HashContext {
-    MG_UECC_HashContext uECC;
-    SHA256_CTX ctx;
-} SHA256_HashContext;
-
-void init_SHA256(MG_UECC_HashContext *base) {
-    SHA256_HashContext *context = (SHA256_HashContext *)base;
-    SHA256_Init(&context->ctx);
-}
-
-void update_SHA256(MG_UECC_HashContext *base,
-                   const uint8_t *message,
-                   unsigned message_size) {
-    SHA256_HashContext *context = (SHA256_HashContext *)base;
-    SHA256_Update(&context->ctx, message, message_size);
-}
-
-void finish_SHA256(MG_UECC_HashContext *base, uint8_t *hash_result) {
-    SHA256_HashContext *context = (SHA256_HashContext *)base;
-    SHA256_Final(hash_result, &context->ctx);
-}
-
-... when signing ...
-{
-    uint8_t tmp[32 + 32 + 64];
-    SHA256_HashContext ctx = {{&init_SHA256, &update_SHA256, &finish_SHA256, 64,
-32, tmp}}; mg_uecc_sign_deterministic(key, message_hash, &ctx.uECC, signature);
-}
-*/
-typedef struct MG_UECC_HashContext {
-  void (*init_hash)(const struct MG_UECC_HashContext *context);
-  void (*update_hash)(const struct MG_UECC_HashContext *context,
-                      const uint8_t *message, unsigned message_size);
-  void (*finish_hash)(const struct MG_UECC_HashContext *context,
-                      uint8_t *hash_result);
-  unsigned
-      block_size; /* Hash function block size in bytes, eg 64 for SHA-256. */
-  unsigned
-      result_size; /* Hash function result size in bytes, eg 32 for SHA-256. */
-  uint8_t *tmp;    /* Must point to a buffer of at least (2 * result_size +
-                      block_size) bytes. */
-} MG_UECC_HashContext;
-
-/* mg_uecc_sign_deterministic() function.
-Generate an ECDSA signature for a given hash value, using a deterministic
-algorithm (see RFC 6979). You do not need to set the RNG using mg_uecc_set_rng()
-before calling this function; however, if the RNG is defined it will improve
-resistance to side-channel attacks.
-
-Usage: Compute a hash of the data you wish to sign (SHA-2 is recommended) and
-pass it to this function along with your private key and a hash context. Note
-that the message_hash does not need to be computed with the same hash function
-used by hash_context.
-
-Inputs:
-    private_key  - Your private key.
-    message_hash - The hash of the message to sign.
-    hash_size    - The size of message_hash in bytes.
-    hash_context - A hash context to use.
-
-Outputs:
-    signature - Will be filled in with the signature value.
-
-Returns 1 if the signature generated successfully, 0 if an error occurred.
-*/
-int mg_uecc_sign_deterministic(const uint8_t *private_key,
-                               const uint8_t *message_hash, unsigned hash_size,
-                               const MG_UECC_HashContext *hash_context,
-                               uint8_t *signature, MG_UECC_Curve curve);
-
-/* mg_uecc_verify() function.
-Verify an ECDSA signature.
-
-Usage: Compute the hash of the signed data using the same hash as the signer and
-pass it to this function along with the signer's public key and the signature
-values (r and s).
-
-Inputs:
-    public_key   - The signer's public key.
-    message_hash - The hash of the signed data.
-    hash_size    - The size of message_hash in bytes.
-    signature    - The signature value.
-
-Returns 1 if the signature is valid, 0 if it is invalid.
-*/
-int mg_uecc_verify(const uint8_t *public_key, const uint8_t *message_hash,
-                   unsigned hash_size, const uint8_t *signature,
-                   MG_UECC_Curve curve);
-
-#ifdef __cplusplus
-} /* end of extern "C" */
-#endif
-
-#endif /* _UECC_H_ */
-
-/* Copyright 2015, Kenneth MacKay. Licensed under the BSD 2-clause license. */
-
-#ifndef _UECC_TYPES_H_
-#define _UECC_TYPES_H_
-
-#ifndef MG_UECC_PLATFORM
-#if defined(__AVR__) && __AVR__
-#define MG_UECC_PLATFORM mg_uecc_avr
-#elif defined(__thumb2__) || \
-    defined(_M_ARMT) /* I think MSVC only supports Thumb-2 targets */
-#define MG_UECC_PLATFORM mg_uecc_arm_thumb2
-#elif defined(__thumb__)
-#define MG_UECC_PLATFORM mg_uecc_arm_thumb
-#elif defined(__arm__) || defined(_M_ARM)
-#define MG_UECC_PLATFORM mg_uecc_arm
-#elif defined(__aarch64__)
-#define MG_UECC_PLATFORM mg_uecc_arm64
-#elif defined(__i386__) || defined(_M_IX86) || defined(_X86_) || \
-    defined(__I86__)
-#define MG_UECC_PLATFORM mg_uecc_x86
-#elif defined(__amd64__) || defined(_M_X64)
-#define MG_UECC_PLATFORM mg_uecc_x86_64
-#else
-#define MG_UECC_PLATFORM mg_uecc_arch_other
-#endif
-#endif
-
-#ifndef MG_UECC_ARM_USE_UMAAL
-#if (MG_UECC_PLATFORM == mg_uecc_arm) && (__ARM_ARCH >= 6)
-#define MG_UECC_ARM_USE_UMAAL 1
-#elif (MG_UECC_PLATFORM == mg_uecc_arm_thumb2) && (__ARM_ARCH >= 6) && \
-    (!defined(__ARM_ARCH_7M__) || !__ARM_ARCH_7M__)
-#define MG_UECC_ARM_USE_UMAAL 1
-#else
-#define MG_UECC_ARM_USE_UMAAL 0
-#endif
-#endif
-
-#ifndef MG_UECC_WORD_SIZE
-#if MG_UECC_PLATFORM == mg_uecc_avr
-#define MG_UECC_WORD_SIZE 1
-#elif (MG_UECC_PLATFORM == mg_uecc_x86_64 || MG_UECC_PLATFORM == mg_uecc_arm64)
-#define MG_UECC_WORD_SIZE 8
-#else
-#define MG_UECC_WORD_SIZE 4
-#endif
-#endif
-
-#if (MG_UECC_WORD_SIZE != 1) && (MG_UECC_WORD_SIZE != 4) && \
-    (MG_UECC_WORD_SIZE != 8)
-#error "Unsupported value for MG_UECC_WORD_SIZE"
-#endif
-
-#if ((MG_UECC_PLATFORM == mg_uecc_avr) && (MG_UECC_WORD_SIZE != 1))
-#pragma message("MG_UECC_WORD_SIZE must be 1 for AVR")
-#undef MG_UECC_WORD_SIZE
-#define MG_UECC_WORD_SIZE 1
-#endif
-
-#if ((MG_UECC_PLATFORM == mg_uecc_arm ||         \
-      MG_UECC_PLATFORM == mg_uecc_arm_thumb ||   \
-      MG_UECC_PLATFORM == mg_uecc_arm_thumb2) && \
-     (MG_UECC_WORD_SIZE != 4))
-#pragma message("MG_UECC_WORD_SIZE must be 4 for ARM")
-#undef MG_UECC_WORD_SIZE
-#define MG_UECC_WORD_SIZE 4
-#endif
-
-typedef int8_t wordcount_t;
-typedef int16_t bitcount_t;
-typedef int8_t cmpresult_t;
-
-#if (MG_UECC_WORD_SIZE == 1)
-
-typedef uint8_t mg_uecc_word_t;
-typedef uint16_t mg_uecc_dword_t;
-
-#define HIGH_BIT_SET 0x80
-#define MG_UECC_WORD_BITS 8
-#define MG_UECC_WORD_BITS_SHIFT 3
-#define MG_UECC_WORD_BITS_MASK 0x07
-
-#elif (MG_UECC_WORD_SIZE == 4)
-
-typedef uint32_t mg_uecc_word_t;
-typedef uint64_t mg_uecc_dword_t;
-
-#define HIGH_BIT_SET 0x80000000
-#define MG_UECC_WORD_BITS 32
-#define MG_UECC_WORD_BITS_SHIFT 5
-#define MG_UECC_WORD_BITS_MASK 0x01F
-
-#elif (MG_UECC_WORD_SIZE == 8)
-
-typedef uint64_t mg_uecc_word_t;
-
-#define HIGH_BIT_SET 0x8000000000000000U
-#define MG_UECC_WORD_BITS 64
-#define MG_UECC_WORD_BITS_SHIFT 6
-#define MG_UECC_WORD_BITS_MASK 0x03F
-
-#endif /* MG_UECC_WORD_SIZE */
-
-#endif /* _UECC_TYPES_H_ */
-
-/* Copyright 2015, Kenneth MacKay. Licensed under the BSD 2-clause license. */
-
-#ifndef _UECC_VLI_H_
-#define _UECC_VLI_H_
-
-// #include "types.h"
-// #include "uECC.h"
-
-/* Functions for raw large-integer manipulation. These are only available
-   if uECC.c is compiled with MG_UECC_ENABLE_VLI_API defined to 1. */
-#ifndef MG_UECC_ENABLE_VLI_API
-#define MG_UECC_ENABLE_VLI_API 0
-#endif
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#if MG_UECC_ENABLE_VLI_API
-
-void mg_uecc_vli_clear(mg_uecc_word_t *vli, wordcount_t num_words);
-
-/* Constant-time comparison to zero - secure way to compare long integers */
-/* Returns 1 if vli == 0, 0 otherwise. */
-mg_uecc_word_t mg_uecc_vli_isZero(const mg_uecc_word_t *vli,
-                                  wordcount_t num_words);
-
-/* Returns nonzero if bit 'bit' of vli is set. */
-mg_uecc_word_t mg_uecc_vli_testBit(const mg_uecc_word_t *vli, bitcount_t bit);
-
-/* Counts the number of bits required to represent vli. */
-bitcount_t mg_uecc_vli_numBits(const mg_uecc_word_t *vli,
-                               const wordcount_t max_words);
-
-/* Sets dest = src. */
-void mg_uecc_vli_set(mg_uecc_word_t *dest, const mg_uecc_word_t *src,
-                     wordcount_t num_words);
-
-/* Constant-time comparison function - secure way to compare long integers */
-/* Returns one if left == right, zero otherwise */
-mg_uecc_word_t mg_uecc_vli_equal(const mg_uecc_word_t *left,
-                                 const mg_uecc_word_t *right,
-                                 wordcount_t num_words);
-
-/* Constant-time comparison function - secure way to compare long integers */
-/* Returns sign of left - right, in constant time. */
-cmpresult_t mg_uecc_vli_cmp(const mg_uecc_word_t *left,
-                            const mg_uecc_word_t *right, wordcount_t num_words);
-
-/* Computes vli = vli >> 1. */
-void mg_uecc_vli_rshift1(mg_uecc_word_t *vli, wordcount_t num_words);
-
-/* Computes result = left + right, returning carry. Can modify in place. */
-mg_uecc_word_t mg_uecc_vli_add(mg_uecc_word_t *result,
-                               const mg_uecc_word_t *left,
-                               const mg_uecc_word_t *right,
-                               wordcount_t num_words);
-
-/* Computes result = left - right, returning borrow. Can modify in place. */
-mg_uecc_word_t mg_uecc_vli_sub(mg_uecc_word_t *result,
-                               const mg_uecc_word_t *left,
-                               const mg_uecc_word_t *right,
-                               wordcount_t num_words);
-
-/* Computes result = left * right. Result must be 2 * num_words long. */
-void mg_uecc_vli_mult(mg_uecc_word_t *result, const mg_uecc_word_t *left,
-                      const mg_uecc_word_t *right, wordcount_t num_words);
-
-/* Computes result = left^2. Result must be 2 * num_words long. */
-void mg_uecc_vli_square(mg_uecc_word_t *result, const mg_uecc_word_t *left,
-                        wordcount_t num_words);
-
-/* Computes result = (left + right) % mod.
-   Assumes that left < mod and right < mod, and that result does not overlap
-   mod. */
-void mg_uecc_vli_modAdd(mg_uecc_word_t *result, const mg_uecc_word_t *left,
-                        const mg_uecc_word_t *right, const mg_uecc_word_t *mod,
-                        wordcount_t num_words);
-
-/* Computes result = (left - right) % mod.
-   Assumes that left < mod and right < mod, and that result does not overlap
-   mod. */
-void mg_uecc_vli_modSub(mg_uecc_word_t *result, const mg_uecc_word_t *left,
-                        const mg_uecc_word_t *right, const mg_uecc_word_t *mod,
-                        wordcount_t num_words);
-
-/* Computes result = product % mod, where product is 2N words long.
-   Currently only designed to work for mod == curve->p or curve_n. */
-void mg_uecc_vli_mmod(mg_uecc_word_t *result, mg_uecc_word_t *product,
-                      const mg_uecc_word_t *mod, wordcount_t num_words);
-
-/* Calculates result = product (mod curve->p), where product is up to
-   2 * curve->num_words long. */
-void mg_uecc_vli_mmod_fast(mg_uecc_word_t *result, mg_uecc_word_t *product,
-                           MG_UECC_Curve curve);
-
-/* Computes result = (left * right) % mod.
-   Currently only designed to work for mod == curve->p or curve_n. */
-void mg_uecc_vli_modMult(mg_uecc_word_t *result, const mg_uecc_word_t *left,
-                         const mg_uecc_word_t *right, const mg_uecc_word_t *mod,
-                         wordcount_t num_words);
-
-/* Computes result = (left * right) % curve->p. */
-void mg_uecc_vli_modMult_fast(mg_uecc_word_t *result,
-                              const mg_uecc_word_t *left,
-                              const mg_uecc_word_t *right, MG_UECC_Curve curve);
-
-/* Computes result = left^2 % mod.
-   Currently only designed to work for mod == curve->p or curve_n. */
-void mg_uecc_vli_modSquare(mg_uecc_word_t *result, const mg_uecc_word_t *left,
-                           const mg_uecc_word_t *mod, wordcount_t num_words);
-
-/* Computes result = left^2 % curve->p. */
-void mg_uecc_vli_modSquare_fast(mg_uecc_word_t *result,
-                                const mg_uecc_word_t *left,
-                                MG_UECC_Curve curve);
-
-/* Computes result = (1 / input) % mod.*/
-void mg_uecc_vli_modInv(mg_uecc_word_t *result, const mg_uecc_word_t *input,
-                        const mg_uecc_word_t *mod, wordcount_t num_words);
-
-#if MG_UECC_SUPPORT_COMPRESSED_POINT
-/* Calculates a = sqrt(a) (mod curve->p) */
-void mg_uecc_vli_mod_sqrt(mg_uecc_word_t *a, MG_UECC_Curve curve);
-#endif
-
-/* Converts an integer in uECC native format to big-endian bytes. */
-void mg_uecc_vli_nativeToBytes(uint8_t *bytes, int num_bytes,
-                               const mg_uecc_word_t *native);
-/* Converts big-endian bytes to an integer in uECC native format. */
-void mg_uecc_vli_bytesToNative(mg_uecc_word_t *native, const uint8_t *bytes,
-                               int num_bytes);
-
-unsigned mg_uecc_curve_num_words(MG_UECC_Curve curve);
-unsigned mg_uecc_curve_num_bytes(MG_UECC_Curve curve);
-unsigned mg_uecc_curve_num_bits(MG_UECC_Curve curve);
-unsigned mg_uecc_curve_num_n_words(MG_UECC_Curve curve);
-unsigned mg_uecc_curve_num_n_bytes(MG_UECC_Curve curve);
-unsigned mg_uecc_curve_num_n_bits(MG_UECC_Curve curve);
-
-const mg_uecc_word_t *mg_uecc_curve_p(MG_UECC_Curve curve);
-const mg_uecc_word_t *mg_uecc_curve_n(MG_UECC_Curve curve);
-const mg_uecc_word_t *mg_uecc_curve_G(MG_UECC_Curve curve);
-const mg_uecc_word_t *mg_uecc_curve_b(MG_UECC_Curve curve);
-
-int mg_uecc_valid_point(const mg_uecc_word_t *point, MG_UECC_Curve curve);
-
-/* Multiplies a point by a scalar. Points are represented by the X coordinate
-   followed by the Y coordinate in the same array, both coordinates are
-   curve->num_words long. Note that scalar must be curve->num_n_words long (NOT
-   curve->num_words). */
-void mg_uecc_point_mult(mg_uecc_word_t *result, const mg_uecc_word_t *point,
-                        const mg_uecc_word_t *scalar, MG_UECC_Curve curve);
-
-/* Generates a random integer in the range 0 < random < top.
-   Both random and top have num_words words. */
-int mg_uecc_generate_random_int(mg_uecc_word_t *random,
-                                const mg_uecc_word_t *top,
-                                wordcount_t num_words);
-
-#endif /* MG_UECC_ENABLE_VLI_API */
-
-#ifdef __cplusplus
-} /* end of extern "C" */
-#endif
-
-#endif /* _UECC_VLI_H_ */
-
-// End of uecc BSD-2

src/tls_x25519.c

@@ -1,262 +0,0 @@
-/**
- * Adapted from STROBE: https://strobe.sourceforge.io/
- * Copyright (c) 2015-2016 Cryptography Research, Inc.
- * Author: Mike Hamburg
- * License: MIT License
- */
-#include "tls.h"
-#include "tls_x25519.h"
-#include "util.h"
-
-#if MG_TLS == MG_TLS_BUILTIN
-
-const uint8_t X25519_BASE_POINT[X25519_BYTES] = {9};
-
-#define X25519_WBITS 32
-
-typedef uint32_t limb_t;
-typedef uint64_t dlimb_t;
-typedef int64_t sdlimb_t;
-
-#define NLIMBS (256 / X25519_WBITS)
-typedef limb_t mg_fe[NLIMBS];
-
-static limb_t umaal(limb_t *carry, limb_t acc, limb_t mand, limb_t mier) {
-  dlimb_t tmp = (dlimb_t) mand * mier + acc + *carry;
-  *carry = (limb_t) (tmp >> X25519_WBITS);
-  return (limb_t) tmp;
-}
-
-// These functions are implemented in terms of umaal on ARM
-static limb_t adc(limb_t *carry, limb_t acc, limb_t mand) {
-  dlimb_t total = (dlimb_t) *carry + acc + mand;
-  *carry = (limb_t) (total >> X25519_WBITS);
-  return (limb_t) total;
-}
-
-static limb_t adc0(limb_t *carry, limb_t acc) {
-  dlimb_t total = (dlimb_t) *carry + acc;
-  *carry = (limb_t) (total >> X25519_WBITS);
-  return (limb_t) total;
-}
-
-// - Precondition: carry is small.
-// - Invariant: result of propagate is < 2^255 + 1 word
-// - In particular, always less than 2p.
-// - Also, output x >= min(x,19)
-static void propagate(mg_fe x, limb_t over) {
-  unsigned i;
-  limb_t carry;
-  over = x[NLIMBS - 1] >> (X25519_WBITS - 1) | over << 1;
-  x[NLIMBS - 1] &= ~((limb_t) 1 << (X25519_WBITS - 1));
-
-  carry = over * 19;
-  for (i = 0; i < NLIMBS; i++) {
-    x[i] = adc0(&carry, x[i]);
-  }
-}
-
-static void add(mg_fe out, const mg_fe a, const mg_fe b) {
-  unsigned i;
-  limb_t carry = 0;
-  for (i = 0; i < NLIMBS; i++) {
-    out[i] = adc(&carry, a[i], b[i]);
-  }
-  propagate(out, carry);
-}
-
-static void sub(mg_fe out, const mg_fe a, const mg_fe b) {
-  unsigned i;
-  sdlimb_t carry = -38;
-  for (i = 0; i < NLIMBS; i++) {
-    carry = carry + a[i] - b[i];
-    out[i] = (limb_t) carry;
-    carry >>= X25519_WBITS;
-  }
-  propagate(out, (limb_t) (1 + carry));
-}
-
-// `b` can contain less than 8 limbs, thus we use `limb_t *` instead of `mg_fe`
-// to avoid build warnings
-static void mul(mg_fe out, const mg_fe a, const limb_t *b, unsigned nb) {
-  limb_t accum[2 * NLIMBS] = {0};
-  unsigned i, j;
-
-  limb_t carry2;
-  for (i = 0; i < nb; i++) {
-    limb_t mand = b[i];
-    carry2 = 0;
-    for (j = 0; j < NLIMBS; j++) {
-      limb_t tmp;                        // "a" may be misaligned
-      memcpy(&tmp, &a[j], sizeof(tmp));  // So make an aligned copy
-      accum[i + j] = umaal(&carry2, accum[i + j], mand, tmp);
-    }
-    accum[i + j] = carry2;
-  }
-
-  carry2 = 0;
-  for (j = 0; j < NLIMBS; j++) {
-    out[j] = umaal(&carry2, accum[j], 38, accum[j + NLIMBS]);
-  }
-  propagate(out, carry2);
-}
-
-static void sqr(mg_fe out, const mg_fe a) {
-  mul(out, a, a, NLIMBS);
-}
-static void mul1(mg_fe out, const mg_fe a) {
-  mul(out, a, out, NLIMBS);
-}
-static void sqr1(mg_fe a) {
-  mul1(a, a);
-}
-
-static void condswap(limb_t a[2 * NLIMBS], limb_t b[2 * NLIMBS],
-                     limb_t doswap) {
-  unsigned i;
-  for (i = 0; i < 2 * NLIMBS; i++) {
-    limb_t xor_ab = (a[i] ^ b[i]) & doswap;
-    a[i] ^= xor_ab;
-    b[i] ^= xor_ab;
-  }
-}
-
-// Canonicalize a field element x, reducing it to the least residue which is
-// congruent to it mod 2^255-19
-// - Precondition: x < 2^255 + 1 word
-static limb_t canon(mg_fe x) {
-  // First, add 19.
-  unsigned i;
-  limb_t carry0 = 19;
-  limb_t res;
-  sdlimb_t carry;
-  for (i = 0; i < NLIMBS; i++) {
-    x[i] = adc0(&carry0, x[i]);
-  }
-  propagate(x, carry0);
-
-  // Here, 19 <= x2 < 2^255
-  // - This is because we added 19, so before propagate it can't be less
-  // than 19. After propagate, it still can't be less than 19, because if
-  // propagate does anything it adds 19.
-  // - We know that the high bit must be clear, because either the input was ~
-  // 2^255 + one word + 19 (in which case it propagates to at most 2 words) or
-  // it was < 2^255. So now, if we subtract 19, we will get back to something in
-  // [0,2^255-19).
-  carry = -19;
-  res = 0;
-  for (i = 0; i < NLIMBS; i++) {
-    carry += x[i];
-    res |= x[i] = (limb_t) carry;
-    carry >>= X25519_WBITS;
-  }
-  return (limb_t) (((dlimb_t) res - 1) >> X25519_WBITS);
-}
-
-static const limb_t a24[1] = {121665};
-
-static void ladder_part1(mg_fe xs[5]) {
-  limb_t *x2 = xs[0], *z2 = xs[1], *x3 = xs[2], *z3 = xs[3], *t1 = xs[4];
-  add(t1, x2, z2);                                 // t1 = A
-  sub(z2, x2, z2);                                 // z2 = B
-  add(x2, x3, z3);                                 // x2 = C
-  sub(z3, x3, z3);                                 // z3 = D
-  mul1(z3, t1);                                    // z3 = DA
-  mul1(x2, z2);                                    // x3 = BC
-  add(x3, z3, x2);                                 // x3 = DA+CB
-  sub(z3, z3, x2);                                 // z3 = DA-CB
-  sqr1(t1);                                        // t1 = AA
-  sqr1(z2);                                        // z2 = BB
-  sub(x2, t1, z2);                                 // x2 = E = AA-BB
-  mul(z2, x2, a24, sizeof(a24) / sizeof(a24[0]));  // z2 = E*a24
-  add(z2, z2, t1);                                 // z2 = E*a24 + AA
-}
-
-static void ladder_part2(mg_fe xs[5], const mg_fe x1) {
-  limb_t *x2 = xs[0], *z2 = xs[1], *x3 = xs[2], *z3 = xs[3], *t1 = xs[4];
-  sqr1(z3);         // z3 = (DA-CB)^2
-  mul1(z3, x1);     // z3 = x1 * (DA-CB)^2
-  sqr1(x3);         // x3 = (DA+CB)^2
-  mul1(z2, x2);     // z2 = AA*(E*a24+AA)
-  sub(x2, t1, x2);  // x2 = BB again
-  mul1(x2, t1);     // x2 = AA*BB
-}
-
-static void x25519_core(mg_fe xs[5], const uint8_t scalar[X25519_BYTES],
-                        const uint8_t *x1, int clamp) {
-  int i;
-  mg_fe x1_limbs;
-  limb_t swap = 0;
-  limb_t *x2 = xs[0], *x3 = xs[2], *z3 = xs[3];
-  memset(xs, 0, 4 * sizeof(mg_fe));
-  x2[0] = z3[0] = 1;
-  for (i = 0; i < NLIMBS; i++) {
-    x3[i] = x1_limbs[i] =
-        MG_U32(x1[i * 4 + 3], x1[i * 4 + 2], x1[i * 4 + 1], x1[i * 4]);
-  }
-
-  for (i = 255; i >= 0; i--) {
-    uint8_t bytei = scalar[i / 8];
-    limb_t doswap;
-    if (clamp) {
-      if (i / 8 == 0) {
-        bytei &= (uint8_t) ~7U;
-      } else if (i / 8 == X25519_BYTES - 1) {
-        bytei &= 0x7F;
-        bytei |= 0x40;
-      }
-    }
-    doswap = 0 - (limb_t) ((bytei >> (i % 8)) & 1);
-    condswap(x2, x3, swap ^ doswap);
-    swap = doswap;
-
-    ladder_part1(xs);
-    ladder_part2(xs, (const limb_t *) x1_limbs);
-  }
-  condswap(x2, x3, swap);
-}
-
-int mg_tls_x25519(uint8_t out[X25519_BYTES], const uint8_t scalar[X25519_BYTES],
-                  const uint8_t x1[X25519_BYTES], int clamp) {
-  int i, ret;
-  mg_fe xs[5], out_limbs;
-  limb_t *x2, *z2, *z3, *prev;
-  static const struct {
-    uint8_t a, c, n;
-  } steps[13] = {{2, 1, 1},  {2, 1, 1},  {4, 2, 3},  {2, 4, 6},  {3, 1, 1},
-                 {3, 2, 12}, {4, 3, 25}, {2, 3, 25}, {2, 4, 50}, {3, 2, 125},
-                 {3, 1, 2},  {3, 1, 2},  {3, 1, 1}};
-  x25519_core(xs, scalar, x1, clamp);
-
-  // Precomputed inversion chain
-  x2 = xs[0];
-  z2 = xs[1];
-  z3 = xs[3];
-
-  prev = z2;
-  for (i = 0; i < 13; i++) {
-    int j;
-    limb_t *a = xs[steps[i].a];
-    for (j = steps[i].n; j > 0; j--) {
-      sqr(a, prev);
-      prev = a;
-    }
-    mul1(a, xs[steps[i].c]);
-  }
-
-  // Here prev = z3
-  // x2 /= z2
-  mul(out_limbs, x2, z3, NLIMBS);
-  ret = (int) canon(out_limbs);
-  if (!clamp) ret = 0;
-  for (i = 0; i < NLIMBS; i++) {
-    uint32_t n = out_limbs[i];
-    out[i * 4] = (uint8_t) (n & 0xff);
-    out[i * 4 + 1] = (uint8_t) ((n >> 8) & 0xff);
-    out[i * 4 + 2] = (uint8_t) ((n >> 16) & 0xff);
-    out[i * 4 + 3] = (uint8_t) ((n >> 24) & 0xff);
-  }
-  return ret;
-}
-
-#endif

src/tls_x25519.h

@@ -1,13 +0,0 @@
-#ifndef TLS_X15519_H
-#define TLS_X15519_H
-
-#include "arch.h"
-
-#define X25519_BYTES 32
-extern const uint8_t X25519_BASE_POINT[X25519_BYTES];
-
-int mg_tls_x25519(uint8_t out[X25519_BYTES], const uint8_t scalar[X25519_BYTES],
-                  const uint8_t x1[X25519_BYTES], int clamp);
-
-
-#endif /* TLS_X15519_H */

src/util.c

@@ -1,5 +1,6 @@
 #include "util.h"
 #include "log.h"
+#include "net.h"
 
 // Not using memset for zeroing memory, cause it can be dropped by compiler
 // See https://github.com/cesanta/mongoose/pull/1265
@@ -43,11 +44,12 @@ bool mg_random(void *buf, size_t len) {
   success = true;
 #elif MG_ARCH == MG_ARCH_CUBE && defined(HAL_RNG_MODULE_ENABLED)
   extern RNG_HandleTypeDef hrng;
+  success = true;
   for (size_t n = 0; n < len; n += sizeof(uint32_t)) {
-    uint32_t r = HAL_RNG_ReadLastRandomNumber(&hrng);
+    uint32_t r = 0;
+    if (HAL_RNG_GenerateRandomNumber(&hrng, &r) != HAL_OK) success = false;
     memcpy((char *) buf + n, &r, n + sizeof(r) > len ? len - n : sizeof(r));
   }
-  success = true;
 #elif MG_ARCH == MG_ARCH_PICOSDK
   while (len--) *p++ = (unsigned char) (get_rand_32() & 255);
   success = true;
@@ -142,22 +144,21 @@ uint16_t mg_crc16(uint16_t crc, const char *buf, size_t len) {
   return (uint16_t) ~c;
 }
 
-static int isbyte(int n) {
+// Parse "IP" or "IP/BITS" into net and mask. The whole spec must be valid
-  return n >= 0 && n <= 255;
+static bool parse_net(struct mg_str spec, uint32_t *net, uint32_t *mask) {
-}
+  struct mg_str caps[3], ip = spec, bits = mg_str("32");
-
+  struct mg_addr addr;
-static int parse_net(const char *spec, uint32_t *net, uint32_t *mask) {
+  uint8_t n = 0;
-  int n, a, b, c, d, slash = 32, len = 0;
+  if (mg_match(spec, mg_str("*/*"), caps)) ip = caps[0], bits = caps[1];
-  if ((sscanf(spec, "%d.%d.%d.%d/%d%n", &a, &b, &c, &d, &slash, &n) == 5 ||
+  // ip.len == 0 check: mg_aton() parses an empty string as 0.0.0.0
-       sscanf(spec, "%d.%d.%d.%d%n", &a, &b, &c, &d, &n) == 4) &&
+  if (ip.len == 0 || !mg_aton(ip, &addr) || addr.is_ip6 ||
-      isbyte(a) && isbyte(b) && isbyte(c) && isbyte(d) && slash >= 0 &&
+      !mg_str_to_num(bits, 10, &n, sizeof(n)) || n > 32) {
-      slash < 33) {
+    return false;
-    len = n;
-    *net = ((uint32_t) a << 24) | ((uint32_t) b << 16) | ((uint32_t) c << 8) |
-           (uint32_t) d;
-    *mask = slash ? (uint32_t) (0xffffffffU << (32 - slash)) : (uint32_t) 0;
   }
-  return len;
+  memcpy(net, addr.addr.ip, sizeof(*net));
+  *net = mg_ntohl(*net);
+  *mask = n ? (uint32_t) (0xffffffffU << (32 - n)) : (uint32_t) 0;
+  return true;
 }
 
 int mg_check_ip_acl(struct mg_str acl, struct mg_addr *remote_ip) {
@@ -171,7 +172,9 @@ int mg_check_ip_acl(struct mg_str acl, struct mg_addr *remote_ip) {
     while (mg_span(acl, &entry, &acl, ',')) {
       uint32_t net, mask;
       if (entry.buf[0] != '+' && entry.buf[0] != '-') return -1;
-      if (parse_net(&entry.buf[1], &net, &mask) == 0) return -2;
+      if (!parse_net(mg_str_n(entry.buf + 1, entry.len - 1), &net, &mask)) {
+        return -2;
+      }
       if ((mg_ntohl(remote_ip4) & mask) == net) allowed = entry.buf[0];
     }
   }
@@ -197,7 +200,7 @@ bool mg_path_is_sane(const struct mg_str path) {
 #if MG_ENABLE_CUSTOM_MILLIS
 #else
 uint64_t mg_millis(void) {
-#if MG_ARCH == MG_ARCH_ESP8266 || MG_ARCH == MG_ARCH_ESP32 || MG_ENABLE_FREERTOS
+#if MG_ARCH == MG_ARCH_ESP32 || MG_ENABLE_FREERTOS
   return xTaskGetTickCount() * portTICK_PERIOD_MS;
 #elif MG_ARCH == MG_ARCH_THREADX
   return tx_time_get() * (1000 /* MS per SEC */ / TX_TIMER_TICKS_PER_SECOND);
@@ -258,8 +261,9 @@ uint64_t mg_ntohll(uint64_t net) {
 }
 
 void mg_delayms(unsigned int ms) {
-  uint64_t to = mg_millis() + ms + 1;
+  uint64_t now, to = mg_millis() + ms + 1;
-  while (mg_millis() < to) (void) 0;
+  while ((now = mg_millis()) < to)
+    if (now + ms + 1 < to) to = now + ms + 1;
 }
 
 #if MG_ENABLE_CUSTOM_CALLOC

test/Makefile

@@ -16,9 +16,9 @@ IPV6 ?= 1
 MDASH ?= 1
 ASAN ?= -fsanitize=address,undefined,alignment -fno-sanitize-recover=all -fno-omit-frame-pointer -fno-common
 ASAN_OPTIONS ?= detect_leaks=1
-# This does not include ESP32, ESP8266, Microchip; all examples that are directly placed under an OS tutorial. Also, it is needed that way...
+TUTORIALS_EMBEDDED := $(dir $(wildcard ../tutorials/esp32/*/Makefile)) $(dir $(wildcard ../tutorials/infineon/*/Makefile)) $(dir $(wildcard ../tutorials/microchip/*/*/Makefile)) $(dir $(wildcard ../tutorials/nordic/*/Makefile)) $(dir $(wildcard ../tutorials/nxp/*/*/Makefile)) $(dir $(wildcard ../tutorials/pico-sdk/*/Makefile)) $(dir $(wildcard ../tutorials/rp/*/Makefile)) $(dir $(wildcard ../tutorials/renesas/*/Makefile)) $(dir $(wildcard ../tutorials/stm32/*/Makefile)) $(dir $(wildcard ../tutorials/stm32/*/*/Makefile)) $(dir $(wildcard ../tutorials/ti/*/Makefile)) $(dir $(wildcard ../tutorials/wch/*/Makefile))
-TUTORIALS_EMBEDDED := $(dir $(wildcard ../tutorials/infineon/*/Makefile)) $(dir $(wildcard ../tutorials/nxp/*/Makefile)) $(dir $(wildcard ../tutorials/rp/*/Makefile)) $(dir $(wildcard ../tutorials/renesas/*/Makefile)) $(dir $(wildcard ../tutorials/stm32/*/*/Makefile)) $(dir $(wildcard ../tutorials/ti/*/Makefile)) $(dir $(wildcard ../tutorials/wch/*/Makefile))
+TUTORIALS_ZEPHYR := $(dir $(wildcard ../tutorials/zephyr/*/Makefile))
-TUTORIALS := ../tutorials/micropython/ $(filter-out $(TUTORIALS_EMBEDDED), $(dir $(wildcard ../tutorials/*/*/Makefile)))
+TUTORIALS := ../tutorials/micropython/ $(filter-out $(TUTORIALS_EMBEDDED) $(TUTORIALS_ZEPHYR), $(dir $(wildcard ../tutorials/*/*/Makefile)))
 TUTORIALS_QUICK := $(filter-out ../tutorials/micropython/ ../tutorials/tcpip/pcap-driver/, $(TUTORIALS))
 TUTORIALS_MAC := $(filter-out ../tutorials/micropython/ ../tutorials/tcpip/pcap-driver/ ../tutorials/tcpip/tap-driver/, $(TUTORIALS))
 TUTORIALS_WIN := $(dir $(wildcard ../tutorials/http/file-*/Makefile) $(wildcard ../tutorials/http/http-*/Makefile) $(wildcard ../tutorials/mqtt/*/Makefile) $(wildcard ../tutorials/websocket/*/Makefile) $(wildcard ../tutorials/webui/*/Makefile))
@@ -76,19 +76,10 @@ LDFLAGS += -L$(WOLFSSL)/lib -lwolfssl
 endif
 
 ifeq "$(SSL)" "BUILTIN"
-DEFS += -DMG_TLS=MG_TLS_BUILTIN
+# Small TLS records: several records per TCP segment, tests record handling
+DEFS += -DMG_TLS=MG_TLS_BUILTIN -DMG_TLS_RECORD_SIZE=256
 endif
 
-tls_multirec/server: FORCE
-ifneq "$(SSL)" ""
-ifeq "$(MULTIREC)" ""
-	$(MAKE) -C tls_multirec CC=gcc
-endif
-endif
-	true
-
-FORCE:
-	true
 
 
 all:
@@ -107,13 +98,13 @@ mongoose.c: Makefile $(wildcard ../src/*.c) $(wildcard ../src/drivers/*.c)
 	cd .. && (export LC_ALL=C ; cat src/license.h; echo; echo '#include "mongoose.h"' ; (for F in src/*.c src/drivers/*.c ; do echo; echo '#ifdef MG_ENABLE_LINES'; echo "#line 1 \"$$F\""; echo '#endif'; cat $$F | sed -e 's,#include ".*,,'; done))> $@
 
 mongoose.h: $(HDRS) Makefile
-	cd .. && (export LC_ALL=C ; cat src/license.h; echo; echo '#ifndef MONGOOSE_H'; echo '#define MONGOOSE_H'; echo; cat src/version.h ; echo; echo '#ifdef __cplusplus'; echo 'extern "C" {'; echo '#endif'; cat src/arch.h src/arch_*.h src/os_*.h src/net_ft.h src/net_lwip.h src/net_rl.h src/config.h src/profile.h src/str.h src/queue.h src/fmt.h src/printf.h src/log.h src/timer.h src/fs.h src/lfs.h src/util.h src/url.h src/iobuf.h src/base64.h src/md5.h src/sha1.h src/sha256.h src/event.h src/net.h src/http.h src/ssi.h src/tls.h src/tls_x25519.h src/tls_aes128.h src/tls_uecc.h src/tls_chacha20.h src/tls_rsa.h src/tls_mbed.h src/tls_openssl.h src/ws.h src/sntp.h src/mqtt.h src/dns.h src/modbus.h src/json.h src/jwt.h src/rpc.h src/dash.h src/ota.h src/health.h src/mdash.h src/flash.h src/wifi.h src/l2.h src/net_builtin.h src/bsd.h src/drivers/*.h | sed -e '/keep/! s,#include ".*,,' -e 's,^#pragma once,,'; echo; echo '#ifdef __cplusplus'; echo '}'; echo '#endif'; echo '#endif  // MONGOOSE_H')> $@
+	cd .. && (export LC_ALL=C ; cat src/license.h; echo; echo '#ifndef MONGOOSE_H'; echo '#define MONGOOSE_H'; echo; cat src/version.h ; echo; echo '#ifdef __cplusplus'; echo 'extern "C" {'; echo '#endif'; cat src/arch.h src/arch_*.h src/os_*.h src/net_ft.h src/net_lwip.h src/net_rl.h src/config.h src/profile.h src/str.h src/queue.h src/fmt.h src/printf.h src/log.h src/timer.h src/fs.h src/lfs.h src/util.h src/url.h src/iobuf.h src/base64.h src/md5.h src/sha1.h src/sha256.h src/event.h src/net.h src/http.h src/ssi.h src/tls.h src/tls_aes128.h src/tls_p256.h src/tls_p384.h src/tls_chacha20.h src/tls_rsa.h src/tls_mbed.h src/tls_openssl.h src/ws.h src/sntp.h src/mqtt.h src/dns.h src/modbus.h src/json.h src/jwt.h src/rpc.h src/dash.h src/ota.h src/health.h src/mdash.h src/flash.h src/wifi.h src/l2.h src/net_builtin.h src/bsd.h src/drivers/*.h | sed -e '/keep/! s,#include ".*,,' -e 's,^#pragma once,,'; echo; echo '#ifdef __cplusplus'; echo '}'; echo '#endif'; echo '#endif  // MONGOOSE_H')> $@
 
 # Check that all external (exported) symbols have "mg_" prefix
 mg_prefix: mongoose.c mongoose.h
 	$(CC) mongoose.c $(CFLAGS) -c -o /tmp/x.o && nm /tmp/x.o | grep ' T ' | grep -v 'mg_' ; test $$? = 1
 
-test: Makefile mongoose.h $(SRCS) tls_multirec/server
+test: Makefile mongoose.h $(SRCS)
 	$(CC) $(SRCS) $(CFLAGS) $(LDFLAGS) -o unit_test
 	ASAN_OPTIONS=$(ASAN_OPTIONS) $(RUN) ./unit_test
 
@@ -263,7 +254,6 @@ packed_fs.c: Makefile data/ssi.h fuzz.c data/a.txt data/range.txt data/ca.pem ce
 
 clean: clean_tutorials clean_tutorials_embedded
 	rm -rf $(PROG) *.exe *.o *.dSYM *_test ut fuzzer *.gcov *.gcno *.gcda *.obj *.exe *.ilk *.pdb slow-unit* _CL_* infer-out data.txt crash-* packed_fs.c pack
-	$(MAKE) -C tls_multirec $@
 	$(MAKE) -C ../resources/I-CUBE-Mongoose $@
 	#find tutorials -maxdepth 3 -name zephyr -prune -o -name Makefile -print | xargs dirname | xargs -n1 make clean -C
 
@@ -287,7 +277,7 @@ atcmd_test: atcmd_test.c mongoose.c mongoose.h Makefile
 	$(CC) atcmd_test.c $(CFLAGS) $(LDFLAGS) -o $@
 	ASAN_OPTIONS=$(ASAN_OPTIONS) $(RUN) ./$@
 
-mip_tap_test: mip_x_test.c mip_tap_test.c mongoose.c mongoose.h packed_fs.c Makefile tls_multirec/server
+mip_tap_test: mip_x_test.c mip_tap_test.c mongoose.c mongoose.h packed_fs.c Makefile
 	$(CC) mip_tap_test.c packed_fs.c $(CFLAGS) $(LDFLAGS) -o $@
 	ASAN_OPTIONS=$(ASAN_OPTIONS) $(RUN) ./$@
 
@@ -300,7 +290,7 @@ port_tap_bridge: port_tap_bridge.c
 	cc port_tap_bridge.c -o $@
 
 # requires port_tap_bridge to be running
-mip_port_test: mip_x_test.c mip_port_test.c mongoose.c mongoose.h packed_fs.c Makefile tls_multirec/server
+mip_port_test: mip_x_test.c mip_port_test.c mongoose.c mongoose.h packed_fs.c Makefile
 	$(CC) mip_port_test.c packed_fs.c $(CFLAGS) $(LDFLAGS) -o $@
 	ASAN_OPTIONS=$(ASAN_OPTIONS) $(RUN) ./$@
 
@@ -309,6 +299,7 @@ mip_diabish: CC = gcc
 mip_diabish: CFLAGS += -std=gnu89 -Werror=declaration-after-statement -Werror=vla -Wno-pedantic
 mip_diabish: mip_test
 
+mip_vc98: MDASH = 0
 mip_vc98: mip_test.c mongoose.c mongoose.h packed_fs.c Makefile
 	$(DOCKER) mdashnet/vc98 wine cl mip_test.c packed_fs.c $(VCFLAGS) $(DEFS) $(TFLAGS) /Fe$@.exe
 	$(DOCKER) -e WINEPREFIX=/tmp/wineprefix mdashnet/vc98 wine $@.exe

test/arduino/Makefile

@@ -29,20 +29,20 @@ teensy-board:
 	touch teensy-board
 
 seeeduino-xiao: arduino seeeduino-xiao-board
-	cd $(ROOT)/tutorials/mqtt/mqtt-client/arduino/sim800-mqtt && $(ARD)/arduino/arduino --verbose --verify --board Seeeduino:samd:seeed_XIAO_m0 sim800-mqtt.ino
+	cd $(ROOT)/tutorials/arduino/sim800-mqtt && $(ARD)/arduino/arduino --verbose --verify --board Seeeduino:samd:seeed_XIAO_m0 sim800-mqtt.ino
-	cd $(ROOT)/tutorials/http/http-server/arduino/w5500-http &&  $(ARD)/arduino/arduino --verbose --verify --board Seeeduino:samd:seeed_XIAO_m0 w5500-http.ino
+	cd $(ROOT)/tutorials/arduino/w5500-http &&  $(ARD)/arduino/arduino --verbose --verify --board Seeeduino:samd:seeed_XIAO_m0 w5500-http.ino
-	cd $(ROOT)/tutorials/mqtt/mqtt-client/arduino/w5500-mqtt &&  $(ARD)/arduino/arduino --verbose --verify --board Seeeduino:samd:seeed_XIAO_m0 w5500-mqtt.ino
+	cd $(ROOT)/tutorials/arduino/w5500-mqtt &&  $(ARD)/arduino/arduino --verbose --verify --board Seeeduino:samd:seeed_XIAO_m0 w5500-mqtt.ino
 
 arduino-nano: arduino
-	cd $(ROOT)/tutorials/mqtt/mqtt-client/arduino/nano-w5500-mqtt && $(ARD)/arduino/arduino --pref compiler.cpp.extra_flags=-DMG_ENABLE_LOG=0 --verbose --verify --board arduino:avr:nano nano-w5500-mqtt.ino
+	cd $(ROOT)/tutorials/arduino/nano-w5500-mqtt && $(ARD)/arduino/arduino --pref compiler.cpp.extra_flags=-DMG_ENABLE_LOG=0 --verbose --verify --board arduino:avr:nano nano-w5500-mqtt.ino
 
 esp32: arduino esp32-board
-	cd $(ROOT)/tutorials/mqtt/mqtt-client/arduino/esp32-mqtt && $(ARD)/arduino/arduino --verbose --verify --board esp32:esp32:node32s esp32-mqtt.ino
+	cd $(ROOT)/tutorials/arduino/esp32-mqtt && $(ARD)/arduino/arduino --verbose --verify --board esp32:esp32:node32s esp32-mqtt.ino
 	# Needs a board with 'LED_BUILTIN', yet somehow invocation is missing that definition (lack of include somehow amended by the IDE)
-	#cd $(ROOT)/tutorials/http/http-server/arduino/esp32-http && $(ARD)/arduino/arduino --verbose --verify --board esp32:esp32:esp32 esp32-http.ino
+	#cd $(ROOT)/tutorials/arduino/esp32-http && $(ARD)/arduino/arduino --verbose --verify --board esp32:esp32:esp32 esp32-http.ino
 
 teensy41: arduino teensy-board
-	cd $(ROOT)/tutorials/http/http-server/arduino/teensy41-http && $(ARD)/arduino/arduino --verbose --verify --board teensy41-http.ino
+	cd $(ROOT)/tutorials/arduino/teensy41-http && $(ARD)/arduino/arduino --verbose --verify --board teensy41-http.ino
 
 
 

test/bsd/Makefile

@@ -13,18 +13,21 @@ else
 C_WARN ?= -Wno-deprecated
 endif
 
-.PHONY: all bsd_test bsd_client shm_tap_bridge shm_port_bridge bsd_s390 clean
+.PHONY: all bsd bsd_test bsd_client bsd_udp bsd_nortos bsd_nortos_test shm_tap_bridge \
+        shm_port_bridge bsd_s390 bsd_nortos_s390 clean
 
 TEST_SOURCES = bsd_shm_test.c
 # A C++ application compiles its sources as C++, linking Mongoose and FreeRTOS as C.
 # FreeRTOS does not build as C++, so C sources are compiled separately.
 C_SOURCES = ../../mongoose.c
-C_SOURCES += FreeRTOS-Kernel/portable/MemMang/heap_4.c
+FREERTOS_SOURCES = FreeRTOS-Kernel/portable/MemMang/heap_4.c
-C_SOURCES += FreeRTOS-Kernel/portable/ThirdParty/GCC/Posix/port.c
+FREERTOS_SOURCES += FreeRTOS-Kernel/portable/ThirdParty/GCC/Posix/port.c
-C_SOURCES += FreeRTOS-Kernel/portable/ThirdParty/GCC/Posix/utils/wait_for_event.c
+FREERTOS_SOURCES += FreeRTOS-Kernel/portable/ThirdParty/GCC/Posix/utils/wait_for_event.c
-C_SOURCES += $(wildcard FreeRTOS-Kernel/*.c)
+FREERTOS_SOURCES += $(wildcard FreeRTOS-Kernel/*.c)
 C_OBJECTS = $(notdir $(C_SOURCES:.c=.o))
+FREERTOS_OBJECTS = $(notdir $(FREERTOS_SOURCES:.c=.o))
 C_INPUTS = $(foreach S,$(C_SOURCES),-x c $(S))
+FREERTOS_INPUTS = $(foreach S,$(FREERTOS_SOURCES),-x c $(S))
 CFLAGS += -IFreeRTOS-Kernel/include 
 CFLAGS += -IFreeRTOS-Kernel/portable/ThirdParty/GCC/Posix -Wno-conversion -Wno-undef
 
@@ -44,11 +47,22 @@ DOCKER ?= $(DOCKER_BIN) run --platform linux/amd64 --net=host --rm $(ENV) -v $(R
 CFLAGS_MONGOOSE += -DMG_ARCH=MG_ARCH_CUSTOM
 
 
-all bsd: shm_tap_bridge bsd_client FreeRTOS-Kernel bsd_test
+all bsd: shm_tap_bridge bsd_client bsd_udp FreeRTOS-Kernel bsd_test
 	ASAN_OPTIONS=$(ASAN_OPTIONS) $(RUN) ./bsd_test $(ARGS)
 
+# also
+bsd_nortos: shm_tap_bridge bsd_client bsd_udp bsd_nortos_test
+	ASAN_OPTIONS=$(ASAN_OPTIONS) $(RUN) ./bsd_nortos_test $(ARGS)
+
 # requires shm_tap_bridge to be running
+bsd_test: CFLAGS_MONGOOSE += -DMG_ENABLE_FREERTOS=1
 bsd_test: FreeRTOS-Kernel
+	$(CC) $(C_INPUTS) $(FREERTOS_INPUTS) -c $(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA)
+	$(CC) -x $(TEST_LANGUAGE) -c $(TEST_SOURCES) $(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA)
+	$(CC) $(C_OBJECTS) $(FREERTOS_OBJECTS) $(TEST_SOURCES:.c=.o) $(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA) -o $@
+
+bsd_nortos_test: CFLAGS_MONGOOSE += -DMG_ENABLE_FREERTOS=0
+bsd_nortos_test:
 	$(CC) $(C_INPUTS) -c $(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA)
 	$(CC) -x $(TEST_LANGUAGE) -c $(TEST_SOURCES) $(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA)
 	$(CC) $(C_OBJECTS) $(TEST_SOURCES:.c=.o) $(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA) -o $@
@@ -56,22 +70,34 @@ bsd_test: FreeRTOS-Kernel
 bsd_client: bsd_client.c
 	$(CC) bsd_client.c -pthread -o $@
 
+bsd_udp: bsd_udp.c
+	$(CC) bsd_udp.c -o $@
+
 # bridge shm queue <--> TAP interface
 shm_tap_bridge: shm_tap_bridge.c shm_queue.h
 	$(CC) shm_tap_bridge.c -pthread -o $@
 
 # requires test/port_tap_bridge to be running
+bsd_s390: CFLAGS_MONGOOSE += -DMG_ENABLE_BSD_PROTOTYPES=0
 bsd_s390: ASAN=
 bsd_s390: CC = $(DOCKER) mdashnet/s390 cc
 bsd_s390: RUN = $(DOCKER) --init mdashnet/s390
-bsd_s390: shm_port_bridge bsd_client FreeRTOS-Kernel bsd_test
+bsd_s390: shm_port_bridge bsd_client bsd_udp FreeRTOS-Kernel bsd_test
 	$(RUN) sh -c './shm_port_bridge & pid=$$!; sleep 1; ./bsd_test; rc=$$?; kill $$pid >/dev/null 2>&1; wait $$pid >/dev/null 2>&1; exit $$rc'
 
+#also
+bsd_nortos_s390: CFLAGS_MONGOOSE += -DMG_ENABLE_BSD_PROTOTYPES=0
+bsd_nortos_s390: ASAN=
+bsd_nortos_s390: CC = $(DOCKER) mdashnet/s390 cc
+bsd_nortos_s390: RUN = $(DOCKER) --init mdashnet/s390
+bsd_nortos_s390: shm_port_bridge bsd_client bsd_udp bsd_nortos_test
+	$(RUN) sh -c './shm_port_bridge & pid=$$!; sleep 1; ./bsd_nortos_test; rc=$$?; kill $$pid >/dev/null 2>&1; wait $$pid >/dev/null 2>&1; exit $$rc'
+
 shm_port_bridge: shm_port_bridge.c shm_queue.h
 	$(CC) shm_port_bridge.c $(CFLAGS) -pthread -o $@
 
 clean:                    # Cleanup. Delete built program and all build artifacts
-	rm -rf bsd_test bsd_client shm_port_bridge *.o *.obj FreeRTOS-Kernel
+	rm -rf bsd_test bsd_client bsd_udp shm_port_bridge *.o *.obj FreeRTOS-Kernel
 
 FreeRTOS-Kernel:  # FreeRTOS sources
 	git clone -q -c advice.detachedHead=false --depth 1 -b V11.2.0 https://github.com/FreeRTOS/FreeRTOS-Kernel $@

test/bsd/bsd_client.c

@@ -1,4 +1,5 @@
 #include <arpa/inet.h>
+#include <errno.h>
 #include <pthread.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -91,22 +92,80 @@ fail:
   exit(1);
 }
 
+enum wait_mode { WAIT_ABORT, WAIT_DRAIN, WAIT_HOLD, WAIT_CLOSE };
+
+// Wait for output, optionally draining through the final marker.
+static int wait_data(const char *host, enum wait_mode mode) {
+  struct sockaddr_in sa;
+  struct timeval timeout;
+  char buf[512];
+  ssize_t n;
+  size_t i;
+  int fd = socket(AF_INET, SOCK_STREAM, 0);
+
+  if (fd < 0) return 1;
+  memset(&sa, 0, sizeof(sa));
+  sa.sin_family = AF_INET;
+  sa.sin_port = htons(PORT);
+  if (inet_pton(AF_INET, host, &sa.sin_addr) != 1) goto fail;
+  timeout.tv_sec = 5, timeout.tv_usec = 0;
+  if (setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)) != 0)
+    goto fail;
+  if (connect(fd, (struct sockaddr *) &sa, sizeof(sa)) != 0) goto fail;
+  if (mode == WAIT_HOLD) {
+    usleep(100000);  // Keep the peer connected while the server fails TX
+    close(fd);
+    return 0;
+  }
+  if (mode == WAIT_CLOSE) {
+    n = recv(fd, buf, sizeof(buf), 0);
+    close(fd);
+    return n == 0 || (n < 0 && errno == ECONNRESET) ? 0 : 1;
+  }
+  for (;;) {
+    n = recv(fd, buf, sizeof(buf), 0);
+    if (n <= 0) goto fail;
+    if (mode == WAIT_ABORT) break;
+    for (i = 0; i < (size_t) n; i++) {
+      if (buf[i] == '\1') break;
+    }
+    if (i < (size_t) n) break;
+  }
+  close(fd);
+  return 0;
+
+fail:
+  close(fd);
+  return 1;
+}
+
 int main(int argc, char *argv[]) {
   pthread_t threads[NUM_CONNECTIONS];
-  int i;
+  int connections = NUM_CONNECTIONS, i;
 
-  if (argc != 2) {
+  if (argc == 3 && strcmp(argv[2], "waitandabort") == 0)
-    fprintf(stderr, "usage: %s IP\n", argv[0]);
+    return wait_data(argv[1], WAIT_ABORT);
+  if (argc == 3 && strcmp(argv[2], "waitanddrain") == 0)
+    return wait_data(argv[1], WAIT_DRAIN);
+  if (argc == 3 && strcmp(argv[2], "hold") == 0)
+    return wait_data(argv[1], WAIT_HOLD);
+  if (argc == 3 && strcmp(argv[2], "expectclose") == 0)
+    return wait_data(argv[1], WAIT_CLOSE);
+  if (argc == 3) connections = atoi(argv[2]);
+  if ((argc != 2 && argc != 3) || connections < 1 ||
+      connections > NUM_CONNECTIONS) {
+    fprintf(stderr, "usage: %s IP [connections|waitandabort|waitanddrain|hold|expectclose]\n",
+            argv[0]);
     return 1;
   }
 
   srandom(1);
 
-  for (i = 0; i < NUM_CONNECTIONS; i++) {
+  for (i = 0; i < connections; i++) {
     if (pthread_create(&threads[i], NULL, worker, argv[1]) != 0) return 1;
   }
 
-  for (i = 0; i < NUM_CONNECTIONS; i++) {
+  for (i = 0; i < connections; i++) {
     if (pthread_join(threads[i], NULL) != 0) return 1;
   }
 

test/bsd/bsd_udp.c

@@ -0,0 +1,55 @@
+#include <arpa/inet.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <unistd.h>
+
+#define PORT 1235
+
+int main(int argc, char *argv[]) {
+  struct sockaddr_in sa;
+  struct timeval timeout;
+  char buf[8];
+  ssize_t n;
+  int fd, rogue;
+
+  if (argc != 2) return 1;
+  memset(&sa, 0, sizeof(sa));
+  sa.sin_family = AF_INET;
+  sa.sin_port = htons(PORT);
+  if (inet_pton(AF_INET, argv[1], &sa.sin_addr) != 1) return 1;
+  timeout.tv_sec = 5, timeout.tv_usec = 0;
+  if ((fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0 ||
+      setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)) != 0 ||
+      connect(fd, (struct sockaddr *) &sa, sizeof(sa)) != 0 ||
+      send(fd, "hello", 5, 0) != 5 || recv(fd, buf, sizeof(buf), 0) != 5 ||
+      memcmp(buf, "ready", 5) != 0)
+    goto fail;
+  if ((rogue = socket(AF_INET, SOCK_DGRAM, 0)) < 0 ||
+      setsockopt(rogue, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)) !=
+          0 ||
+      send(fd, "one", 3, 0) != 3 ||
+      sendto(rogue, "two2", 4, 0, (struct sockaddr *) &sa, sizeof(sa)) != 4 ||
+      recv(fd, buf, sizeof(buf), 0) != 4 || memcmp(buf, "peer", 4) != 0 ||
+      recv(rogue, buf, sizeof(buf), 0) != 5 || memcmp(buf, "rogue", 5) != 0 ||
+      send(fd, "truncate", 8, 0) != 8 || send(fd, "peek", 4, 0) != 4 ||
+      recv(fd, buf, sizeof(buf), 0) != 4 || memcmp(buf, "more", 4) != 0 ||
+      recv(fd, buf, sizeof(buf), 0) != 3 || memcmp(buf, "one", 3) != 0 ||
+      recv(fd, buf, sizeof(buf), 0) != 4 || memcmp(buf, "two2", 4) != 0 ||
+      recv(fd, buf, sizeof(buf), 0) != 0 ||
+      sendto(rogue, "rogue", 5, 0, (struct sockaddr *) &sa, sizeof(sa)) != 5 ||
+      recv(fd, buf, sizeof(buf), 0) != 7 || memcmp(buf, "checked", 7) != 0 ||
+      send(fd, "echo", 4, 0) != 4 || recv(fd, buf, sizeof(buf), 0) != 4 ||
+      memcmp(buf, "echo", 4) != 0)
+    goto fail_close_rogue;
+  close(rogue);
+  close(fd);
+  return 0;
+
+fail_close_rogue:
+  close(rogue);
+fail:
+  close(fd);
+  return 1;
+}

test/bsd/mongoose_config.h

@@ -1,18 +1,13 @@
 #pragma once
 
 // See https://mongoose.ws/documentation/#build-options
-//#undef MG_ARCH
-//#define MG_ARCH MG_ARCH_UNIX
-#define MG_ENABLE_FREERTOS 1
 
 #define MG_ENABLE_TCPIP 1
 #define MG_ENABLE_TCPIP_DRIVER_INIT 0
 #define MG_ENABLE_BSD_SOCKETS 1
-#define MG_ENABLE_BSD_LOG 1
 #define MG_ENABLE_LINES 1 
 #define MG_ENABLE_CUSTOM_RANDOM 1
 
-//#include <ctype.h>
 #include <inttypes.h>
 #include <limits.h>
 #include <stdarg.h>
@@ -24,7 +19,16 @@
 #include <string.h>
 
 #include <sys/stat.h>
-#include <sys/time.h>
 #include <sys/types.h>
 #include <time.h>
 #include <unistd.h>
+
+#if MG_ENABLE_FREERTOS
+
+
+#else
+
+#define MG_ENABLE_CUSTOM_CALLOC 1
+#define MG_ENABLE_CUSTOM_MILLIS 1
+
+#endif

test/esp-idf/Makefile

@@ -1,5 +1,5 @@
 ROOT ?= $(realpath $(CURDIR)/../..)
-PROJECTS ?= ../../tutorials/http/device-dashboard/esp32/ ../../tutorials/micropython/esp32/ ../../tutorials/http/uart-bridge/esp32/
+PROJECTS ?= ../../tutorials/esp32/device-dashboard/ ../../tutorials/micropython/esp32/ ../../tutorials/esp32/uart-bridge/
 TARGET ?= Debug
 DOCKER = docker run --rm -v $(ROOT):$(ROOT) -v $(CURDIR):/root -w $(CURDIR) 
 IMAGE ?= espressif/idf

test/mip_x_test.c

@@ -176,7 +176,6 @@ static void fcb(struct mg_connection *c, int ev, void *ev_data) {
     snprintf(fd->buf, FETCH_BUF_SIZE, "%.*s", (int) hm->message.len,
              hm->message.buf);
     fd->code = atoi(hm->uri.buf);
-    fd->closed = 1;
     c->is_closing = 1;
     MG_DEBUG(("CODE: %d, MSG: %.*s", fd->code, (int) hm->message.len,
               hm->message.buf));
@@ -214,7 +213,8 @@ static int fetch(struct mg_mgr *mgr, char *buf, const char *url,
                    // given enough traffic, the timer expires before we get a
                    // chance to see the response
   }
-  if (!fd.closed) c->is_closing = 1;
+  if (!fd.closed) // failed, force closure and conn removal, and loop end
+    ((struct connstate *) (c + 1))->is_closing = 1;
   mg_mgr_poll(mgr, 0);
   return fd.code;
 }
@@ -480,8 +480,7 @@ static void test_http_server(struct mg_mgr *mgr) {
 }
 
 static void test_tls(struct mg_mgr *mgr) {
-#if MG_TLS
+#if MG_TLS && 0  // TODO(cpq): restore multi-record TLS test
-  char *url;
   char buf[FETCH_BUF_SIZE];  // make sure it can hold Makefile
   mg_mem_files = mg_packed_files;  // Use generated packed filesystem
   struct mg_str data = mg_unpacked("/Makefile");
@@ -496,7 +495,8 @@ static void test_tls(struct mg_mgr *mgr) {
   // - Fire patched server, test multiple TLS records per TCP segment handling
   // skip other TLS stacks to avoid "bad client hello", we are 1.3 only
   if (access("tls_multirec/server", X_OK) == 0) {
-    url = mg_mprintf("https://%s:8443", host_ip);  
+    char url[256];
+    mg_snrintf(url, sizeof(url), "https://%s:8443", host_ip);
     ASSERT(system("tls_multirec/server -d tls_multirec &") == 0);
     sleep(1);
     // fetch() needs to loop enough times in order to process all TLS records;
@@ -504,7 +504,6 @@ static void test_tls(struct mg_mgr *mgr) {
     ASSERT(fetch(mgr, buf, url, "GET /thefile HTTP/1.0\n\n") == 200);
     ASSERT(cmpbody(buf, data.buf) == 0);  // "thefile" links to Makefile
     ASSERT(system("killall tls_multirec/server") == 0);
-    free(url);
   } else {
     printf("SKIPPED TLS MULTIPLE RECORDS TEST, tls_multirec/server NOT PRESENT\n");
   }
@@ -512,7 +511,6 @@ static void test_tls(struct mg_mgr *mgr) {
   printf("SKIPPED TLS MULTIPLE RECORDS TEST, not a known TLS 1.3 stack\n");
   (void) cmpbody("", "");
   (void) mgr;
-  (void) url; // these three: NO SIMPLE TLS TEST
   (void) buf;
   (void) data;
 #endif
@@ -593,6 +591,7 @@ bool mip_x_test(struct mg_mgr *mgr) {
 
   // Clear
   s_error = false;
+  mg_mgr_poll(mgr, 0); // prevent mDash from trashing mg_mgr_free()
   mg_mgr_free(mgr);
   ASSERT(mgr->conns == NULL);  // Deconstruction OK
   printf("HEALTH_DASHBOARD\t\"cleanup\": %s\n", s_error ? "false":"true");

test/tls_multirec/Makefile

@@ -1,9 +0,0 @@
-CFLAGS = -g -I.  # This is a known version, no need to check
-CFLAGS_MONGOOSE += -DMG_ENABLE_LINES=1 -DMG_ENABLE_IPV6=1
-CFLAGS_EXTRA ?= -DMG_TLS=MG_TLS_BUILTIN
-
-server: main.c patched_mongoose.c mongoose.h Makefile
-	$(CC) main.c patched_mongoose.c $(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA) -o $@
-
-clean:
-	rm -rf server *.exe *.o *.dSYM

test/tls_multirec/main.c

@@ -1,184 +0,0 @@
-// Copyright (c) 2020 Cesanta Software Limited
-// All rights reserved
-
-#include <signal.h>
-#include "mongoose.h"
-
-static int s_debug_level = MG_LL_INFO;
-static const char *s_root_dir = ".";
-static const char *s_addr1 = "http://0.0.0.0:8000";
-static const char *s_addr2 = "https://0.0.0.0:8443";
-static const char *s_enable_hexdump = "no";
-static const char *s_ssi_pattern = "#.html";
-static const char *s_upload_dir = NULL;  // File uploads disabled by default
-
-// Self signed certificates, see
-// https://github.com/cesanta/mongoose/blob/master/test/certs/generate.sh
-#ifdef TLS_TWOWAY
-static const char *s_tls_ca =
-    "-----BEGIN CERTIFICATE-----\n"
-    "MIIBFTCBvAIJAMNTFtpfcq8NMAoGCCqGSM49BAMCMBMxETAPBgNVBAMMCE1vbmdv\n"
-    "b3NlMB4XDTI0MDUwNzE0MzczNloXDTM0MDUwNTE0MzczNlowEzERMA8GA1UEAwwI\n"
-    "TW9uZ29vc2UwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASuP+86T/rOWnGpEVhl\n"
-    "fxYZ+pjMbCmDZ+vdnP0rjoxudwRMRQCv5slRlDK7Lxue761sdvqxWr0Ma6TFGTNg\n"
-    "epsRMAoGCCqGSM49BAMCA0gAMEUCIQCwb2CxuAKm51s81S6BIoy1IcandXSohnqs\n"
-    "us64BAA7QgIgGGtUrpkgFSS0oPBlCUG6YPHFVw42vTfpTC0ySwAS0M4=\n"
-    "-----END CERTIFICATE-----\n";
-#endif
-static const char *s_tls_cert =
-    "-----BEGIN CERTIFICATE-----\n"
-    "MIIBMTCB2aADAgECAgkAluqkgeuV/zUwCgYIKoZIzj0EAwIwEzERMA8GA1UEAwwI\n"
-    "TW9uZ29vc2UwHhcNMjQwNTA3MTQzNzM2WhcNMzQwNTA1MTQzNzM2WjARMQ8wDQYD\n"
-    "VQQDDAZzZXJ2ZXIwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASo3oEiG+BuTt5y\n"
-    "ZRyfwNr0C+SP+4M0RG2pYkb2v+ivbpfi72NHkmXiF/kbHXtgmSrn/PeTqiA8M+mg\n"
-    "BhYjDX+zoxgwFjAUBgNVHREEDTALgglsb2NhbGhvc3QwCgYIKoZIzj0EAwIDRwAw\n"
-    "RAIgTXW9MITQSwzqbNTxUUdt9DcB+8pPUTbWZpiXcA26GMYCIBiYw+DSFMLHmkHF\n"
-    "+5U3NXW3gVCLN9ntD5DAx8LTG8sB\n"
-    "-----END CERTIFICATE-----\n";
-
-static const char *s_tls_key =
-    "-----BEGIN EC PRIVATE KEY-----\n"
-    "MHcCAQEEIAVdo8UAScxG7jiuNY2UZESNX/KPH8qJ0u0gOMMsAzYWoAoGCCqGSM49\n"
-    "AwEHoUQDQgAEqN6BIhvgbk7ecmUcn8Da9Avkj/uDNERtqWJG9r/or26X4u9jR5Jl\n"
-    "4hf5Gx17YJkq5/z3k6ogPDPpoAYWIw1/sw==\n"
-    "-----END EC PRIVATE KEY-----\n";
-
-// Handle interrupts, like Ctrl-C
-static int s_signo;
-static void signal_handler(int signo) {
-  s_signo = signo;
-}
-
-// Event handler for the listening connection.
-// Simply serve static files from `s_root_dir`
-static void cb(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_ACCEPT && c->fn_data != NULL) {
-    struct mg_tls_opts opts;
-    memset(&opts, 0, sizeof(opts));
-#ifdef TLS_TWOWAY
-    opts.ca = mg_str(s_tls_ca);
-#endif
-    opts.cert = mg_str(s_tls_cert);
-    opts.key = mg_str(s_tls_key);
-    mg_tls_init(c, &opts);
-  }
-  if (ev == MG_EV_HTTP_MSG) {
-    struct mg_http_message *hm = (struct mg_http_message *) ev_data;
-
-    if (mg_match(hm->uri, mg_str("/upload"), NULL)) {
-      // Serve file upload
-      if (s_upload_dir == NULL) {
-        mg_http_reply(c, 403, "", "Denied: file upload directory not set\n");
-      } else {
-        struct mg_http_part part;
-        size_t pos = 0, total_bytes = 0, num_files = 0;
-        while ((pos = mg_http_next_multipart(hm->body, pos, &part)) > 0) {
-          char path[MG_PATH_MAX];
-          MG_INFO(("Chunk name: [%.*s] filename: [%.*s] length: %lu bytes",
-                   part.name.len, part.name.buf, part.filename.len,
-                   part.filename.buf, part.body.len));
-          mg_snprintf(path, sizeof(path), "%s/%.*s", s_upload_dir,
-                      part.filename.len, part.filename.buf);
-          if (mg_path_is_sane(mg_str(path))) {
-            mg_file_write(&mg_fs_posix, path, part.body.buf, part.body.len);
-            total_bytes += part.body.len;
-            num_files++;
-          } else {
-            MG_ERROR(("Rejecting dangerous path %s", path));
-          }
-        }
-        mg_http_reply(c, 200, "", "Uploaded %lu files, %lu bytes\n", num_files,
-                      total_bytes);
-      }
-    } else {
-      // Serve web root directory
-      struct mg_http_serve_opts opts = {0};
-      opts.root_dir = s_root_dir;
-      opts.ssi_pattern = s_ssi_pattern;
-      mg_http_serve_dir(c, hm, &opts);
-    }
-
-    // Log request
-    MG_INFO(("%.*s %.*s %lu -> %.*s %lu", hm->method.len, hm->method.buf,
-             hm->uri.len, hm->uri.buf, hm->body.len, 3, c->send.buf + 9,
-             c->send.len));
-  }
-}
-
-static void usage(const char *prog) {
-  fprintf(stderr,
-          "Mongoose v.%s\n"
-          "Usage: %s OPTIONS\n"
-          "  -H yes|no - enable traffic hexdump, default: '%s'\n"
-          "  -S PAT    - SSI filename pattern, default: '%s'\n"
-          "  -d DIR    - directory to serve, default: '%s'\n"
-          "  -l ADDR   - listening address, default: '%s'\n"
-          "  -u DIR    - file upload directory, default: unset\n"
-          "  -v LEVEL  - debug level, from 0 to 4, default: %d\n",
-          MG_VERSION, prog, s_enable_hexdump, s_ssi_pattern, s_root_dir,
-          s_addr1, s_debug_level);
-  exit(EXIT_FAILURE);
-}
-
-int main(int argc, char *argv[]) {
-  char path[MG_PATH_MAX] = ".";
-  struct mg_mgr mgr;
-  struct mg_connection *c;
-  int i;
-
-  // Parse command-line flags
-  for (i = 1; i < argc; i++) {
-    if (strcmp(argv[i], "-d") == 0) {
-      s_root_dir = argv[++i];
-    } else if (strcmp(argv[i], "-H") == 0) {
-      s_enable_hexdump = argv[++i];
-    } else if (strcmp(argv[i], "-S") == 0) {
-      s_ssi_pattern = argv[++i];
-    } else if (strcmp(argv[i], "-l") == 0) {
-      s_addr1 = argv[++i];
-    } else if (strcmp(argv[i], "-l2") == 0) {
-      s_addr2 = argv[++i];
-    } else if (strcmp(argv[i], "-u") == 0) {
-      s_upload_dir = argv[++i];
-    } else if (strcmp(argv[i], "-v") == 0) {
-      s_debug_level = atoi(argv[++i]);
-    } else {
-      usage(argv[0]);
-    }
-  }
-
-  // Root directory must not contain double dots. Make it absolute
-  // Do the conversion only if the root dir spec does not contain overrides
-  if (strchr(s_root_dir, ',') == NULL) {
-    realpath(s_root_dir, path);
-    s_root_dir = path;
-  }
-
-  // Initialise stuff
-  signal(SIGINT, signal_handler);
-  signal(SIGTERM, signal_handler);
-  mg_log_set(s_debug_level);
-  mg_mgr_init(&mgr);
-  if ((c = mg_http_listen(&mgr, s_addr1, cb, NULL)) == NULL) {
-    MG_ERROR(("Cannot listen on %s. Use http://ADDR:PORT or :PORT",
-              s_addr1));
-    exit(EXIT_FAILURE);
-  }
-  if ((c = mg_http_listen(&mgr, s_addr2, cb, (void *) 1)) == NULL) {
-    MG_ERROR(("Cannot listen on %s. Use http://ADDR:PORT or :PORT",
-              s_addr2));
-    exit(EXIT_FAILURE);
-  }
-  if (mg_casecmp(s_enable_hexdump, "yes") == 0) c->is_hexdumping = 1;
-
-  // Start infinite event loop
-  MG_INFO(("Mongoose version : v%s", MG_VERSION));
-  MG_INFO(("HTTP listener    : %s", s_addr1));
-  MG_INFO(("HTTPS listener   : %s", s_addr2));
-  MG_INFO(("Web root         : [%s]", s_root_dir));
-  MG_INFO(("Upload dir       : [%s]", s_upload_dir ? s_upload_dir : "unset"));
-  while (s_signo == 0) mg_mgr_poll(&mgr, 1000);
-  mg_mgr_free(&mgr);
-  MG_INFO(("Exiting on signal %d", s_signo));
-  return 0;
-}

test/tls_multirec/thefile

@@ -1 +0,0 @@
-../Makefile

test/tls_multirec/tls_multirec.diff

@@ -1,22 +0,0 @@
-diff --git a/mongoose.c b/mongoose.c
-index 44539e81..b3f1c83a 100644
---- a/mongoose.c
-+++ b/mongoose.c
-@@ -11300,9 +11300,16 @@ void mg_tls_free(struct mg_connection *c) {
- long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) {
-   struct tls_data *tls = (struct tls_data *) c->tls;
-   long n = MG_IO_WAIT;
-+  size_t maxsize = 256, encrypted = 0;
-   if (len > MG_IO_SIZE) len = MG_IO_SIZE;
-   if (len > 16384) len = 16384;
--  mg_tls_encrypt(c, (const uint8_t *) buf, len, MG_TLS_APP_DATA);
-+  while (encrypted < len) {
-+    const uint8_t *chunk = (const uint8_t *) buf + encrypted;
-+    size_t chunksize = len - encrypted;
-+    if (chunksize > maxsize) chunksize = maxsize;
-+    mg_tls_encrypt(c, chunk, chunksize, MG_TLS_APP_DATA);
-+    encrypted += chunksize;
-+  }
-   while (tls->send.len > 0 &&
-          (n = mg_io_send(c, tls->send.buf, tls->send.len)) > 0) {
-     mg_iobuf_del(&tls->send, 0, (size_t) n);

test/unit_test.c

@@ -803,11 +803,18 @@ static void test_mqtt_parse(void) {
   struct mg_mqtt_prop prop;
   // MQTT5 PUBLISH with Subscription Identifier = 5
   const uint8_t sub_id_pkt[] = {0x30, 0x06, 0x00, 0x01, 'x', 0x02, 0x0B, 0x05};
+  // MQTT5 CONNACK with Server Keep Alive = 60
+  const uint8_t connack_pkt[] = {0x20, 0x06, 0x00, 0x00, 0x03, 0x13, 0x00, 0x3C};
 
   memset(&mm, 0, sizeof(struct mg_mqtt_message));
   memset(&prop, 0, sizeof(struct mg_mqtt_prop));
   ASSERT(mg_mqtt_parse(sub_id_pkt, sizeof(sub_id_pkt), 5, &mm) == MQTT_OK);
   mg_mqtt_next_prop(&mm, &prop, 0);
+
+  ASSERT(mg_mqtt_parse(connack_pkt, sizeof(connack_pkt), 5, &mm) == MQTT_OK);
+  ASSERT(mm.ack == 0);
+  ASSERT(mg_mqtt_next_prop(&mm, &prop, 0) > 0);
+  ASSERT(prop.id == MQTT_PROP_SERVER_KEEP_ALIVE && prop.iv == 60);
 }
 
 static void test_mqtt(void) {
@@ -918,6 +925,10 @@ static void fcb(struct mg_connection *c, int ev, void *ev_data) {
   }
 }
 
+// Max number of mg_mgr_poll() calls fetch() waits for a response. Large
+// transfers over builtin TLS with small records (MG_TLS_RECORD_SIZE) need more
+static int s_fetch_polls = 100;
+
 static int fetch(struct mg_mgr *mgr, char *buf, const char *url,
                  const char *fmt, ...) {
   struct fetch_data fd = {buf, 0, 0};
@@ -946,7 +957,7 @@ static int fetch(struct mg_mgr *mgr, char *buf, const char *url,
   mg_vprintf(c, fmt, &ap);
   va_end(ap);
   buf[0] = '\0';
-  for (i = 0; i < 100 && buf[0] == '\0'; i++) mg_mgr_poll(mgr, 1);
+  for (i = 0; i < s_fetch_polls && buf[0] == '\0'; i++) mg_mgr_poll(mgr, 1);
   if (!fd.closed) c->is_closing = 1;
   mg_mgr_poll(mgr, 1);
   return fd.code;
@@ -1515,7 +1526,6 @@ static void test_http_404(void) {
 }
 
 static void test_tls(void) {
-//  return;
 #if MG_TLS
   struct mg_mgr mgr;
   struct mg_connection *c;
@@ -1538,6 +1548,7 @@ static void test_tls(void) {
   // POST a large file, several MSS but less than max TLS record length
   // make sure we drain TLS buffers and read all, #2619
   ASSERT(data.len > 3100 && data.len < 16384);  // pick another file on failure
+  s_fetch_polls = 5000;  // Many small TLS records, one is decrypted per poll
   ASSERT(fetch(&mgr, buf, url,
                "POST /body HTTP/1.0\n"
                "Content-Length: %lu\n\n"
@@ -1554,29 +1565,7 @@ static void test_tls(void) {
                "%s",
                bd.len, bd.buf) == 200);
   ASSERT(cmpbody(buf, bd.buf) == 0);
-#if MG_TLS == MG_TLS_BUILTIN && defined(__linux__) && \
+  s_fetch_polls = 100;
-    MG_ENABLE_CHACHA20  // skip for non-CHACHA tests
-  // fire patched server, test multiple TLS records per TCP segment handling
-  // skip other TLS stacks to avoid "bad client hello", we are 1.3 only
-  if (access("tls_multirec/server", X_OK) == 0) {
-    ASSERT(system("tls_multirec/server -d tls_multirec &") == 0);
-    sleep(1);
-    // fetch() needs to loop enough times in order to process all TLS records;
-    // otherwise it will end with 200 and shorter file contents
-    ASSERT(fetch(&mgr, buf, "https://localhost:8443",
-                 "GET /thefile HTTP/1.0\n\n") == 200);
-    data = mg_unpacked("/Makefile");
-    ASSERT(cmpbody(buf, data.buf) == 0);  // "thefile" links to Makefile
-    ASSERT(system("killall tls_multirec/server") == 0);
-  } else {
-    printf("\nSKIPPED TLS MULTIPLE RECORDS TEST, tls_multirec/server NOT PRESENT\n");
-  }
-#else
-  printf(
-      "\n Skipping multiple TLS records per TCP segment handling test, server "
-      "is 1.3 only; re-enable when other stacks can be easily configured for "
-      "1.3\n");
-#endif
 
   // Repeat the simplest test with two-way authentication
   opts.ca = mg_unpacked("/certs/ca.crt");  // configure the server for two-way
@@ -3169,8 +3158,6 @@ static bool su_cb(struct mg_http_message *hm, struct mg_str *data, void **p) {
 static void su(struct mg_connection *c, int ev, void *ev_data) {
   if (ev == MG_EV_HTTP_HDRS) {
     mg_http_stream_body(c, (struct mg_http_message *) ev_data, su_cb, NULL);
-  } else if (ev == MG_EV_HTTP_MSG) {  // Only for requests that were not streamed
-    mg_http_reply(c, 400, "", "not streamed\n");
   }
 }
 
@@ -3205,8 +3192,7 @@ static void cr(struct mg_connection *c, int ev, void *ev_data) {
   if (ev == MG_EV_CONNECT) {
     mg_printf(c, "GET / HTTP/1.0\r\n\r\n");
   } else if (ev == MG_EV_HTTP_HDRS) {
-    ASSERT(mg_http_stream_body(c, (struct mg_http_message *) ev_data, cr_cb,
+    mg_http_stream_body(c, (struct mg_http_message *) ev_data, cr_cb, NULL);
-                               NULL));
   }
 }
 
@@ -3219,12 +3205,103 @@ static void cs(struct mg_connection *c, int ev, void *ev_data) {
   (void) ev_data;
 }
 
+struct stream_test_state {
+  int fail_at, starts, chunks, ends;
+};
+
+static bool stream_test_cb(struct mg_http_message *hm, struct mg_str *data,
+                            void **p) {
+  struct stream_test_state *s = (struct stream_test_state *) *p;
+  ASSERT(s != NULL);
+  if (hm != NULL) {
+    s->starts++;
+    return s->fail_at != 1;
+  } else if (data != NULL) {
+    s->chunks++;
+    return s->fail_at != 2;
+  }
+  s->ends++;
+  *p = NULL;
+  return s->fail_at != 3;
+}
+
+static void stream_test_original(struct mg_connection *c, int ev, void *data) {
+  (void) c, (void) ev, (void) data;
+  ASSERT(false);  // Streaming must take ownership even when validation fails
+}
+
+static void test_http_stream_errors(void) {
+  static const struct {
+    const char *request;
+    int client, fail_at, body_size, code, starts, chunks;
+  } cases[] = {
+      {"GET / HTTP/1.1\r\nContent-Length: 0\r\n\r\n", 0, 0, 0, 405, 0, 0},
+      {"POST / HTTP/1.1\r\n\r\n", 0, 0, 0, 411, 0, 0},
+      {"POST / HTTP/1.1\r\nTransfer-Encoding: chunked\r\n\r\n",
+       0, 0, 0, 400, 0, 0},
+      {"POST / HTTP/1.1\r\nContent-Length: 3\r\n\r\nabc", 0, 0, 0, 200, 1, 1},
+      {"PUT / HTTP/1.1\r\nContent-Length: 0\r\n\r\n", 0, 0, 0, 200, 1, 0},
+      // Start failure must reply without waiting for the body or sending 100.
+      {"POST / HTTP/1.1\r\nContent-Length: 1000000\r\nExpect: 100-continue\r\n\r\n",
+       0, 1, 0, 500, 1, 0},
+      // Write failure must also reply before the announced body is complete.
+      {"POST / HTTP/1.1\r\nContent-Length: 1000000\r\n\r\n",
+       0, 2, 512, 500, 1, 1},
+      {"POST / HTTP/1.1\r\nContent-Length: 3\r\n\r\nabc", 0, 3, 0, 500, 1, 1},
+      // Clients close on errors and never send an HTTP error response.
+      {"HTTP/1.1 200 OK\r\n\r\n", 1, 0, 0, 411, 0, 0},
+      {"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n",
+       1, 0, 0, 400, 0, 0},
+      {"HTTP/1.1 200 OK\r\nContent-Length: 1000000\r\n\r\n",
+       1, 1, 0, 500, 1, 0},
+      {"HTTP/1.1 200 OK\r\nContent-Length: 1000000\r\n\r\n",
+       1, 2, 512, 500, 1, 1},
+      {"HTTP/1.1 200 OK\r\nContent-Length: 3\r\n\r\nabc", 1, 3, 0, 500, 1, 1},
+      {"HTTP/1.1 200 OK\r\nContent-Length: 3\r\n\r\nabc", 1, 0, 0, 200, 1, 1},
+      {"HTTP/1.1 204 No Content\r\n\r\n", 1, 0, 0, 200, 1, 0},
+  };
+  size_t i;
+  for (i = 0; i < sizeof(cases) / sizeof(cases[0]); i++) {
+    struct mg_connection c;
+    struct mg_http_message hm;
+    struct stream_test_state state = {0, 0, 0, 0};
+    char body[512];
+    memset(&c, 0, sizeof(c));
+    memset(body, 'x', sizeof(body));
+    state.fail_at = cases[i].fail_at;
+    c.is_client = cases[i].client != 0;
+    c.fn = c.pfn = stream_test_original;
+    mg_iobuf_add(&c.recv, 0, cases[i].request, strlen(cases[i].request));
+    mg_iobuf_add(&c.recv, c.recv.len, body, (size_t) cases[i].body_size);
+    ASSERT(mg_http_parse((char *) c.recv.buf, c.recv.len, &hm) > 0);
+    mg_http_stream_body(&c, &hm, stream_test_cb, &state);
+    ASSERT(c.pfn == NULL && c.is_draining);
+    ASSERT(state.starts == cases[i].starts && state.chunks == cases[i].chunks);
+    ASSERT(state.ends == 1);
+    if (c.is_client) {
+      ASSERT(c.send.len == 0);
+      ASSERT(c.is_closing == (cases[i].code != 200));
+    } else {
+      ASSERT(mg_http_parse((char *) c.send.buf, c.send.len, &hm) > 0);
+      ASSERT(mg_http_status(&hm) == cases[i].code);
+      ASSERT(hm.message.len == c.send.len);  // Exactly one response
+    }
+    mg_call(&c, MG_EV_READ, NULL);
+    mg_error(&c, "stream cleanup test");
+    mg_call(&c, MG_EV_CLOSE, NULL);
+    ASSERT(state.ends == 1);  // Error followed by close must not clean up twice
+    mg_iobuf_free(&c.recv);
+    mg_iobuf_free(&c.send);
+  }
+}
+
 static void test_http_upload(void) {
   struct mg_mgr mgr;
   const char *url = "http://127.0.0.1:12352";
   int i;
   const char *s = "ok (8 foo\nbar\n)\n";
 
+  test_http_stream_errors();
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, url, us, NULL);
   mg_http_connect(&mgr, url, uc, (void *) &s);
@@ -3268,7 +3345,7 @@ static void test_http_upload(void) {
     ASSERT(mgr.conns == NULL);
   }
 
-  // mg_http_stream_body: chunked request is not streamed, caller replies "400"
+  // mg_http_stream_body: chunked request rejected with "400", cleanup still runs
   {
     char buf[FETCH_BUF_SIZE];
     s_su_done = s_su_end = 0;
@@ -3279,7 +3356,7 @@ static void test_http_upload(void) {
                  "POST /su_chunked.txt HTTP/1.1\r\n"
                  "Transfer-Encoding: chunked\r\n\r\n"
                  "3\r\nfoo\r\n0\r\n\r\n") == 400);
-    ASSERT(s_su_done == 0 && s_su_end == 0);  // The callback was never called
+    ASSERT(s_su_done == 1 && s_su_end == 1);  // End called without start
     ASSERT(fopen("su_chunked.txt", "r") == NULL);
     mg_mgr_free(&mgr);
     ASSERT(mgr.conns == NULL);
@@ -3656,6 +3733,14 @@ static void test_check_ip_acl(void) {
   ASSERT(mg_check_ip_acl(mg_str("-0.0.0.0/0,+1.0.0.0/8"), &ip) == 1);
   ASSERT(mg_check_ip_acl(mg_str("-0.0.0.0/0,+1.2.3.4"), &ip) == 1);
   ASSERT(mg_check_ip_acl(mg_str("-0.0.0.0/0,+1.0.0.0/16"), &ip) == 0);
+  ASSERT(mg_check_ip_acl(mg_str("+1.2.3.4xyz"), &ip) == -2);     // junk
+  ASSERT(mg_check_ip_acl(mg_str("+1.2.3.4/32abc"), &ip) == -2);  // junk
+  ASSERT(mg_check_ip_acl(mg_str("+1.2.3.4/"), &ip) == -2);
+  ASSERT(mg_check_ip_acl(mg_str("+1.2.3.4/33"), &ip) == -2);
+  ASSERT(mg_check_ip_acl(mg_str("+1.2.3.256"), &ip) == -2);
+  ASSERT(mg_check_ip_acl(mg_str("+"), &ip) == -2);
+  // Not NUL-terminated: must not read past the end of the ACL
+  ASSERT(mg_check_ip_acl(mg_str_n("+1.2.3.4xyz", 8), &ip) == 1);
   ip.is_ip6 = true;
   ASSERT(mg_check_ip_acl(mg_str("-0.0.0.0/0"), &ip) ==
          -1);  // not yet supported
@@ -4409,18 +4494,39 @@ static void test_split(void) {
   ASSERT(mg_strcmp(b, mg_str("")) == 0);
 }
 
-static void test_x25519(void) {
+// RFC 6979 A.2.5: P-256, SHA-256, message "sample"
+static void test_p256(void) {
 #if MG_TLS == MG_TLS_BUILTIN
-  uint8_t key[X25519_BYTES];
+  static const uint8_t x[32] = {
-  uint8_t buf[X25519_BYTES];
+      0xc9, 0xaf, 0xa9, 0xd8, 0x45, 0xba, 0x75, 0x16, 0x6b, 0x5c, 0x21,
-  char tmp[100];
+      0x57, 0x67, 0xb1, 0xd6, 0x93, 0x4e, 0x50, 0xc3, 0xdb, 0x36, 0xe8,
-  size_t i;
+      0x9b, 0x12, 0x7b, 0x8a, 0x62, 0x2b, 0x12, 0x0f, 0x67, 0x21};
-  for (i = 0; i < sizeof(key); i++) key[i] = (uint8_t) i;
+  static const uint8_t ux[8] = {0x60, 0xfe, 0xd4, 0xba, 0x25, 0x5a, 0x9d, 0x31};
-  for (i = 0; i < sizeof(buf); i++) buf[i] = 0;
+  static const uint8_t uy[8] = {0x79, 0x03, 0xfe, 0x10, 0x08, 0xb8, 0xbc, 0x99};
-  mg_tls_x25519(buf, key, X25519_BASE_POINT, 1);
+  static const uint8_t rs[64] = {
-  mg_snprintf(tmp, sizeof(tmp), "%M", mg_print_hex, sizeof(buf), buf);
+      0xef, 0xd4, 0x8b, 0x2a, 0xac, 0xb6, 0xa8, 0xfd, 0x11, 0x40, 0xdd, 0x9c,
-  MG_INFO(("%s", tmp));
+      0xd4, 0x5e, 0x81, 0xd6, 0x9d, 0x2c, 0x87, 0x7b, 0x56, 0xaa, 0xf9, 0x91,
-  ASSERT(mg_strcmp(mg_str("8f40c5adb6"), mg_str_n(tmp, 10)) == 0);
+      0xc3, 0x4d, 0x0e, 0xa8, 0x4e, 0xaf, 0x37, 0x16, 0xf7, 0xcb, 0x1c, 0x94,
+      0x2d, 0x65, 0x7c, 0x41, 0xd4, 0x36, 0xc7, 0xa1, 0xb6, 0xe2, 0x9f, 0x65,
+      0xf3, 0xe9, 0x00, 0xdb, 0xb9, 0xaf, 0xf4, 0x06, 0x4d, 0xc4, 0xab, 0x2f,
+      0x84, 0x3a, 0xcd, 0xa8};
+  uint8_t pub[64], hash[32], sig[64], prv2[32], pub2[64], sec1[32], sec2[32];
+  mg_sha256(hash, (uint8_t *) "sample", 6);
+  ASSERT(mg_p256_compute_public_key(x, pub) == 1);
+  ASSERT(memcmp(pub, ux, sizeof(ux)) == 0);
+  ASSERT(memcmp(pub + 32, uy, sizeof(uy)) == 0);
+  ASSERT(mg_p256_sign(x, hash, sizeof(hash), sig) == 1);
+  ASSERT(memcmp(sig, rs, sizeof(rs)) == 0);
+  ASSERT(mg_p256_verify(pub, hash, sizeof(hash), sig) == 1);
+  sig[10] ^= 1;
+  ASSERT(mg_p256_verify(pub, hash, sizeof(hash), sig) == 0);
+  // ECDH: both sides compute the same secret
+  ASSERT(mg_p256_make_key(pub2, prv2) == 1);
+  ASSERT(mg_p256_shared_secret(pub2, x, sec1) == 1);
+  ASSERT(mg_p256_shared_secret(pub, prv2, sec2) == 1);
+  ASSERT(memcmp(sec1, sec2, sizeof(sec1)) == 0);
+  pub2[63] ^= 1;  // Not on the curve anymore
+  ASSERT(mg_p256_shared_secret(pub2, x, sec1) == 0);
 #endif
 }
 
@@ -4643,8 +4749,8 @@ static void test_jwt(void) {
     opts.kid = mg_str("ec-key-1");
     opts.private_key = key;
     opts.public_key = pub;
-    ASSERT(mg_uecc_parse_private_key(mg_str(key_pem), key, sizeof(key)) == 32);
+    ASSERT(mg_p256_parse_private_key(mg_str(key_pem), key, sizeof(key)) == 32);
-    ASSERT(mg_uecc_compute_public_key(key, pub, mg_uecc_secp256r1()) == 1);
+    ASSERT(mg_p256_compute_public_key(key, pub) == 1);
     n = mg_jwt_sign_es256(&opts, jwt, sizeof(jwt));
     ASSERT(n > 0 && n + 1 < sizeof(jwt));
     jwt[n] = '\0';
@@ -4666,7 +4772,7 @@ static void test_crypto(void) {
   test_sha1();
   test_sha256();
   test_sha384();
-  test_x25519();
+  test_p256();
   test_rsa();
   test_jwt();
 }
@@ -4992,6 +5098,20 @@ static void test_dash(void) {
                "Authorization: Basic YWRtaW46YWRtaW4=\n\n") == 200);
   ASSERT(cmpbody(buf, login_admin_expected) == 0);
 
+  // OTA uses streaming and enforces the dashboard's authentication.
+  ASSERT(fetch(&mgr, buf, url,
+               "POST /api/ota HTTP/1.0\nContent-Length: 1\n\nx") == 403);
+  ASSERT(fetch(&mgr, buf, url,
+               "GET /api/ota HTTP/1.0\nContent-Length: 0\n"
+               "Authorization: Basic YWRtaW46YWRtaW4=\n\n") == 405);
+  ASSERT(fetch(&mgr, buf, url,
+               "POST /ota HTTP/1.0\nContent-Length: 1\n"
+               "Authorization: Basic YWRtaW46YWRtaW4=\n\nx") == 404);
+  ASSERT(fetch(&mgr, buf, url,
+               "POST /api/ota HTTP/1.0\nContent-Length: 1\n"
+               "Authorization: Basic YWRtaW46YWRtaW4=\n\nx") == 200);
+  ASSERT(cmpbody(buf, "1 ok\n") == 0);
+
   // set3 is admin-only
   ASSERT(fetch(&mgr, buf, url,
                "GET /api/get/set3 HTTP/1.0\n"

tutorials/README.md

@@ -9,13 +9,13 @@ The fastest way to quickly get Mongoose running on your hardware is to follow ou
 
 Steps to get the most out of this code base:
 
-- Most code here has a README.md file that points to a verbose tutorial describing how to get the intended functionality out of Mongoose Network Library. Code there runs as is in Windows, Ubuntu Linux, and Mac (very few cases don't run in Windows).
+- Most workstation code here has a README.md file that points to a verbose tutorial describing how to get the intended functionality out of Mongoose Network Library. Code there runs as is in Windows, Ubuntu Linux, and Mac (very few cases don't run in Windows).
   - Navigate your way to the desired protocol or function, read the README.md file
   - Follow the linked tutorial
   - In cases were there is no tutorial:
     - Follow the [Build Tools](https://mongoose.ws/documentation/tutorials/tools/) tutorial to setup your development environment.
     - run `make all`
-- Embedded hardware tutorials are conveniently linked from OS tutorials, or grouped by vendor and board.
+- Embedded hardware tutorials are grouped by vendor and board.
   - Navigate your way to the desired board or the closest one, read the README.md file. In most cases you'll find a link to our [Wizard](https://mongoose.ws/wizard/); for others, there is a link to a [Tutorial](https://mongoose.ws/documentation/#tutorials), as described at the top of this text. The Wizard will also link you to the tutorials you'll need.
   - In cases were there you don't find a link to a tutorial:
     - Follow the [Build Tools](https://mongoose.ws/documentation/tutorials/tools/) tutorial to setup your development environment.
@@ -28,7 +28,8 @@ Steps to get the most out of this code base:
 Rules for creating a new example:
 
 - Makefile golden reference for desktop/server examples: [http-server](http/http-server/)
-- Makefile golden reference for embedded examples: [stm32/nucleo-f746zg-baremetal-builtin-rndis](stm32/nucleo-f746zg-baremetal-builtin-rndis/)
+- Makefile golden reference for embedded examples: [stm32/nucleo-f746zg/minimal](stm32/nucleo-f746zg/minimal/)
+- Desktop/server examples compile `$(REPO_ROOT)/mongoose.c` and add `$(REPO_ROOT)` to their include path
 - Examples must build on Windows, Mac and Ubuntu Linux systems
 - Assume that users installed their tools according to the [Build Tools](https://mongoose.ws/documentation/tutorials/tools/) tutorial
 - Makefiles must not include other Makefiles
@@ -37,5 +38,5 @@ Rules for creating a new example:
 - Use `$(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA)` to compile
 - If an external repository is required, download it on demand using git shallow clone. See the embedded examples golden reference
 - Keep Makefiles as short as possible, but verbose to understand them easily
-- Symlink files when required, like `mongoose.c`, `ca.pem`, etc. Make no copies
+- Symlink files when required, like `ca.pem`, etc. Make no copies
 - Examples README.md files should contain only the title and the link to the corresponding mongoose.ws tutorial page

tutorials/arduino/esp32-http

@@ -1 +0,0 @@
-../http/http-server/arduino/esp32-http

tutorials/arduino/esp32-mqtt

@@ -1 +0,0 @@
-../mqtt/mqtt-client/arduino/esp32-mqtt

tutorials/arduino/sim800-mqtt

@@ -1 +0,0 @@
-../mqtt/mqtt-client/arduino/sim800-mqtt/