Add h723 baremetal cubemx stack/heap reporting

make TLS error reporting consistent

.github/workflows/nightly.yml

@@ -165,7 +165,7 @@ jobs:
     - run: |
         sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
         if [[ "${{ matrix.target }}" == *port* ]]; then source ./test/setup_ga_network.sh ; export ENV="-e Tmp=. -e WINEDEBUG=-all -e HOST_IP -e HOST_IPV6 -e HOST_IFC" ; sed -i -e "s/127.0.0.1//" test/mosquitto.conf; cat test/mosquitto.conf; ./test/setup_mqtt_server.sh ; make -C test port_tap_bridge ; test/port_tap_bridge & sleep 2 ; fi
-        make -C test ${{ matrix.target }} IPV6=${{ matrix.ipv6 }} SSL=${{ matrix.ssl }} MULTIREC=NO
+        make -C test ${{ matrix.target }} IPV6=${{ matrix.ipv6 }} SSL=${{ matrix.ssl }}
 
   miprtxbe:
     runs-on: ubuntu-latest
@@ -180,7 +180,7 @@ jobs:
     - run: |
         sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
         source ./test/setup_ga_network.sh ; export ENV="-e Tmp=. -e WINEDEBUG=-all -e HOST_IP -e HOST_IPV6 -e HOST_IFC -e RTX" ; sed -i -e "s/127.0.0.1//" test/mosquitto.conf ; ./test/setup_mqtt_server.sh ; make -C test port_tap_bridge ; test/port_tap_bridge & sleep 2
-        make -C test mip_port_s390 MULTIREC=NO
+        make -C test mip_port_s390
 
   l2:
     runs-on: ubuntu-latest
@@ -303,6 +303,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        target: [bsd, bsd_nortos]
         cc: [gcc, clang, g++, clang++]
     name: bsd CC=${{ matrix.cc }}
     steps:
@@ -316,7 +317,7 @@ jobs:
         make -C test/bsd shm_tap_bridge
         test/bsd/shm_tap_bridge &
         sleep 2
-        make -C test/bsd CC=${{ matrix.cc }} > log
+        make -C test/bsd ${{ matrix.target }} CC=${{ matrix.cc }} > log
     - if: success() || failure()
       run: |
         cat log
@@ -353,7 +354,7 @@ jobs:
     steps:
     - uses: actions/checkout@v5
       with: { fetch-depth: 2 }
-    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && ./test/setup_mqtt_server.sh && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test s390 SSL=${{ matrix.ssl }} MULTIREC=NO
+    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && ./test/setup_mqtt_server.sh && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test s390 SSL=${{ matrix.ssl }}
   armhf:
     runs-on: ubuntu-latest
     strategy:
@@ -366,7 +367,7 @@ jobs:
     steps:
     - uses: actions/checkout@v5
       with: { fetch-depth: 2 }
-    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && ./test/setup_mqtt_server.sh && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test armhf SSL=${{ matrix.ssl }} MULTIREC=NO
+    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && ./test/setup_mqtt_server.sh && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test armhf SSL=${{ matrix.ssl }}
   unamalgamated-mg_prefix:
     runs-on: ubuntu-latest
     strategy:
@@ -589,10 +590,12 @@ jobs:
               stm32/nucleo-f746zg/minimal
               stm32/nucleo-f746zg/minimal-pppoe
               stm32/nucleo-f756zg/minimal
-              stm32/nucleo-h563zi/minimal
               stm32/nucleo-h723zg/minimal
+              stm32/nucleo-h723zg/minimal-bsd-baremetal
+              stm32/nucleo-h723zg/minimal-bsd-freertos
           - group: stm32-2
             examples: |
+              stm32/nucleo-h563zi/minimal
               stm32/nucleo-h743zi/minimal
               stm32/nucleo-n657x0-q/minimal
               stm32/nucleo-u5a5zj-q/minimal
@@ -633,8 +636,7 @@ jobs:
       matrix:
         example:
           - path: micropython/esp32
-          - path: http/uart-bridge/esp32
+          - path: esp32/uart-bridge
-          - path: http/http-client/esp8266/http-client-server
     name: ${{ matrix.example.path }}
     env:
       GO: 0
@@ -652,7 +654,7 @@ jobs:
         include:
           - group: other
             examples: |
-              mqtt/mqtt-client/microchip/same54-xpro
+              microchip/same54-xpro/mqtt-client
               rp/pico-rmii
               stm32/nucleo-f746zg/minimal-rm2
               stm32/nucleo-f746zg/minimal-rndis
@@ -691,13 +693,13 @@ jobs:
       fail-fast: false
       matrix:
         example:
-          - path: esp32
+          - path: esp32/device-dashboard
     name: ${{ matrix.example.path }}
     steps:
       - uses: actions/checkout@v5
         with: { fetch-depth: 2 }
       - run: echo # nothing specific to install or do
-      - run: make -C tutorials/http/device-dashboard/${{ matrix.example.path }} build
+      - run: make -C tutorials/${{ matrix.example.path }} build
 
 
   device_dashboard_examples_arm:
@@ -709,12 +711,12 @@ jobs:
           - group: none
             cflags: ""
             examples: |
-              http/device-dashboard/microchip/same54-xpro
+              microchip/same54-xpro/device-dashboard
               renesas/ek-ra6m4-make-baremetal-builtin
           - group: builtin
             cflags: -DMG_TLS=MG_TLS_BUILTIN
             examples: |
-              http/device-dashboard/microchip/same54-xpro
+              microchip/same54-xpro/device-dashboard
               renesas/ek-ra6m4-make-baremetal-builtin
     name: device dashboard ARM ${{ matrix.group }}
     steps:
@@ -740,19 +742,19 @@ jobs:
           done
           exit $failed
 
-#  mqtt_dashboard_examples:
+  mqtt_dashboard_examples_arm:
-#    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest
-#    strategy:
+    strategy:
-#      fail-fast: false
+      fail-fast: false
-#      matrix:
+      matrix:
-#        example:
+        example:
-#          - path:
+          - path: rp/pico-rndis-device
-#    name: ${{ matrix.example.path }}
+    name: ${{ matrix.example.path }}
-#    steps:
+    steps:
-#      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5
-#        with: { fetch-depth: 2 }
+        with: { fetch-depth: 2 }
-#      - run: echo # nothing specific to install or do
+      - run: sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
-#      - run: make -C tutorials/${{ matrix.example.path }} build
+      - run: make -C tutorials/${{ matrix.example.path }} build
 
 
 #  dual_examples:

.github/workflows/nightly_tests.yml

@@ -98,8 +98,8 @@ jobs:
       with: { fetch-depth: 2 }
     - name: baremetal
       run: sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
-    - run:  make -C tutorials/http/device-dashboard/microchip/same54-xpro test VCON_API_KEY=${{secrets.VCON_API_KEY}}
+    - run:  make -C tutorials/microchip/same54-xpro/device-dashboard test VCON_API_KEY=${{secrets.VCON_API_KEY}}
-    - run:  make -C tutorials/mqtt/mqtt-client/microchip/same54-xpro test VCON_API_KEY=${{secrets.VCON_API_KEY}}
+    - run:  make -C tutorials/microchip/same54-xpro/mqtt-client test VCON_API_KEY=${{secrets.VCON_API_KEY}}
 
   test_pico_w5500:
     runs-on: ubuntu-latest

.github/workflows/quicktest.yml

@@ -158,7 +158,8 @@ jobs:
           - path: stm32/nucleo-f746zg/minimal
           - path: stm32/nucleo-h563zi/minimal
           - path: stm32/nucleo-h723zg/minimal
-          - path: stm32/nucleo-h723zg/minimal-bsd
+          - path: stm32/nucleo-h723zg/minimal-bsd-baremetal
+          - path: stm32/nucleo-h723zg/minimal-bsd-freertos
           - path: stm32/nucleo-h743zi/minimal
           - path: stm32/stm32h573i-dk/minimal
           - path: ti/ek-tm4c1294xl-make-baremetal-builtin
@@ -184,8 +185,7 @@ jobs:
       fail-fast: false
       matrix:
         example:
-          - path: http/uart-bridge/esp32
+          - path: esp32/uart-bridge
-          - path: http/http-client/esp8266/http-client-server
     name: ${{ matrix.example.path }}
     env:
       GO: 0
@@ -227,7 +227,7 @@ jobs:
       fail-fast: false
       matrix:
         example:
-          - path: esp32
+          - path: esp32/device-dashboard
     name: ${{ matrix.example.path }}
     env:
       GO: 0
@@ -235,12 +235,12 @@ jobs:
       - uses: actions/checkout@v5
         with: { fetch-depth: 2 }
       - run: |
-          if ./test/match_changed_files.sh '^src|tutorials/http/device-dashboard'; then
+          if ./test/match_changed_files.sh '^src|^tutorials/http/device-dashboard|^tutorials/${{ matrix.example.path }}'; then
             echo GO=1 >> $GITHUB_ENV
             # nothing specific to install or do
           fi
       - if: ${{ env.GO == 1 }}
-        run: make -C tutorials/http/device-dashboard/${{ matrix.example.path }} build
+        run: make -C tutorials/${{ matrix.example.path }} build
 
   device_dashboard_examples_arm:
     runs-on: ubuntu-latest
@@ -248,7 +248,7 @@ jobs:
       fail-fast: false
       matrix:
         example:
-          - path: http/device-dashboard/microchip/same54-xpro
+          - path: microchip/same54-xpro/device-dashboard
           - path: renesas/ek-ra6m4-make-baremetal-builtin
           - path: rp/pico-rndis
           - path: rp/pico-w
@@ -267,3 +267,24 @@ jobs:
           fi
       - if: ${{ env.GO == 1 }}
         run: make -C tutorials/${{ matrix.example.path }} build
+
+  mqtt_dashboard_examples_arm:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        example:
+          - path: rp/pico-rndis-device
+    name: ${{ matrix.example.path }}
+    env:
+      GO: 0
+    steps:
+      - uses: actions/checkout@v5
+        with: { fetch-depth: 2 }
+      - run: |
+          if ./test/match_changed_files.sh '^src|^tutorials/mqtt/mqtt-dashboard/device|^tutorials/${{ matrix.example.path }}'; then
+            echo GO=1 >> $GITHUB_ENV
+            sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
+          fi
+      - if: ${{ env.GO == 1 }}
+        run: make -C tutorials/${{ matrix.example.path }} build

.github/workflows/test.yml

@@ -179,7 +179,6 @@ jobs:
         example:
           - path: esp32/uart-bridge
           - path: esp32/micropython
-          - path: esp8266/http-client-server
     name: ${{ matrix.example.path }}
     env:
       GO: 0

AGENTS.md

@@ -486,7 +486,7 @@ embedded devices and needs only a few lines added to `mongoose_config.h`:
 
 ```c
 #define MG_OTA_URL "https://mongoose.ws/ota/u/PREFIX/ota.json"  // Copy from instructions panel
-#define MG_OTA_FIRMWARE_VERSION "MY_PRODUCT_1.4.2"  // Change this
+#define MG_FIRMWARE_VERSION "MY_PRODUCT_1.4.2"  // Change this
 ```
 
 No backend programming required. The device registers itself and checks in at

README.md

@@ -220,6 +220,15 @@ Technical guides and deep dives into embedded web servers, WebUI integration and
 - [STM32 Ethernet and caches](https://mongoose.ws/articles/stm32-ethernet-and-cache/)
 - [NXP RW612 OTA Firmware Update](https://mongoose.ws/articles/rw612-ota-firmware-update/)
 - [lwIP vs Mongoose - TCP/IP Stack Integration Benchmark](https://mongoose.ws/articles/lwip-vs-mongoose-tcpip-stack-integration/)
+- [Embedded TCP/IP Stacks Comparison](https://mongoose.ws/embedded-tcpip-stack-comparison/)
+- [STM32H5 File System on Internal Flash: LittleFS + Mongoose](https://mongoose.ws/articles/stm32h5-file-system-on-internal-flash/)
+- [Firmware OTA and remote control on NXP FRDM-RW612](https://mongoose.ws/articles/mdash/)
+- [25000 WebSocket messages per second on STM32 Nucleo-H723ZG](https://mongoose.ws/articles/stm32-websocket-benchmark/)
+- [How to connect STM32 to AWS IoT Core](https://mongoose.ws/articles/stm32-aws-iot/)
+- [How to connect STM32 to Azure IoT Hub](https://mongoose.ws/articles/stm32-azure-iot-hub/)
+- [How to connect STM32 to EMQX](https://mongoose.ws/articles/stm32-emqx/)
+- [STM32 Device Management deep dive: Secure OTA, Remote Control, health monitor](https://mongoose.ws/articles/stm32-mdash-deep-dive/")
+- [STM32 TCP/IP footprint: how much flash and RAM does Mongoose take?](https://mongoose.ws/articles/tcp-ip-footprint/)
 
 
 ## Contributions

resources/I-CUBE-Mongoose/.config/mongoose_parameters.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "version": "0.0.1",
+  "componentid": "::Mongoose:Networking Core",
+  "type": "object",
+  "grammarVersion": "3.8.0",
+  "license": "Copyright (c) Cesanta Software Limited",
+  "properties": {
+    "parameters": {
+      "type": "object",
+      "properties": {
+        "info": {
+          "type": "object",
+          "title": "General information",
+          "properties": {
+            "description": {
+              "title": "Middleware description",
+              "type": "string",
+              "actions": [
+                {
+                  "type": "disable",
+                  "condition": "true"
+                }
+              ],
+              "default": "Mongoose networking library: TCP/IP, TLS, HTTP, WebSocket, MQTT, OTA. Edit mongoose_config.h to configure it."
+            }
+          }
+        }
+      }
+    }
+  }
+}

resources/I-CUBE-Mongoose/Cesanta.I-CUBE-Mongoose.pdsc

@@ -1,13 +1,22 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<package schemaVersion="1.7.40" xmlns:xs="http://www.w3.org/2001/XMLSchema-instance" xs:noNamespaceSchemaLocation="PACK.xsd">
+<package schemaVersion="1.7.56" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:stm32="https://developer.st.com/schemas/stm32cube/1.0.0" xsi:noNamespaceSchemaLocation="PACK.xsd">
   <vendor>Cesanta</vendor>
   <name>I-CUBE-Mongoose</name>
-  <description>Mongoose - a lightweight networking library providing TCP/IP stack, TLS, HTTP (Embedded Web Server), WebSocket, MQTT, and Firmware OTA updates. Build production-ready web device dashboards and MQTT cloud connectivity without stitching multiple components together.
+  <description>Mongoose - a full-stack networking library for microcontrollers: Ethernet and Wi-Fi drivers, TCP/IP stack, TLS 1.3, HTTP, WebSocket, MQTT, Modbus, OTA updates and device management, in a two-file C/C++ library, on any RTOS or bare metal.</description>
-  </description>
   <url>https://mongoose.ws/downloads/stm32pack/</url>
   <license>License.txt</license>
   <supportContact>https://mongoose.ws/contact/</supportContact>
+  <environments>
+    <environment name="STM32Cube">
+      <stm32:pack type="MW" friendlyName="Mongoose" shortDesc="Mongoose full-stack networking library">
+        <relocation-info parent="middleware"/>
+        <no-compatibility-constraint/>
+      </stm32:pack>
+    </environment>
+  </environments>
   <releases>
+    <release date="2026-10-19" version="7.23.2">See https://github.com/cesanta/mongoose/releases/tag/7.23</release>
+    <release date="2026-09-28" version="7.23.1">See https://github.com/cesanta/mongoose/releases/tag/7.23</release>
     <release date="2026-05-11" version="7.21.7">See https://github.com/cesanta/mongoose/releases/tag/7.21</release>
     <release date="2026-05-05" version="7.21.5">See https://github.com/cesanta/mongoose/releases/tag/7.21</release>
     <release date="2026-04-24" version="7.21.4">See https://github.com/cesanta/mongoose/releases/tag/7.21</release>
@@ -19,7 +28,7 @@
       <keyword>IMPLEMENTED_WITH_STM32CUBEMX</keyword>
   </keywords>
   <components>
-    <component Cclass="Mongoose" Cgroup="Networking Core" Cversion="7.21.7" maxInstances="1">
+    <component Cclass="Mongoose" Cgroup="Networking Core" Cversion="7.23.2" maxInstances="1">
       <description>Networking Core</description>
       <files>
         <file category="doc" name="README.md"/>
@@ -27,7 +36,15 @@
         <file category="sourceC" name="mongoose.c" />
         <file category="header" name="mongoose_config.h"/>
         <file category="utility" name="README.md" public="false"/>
+        <file category="genAsset" name=".config/mongoose_parameters.json"/>
       </files>
+      <environments>
+        <environment name="STM32Cube">
+          <stm32:component>
+            <middleware-entry-point id="Mongoose" name="Mongoose" category="TCP/IP"/>
+          </stm32:component>
+        </environment>
+      </environments>
     </component>
   </components>
 </package>

resources/I-CUBE-Mongoose/Makefile

@@ -1,10 +1,16 @@
-VERSION = 7.21.7
+VERSION = 7.23.2
 REPO_ROOT = ../..
 MX ?= /Applications/STMicroelectronics/STM32CubeMX.app/Contents/MacOs/STM32CubeMX
-FILES = Cesanta.I-CUBE-Mongoose.pdsc Release_Notes.html mongoose_config.h README.md
+FILES = Cesanta.I-CUBE-Mongoose.pdsc Release_Notes.html mongoose_config.h README.md .config/mongoose_parameters.json
 GENERATED = License.txt mongoose.h mongoose.c
+MX2 ?= $(HOME)/STMicroelectronics/STM32CubeMX2_1.1.2/.bin/cube
+PACKSDIR ?= $(HOME)/Library/Application Support/stm32cube/packs
+MX2CPN ?= STM32C5A3ZGT6
+MX2PROJ = $(CURDIR)/mx2test/test.ioc2
+
+NAME = Cesanta.I-CUBE-Mongoose.$(VERSION)
+PACK = $(NAME).pack
 
-PACK = Cesanta.I-CUBE-Mongoose.$(VERSION).pack
 all: $(PACK)
 
 Cesanta.I-CUBE-Mongoose.$(VERSION).pack: $(FILES) $(GENERATED)
@@ -44,23 +50,19 @@ mongoose.h: Mongoose
 mongoose.c: Mongoose
 	cp $(REPO_ROOT)/mongoose.c $@
 
-pk: $(PACK)
+test_mx2: $(PACK)
-	rm -f gen.mx
+	-$(MX2) pack remove --cmsis-pack-root "$(PACKSDIR)" $(NAME)
-	echo swmgr remove Cesanta.I-CUBE-Mongoose.$(VERSION) >> gen.mx
+	rm -f "$(PACKSDIR)/.Download/$(PACK)"
-	echo swmgr install `pwd`/Cesanta.I-CUBE-Mongoose.$(VERSION).pack ask >> gen.mx
+	$(MX2) pack install --cmsis-pack-root "$(PACKSDIR)" "$(CURDIR)/$(PACK)"
-	echo exit >> gen.mx
+	export PATH="$(dir $(MX2)):$$PATH"; \
-	$(MX) -q `pwd`/gen.mx
+	PORT=$$(cube lifecycle-mx start-only | sed -n 's/^BACKEND_PORT *//p'); \
-
+	cube mx project close --port $$PORT -p "$(MX2PROJ)" --discard > /dev/null 2>&1; \
-
+	rm -rf mx2test && mkdir mx2test && \
-mx: $(PACK)
+	cube mx project create-from-mcu --port $$PORT --cpn $(MX2CPN) -l "$(CURDIR)/mx2test" -n test --empty-project && \
-	mkdir -p $@
+	cube mx middleware enable-middleware --port $$PORT -p "$(MX2PROJ)" -n Mongoose | tee mx2test/enable.json && \
-	cp ../downloads/nucleo_h563zi.ioc $@
+	grep -q '"status": "success"' mx2test/enable.json && \
-	V=`grep 'Mcu.ThirdParty0' $@/nucleo_h563zi.ioc | sed 's,^.*se.,,'`; sed -i '' "s,$$V,$(VERSION),g" $@/nucleo_h563zi.ioc
+	cube mx project save --port $$PORT -p "$(MX2PROJ)" && \
-	rm -f gen.mx
+	cube mx project close --port $$PORT -p "$(MX2PROJ)" --discard
-	echo config load `pwd`/$@/nucleo_h563zi.ioc >> gen.mx
-	echo project generate >> gen.mx
-	echo exit >> gen.mx
-	$(MX) -q `pwd`/gen.mx
 
 clean:
-	rm -rf *.pack STM32CubeMX/*.$(VERSION)_*.xml $(GENERATED) gen.mx mx
+	rm -rf *.pack STM32CubeMX/*.$(VERSION)_*.xml $(GENERATED) mx2test

resources/specs/areas/tls.md

@@ -13,9 +13,10 @@ Primary files:
 - `src/tls_dummy.c`
 - `src/tls_mbed.c`
 - `src/tls_openssl.c`
+- `src/tls_p256_cortex.c`
+- `src/tls_p256.c`
+- `src/tls_p384.c`
 - `src/tls_rsa.c`
-- `src/tls_uecc.c`
-- `src/tls_x25519.c`
 
 Perform a focused security review centered on these files and this security surface.
 
@@ -38,6 +39,6 @@ Trace attacker-controlled TLS peer input through normal client and server execut
 - Verify that wildcard matching is applied only to certificate presented identifiers, not to arbitrary reference identifiers or general DNS glob matching.
 - Review `mg_match` or other glob/matching helpers if used for certificate identity checks, authorization checks, filesystem paths, routing, or topic matching. Flag cases where glob semantics are broader than the security policy requires.
 - Check certificate parsing for DER/PEM boundary errors, length overflows, malformed ASN.1, extension parsing mistakes, name constraints, SAN vs CN precedence, embedded NUL, and invalid string type handling.
-- Review TLS record parsing, handshake transcript handling, key schedule, random generation, ECC/X25519 operations, AES-GCM nonce/tag handling, and error handling for memory safety and authentication failures.
+- Review TLS record parsing, handshake transcript handling, key schedule, random generation, ECC (P-256, P-384) operations, AES-GCM nonce/tag handling, and error handling for memory safety and authentication failures.
 - Flag any behavior that silently falls back from verified TLS to unverified TLS or plaintext.
 - Check that TLS receive/send error paths cannot corrupt connection state, reuse freed buffers, or continue processing unauthenticated plaintext as encrypted data.

sbom.cdx.json

@@ -3,9 +3,9 @@
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
   "serialNumber": "urn:uuid:d3f8b1e2-4a7c-4d9e-bf2a-1c3e5f7a9b0d",
-  "version": 1,
+  "version": 2,
   "metadata": {
-    "timestamp": "2026-08-12T00:00:00Z",
+    "timestamp": "2026-10-13T00:00:00Z",
     "component": {
       "type": "library",
       "bom-ref": "mongoose",
@@ -34,14 +34,31 @@
   "components": [
     {
       "type": "library",
-      "bom-ref": "micro-ecc",
+      "bom-ref": "bearssl-ec",
-      "author": "Kenneth MacKay",
+      "author": "Thomas Pornin",
-      "name": "micro-ecc",
+      "name": "BearSSL EC (P-256, P-384, ECDSA)",
-      "description": "ECC point operations on GF(p) curves (secp256r1). Used by Mongoose built-in TLS 1.3 for ECDH key exchange and ECDSA signatures. Source: src/tls_uecc.c, src/tls_uecc.h.",
+      "description": "P-256 (ec_p256_m31) and P-384 (ec_prime_i31) elliptic curve arithmetic, ECDSA sign and verify, and the i31 bignum code they use, derived from BearSSL. Used by Mongoose built-in TLS 1.3 for ECDHE key exchange and ECDSA signatures, by JWT ES256 and by OTA firmware signature verification. Source: src/tls_p256.c, src/tls_p256.h, src/tls_p384.c, src/tls_p384.h.",
-      "licenses": [ { "expression": "BSD-2-Clause" } ],
+      "licenses": [ { "expression": "MIT" } ],
-      "purl": "pkg:github/kmackay/micro-ecc",
       "externalReferences": [
-        { "type": "vcs", "url": "https://github.com/kmackay/micro-ecc" }
+        { "type": "website", "url": "https://bearssl.org" }
+      ],
+      "properties": [
+        { "name": "upstream-commit", "value": "7bea48e5e850ab4cafbe68d3765cdaba13a86d6f" }
+      ]
+    },
+    {
+      "type": "library",
+      "bom-ref": "p256-cortex-m4",
+      "author": "Emil Lenngren, Shortcut Labs AB",
+      "name": "P256-Cortex-M4",
+      "description": "P-256 ECDH and ECDSA in Cortex-M assembly. Used by Mongoose built-in TLS 1.3 instead of the BearSSL P-256 code on Cortex-M cores with the DSP extension (M4, M7, M33, M55, M85). Source: src/tls_p256_cortex.c.",
+      "licenses": [ { "expression": "MIT" } ],
+      "purl": "pkg:github/Emill/P256-Cortex-M4@ecd3ec2222fc9e18b6b44c86bb7183971a2041fc",
+      "externalReferences": [
+        { "type": "vcs", "url": "https://github.com/Emill/P256-Cortex-M4" }
+      ],
+      "properties": [
+        { "name": "upstream-commit", "value": "ecd3ec2222fc9e18b6b44c86bb7183971a2041fc" }
       ]
     },
     {
@@ -55,17 +72,6 @@
         { "type": "website", "url": "https://bearssl.org" }
       ]
     },
-    {
-      "type": "library",
-      "bom-ref": "strobe-x25519",
-      "author": "Cryptography Research, Inc. / Mike Hamburg",
-      "name": "STROBE x25519 (adapted)",
-      "description": "X25519 Diffie-Hellman function adapted from the STROBE project. Used by Mongoose built-in TLS 1.3 for ECDH key exchange. Source: src/tls_x25519.c.",
-      "licenses": [ { "expression": "MIT" } ],
-      "externalReferences": [
-        { "type": "website", "url": "https://strobe.sourceforge.io/" }
-      ]
-    },
     {
       "type": "library",
       "bom-ref": "sha1-reid",

src/arch.h

@@ -4,7 +4,6 @@
 #define MG_ARCH_UNIX 1          // Linux, BSD, Mac, ...
 #define MG_ARCH_WIN32 2         // Windows
 #define MG_ARCH_ESP32 3         // ESP32
-#define MG_ARCH_ESP8266 4       // ESP8266
 
 #define MG_ARCH_FREERTOS 5      // FreeRTOS <-- DEPRECATED !!!
 
@@ -50,7 +49,6 @@
 #include "arch_armgcc.h"
 #include "arch_cube.h"
 #include "arch_esp32.h"
-#include "arch_esp8266.h"
 #include "arch_rtx.h"
 #include "arch_threadx.h"
 #include "arch_unix.h"

src/arch_armcgt.h

@@ -12,7 +12,8 @@
 #include <sys/types.h>
 #include <time.h>
 
+#ifndef MG_PATH_MAX
 #define MG_PATH_MAX 100
-#define MG_ENABLE_DIRLIST 0
+#endif
 
 #endif

src/arch_armgcc.h

@@ -18,7 +18,8 @@
 #include <time.h>
 #include <unistd.h>
 
+#ifndef MG_PATH_MAX
 #define MG_PATH_MAX 100
-#define MG_ENABLE_DIRLIST 0
+#endif
 
 #endif

src/arch_cube.h

@@ -25,10 +25,6 @@
 #define MG_PATH_MAX 100
 #endif
 
-#ifndef MG_ENABLE_DIRLIST
-#define MG_ENABLE_DIRLIST 0
-#endif
-
 
 #ifndef MG_ENABLE_TCPIP
 #define MG_ENABLE_TCPIP 1  // Enable built-in TCP/IP stack

src/arch_esp32.h

@@ -22,10 +22,8 @@
 #include <esp_system.h>
 #include <esp_mac.h>
 #include <esp_idf_version.h>
-#include <esp_ota_ops.h>
+// #include <esp_memory_utils.h>  // For health record coredumps
-#include <esp_task_wdt.h>
+// #include <esp_core_dump.h>     // For health record coredumps
-#include <soc/soc.h>
-#include <soc/rtc_cntl_reg.h>
 
 #define MG_PATH_MAX 128
 
@@ -33,59 +31,8 @@
 #define MG_ENABLE_POSIX_FS 1
 #endif
 
-#ifndef MG_ENABLE_DIRLIST
+#ifndef MG_HEALTH_DATA_SIZE
-#define MG_ENABLE_DIRLIST 1
+#define MG_HEALTH_DATA_SIZE 20
-#endif
-
-#ifndef MG_OTA_ESP32_WDT_TIMEOUT_MS
-#define MG_OTA_ESP32_WDT_TIMEOUT_MS 10000U
-#endif
-
-static inline void mg_ota_esp32_timer_start(void) {
-#if ESP_IDF_VERSION_MAJOR >= 5
-  esp_task_wdt_config_t cfg = {0};
-  esp_err_t err;
-
-  cfg.timeout_ms = MG_OTA_ESP32_WDT_TIMEOUT_MS;
-  cfg.idle_core_mask = 0;
-  cfg.trigger_panic = true;
-
-  err = esp_task_wdt_init(&cfg);
-  if (err == ESP_ERR_INVALID_STATE) esp_task_wdt_reconfigure(&cfg);
-#else
-  esp_task_wdt_init(MG_OTA_ESP32_WDT_TIMEOUT_MS / 1000U, true);
-#endif
-  esp_task_wdt_add(NULL);
-  esp_task_wdt_reset();
-}
-
-static inline uint32_t mg_ota_esp32_state_set(uint32_t state) {
-  if (state == 0) esp_ota_mark_app_valid_cancel_rollback();
-  REG_WRITE(RTC_CNTL_STORE0_REG, state);
-  return REG_READ(RTC_CNTL_STORE0_REG);
-}
-
-#define MG_OTA_STATE_GET() \
-  REG_READ(RTC_CNTL_STORE0_REG)
-
-#define MG_OTA_STATE_SET(v) mg_ota_esp32_state_set((uint32_t) (v))
-
-#ifndef MG_OTA_ROLLBACK_TIMER_START
-#define MG_OTA_ROLLBACK_TIMER_START() mg_ota_esp32_timer_start()
-#endif
-
-#ifndef MG_OTA_ROLLBACK_TIMER_FEED
-#define MG_OTA_ROLLBACK_TIMER_FEED() \
-  do {                               \
-    (void) esp_task_wdt_reset();     \
-  } while (0)
-#endif
-
-#ifndef MG_OTA_ROLLBACK
-#define MG_OTA_ROLLBACK()                                  \
-  do {                                                     \
-    (void) esp_ota_mark_app_invalid_rollback_and_reboot(); \
-  } while (0)
 #endif
 
 #endif

src/arch_esp8266.h

@@ -1,26 +0,0 @@
-#pragma once
-
-#if MG_ARCH == MG_ARCH_ESP8266
-
-#include <ctype.h>
-#include <dirent.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <limits.h>
-#include <netdb.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <time.h>
-
-#include <esp_system.h>
-
-#define MG_PATH_MAX 128
-
-#endif

src/arch_mcuxpresso.h

@@ -27,10 +27,6 @@
 #define MG_PATH_MAX 100
 #endif
 
-#ifndef MG_ENABLE_DIRLIST
-#define MG_ENABLE_DIRLIST 0
-#endif
-
 #ifndef MG_ENABLE_TCPIP
 #define MG_ENABLE_TCPIP 1  // Enable built-in TCP/IP stack
 #endif

src/arch_unix.h

@@ -50,10 +50,6 @@
 #include <time.h>
 #include <unistd.h>
 
-#ifndef MG_ENABLE_DIRLIST
-#define MG_ENABLE_DIRLIST 1
-#endif
-
 #ifndef MG_PATH_MAX
 #define MG_PATH_MAX FILENAME_MAX
 #endif

src/arch_win32.h

@@ -166,10 +166,6 @@ typedef int socklen_t;
 #define S_ISDIR(x) (((x) &_S_IFMT) == _S_IFDIR)
 #endif
 
-#ifndef MG_ENABLE_DIRLIST
-#define MG_ENABLE_DIRLIST 1
-#endif
-
 #ifndef SIGPIPE
 #define SIGPIPE 0
 #endif

src/bsd.h

@@ -4,22 +4,64 @@
 #include "net_builtin.h"
 
 #if MG_ENABLE_BSD_SOCKETS
+void mg_bsd_init(struct mg_mgr *);
+void mg_bsd_poll(struct mg_mgr *);
 
-#ifndef MG_ENABLE_BSD_PROTOTYPES
-#include <arpa/inet.h>
 #include <errno.h>
 #include <fcntl.h>
-#include <netdb.h>
+
-#include <netinet/in.h>
+#ifndef EAGAIN
-#include <netinet/tcp.h>
+#define EAGAIN 11
-#include <poll.h>
+#endif
-#include <sys/select.h>
+#ifndef EWOULDBLOCK
-#include <sys/socket.h>
+#define EWOULDBLOCK EAGAIN
-#include <sys/time.h>
+#endif
-#include <sys/un.h>
+#ifndef EINPROGRESS
-#else
+#define EINPROGRESS 36
-#include <errno.h>
+#endif
+#ifndef ENOTCONN
+#define ENOTCONN 107
+#endif
+#ifndef ECONNREFUSED
+#define ECONNREFUSED 111
+#endif
+#ifndef ECONNRESET
+#define ECONNRESET 104
+#endif
+#ifndef EADDRINUSE
+#define EADDRINUSE 98
+#endif
+#ifndef ETIMEDOUT
+#define ETIMEDOUT 110
+#endif
+#ifndef EBADF
+#define EBADF 9
+#endif
+#ifndef EMFILE
+#define EMFILE 24
+#endif
+#ifndef ENOMEM
+#define ENOMEM 12
+#endif
+#ifndef EIO
+#define EIO 5
+#endif
+#ifndef EINVAL
+#define EINVAL 22
+#endif
+#ifndef EPERM
+#define EPERM 1
+#endif
+#ifndef EPIPE
+#define EPIPE 32
+#endif
+#ifndef EPROTONOSUPPORT
+#define EPROTONOSUPPORT 93
+#endif
+
+#if MG_ENABLE_BSD_PROTOTYPES
 typedef unsigned int socklen_t;
+typedef unsigned long nfds_t;
 typedef uint32_t in_addr_t;
 struct in_addr { in_addr_t s_addr; };
 struct in6_addr { uint8_t s6_addr[16]; };
@@ -45,7 +87,6 @@ struct hostent {
   int h_length;
   char **h_addr_list;
 };
-#define h_addr h_addr_list[0]
 struct addrinfo {
   int ai_flags;
   int ai_family;
@@ -57,6 +98,32 @@ struct addrinfo {
   struct addrinfo *ai_next;
 };
 struct pollfd { int fd; short events; short revents; };
+
+#if !defined(FD_SET) && !defined(FD_ZERO) && !defined(FD_ISSET)
+#define MG_BSD_SELECT_H
+typedef unsigned long __fd_mask;
+#ifndef FD_SETSIZE
+#define FD_SETSIZE 64
+#endif
+#define _NFDBITS ((int) sizeof(__fd_mask) * 8)
+#define _howmany(x, y) (((x) + ((y) - 1)) / (y))
+typedef struct fd_set {
+  __fd_mask __fds_bits[_howmany(FD_SETSIZE, _NFDBITS)];
+} fd_set;
+#define __fdset_mask(n) ((__fd_mask) 1 << ((n) % _NFDBITS))
+#define FD_CLR(n, p) ((p)->__fds_bits[(n) / _NFDBITS] &= ~__fdset_mask(n))
+#define FD_ISSET(n, p) \
+  (((p)->__fds_bits[(n) / _NFDBITS] & __fdset_mask(n)) != 0)
+#define FD_SET(n, p) ((p)->__fds_bits[(n) / _NFDBITS] |= __fdset_mask(n))
+#define FD_ZERO(p)                                                     \
+  do {                                                                 \
+    fd_set *_p = (p);                                                  \
+    size_t _n = _howmany(FD_SETSIZE, _NFDBITS);                        \
+    while (_n > 0) _p->__fds_bits[--_n] = 0;                           \
+  } while (0)
+#endif
+
+#define h_addr h_addr_list[0]
 #define AF_INET 2
 #define AF_INET6 10
 #define AF_UNSPEC 0
@@ -69,6 +136,7 @@ struct pollfd { int fd; short events; short revents; };
 #define IPPROTO_UDP 17
 #define INADDR_ANY 0
 #define INADDR_LOOPBACK 0x7f000001
+#define INET_ADDRSTRLEN 16
 #define SOL_SOCKET 0xffff
 #define SO_REUSEADDR 2
 #define SO_REUSEPORT 15
@@ -77,79 +145,37 @@ struct pollfd { int fd; short events; short revents; };
 #define SO_BROADCAST 6
 #define SO_RCVBUF 8
 #define SO_SNDBUF 7
+#define SO_NOSIGPIPE 0x1022
 #define TCP_NODELAY 1
 #define MSG_DONTWAIT 0x40
 #define MSG_NOSIGNAL 0x4000
 #define MSG_PEEK 0x02
+#ifndef F_GETFL
 #define F_GETFL 3
+#endif
+#ifndef F_SETFL
 #define F_SETFL 4
-#define O_NONBLOCK 0x0004
+#endif
+#ifndef O_NONBLOCK
+#define O_NONBLOCK 0x4000
+#endif
 #define SHUT_RD 0
 #define SHUT_WR 1
 #define SHUT_RDWR 2
 #define AI_PASSIVE 0x0001
 #define NI_MAXHOST 1025
 #define NI_MAXSERV 32
-#ifndef EAGAIN
-#define EAGAIN 11
-#endif
-#ifndef EWOULDBLOCK
-#define EWOULDBLOCK EAGAIN
-#endif
-#ifndef EINPROGRESS
-#define EINPROGRESS 36
-#endif
-#ifndef ENOTCONN
-#define ENOTCONN 107
-#endif
-#ifndef ECONNREFUSED
-#define ECONNREFUSED 111
-#endif
-#ifndef ECONNRESET
-#define ECONNRESET 104
-#endif
-#ifndef EADDRINUSE
-#define EADDRINUSE 98
-#endif
-#ifndef ETIMEDOUT
-#define ETIMEDOUT 110
-#endif
 #define POLLIN 0x001
 #define POLLOUT 0x004
 #define POLLERR 0x008
 #define POLLHUP 0x010
 #define POLLNVAL 0x020
-uint16_t htons(uint16_t);
-uint16_t ntohs(uint16_t);
-uint32_t htonl(uint32_t);
-uint32_t ntohl(uint32_t);
-#endif  // MG_ENABLE_BSD_PROTOTYPES
 
-#define closesocket(a) close(a)
+#define htons(x) mg_ntohs(x)
+#define ntohs(x) mg_ntohs(x)
+#define htonl(x) mg_ntohl(x)
+#define ntohl(x) mg_ntohl(x)
 
-#ifndef MG_BSD_BACKLOG
-#define MG_BSD_BACKLOG 5
-#endif
-
-#ifndef MG_BSD_CONNECT_TIMEOUT_MS
-#define MG_BSD_CONNECT_TIMEOUT_MS 10000
-#endif
-
-// Mongoose-specific API
-void mg_bsd_init(void);  // must be called before socket()
-void mg_bsd_poll(struct mg_mgr *);  // process pending BSD commands
-
-// Transport backend: implement these OR define MG_ENABLE_FREERTOS for the built-in backend
-void *mg_bsd_transport_new(int domain, int type, int proto);
-void  mg_bsd_transport_free(void *t);
-int   mg_bsd_transport_listen(void *t, const struct sockaddr_in *addr);
-void *mg_bsd_transport_accept(void *t, struct sockaddr_in *peer, bool nonblock);
-ssize_t mg_bsd_transport_recv(void *t, void *buf, size_t len, bool nonblock);
-ssize_t mg_bsd_transport_send(void *t, const void *buf, size_t len, bool nonblock);
-int   mg_bsd_transport_connect(void *t, const struct sockaddr_in *addr, bool nonblock);
-void  mg_bsd_transport_close(void *t);
-
-// Standard BSD socket API
 int socket(int, int, int);
 int bind(int, const struct sockaddr *, socklen_t);
 int listen(int, int);
@@ -157,23 +183,40 @@ int accept(int, struct sockaddr *, socklen_t *);
 int connect(int, const struct sockaddr *, socklen_t);
 ssize_t send(int, const void *, size_t, int);
 ssize_t recv(int, void *, size_t, int);
-ssize_t sendto(int, const void *, size_t, int, const struct sockaddr *, socklen_t);
+ssize_t sendto(int, const void *, size_t, int, const struct sockaddr *,
+               socklen_t);
 ssize_t recvfrom(int, void *, size_t, int, struct sockaddr *, socklen_t *);
 int close(int);
 int shutdown(int, int);
-int fcntl(int, int, int);
 int setsockopt(int, int, int, const void *, socklen_t);
 int getsockopt(int, int, int, void *, socklen_t *);
 int getsockname(int, struct sockaddr *, socklen_t *);
 int getpeername(int, struct sockaddr *, socklen_t *);
 int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
-int poll(struct pollfd *, unsigned int, int);
+int poll(struct pollfd *, nfds_t, int);
 struct hostent *gethostbyname(const char *);
-int getaddrinfo(const char *, const char *, const struct addrinfo *, struct addrinfo **);
+int getaddrinfo(const char *, const char *, const struct addrinfo *,
+                struct addrinfo **);
 void freeaddrinfo(struct addrinfo *);
 int inet_pton(int, const char *, void *);
 const char *inet_ntop(int, const void *, char *, socklen_t);
 in_addr_t inet_addr(const char *);
 char *inet_ntoa(struct in_addr);
+#else
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <poll.h>
+#include <sys/select.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <unistd.h>
+#endif  // MG_ENABLE_BSD_PROTOTYPES
 
+#include <sys/time.h>
+
+#else
+#define mg_bsd_init(mgr)
+#define mg_bsd_poll(mgr)
 #endif  // MG_ENABLE_BSD_SOCKETS

src/config.h

@@ -82,10 +82,6 @@
 #define MG_ENABLE_WINSOCK 1
 #endif
 
-#ifndef MG_ENABLE_DIRLIST
-#define MG_ENABLE_DIRLIST 0
-#endif
-
 #ifndef MG_ENABLE_CUSTOM_RANDOM
 #define MG_ENABLE_CUSTOM_RANDOM 0
 #endif
@@ -135,7 +131,7 @@
 #endif
 
 #ifndef MG_ENABLE_POSIX_FS
-#define MG_ENABLE_POSIX_FS 0
+#define MG_ENABLE_POSIX_FS MG_ENABLE_LFS
 #endif
 
 #ifndef MG_INVALID_SOCKET
@@ -227,6 +223,28 @@
 #define MG_ENABLE_TCPIP_PRINT_DEBUG_STATS 0
 #endif
 
+#ifndef MG_TLS_RECORD_SIZE
+#define MG_TLS_RECORD_SIZE 16384  // Max plaintext per sent TLS record, builtin
+#endif
+
 #ifndef MG_ENABLE_CHACHA20
 #define MG_ENABLE_CHACHA20 1  // When set to 0, GCM is used. For MG_TLS_BUILTIN
 #endif
+
+// P-256 implementation, for MG_TLS_BUILTIN
+#define MG_P256_LENNGREN 1  // Cortex-M4/M7/M33 asm, see tls_p256_cortex.c
+#define MG_P256_BEAR 3      // Portable C, BearSSL, see tls_p256.c
+
+#ifndef MG_P256
+#if defined(__GNUC__) && defined(__ARM_ARCH_PROFILE) && \
+    __ARM_ARCH_PROFILE == 'M' && defined(__ARM_FEATURE_DSP) && \
+    !defined(__ARM_BIG_ENDIAN)
+#define MG_P256 MG_P256_LENNGREN  // Cortex-M with DSP: M4, M7, M33, M55, M85
+#else
+#define MG_P256 MG_P256_BEAR
+#endif
+#endif
+
+#ifndef MG_ENABLE_HEALTH
+#define MG_ENABLE_HEALTH 0
+#endif

src/dash.c

@@ -1,5 +1,6 @@
 #include "dash.h"
 #include "http.h"
+#include "ota.h"
 #include "util.h"
 
 #define MG_NO_CACHE_HEADERS "Cache-Control: no-cache\r\n"
@@ -77,12 +78,7 @@ static int mg_dash_array_size(struct mg_field_set *set,
                               struct mg_dash_user *u) {
   int saved = *set->index, sz = -1;
   *set->index = -1;
-  if (set->fn) {
+  if (set->fn && set->fn(MG_DASH_READ, u)) sz = *set->index;
-    if (set->fn(MG_DASH_READ, u)) sz = *set->index;
-  } else if (set->get_dir) {
-    mg_dash_dir_read(set, u);
-    sz = *set->index;
-  }
   *set->index = saved;
   return sz;
 }
@@ -100,10 +96,7 @@ static size_t mg_dash_print_array(mg_pfn_t fn, void *arg, va_list *ap) {
   for (;;) {
     bool done = to >= 0 && *set->index > to;
     if (!done) {
-      if (set->fn)
+      if (set->fn) set->fn(MG_DASH_READ, u);
-        set->fn(MG_DASH_READ, u);
-      else if (set->get_dir)
-        mg_dash_dir_read(set, u);
       done = *set->index < 0;
     }
     if (done) break;
@@ -185,8 +178,7 @@ void mg_dash_send_change(struct mg_mgr *mgr, struct mg_field_set *set) {
                    MG_ESC("change"), MG_ESC("params"), MG_ESC(set->name), sz);
     } else {
       int saved_idx = set->index != NULL ? *set->index : 0;
-      bool ok = set->fn ? set->fn(MG_DASH_READ, u)
+      bool ok = set->fn ? set->fn(MG_DASH_READ, u) : true;
-                        : (set->get_dir ? mg_dash_dir_read(set, u) : true);
       if (!ok) {
         if (set->index != NULL) *set->index = saved_idx;
         continue;
@@ -233,8 +225,7 @@ static int mg_dash_parse_field(struct mg_str json, struct mg_field *f) {
          mg_json_get_num(json, json_path, (double *) f->value);
   } else if (f->type == MG_VAL_STR && f->value_size > 0) {
     struct mg_str tok = mg_json_get_tok(json, json_path);
-    ok = tok.len >= 2 && tok.buf[0] == '"' &&
+    ok = tok.len >= 2 && tok.buf[0] == '"' && tok.buf[tok.len - 1] == '"';
-         tok.buf[tok.len - 1] == '"';
     if (ok) mg_json_unescape(json, json_path, (char *) f->value, f->value_size);
   } else if (f->type == MG_VAL_RAW && f->value_size > 0) {
     ok = mg_snprintf((char *) f->value, f->value_size, "%.*s", json.len,
@@ -271,68 +262,6 @@ static int mg_dash_apply(struct mg_connection *c, struct mg_dash *dash,
   return total_count;
 }
 
-bool mg_dash_dir_read(struct mg_field_set *set, struct mg_dash_user *u) {
-  char dir[256], fname[128] = "";
-  struct mg_fs *fs = u->dash->upload_fs ? u->dash->upload_fs : &mg_fs_posix;
-  struct mg_field *name_field = NULL, *size_field = NULL;
-  size_t i;
-
-  if (!set->get_dir(u, dir, sizeof(dir))) return false;
-
-  for (i = 0; set->fields[i].name != NULL; i++) {
-    if (name_field == NULL && set->fields[i].type == MG_VAL_STR &&
-        strcmp(set->fields[i].name, "name") == 0)
-      name_field = &set->fields[i];
-    if (size_field == NULL && strcmp(set->fields[i].name, "size") == 0)
-      size_field = &set->fields[i];
-  }
-  if (name_field == NULL) return false;
-
-  if (*set->index == -1) {  // Size query: count all files
-    int count = 0;
-    while (mg_fs_ls(fs, dir, fname, sizeof(fname))) count++;
-    *set->index = count;
-    return true;
-  }
-
-  {  // Regular read: scan to *set->index
-    int target = *set->index, cur = 0;
-    while (mg_fs_ls(fs, dir, fname, sizeof(fname))) {
-      if (cur++ == target) {
-        mg_snprintf((char *) name_field->value, name_field->value_size, "%s",
-                    fname);
-        if (size_field != NULL) {
-          char path[512];
-          size_t sz = 0;
-          mg_snprintf(path, sizeof(path), "%s/%s", dir, fname);
-          fs->st(path, &sz, NULL);
-          if (size_field->type == MG_VAL_UINT64)
-            *(uint64_t *) size_field->value = (uint64_t) sz;
-          else if (size_field->type == MG_VAL_INT)
-            *(int *) size_field->value = (int) sz;
-        }
-        return true;
-      }
-    }
-    *set->index = -1;  // No more entries
-    return true;
-  }
-}
-
-static bool mg_dash_set_file_name(struct mg_field_set *set,
-                                  struct mg_str name) {
-  size_t i;
-  for (i = 0; set->fields[i].name != NULL; i++) {
-    struct mg_field *f = &set->fields[i];
-    if (f->type == MG_VAL_STR && strcmp(f->name, "name") == 0) {
-      mg_snprintf((char *) f->value, f->value_size, "%.*s", (int) name.len,
-                  name.buf);
-      return true;
-    }
-  }
-  return false;
-}
-
 static inline void mg_log_http_req(struct mg_connection *c,
                                    struct mg_http_message *hm) {
   int len = 0;
@@ -365,33 +294,6 @@ static inline void mg_log_http_req(struct mg_connection *c,
             c->send.buf + n));
 }
 
-static void mg_dash_ota_cb(struct mg_connection *c, const char *errmsg) {
-  mg_http_reply(c, errmsg ? 500 : 200, NULL, errmsg ? errmsg : "ok\n");
-  c->is_draining = 1;
-}
-
-static void mg_dash_upload_cb(struct mg_connection *c, const char *errmsg) {
-  if (errmsg) {
-    mg_http_reply(c, 500, NULL, "%s\n", errmsg);
-  } else {
-    // mg_http_start_upload() repurposes c->data for its own bookkeeping,
-    // so the field set can't be cached there. Re-derive the dashboard from
-    // c->fn_data instead, and notify every file-backed array: the upload
-    // could belong to any of them, and re-querying get_dir() per recipient
-    // is what mg_dash_send_change() does anyway (directories can be
-    // user-specific)
-    struct mg_dash *dash = (struct mg_dash *) c->fn_data;
-    struct mg_field_set *fs;
-    mg_http_reply(c, 200, NULL, "ok\n");
-    for (fs = dash->sets; fs != NULL; fs = fs->next) {
-      if (fs->get_dir == NULL) continue;
-      *fs->index = -1;  // Signal mg_dash_send_change() to broadcast new size
-      mg_dash_send_change(c->mgr, fs);
-    }
-  }
-  c->is_draining = 1;
-}
-
 static uint64_t mg_dash_make_expiration_time(struct mg_dash *dash) {
   unsigned t = (unsigned) dash->session_auto_expiration_seconds;
   if (t == 0) t = 3600;  // Default expiration time in seconds
@@ -631,6 +533,40 @@ static void mg_dash_handle_add(struct mg_connection *c, struct mg_dash *dash,
   }
 }
 
+// Firmware upload callback for mg_http_stream_body(). Uses *p as a flag:
+// non-NULL means an OTA session is open and must be closed by mg_ota_end()
+static bool otacb(struct mg_http_message *hm, struct mg_str *data, void **p) {
+  if (hm != NULL) {  // Start
+    if (!mg_ota_begin(hm->body.len)) return false;
+    *p = (void *) (ptrdiff_t) 1;
+    return true;
+  } else if (data != NULL) {  // Next chunk
+    return mg_ota_write(data->buf, data->len);
+  }
+  if (*p == NULL) return false;  // End. Begin failed, nothing to finish
+  *p = NULL;
+  return mg_ota_end();
+}
+
+static void mg_serve_fs(struct mg_connection *c, struct mg_http_message *hm,
+                        struct mg_dash_user *u, bool stream) {
+  struct mg_dash *dash = (struct mg_dash *) c->fn_data;
+  char root[128] = "/fs/=";
+  if (u == NULL) {
+    mg_http_reply(c, 403, MG_JSON_HEADERS, "Not Authorised\n");
+  } else if (dash->files_dir(u, root + 5, sizeof(root) - 5) == false) {
+    mg_http_reply(c, 500, MG_JSON_HEADERS, "Upload dir error\n");
+  } else {
+    struct mg_http_serve_opts o;
+    memset(&o, 0, sizeof(o));
+    o.root_dir = root;
+    o.fs = dash->upload_fs ? dash->upload_fs : &mg_fs_posix;
+    o.enable_delete = o.enable_upload = o.enable_dir_listing = true;
+    if (stream) mg_http_serve_upload(c, hm, &o);
+    else mg_http_serve_dir(c, hm, &o);
+  }
+}
+
 void mg_dash_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
   struct mg_dash *dash = (struct mg_dash *) c->fn_data;
   struct mg_dash_cdata *d = (struct mg_dash_cdata *) c->data;
@@ -644,9 +580,6 @@ void mg_dash_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
     // Received headers - check authentication and possibly start uploads/ota
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     struct mg_dash_user *u = mg_dash_authenticate(c, hm, dash);
-    struct mg_str parts[3];
-    memset(parts, 0, sizeof(parts));
-
     if (mg_match(hm->uri, mg_str("/api/hi"), NULL) ||
         mg_match(hm->uri, mg_str("/api/logout"), NULL)) {
       // Do nothing, handle them MG_EV_HTTP_MSG. We bypass auth for those
@@ -656,49 +589,21 @@ void mg_dash_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
     } else if (mg_match(hm->uri, mg_str("/api/login"), NULL) && u != NULL) {
       mg_handle_login(c, u);
       d->marker = CONN_HANDLED;
+    } else if (u != NULL && dash->files_dir != NULL &&
+               mg_match(hm->uri, mg_str("/fs/#"), NULL)) {
+      mg_serve_fs(c, hm, u, true);
+      return;  // Important - the serve_fs() call can invalidate hm
     } else if (mg_match(hm->uri, mg_str("/api/ota"), NULL)) {
-      mg_http_start_ota(c, hm, mg_dash_ota_cb);
+      // Authenticated above. If streaming started, the stream handler owns
-    } else if (mg_match(hm->uri, mg_str("/fs/*/*"), parts) &&
+      // the connection and c->data, so skip the marker check below
-               (mg_strcasecmp(hm->method, mg_str("POST")) == 0 ||
+      if (mg_http_stream_body(c, hm, otacb, NULL)) return;
-                mg_strcasecmp(hm->method, mg_str("PUT")) == 0)) {
-      struct mg_field_set *set = mg_dash_find_field_set(dash, parts[0]);
-      struct mg_str name = parts[1];
-      int len =
-          mg_url_decode(name.buf, name.len, (char *) name.buf, name.len + 1, 0);
-      if (len > 0 && (size_t) len <= name.len) name.len = (size_t) len;
-      if (set == NULL || set->get_dir == NULL) {
-        mg_http_reply(c, 404, MG_JSON_HEADERS, "Not Found\n");
-        d->marker = CONN_HANDLED;
-      } else if (u == NULL) {
-        mg_http_reply(c, 403, MG_JSON_HEADERS, "Not Authorised\n");
-        d->marker = CONN_HANDLED;
-      } else if (!mg_path_is_sane(name)) {
-        mg_http_reply(c, 400, MG_JSON_HEADERS, "Bad file name\n");
-        d->marker = CONN_HANDLED;
-      } else {
-        mg_dash_set_file_name(set, name);
-        if (set->fn != NULL && !set->fn(MG_DASH_WRITE, u)) {
-          mg_http_reply(c, 403, MG_JSON_HEADERS, "Not Authorised\n");
-          d->marker = CONN_HANDLED;
-        } else {
-          char dir[256];
-          struct mg_fs *fs = dash->upload_fs ? dash->upload_fs : &mg_fs_posix;
-          if (!set->get_dir(u, dir, sizeof(dir))) {
-            mg_http_reply(c, 500, MG_JSON_HEADERS, "Upload dir error\n");
-            d->marker = CONN_HANDLED;
-          } else {
-            mg_http_start_upload(c, hm, name, mg_str(dir), fs,
-                                 mg_dash_upload_cb);
-          }
-        }
-      }
     }
     if (d->marker != '\0') mg_log_http_req(c, hm);
   } else if (ev == MG_EV_HTTP_MSG && d->marker != '\0') {
     // The response has been send in EV_HDRS path, so we're not reponding
     // anything but clearing the marker for the next request.
     d->marker = 0;
-    c->is_resp = 0;
+    c->pfn_data = NULL;  // Response done
   } else if (ev == MG_EV_HTTP_MSG && d->marker == '\0') {
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     struct mg_dash_user *u = mg_dash_authenticate(c, hm, dash);
@@ -714,42 +619,9 @@ void mg_dash_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
     } else if (mg_match(hm->uri, mg_str("/api/websocket"), NULL)) {
       d->u = u;
       mg_ws_upgrade(c, hm, NULL);
-    } else if (mg_match(hm->uri, mg_str("/fs/*/*"), parts)) {
+    } else if (dash->files_dir != NULL &&
-      struct mg_field_set *set = mg_dash_find_field_set(dash, parts[0]);
+               mg_match(hm->uri, mg_str("/fs/#"), NULL)) {
-      if (set == NULL || set->get_dir == NULL) {
+      mg_serve_fs(c, hm, u, false);
-        mg_http_reply(c, 404, MG_JSON_HEADERS, "Not Found");
-      } else if (u == NULL) {
-        mg_http_reply(c, 403, MG_JSON_HEADERS, "Not Authorised\n");
-      } else {
-        char dir[256], path[512];
-        struct mg_fs *fs = dash->upload_fs ? dash->upload_fs : &mg_fs_posix;
-        struct mg_str name = parts[1];
-        int len = mg_url_decode(name.buf, name.len, (char *) name.buf,
-                                name.len + 1, 0);
-        if (len > 0 && (size_t) len <= name.len) name.len = (size_t) len;
-        if (!mg_path_is_sane(name)) {
-          mg_http_reply(c, 400, MG_JSON_HEADERS, "Bad file name\n");
-          return;
-        }
-        if (!set->get_dir(u, dir, sizeof(dir))) {
-          mg_http_reply(c, 500, MG_JSON_HEADERS, "Upload dir error\n");
-          return;
-        }
-        mg_snprintf(path, sizeof(path), "%s/%.*s", dir, name.len, name.buf);
-        if (mg_strcasecmp(hm->method, mg_str("DELETE")) == 0) {
-          mg_dash_set_file_name(set, name);
-          if (set->fn != NULL && !set->fn(MG_DASH_DELETE, u)) {
-            mg_http_reply(c, 403, MG_JSON_HEADERS, "Not Authorised\n");
-          } else {
-            fs->rm(path);
-            *set->index = -1;  // Signal mg_dash_send_change() to send new size
-            mg_dash_send_change(c->mgr, set);
-            mg_http_reply(c, 200, NULL, "true");
-          }
-        } else {
-          mg_http_serve_file(c, hm, path, NULL);
-        }
-      }
     } else if (mg_match(hm->uri, mg_str("/api/del/*/*/*"), parts) ||
                mg_match(hm->uri, mg_str("/api/del/*/*"), parts)) {
       mg_dash_handle_del(c, dash, u, parts);
@@ -780,7 +652,7 @@ void mg_dash_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
           break;
         }
       }
-      if (ch == NULL) mg_http_reply(c, 404, MG_JSON_HEADERS, "Not Found");
+      if (ch == NULL) mg_http_reply(c, 404, MG_JSON_HEADERS, "Not Found\n");
       mg_log_http_req(c, hm);
     }
   }

src/dash.h

@@ -73,9 +73,7 @@ struct mg_field_set {
                // fn sets *index = -1 to signal end of iteration.
                // Size query: framework sets *index = -1 before fn(READ); fn
                // sets *index = total size
-  bool (*get_dir)(const struct mg_dash_user *u, char *buf,
+  struct mg_field_set *next;  // Next set in the list
-                  size_t len);  // Non-NULL: file array
-  struct mg_field_set *next;    // Next set in the list
 };
 
 // Custom URI handler, registered with MG_DASH_REGISTER_CUSTOM_HANDLER()
@@ -96,6 +94,9 @@ struct mg_dash {
   int session_auto_expiration_seconds;  // Session lifetime, 0: 1 hour default
   struct mg_dash_user *guest;           // Used when authenticate == NULL
   struct mg_fs *upload_fs;  // FS for uploads/listing, default &mg_fs_posix
+  // Resolves the built-in file manager's root dir for user u, e.g. per-user
+  // upload directories. NULL: file manager disabled
+  bool (*files_dir)(const struct mg_dash_user *u, char *buf, size_t len);
 };
 
 #define MG_DASH_ADD_FIELD_SET(dash_, set_) \
@@ -121,43 +122,6 @@ void mg_dash_ev_handler(struct mg_connection *c, int ev, void *ev_data);
 // array size if *set->index < 0, or a single element update otherwise
 void mg_dash_send_change(struct mg_mgr *mgr, struct mg_field_set *);
 
-// Default reader for file-backed array sets (set->get_dir != NULL)
-// Usage example - this is a complete implemenation of the file manager:
-// ```c
-// static struct file {
-//   int index;
-//   char name[64];
-//   size_t size;
-//   uint64_t checksum;
-// } s_file;
-// static struct mg_field_set set_files;
-//
-// static bool get_dir(const struct mg_dash_user *u, char *buf, size_t len) {
-//   (void) u;
-//   mkdir("/tmp/dashboard", 0755);
-//   mg_snprintf(buf, len, "%s", "/tmp/dashboard");
-//   return true;
-// }
-//
-// static struct mg_field fields_files[] = {
-//     {"name", MG_VAL_STR, s_file.name, sizeof(s_file.name)},
-//     {"size", MG_VAL_UINT64, &s_file.size, 0},
-//     {"checksum", MG_VAL_UINT64, &s_file.checksum, sizeof(s_file.checksum)},
-//     {NULL, MG_VAL_INT, NULL, 0},
-// };
-//
-// static bool files_fn(enum mg_dash_op op, struct mg_dash_user *u) {
-//   if (op == MG_DASH_WRITE) return s_uploads_enabled && u->level >= 7;
-//   if (op != MG_DASH_READ) return false;
-//   if (!mg_dash_dir_read(&set_files, u)) return false;
-//   s_file.checksum = 0;  // Mock to show how to set custom fields
-//   return true;
-// }
-//
-// static struct mg_field_set set_files = {"files", fields_files, files_fn, &s_file.index, get_dir, NULL};
-// ```
-bool mg_dash_dir_read(struct mg_field_set *set, struct mg_dash_user *u);
-
 // Helper forward declarations for Mongoose CMSIS pack modules
 extern struct mg_mgr g_mgr;
 extern void mg_dash_init(struct mg_mgr *);

src/dns.c

@@ -263,14 +263,14 @@ static bool mg_dns_send(struct mg_connection *c, const struct mg_str *name,
 bool mg_dnsc_init(struct mg_mgr *mgr, struct mg_dns *dnsc);
 bool mg_dnsc_init(struct mg_mgr *mgr, struct mg_dns *dnsc) {
   if (dnsc->url == NULL) {
-    mg_error(0, "DNS server URL is NULL. Call mg_mgr_init()");
+    MG_ERROR(("DNS server URL is NULL. Call mg_mgr_init()"));
     return false;
   }
   if (dnsc->c == NULL) {
     dnsc->c = mg_connect(mgr, dnsc->url, NULL, NULL);
     if (dnsc->c == NULL) return false;
-    dnsc->c->pfn = dns_cb;
   }
+  dnsc->c->pfn = dns_cb; // do it always, DHCP-assigned DNS bootstrap needs it
   return true;
 }
 

src/flash.c

@@ -4,7 +4,7 @@
 #include "ota.h"
 #ifdef MG_OTA_PUBLIC_KEY
 #include "sha256.h"
-#include "tls_uecc.h"
+#include "tls_p256.h"
 #endif
 
 #if MG_OTA != MG_OTA_NONE && MG_OTA != MG_OTA_CUSTOM
@@ -76,9 +76,8 @@ bool mg_ota_flash_end(struct mg_flash *flash) {
         uint8_t hash[32];
         size_t fw_size = s_size - 68;  // strip 64-byte sig + 4-byte magic
         mg_sha256(hash, (uint8_t *) base, fw_size);
-        ok = mg_uecc_verify(s_pubkey, hash, sizeof(hash),
+        ok = mg_p256_verify(s_pubkey, hash, sizeof(hash),
-                            (uint8_t *) base + fw_size,
+                            (uint8_t *) base + fw_size) == 1;
-                            mg_uecc_secp256r1()) == 1;
         MG_INFO(("Signature: %s", ok ? "ok" : "fail"));
       } else {
         ok = false;

src/fs.c

@@ -1,4 +1,5 @@
 #include "fs.h"
+#include "log.h"
 #include "printf.h"
 #include "str.h"
 #include "util.h"
@@ -47,6 +48,7 @@ bool mg_file_write(struct mg_fs *fs, const char *path, const void *buf,
   char tmp[MG_PATH_MAX], rnd[10];
   size_t path_len = mg_snprintf(tmp, sizeof(tmp), "%s..%s", path,
                                 mg_random_str(rnd, sizeof(rnd)));
+  fs->rm(tmp);
   if (path_len < sizeof(tmp) &&
       (fd = mg_fs_open(fs, tmp, MG_FS_WRITE | MG_FS_EXCL)) != NULL) {
     result = fs->wr(fd->fd, buf, len) == len;
@@ -54,8 +56,11 @@ bool mg_file_write(struct mg_fs *fs, const char *path, const void *buf,
     if (result) {
       fs->rm(path);
       result = fs->mv(tmp, path);
+      MG_DEBUG(("mv %s -> %s result=%d", tmp, path, result));
     }
     fs->rm(tmp);
+  } else {
+    MG_ERROR(("mg_fs_open(%s) failed, path_len=%zu", tmp, path_len));
   }
   return result;
 }

src/fs.h

@@ -2,6 +2,7 @@
 
 #include "arch.h"
 #include "config.h"
+#include "lfs.h"
 
 // Flags returned by mg_fs.st() and passed to mg_fs.open().
 enum { MG_FS_READ = 1, MG_FS_WRITE = 2, MG_FS_DIR = 4, MG_FS_EXCL = 8 };
@@ -40,6 +41,7 @@ void mg_fs_close(struct mg_fd *fd);
 
 // Sequential directory iterator. Call repeatedly with the same buf/len;
 // each call fills buf with the next entry name. Returns false when done.
+// Note: make sure buf[0] == 0 before the first call
 bool mg_fs_ls(struct mg_fs *fs, const char *path, char *buf, size_t len);
 
 // Reads the entire file into a heap-allocated buffer. The returned mg_str is

src/fs_posix.c

@@ -10,6 +10,10 @@
 #define MG_STAT_FUNC stat
 #endif
 
+#if MG_ENABLE_LFS
+#include <dirent.h>
+#endif
+
 static int p_stat(const char *path, size_t *size, time_t *mtime) {
 #if !defined(S_ISDIR)
   MG_ERROR(("stat() API is not supported. %p %p %p", path, size, mtime));
@@ -161,7 +165,6 @@ struct dirent *readdir(DIR *d) {
 
 static void p_list(const char *dir, void (*fn)(const char *, void *),
                    void *userdata) {
-#if MG_ENABLE_DIRLIST
   struct dirent *dp;
   DIR *dirp;
   if ((dirp = (opendir(dir))) == NULL) return;
@@ -170,9 +173,6 @@ static void p_list(const char *dir, void (*fn)(const char *, void *),
     fn(dp->d_name, userdata);
   }
   closedir(dirp);
-#else
-  (void) dir, (void) fn, (void) userdata;
-#endif
 }
 
 static void *p_open(const char *path, int flags) {

src/health.c

@@ -1,5 +1,121 @@
+#include "config.h"
 #include "health.h"
 
 // The one health record. Lives in RAM that survives a warm reset, see
 // MG_HEALTH_RAM and the .mg_health region in the linker script
 struct mg_health mg_health_record MG_HEALTH_RAM;
+
+// STM32 H723 support. Needs the _estack symbol from the linker script
+#if MG_ENABLE_HEALTH && (defined(STM32H7_DEV_ID) || defined(STM32H5))
+// Fault handler body. Runs in exception context: no printf, no malloc, no
+// blocking calls. Copies the unwind registers and raw stack into the health
+// record, then resets.
+// "used" keeps the linker from garbage-collecting this section: the only
+// reference is the "b fault_c" branch in the naked handler below
+__attribute__((used, noinline)) static void fault_c(uint32_t *frame,
+                                                    uint32_t exc_return) {
+  extern uint32_t _estack;
+  uint32_t *stack = frame + 8 + ((exc_return & (1U << 4)) ? 0 : 18);
+  uint32_t *r = mg_health_record.data;
+
+  if (frame[7] & (1U << 9)) stack++;    // Eight-byte stack alignment padding
+  r[0] = (uint32_t) (uintptr_t) stack;  // SP
+  r[1] = frame[5];                      // LR
+  r[2] = frame[6];                      // PC
+  for (size_t i = 0; i < MG_HEALTH_DATA_SIZE - 3; i++) {  // Raw stack
+    r[3 + i] = stack + i < &_estack ? stack[i] : 0;
+  }
+  mg_health_record.cpuid = SCB->CPUID;
+  mg_health_record.reset_reason = MG_HEALTH_RESET_FAULT;
+  NVIC_SystemReset();
+}
+
+// Common fault entry. EXC_RETURN bit 2 tells which stack was in use:
+// 0 = MSP, 1 = PSP. Load the faulting SP into r0 and hand it to fault_c()
+__attribute__((naked)) void HardFault_Handler(void) {
+  __asm volatile(
+      "mov r1, lr\n\t"
+      "tst lr, #4\n\t"
+      "ite eq\n\t"
+      "mrseq r0, msp\n\t"
+      "mrsne r0, psp\n\t"
+      "b fault_c\n\t");
+}
+
+// Route the other fault types through the same entry point
+void MemManage_Handler(void) __attribute__((alias("HardFault_Handler")));
+void BusFault_Handler(void) __attribute__((alias("HardFault_Handler")));
+void UsageFault_Handler(void) __attribute__((alias("HardFault_Handler")));
+#endif
+
+// Start a new boot: validate the record, count the boot, store the reset
+// reason. The current boot moves to prev_* slots first, so the previous
+// boot's uptime and reason stay readable. Called by MG_HEALTH_INIT()
+void mg_health_init(void) {
+  char magic[] = MG_HEALTH_MAGIC;
+  // struct mg_health *h = mg_health_get();
+  if (!mg_health_valid()) {  // First boot, or RAM lost its contents
+    memset(&mg_health_record, 0, sizeof(mg_health_record));
+    memcpy(mg_health_record.magic, magic, sizeof(mg_health_record.magic));
+  }
+
+#if 0 && MG_ARCH == MG_ARCH_ESP32 && CONFIG_ESP_COREDUMP_ENABLE_TO_FLASH
+  {
+    // After a crash, copy the backtrace from the core dump in flash: the same
+    // addresses the panic handler prints as "Backtrace: PC:SP PC:SP ...".
+    // The core dump stays in flash, so check the reset reason, otherwise an
+    // old crash is reported on every boot
+    static esp_core_dump_summary_t s;  // Big on RISC-V, keep it off the stack
+    esp_reset_reason_t rr = esp_reset_reason();
+    uint32_t *out = mg_health_record.data;
+    size_t n = 0, max = MG_HEALTH_DATA_SIZE;
+    if (rr != ESP_RST_PANIC && rr != ESP_RST_INT_WDT && rr != ESP_RST_TASK_WDT)
+      return;  // Not a crash that went through the panic handler
+    if (max == 0 || esp_core_dump_get_summary(&s) != ESP_OK) return;
+
+    mg_health_record.cpuid = 42;  // ESP32
+    mg_health_record.reset_reason = MG_HEALTH_RESET_FAULT;
+
+    memset(out, 0, sizeof(mg_health_record.data));
+    out[n++] = s.exc_pc;
+#if CONFIG_IDF_TARGET_ARCH_XTENSA
+    for (uint32_t i = 0; i < s.exc_bt_info.depth && n < max; i++) {
+      if (s.exc_bt_info.bt[i] != s.exc_pc) out[n++] = s.exc_bt_info.bt[i];
+    }
+#elif CONFIG_IDF_TARGET_ARCH_RISCV
+    // No unwinder: take the return address, then words on the stack that
+    // point into executable memory (a heuristic, may include stale values)
+    if (n < max) out[n++] = s.ex_info.ra;
+    for (uint32_t i = 0; i + 4 <= s.exc_bt_info.dump_size && n < max; i += 4) {
+      uint32_t w;
+      memcpy(&w, &s.exc_bt_info.stackdump[i], sizeof(w));  // Byte array
+      if (esp_ptr_executable((void *) (uintptr_t) w)) out[n++] = w;
+    }
+#endif
+  }
+#endif
+}
+
+static size_t print_uint32(void (*fn)(char, void *), void *arg, va_list *ap) {
+  size_t n = va_arg(*ap, size_t);
+  uint32_t *p = va_arg(*ap, uint32_t *);
+  size_t len = 0;
+  while (n--) len += mg_xprintf(fn, arg, "%s%lu", len == 0 ? "" : ",", *p++);
+  return len;
+}
+
+size_t mg_print_crash_record(void (*fn)(char, void *), void *arg, va_list *ap) {
+  size_t len = 0;
+  if (mg_health_valid() &&
+      mg_health_record.reset_reason == MG_HEALTH_RESET_FAULT) {
+    size_t n = sizeof(mg_health_record.data) / sizeof(mg_health_record.data[0]);
+    len += mg_xprintf(fn, arg, "{%m:%hhu,%m:%u,%m:[%M]}",            //
+                      MG_ESC("version"), mg_health_record.magic[3],  //
+                      MG_ESC("cpuid"), mg_health_record.cpuid,       //
+                      MG_ESC("data"), print_uint32, n, mg_health_record.data);
+  } else {
+    len += mg_xprintf(fn, arg, "{}");
+  }
+  (void) ap;
+  return len;
+}

src/health.h

@@ -1,37 +1,43 @@
 // Device health monitoring
-//
-// Keeps a small record in a RAM region that survives a warm reset, so a device
-// can tell why it restarted. The record holds a boot counter, the uptime this
-// boot has reached, and the reset reason reported by the hardware. A crash
-// loop, a hang loop and a marginal power supply each leave a different mark.
-//
-// Put MG_HEALTH_INIT() in main(), right after clock and memory init:
-//
-// ```c
-// int main(void) {
-//   hal_clock_init();
-//   MG_HEALTH_INIT();
-//   ...
-// }
-// ```
-//
-// The record must live in RAM that startup code neither copies nor zeroes.
-// See tutorials/stm32/nucleo-h723zg/minimal/link.ld for the .mg_health region,
-// and tutorials/stm32/nucleo-h723zg/minimal/mongoose_config.h for the
-// reset-reason hooks.
-//
-// On Cortex-M, a fault handler can record the crash: it sets reset_reason to
-// MG_HEALTH_RESET_FAULT and walks the stack into backtrace[]. See
-// tutorials/stm32/nucleo-h723zg/minimal/main.c for a sample HardFault_Handler.
 
 #pragma once
 
 #include "arch.h"
+#include "printf.h"
+
+// Memory usage in bytes. Override in mongoose_config.h for the target.
+#ifndef MG_HEALTH_STACK_USED
+#define MG_HEALTH_STACK_USED 0
+#endif
+
+#ifndef MG_HEALTH_STACK_TOTAL
+#define MG_HEALTH_STACK_TOTAL 0
+#endif
+
+#ifndef MG_HEALTH_HEAP_USED
+#define MG_HEALTH_HEAP_USED 0
+#endif
+
+#ifndef MG_HEALTH_HEAP_TOTAL
+#define MG_HEALTH_HEAP_TOTAL 0
+#endif
 
 #ifndef MG_HEALTH_MAGIC
 #define MG_HEALTH_MAGIC {'M', 'G', 'H', '3'}  // '3' is the layout version
 #endif
 
+#if !defined(MG_HEALTH_RAM) && (defined(STM32H7_DEV_ID) || defined(STM32H5))
+#define MG_HEALTH_RAM __attribute__((section(".mg_health")))
+#endif
+
+#if !defined(MG_HEALTH_DATA_SIZE) && (defined(STM32H7_DEV_ID) || defined(STM32H5))
+#define MG_HEALTH_DATA_SIZE 250
+#endif
+
+#ifndef MG_HEALTH_DATA_SIZE
+#define MG_HEALTH_DATA_SIZE 10
+#endif
+
 // Places the record in RAM that survives a reset. Define in mongoose_config.h
 // to match the linker script, e.g. __attribute__((section(".mg_health")))
 #ifndef MG_HEALTH_RAM
@@ -52,12 +58,11 @@ enum mg_health_reason {
   MG_HEALTH_RESET_FAULT         // Fault handler ran, see regs[] and saved_stack
 };
 
-#define MG_HEALTH_BACKTRACE 20  // Return addresses in mg_health::backtrace
-
 struct mg_health {
   char magic[4];          // MG_HEALTH_MAGIC when the record holds valid data
   uint32_t reset_reason;  // enum mg_health_reason that started this boot
-  uint32_t backtrace[MG_HEALTH_BACKTRACE];  // Crash backtrace, frame 0 first
+  uint32_t cpuid;         // ARM CPU ID
+  uint32_t data[MG_HEALTH_DATA_SIZE];
 };
 
 extern struct mg_health mg_health_record;  // Defined in health.c
@@ -88,34 +93,6 @@ static inline const char *mg_health_reason_str(int reason) {
   }
 }
 
-// Start a new boot: validate the record, count the boot, store the reset
-// reason. The current boot moves to prev_* slots first, so the previous
-// boot's uptime and reason stay readable. Called by MG_HEALTH_INIT()
-static inline void mg_health_init(void) {
-  char magic[] = MG_HEALTH_MAGIC;
-  // struct mg_health *h = mg_health_get();
-  if (!mg_health_valid()) {  // First boot, or RAM lost its contents
-    memset(&mg_health_record, 0, sizeof(mg_health_record));
-    memcpy(mg_health_record.magic, magic, sizeof(mg_health_record.magic));
-  }
-  // h->prev_uptime = h->uptime;
-  // h->prev_reason = h->reason;
-  // h->counter++;
-  // h->uptime = 0;
-  // h->reason = mg_health_decode_reason();
-  // MG_HEALTH_RESET_CLEAR();
-}
-
-// // Record that the main loop is still alive. Called from mg_mgr_poll(), so a
-// // hung application leaves uptime frozen at the hang
-// extern uint64_t mg_health_next_ms;  // Defined in health.c
-
-// static inline void mg_health_uptime(uint64_t now_ms) {
-//   struct mg_health *h = mg_health_get();
-//   if (now_ms >= mg_health_next_ms && mg_health_valid()) {
-//     mg_health_next_ms = now_ms + 1000;
-//     h->uptime++;
-//   }
-// }
-
 #define MG_HEALTH_INIT() mg_health_init()
+extern size_t mg_print_crash_record(mg_pfn_t, void *, va_list *);
+extern void mg_health_init(void);

src/http.c

@@ -3,7 +3,6 @@
 #include "fmt.h"
 #include "log.h"
 #include "net.h"
-#include "ota.h"
 #include "printf.h"
 #include "ssi.h"
 #include "util.h"
@@ -359,7 +358,7 @@ static void mg_http_vprintf_chunk(struct mg_connection *c, const char *fmt,
   if (c->send.len >= len + 10) {
     mg_snprintf((char *) c->send.buf + len, 9, "%08lx", c->send.len - len - 10);
     c->send.buf[len + 8] = '\r';
-    if (c->send.len == len + 10) c->is_resp = 0;  // Last chunk, reset marker
+    if (c->send.len == len + 10) c->pfn_data = NULL;  // Last chunk, done
   }
   if (!mg_send(c, "\r\n", 2)) mg_error(c, "OOM");
 }
@@ -374,7 +373,7 @@ void mg_http_printf_chunk(struct mg_connection *c, const char *fmt, ...) {
 void mg_http_write_chunk(struct mg_connection *c, const char *buf, size_t len) {
   mg_printf(c, "%lx\r\n", (unsigned long) len);
   if (!mg_send(c, buf, len) || !mg_send(c, "\r\n", 2)) mg_error(c, "OOM");
-  if (len == 0) c->is_resp = 0;
+  if (len == 0) c->pfn_data = NULL;  // Last chunk, response done
 }
 
 // clang-format off
@@ -463,15 +462,14 @@ void mg_http_reply(struct mg_connection *c, int code, const char *headers,
                            (unsigned long) (c->send.len - len));
     c->send.buf[len - 15 + n] = ' ';  // Change ending 0 to space
   }
-  c->is_resp = 0;
+  c->pfn_data = NULL;  // Response done
 }
 
 static void http_cb(struct mg_connection *, int, void *);
 static void restore_http_cb(struct mg_connection *c) {
   mg_fs_close((struct mg_fd *) c->pfn_data);
-  c->pfn_data = NULL;
+  c->pfn_data = NULL;  // Response done
   c->pfn = http_cb;
-  c->is_resp = 0;
 }
 
 char *mg_http_etag(char *buf, size_t len, size_t size, time_t mtime);
@@ -659,7 +657,7 @@ void mg_http_serve_file(struct mg_connection *c, struct mg_http_message *hm,
               etag, (uint64_t) cl, gzip ? "Content-Encoding: gzip\r\n" : "",
               range, hdrs);
     if (mg_strcasecmp(hm->method, mg_str("HEAD")) == 0 || c->is_closing) {
-      c->is_resp = 0;
+      c->pfn_data = NULL;  // Response done
       mg_fs_close(fd);
     } else {  // start serving static content only if not closing, see #3354
       // Track to-be-sent content length at the end of c->data, aligned
@@ -677,161 +675,97 @@ struct printdirentrydata {
   struct mg_http_message *hm;
   const struct mg_http_serve_opts *opts;
   const char *dir;
+  size_t count;
 };
 
-#if MG_ENABLE_DIRLIST
-// Print file name, escaping HTML chars
-static size_t html_esc(void (*fn)(char, void *), void *arg, va_list *ap) {
-  const char *s = va_arg(*ap, const char *);
-  size_t i, len = 0;
-  for (i = 0; s[i] != '\0'; i++) {
-    if (s[i] == '<') {
-      len += mg_xprintf(fn, arg, "%s", "&lt;");
-    } else if (s[i] == '>') {
-      len += mg_xprintf(fn, arg, "%s", "&gt;");
-    } else if (s[i] == '&') {
-      len += mg_xprintf(fn, arg, "%s", "&amp;");
-    } else {
-      len += mg_xprintf(fn, arg, "%c", s[i]);
-    }
-  }
-  return len;
-}
-
 static void printdirentry(const char *name, void *userdata) {
   struct printdirentrydata *d = (struct printdirentrydata *) userdata;
   struct mg_fs *fs = d->opts->fs == NULL ? &mg_fs_posix : d->opts->fs;
   size_t size = 0;
   time_t t = 0;
-  char path[MG_PATH_MAX], sz[40], mod[40];
+  char path[MG_PATH_MAX];
-  int flags, n = 0;
+  int flags;
 
-  // MG_DEBUG(("[%s] [%s]", d->dir, name));
+  if (mg_snprintf(path, sizeof(path), "%s%c%s", d->dir, '/', name) >=
-  if (mg_snprintf(path, sizeof(path), "%s%c%s", d->dir, '/', name) >
       sizeof(path)) {
     MG_ERROR(("%s truncated", name));
   } else if ((flags = fs->st(path, &size, &t)) == 0) {
     MG_ERROR(("%lu stat(%s)", d->c->id, path));
   } else {
-    const char *slash = flags & MG_FS_DIR ? "/" : "";
     if (flags & MG_FS_DIR) {
-      mg_snprintf(sz, sizeof(sz), "%s", "[DIR]");
+      mg_printf(d->c, "%s\n  {%m: %m, %m: true}", //
+                d->count == 0 ? "" : ",", //
+                MG_ESC("name"), MG_ESC(name), MG_ESC("dir"));
     } else {
-      mg_snprintf(sz, sizeof(sz), "%lld", (uint64_t) size);
+      mg_printf(d->c, "%s\n  {%m: %m, %m: %zu, %m: %llu, %m: false}", //
+                d->count == 0 ? "" : ",", //
+                MG_ESC("name"), MG_ESC(name), //
+                MG_ESC("size"), size, //
+                MG_ESC("modified"), (uint64_t) t, MG_ESC("dir"));
     }
-#if defined(MG_HTTP_DIRLIST_TIME_FMT)
+    d->count++;
-    {
-      char time_str[40];
-      struct tm *time_info = localtime(&t);
-      strftime(time_str, sizeof time_str, "%Y/%m/%d %H:%M:%S", time_info);
-      mg_snprintf(mod, sizeof(mod), "%s", time_str);
-    }
-#else
-    mg_snprintf(mod, sizeof(mod), "%lu", (unsigned long) t);
-#endif
-    n = (int) mg_url_encode(name, strlen(name), path, sizeof(path));
-    mg_printf(d->c,
-              "  <tr><td><a href=\"%.*s%s\">%M%s</a></td>"
-              "<td name=%lu>%s</td><td name=%lld>%s</td></tr>\n",
-              n, path, slash, html_esc, name, slash, (unsigned long) t, mod,
-              flags & MG_FS_DIR ? (int64_t) -1 : (int64_t) size, sz);
   }
 }
 
 static void listdir(struct mg_connection *c, struct mg_http_message *hm,
                     const struct mg_http_serve_opts *opts, char *dir) {
-  const char *sort_js_code =
-      "<script>function srt(tb, sc, so, d) {"
-      "var tr = Array.prototype.slice.call(tb.rows, 0),"
-      "tr = tr.sort(function (a, b) { var c1 = a.cells[sc], c2 = b.cells[sc],"
-      "n1 = c1.getAttribute('name'), n2 = c2.getAttribute('name'), "
-      "t1 = a.cells[2].getAttribute('name'), "
-      "t2 = b.cells[2].getAttribute('name'); "
-      "return so * (t1 < 0 && t2 >= 0 ? -1 : t2 < 0 && t1 >= 0 ? 1 : "
-      "n1 ? parseInt(n2) - parseInt(n1) : "
-      "c1.textContent.trim().localeCompare(c2.textContent.trim())); });";
-  const char *sort_js_code2 =
-      "for (var i = 0; i < tr.length; i++) tb.appendChild(tr[i]); "
-      "if (!d) window.location.hash = ('sc=' + sc + '&so=' + so); "
-      "};"
-      "window.onload = function() {"
-      "var tb = document.getElementById('tb');"
-      "var m = /sc=([012]).so=(1|-1)/.exec(window.location.hash) || [0, 2, 1];"
-      "var sc = m[1], so = m[2]; document.onclick = function(ev) { "
-      "var c = ev.target.rel; if (c) {if (c == sc) so *= -1; srt(tb, c, so); "
-      "sc = c; ev.preventDefault();}};"
-      "srt(tb, sc, so, true);"
-      "}"
-      "</script>";
   struct mg_fs *fs = opts->fs == NULL ? &mg_fs_posix : opts->fs;
-  struct printdirentrydata d = {c, hm, opts, dir};
+  struct printdirentrydata d = {c, hm, opts, dir, 0};
-  char tmp[10], buf[MG_PATH_MAX];
+  char tmp[10];
   size_t off, n;
-  int len = mg_url_decode(hm->uri.buf, hm->uri.len, buf, sizeof(buf), 0);
-  struct mg_str uri = len > 0 ? mg_str_n(buf, (size_t) len) : hm->uri;
-
   mg_printf(c,
-            "HTTP/1.1 200 OK\r\n"
+      "HTTP/1.1 200 OK\r\n"
-            "Content-Type: text/html; charset=utf-8\r\n"
+      "Content-Type: application/json; charset=utf-8\r\n"
-            "%s"
+      "%s"
-            "Content-Length:         \r\n\r\n",
+      "Content-Length:         \r\n\r\n",
-            opts->extra_headers == NULL ? "" : opts->extra_headers);
+      opts->extra_headers == NULL ? "" : opts->extra_headers);
   off = c->send.len;  // Start of body
-  mg_printf(c,
+  mg_printf(c, "[");
-            "<!DOCTYPE html><html><head><title>Index of %M</title>%s%s"
-            "<style>th,td {text-align: left; padding-right: 1em; "
-            "font-family: monospace; }</style></head>"
-            "<body><h1>Index of %M</h1><table cellpadding=\"0\"><thead>"
-            "<tr><th><a href=\"#\" rel=\"0\">Name</a></th><th>"
-            "<a href=\"#\" rel=\"1\">Modified</a></th>"
-            "<th><a href=\"#\" rel=\"2\">Size</a></th></tr>"
-            "<tr><td colspan=\"3\"><hr></td></tr>"
-            "</thead>"
-            "<tbody id=\"tb\">\n",
-            mg_print_html_esc, (int) uri.len, uri.buf, sort_js_code, sort_js_code2,
-            mg_print_html_esc, (int) uri.len, uri.buf);
-  mg_printf(c, "%s",
-            "  <tr><td><a href=\"..\">..</a></td>"
-            "<td name=-1></td><td name=-1>[DIR]</td></tr>\n");
   fs->ls(dir, printdirentry, &d);
-  mg_printf(c,
+  mg_printf(c, "\n]\n");
-            "</tbody><tfoot><tr><td colspan=\"3\"><hr></td></tr></tfoot>"
-            "</table><address>Mongoose v.%s</address></body></html>\n",
-            MG_VERSION);
   n = mg_snprintf(tmp, sizeof(tmp), "%lu", (unsigned long) (c->send.len - off));
   if (n > sizeof(tmp)) n = 0;
   memcpy(c->send.buf + off - 12, tmp, n);  // Set content length
-  c->is_resp = 0;                          // Mark response end
+  c->pfn_data = NULL;                      // Response done
+}
+
+// Map requested URI to the file path (buf,len). Use root directory r.
+// r could be a path optionally followed by map: PATH,/PREFIX1=PATH1,...
+static bool uri2path(const char *r, struct mg_str uri, char *buf, size_t len) {
+  struct mg_str k, v, part, s = mg_str(r), u = {NULL, 0}, d = u;
+  size_t n;
+  while (mg_span(s, &part, &s, ',')) {
+    if (!mg_span(part, &k, &v, '=')) k = part, v = mg_str_n(NULL, 0);
+    if (v.len == 0) v = k, k = mg_str("/"), u = k, d = v;
+    if (uri.len < k.len) continue;
+    if (mg_strcmp(k, mg_str_n(uri.buf, k.len)) != 0) continue;
+    u = k, d = v;
+  }
+  n = mg_snprintf(buf, len, "%.*s", (int) d.len, d.buf);
+  if (len == 0 || n + 2 >= len) return false;  // Path overflow
+  if (n > 0 && buf[n - 1] != '/') buf[n++] = '/', buf[n] = '\0';  // Add slash
+  if (mg_url_decode(uri.buf + u.len, uri.len - u.len, buf + n, len - n, 0) < 0) {
+    return false;
+  }
+  buf[len - 1] = '\0';  // Double-check
+  n = strlen(buf);
+  if (!mg_path_is_sane(mg_str_n(buf, n))) return false;
+  while (n > 1 && buf[n - 1] == '/') buf[--n] = 0;  // Trim trailing slashes
+  return true;
 }
-#endif
 
 // Resolve requested file into `path` and return its fs->st() result
-static int uri_to_path2(struct mg_connection *c, struct mg_http_message *hm,
+static int uri_to_file_status(struct mg_connection *c,
-                        struct mg_fs *fs, struct mg_str url, struct mg_str dir,
+                              struct mg_http_message *hm,
-                        char *path, size_t path_size) {
+                              struct mg_fs *fs, const char *root_dir,
+                              char *path, size_t path_size) {
   int flags, tmp;
-  // Append URI to the root_dir, and sanitize it
+  size_t n;
-  size_t n = mg_snprintf(path, path_size, "%.*s", (int) dir.len, dir.buf);
+  if (!uri2path(root_dir, hm->uri, path, path_size)) {
-  if (n + 2 >= path_size) {
-    mg_http_reply(c, 400, "", "Exceeded path size");
-    return -1;
-  }
-  path[path_size - 1] = '\0';
-  // Terminate root dir with slash
-  if (n > 0 && path[n - 1] != '/') path[n++] = '/', path[n] = '\0';
-  if (url.len < hm->uri.len &&
-      mg_url_decode(hm->uri.buf + url.len, hm->uri.len - url.len, path + n,
-                    path_size - n, 0) < 0) {
     mg_http_reply(c, 400, "", "Invalid path");
     return -1;
   }
-  path[path_size - 1] = '\0';  // Double-check
   n = strlen(path);
-  if (!mg_path_is_sane(mg_str_n(path, n))) {
-    mg_http_reply(c, 400, "", "Invalid path");
-    return -1;
-  }
-  while (n > 1 && path[n - 1] == '/') path[--n] = 0;  // Trim trailing slashes
   flags = mg_strcmp(hm->uri, mg_str("/")) == 0 ? MG_FS_DIR
                                                : fs->st(path, NULL, NULL);
   MG_VERBOSE(("%lu %.*s -> %s %d", c->id, (int) hm->uri.len, hm->uri.buf, path,
@@ -846,7 +780,7 @@ static int uri_to_path2(struct mg_connection *c, struct mg_http_message *hm,
               "Content-Length: 0\r\n"
               "\r\n",
               (int) hm->uri.len, hm->uri.buf);
-    c->is_resp = 0;
+    c->pfn_data = NULL;  // Response done
     flags = -1;
   } else if (flags & MG_FS_DIR) {
     if (((mg_snprintf(path + n, path_size - n, "/" MG_HTTP_INDEX) > 0 &&
@@ -868,34 +802,36 @@ static int uri_to_path2(struct mg_connection *c, struct mg_http_message *hm,
   return flags;
 }
 
-static int uri_to_path(struct mg_connection *c, struct mg_http_message *hm,
-                       const struct mg_http_serve_opts *opts, char *path,
-                       size_t path_size) {
-  struct mg_fs *fs = opts->fs == NULL ? &mg_fs_posix : opts->fs;
-  struct mg_str k, v, part, s = mg_str(opts->root_dir), u = {NULL, 0}, p = u;
-  while (mg_span(s, &part, &s, ',')) {
-    if (!mg_span(part, &k, &v, '=')) k = part, v = mg_str_n(NULL, 0);
-    if (v.len == 0) v = k, k = mg_str("/"), u = k, p = v;
-    if (hm->uri.len < k.len) continue;
-    if (mg_strcmp(k, mg_str_n(hm->uri.buf, k.len)) != 0) continue;
-    u = k, p = v;
-  }
-  return uri_to_path2(c, hm, fs, u, p, path, path_size);
-}
-
 void mg_http_serve_dir(struct mg_connection *c, struct mg_http_message *hm,
                        const struct mg_http_serve_opts *opts) {
   char path[MG_PATH_MAX];
+  struct mg_fs *fs = opts->fs == NULL ? &mg_fs_posix : opts->fs;
   const char *sp = opts->ssi_pattern;
-  int flags = uri_to_path(c, hm, opts, path, sizeof(path));
+  int flags = uri_to_file_status(c, hm, fs, opts->root_dir, path, sizeof(path));
   if (flags < 0) {
-    // Do nothing: the response has already been sent by uri_to_path()
+    // Do nothing: the response has already been sent by uri_to_file_status()
   } else if (flags & MG_FS_DIR) {
-#if MG_ENABLE_DIRLIST
+    if (opts->enable_dir_listing) {
-    listdir(c, hm, opts, path);
+      listdir(c, hm, opts, path);
-#else
+    } else {
-    mg_http_reply(c, 403, "", "Forbidden\n");
+      mg_http_reply(c, 403, "", "Forbidden\n");
-#endif
+    }
+  } else if (opts->enable_delete &&
+            mg_strcasecmp(hm->method, mg_str("DELETE")) == 0) {
+    mg_http_reply(c, flags && fs->rm(path) ? 200 : 404, "", "");
+  } else if (opts->enable_upload &&
+            (mg_strcasecmp(hm->method, mg_str("POST")) == 0 ||
+             mg_strcasecmp(hm->method, mg_str("PUT")) == 0)) {
+    // Small or already fully buffered body. mg_http_serve_upload() handles
+    // the same thing without buffering, for big uploads, from MG_EV_HTTP_HDRS
+    void *fd;
+    bool ok = false;
+    fs->rm(path);  // MG_FS_WRITE appends, not truncates: drop any old file
+    if ((fd = fs->op(path, MG_FS_WRITE)) != NULL) {
+      ok = fs->wr(fd, hm->body.buf, hm->body.len) == hm->body.len;
+      fs->cl(fd);
+    }
+    mg_http_reply(c, ok ? 200 : 500, "", "");
   } else if (flags && sp != NULL && mg_match(mg_str(path), mg_str(sp), NULL)) {
     mg_http_serve_ssi(c, opts->root_dir, path);
   } else {
@@ -903,6 +839,52 @@ void mg_http_serve_dir(struct mg_connection *c, struct mg_http_message *hm,
   }
 }
 
+// mg_http_stream_body() callback for mg_http_serve_upload(). The file is
+// opened by the caller before streaming starts, so this only writes and closes
+static bool serve_upload_cb(struct mg_http_message *hm, struct mg_str *data,
+                            void **p) {
+  struct mg_fd *fd = (struct mg_fd *) *p;
+  if (hm != NULL) return fd != NULL;  // Start
+  if (data != NULL) {                 // Next chunk
+    return fd != NULL && fd->fs->wr(fd->fd, data->buf, data->len) == data->len;
+  }
+  if (fd != NULL) mg_fs_close(fd);  // End
+  *p = NULL;
+  return true;
+}
+
+// Starts a streaming upload for a big POST/PUT body, so it never sits fully
+// buffered in memory. Companion to mg_http_serve_dir(): call this from
+// MG_EV_HTTP_HDRS, and keep calling mg_http_serve_dir() from MG_EV_HTTP_MSG
+// as before - it handles uploads too, for bodies this function skips.
+// Does nothing unless opts->enable_upload is set, the method is POST or PUT,
+// and Content-Length is known and >= 2 * MG_IO_SIZE.
+void mg_http_serve_upload(struct mg_connection *c, struct mg_http_message *hm,
+                          const struct mg_http_serve_opts *opts) {
+  char path[MG_PATH_MAX];
+  struct mg_fs *fs = opts->fs == NULL ? &mg_fs_posix : opts->fs;
+  if (!opts->enable_upload) {
+    // Not enabled, nothing to do
+  } else if (mg_strcasecmp(hm->method, mg_str("POST")) != 0 &&
+            mg_strcasecmp(hm->method, mg_str("PUT")) != 0) {
+    // Not an upload request, nothing to do
+  } else if (hm->body.len == (size_t) ~0 || hm->body.len < 2 * MG_IO_SIZE) {
+    // Unknown length, or small enough for mg_http_serve_dir() to buffer it
+  } else if (!uri2path(opts->root_dir, hm->uri, path, sizeof(path))) {
+    MG_ERROR(("Invalid upload path: %.*s", (int) hm->uri.len, hm->uri.buf));
+  } else if (fs->st(path, NULL, NULL) & MG_FS_DIR) {
+    // Target is a directory, let mg_http_serve_dir() list it
+  } else {
+    struct mg_fd *fd;
+    fs->rm(path);  // MG_FS_WRITE appends, not truncates: drop any old file
+    if ((fd = mg_fs_open(fs, path, MG_FS_WRITE)) == NULL) {
+      MG_ERROR(("Cannot open %s for upload", path));
+    } else if (!mg_http_stream_body(c, hm, serve_upload_cb, fd)) {
+      mg_fs_close(fd);
+    }
+  }
+}
+
 static bool mg_is_url_safe(int c) {
   return (c >= '0' && c <= '9') || (c >= 'a' && c <= 'z') ||
          (c >= 'A' && c <= 'Z') || c == '.' || c == '_' || c == '-' || c == '~';
@@ -1025,137 +1007,96 @@ int mg_http_status(const struct mg_http_message *hm) {
   return atoi(hm->uri.buf);
 }
 
-struct mg_upload_priv {
+// State of a streamed request or response body, kept in c->data. The callback
-  size_t expected;
+// is kept in c->fn_data, which is free because we own the connection
-  size_t received;
+struct mg_upload_state {
-  struct mg_fd *fd;  // non-NULL: file upload; NULL: OTA
+  size_t expected;  // Number of body bytes to receive
-  void (*fn)(struct mg_connection *, const char *);
+  size_t received;  // Number of body bytes received so far
+  void *user_data;  // Passed to cb, free for cb to use
+  bool failed;      // Set when cb returned false
 };
 
-static void mg_upload_handler(struct mg_connection *c, int ev, void *ev_data) {
+// Event handler installed by mg_http_stream_body(). Feeds the body to the
-  struct mg_upload_priv *p = (struct mg_upload_priv *) c->data;
+// callback, then replies (servers only). It does not restore the previous
-  if (p->fn == NULL) return;
+// handler: the connection is closed after the reply.
-  if (ev == MG_EV_READ && c->recv.len > 0) {
+static void mg_stream_handler(struct mg_connection *c, int ev, void *ev_data) {
-    size_t alignment = 512;
+  struct mg_upload_state *us = (struct mg_upload_state *) c->data;
-    size_t left = p->expected > p->received ? p->expected - p->received : 0;
+    bool (*fn)(struct mg_http_message *, struct mg_str *, void **) =
-    size_t aligned = c->recv.len < left ? MG_ROUND_DOWN(c->recv.len, alignment)
+      (bool (*)(struct mg_http_message *, struct mg_str *, void **))
-                                        : left;
+      (ptrdiff_t) c->fn_data;
-    bool ok = true;
-    if (aligned > 0) {
-      if (p->fd != NULL) {
-        ok = p->fd->fs->wr(p->fd->fd, c->recv.buf, aligned) == aligned;
-      } else {
-        ok = mg_ota_write(c->recv.buf, aligned);
-      }
-    }
-    p->received += aligned;
-    mg_iobuf_del(&c->recv, 0, aligned);
-    if (!ok) {
-      if (p->fd != NULL) { mg_fs_close(p->fd); p->fd = NULL; }
-      else mg_ota_end();
-      p->fn(c, "write error");
-      mg_free(c->pfn_data); c->pfn_data = NULL; p->fn = NULL;
-    } else if (p->received >= p->expected) {
-      const char *errmsg = NULL;
-      if (p->fd != NULL) { mg_fs_close(p->fd); p->fd = NULL; }
-      else if (!mg_ota_end()) errmsg = "OTA finalize failed";
-      p->fn(c, errmsg);
-      mg_free(c->pfn_data); c->pfn_data = NULL; p->fn = NULL;
-    }
-  } else if (ev == MG_EV_ERROR || ev == MG_EV_CLOSE) {
-    if (p->fd != NULL) { mg_fs_close(p->fd); p->fd = NULL; }
-    else mg_ota_end();
-    p->fn(c, ev == MG_EV_ERROR ? (const char *) ev_data : "connection closed");
-    mg_free(c->pfn_data); c->pfn_data = NULL; p->fn = NULL;
-  }
   (void) ev_data;
+  if (ev == MG_EV_CLOSE || ev == MG_EV_ERROR) {
+    if (us->received < us->expected) {
+      // Connection dropped mid-upload. Let cb clean up, e.g. call mg_ota_end()
+      us->received = us->expected;  // MG_EV_ERROR is followed by MG_EV_CLOSE
+      fn(NULL, NULL, &us->user_data);
+    }
+  } else if (ev == MG_EV_READ && !c->is_draining) {
+    if (c->recv.len > 0 && us->received < us->expected) {
+      // Got some uploaded data. Feed by 512-byte aligned chunks, for OTA
+      size_t left = us->expected - us->received, r = c->recv.len;
+      size_t aligned = r < left ? MG_ROUND_DOWN(r, 512) : left;
+      struct mg_str data = mg_str_n((char *) c->recv.buf, aligned);
+      if (data.len > 0 && !us->failed) {
+        us->failed = !fn(NULL, &data, &us->user_data);
+      }
+      us->received += aligned;
+      mg_iobuf_del(&c->recv, 0, aligned);  // Shift the unprocessed tail
+    }
+    if (us->received >= us->expected) {
+      // Finished upload. Always call cb, even after error, so it can clean up
+      us->failed |= !fn(NULL, NULL, &us->user_data);
+      if (!c->is_client) {
+        mg_http_reply(c, us->failed ? 500 : 200, NULL, "%zu %s\n",
+                      us->received, us->failed ? "fail" : "ok");
+      }
+      c->is_draining = 1;
+    }
+  }
 }
 
-static void mg_upload_default_cb(struct mg_connection *c, const char *status) {
+bool mg_http_stream_body(struct mg_connection *c, struct mg_http_message *hm,
-  MG_INFO(("%lu %s", c->id, status ? status : "ok"));
+                         bool (*cb)(struct mg_http_message *, struct mg_str *,
-  mg_http_reply(c, status ? 500 : 200, "", "%s\n", status ? status : "ok");
+                                    void **user_data),
-}
+                         void *user_data) {
+  struct mg_upload_state *us = (struct mg_upload_state *) c->data;
+  struct mg_str *te = mg_http_get_header(hm, "Transfer-Encoding");
+  bool handled = false;
 
-void mg_http_start_upload(struct mg_connection *c, struct mg_http_message *hm,
+  // Catch upload requests early, without buffering whole body. Called on the
-                          struct mg_str name, struct mg_str dir,
+  // MG_EV_HTTP_HDRS event: we've received all HTTP headers but not necessarily
-                          struct mg_fs *fs,
+  // the full HTTP body
-                          void (*fn)(struct mg_connection *, const char *)) {
+  if (hm->body.len == (size_t) ~0 ||
-  struct mg_upload_priv *p = (struct mg_upload_priv *) c->data;
+      (te != NULL && mg_strcasecmp(*te, mg_str("chunked")) == 0)) {
-  char path[MG_PATH_MAX];
+    // Unknown length or chunked, cannot stream. Leave it to the caller
-  struct mg_fd *fd;
+  } else if (!c->is_client &&
-  if (fn == NULL) fn = mg_upload_default_cb;
+             mg_strcmp(hm->method, mg_str("POST")) != 0 &&
-  if (sizeof(*p) > sizeof(c->data)) { fn(c, "data too small"); return; }
+             mg_strcmp(hm->method, mg_str("PUT")) != 0) {
-  if (!mg_path_is_sane(name)) { fn(c, "bad name"); return; }
+    // Not an upload request. Leave it to the caller
-  mg_snprintf(path, sizeof(path), "%.*s%c%.*s", (int) dir.len, dir.buf,
+  } else if (sizeof(*us) > sizeof(c->data)) {
-              MG_DIRSEP, (int) name.len, name.buf);
+    if (!c->is_client) {  // Nobody to reply to on a client connection
-  fd = mg_fs_open(fs, path, MG_FS_WRITE);
+      c->pfn = NULL;
-  if (fd == NULL) { fn(c, "open failed"); return; }
+      mg_http_reply(c, 500, NULL, "data too small\n");
-  p->expected = hm->body.len;
+      c->is_draining = 1;
-  p->received = 0;
+      cb(NULL, NULL, &user_data);  // Let cb release user_data, start skipped
-  p->fd = fd;
+      handled = true;
-  p->fn = fn;
+    }
-  c->fn = mg_upload_handler;
+  } else {
-  c->pfn_data = strdup(path);
+    c->pfn = NULL;  // Silence HTTP protocol handler
-  c->pfn = NULL;
+    memset(us, 0, sizeof(*us));
-  mg_iobuf_del(&c->recv, 0, hm->head.len);
+    us->expected = hm->body.len;  // Store number of bytes we expect
-  mg_call(c, MG_EV_READ, &c->recv.len);
+    us->user_data = user_data;
-}
+    us->failed = !cb(hm, NULL, &us->user_data);  // Call before deleting headers
-
-void mg_http_start_ota(struct mg_connection *c, struct mg_http_message *hm,
-                       void (*fn)(struct mg_connection *, const char *)) {
-  struct mg_upload_priv *p = (struct mg_upload_priv *) c->data;
-  if (fn == NULL) fn = mg_upload_default_cb;
-  if (sizeof(*p) > sizeof(c->data)) { fn(c, "data too small"); return; }
-  if (!mg_ota_begin(hm->body.len)) { fn(c, "ota begin failed"); return; }
-  p->expected = hm->body.len;
-  p->received = 0;
-  p->fd = NULL;
-  p->fn = fn;
-  c->fn = mg_upload_handler;
-  c->pfn = NULL;
-  mg_iobuf_del(&c->recv, 0, hm->head.len);
-  mg_call(c, MG_EV_READ, &c->recv.len);
-}
-
-void mg_http_stream_body(struct mg_connection *c, int ev, void *ev_data,
-                         struct mg_str uri_pattern,
-                         void (*cb)(struct mg_http_message *, struct mg_str *,
-                                    void **user_data)) {
-  struct mg_http_message *hm = (struct mg_http_message *) ev_data;
-
-  // Catch upload requests early, without buffering whole body
-  // When we receive MG_EV_HTTP_HDRS event, that means we've received all
-  // HTTP headers but not necessarily full HTTP body
-  if (ev == MG_EV_HTTP_HDRS &&
-      (mg_strcmp(hm->method, mg_str("POST")) == 0 ||
-       mg_strcmp(hm->method, mg_str("PUT")) == 0) &&
-      hm->body.len != (size_t) ~0 && mg_match(hm->uri, uri_pattern, NULL)) {
-    c->pfn = NULL;  // Silence HTTP protocol handler, we'll use MG_EV_READ
-    c->pfn_data = (void *) (ptrdiff_t) hm->body.len;  // Record expected len
-    cb(hm, NULL, &c->fn_data);  // Call handler before deleting headers
     if (mg_http_get_header(hm, "Expect") != NULL) {
       mg_http_reply(c, 100, NULL, "");  // If curl expects, we continue
     }
     mg_iobuf_del(&c->recv, 0, hm->head.len);  // Delete HTTP headers
+    c->fn = mg_stream_handler;                // We own the connection from now
+    c->fn_data = (void *) (ptrdiff_t) cb;
+    mg_call(c, MG_EV_READ, &c->recv.len);  // Process the body bytes we have
+    handled = true;
   }
-
+  return handled;
-  if (c->pfn == NULL && ev != MG_EV_OPEN) {
-    if (c->pfn_data != NULL && c->recv.len > 0) {
-      // Got some uploaded data. Feed by 512-byte aligned chunks, for OTA
-      size_t left = (size_t) (ptrdiff_t) c->pfn_data, r = c->recv.len;
-      size_t aligned = r < left ? MG_ROUND_DOWN(r, 512) : left;
-      struct mg_str data = mg_str_n((char *) c->recv.buf, aligned);
-      if (data.len) cb(NULL, &data, &c->fn_data);
-      c->pfn_data = (void *) (ptrdiff_t) (left - aligned);
-      c->recv.len -= aligned;
-    }
-    if (c->pfn_data == NULL && c->is_draining == 0) {
-      // Finished upload
-      mg_http_reply(c, 200, NULL, "ok\n");
-      c->is_draining = 1;
-      cb(NULL, NULL, &c->fn_data);
-    }
-  }
 }
 
 static bool is_hex_digit(int c) {
@@ -1184,7 +1125,9 @@ static void http_cb(struct mg_connection *c, int ev, void *ev_data) {
        c->recv.len > 0)) {  // see #2796
     struct mg_http_message hm;
     size_t ofs = 0;  // Parsing offset
-    while (c->is_resp == 0 && ofs < c->recv.len) {
+    // c->pfn_data is the "response generation in progress" marker. While it
+    // is set, don't parse the next pipelined request, to keep responses in order
+    while (c->pfn_data == NULL && ofs < c->recv.len) {
       const char *buf = (char *) c->recv.buf + ofs;
       int n = mg_http_parse(buf, c->recv.len - ofs, &hm);
       struct mg_str *te;  // Transfer - encoding header
@@ -1277,9 +1220,9 @@ static void http_cb(struct mg_connection *c, int ev, void *ev_data) {
         ofs += (size_t) n + hm.body.len;
       }
 
-      if (c->is_accepted) c->is_resp = 1;  // Start generating response
+      if (c->is_accepted) c->pfn_data = c;  // Response started
-      mg_call(c, MG_EV_HTTP_MSG, &hm);     // User handler can clear is_resp
+      mg_call(c, MG_EV_HTTP_MSG, &hm);  // Handler sets pfn_data NULL when done
-      if (c->is_accepted && !c->is_resp) {
+      if (c->is_accepted && c->pfn_data == NULL) {
         struct mg_str *cc = mg_http_get_header(&hm, "Connection");
         if (cc != NULL && mg_strcasecmp(*cc, mg_str("close")) == 0) {
           c->is_draining = 1;  // honor "Connection: close"

src/http.h

@@ -32,6 +32,9 @@ struct mg_http_serve_opts {
   const char *mime_types;     // Additional MIME types: "ext1=type1,ext2=type2". NULL for defaults only
   const char *page404;        // Path to a custom 404 page, e.g. "/404.html". NULL for built-in
   struct mg_fs *fs;           // Filesystem to use. NULL defaults to POSIX
+  bool enable_delete;         // Allow to DELETE files
+  bool enable_upload;         // Allow to POST/PUT files
+  bool enable_dir_listing;    // Enable directory listing
 };
 
 // A single part of a multipart/form-data body, filled by mg_http_next_multipart().
@@ -105,8 +108,11 @@ struct mg_connection *mg_http_connect(struct mg_mgr *, const char *url,
 //   mg_http_listen(), mg_http_serve_file(), mg_http_reply(), mg_match()
 // Notes:
 //   Call from an MG_EV_HTTP_MSG handler. The uri in hm is mapped under
-//   opts->root_dir. Directory listing depends on MG_ENABLE_DIRLIST; SSI uses
+//   opts->root_dir. opts->enable_dir_listing enables directory listing; SSI
-//   opts->ssi_pattern when configured.
+//   uses opts->ssi_pattern when configured. opts->enable_delete enables
+//   DELETE; opts->enable_upload enables POST/PUT, writing the whole body to
+//   a file - see mg_http_serve_upload() to also stream big uploads without
+//   buffering.
 void mg_http_serve_dir(struct mg_connection *, struct mg_http_message *hm,
                        const struct mg_http_serve_opts *);
 
@@ -114,6 +120,15 @@ void mg_http_serve_dir(struct mg_connection *, struct mg_http_message *hm,
 void mg_http_serve_file(struct mg_connection *, struct mg_http_message *hm,
                         const char *path, const struct mg_http_serve_opts *);
 
+// Streams a big POST/PUT upload straight to a file, instead of buffering the
+// whole body. Optional companion to mg_http_serve_dir(): call this from
+// MG_EV_HTTP_HDRS with the same opts, and keep calling mg_http_serve_dir()
+// from MG_EV_HTTP_MSG as usual - it still handles uploads this function skips.
+// Does nothing unless opts->enable_upload is set, the method is POST or PUT,
+// and Content-Length is known and big enough.
+void mg_http_serve_upload(struct mg_connection *, struct mg_http_message *hm,
+                          const struct mg_http_serve_opts *);
+
 // Sends a complete HTTP response with Content-Length.
 //
 // Example:
@@ -160,20 +175,6 @@ void mg_http_creds(struct mg_http_message *, char *, size_t, char *, size_t);
 long mg_http_upload(struct mg_connection *c, struct mg_http_message *hm,
                     struct mg_fs *fs, const char *dir, size_t max_size);
 
-// Streams the raw request body into dir/name via fs. Non-blocking: installs an
-// internal handler and returns immediately. fn is called with NULL on success
-// or an error string on failure.
-void mg_http_start_upload(struct mg_connection *c, struct mg_http_message *hm,
-                          struct mg_str name, struct mg_str dir,
-                          struct mg_fs *fs,
-                          void (*fn)(struct mg_connection *, const char *));
-
-// Starts an OTA firmware update from an HTTP POST upload.
-// Calls mg_ota_begin/write/end internally; fn is called with NULL on success,
-// or an error string on failure.
-void mg_http_start_ota(struct mg_connection *c, struct mg_http_message *hm,
-                       void (*fn)(struct mg_connection *, const char *));
-
 // Sends a 401 Unauthorized response with a Basic Auth WWW-Authenticate challenge.
 void mg_http_bauth(struct mg_connection *, const char *user, const char *pass);
 
@@ -192,7 +193,7 @@ struct mg_str mg_http_get_header_var(struct mg_str s, struct mg_str v);
 // Full examples:
 //   tutorials/http/file-upload-html-form, tutorials/http/http-server
 // Related APIs:
-//   mg_http_listen(), mg_http_start_upload()
+//   mg_http_listen(), mg_http_stream_body()
 // Notes:
 //   Call from an MG_EV_HTTP_MSG handler after the full request body is
 //   received. part.name, part.filename, and part.body are zero-copy slices into
@@ -203,24 +204,30 @@ size_t mg_http_next_multipart(struct mg_str, size_t, struct mg_http_part *);
 int mg_http_status(const struct mg_http_message *hm);
 
 // Streams a POST/PUT body to a callback as it arrives, without buffering it.
-// Call it from your connection handler on every event.
+// Call it from an MG_EV_HTTP_HDRS handler, after matching the request, e.g.
+// with mg_match(). Returns true if it took over the connection, false if the
+// request is not POST/PUT, is chunked, or has no Content-Length.
 //
 // Callback upload_fn(hm, data, user_data) is called:
-//   - at start: hm is set, data is NULL. Open the file, set user_data.
+//   - at start: hm is set. Open the file, set *user_data.
-//   - per chunk: hm is NULL, data is set. Chunks are 512 bytes aligned
+//   - per chunk: data is set, 512 byte aligned except the last. Not called
-//     except the last one.
+//     again after a failure.
-//   - at end: both NULL. Close the file.
+//   - at end: both NULL. Always called once, also when the connection drops
-// After the last chunk, "200 ok" is sent and the connection is drained.
+//     early, so release resources here. A truncated body looks like a complete
+//     one: validate before committing.
+// Return true on success, false on error.
 // Example:
-//   mg_http_stream_body(c, ev, ev_data, mg_str("/fs/*"), upload);
+//   if (ev == MG_EV_HTTP_HDRS && mg_match(hm->uri, mg_str("/fs/*"), NULL) {
+//     mg_http_stream_body(c, hm, upload, NULL));
+//   }
 // Full example:
 //   tutorials/http/file-upload-single-post
 // Related APIs:
-//   mg_http_start_upload(), mg_http_start_ota()
+//   mg_http_listen(), mg_http_next_multipart()
 // Notes:
-//   Requires Content-Length, chunked bodies are not streamed. user_data is
+//   After it returns true, this function hijacks the connection. Existing event
-//   &c->fn_data. While streaming, c->pfn is NULL
+//   handler not called, hm is invalid, c->data and c->fn_data are modified
-void mg_http_stream_body(struct mg_connection *c, int ev, void *ev_data,
+bool mg_http_stream_body(struct mg_connection *c, struct mg_http_message *hm,
-                         struct mg_str uri_pattern,
+                         bool (*upload_fn)(struct mg_http_message *,
-                         void (*upload_fn)(struct mg_http_message *,
+                                           struct mg_str *, void **user_data),
-                                           struct mg_str *, void **user_data));
+                         void *user_data);

src/jwt.c

@@ -7,7 +7,7 @@
 #include "util.h"
 
 #if MG_TLS == MG_TLS_BUILTIN
-#include "tls_uecc.h"
+#include "tls_p256.h"
 #endif
 
 static size_t jwt_split(struct mg_str jwt, struct mg_str *h, struct mg_str *p,
@@ -95,39 +95,14 @@ size_t mg_jwt_verify_hs256(struct mg_str jwt, const struct mg_jwt_opts *opts,
 }
 
 #if MG_TLS == MG_TLS_BUILTIN
-typedef struct {
-  MG_UECC_HashContext uECC;
-  mg_sha256_ctx sha256;
-} jwt_hash_ctx;
-
-static void jwt_hash_init(const MG_UECC_HashContext *ctx) {
-  jwt_hash_ctx *c = (jwt_hash_ctx *) ctx;
-  mg_sha256_init(&c->sha256);
-}
-
-static void jwt_hash_update(const MG_UECC_HashContext *ctx, const uint8_t *msg,
-                            unsigned len) {
-  jwt_hash_ctx *c = (jwt_hash_ctx *) ctx;
-  mg_sha256_update(&c->sha256, msg, len);
-}
-
-static void jwt_hash_finish(const MG_UECC_HashContext *ctx, uint8_t *hash) {
-  jwt_hash_ctx *c = (jwt_hash_ctx *) ctx;
-  mg_sha256_final(hash, &c->sha256);
-}
-
 size_t mg_jwt_sign_es256(const struct mg_jwt_opts *opts, char *buf,
                          size_t len) {
-  uint8_t hash[32], sig[64], tmp[2 * 32 + 64];
+  uint8_t hash[32], sig[64];
-  jwt_hash_ctx ctx = {
-      {jwt_hash_init, jwt_hash_update, jwt_hash_finish, 64, 32, tmp},
-      {{0}, 0, 0, {0}}};
   size_t n = jwt_header_payload("ES256", opts, buf, len);
   size_t m;
   if (n == 0 || n + 1 >= len) return 0;
   mg_sha256(hash, (uint8_t *) buf, n);
-  if (mg_uecc_sign_deterministic(opts->private_key, hash, sizeof(hash),
+  if (mg_p256_sign(opts->private_key, hash, sizeof(hash), sig) != 1)
-                                 &ctx.uECC, sig, mg_uecc_secp256r1()) != 1)
     return 0;
   buf[n++] = '.';
   m = mg_base64url_encode(sig, sizeof(sig), buf + n, len - n);
@@ -143,8 +118,7 @@ size_t mg_jwt_verify_es256(struct mg_str jwt, const struct mg_jwt_opts *opts,
   if (mg_base64url_decode(s.buf, s.len, (char *) sig, sizeof(sig)) != 64)
     return 0;
   mg_sha256(hash, (uint8_t *) jwt.buf, n);
-  if (mg_uecc_verify(opts->public_key, hash, sizeof(hash), sig,
+  if (mg_p256_verify(opts->public_key, hash, sizeof(hash), sig) != 1)
-                     mg_uecc_secp256r1()) != 1)
     return 0;
   return mg_base64url_decode(p.buf, p.len, buf, len);
 }

src/lfs.c

@@ -3,19 +3,18 @@
 
 #include "flash.h"
 #include "util.h"
+#include "lfs.h"
 
 #if MG_ENABLE_LFS
 
-#include <fcntl.h>
-#include <littlefs/lfs.h>
-#include <string.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-
 #ifndef LFS_USE_RAM
 #define LFS_USE_RAM 0  // If 1, use RAM FS. If 0, use flash
 #endif
 
+#ifndef MG_LFS_SIZE
+#define MG_LFS_SIZE (64 * 1024)
+#endif
+
 #ifndef MG_LFS_BUF_SIZE
 #define MG_LFS_BUF_SIZE 64  // Buffer size used for reads, writes, and cache
 #endif
@@ -28,19 +27,6 @@
 #define MG_LFS_BLOCK_SIZE 8192
 #endif
 
-#ifndef DT_DIR
-#define DT_DIR 4
-#endif
-#ifndef DT_REG
-#define DT_REG 8
-#endif
-
-typedef struct mg_lfs_fd DIR;
-struct dirent {
-  char d_name[LFS_NAME_MAX + 1];
-  unsigned char d_type;
-};
-
 struct mg_lfs_fd {
   struct mg_lfs_fd *next;
   bool isopen;
@@ -52,7 +38,6 @@ struct mg_lfs_fd {
 static lfs_t s_lfs;
 static struct mg_lfs_fd *s_fds;
 static uint8_t *s_fs;
-static int s_next_fd = MG_LFS_FD_BASE;
 static bool s_lfs_ready;
 #if LFS_USE_RAM
 static uint8_t *s_ram_fs;
@@ -110,29 +95,50 @@ static int lfs_driver_sync(const struct lfs_config *cfg) {
 }
 
 bool mg_lfs_init(size_t size) {
-  int result = 0;
+  //bool ok = false;
+  MG_DEBUG(("size: %zu", size));
   if (s_lfs_ready) return true;
-  if (size == 0) return false;
+  if (size == 0) {
+    MG_ERROR(("invalidsize = 0"));
+  } else {
 #if LFS_USE_RAM
-  s_cfg.block_size = MG_LFS_BLOCK_SIZE;
+    s_cfg.block_size = MG_LFS_BLOCK_SIZE;
-  if (s_ram_fs == NULL) s_ram_fs = (uint8_t *) mg_calloc(1, size);
+    if (s_ram_fs == NULL) s_ram_fs = (uint8_t *) mg_calloc(1, size);
-  s_fs = s_ram_fs;
+    s_fs = s_ram_fs;
 #else
-  if (mg_flash == NULL || mg_flash->secsz == 0 || mg_flash->size < size) return false;
+    {
-  if (mg_flash->write_fn == NULL) return false;
+      // Some flash attributes may be initialised on ota_begin
-  s_cfg.block_size = mg_flash->secsz;
+      int lev = mg_log_level;
-  s_fs = (uint8_t *) mg_flash->start + mg_flash->size - size;
+      mg_log_level = MG_LL_NONE;
+      mg_ota_begin(1);
+      mg_ota_end();
+      mg_log_set(lev);
+    }
+    if (mg_flash == NULL || mg_flash->secsz == 0 || mg_flash->size < size) {
+      MG_ERROR(("mg_flash %p secsz %zu flash_size %zu < size %zu", mg_flash, mg_flash->secsz, mg_flash->size, size));
+    } else if (mg_flash->write_fn == NULL) {
+      MG_ERROR(("flash write_fn == NULL"));
+    } else {
+      s_cfg.block_size = mg_flash->secsz;
+      s_fs = (uint8_t *) mg_flash->start + mg_flash->size - size;
+    }
 #endif
-  if (s_fs == NULL || s_cfg.block_size == 0 || size % s_cfg.block_size != 0) {
+    if (s_fs == NULL || s_cfg.block_size == 0 || size % s_cfg.block_size != 0) {
-    return false;
+      MG_ERROR(("s_fs %p blk_size %zu size %zu", s_fs, s_cfg.block_size));
+    } else {
+      s_cfg.block_count = (lfs_size_t) (size / s_cfg.block_size);
+      if (s_cfg.block_count == 0) {
+        MG_ERROR(("blk_count == 0"));
+      } else {
+        if (lfs_mount(&s_lfs, &s_cfg) != 0) lfs_format(&s_lfs, &s_cfg);
+        if (lfs_mount(&s_lfs, &s_cfg) != 0) {
+          MG_ERROR(("lfs_mount"));
+        } else {
+          s_lfs_ready = true;
+        }
+      }
+    }
   }
-  s_cfg.block_count = (lfs_size_t) (size / s_cfg.block_size);
-  if (s_cfg.block_count == 0) return false;
-  if (lfs_mount(&s_lfs, &s_cfg) != 0) {
-    lfs_format(&s_lfs, &s_cfg);
-    if (lfs_mount(&s_lfs, &s_cfg) != 0) result = -1;
-  }
-  s_lfs_ready = result == 0;
   return s_lfs_ready;
 }
 
@@ -145,16 +151,12 @@ static struct mg_lfs_fd *find_fd(int fd) {
 }
 
 static struct mg_lfs_fd *open_fd(void) {
-  struct mg_lfs_fd *f = NULL;
+  struct mg_lfs_fd *f = NULL, *p = s_fds;
-  if (s_lfs_ready) {
+  if (s_lfs_ready == false) mg_lfs_init(MG_LFS_SIZE);
-    f = (struct mg_lfs_fd *) mg_calloc(1, sizeof(*f));
+  if (s_lfs_ready && (f = (struct mg_lfs_fd *) mg_calloc(1, sizeof(*f)))) {
-    if (f != NULL) {
+    f->isopen = true, f->fd = MG_LFS_FD_BASE, f->next = s_fds;
-      f->isopen = true;
+    while (p != NULL) p = p->fd == f->fd ? (f->fd++, s_fds) : p->next;
-      f->fd = s_next_fd++;
+    s_fds = f;
-      f->next = s_fds;
-      s_fds = f;
-      if (s_next_fd < MG_LFS_FD_BASE) s_next_fd = MG_LFS_FD_BASE;
-    }
   }
   return f;
 }
@@ -173,6 +175,7 @@ int _open(const char *path, int flags, mode_t mode) {
   int err, lfs_flags = 0, fd = -1;
   struct mg_lfs_fd *f = open_fd();
   (void) mode;
+  MG_DEBUG(("%s -> %p, lfs_ready %d", path, f, s_lfs_ready));
   if (f == NULL) return -1;
   fd = f->fd;
   if ((flags & 3) == O_RDONLY) lfs_flags |= LFS_O_RDONLY;
@@ -214,11 +217,21 @@ int _lseek(int fd, int offset, int whence) {
 }
 
 int _rename(const char *oldname, const char *newname) {
+  if (s_lfs_ready == false) mg_lfs_init(MG_LFS_SIZE);
   return s_lfs_ready ? lfs_rename(&s_lfs, oldname, newname) : -1;
 }
 
-int _unlink_r(void *r, const char *a) {
+// Some libc rename() implementations have no atomic rename syscall and emulate
-  (void) r;
+// it as link() + unlink() instead of calling _rename() directly. LittleFS has
+// no real hard links, but forwarding to _rename() gives the same end result
+// (oldname becomes newname), which is all mg_file_write()'s atomic-write
+// pattern (write to a temp file, then rename it into place) needs
+int _link(const char *oldname, const char *newname) {
+  return _rename(oldname, newname);
+}
+
+int _unlink(const char *a) {
+  if (s_lfs_ready == false) mg_lfs_init(MG_LFS_SIZE);
   return s_lfs_ready ? lfs_remove(&s_lfs, a) : -1;
 }
 
@@ -227,7 +240,7 @@ DIR *opendir(const char *name) {
   if (f == NULL) return NULL;
   if (lfs_dir_open(&s_lfs, &f->dir, name) != 0) {
     close_fd(f);
-    return NULL;
+    f = NULL;
   }
   return (DIR *) f;
 }
@@ -254,7 +267,9 @@ struct dirent *readdir(DIR *dir) {
 
 int _stat(const char *path, struct stat *st) {
   struct lfs_info info;
+  if (s_lfs_ready == false) mg_lfs_init(MG_LFS_SIZE);
   if (!s_lfs_ready || lfs_stat(&s_lfs, path, &info) != 0) return -1;
+  memset(st, 0, sizeof(*st));
   st->st_mode = info.type == LFS_TYPE_DIR ? S_IFDIR : S_IFREG;
   st->st_size = info.size;
   return 0;
@@ -268,7 +283,7 @@ int _fstat(int fd, struct stat *st) {
 
 int mkdir(const char *path, mode_t mode) {
   (void) mode;
+  if (s_lfs_ready == false) mg_lfs_init(MG_LFS_SIZE);
   return s_lfs_ready ? lfs_mkdir(&s_lfs, path) : -1;
 }
-
 #endif

src/lfs.h

@@ -0,0 +1,20 @@
+#pragma once
+
+#if MG_ENABLE_LFS
+#include <fcntl.h>
+#include <lfs.h>
+
+#ifndef DT_DIR
+#define DT_DIR 4
+#endif
+#ifndef DT_REG
+#define DT_REG 8
+#endif
+
+struct dirent {
+  char d_name[LFS_NAME_MAX + 1];
+  unsigned char d_type;
+};
+
+typedef struct mg_lfs_fd DIR;
+#endif

src/mdash.c

@@ -55,7 +55,10 @@ static void mg_mdash_fn(struct mg_connection *c, int ev, void *ev_data) {
     // c->is_hexdumping = true;
     if (mg_url_is_ssl(MG_MDASH_URL)) {
       struct mg_str host = mg_url_host(MG_MDASH_URL);
-      struct mg_tls_opts opts = {.ca = mg_str(mg_mdash_ca_pem), .name = host};
+      struct mg_tls_opts opts;
+      memset(&opts, 0, sizeof(struct mg_tls_opts));
+      opts.ca = mg_str(mg_mdash_ca_pem);
+      opts.name = host;
       mg_tls_init(c, &opts);
     }
   }
@@ -65,16 +68,18 @@ static void mg_mdash_fn(struct mg_connection *c, int ev, void *ev_data) {
     // mDashTriggerEvent(s_mDashState, NULL);
   } else if (ev == MG_EV_WS_MSG) {
     struct mg_iobuf io = {0, 0, 0, 512};
-    struct mg_ws_message *wm = ev_data;
+    struct mg_ws_message *wm = (struct mg_ws_message *) ev_data;
     struct mg_str s = wm->data;
+    struct mg_rpc_req r;
     while (s.len > 0 && isspace((uint8_t) s.buf[s.len - 1])) s.len--;
     MG_INFO(("RPC: %.*s", (int) s.len, s.buf));
-    struct mg_rpc_req r = {.head = &c->mgr->rpcs,
+    memset(&r, 0, sizeof(struct mg_rpc_req));
-                           .rpc = NULL,
+    r.head = &c->mgr->rpcs;
-                           .pfn = mg_pfn_iobuf,
+    r.rpc = NULL;
-                           .pfn_data = &io,
+    r.pfn = mg_pfn_iobuf;
-                           .req_data = NULL,
+    r.pfn_data = &io;
-                           .frame = s};
+    r.req_data = NULL;
+    r.frame = s;
     mg_rpc_process(&r);
     if (io.buf != NULL) {
       MG_INFO(("     %s", io.buf));
@@ -91,11 +96,21 @@ static void mg_mdash_fn(struct mg_connection *c, int ev, void *ev_data) {
 }
 
 static void mg_mdash_rpc_get_info(struct mg_rpc_req *r) {
-  mg_rpc_ok(r, "{%m:%m,%m:%llu,%m:%m,%m:\"mws.%d\"}", MG_ESC("fw_version"),
+  const char *reset_reason = mg_health_reason_str(mg_health_reason());
-            MG_ESC(MG_MDASH_FIRMWARE_VERSION), MG_ESC("uptime"),
+  mg_rpc_ok(r, "{%m:%m,%m:%llu,%m:%m,%m:\"mws.%d\",%m:%M}",     //
-            (uint64_t) (mg_millis() / 1000), MG_ESC("reboot_reason"),
+            MG_ESC("fw_version"), MG_ESC(MG_FIRMWARE_VERSION),  //
-            MG_ESC(mg_health_reason_str(mg_health_reason())), MG_ESC("arch"),
+            MG_ESC("uptime"), (uint64_t) (mg_millis() / 1000),  //
-            MG_ARCH);
+            MG_ESC("reboot_reason"), MG_ESC(reset_reason),      //
+            MG_ESC("arch"), MG_ARCH,                            //
+            MG_ESC("crash"), mg_print_crash_record);
+}
+
+static void mg_mdash_rpc_mem_stats(struct mg_rpc_req *r) {
+  mg_rpc_ok(r, "{%m:%zu,%m:%zu,%m:%zu,%m:%zu}",              //
+            MG_ESC("stack_used"), (size_t) MG_HEALTH_STACK_USED,  //
+            MG_ESC("stack_total"), (size_t) MG_HEALTH_STACK_TOTAL,  //
+            MG_ESC("heap_used"), (size_t) MG_HEALTH_HEAP_USED,  //
+            MG_ESC("heap_total"), (size_t) MG_HEALTH_HEAP_TOTAL);
 }
 
 static void mg_mdash_rpc_ota_begin(struct mg_rpc_req *r) {
@@ -114,7 +129,7 @@ static void mg_mdash_rpc_ota_write(struct mg_rpc_req *r) {
     mg_rpc_err(r, 500, "%m", MG_ESC("data required"));
   } else {
     struct mg_str s = mg_str_n(&r->frame.buf[ofs] + 1, (size_t) (len - 2));
-    size_t n = mg_base64_decode(s.buf, s.len, s.buf, s.len); // Decode in-place
+    size_t n = mg_base64_decode(s.buf, s.len, s.buf, s.len);  // Decode in-place
     if (n == 0) {
       mg_rpc_ok(r, "%m", MG_ESC("finished"));
       mg_ota_end();
@@ -143,20 +158,32 @@ void mg_mdash_init(struct mg_mgr *mgr) {
   MG_INFO(("Initialising mdash agent, key [%s]", MG_MDASH_KEY));
   mg_rpc_add(&mgr->rpcs, mg_str("RPC.List"), mg_rpc_list, NULL);
   mg_rpc_add(&mgr->rpcs, mg_str("Sys.GetInfo"), mg_mdash_rpc_get_info, NULL);
+  mg_rpc_add(&mgr->rpcs, mg_str("Sys.MemStats"), mg_mdash_rpc_mem_stats, NULL);
   mg_rpc_add(&mgr->rpcs, mg_str("OTA.Begin"), mg_mdash_rpc_ota_begin, NULL);
   mg_rpc_add(&mgr->rpcs, mg_str("OTA.Write"), mg_mdash_rpc_ota_write, NULL);
   mg_rpc_add(&mgr->rpcs, mg_str("OTA.End"), mg_mdash_rpc_ota_end, NULL);
 }
 
 void mg_mdash_poll(struct mg_mgr *mgr) {
+#if MG_TLS == MG_TLS_NONE
+  (void) mgr, (void) mg_mdash_fn;  // mdash needs wss://, nothing to do
+#else
   static uint64_t timer = 0;
-  if (mg_mdash_conn == NULL && mg_timer_expired(&timer, 1000, mg_millis())) {
+  // No RPC handlers means mdash was never set up, or mg_mdash_free() ran.
+  // No key means mdash would reject us, so do not connect at all
+  if (mg_mdash_conn == NULL && mgr->rpcs != NULL && MG_MDASH_KEY[0] != '\0' &&
+      mg_timer_expired(&timer, 1000, mg_millis())) {
     MG_INFO(("Connecting to %s", MG_MDASH_URL));
     mg_mdash_conn = mg_ws_connect(mgr, MG_MDASH_URL, mg_mdash_fn, NULL,
                                   "Origin: %s\r\n"
                                   "Authorization: Bearer %s\r\n",
                                   MG_MDASH_URL, MG_MDASH_KEY);
   }
+#endif
+}
+
+void mg_mdash_free(struct mg_mgr *mgr) {
+  mg_rpc_del(&mgr->rpcs, NULL);
 }
 
 #else
@@ -166,4 +193,7 @@ void mg_mdash_init(struct mg_mgr *mgr) {
 void mg_mdash_poll(struct mg_mgr *mgr) {
   (void) mgr;
 }
+void mg_mdash_free(struct mg_mgr *mgr) {
+  (void) mgr;
+}
 #endif

src/mdash.h

@@ -12,13 +12,10 @@
 #define MG_MDASH_KEY ""
 #endif
 
-#ifndef MG_MDASH_FIRMWARE_VERSION
-#define MG_MDASH_FIRMWARE_VERSION "1.0.0"
-#endif
-
 #ifndef MG_ENABLE_MDASH
 #define MG_ENABLE_MDASH 0
 #endif
 
 void mg_mdash_init(struct mg_mgr *);
 void mg_mdash_poll(struct mg_mgr *);
+void mg_mdash_free(struct mg_mgr *);

src/mqtt.c

@@ -438,6 +438,16 @@ int mg_mqtt_parse(const uint8_t *buf, size_t len, uint8_t version,
     case MQTT_CMD_CONNACK:
       if (end - p < 2) return MQTT_MALFORMED;
       m->ack = p[1];
+      p += 2;
+      if (version == 5) {
+        if (p >= end) return MQTT_MALFORMED;
+        len_len = (uint32_t) decode_varint(p, (size_t) (end - p), &tmp);
+        if (!len_len) return MQTT_MALFORMED;
+        m->props_size = (size_t) tmp;
+        m->props_start = (size_t) (p + len_len - buf);
+        p += len_len + m->props_size;
+        if (p > end) return MQTT_MALFORMED;
+      }
       break;
     case MQTT_CMD_PUBACK:
     case MQTT_CMD_PUBREC:

src/net.c

@@ -1,8 +1,8 @@
-#include "net.h"
 #include "dns.h"
 #include "fmt.h"
 #include "log.h"
 #include "mdash.h"
+#include "net.h"
 #include "printf.h"
 #include "profile.h"
 #include "timer.h"
@@ -39,10 +39,10 @@ bool mg_dscp(struct mg_connection *c, uint8_t dscp) {
   int tos = dscp << 2, level = IPPROTO_IP, optname = IP_TOS;
   c->dscp = (unsigned) (dscp & 63);
 #if MG_ENABLE_IPV6 && !MG_ENABLE_LWIP
-  if (c->loc.is_ip6)
+  if (c->loc.is_ip6) level = IPPROTO_IPV6, optname = IPV6_TCLASS;
-    level = IPPROTO_IPV6, optname = IPV6_TCLASS;
 #endif
-  return setsockopt((MG_SOCKET_TYPE) (size_t) c->fd, level, optname, (char *) &tos, sizeof(tos)) == 0;
+  return setsockopt((MG_SOCKET_TYPE) (size_t) c->fd, level, optname,
+                    (char *) &tos, sizeof(tos)) == 0;
 #endif
 #elif MG_ENABLE_TCPIP
   c->dscp = (unsigned) (dscp & 63);
@@ -299,6 +299,9 @@ void mg_mgr_free(struct mg_mgr *mgr) {
   while (t != NULL) tmp = t->next, mg_free(t), t = tmp;
   mgr->timers = NULL;  // Important. Next call to poll won't touch timers
   for (c = mgr->conns; c != NULL; c = c->next) c->is_closing = 1;
+#if MG_ENABLE_MDASH
+  mg_mdash_free(mgr);  // Before the final poll, so mdash does not reconnect
+#endif
   mg_mgr_poll(mgr, 0);
 #if MG_ENABLE_FREERTOS_TCP
   FreeRTOS_DeleteSocketSet(mgr->ss);
@@ -343,13 +346,15 @@ void mg_mgr_init(struct mg_mgr *mgr) {
   mgr->dns4.url = "udp://8.8.8.8:53";
   mgr->dns6.url = "udp://[2001:4860:4860::8888]:53";
   mg_tls_ctx_init(mgr);
-  MG_DEBUG(("MG_IO_SIZE: %lu, TLS: %s", MG_IO_SIZE,
+  MG_DEBUG(("MG_IO_SIZE: %lu, TLS: %s, conn size: %zu, mgr size: %zu",
+            MG_IO_SIZE,
             MG_TLS == MG_TLS_NONE      ? "none"
             : MG_TLS == MG_TLS_MBED    ? "MbedTLS"
             : MG_TLS == MG_TLS_OPENSSL ? "OpenSSL"
             : MG_TLS == MG_TLS_BUILTIN ? "builtin"
             : MG_TLS == MG_TLS_WOLFSSL ? "WolfSSL"
-                                       : "custom"));
+                                       : "custom",
+            sizeof(struct mg_connection), sizeof(struct mg_mgr)));
 #if MG_ENABLE_MDASH
   mg_mdash_init(mgr);
 #endif

src/net.h

@@ -92,12 +92,12 @@ struct mg_connection {
   unsigned is_mqtt5 : 1;          // MQTT5 connection (set by mg_mqtt_login)
   unsigned is_hexdumping : 1;     // Log hex dump of all in/out traffic
   unsigned is_draining : 1;       // Flush send buffer, then close
-  unsigned is_closing : 1;        // Close and free immediately on next poll
+  unsigned is_closing : 1;        // Request Close and free on next poll
   unsigned is_full : 1;           // Pause incoming reads until cleared
   unsigned is_tls_throttled : 1;  // TLS write was throttled; retry pending
-  unsigned is_resp : 1;           // HTTP: response is still being generated
   unsigned is_readable : 1;       // Socket is ready to read (epoll/select)
   unsigned is_writable : 1;       // Socket is ready to write (epoll/select)
+  unsigned is_bsd : 1;            // Built-in TCP/IP stack BSD socket
 };
 
 // Runs one iteration of the event loop.

src/net_builtin.c

@@ -1,4 +1,5 @@
 #include "net_builtin.h"
+#include "bsd.h"
 #include "profile.h"
 
 #if MG_ENABLE_TCPIP
@@ -31,16 +32,16 @@
 #endif
 
 struct connstate {
-  uint32_t seq, ack;                      // TCP seq/ack counters
+  uint32_t seq, ack;   // TCP seq/ack counters
-  uint64_t timer;                         // TCP timer (see 'ttype' below)
+  uint64_t timer;      // TCP timer (see 'ttype' below)
-  uint64_t txq_timer;                     // TCP retransmission timer (RFC-6298, 5)
+  uint64_t txq_timer;  // TCP retransmission timer (RFC-6298, 5)
-  uint32_t acked;                         // Last ACK-ed number
+  uint32_t acked;      // Last ACK-ed number
-  size_t unacked;                         // Not acked bytes
+  size_t unacked;      // Not acked bytes
-  uint32_t maxseq;                        // Max send seq (ack + window)
+  uint32_t maxseq;     // Max send seq (ack + window)
-  uint32_t txq_seq;                       // Sequence of first txq record (RFC-9293, 3.8)
+  uint32_t txq_seq;    // Sequence of first txq record (RFC-9293, 3.8)
-  uint32_t txq_una;                       // Oldest unacknowledged sequence (RFC-9293, 3.4)
+  uint32_t txq_una;    // Oldest unacknowledged sequence (RFC-9293, 3.4)
-  uint16_t win;                           // destination current window size
+  uint16_t win;        // destination current window size
-  uint16_t dmss;                          // destination MSS (from TCP opts)
+  uint16_t dmss;       // destination MSS (from TCP opts)
   uint8_t mac[sizeof(struct mg_l2addr)];  // Peer hw address
   uint8_t ttype;                          // Timer type:
 #define MIP_TTYPE_KEEPALIVE 0  // Connection is idle for long, send keepalive
@@ -54,6 +55,8 @@ struct connstate {
   bool twclosure;        // 3-way closure done
   bool retransmit;       // Retain sent data until acknowledged
   bool is_full;          // Advertise a zero receive window
+  bool is_closing;       // Finished, remove connection (TCP after FIN)
+  bool send_rst;         // Send RST before removing a TCP connection
   struct mg_iobuf txq;   // Length-prefixed sent TCP segments (RFC-9293, 3.8)
 };
 
@@ -310,6 +313,8 @@ static bool tcpcsum_ok(void *d, void *t) {
           0);
 }
 
+#define MG_IPISLOCAL(i, a) ((a & i->mask) == (i->ip & i->mask))
+
 #if MG_ENABLE_IPV6
 static uint16_t p6csum(void *d, void *p, uint8_t proto, size_t plen) {
   uint32_t sum;
@@ -418,12 +423,13 @@ static void onstatechange(struct mg_tcpip_if *ifp) {
       ifp->is_ip_changed = false;
     }
   } else if (ifp->state == MG_TCPIP_STATE_IP) {
-    if (ifp->gw != 0 && ifp->l2type == MG_TCPIP_L2_ETH)
+    if (ifp->l2type == MG_TCPIP_L2_ETH) {
-      mg_tcpip_arp_request(ifp, ifp->gw, NULL);  // unsolicited GW ARP request
+      ifp->gw_ready = false;  // remove any prior state
+      if (ifp->gw != 0)  // send an unsolicited GW ARP request
+        mg_tcpip_arp_request(ifp, ifp->gw, NULL);
+    }
   } else if (ifp->state == MG_TCPIP_STATE_UP) {
     srand((unsigned int) mg_millis());
-  } else if (ifp->state == MG_TCPIP_STATE_DOWN) {
-    MG_ERROR(("Link down"));
   }
   mg_tcpip_call(ifp, MG_TCPIP_EV_STATE_CHANGE, &ifp->state);
 }
@@ -672,6 +678,7 @@ static void rx_icmp(struct mg_tcpip_if *ifp, struct pkt *pkt) {
 }
 
 static void setdns4(struct mg_tcpip_if *ifp, uint32_t *ip);
+static void conndns4(struct mg_tcpip_if *ifp, uint32_t ip);
 
 static bool dhcp_opt_len_ok(uint8_t len, uint8_t *p, uint8_t *end) {
   return (len >= 4 && (len & 3) == 0 && p + 6 < end);
@@ -732,16 +739,15 @@ static void rx_dhcp_client(struct mg_tcpip_if *ifp, struct pkt *pkt) {
       uint64_t rand;
       ifp->lease_expire = ifp->now + (uint64_t) lease * 1000;
       MG_INFO(("Lease: %u sec (%lld)", lease, ifp->lease_expire / 1000));
-      // assume DHCP server = router until ARP resolves
-      memcpy(ifp->gwmac, mg_l2_getaddr(ifp, pkt->l2), sizeof(ifp->gwmac));
-      ifp->gw_ready = true;  // NOTE(): actual gw ARP won't retry now
       if (ifp->ip != ip) ifp->is_ip_changed = true;
       ifp->ip = ip, ifp->gw = gw, ifp->mask = mask;
       ifp->state = MG_TCPIP_STATE_IP;  // BOUND state
       mg_random(&rand, sizeof(rand));
       srand((unsigned int) (rand + mg_millis()));
       if (ifp->enable_req_dns && dns != 0) {
-        setdns4(ifp, &dns);
+        setdns4(ifp, &dns);         // configure the provided DNS
+        if (MG_IPISLOCAL(ifp, dns)) // connect to a local DNS at this point
+          conndns4(ifp, dns);
         mg_tcpip_call(ifp, MG_TCPIP_EV_DHCP_DNS, &dns);
       }
       if (ifp->enable_req_sntp && sntp != 0)
@@ -792,7 +798,7 @@ static void rx_dhcp_server(struct mg_tcpip_if *ifp, struct pkt *pkt) {
     res.xid = pkt->dhcp->xid;
     mac = mg_l2_getaddr(ifp, pkt->l2);
     if (ifp->enable_get_gateway) {
-      ifp->gw = res.yiaddr;  // set gw IP, best-effort gwmac as DHCP server's
+      ifp->gw = res.yiaddr;  // set gw IP, and MAC
       memcpy(ifp->gwmac, mac, sizeof(ifp->gwmac));
     }
     tx_udp4(ifp, mac, ifp->ip, mg_htons(67), op == 1 ? ~0U : res.yiaddr,
@@ -809,7 +815,7 @@ static struct ip6 *tx_ip6(struct mg_tcpip_if *ifp, uint8_t *l2_dst,
   struct ip6 *ip6 = (struct ip6 *) mg_l2_header(ifp, MG_TCPIP_L2PROTO_IPV6,
                                                 ifp->mac, l2_dst, l2p);
   memset(ip6, 0, sizeof(*ip6));
-  ip6->ver = (uint8_t) (0x60 | (dscp >> 2)); // Version 6, traffic class
+  ip6->ver = (uint8_t) (0x60 | (dscp >> 2));  // Version 6, traffic class
   ip6->label[0] = (uint8_t) (dscp << 6);
   ip6->plen = mg_htons((uint16_t) plen);
   ip6->next = next;
@@ -1049,6 +1055,7 @@ static void rx_ndp_ra(struct mg_tcpip_if *ifp, struct pkt *pkt) {
     if (gotprefix && !fill_global(ifp, prefix, prefix_len)) return;
     if (changed) ifp->is_ip6_changed = true;
     ifp->gw6[0] = pkt->ip6->src[0], ifp->gw6[1] = pkt->ip6->src[1];
+    ifp->gw6_ready = false;  // Remove any prior state
     if (gotl2addr) memcpy(ifp->gw6mac, l2, sizeof(ifp->gw6mac));
     if (gotl2addr || ifp->l2type == MG_TCPIP_L2_PPP ||
         ifp->l2type == MG_TCPIP_L2_PPPoE) {
@@ -1063,10 +1070,8 @@ static void rx_ndp_ra(struct mg_tcpip_if *ifp, struct pkt *pkt) {
            mtu));
       ifp->mtu = (uint16_t) mtu;
     }
-    if (ifp->state6 != MG_TCPIP_STATE_READY) {
+    if (ifp->state6 != MG_TCPIP_STATE_READY)
-      tx_ndp_ns(ifp, ifp->gw6, NULL);  // unsolicited GW hwaddr resolution
       ifp->state6 = MG_TCPIP_STATE_IP;
-    }
     onstate6change(ifp);
   }
 }
@@ -1182,7 +1187,7 @@ static uint8_t *get_return_l2addr(struct mg_tcpip_if *ifp, struct mg_addr *rem,
   } else
 #endif
   {
-    if (ifp->ip != 0 && ((rem->addr.ip4 & ifp->mask) == (ifp->ip & ifp->mask)))
+    if (ifp->ip != 0 && MG_IPISLOCAL(ifp, rem->addr.ip4))
       return mg_l2_getaddr(ifp, pkt->l2);  // same LAN, get from frame
     if (ifp->gw_ready)                     // use the router
       return ifp->gwmac;                   // ignore source address in frame
@@ -1192,6 +1197,20 @@ static uint8_t *get_return_l2addr(struct mg_tcpip_if *ifp, struct mg_addr *rem,
   return NULL;
 }
 
+static void proto_error(struct mg_connection *c, bool r, const char *f, ...) {
+  char buf[64];
+  va_list ap;
+  struct connstate *s = (struct connstate *) (c + 1);
+  va_start(ap, f);
+  mg_vsnprintf(buf, sizeof(buf), f, &ap);
+  va_end(ap);
+  MG_ERROR(("%lu %ld %s", c->id, c->fd, buf));
+  c->is_closing = 1;  // Stop Mongoose I/O
+  s->is_closing = 1;  // Transport-terminal; do not send FIN
+  if (r && !c->is_udp) s->send_rst = true;  // honot TCP RST request
+  mg_call(c, MG_EV_ERROR, buf);
+}
+
 static bool rx_udp(struct mg_tcpip_if *ifp, struct pkt *pkt) {
   struct mg_connection *c = getpeer(ifp->mgr, pkt, true);
   struct connstate *s;
@@ -1214,10 +1233,10 @@ static bool rx_udp(struct mg_tcpip_if *ifp, struct pkt *pkt) {
     return false;  // safety net for lousy networks
   memcpy(s->mac, l2addr, sizeof(s->mac));
   if (c->recv.len >= MG_MAX_RECV_SIZE) {
-    mg_error(c, "max_recv_buf_size reached");
+    proto_error(c, false, "max_recv_buf_size reached");
   } else if (c->recv.size - c->recv.len < pkt->pay.len &&
              !mg_iobuf_resize(&c->recv, c->recv.len + pkt->pay.len)) {
-    mg_error(c, "oom");
+    proto_error(c, false, "oom");
   } else {
     memcpy(&c->recv.buf[c->recv.len], pkt->pay.buf, pkt->pay.len);
     c->recv.len += pkt->pay.len;
@@ -1278,7 +1297,7 @@ static size_t tx_tcp(struct mg_tcpip_if *ifp, uint8_t *l2_dst,
   tcp->off = (uint8_t) (hlen / 4 << 4);
 #if MG_ENABLE_IPV6
   if (ip_dst->is_ip6) {
-   tcp->csum = p6csum(ip6, tcp, 6, hlen + len);
+    tcp->csum = p6csum(ip6, tcp, 6, hlen + len);
   } else
 #endif
   {
@@ -1491,7 +1510,7 @@ static void handle_tls_recv(struct mg_connection *c) {
   size_t min = avail > MG_MAX_RECV_SIZE ? MG_MAX_RECV_SIZE : avail;
   struct mg_iobuf *io = &c->recv;  // allocated on first avail > 0
   if (io->size - io->len < min && !mg_iobuf_resize(io, io->len + min)) {
-    mg_error(c, "oom");
+    proto_error(c, true, "oom");
   } else {
     // Decrypt data directly into c->recv. If io->buf = NULL or
     // io->len = io->size (no room), there can be outstanding data that can't be
@@ -1500,7 +1519,7 @@ static void handle_tls_recv(struct mg_connection *c) {
     long n = mg_tls_recv(c, io->buf != NULL ? &io->buf[io->len] : io->buf,
                          io->size - io->len);
     if (n == MG_IO_ERR) {
-      mg_error(c, "TLS recv error");
+      proto_error(c, true, "TLS recv error");
     } else if (n > 0) {
       // Decrypted successfully - trigger MG_EV_READ
       io->len += (size_t) n;
@@ -1544,7 +1563,7 @@ static void retransmit(struct mg_connection *c) {
       tx_tcp(ifp, s->mac, &c->loc, &c->rem, c->dscp, TH_PUSH | TH_ACK,
              mg_htonl(s->txq_seq), mg_htonl(s->ack),
              s->is_full ? 0 : MG_TCPIP_WIN, buf, len) == (size_t) -1) {
-    mg_error(c, "retransmit");
+    proto_error(c, false, "retransmit"); // should RST, but sending just failed
     return;
   }
   // Back off RTO after every timeout (RFC-6298, 5.5)
@@ -1577,15 +1596,11 @@ static void read_conn(struct mg_connection *c, struct pkt *pkt) {
     s->ack = (uint32_t) (mg_htonl(pkt->tcp->seq) + pkt->pay.len + 1);
     s->fin_rcvd = true;
     if (c->is_draining && s->ttype == MIP_TTYPE_FIN) {
-      if (s->seq == mg_htonl(pkt->tcp->ack)) {  // Simultaneous closure ?
+      // Simultaneous closure ?
-        s->seq++;                               // Yes. Increment our SEQ
-      } else {                                  // Otherwise,
-        s->seq = mg_htonl(pkt->tcp->ack);       // Set to peer's ACK
-      }
       s->twclosure = true;
     } else {
       // Peer closed first: send ACK only, enter CLOSE_WAIT.
-      // The connection loop will call init_closure after pending send data
+      // The connection loop will initiate closure after pending send data
       // is flushed, then send our FIN.
       c->is_draining = 1;
     }
@@ -1619,18 +1634,11 @@ static void read_conn(struct mg_connection *c, struct pkt *pkt) {
       s->twclosure = true;
   }
   if (pkt->pay.len == 0) return;
-  if (io->size - io->len < pkt->pay.len &&
+  if (!c->is_closing && io->size - io->len < pkt->pay.len &&
       !mg_iobuf_resize(io, io->len + pkt->pay.len)) {
-    mg_error(c, "oom");
+    proto_error(c, true, "oom");
     return;  // drop it
   }
-  // Copy TCP payload into the IO buffer. If the connection is plain text,
-  // we copy to c->recv. If the connection is TLS, this data is encrypted,
-  // therefore we copy that encrypted data to the c->rtls iobuffer instead,
-  // and then call mg_tls_recv() to decrypt it. NOTE: mg_tls_recv() will
-  // call back mg_io_recv() which grabs raw data from c->rtls
-  memcpy(&io->buf[io->len], pkt->pay.buf, pkt->pay.len);
-  io->len += pkt->pay.len;
   MG_VERBOSE(("%lu SEQ %x -> %x", c->id, mg_htonl(pkt->tcp->seq), s->ack));
   if (!(pkt->tcp->flags & TH_FIN)) {  // FIN already advanced s->ack
     // Advance ACK counter
@@ -1638,7 +1646,8 @@ static void read_conn(struct mg_connection *c, struct pkt *pkt) {
     s->unacked += pkt->pay.len;
   }
   // size_t diff = s->acked <= s->ack ? s->ack - s->acked : s->ack;
-  if (s->unacked > MG_TCPIP_WIN / 2 && s->acked != s->ack) {
+  if ((s->unacked > MG_TCPIP_WIN / 2 && s->acked != s->ack) ||
+      s->ttype == MIP_TTYPE_FIN) {
     // Send ACK immediately
     MG_VERBOSE(("%lu imm ACK %lu", c->id, s->acked));
     tx_tcp(c->mgr->ifp, s->mac, &c->loc, &c->rem, c->dscp, TH_ACK,
@@ -1651,6 +1660,14 @@ static void read_conn(struct mg_connection *c, struct pkt *pkt) {
     // if not already running, setup a timer to send an ACK later
     if (s->ttype != MIP_TTYPE_ACK) settmout(c, MIP_TTYPE_ACK);
   }
+  if (c->is_closing) return; // we have a "closed socket", ignore data
+  // Copy TCP payload into the IO buffer. If the connection is plain text,
+  // we copy to c->recv. If the connection is TLS, this data is encrypted,
+  // therefore we copy that encrypted data to the c->rtls iobuffer instead,
+  // and then call mg_tls_recv() to decrypt it. NOTE: mg_tls_recv() will
+  // call back mg_io_recv() which grabs raw data from c->rtls
+  memcpy(&io->buf[io->len], pkt->pay.buf, pkt->pay.len);
+  io->len += pkt->pay.len;
   if (c->is_tls) {
     c->is_tls_hs ? mg_tls_handshake(c) : handle_tls_recv(c);
   } else {
@@ -1759,11 +1776,11 @@ static void rx_tcp(struct mg_tcpip_if *ifp, struct pkt *pkt) {
     if (c->is_tls_hs) mg_tls_handshake(c);
     if (!c->is_tls_hs) c->is_tls = 0;  // user did not call mg_tls_init()
   } else if (c != NULL && c->is_connecting && pkt->tcp->flags != TH_ACK) {
-    mg_error(c, "connection refused");
+    proto_error(c, false, "connection refused");
   } else if (c != NULL && pkt->tcp->flags & TH_RST) {
     uint32_t seqno = mg_ntohl(pkt->tcp->seq);
     if (seqno >= s->ack && seqno < (s->ack + MG_TCPIP_WIN))  // RFC-9293 3.5.3
-      mg_error(c, "peer RST");  // RFC-1122 4.2.2.13
+      proto_error(c, false, "peer RST");  // RFC-1122 4.2.2.13
   } else if (c != NULL) {
     // process segment
     s->tmiss = 0;                         // Reset missed keep-alive counter
@@ -1845,7 +1862,7 @@ static void rx_ip(struct mg_tcpip_if *ifp, struct pkt *pkt) {
     if (pkt->ip->proto == 17) pkt->udp = (struct udp *) (pkt->pay.buf);
     if (pkt->ip->proto == 6) pkt->tcp = (struct tcp *) (pkt->pay.buf);
     c = getpeer(ifp->mgr, pkt, false);
-    if (c) mg_error(c, "Received fragmented packet");
+    if (c) proto_error(c, false, "Received fragmented packet");
   } else if (pkt->ip->proto == 1) {
     pkt->icmp = (struct icmp *) (pkt->pay.buf);
     if (pkt->pay.len < sizeof(*pkt->icmp)) return;
@@ -1928,7 +1945,7 @@ static void rx_ip6(struct mg_tcpip_if *ifp, struct pkt *pkt) {
         if (nhdr[0] == 17) pkt->udp = (struct udp *) (pkt->pay.buf);
         if (nhdr[0] == 6) pkt->tcp = (struct tcp *) (pkt->pay.buf);
         c = getpeer(ifp->mgr, pkt, false);
-        if (c) mg_error(c, "Received fragmented packet");
+        if (c) proto_error(c, false, "Received fragmented packet");
       }
         return;
       case 59:  // No Next Header 4.7
@@ -2122,7 +2139,7 @@ static void mg_tcpip_poll(struct mg_tcpip_if *ifp, uint64_t now) {
   }
   // Handle gw ARP request timeout, order is important
   if (expired_1000ms && ifp->state == MG_TCPIP_STATE_IP) {
-    ifp->state = MG_TCPIP_STATE_READY;  // keep best-effort MAC or poison mark
+    ifp->state = MG_TCPIP_STATE_READY;  // gw MAC not resolved, we'll retry
     onstatechange(ifp);
   }
   if (expired_1000ms && ifp->state == MG_TCPIP_STATE_READY && !ifp->gw_ready &&
@@ -2131,10 +2148,10 @@ static void mg_tcpip_poll(struct mg_tcpip_if *ifp, uint64_t now) {
 #if MG_ENABLE_IPV6
   // Handle gw NS/NA req/resp timeout, order is important
   if (expired_1000ms && ifp->state6 == MG_TCPIP_STATE_IP) {
-    ifp->state6 = MG_TCPIP_STATE_READY;  // keep best-effort MAC or poison mark
+    ifp->state6 = MG_TCPIP_STATE_READY;  // gw6 MAC not resolved, we'll retry
     onstate6change(ifp);
   }
-  if (expired_1000ms && ifp->state == MG_TCPIP_STATE_READY && !ifp->gw6_ready &&
+  if (expired_1000ms && ifp->state6 == MG_TCPIP_STATE_READY && !ifp->gw6_ready &&
       (ifp->gw6[0] != 0 || ifp->gw6[1] != 0))
     tx_ndp_ns(ifp, ifp->gw6, NULL);  // retry GW hwaddr resolution
 #endif
@@ -2193,7 +2210,7 @@ static void mg_tcpip_poll(struct mg_tcpip_if *ifp, uint64_t now) {
     }
     if (ifp->now > s->timer) {
       if (s->ttype == MIP_TTYPE_ARP) {
-        mg_error(c, "ARP timeout");
+        proto_error(c, false, "ARP timeout");
       } else if (c->is_udp) {
         continue;
       } else if (s->ttype == MIP_TTYPE_ACK && s->acked != s->ack) {
@@ -2202,13 +2219,13 @@ static void mg_tcpip_poll(struct mg_tcpip_if *ifp, uint64_t now) {
                mg_htonl(s->ack), s->is_full ? 0 : MG_TCPIP_WIN, NULL, 0);
         s->acked = s->ack;
       } else if (s->ttype == MIP_TTYPE_SYN) {
-        mg_error(c, "Connection timeout");
+        proto_error(c, false, "Connection timeout");
       } else if (s->ttype == MIP_TTYPE_FIN) {
-        c->is_closing = 1;
+        s->is_closing = 1;
         continue;
       } else {
         if (s->tmiss++ > 2) {
-          mg_error(c, "keepalive");
+          proto_error(c, false, "keepalive");
         } else {
           MG_VERBOSE(("%lu keepalive", c->id));
           tx_tcp(ifp, s->mac, &c->loc, &c->rem, c->dscp, TH_ACK,
@@ -2265,10 +2282,20 @@ void mg_tcpip_init(struct mg_mgr *mgr, struct mg_tcpip_if *ifp) {
     ifp->eport |= MG_EPHEMERAL_PORT_BASE;        // Random from
                                            // MG_EPHEMERAL_PORT_BASE to 65535
     if (ifp->tx.buf == NULL || ifp->recv_queue.buf == NULL) MG_ERROR(("OOM"));
+    MG_DEBUG(("Builtin TCP/IP init done. Queue size: %zu, extra conn size: %zu",
+              ifp->recv_queue.size, mgr->extraconnsize));
   }
+  mg_bsd_init(mgr);
+}
+
+static void close_conn(struct mg_connection *c) {
+  struct connstate *s = (struct connstate *) (c + 1);
+  mg_iobuf_free(&s->txq);
+  mg_close_conn(c);
 }
 
 void mg_tcpip_free(struct mg_tcpip_if *ifp) {
+  while (ifp->mgr->conns != NULL) close_conn(ifp->mgr->conns); // TCP FIN wait
   mg_free(ifp->recv_queue.buf);
   mg_free(ifp->tx.buf);
   mg_free(ifp->dns4_url);
@@ -2335,12 +2362,12 @@ void mg_connect_resolved(struct mg_connection *c) {
       memcpy(s->mac, ifp->gw6mac, sizeof(s->mac));
       l2addr_resolved(c);
     } else {
-      MG_ERROR(("No IPv6 gateway, can't connect"));
+      mg_error(c, "No IPv6 gateway, can't connect");
     }
 #endif
   } else {
     uint32_t rem_ip = c->rem.addr.ip4;
-    if (ifp->ip && ((rem_ip & ifp->mask) == (ifp->ip & ifp->mask)) &&
+    if (ifp->ip && MG_IPISLOCAL(ifp, rem_ip) &&
         rem_ip != ifp->gw) {  // skip if gw (onstatechange -> ARP)
       // If we're in the same LAN, fire an ARP lookup.
       MG_DEBUG(("%lu ARP lookup...", c->id));
@@ -2351,7 +2378,7 @@ void mg_connect_resolved(struct mg_connection *c) {
       memcpy(s->mac, ifp->gwmac, sizeof(s->mac));
       l2addr_resolved(c);
     } else {
-      MG_ERROR(("No gateway, can't connect"));
+      mg_error(c, "No gateway, can't connect");
     }
   }
 }
@@ -2370,29 +2397,13 @@ static void write_conn(struct mg_connection *c) {
                        : mg_io_send(c, c->send.buf, c->send.len);
   // TODO(): mg_tls_send() may return 0 forever on steady OOM
   if (len == MG_IO_ERR) {
-    mg_error(c, "tx err");
+    proto_error(c, false, "tx err");
   } else if (len > 0) {
     mg_iobuf_del(&c->send, 0, (size_t) len);
     mg_call(c, MG_EV_WRITE, &len);
   }
 }
 
-static void init_closure(struct mg_connection *c) {
-  struct connstate *s = (struct connstate *) (c + 1);
-  if (c->is_listening == false && c->is_connecting == false) {
-    tx_tcp(c->mgr->ifp, s->mac, &c->loc, &c->rem, c->dscp, TH_FIN | TH_ACK,
-           mg_htonl(s->seq), mg_htonl(s->ack), s->is_full ? 0 : MG_TCPIP_WIN,
-           NULL, 0);
-    settmout(c, MIP_TTYPE_FIN);
-  }
-}
-
-static void close_conn(struct mg_connection *c) {
-  struct connstate *s = (struct connstate *) (c + 1);
-  mg_iobuf_free(&s->txq);
-  mg_close_conn(c);
-}
-
 static bool can_write(struct mg_connection *c) {
   return c->is_connecting == 0 && c->is_resolving == 0 && c->send.len > 0 &&
          c->is_tls_hs == 0 && c->is_arplooking == 0;
@@ -2413,29 +2424,50 @@ void mg_mgr_poll(struct mg_mgr *mgr, int ms) {
                   !c->is_listening && !c->is_connecting;
     tmp = c->next;
     mg_call(c, MG_EV_POLL, &now);
-    MG_VERBOSE(("%lu .. %c%c%c%c%c %lu %lu", c->id, c->is_tls ? 'T' : 't',
+    MG_VERBOSE(("%lu .. %c%c%c%c%c%c %lu %lu", c->id, c->is_tls ? 'T' : 't',
                 c->is_connecting ? 'C' : 'c', c->is_tls_hs ? 'H' : 'h',
                 c->is_resolving ? 'R' : 'r', c->is_closing ? 'C' : 'c',
-                mg_tls_pending(c), c->rtls.len));
+                s->is_closing ? 'F' : 'f', mg_tls_pending(c), c->rtls.len));
-    // order is important, TLS conn close with > 1 record in buffer (below)
+    if (!c->is_closing) {
-    if (is_tls && (c->rtls.len > 0 || mg_tls_pending(c) > 0))
+      // order is important, TLS conn close with > 1 record in buffer (below)
+      if (is_tls && (c->rtls.len > 0 || mg_tls_pending(c) > 0))
       c->is_tls_hs ? mg_tls_handshake(c) : handle_tls_recv(c);
-    if (can_write(c)) write_conn(c);
+      if (can_write(c)) write_conn(c);
-    if (is_tls && c->send.len == 0) flush = mg_tls_flush(c);
+      if (is_tls && c->send.len == 0) flush = mg_tls_flush(c);
-    if (flush == MG_IO_ERR) mg_error(c, "tx err");
-    if (c->is_draining && c->send.len == 0) {
-      if (c->is_udp) c->is_closing = 1;
-      if (!c->is_udp && flush == 0 && s->txq.len == 0 &&
-          s->ttype != MIP_TTYPE_FIN)
-        init_closure(c);
     }
+    if (flush == MG_IO_ERR) proto_error(c, false, "tx err"); // should RST but
+    if (c->is_draining && c->send.len == 0 &&
+        (c->is_udp ||
+         (flush == 0 && s->txq.len == 0 && s->ttype != MIP_TTYPE_FIN)))
+      c->is_closing = 1;
     // For non-TLS, close immediately upon completing the 3-way closure
     // For TLS, handle any pending data (above) until MIP_TTYPE_FIN expires
     if (s->twclosure &&
-        (!c->is_tls || (c->rtls.len == 0 && mg_tls_pending(c) == 0)))
+        (!c->is_tls || (c->rtls.len == 0 && mg_tls_pending(c) == 0))) {
-      c->is_closing = 1;
+      s->is_closing = 1;
-    if (c->is_closing) close_conn(c);
+    } else if (c->is_closing && !s->is_closing) {
+      if (c->is_udp || c->is_listening || c->is_resolving || c->is_arplooking ||
+          c->is_connecting) {
+        close_conn(c);
+        continue;
+      } else if (s->ttype != MIP_TTYPE_FIN) {  // active TCP: initiate closure
+        size_t tx = tx_tcp(c->mgr->ifp, s->mac, &c->loc, &c->rem, c->dscp,
+                           TH_FIN | TH_ACK, mg_htonl(s->seq), mg_htonl(s->ack),
+                           s->is_full ? 0 : MG_TCPIP_WIN, NULL, 0);
+        if (tx == (size_t) -1) {
+          s->is_closing = 1;
+        } else if (tx > 0) {
+          s->seq++;
+          settmout(c, MIP_TTYPE_FIN);
+        }  // else tx = 0, should recover later or we have worse problems
+      }
+    }
+    if (s->send_rst)  // proto_error requested TCP RST, send it and close
+      tx_tcp(c->mgr->ifp, s->mac, &c->loc, &c->rem, c->dscp, TH_RST,
+             mg_htonl(s->seq), 0, 0, NULL, 0);
+    if (s->is_closing) close_conn(c);  // then removes the conn
   }
+  mg_bsd_poll(mgr);
   (void) ms;
 }
 
@@ -2443,10 +2475,10 @@ bool mg_send(struct mg_connection *c, const void *buf, size_t len) {
   struct mg_tcpip_if *ifp = c->mgr->ifp;
   bool res = false;
   if (!c->loc.is_ip6 && (ifp->ip == 0 || ifp->state != MG_TCPIP_STATE_READY)) {
-    mg_error(c, "net down");
+    proto_error(c, false, "net down");
 #if MG_ENABLE_IPV6
   } else if (c->loc.is_ip6 && ifp->state6 != MG_TCPIP_STATE_READY) {
-    mg_error(c, "net down");
+    proto_error(c, false, "net down");
 #endif
   } else if (c->is_udp && (c->is_arplooking || c->is_resolving)) {
     // Fail to send, no target MAC or IP
@@ -2480,10 +2512,31 @@ static void setdns4(struct mg_tcpip_if *ifp, uint32_t *ip) {
   MG_DEBUG(("Set DNS URL to %s", dnsc->url));
   if (ifp->mgr->use_dns6) return;
   if (dnsc->c != NULL) mg_close_conn(dnsc->c);
-  if (!mg_dnsc_init(ifp->mgr, dnsc))  // create DNS connection
-    MG_ERROR(("DNS connection creation failed"));
 }
 
+static void conndns4(struct mg_tcpip_if *ifp, uint32_t ip) {
+  struct mg_connection *c;
+  struct mg_dns *dnsc = &ifp->mgr->dns4;
+  if (ifp->mgr->use_dns6) return;
+  if ((c = mg_alloc_conn(ifp->mgr)) == NULL) {
+    MG_ERROR(("OOM, DNS connection creation failed"));
+    return;
+  } // mg_connect_svc() would block us, so we bypass it here
+  LIST_ADD_HEAD(struct mg_connection, &ifp->mgr->conns, c);
+  c->is_udp = true;
+  c->fd = (void *) (size_t) MG_INVALID_SOCKET;
+  c->is_client = true;
+  dnsc->c = c;
+  mg_call(c, MG_EV_OPEN, (void *) dnsc->url);
+  MG_DEBUG(("%lu %ld %s", c->id, c->fd, dnsc->url));
+  c->rem.addr.ip4 = ip;
+  c->rem.port = mg_htons(53);
+  mg_connect_resolved(c);
+  mg_dnsc_init(ifp->mgr, dnsc); // will fill c->pfn = dns_cb
+}
+
+
+
 void mg_tcpip_mapip(struct mg_connection *c, struct mg_addr *ip) {
   struct connstate *s = (struct connstate *) (c + 1);
   uint8_t *l2addr = tcpip_mapip(c->mgr->ifp, ip);

src/ota.c

@@ -13,7 +13,7 @@
 
 // Scannable version tag embedded in every firmware binary, for server-side
 // version extraction. The version string starts after the "MG_VERSION:" prefix.
-static const char s_fw_version[] = "MG_VERSION:" MG_OTA_FIRMWARE_VERSION;
+static const char s_fw_version[] = "MG_VERSION:" MG_FIRMWARE_VERSION;
 
 static bool s_autocommit_ok;  // True after OTA server confirms "same version"
 
@@ -23,6 +23,9 @@ static struct mg_ota_state {
   size_t size;
   uint8_t sha256[32];
   void (*fn)(const char *error_message);
+  size_t received;  // Firmware bytes written so far
+  bool open;        // mg_ota_begin() succeeded, mg_ota_end() is pending
+  const char *err;  // First error during download, NULL if none
 } *s_ota;
 
 static void s_firmware_fn(struct mg_connection *c, int ev, void *ev_data);
@@ -143,11 +146,38 @@ static void status_fn(const char *errmsg) {
   if (errmsg) MG_ERROR(("OTA failed: %s", errmsg));
 }
 
-static void status_fn_2(struct mg_connection *c, const char *errmsg) {
+// Firmware download callback for mg_http_stream_body(). Writes chunks to the
-  if (s_ota) s_ota->fn(errmsg);
+// OTA target and reports the result via s_ota->fn(). The end call also happens
+// when the connection drops before the whole body arrived.
+static bool s_firmware_cb(struct mg_http_message *hm, struct mg_str *data,
+                          void **p) {
+  bool finalized = false, ok;
+  (void) p;
+  if (s_ota == NULL) return false;
+  if (hm != NULL) {  // Start
+    s_ota->received = 0;
+    s_ota->open = mg_ota_begin(hm->body.len);
+    if (!s_ota->open) s_ota->err = "OTA begin failed";
+    return s_ota->open;
+  } else if (data != NULL) {  // Next chunk
+    if (!mg_ota_write(data->buf, data->len)) {
+      s_ota->err = "OTA write failed";
+      return false;
+    }
+    s_ota->received += data->len;
+    return true;
+  }
+  // End
+  if (s_ota->open) finalized = mg_ota_end();
+  if (s_ota->err == NULL && s_ota->received != s_ota->size) {
+    s_ota->err = "Connection closed";
+  }
+  if (s_ota->err == NULL && !finalized) s_ota->err = "OTA finalize failed";
+  ok = s_ota->err == NULL;
+  s_ota->fn(s_ota->err);
   mg_free(s_ota);
   s_ota = NULL;
-  mg_http_reply(c, errmsg ? 500 : 200, "", "%s\n", errmsg ? errmsg : "ok");
+  return ok;
 }
 
 static void s_firmware_fn(struct mg_connection *c, int ev, void *ev_data) {
@@ -178,7 +208,9 @@ static void s_firmware_fn(struct mg_connection *c, int ev, void *ev_data) {
                (unsigned long) hm->body.len, (unsigned long) s_ota->size);
     } else {
       MG_DEBUG(("Beginning OTA (%lu bytes)", (unsigned long) s_ota->size));
-      mg_http_start_ota(c, hm, status_fn_2);
+      if (!mg_http_stream_body(c, hm, s_firmware_cb, NULL)) {
+        mg_error(c, "Cannot stream firmware");
+      }
     }
   } else if (ev == MG_EV_ERROR) {
     s_ota->fn((char *) ev_data);

src/ota.h

@@ -3,7 +3,7 @@
 // This is a low-level OTA API, not intended to be called directly by users.
 // Users are provided with a higher-level API:
 // - defining MG_OTA_URL enables HTTP or HTTPS pull-based updates
-// - mg_http_start_ota() enables push-based updates
+// - mg_http_stream_body() enables push-based updates
 //
 // However, it is possible to use the mg_ota_* API directly. Below is the
 // example code of a function that is called repeatedly. It expects the
@@ -154,7 +154,7 @@ enum {
 // needs to be defined. Fetches metadata_url, which must
 // return a JSON object like:
 // { "version": "1.2.3", "url": "FIRMWARE_URL", "size": 324645 }
-// If the server version differs from MG_OTA_FIRMWARE_VERSION, downloads
+// If the server version differs from MG_FIRMWARE_VERSION, downloads
 // FIRMWARE_URL and performs the OTA update. fn is called on every outcome:
 // NULL on successful flash, "Same version" when already up to date, or an
 // error string on failure. Pass NULL to use the default handler which logs
@@ -181,8 +181,8 @@ void mg_ota_url_check(struct mg_mgr *mgr, const char *metadata_url,
 #endif
 
 // Firmware version for mg_ota_poll(). Settable in mongoose_config.h
-#ifndef MG_OTA_FIRMWARE_VERSION
+#ifndef MG_FIRMWARE_VERSION
-#define MG_OTA_FIRMWARE_VERSION "1.0.0"
+#define MG_FIRMWARE_VERSION "1.0.0"
 #endif
 
 // Maximum version string length

src/ota_rw612.c

@@ -291,24 +291,22 @@ MG_IRAM static bool mg_frdm_write(void *addr, const void *buf, size_t len) {
     }
     uint32_t status;
     uint32_t dst_ofs = (uint32_t) dst - (uint32_t) s_mg_flash_frdm.start;
+    size_t tmp_buf_size = s_mg_flash_frdm.align / sizeof(uint32_t);
+    uint32_t tmp[tmp_buf_size];
     if ((char *) buf >= (char *) s_mg_flash_frdm.start &&
         (char *) buf <
             (char *) (s_mg_flash_frdm.start + s_mg_flash_frdm.size)) {
       // If we copy from FLASH to FLASH, then we first need to copy the source
       // to RAM
-      size_t tmp_buf_size = s_mg_flash_frdm.align / sizeof(uint32_t);
-      uint32_t tmp[tmp_buf_size];
-
       for (size_t i = 0; i < tmp_buf_size; i++) {
         flash_wait();
         tmp[i] = src[i];
       }
-      status = flexspi_nor->page_program(MG_FLEXSPI_NOR_INSTANCE, &config,
-                                         (uint32_t) dst_ofs, tmp, false);
     } else {
-      status = flexspi_nor->page_program(MG_FLEXSPI_NOR_INSTANCE, &config,
+      memcpy(tmp, src, sizeof(tmp));
-                                         (uint32_t) dst_ofs, src, false);
     }
+    status = flexspi_nor->page_program(MG_FLEXSPI_NOR_INSTANCE, &config,
+                                       (uint32_t) dst_ofs, tmp, false);
     src = (uint32_t *) ((char *) src + s_mg_flash_frdm.align);
     dst = (uint32_t *) ((char *) dst + s_mg_flash_frdm.align);
     if (status != 0) {

src/printf.c

@@ -71,8 +71,10 @@ char *mg_mprintf(const char *fmt, ...) {
 }
 
 void mg_pfn_stdout(char c, void *param) {
+#if MG_ENABLE_POSIX_FS
   putchar(c);
-  (void) param;
+#endif
+  (void) param, (void) c;
 }
 
 static size_t print_ip4(void (*out)(char, void *), void *arg, uint8_t *p) {

src/sntp.h

@@ -29,7 +29,6 @@ uint64_t mg_now(void);
 //     MG_INFO(("every second"));
 //   }
 // Full examples:
-//   tutorials/http/http-server/arduino/teensy41-http,
 //   tutorials/mqtt/mqtt-client
 // Related APIs:
 //   mg_millis(), mg_now()

src/sock.c

@@ -772,13 +772,8 @@ void mg_mgr_poll(struct mg_mgr *mgr, int ms) {
 
   for (c = mgr->conns; c != NULL; c = tmp) {
     long flush = 0;
-    bool is_resp = c->is_resp;
     tmp = c->next;
     mg_call(c, MG_EV_POLL, &now);
-    if (is_resp && !c->is_resp) {
-      long n = 0;
-      mg_call(c, MG_EV_READ, &n);
-    }
     MG_VERBOSE(("%lu %c%c %c%c%c%c%c %lu %lu", c->id,
                 c->is_readable ? 'r' : '-', c->is_writable ? 'w' : '-',
                 c->is_tls ? 'T' : 't', c->is_connecting ? 'C' : 'c',

src/tls.h

@@ -90,7 +90,7 @@ void mg_tls_ctx_free(struct mg_mgr *);
 #if MG_TLS == MG_TLS_BUILTIN
 // Extracts a 32-byte P-256 private scalar from EC PRIVATE KEY or PKCS#8 PRIVATE
 // KEY input. Accepts PEM or DER. Returns key size, or 0 on error.
-size_t mg_uecc_parse_private_key(struct mg_str key, uint8_t *buf, size_t len);
+size_t mg_p256_parse_private_key(struct mg_str key, uint8_t *buf, size_t len);
 #endif
 
 // Low-level IO primitives used by TLS layer

src/tls_builtin.c

@@ -6,8 +6,8 @@
 #include "tls_aes128.h"
 #include "tls_chacha20.h"
 #include "tls_rsa.h"
-#include "tls_uecc.h"
+#include "tls_p256.h"
-#include "tls_x25519.h"
+#include "tls_p384.h"
 #include "util.h"
 
 #if MG_TLS == MG_TLS_BUILTIN
@@ -61,6 +61,7 @@ enum mg_tls_hs_state {
 
   // Server state machine:
   MG_TLS_STATE_SERVER_START,       // Wait for ClientHello
+  MG_TLS_STATE_SERVER_RETRY,       // Wait for ClientHello after HelloRetry
   MG_TLS_STATE_SERVER_WAIT_CERT,   // Wait for Certificate
   MG_TLS_STATE_SERVER_WAIT_CV,     // Wait for CertificateVerify
   MG_TLS_STATE_SERVER_NEGOTIATED,  // Wait for Finish
@@ -106,8 +107,9 @@ struct tls_data {
 
   uint8_t random[32];      // client random from ClientHello
   uint8_t session_id[32];  // client session ID between the handshake states
-  uint8_t x25519_cli[32];  // client X25519 key between the handshake states
+  uint8_t p256_cli[32];    // client P-256 key between the handshake states
-  uint8_t x25519_sec[32];  // x25519 secret between the handshake states
+  uint8_t p256_peer[64];   // server: client P-256 public key X || Y
+  uint8_t ecdhe_sec[32];   // P-256 ECDHE shared secret between the states
 
   bool skip_verification;    // do not perform checks on server certificate
   bool cert_requested;       // client received a CertificateRequest
@@ -130,6 +132,9 @@ struct tls_data {
                              // verify cert
   size_t pubkeysz;           // size of the server public key
   uint8_t sighash[32];       // calculated signature verification hash
+  uint8_t sighash384[48];    // same, SHA-384, for ecdsa_secp384r1_sha384
+  uint64_t hs_start;         // mg_millis() when the handshake started
+  uint64_t hs_proc;          // ms spent processing handshake messages
 
   struct tls_enc enc;       // actual keys in use at this time
   struct tls_enc app_keys;  // storage during two-way auth handshake
@@ -321,7 +326,7 @@ static void mg_tls_derive_secret(const char *label, uint8_t *key, size_t keysz,
   memmove(hash, secret, hashsz);
 }
 
-// at this point we have x25519 shared secret, we can generate a set of derived
+// at this point we have ECDHE shared secret, we can generate a set of derived
 // handshake encryption keys
 static void mg_tls_generate_handshake_keys(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
@@ -342,8 +347,11 @@ static void mg_tls_generate_handshake_keys(struct mg_connection *c) {
   mg_tls_derive_secret("tls13 derived", early_secret, 32, zeros_sha256_digest,
                        32, pre_extract_secret, 32);
   mg_hmac_sha256(tls->enc.handshake_secret, pre_extract_secret,
-                 sizeof(pre_extract_secret), tls->x25519_sec,
+                 sizeof(pre_extract_secret), tls->ecdhe_sec,
-                 sizeof(tls->x25519_sec));
+                 sizeof(tls->ecdhe_sec));
+  // ECDHE keys and secret are not needed anymore, wipe for forward secrecy
+  mg_bzero(tls->p256_cli, sizeof(tls->p256_cli));
+  mg_bzero(tls->ecdhe_sec, sizeof(tls->ecdhe_sec));
   mg_tls_hexdump("hs secret", tls->enc.handshake_secret, 32);
 
   // mg_sha256_final is not idempotent, need to copy sha256 context to calculate
@@ -461,7 +469,7 @@ static bool mg_tls_encrypt(struct mg_connection *c, const uint8_t *msg,
       c->is_client ? tls->enc.client_write_iv : tls->enc.server_write_iv;
 
   if (msgsz > 16384) {
-    MG_ERROR(("msg longer than recordsz"));
+    mg_error(c, "msg longer than recordsz");
     return false;
   }
 
@@ -506,19 +514,20 @@ static bool mg_tls_encrypt(struct mg_connection *c, const uint8_t *msg,
 
 static void verbose_alert(uint8_t *buf) {
   uint8_t level = buf[0], desc = buf[1];
-  MG_INFO(("TLS ALERT received: level=%d, desc=%d (%s)", level, desc,
+  MG_LOG(desc == 0 ? MG_LL_VERBOSE : MG_LL_INFO,  // close_notify is normal
-           desc == 0    ? "close_notify"
+         ("TLS ALERT received: level=%d, desc=%d (%s)", level, desc,
-           : desc == 10 ? "unexpected_message"
+          desc == 0    ? "close_notify"
-           : desc == 20 ? "bad_record_mac"
+          : desc == 10 ? "unexpected_message"
-           : desc == 21 ? "decryption_failed"
+          : desc == 20 ? "bad_record_mac"
-           : desc == 40 ? "handshake_failure"
+          : desc == 21 ? "decryption_failed"
-           : desc == 42 ? "bad_certificate"
+          : desc == 40 ? "handshake_failure"
-           : desc == 43 ? "unsupported_certificate"
+          : desc == 42 ? "bad_certificate"
-           : desc == 44 ? "certificate_revoked"
+          : desc == 43 ? "unsupported_certificate"
-           : desc == 45 ? "certificate_expired"
+          : desc == 44 ? "certificate_revoked"
-           : desc == 46 ? "certificate_unknown"
+          : desc == 45 ? "certificate_expired"
-           : desc == 48 ? "unknown_ca"
+          : desc == 46 ? "certificate_unknown"
-                        : "unknown"));
+          : desc == 48 ? "unknown_ca"
+                       : "unknown"));
 }
 
 // read an encrypted record, decrypt it in place
@@ -626,8 +635,11 @@ static int mg_tls_recv_record(struct mg_connection *c) {
   return r;
 }
 
+// Hash the CertificateVerify content: SHA-256 into hash, and if hash384 is not
+// NULL, SHA-384 into hash384 for ecdsa_secp384r1_sha384
 static void mg_tls_calc_cert_verify_hash(struct mg_connection *c,
-                                         uint8_t hash[32], bool is_client) {
+                                         uint8_t hash[32], uint8_t *hash384,
+                                         bool is_client) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   uint8_t sig_content[130];
   mg_sha256_ctx sha256;
@@ -647,9 +659,11 @@ static void mg_tls_calc_cert_verify_hash(struct mg_connection *c,
   mg_sha256_init(&sha256);
   mg_sha256_update(&sha256, sig_content, sizeof(sig_content));
   mg_sha256_final(hash, &sha256);
+  if (hash384 != NULL) mg_sha384(hash384, sig_content, sizeof(sig_content));
 }
 
-// read and parse ClientHello record
+// read and parse ClientHello record. Return 0 if it has a P-256 key share,
+// 1 if it does not and HelloRetryRequest must be sent, negative otherwise
 static int mg_tls_server_recv_hello(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   struct mg_iobuf *rio = &c->rtls;
@@ -659,9 +673,13 @@ static int mg_tls_server_recv_hello(struct mg_connection *c) {
   uint16_t ext_len;
   uint8_t *ext;
   uint16_t msgsz;
+  bool have_p256 = false;
+  bool is_retry = tls->state == MG_TLS_STATE_SERVER_RETRY;
 
-  if (!mg_tls_got_record(c)) {
+  for (;;) {
-    return MG_IO_WAIT;
+    if (!mg_tls_got_record(c)) return MG_IO_WAIT;
+    if (!is_retry || rio->buf[0] != MG_TLS_CHANGE_CIPHER) break;
+    mg_tls_drop_record(c);  // compatibility mode CCS before 2nd ClientHello
   }
   if (rio->buf[0] != MG_TLS_HANDSHAKE || rio->buf[5] != MG_TLS_CLIENT_HELLO) {
     mg_error(c, "not a client hello packet");
@@ -705,16 +723,21 @@ static int mg_tls_server_recv_hello(struct mg_connection *c) {
       goto fail;
     for (k = 0; k < key_exchange_len;) {
       uint16_t m = MG_LOAD_BE16(key_exchange + k + 2);
+      uint16_t group = MG_LOAD_BE16(key_exchange + k);
       if (((uint32_t) m + k + 4) > key_exchange_len) goto fail;
-      if (m == 32 && key_exchange[k] == 0x00 && key_exchange[k + 1] == 0x1d) {
+      // secp256r1, uncompressed point 0x04 || X || Y
-        memmove(tls->x25519_cli, key_exchange + k + 4, m);
+      if (group == 0x0017 && m == 65 && key_exchange[k + 4] == 0x04) {
-        mg_tls_drop_record(c);
+        memmove(tls->p256_peer, key_exchange + k + 5, 64);
-        return 0;
+        have_p256 = true;
       }
       k += (uint16_t) (m + 4);
     }
     j += (uint16_t) (n + 4);
   }
+  if (have_p256 || !is_retry) {  // No P-256 share: ask for it, but only once
+    mg_tls_drop_record(c);
+    return have_p256 ? 0 : 1;
+  }
 fail:
   mg_error(c, "bad client hello");
   return -1;
@@ -728,58 +751,98 @@ fail:
 static bool mg_tls_server_send_hello(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   struct mg_iobuf *wio = &tls->send;
+  uint8_t hello[155], pub[65], prv[32], hdr[5] = {0x16, 0x03, 0x03, 0, 0};
+  size_t n = sizeof(hello);  // ServerHello length, including 4-byte header
 
-  // clang-format off
+  // calculate P-256 keyshare and the shared secret
-  uint8_t msg_server_hello[122] = {
+  pub[0] = 0x04;  // uncompressed point 0x04 || X || Y
-      // server hello, tls 1.2
+  if (!mg_p256_make_key(pub + 1, prv) ||
-      0x02, 0x00, 0x00, 0x76, 0x03, 0x03,
+      !mg_p256_shared_secret(tls->p256_peer, prv, tls->ecdhe_sec)) {
-      // random (32 bytes)
+    mg_bzero(prv, sizeof(prv));
-      PLACEHOLDER_32B,
-      // session ID length + session ID (32 bytes)
-      0x20, PLACEHOLDER_32B,
-#if MG_ENABLE_CHACHA20
-      // TLS_CHACHA20_POLY1305_SHA256 + no compression
-      0x13, 0x03, 0x00,
-#else
-      // TLS_AES_128_GCM_SHA256 + no compression
-      0x13, 0x01, 0x00,
-#endif
-      // extensions + keyshare
-      0x00, 0x2e, 0x00, 0x33, 0x00, 0x24, 0x00, 0x1d, 0x00, 0x20,
-      // x25519 keyshare
-      PLACEHOLDER_32B,
-      // supported versions (tls1.3 == 0x304)
-      0x00, 0x2b, 0x00, 0x02, 0x03, 0x04};
-  // clang-format on
-
-  // calculate keyshare
-  uint8_t x25519_pub[X25519_BYTES];
-  uint8_t x25519_prv[X25519_BYTES];
-  if (!mg_random(x25519_prv, sizeof(x25519_prv))) mg_error(c, "RNG");
-  if( mg_tls_x25519(x25519_pub, x25519_prv, X25519_BASE_POINT, 1) < 0 || mg_tls_x25519(tls->x25519_sec, x25519_prv, tls->x25519_cli, 1) < 0) {
     mg_error(c, "bad key");
     return false;
   }
-  mg_tls_hexdump("s x25519 sec", tls->x25519_sec, sizeof(tls->x25519_sec));
+  mg_bzero(prv, sizeof(prv));
+  mg_tls_hexdump("s ecdhe sec", tls->ecdhe_sec, sizeof(tls->ecdhe_sec));
 
-  // fill in the gaps: random + session ID + keyshare
+  hello[0] = 0x02;  // server hello, tls 1.2
-  memmove(msg_server_hello + 6, tls->random, sizeof(tls->random));
+  MG_STORE_BE24(hello + 1, n - 4);
-  memmove(msg_server_hello + 39, tls->session_id, sizeof(tls->session_id));
+  hello[4] = 0x03, hello[5] = 0x03;
-  memmove(msg_server_hello + 84, x25519_pub, sizeof(x25519_pub));
+  if (!mg_random(hello + 6, 32)) {  // server random, RFC 8446 4.1.3
+    mg_error(c, "RNG");
+    return false;
+  }
+  hello[38] = 0x20;  // session ID length + session ID (32 bytes)
+  memmove(hello + 39, tls->session_id, sizeof(tls->session_id));
+#if MG_ENABLE_CHACHA20
+  hello[71] = 0x13, hello[72] = 0x03;  // TLS_CHACHA20_POLY1305_SHA256
+#else
+  hello[71] = 0x13, hello[72] = 0x01;  // TLS_AES_128_GCM_SHA256
+#endif
+  hello[73] = 0x00;                      // no compression
+  MG_STORE_BE16(hello + 74, 65 + 14);    // extensions length
+  MG_STORE_BE16(hello + 76, 0x0033);     // key share
+  MG_STORE_BE16(hello + 78, 65 + 4);
+  MG_STORE_BE16(hello + 80, 0x0017);     // secp256r1
+  MG_STORE_BE16(hello + 82, 65);
+  memmove(hello + 84, pub, sizeof(pub));
+  memmove(hello + 149, "\x00\x2b\x00\x02\x03\x04", 6);  // tls1.3 == 0x304
+  MG_STORE_BE16(hdr + 3, n);
 
   // server hello message
-  if (mg_iobuf_add(wio, wio->len, "\x16\x03\x03\x00\x7a", 5) == 0 ||
+  if (mg_iobuf_add(wio, wio->len, hdr, sizeof(hdr)) == 0 ||
-      mg_iobuf_add(wio, wio->len, msg_server_hello, sizeof(msg_server_hello)) ==
+      mg_iobuf_add(wio, wio->len, hello, n) == 0)
-          0)
     return false;
-  mg_sha256_update(&tls->sha256, msg_server_hello, sizeof(msg_server_hello));
+  mg_sha256_update(&tls->sha256, hello, n);
 
-  // change cipher message
+  // change cipher message, unless it was already sent after HelloRetryRequest
-  if (mg_iobuf_add(wio, wio->len, "\x14\x03\x03\x00\x01\x01", 6) == 0)
+  if (tls->state != MG_TLS_STATE_SERVER_RETRY &&
+      mg_iobuf_add(wio, wio->len, "\x14\x03\x03\x00\x01\x01", 6) == 0)
     return false;
   return true;
 }
 
+// HelloRetryRequest random, SHA-256 of "HelloRetryRequest", RFC 8446 4.1.3
+static const uint8_t hrr_random[32] = {
+    0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c,
+    0x02, 0x1e, 0x65, 0xb8, 0x91, 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb,
+    0x8c, 0x5e, 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c};
+
+// put HelloRetryRequest record into wio buffer, asking for a P-256 key share.
+// Replace ClientHello in the transcript with message_hash, RFC 8446 4.4.1
+static bool mg_tls_server_send_hrr(struct mg_connection *c) {
+  struct tls_data *tls = (struct tls_data *) c->tls;
+  struct mg_iobuf *wio = &tls->send;
+  uint8_t hrr[88], hdr[5] = {0x16, 0x03, 0x03, 0, sizeof(hrr)};
+  uint8_t mh[4 + 32] = {0xfe, 0, 0, 32};  // message_hash(ClientHello1)
+
+  hrr[0] = 0x02;  // server hello, tls 1.2
+  MG_STORE_BE24(hrr + 1, sizeof(hrr) - 4);
+  hrr[4] = 0x03, hrr[5] = 0x03;
+  memmove(hrr + 6, hrr_random, sizeof(hrr_random));
+  hrr[38] = 0x20;  // session ID length + session ID (32 bytes)
+  memmove(hrr + 39, tls->session_id, sizeof(tls->session_id));
+#if MG_ENABLE_CHACHA20
+  hrr[71] = 0x13, hrr[72] = 0x03;  // TLS_CHACHA20_POLY1305_SHA256
+#else
+  hrr[71] = 0x13, hrr[72] = 0x01;  // TLS_AES_128_GCM_SHA256
+#endif
+  hrr[73] = 0x00;  // no compression
+  // extensions: supported versions tls1.3, key share secp256r1 (group only)
+  memmove(hrr + 74, "\x00\x0c\x00\x2b\x00\x02\x03\x04\x00\x33\x00\x02\x00\x17",
+          14);
+
+  mg_sha256_final(mh + 4, &tls->sha256);
+  mg_sha256_init(&tls->sha256);
+  mg_sha256_update(&tls->sha256, mh, sizeof(mh));
+  mg_sha256_update(&tls->sha256, hrr, sizeof(hrr));
+
+  // HelloRetryRequest message, followed by change cipher message
+  return mg_iobuf_add(wio, wio->len, hdr, sizeof(hdr)) != 0 &&
+         mg_iobuf_add(wio, wio->len, hrr, sizeof(hrr)) != 0 &&
+         mg_iobuf_add(wio, wio->len, "\x14\x03\x03\x00\x01\x01", 6) != 0;
+}
+
 static bool mg_tls_server_send_ext(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   // server extensions
@@ -788,10 +851,11 @@ static bool mg_tls_server_send_ext(struct mg_connection *c) {
   return mg_tls_encrypt(c, ext, sizeof(ext), MG_TLS_HANDSHAKE);
 }
 
-// signature algorithms we actually support:
+// signature algorithms we actually support: ecdsa_secp256r1_sha256,
-// rsa_pkcs1_sha256, rsa_pss_rsae_sha256 and ecdsa_secp256r1_sha256
+// ecdsa_secp384r1_sha384, rsa_pss_rsae_sha256, rsa_pkcs1_sha256
-static const uint8_t secp256r1_sig_algs[12] = {
+static const uint8_t secp256r1_sig_algs[] = {
-    0x00, 0x0d, 0x00, 0x08, 0x00, 0x06, 0x04, 0x03, 0x08, 0x04, 0x04, 0x01};
+    0x00, 0x0d, 0x00, 0x0a, 0x00, 0x08, 0x04, 0x03,
+    0x05, 0x03, 0x08, 0x04, 0x04, 0x01};
 
 static bool mg_tls_server_send_cert_request(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
@@ -863,28 +927,6 @@ static bool mg_tls_send_cert(struct mg_connection *c, bool is_client) {
   return res;
 }
 
-// type adapter between uECC hash context and our sha256 implementation
-typedef struct SHA256_HashContext {
-  MG_UECC_HashContext uECC;
-  mg_sha256_ctx ctx;
-} SHA256_HashContext;
-
-static void init_SHA256(const MG_UECC_HashContext *base) {
-  SHA256_HashContext *c = (SHA256_HashContext *) base;
-  mg_sha256_init(&c->ctx);
-}
-
-static void update_SHA256(const MG_UECC_HashContext *base,
-                          const uint8_t *message, unsigned message_size) {
-  SHA256_HashContext *c = (SHA256_HashContext *) base;
-  mg_sha256_update(&c->ctx, message, message_size);
-}
-static void finish_SHA256(const MG_UECC_HashContext *base,
-                          uint8_t *hash_result) {
-  SHA256_HashContext *c = (SHA256_HashContext *) base;
-  mg_sha256_final(hash_result, &c->ctx);
-}
-
 static void mg_tls_mgf1(uint8_t *mask, size_t mask_len, const uint8_t *seed,
                         size_t seed_len) {
   uint32_t counter = 0;
@@ -1071,7 +1113,7 @@ static bool mg_tls_send_cert_verify(struct mg_connection *c, bool is_client) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   uint8_t hash[32] = {0};
 
-  mg_tls_calc_cert_verify_hash(c, (uint8_t *) hash, is_client);
+  mg_tls_calc_cert_verify_hash(c, (uint8_t *) hash, NULL, is_client);
 
   if (tls->rsa.n.len > 0 && tls->rsa.d.len > 0) {
     // RSA certificate verify packet
@@ -1088,19 +1130,19 @@ static bool mg_tls_send_cert_verify(struct mg_connection *c, bool is_client) {
 
     // Check bounds
     if (emlen > sizeof(em) || verifysz > sizeof(verify)) {
-      MG_ERROR(("RSA key too large for static buffers"));
+      mg_error(c, "RSA key too large for static buffers");
       return false;
     }
 
     if (!mg_tls_pss_encode(hash, sizeof(hash), &rn, em)) {
-      MG_ERROR(("Failed PSS encode"));
+      mg_error(c, "Failed PSS encode");
       return false;
     }
 
     // Validate PSS encoded message format
     if (em[emlen - 1] != 0xbc) {
-      MG_ERROR(("Invalid PSS encoding: last byte is 0x%02x, expected 0xbc",
+      mg_error(c, "Invalid PSS encoding: last byte is 0x%02x, expected 0xbc",
-                em[emlen - 1]));
+                em[emlen - 1]);
       return false;
     }
 
@@ -1113,7 +1155,7 @@ static bool mg_tls_send_cert_verify(struct mg_connection *c, bool is_client) {
     // Sign directly into the verify buffer (verify + 8 = signature location)
     memset(verify + 8, 0, emlen);  // Initialize signature area
     if (!mg_tls_rsa_sign(tls, em, emlen, verify + 8)) {
-      MG_ERROR(("Failed RSA sign"));
+      mg_error(c, "Failed RSA sign");
       return false;
     }
 
@@ -1127,15 +1169,13 @@ static bool mg_tls_send_cert_verify(struct mg_connection *c, bool is_client) {
   } else {
     // EC certificate verify packet
     uint8_t verify[82] = {0x0f, 0x00, 0x00, 0x00, 0x04, 0x03, 0x00, 0x00};
-    uint8_t tmp[2 * 32 + 64] = {0};
-    struct SHA256_HashContext ctx = {
-        {&init_SHA256, &update_SHA256, &finish_SHA256, 64, 32, tmp},
-        {{0}, 0, 0, {0}}};
     size_t sigsz, verifysz = 0;
     int neg1, neg2;
     uint8_t sig[64] = {0};
-    mg_uecc_sign_deterministic(tls->ec_key, hash, sizeof(hash), &ctx.uECC, sig,
+    if (!mg_p256_sign(tls->ec_key, hash, sizeof(hash), sig)) {
-                               mg_uecc_secp256r1());
+      mg_error(c, "P-256 sign");
+      return false;
+    }
 
     neg1 = !!(sig[0] & 0x80);
     neg2 = !!(sig[32] & 0x80);
@@ -1198,8 +1238,6 @@ static bool mg_tls_client_send_hello(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   struct mg_iobuf *wio = &tls->send;
 
-  uint8_t x25519_pub[X25519_BYTES];
-
   // - "signature algorithms we actually support", see above
   //   uint8_t secp256r1_sig_algs[]
   // - all popular signature algorithms (if we don't care about verification)
@@ -1211,11 +1249,11 @@ static bool mg_tls_client_send_hello(struct mg_connection *c) {
                                 0xfe, 0x00, 0x00, 0xfe};
 
   // clang-format off
-  uint8_t msg_client_hello[145] = {
+  uint8_t msg_client_hello[178] = {
       // TLS Client Hello header reported as TLS1.2 (5)
-      0x16, 0x03, 0x03, 0x00, 0xfe,
+      0x16, 0x03, 0x03, 0x00, 0xd8,
       // client hello, tls 1.2 (6)
-      0x01, 0x00, 0x00, 0x8c, 0x03, 0x03,
+      0x01, 0x00, 0x00, 0xd4, 0x03, 0x03,
       // random (32 bytes)
       PLACEHOLDER_32B,
       // session ID length + session ID (32 bytes)
@@ -1232,15 +1270,15 @@ static bool mg_tls_client_send_hello(struct mg_connection *c) {
       0x01, 0x00,
       // extensions + keyshare
       0x00, 0xfe,
-      // x25519 keyshare
+      // keyshare: secp256r1, uncompressed point
-      0x00, 0x33, 0x00, 0x26, 0x00, 0x24, 0x00, 0x1d, 0x00, 0x20,
+      0x00, 0x33, 0x00, 0x47, 0x00, 0x45,
-      PLACEHOLDER_32B,
+      0x00, 0x17, 0x00, 0x41, 0x04, PLACEHOLDER_32B, PLACEHOLDER_32B,
-      // supported groups (x25519)
+      // supported groups (secp256r1)
-      0x00, 0x0a, 0x00, 0x04, 0x00, 0x02, 0x00, 0x1d,
+      0x00, 0x0a, 0x00, 0x04, 0x00, 0x02, 0x00, 0x17,
       // supported versions (tls1.3 == 0x304)
       0x00, 0x2b, 0x00, 0x03, 0x02, 0x03, 0x04,
       // session ticket (none)
-      0x00, 0x23, 0x00, 0x00, // 144 bytes till here
+      0x00, 0x23, 0x00, 0x00, // 177 bytes till here
 	};
   // clang-format on
   const char *hostname = tls->hostname;
@@ -1253,11 +1291,11 @@ static bool mg_tls_client_send_hello(struct mg_connection *c) {
 
   // patch ClientHello with correct hostname ext length (if any)
   MG_STORE_BE16(msg_client_hello + 3,
-                hostname_extsz + 183 - 9 - 34 + sig_alg_sz);
+                hostname_extsz + 216 - 9 - 34 + sig_alg_sz);
   MG_STORE_BE16(msg_client_hello + 7,
-                hostname_extsz + 179 - 9 - 34 + sig_alg_sz);
+                hostname_extsz + 212 - 9 - 34 + sig_alg_sz);
   MG_STORE_BE16(msg_client_hello + 82,
-                hostname_extsz + 104 - 9 - 34 + sig_alg_sz);
+                hostname_extsz + 137 - 9 - 34 + sig_alg_sz);
 
   if (hostnamesz > 0) {
     MG_STORE_BE16(server_name_ext + 2, hostnamesz + 5);
@@ -1265,16 +1303,20 @@ static bool mg_tls_client_send_hello(struct mg_connection *c) {
     MG_STORE_BE16(server_name_ext + 7, hostnamesz);
   }
 
-  // calculate keyshare
+  // calc+fill keyshare; X || Y, sent as an uncompressed point 0x04 || X || Y
-  if (!mg_random(tls->x25519_cli, sizeof(tls->x25519_cli))) mg_error(c, "RNG");
+  if (!mg_p256_make_key(msg_client_hello + 95, tls->p256_cli)) {
-  mg_tls_x25519(x25519_pub, tls->x25519_cli, X25519_BASE_POINT, 1);
+    mg_error(c, "P-256 key");
+    return false;
+  }
 
-  // fill in the gaps: random + session ID + keyshare
+  // fill in the gaps: random + session ID
-  if (!mg_random(tls->session_id, sizeof(tls->session_id))) mg_error(c, "RNG");
+  if (!mg_random(tls->session_id, sizeof(tls->session_id)) ||
-  if (!mg_random(tls->random, sizeof(tls->random))) mg_error(c, "RNG");
+      !mg_random(tls->random, sizeof(tls->random))) {
+    mg_error(c, "RNG");
+    return false;
+  }
   memmove(msg_client_hello + 11, tls->random, sizeof(tls->random));
   memmove(msg_client_hello + 44, tls->session_id, sizeof(tls->session_id));
-  memmove(msg_client_hello + 94, x25519_pub, sizeof(x25519_pub));
 
   // client hello message
   if (mg_iobuf_add(wio, wio->len, msg_client_hello, sizeof(msg_client_hello)) ==
@@ -1344,17 +1386,20 @@ static int mg_tls_client_recv_hello(struct mg_connection *c) {
     }
     if (ext_len2 < (2 + 2 + 32)) goto fail;
     group = MG_LOAD_BE16(ext + j + 4);
-    if (group != 0x001d) {
+    key_exchange_len = MG_LOAD_BE16(ext + j + 6);
+    key_exchange = ext + j + 8;
+    if (key_exchange_len > ext_len2 - 4) goto fail;
+    if (group != 0x0017) {  // secp256r1, uncompressed point 0x04 || X || Y
       mg_error(c, "bad key exchange group");
       return -1;
     }
-    key_exchange_len = MG_LOAD_BE16(ext + j + 6);
+    if (key_exchange_len != 65 || key_exchange[0] != 0x04 ||
-    key_exchange = ext + j + 8;
+        !mg_p256_shared_secret(key_exchange + 1, tls->p256_cli,
-    if (key_exchange_len != 32 || mg_tls_x25519(tls->x25519_sec, tls->x25519_cli, key_exchange, 1) < 0) {
+                               tls->ecdhe_sec)) {  // Validates the point
       mg_error(c, "bad key");
       return -1;
-    }    
+    }
-    mg_tls_hexdump("c x25519 sec", tls->x25519_sec, 32);
+    // mg_tls_hexdump("c ecdhe sec", tls->ecdhe_sec, 32);
     mg_tls_drop_record(c);
     /* generate handshake keys */
     mg_tls_generate_handshake_keys(c);
@@ -1619,7 +1664,7 @@ static int countdots(struct mg_str s) {
   char *p = s.buf;
   while (len--) {
     if (*(p++) == '.') ++count;
-  }    
+  }
   return count;
 }
 
@@ -1679,7 +1724,6 @@ static int mg_tls_verify_cert_signature(const struct mg_tls_cert *cert,
       MG_ERROR(("cert verification error"));
       return 0;
     }
-#if MG_UECC_SUPPORTS_secp256r1
     if (issuer->pubkey.len == 64) {
       const uint32_t N = 32;
       if (a.len > N) a.value += (a.len - N), a.len = N; // padding
@@ -1688,24 +1732,19 @@ static int mg_tls_verify_cert_signature(const struct mg_tls_cert *cert,
       memmove(sig + (N - a.len), a.value, a.len);
       memset(sig + N, 0, N - b.len);
       memmove(sig + N + (N - b.len), b.value, b.len);
-      return mg_uecc_verify((uint8_t *) issuer->pubkey.buf, cert->tbshash,
+      return mg_p256_verify((uint8_t *) issuer->pubkey.buf, cert->tbshash,
-                            (unsigned) cert->tbshashsz, sig,
+                            cert->tbshashsz, sig);
-                            mg_uecc_secp256r1());
+    } else if (issuer->pubkey.len == 96) {
-    } else
-#endif
-#if MG_UECC_SUPPORTS_secp384r1
-    if (issuer->pubkey.len == 96) {
       const uint32_t N = 48;
-      if (a.len > N) a.value += (a.len - N), a.len = N;
+      if (a.len > N) a.value += (a.len - N), a.len = N;  // padding
       if (b.len > N) b.value += (b.len - N), b.len = N;
-      memmove(sig, a.value, N);
+      memset(sig, 0, N - a.len);  // short encoding
-      memmove(sig + N, b.value, N);
+      memmove(sig + (N - a.len), a.value, a.len);
-      return mg_uecc_verify((uint8_t *) issuer->pubkey.buf, cert->tbshash,
+      memset(sig + N, 0, N - b.len);
-                            (unsigned) cert->tbshashsz, sig,
+      memmove(sig + N + (N - b.len), b.value, b.len);
-                            mg_uecc_secp384r1());
+      return mg_p384_verify((uint8_t *) issuer->pubkey.buf, cert->tbshash,
-    } else
+                            cert->tbshashsz, sig);
-#endif
+    } else {
-    {
       MG_ERROR(("unsupported public key length: %d", issuer->pubkey.len));
       return 0;
     }
@@ -1894,6 +1933,18 @@ static int mg_tls_recv_cert(struct mg_connection *c, bool is_client) {
         }  // else r = 0 or -2 => subj not found or pubkey not matching
       }
 
+      // Single CA: accept the chain if the CA itself is in it, e.g. a
+      // cross-signed copy of the root. Same subject and same public key
+      // means the same trusted key, and the links below ci are verified
+      if (tls->ca_der.len > 0 && ca.subj.len == ci->subj.len &&
+          memcmp(ca.subj.value, ci->subj.value, ca.subj.len) == 0 &&
+          ca.pubkey.len == ci->pubkey.len &&
+          memcmp(ca.pubkey.buf, ci->pubkey.buf, ca.pubkey.len) == 0) {
+        found_ca = true;
+        MG_VERBOSE(("CA found in chain at depth %d", certnum - 1));
+        break;
+      }
+
       if (certnum == sizeof(certs) / sizeof(certs[0]) - 1) {
         mg_error(c, "too many certificates in the chain");
         return -1;
@@ -1928,7 +1979,7 @@ static int mg_tls_recv_cert(struct mg_connection *c, bool is_client) {
     }
   }
   mg_tls_drop_message(c);
-  mg_tls_calc_cert_verify_hash(c, tls->sighash, !is_client);
+  mg_tls_calc_cert_verify_hash(c, tls->sighash, tls->sighash384, !is_client);
   return 0;
 }
 
@@ -1991,11 +2042,19 @@ static int mg_tls_recv_cert_verify(struct mg_connection *c) {
         return -1;
       }
       MG_VERBOSE(("certificate verification successful (RSA)"));
-    } else if (sigalg == 0x0403) {  // ecdsa_secp256r1_sha256
+    } else if (sigalg == 0x0403 || sigalg == 0x0503) {
-      // Extract certificate signature and verify it using pubkey and sighash
+      // ecdsa_secp256r1_sha256 or ecdsa_secp384r1_sha384. Extract certificate
-      uint8_t sig[64];
+      // signature and verify it using pubkey and sighash
+      bool is384 = sigalg == 0x0503;
+      uint32_t N = is384 ? 48 : 32;  // curve size: r and s are N bytes each
+      int ok;
+      uint8_t sig[96];
       struct mg_der_tlv seq, r, s;
-      memset(sig, 0, 64);
+      memset(sig, 0, sizeof(sig));
+      if (tls->pubkeysz != 2 * N) {
+        mg_error(c, "certverify scheme %04x does not match the key", sigalg);
+        return -1;
+      }
       if (mg_der_to_tlv(sigbuf, siglen, &seq) < 0) {
         mg_error(c, "verification message is not an ASN.1 DER sequence");
         return -1;
@@ -2009,15 +2068,21 @@ static int mg_tls_recv_cert_verify(struct mg_connection *c) {
         return -1;
       }
       // Integers may be padded with zeroes
-      if (r.len > 32) r.value = r.value + (r.len - 32), r.len = 32;
+      if (r.len > N) r.value = r.value + (r.len - N), r.len = N;
-      if (s.len > 32) s.value = s.value + (s.len - 32), s.len = 32;
+      if (s.len > N) s.value = s.value + (s.len - N), s.len = N;
 
-      // r or s may be shorter than 32 bytes, "right-justify" (network order)
+      // r or s may be shorter than N bytes, "right-justify" (network order)
-      memmove(sig + (32 - r.len), r.value, r.len);
+      memmove(sig + (N - r.len), r.value, r.len);
-      memmove(sig + 32 + (32 - s.len), s.value, s.len);
+      memmove(sig + N + (N - s.len), s.value, s.len);
 
-      if (mg_uecc_verify(tls->pubkey, tls->sighash, sizeof(tls->sighash), sig,
+      if (is384) {
-                         mg_uecc_secp256r1()) != 1) {
+        ok = mg_p384_verify(tls->pubkey, tls->sighash384,
+                            sizeof(tls->sighash384), sig);
+      } else {
+        ok = mg_p256_verify(tls->pubkey, tls->sighash, sizeof(tls->sighash),
+                            sig);
+      }
+      if (ok != 1) {
         mg_error(c, "failed to verify EC certificate (certverify)");
         return -1;
       }
@@ -2032,8 +2097,8 @@ static int mg_tls_recv_cert_verify(struct mg_connection *c) {
       //   0809 = rsa_pss_pss_sha256
       //   080A = rsa_pss_pss_sha384
       //   080B = rsa_pss_pss_sha512
-      MG_ERROR(("unsupported certverify signature scheme: %x of %d bytes",
+      mg_error(c, "unsupported certverify signature scheme: %x of %d bytes",
-                sigalg, siglen));
+                sigalg, siglen);
       return -1;
     }
   }
@@ -2119,16 +2184,23 @@ static bool mg_tls_client_handshake(struct mg_connection *c) {
 
 static bool mg_tls_server_handshake(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
+  int r;
   switch (tls->state) {
     case MG_TLS_STATE_SERVER_START:
-      if (mg_tls_server_recv_hello(c) < 0) break;
+    case MG_TLS_STATE_SERVER_RETRY:
+      if ((r = mg_tls_server_recv_hello(c)) < 0) break;
+      if (r == 1) {  // No P-256 key share, ask for it
+        if (!mg_tls_server_send_hrr(c)) return false;
+        tls->state = MG_TLS_STATE_SERVER_RETRY;
+        break;
+      }
       if (!mg_tls_server_send_hello(c)) return false;
       mg_tls_generate_handshake_keys(c);
       if (!mg_tls_server_send_ext(c)) return false;
       if (tls->is_twoway && !mg_tls_server_send_cert_request(c)) return false;
-      if (!mg_tls_send_cert(c, false) || !mg_tls_send_cert_verify(c, false) ||
+      if (!mg_tls_send_cert(c, false)) return false;
-          !mg_tls_server_send_finish(c))
+      if (!mg_tls_send_cert_verify(c, false)) return false;
-        return false;
+      if (!mg_tls_server_send_finish(c)) return false;
       if (tls->is_twoway) {
         // generate application keys at this point, keep using handshake keys
         struct tls_enc hs_keys = tls->enc;
@@ -2169,16 +2241,27 @@ void mg_tls_handshake(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   long n;
   bool res;
+  uint64_t t;
   if (c->is_closing) return;  // we don't clear rx buf, so ignore what's left
   if (tls->is_sntp_pending) return;
+  t = mg_millis();
   if (c->is_client) {
     // will clear is_hs when sending last chunk
     res = mg_tls_client_handshake(c);
   } else {
     res = mg_tls_server_handshake(c);
   }
-  if (!res) {
+  tls->hs_proc += mg_millis() - t;
-    mg_error(c, "TLS OOM");
+  if (res && !c->is_tls_hs) {
+    // CPU: key exchange, signing, certificate verification. Wait: the rest of
+    // the total, waiting for the peer and the network
+    unsigned long total = (unsigned long) (mg_millis() - tls->hs_start);
+    unsigned long cpu = (unsigned long) tls->hs_proc;
+    MG_DEBUG(("%lu TLS handshake done in %lu ms: %lu ms CPU, %lu ms peer wait",
+              c->id, total, cpu, total > cpu ? total - cpu : 0));
+  }
+  if (!res) { // already mg_error()ed at handshake helper ?
+    if (!c->is_closing) mg_error(c, "TLS OOM"); // No, do it
     return;
   }
   while (tls->send.len > 0 &&
@@ -2595,7 +2678,7 @@ static int mg_parse_pem_certs(const struct mg_str pem, struct mg_str **ders) {
   return count;
 }
 
-size_t mg_uecc_parse_private_key(struct mg_str key, uint8_t *buf, size_t len) {
+size_t mg_p256_parse_private_key(struct mg_str key, uint8_t *buf, size_t len) {
   struct mg_str der = mg_str_n(NULL, 0);
   size_t n = 0;
   if (buf == NULL || len < 32) return 0;
@@ -2635,6 +2718,7 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
     mg_error(c, "tls oom");
     return;
   }
+  tls->hs_start = mg_millis();
 
   tls->state =
       c->is_client ? MG_TLS_STATE_CLIENT_START : MG_TLS_STATE_SERVER_START;
@@ -2678,7 +2762,7 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
     if (!c->is_client) tls->is_twoway = true;  // server + CA: two-way auth
   }
 
-  if (opts->cert.buf == NULL) {
+  if (opts->cert.buf == NULL || opts->cert.len == 0) {
     MG_VERBOSE(("No certificate provided"));
     goto xit;
   }
@@ -2707,7 +2791,7 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
   }
 
   // parse PEM or DER EC key
-  if (opts->key.buf == NULL) {
+  if (opts->key.buf == NULL || opts->key.len == 0) {
     mg_error(c, "Certificate provided without a private key");
     return;
   }
@@ -2758,7 +2842,7 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
         MG_INFO(("Parsed PKCS#8 RSA private key: %d bytes", (int) key.len));
       } else {
         mg_free((void *) key.buf);
-        MG_INFO(("Parsed PKCS#8 EC private key"));
+        MG_VERBOSE(("Parsed PKCS#8 EC private key"));
       }
     } else {
       mg_free((void *) key.buf);
@@ -2809,6 +2893,7 @@ void mg_tls_free(struct mg_connection *c) {
     }
     mg_free((void *) tls->ca_der.buf);
     mg_free((void *) tls->rsa_key_der.buf);
+    mg_bzero((unsigned char *) tls, sizeof(*tls));  // Wipe keys and secrets
   }
   mg_free(c->tls);
   c->tls = NULL;
@@ -2819,11 +2904,15 @@ long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) {
   long n = MG_IO_WAIT;
   bool was_throttled = c->is_tls_throttled;  // see #3074
   if (!was_throttled) {                      // encrypt new data
+    size_t i, rs = MG_TLS_RECORD_SIZE > 16384 ? 16384 : MG_TLS_RECORD_SIZE;
     if (len > MG_IO_SIZE) len = MG_IO_SIZE;
-    if (len > 16384) len = 16384;
+    for (i = 0; i < len; i += rs) {  // Split into records, send them at once
-    if (!mg_tls_encrypt(c, (const uint8_t *) buf, len, MG_TLS_APP_DATA))
+      size_t m = len - i < rs ? len - i : rs;
-      return 0;  // returning 0 means an OOM condition (iobuf couldn't resize),
+      if (!mg_tls_encrypt(c, (const uint8_t *) buf + i, m, MG_TLS_APP_DATA))
-                 // yet this is so far recoverable, let the caller decide
+        return 0;  // returning 0 means an OOM condition (iobuf couldn't
+                   // resize), yet this is so far recoverable, let the caller
+                   // decide
+    }
   }  // else, resend outstanding encrypted data in tls->send
   while (tls->send.len > 0 &&
          (n = mg_io_send(c, tls->send.buf, tls->send.len)) > 0) {

src/tls_chacha20.c

@@ -60,9 +60,6 @@ static PORTABLE_8439_DECL void poly1305_finish(poly1305_context *ctx,
 // ******* END:   poly1305-donna/poly1305-donna.h ********
 // ******* BEGIN: chacha-portable.c ********
 
-#include <assert.h>
-#include <string.h>
-
 // this is a fresh implementation of chacha20, based on the description in
 // rfc8349 it's such a nice compact algorithm that it is easy to do. In
 // relationship to other c implementation this implementation:

src/tls_p256.h

@@ -0,0 +1,181 @@
+// P-256 API, mg_p256_*(), used by built-in TLS, JWT and OTA. Implemented by
+// BearSSL code below (MG_P256=MG_P256_BEAR) or tls_p256_cortex.c (LENNGREN)
+// BearSSL code: https://bearssl.org commit 7bea48e. Shared bignum and ECDSA
+// code is always compiled, it is also used by P-384, see tls_p384.c
+//
+// Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
+// Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+//
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+// BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+// ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+//
+// Mongoose changes: br_ / BR_ names are prefixed with mg_ / MG_, as are the
+// constant-time helpers from inner.h (NOT, MUX, EQ, ...). Structs are not
+// typedef-ed. ECDSA signing takes the caller's k instead of HMAC-DRBG, k is
+// computed by mg_p256_sign() (RFC 6979). ECDSA functions take the curve id and
+// public key directly
+#pragma once
+
+#include "arch.h"
+#include "config.h"
+#include "str.h"
+#include "tls.h"
+
+#if MG_TLS == MG_TLS_BUILTIN || defined(MG_OTA_PUBLIC_KEY)
+
+#define MG_BR_EC_secp256r1 23  // Curve IDs, same as TLS named groups
+#define MG_BR_EC_secp384r1 24
+#define MG_BR_MAX_EC_SIZE 384  // Largest supported curve, bits
+
+// From BearSSL inc/bearssl_ec.h: an EC implementation
+struct mg_br_ec_impl {
+  uint32_t supported_curves;  // Bit mask of curve IDs
+  const unsigned char *(*generator)(int curve, size_t *len);
+  const unsigned char *(*order)(int curve, size_t *len);
+  size_t (*xoff)(int curve, size_t *len);
+  uint32_t (*mul)(unsigned char *G, size_t Glen, const unsigned char *x,
+                  size_t xlen, int curve);
+  size_t (*mulgen)(unsigned char *R, const unsigned char *x, size_t xlen,
+                   int curve);
+  uint32_t (*muladd)(unsigned char *A, const unsigned char *B, size_t len,
+                     const unsigned char *x, size_t xlen,
+                     const unsigned char *y, size_t ylen, int curve);
+};
+
+// From BearSSL src/inner.h: constant-time helpers
+static inline uint32_t MG_BR_NOT(uint32_t ctl) {
+  return ctl ^ 1;
+}
+static inline uint32_t MG_BR_MUX(uint32_t ctl, uint32_t x, uint32_t y) {
+  return y ^ (-ctl & (x ^ y));
+}
+static inline uint32_t MG_BR_EQ(uint32_t x, uint32_t y) {
+  uint32_t q = x ^ y;
+  return MG_BR_NOT((q | -q) >> 31);
+}
+static inline uint32_t MG_BR_NEQ(uint32_t x, uint32_t y) {
+  uint32_t q = x ^ y;
+  return (q | -q) >> 31;
+}
+static inline uint32_t MG_BR_GT(uint32_t x, uint32_t y) {
+  uint32_t z = y - x;
+  return (z ^ ((x ^ y) & (x ^ z))) >> 31;
+}
+#define MG_BR_GE(x, y) MG_BR_NOT(MG_BR_GT(y, x))
+#define MG_BR_LT(x, y) MG_BR_GT(y, x)
+static inline int32_t MG_BR_CMP(uint32_t x, uint32_t y) {
+  return (int32_t) MG_BR_GT(x, y) | -(int32_t) MG_BR_GT(y, x);
+}
+static inline uint32_t MG_BR_BIT_LENGTH(uint32_t x) {
+  uint32_t k, c;
+  k = MG_BR_NEQ(x, 0);
+  c = MG_BR_GT(x, 0xFFFF), x = MG_BR_MUX(c, x >> 16, x), k += c << 4;
+  c = MG_BR_GT(x, 0x00FF), x = MG_BR_MUX(c, x >> 8, x), k += c << 3;
+  c = MG_BR_GT(x, 0x000F), x = MG_BR_MUX(c, x >> 4, x), k += c << 2;
+  c = MG_BR_GT(x, 0x0003), x = MG_BR_MUX(c, x >> 2, x), k += c << 1;
+  k += MG_BR_GT(x, 0x0001);
+  return k;
+}
+#define MG_BR_MUL31(x, y) ((uint64_t) (x) * (uint64_t) (y))
+#define MG_BR_MUL31_lo(x, y) \
+  (((uint32_t) (x) * (uint32_t) (y)) & (uint32_t) 0x7FFFFFFF)
+#define MG_BR_CCOPY mg_br_ccopy
+void mg_br_ccopy(uint32_t ctl, void *dst, const void *src, size_t len);
+uint32_t mg_br_divrem(uint32_t hi, uint32_t lo, uint32_t d, uint32_t *r);
+static inline uint32_t mg_br_rem(uint32_t hi, uint32_t lo, uint32_t d) {
+  uint32_t r;
+  mg_br_divrem(hi, lo, d, &r);
+  return r;
+}
+static inline uint32_t mg_br_div(uint32_t hi, uint32_t lo, uint32_t d) {
+  uint32_t r;
+  return mg_br_divrem(hi, lo, d, &r);
+}
+static inline void mg_br_enc32be(void *dst, uint32_t x) {
+  unsigned char *buf = (unsigned char *) dst;
+  buf[0] = (unsigned char) (x >> 24), buf[1] = (unsigned char) (x >> 16);
+  buf[2] = (unsigned char) (x >> 8), buf[3] = (unsigned char) x;
+}
+static inline void mg_br_i31_zero(uint32_t *x, uint32_t bit_len) {
+  *x++ = bit_len;
+  memset(x, 0, ((bit_len + 31) >> 5) * sizeof *x);
+}
+
+// Big integers, "i31" format, see BearSSL src/inner.h
+uint32_t mg_br_i31_add(uint32_t *a, const uint32_t *b, uint32_t ctl);
+uint32_t mg_br_i31_sub(uint32_t *a, const uint32_t *b, uint32_t ctl);
+uint32_t mg_br_i31_bit_length(uint32_t *x, size_t xlen);
+uint32_t mg_br_i31_decode_mod(uint32_t *x, const void *src, size_t len,
+                              const uint32_t *m);
+void mg_br_i31_decode(uint32_t *x, const void *src, size_t len);
+void mg_br_i31_encode(void *dst, size_t len, const uint32_t *x);
+void mg_br_i31_from_monty(uint32_t *x, const uint32_t *m, uint32_t m0i);
+void mg_br_i31_to_monty(uint32_t *x, const uint32_t *m);
+uint32_t mg_br_i31_iszero(const uint32_t *x);
+void mg_br_i31_modpow(uint32_t *x, const unsigned char *e, size_t elen,
+                      const uint32_t *m, uint32_t m0i, uint32_t *t1,
+                      uint32_t *t2);
+void mg_br_i31_montymul(uint32_t *d, const uint32_t *x, const uint32_t *y,
+                        const uint32_t *m, uint32_t m0i);
+void mg_br_i31_muladd_small(uint32_t *x, uint32_t z, const uint32_t *m);
+uint32_t mg_br_i31_ninv31(uint32_t x);
+void mg_br_i31_rshift(uint32_t *x, int count);
+
+// ECDSA, see BearSSL src/ec/ecdsa_i31_*.c. q is an uncompressed point
+void mg_br_ecdsa_i31_bits2int(uint32_t *x, const void *src, size_t len,
+                              uint32_t ebitlen);
+uint32_t mg_br_ecdsa_i31_vrfy_raw(const struct mg_br_ec_impl *impl, int curve,
+                                  const void *hash, size_t hash_len,
+                                  const unsigned char *q, size_t qlen,
+                                  const void *sig, size_t sig_len);
+size_t mg_br_ecdsa_i31_sign_raw(const struct mg_br_ec_impl *impl, int curve,
+                                const void *hash, size_t hash_len,
+                                const unsigned char *x, size_t xlen,
+                                const unsigned char *k, void *sig);
+
+// P-256 (secp256r1) API. Keys and signatures are big endian byte strings,
+// a public key is X || Y, a signature is r || s. Functions return 1 on
+// success, 0 on failure
+
+// Generate a random key pair, using mg_random()
+int mg_p256_make_key(uint8_t public_key[64], uint8_t private_key[32]);
+
+// Compute public key from a private key. Return 0 if private key is invalid
+int mg_p256_compute_public_key(const uint8_t private_key[32],
+                               uint8_t public_key[64]);
+
+// ECDH. Validates the peer public key, returns 0 if it is not on the curve
+int mg_p256_shared_secret(const uint8_t public_key[64],
+                          const uint8_t private_key[32], uint8_t secret[32]);
+
+// ECDSA sign with a deterministic k, RFC 6979 with HMAC-SHA256
+int mg_p256_sign(const uint8_t private_key[32], const uint8_t *hash,
+                 size_t hash_size, uint8_t signature[64]);
+
+// ECDSA verify. Validates the public key
+int mg_p256_verify(const uint8_t public_key[64], const uint8_t *hash,
+                   size_t hash_size, const uint8_t signature[64]);
+
+// Internal: ECDSA sign with a given k, 32 bytes big endian, in [1, n-1].
+// Provided by the selected implementation, used by mg_p256_sign()
+int mg_p256_sign_with_k(const uint8_t private_key[32], const uint8_t *hash,
+                        size_t hash_size, const uint8_t k[32],
+                        uint8_t signature[64]);
+#endif  // MG_TLS == MG_TLS_BUILTIN || defined(MG_OTA_PUBLIC_KEY)

src/tls_p384.c

@@ -0,0 +1,834 @@
+// P-384 from BearSSL, https://bearssl.org commit 7bea48e
+// P-384 signature verification, used by built-in TLS for certificates and
+// CertificateVerify. Shared bignum and ECDSA code is in tls_p256.c
+//
+// Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+//
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+// BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+// ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+//
+// Mongoose changes: br_ / BR_ names are prefixed with mg_ / MG_, static
+// functions with p384_. Trimmed to P-384. Structs are not typedef-ed
+
+#include "tls_p384.h"
+#include "tls_p256.h"
+
+#if MG_TLS == MG_TLS_BUILTIN || defined(MG_OTA_PUBLIC_KEY)
+
+// From BearSSL src/ec/ec_secp384r1.c
+static const unsigned char P384_N[] = {
+	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
+	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
+	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
+	0xC7, 0x63, 0x4D, 0x81, 0xF4, 0x37, 0x2D, 0xDF, 
+	0x58, 0x1A, 0x0D, 0xB2, 0x48, 0xB0, 0xA7, 0x7A, 
+	0xEC, 0xEC, 0x19, 0x6A, 0xCC, 0xC5, 0x29, 0x73
+};
+
+static const unsigned char P384_G[] = {
+	0x04, 0xAA, 0x87, 0xCA, 0x22, 0xBE, 0x8B, 0x05,
+	0x37, 0x8E, 0xB1, 0xC7, 0x1E, 0xF3, 0x20, 0xAD,
+	0x74, 0x6E, 0x1D, 0x3B, 0x62, 0x8B, 0xA7, 0x9B,
+	0x98, 0x59, 0xF7, 0x41, 0xE0, 0x82, 0x54, 0x2A,
+	0x38, 0x55, 0x02, 0xF2, 0x5D, 0xBF, 0x55, 0x29,
+	0x6C, 0x3A, 0x54, 0x5E, 0x38, 0x72, 0x76, 0x0A,
+	0xB7, 0x36, 0x17, 0xDE, 0x4A, 0x96, 0x26, 0x2C,
+	0x6F, 0x5D, 0x9E, 0x98, 0xBF, 0x92, 0x92, 0xDC,
+	0x29, 0xF8, 0xF4, 0x1D, 0xBD, 0x28, 0x9A, 0x14,
+	0x7C, 0xE9, 0xDA, 0x31, 0x13, 0xB5, 0xF0, 0xB8,
+	0xC0, 0x0A, 0x60, 0xB1, 0xCE, 0x1D, 0x7E, 0x81,
+	0x9D, 0x7A, 0x43, 0x1D, 0x7C, 0x90, 0xEA, 0x0E,
+	0x5F
+};
+
+
+// From BearSSL src/ec/ec_prime_i31.c
+/*
+ * Parameters for supported curves (field modulus, and 'b' equation
+ * parameter; both values use the 'i31' format, and 'b' is in Montgomery
+ * representation).
+ */
+
+static const uint32_t P384_P[] = {
+	0x0000018C,
+	0x7FFFFFFF, 0x00000001, 0x00000000, 0x7FFFFFF8,
+	0x7FFFFFEF, 0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF,
+	0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF,
+	0x00000FFF
+};
+
+static const uint32_t P384_R2[] = {
+	0x0000018C,
+	0x00000000, 0x00000080, 0x7FFFFE00, 0x000001FF,
+	0x00000800, 0x00000000, 0x7FFFE000, 0x00001FFF,
+	0x00008000, 0x00008000, 0x00000000, 0x00000000,
+	0x00000000
+};
+
+static const uint32_t P384_B[] = {
+	0x0000018C,
+	0x6E666840, 0x070D0392, 0x5D810231, 0x7651D50C,
+	0x17E218D6, 0x1B192002, 0x44EFE441, 0x3A524E2B,
+	0x2719BA5F, 0x41F02209, 0x36C5643E, 0x5813EFFE,
+	0x000008A5
+};
+
+struct p384_curve_params {
+	const uint32_t *p;
+	const uint32_t *b;
+	const uint32_t *R2;
+	uint32_t p0i;
+	size_t point_len;
+};
+
+static inline const struct p384_curve_params *
+p384_id_to_curve(int curve)
+{
+	static const struct p384_curve_params pp = {
+		P384_P, P384_B, P384_R2, 0x00000001,  97
+	};
+
+	(void)curve;
+	return &pp;
+}
+
+#define I31_LEN   ((MG_BR_MAX_EC_SIZE + 61) / 31)
+
+/*
+ * Type for a point in Jacobian coordinates:
+ * -- three values, x, y and z, in Montgomery representation
+ * -- affine coordinates are X = x / z^2 and Y = y / z^3
+ * -- for the point at infinity, z = 0
+ */
+struct p384_jacobian {
+	uint32_t c[3][I31_LEN];
+};
+
+/*
+ * We use a custom interpreter that uses a dozen registers, and
+ * only six operations:
+ *    MSET(d, a)       copy a into d
+ *    MADD(d, a)       d = d+a (modular)
+ *    MSUB(d, a)       d = d-a (modular)
+ *    MMUL(d, a, b)    d = a*b (Montgomery multiplication)
+ *    MINV(d, a, b)    invert d modulo p; a and b are used as scratch registers
+ *    MTZ(d)           clear return value if d = 0
+ * Destination of MMUL (d) must be distinct from operands (a and b).
+ * There is no such constraint for MSUB and MADD.
+ *
+ * Registers include the operand coordinates, and temporaries.
+ */
+#define MSET(d, a)      (0x0000 + ((d) << 8) + ((a) << 4))
+#define MADD(d, a)      (0x1000 + ((d) << 8) + ((a) << 4))
+#define MSUB(d, a)      (0x2000 + ((d) << 8) + ((a) << 4))
+#define MMUL(d, a, b)   (0x3000 + ((d) << 8) + ((a) << 4) + (b))
+#define MINV(d, a, b)   (0x4000 + ((d) << 8) + ((a) << 4) + (b))
+#define MTZ(d)          (0x5000 + ((d) << 8))
+#define ENDCODE         0
+
+/*
+ * Registers for the input operands.
+ */
+#define P1x    0
+#define P1y    1
+#define P1z    2
+#define P2x    3
+#define P2y    4
+#define P2z    5
+
+/*
+ * Alternate names for the first input operand.
+ */
+#define Px     0
+#define Py     1
+#define Pz     2
+
+/*
+ * Temporaries.
+ */
+#define t1     6
+#define t2     7
+#define t3     8
+#define t4     9
+#define t5    10
+#define t6    11
+#define t7    12
+
+/*
+ * Extra scratch registers available when there is no second operand (e.g.
+ * for "double" and "affine").
+ */
+#define t8     3
+#define t9     4
+#define t10    5
+
+/*
+ * Doubling formulas are:
+ *
+ *   s = 4*x*y^2
+ *   m = 3*(x + z^2)*(x - z^2)
+ *   x' = m^2 - 2*s
+ *   y' = m*(s - x') - 8*y^4
+ *   z' = 2*y*z
+ *
+ * If y = 0 (P has order 2) then this yields infinity (z' = 0), as it
+ * should. This case should not happen anyway, because our curves have
+ * prime order, and thus do not contain any point of order 2.
+ *
+ * If P is infinity (z = 0), then again the formulas yield infinity,
+ * which is correct. Thus, this code works for all points.
+ *
+ * Cost: 8 multiplications
+ */
+static const uint16_t p384_code_double[] = {
+	/*
+	 * Compute z^2 (in t1).
+	 */
+	MMUL(t1, Pz, Pz),
+
+	/*
+	 * Compute x-z^2 (in t2) and then x+z^2 (in t1).
+	 */
+	MSET(t2, Px),
+	MSUB(t2, t1),
+	MADD(t1, Px),
+
+	/*
+	 * Compute m = 3*(x+z^2)*(x-z^2) (in t1).
+	 */
+	MMUL(t3, t1, t2),
+	MSET(t1, t3),
+	MADD(t1, t3),
+	MADD(t1, t3),
+
+	/*
+	 * Compute s = 4*x*y^2 (in t2) and 2*y^2 (in t3).
+	 */
+	MMUL(t3, Py, Py),
+	MADD(t3, t3),
+	MMUL(t2, Px, t3),
+	MADD(t2, t2),
+
+	/*
+	 * Compute x' = m^2 - 2*s.
+	 */
+	MMUL(Px, t1, t1),
+	MSUB(Px, t2),
+	MSUB(Px, t2),
+
+	/*
+	 * Compute z' = 2*y*z.
+	 */
+	MMUL(t4, Py, Pz),
+	MSET(Pz, t4),
+	MADD(Pz, t4),
+
+	/*
+	 * Compute y' = m*(s - x') - 8*y^4. Note that we already have
+	 * 2*y^2 in t3.
+	 */
+	MSUB(t2, Px),
+	MMUL(Py, t1, t2),
+	MMUL(t4, t3, t3),
+	MSUB(Py, t4),
+	MSUB(Py, t4),
+
+	ENDCODE
+};
+
+/*
+ * Addtions formulas are:
+ *
+ *   u1 = x1 * z2^2
+ *   u2 = x2 * z1^2
+ *   s1 = y1 * z2^3
+ *   s2 = y2 * z1^3
+ *   h = u2 - u1
+ *   r = s2 - s1
+ *   x3 = r^2 - h^3 - 2 * u1 * h^2
+ *   y3 = r * (u1 * h^2 - x3) - s1 * h^3
+ *   z3 = h * z1 * z2
+ *
+ * If both P1 and P2 are infinity, then z1 == 0 and z2 == 0, implying that
+ * z3 == 0, so the result is correct.
+ * If either of P1 or P2 is infinity, but not both, then z3 == 0, which is
+ * not correct.
+ * h == 0 only if u1 == u2; this happens in two cases:
+ * -- if s1 == s2 then P1 and/or P2 is infinity, or P1 == P2
+ * -- if s1 != s2 then P1 + P2 == infinity (but neither P1 or P2 is infinity)
+ *
+ * Thus, the following situations are not handled correctly:
+ * -- P1 = 0 and P2 != 0
+ * -- P1 != 0 and P2 = 0
+ * -- P1 = P2
+ * All other cases are properly computed. However, even in "incorrect"
+ * situations, the three coordinates still are properly formed field
+ * elements.
+ *
+ * The returned flag is cleared if r == 0. This happens in the following
+ * cases:
+ * -- Both points are on the same horizontal line (same Y coordinate).
+ * -- Both points are infinity.
+ * -- One point is infinity and the other is on line Y = 0.
+ * The third case cannot happen with our curves (there is no valid point
+ * on line Y = 0 since that would be a point of order 2). If the two
+ * source points are non-infinity, then remains only the case where the
+ * two points are on the same horizontal line.
+ *
+ * This allows us to detect the "P1 == P2" case, assuming that P1 != 0 and
+ * P2 != 0:
+ * -- If the returned value is not the point at infinity, then it was properly
+ * computed.
+ * -- Otherwise, if the returned flag is 1, then P1+P2 = 0, and the result
+ * is indeed the point at infinity.
+ * -- Otherwise (result is infinity, flag is 0), then P1 = P2 and we should
+ * use the 'double' code.
+ *
+ * Cost: 16 multiplications
+ */
+static const uint16_t p384_code_add[] = {
+	/*
+	 * Compute u1 = x1*z2^2 (in t1) and s1 = y1*z2^3 (in t3).
+	 */
+	MMUL(t3, P2z, P2z),
+	MMUL(t1, P1x, t3),
+	MMUL(t4, P2z, t3),
+	MMUL(t3, P1y, t4),
+
+	/*
+	 * Compute u2 = x2*z1^2 (in t2) and s2 = y2*z1^3 (in t4).
+	 */
+	MMUL(t4, P1z, P1z),
+	MMUL(t2, P2x, t4),
+	MMUL(t5, P1z, t4),
+	MMUL(t4, P2y, t5),
+
+	/*
+	 * Compute h = u2 - u1 (in t2) and r = s2 - s1 (in t4).
+	 */
+	MSUB(t2, t1),
+	MSUB(t4, t3),
+
+	/*
+	 * Report cases where r = 0 through the returned flag.
+	 */
+	MTZ(t4),
+
+	/*
+	 * Compute u1*h^2 (in t6) and h^3 (in t5).
+	 */
+	MMUL(t7, t2, t2),
+	MMUL(t6, t1, t7),
+	MMUL(t5, t7, t2),
+
+	/*
+	 * Compute x3 = r^2 - h^3 - 2*u1*h^2.
+	 * t1 and t7 can be used as scratch registers.
+	 */
+	MMUL(P1x, t4, t4),
+	MSUB(P1x, t5),
+	MSUB(P1x, t6),
+	MSUB(P1x, t6),
+
+	/*
+	 * Compute y3 = r*(u1*h^2 - x3) - s1*h^3.
+	 */
+	MSUB(t6, P1x),
+	MMUL(P1y, t4, t6),
+	MMUL(t1, t5, t3),
+	MSUB(P1y, t1),
+
+	/*
+	 * Compute z3 = h*z1*z2.
+	 */
+	MMUL(t1, P1z, P2z),
+	MMUL(P1z, t1, t2),
+
+	ENDCODE
+};
+
+/*
+ * Check that the point is on the curve. This code snippet assumes the
+ * following conventions:
+ * -- Coordinates x and y have been freshly decoded in P1 (but not
+ * converted to Montgomery coordinates yet).
+ * -- P2x, P2y and P2z are set to, respectively, R^2, b*R and 1.
+ */
+static const uint16_t p384_code_check[] = {
+
+	/* Convert x and y to Montgomery representation. */
+	MMUL(t1, P1x, P2x),
+	MMUL(t2, P1y, P2x),
+	MSET(P1x, t1),
+	MSET(P1y, t2),
+
+	/* Compute x^3 in t1. */
+	MMUL(t2, P1x, P1x),
+	MMUL(t1, P1x, t2),
+
+	/* Subtract 3*x from t1. */
+	MSUB(t1, P1x),
+	MSUB(t1, P1x),
+	MSUB(t1, P1x),
+
+	/* Add b. */
+	MADD(t1, P2y),
+
+	/* Compute y^2 in t2. */
+	MMUL(t2, P1y, P1y),
+
+	/* Compare y^2 with x^3 - 3*x + b; they must match. */
+	MSUB(t1, t2),
+	MTZ(t1),
+
+	/* Set z to 1 (in Montgomery representation). */
+	MMUL(P1z, P2x, P2z),
+
+	ENDCODE
+};
+
+/*
+ * Conversion back to affine coordinates. This code snippet assumes that
+ * the z coordinate of P2 is set to 1 (not in Montgomery representation).
+ */
+static const uint16_t p384_code_affine[] = {
+
+	/* Save z*R in t1. */
+	MSET(t1, P1z),
+
+	/* Compute z^3 in t2. */
+	MMUL(t2, P1z, P1z),
+	MMUL(t3, P1z, t2),
+	MMUL(t2, t3, P2z),
+
+	/* Invert to (1/z^3) in t2. */
+	MINV(t2, t3, t4),
+
+	/* Compute y. */
+	MSET(t3, P1y),
+	MMUL(P1y, t2, t3),
+
+	/* Compute (1/z^2) in t3. */
+	MMUL(t3, t2, t1),
+
+	/* Compute x. */
+	MSET(t2, P1x),
+	MMUL(P1x, t2, t3),
+
+	ENDCODE
+};
+
+static uint32_t
+p384_run_code(struct p384_jacobian *P1, const struct p384_jacobian *P2,
+	const struct p384_curve_params *cc, const uint16_t *code)
+{
+	uint32_t r;
+	uint32_t t[13][I31_LEN];
+	size_t u;
+
+	r = 1;
+
+	/*
+	 * Copy the two operands in the dedicated registers.
+	 */
+	memcpy(t[P1x], P1->c, 3 * I31_LEN * sizeof(uint32_t));
+	memcpy(t[P2x], P2->c, 3 * I31_LEN * sizeof(uint32_t));
+
+	/*
+	 * Run formulas.
+	 */
+	for (u = 0;; u ++) {
+		unsigned op, d, a, b;
+
+		op = code[u];
+		if (op == 0) {
+			break;
+		}
+		d = (op >> 8) & 0x0F;
+		a = (op >> 4) & 0x0F;
+		b = op & 0x0F;
+		op >>= 12;
+		switch (op) {
+			uint32_t ctl;
+			size_t plen;
+			unsigned char tp[(MG_BR_MAX_EC_SIZE + 7) >> 3];
+
+		case 0:
+			memcpy(t[d], t[a], I31_LEN * sizeof(uint32_t));
+			break;
+		case 1:
+			ctl = mg_br_i31_add(t[d], t[a], 1);
+			ctl |= MG_BR_NOT(mg_br_i31_sub(t[d], cc->p, 0));
+			mg_br_i31_sub(t[d], cc->p, ctl);
+			break;
+		case 2:
+			mg_br_i31_add(t[d], cc->p, mg_br_i31_sub(t[d], t[a], 1));
+			break;
+		case 3:
+			mg_br_i31_montymul(t[d], t[a], t[b], cc->p, cc->p0i);
+			break;
+		case 4:
+			plen = (cc->p[0] - (cc->p[0] >> 5) + 7) >> 3;
+			mg_br_i31_encode(tp, plen, cc->p);
+			tp[plen - 1] -= 2;
+			mg_br_i31_modpow(t[d], tp, plen,
+				cc->p, cc->p0i, t[a], t[b]);
+			break;
+		default:
+			r &= ~mg_br_i31_iszero(t[d]);
+			break;
+		}
+	}
+
+	/*
+	 * Copy back result.
+	 */
+	memcpy(P1->c, t[P1x], 3 * I31_LEN * sizeof(uint32_t));
+	return r;
+}
+
+static void
+p384_set_one(uint32_t *x, const uint32_t *p)
+{
+	size_t plen;
+
+	plen = (p[0] + 63) >> 5;
+	memset(x, 0, plen * sizeof *x);
+	x[0] = p[0];
+	x[1] = 0x00000001;
+}
+
+static void
+p384_point_zero(struct p384_jacobian *P, const struct p384_curve_params *cc)
+{
+	memset(P, 0, sizeof *P);
+	P->c[0][0] = P->c[1][0] = P->c[2][0] = cc->p[0];
+}
+
+static inline void
+p384_point_double(struct p384_jacobian *P, const struct p384_curve_params *cc)
+{
+	p384_run_code(P, P, cc, p384_code_double);
+}
+
+static inline uint32_t
+p384_point_add(struct p384_jacobian *P1, const struct p384_jacobian *P2, const struct p384_curve_params *cc)
+{
+	return p384_run_code(P1, P2, cc, p384_code_add);
+}
+
+static void
+p384_point_mul(struct p384_jacobian *P, const unsigned char *x, size_t xlen,
+	const struct p384_curve_params *cc)
+{
+	/*
+	 * We do a simple double-and-add ladder with a 2-bit window
+	 * to make only one add every two doublings. We thus first
+	 * precompute 2P and 3P in some local buffers.
+	 *
+	 * We always perform two doublings and one addition; the
+	 * addition is with P, 2P and 3P and is done in a temporary
+	 * array.
+	 *
+	 * The addition code cannot handle cases where one of the
+	 * operands is infinity, which is the case at the start of the
+	 * ladder. We therefore need to maintain a flag that controls
+	 * this situation.
+	 */
+	uint32_t qz;
+	struct p384_jacobian P2, P3, Q, T, U;
+
+	memcpy(&P2, P, sizeof P2);
+	p384_point_double(&P2, cc);
+	memcpy(&P3, P, sizeof P3);
+	p384_point_add(&P3, &P2, cc);
+
+	p384_point_zero(&Q, cc);
+	qz = 1;
+	while (xlen -- > 0) {
+		int k;
+
+		for (k = 6; k >= 0; k -= 2) {
+			uint32_t bits;
+			uint32_t bnz;
+
+			p384_point_double(&Q, cc);
+			p384_point_double(&Q, cc);
+			memcpy(&T, P, sizeof T);
+			memcpy(&U, &Q, sizeof U);
+			bits = (*x >> k) & (uint32_t)3;
+			bnz = MG_BR_NEQ(bits, 0);
+			MG_BR_CCOPY(MG_BR_EQ(bits, 2), &T, &P2, sizeof T);
+			MG_BR_CCOPY(MG_BR_EQ(bits, 3), &T, &P3, sizeof T);
+			p384_point_add(&U, &T, cc);
+			MG_BR_CCOPY(bnz & qz, &Q, &T, sizeof Q);
+			MG_BR_CCOPY(bnz & ~qz, &Q, &U, sizeof Q);
+			qz &= ~bnz;
+		}
+		x ++;
+	}
+	memcpy(P, &Q, sizeof Q);
+}
+
+/*
+ * Decode point into Jacobian coordinates. This function does not support
+ * the point at infinity. If the point is invalid then this returns 0, but
+ * the coordinates are still set to properly formed field elements.
+ */
+static uint32_t
+p384_point_decode(struct p384_jacobian *P, const void *src, size_t len, const struct p384_curve_params *cc)
+{
+	/*
+	 * Points must use uncompressed format:
+	 * -- first byte is 0x04;
+	 * -- coordinates X and Y use unsigned big-endian, with the same
+	 *    length as the field modulus.
+	 *
+	 * We don't support hybrid format (uncompressed, but first byte
+	 * has value 0x06 or 0x07, depending on the least significant bit
+	 * of Y) because it is rather useless, and explicitly forbidden
+	 * by PKIX (RFC 5480, section 2.2).
+	 *
+	 * We don't support compressed format either, because it is not
+	 * much used in practice (there are or were patent-related
+	 * concerns about point compression, which explains the lack of
+	 * generalised support). Also, point compression support would
+	 * need a bit more code.
+	 */
+	const unsigned char *buf;
+	size_t plen, zlen;
+	uint32_t r;
+	struct p384_jacobian Q;
+
+	buf = (const unsigned char *)src;
+	p384_point_zero(P, cc);
+	plen = (cc->p[0] - (cc->p[0] >> 5) + 7) >> 3;
+	if (len != 1 + (plen << 1)) {
+		return 0;
+	}
+	r = mg_br_i31_decode_mod(P->c[0], buf + 1, plen, cc->p);
+	r &= mg_br_i31_decode_mod(P->c[1], buf + 1 + plen, plen, cc->p);
+
+	/*
+	 * Check first byte.
+	 */
+	r &= MG_BR_EQ(buf[0], 0x04);
+	/* obsolete
+	r &= MG_BR_EQ(buf[0], 0x04) | (MG_BR_EQ(buf[0] & 0xFE, 0x06)
+		& ~(uint32_t)(buf[0] ^ buf[plen << 1]));
+	*/
+
+	/*
+	 * Convert coordinates and check that the point is valid.
+	 */
+	zlen = ((cc->p[0] + 63) >> 5) * sizeof(uint32_t);
+	memcpy(Q.c[0], cc->R2, zlen);
+	memcpy(Q.c[1], cc->b, zlen);
+	p384_set_one(Q.c[2], cc->p);
+	r &= ~p384_run_code(P, &Q, cc, p384_code_check);
+	return r;
+}
+
+/*
+ * Encode a point. This method assumes that the point is correct and is
+ * not the point at infinity. Encoded size is always 1+2*plen, where
+ * plen is the field modulus length, in bytes.
+ */
+static void
+p384_point_encode(void *dst, const struct p384_jacobian *P, const struct p384_curve_params *cc)
+{
+	unsigned char *buf;
+	uint32_t xbl;
+	size_t plen;
+	struct p384_jacobian Q, T;
+
+	buf = (unsigned char *)dst;
+	xbl = cc->p[0];
+	xbl -= (xbl >> 5);
+	plen = (xbl + 7) >> 3;
+	buf[0] = 0x04;
+	memcpy(&Q, P, sizeof *P);
+	p384_set_one(T.c[2], cc->p);
+	p384_run_code(&Q, &T, cc, p384_code_affine);
+	mg_br_i31_encode(buf + 1, plen, Q.c[0]);
+	mg_br_i31_encode(buf + 1 + plen, plen, Q.c[1]);
+}
+
+static const unsigned char *
+p384_api_generator(int curve, size_t *len)
+{
+	(void)curve;
+	*len = sizeof P384_G;
+	return P384_G;
+}
+
+static const unsigned char *
+p384_api_order(int curve, size_t *len)
+{
+	(void)curve;
+	*len = sizeof P384_N;
+	return P384_N;
+}
+
+static size_t
+p384_api_xoff(int curve, size_t *len)
+{
+	p384_api_generator(curve, len);
+	*len >>= 1;
+	return 1;
+}
+
+static uint32_t
+p384_api_mul(unsigned char *G, size_t Glen,
+	const unsigned char *x, size_t xlen, int curve)
+{
+	uint32_t r;
+	const struct p384_curve_params *cc;
+	struct p384_jacobian P;
+
+	cc = p384_id_to_curve(curve);
+	if (Glen != cc->point_len) {
+		return 0;
+	}
+	r = p384_point_decode(&P, G, Glen, cc);
+	p384_point_mul(&P, x, xlen, cc);
+	p384_point_encode(G, &P, cc);
+	return r;
+}
+
+static size_t
+p384_api_mulgen(unsigned char *R,
+	const unsigned char *x, size_t xlen, int curve)
+{
+	const unsigned char *G;
+	size_t Glen;
+
+	G = p384_api_generator(curve, &Glen);
+	memcpy(R, G, Glen);
+	p384_api_mul(R, Glen, x, xlen, curve);
+	return Glen;
+}
+
+static uint32_t
+p384_api_muladd(unsigned char *A, const unsigned char *B, size_t len,
+	const unsigned char *x, size_t xlen,
+	const unsigned char *y, size_t ylen, int curve)
+{
+	uint32_t r, t, z;
+	const struct p384_curve_params *cc;
+	struct p384_jacobian P, Q;
+
+	/*
+	 * TODO: see about merging the two ladders. Right now, we do
+	 * two independent point multiplications, which is a bit
+	 * wasteful of CPU resources (but yields short code).
+	 */
+
+	cc = p384_id_to_curve(curve);
+	if (len != cc->point_len) {
+		return 0;
+	}
+	r = p384_point_decode(&P, A, len, cc);
+	if (B == NULL) {
+		size_t Glen;
+
+		B = p384_api_generator(curve, &Glen);
+	}
+	r &= p384_point_decode(&Q, B, len, cc);
+	p384_point_mul(&P, x, xlen, cc);
+	p384_point_mul(&Q, y, ylen, cc);
+
+	/*
+	 * We want to compute P+Q. Since the base points A and B are distinct
+	 * from infinity, and the multipliers are non-zero and lower than the
+	 * curve order, then we know that P and Q are non-infinity. This
+	 * leaves two special situations to test for:
+	 * -- If P = Q then we must use p384_point_double().
+	 * -- If P+Q = 0 then we must report an error.
+	 */
+	t = p384_point_add(&P, &Q, cc);
+	p384_point_double(&Q, cc);
+	z = mg_br_i31_iszero(P.c[2]);
+
+	/*
+	 * If z is 1 then either P+Q = 0 (t = 1) or P = Q (t = 0). So we
+	 * have the following:
+	 *
+	 *   z = 0, t = 0   return P (normal addition)
+	 *   z = 0, t = 1   return P (normal addition)
+	 *   z = 1, t = 0   return Q (a 'double' case)
+	 *   z = 1, t = 1   report an error (P+Q = 0)
+	 */
+	MG_BR_CCOPY(z & ~t, &P, &Q, sizeof Q);
+	p384_point_encode(A, &P, cc);
+	r &= ~(z & t);
+
+	return r;
+}
+
+static const struct mg_br_ec_impl mg_br_ec_prime_i31 = {
+	(uint32_t)1 << MG_BR_EC_secp384r1,
+	&p384_api_generator,
+	&p384_api_order,
+	&p384_api_xoff,
+	&p384_api_mul,
+	&p384_api_mulgen,
+	&p384_api_muladd
+};
+
+// See tls_p384.h
+int mg_p384_verify(const uint8_t public_key[96], const uint8_t *hash,
+                   size_t hash_size, const uint8_t signature[96]) {
+  unsigned char q[97];
+  q[0] = 0x04;
+  memcpy(q + 1, public_key, 96);
+  return mg_br_ecdsa_i31_vrfy_raw(&mg_br_ec_prime_i31, MG_BR_EC_secp384r1, hash,
+                                  hash_size, q, sizeof(q), signature, 96) == 1;
+}
+
+// Undefine local macros, mongoose.c is one translation unit
+#undef I31_LEN
+#undef MSET
+#undef MADD
+#undef MSUB
+#undef MMUL
+#undef MINV
+#undef MTZ
+#undef ENDCODE
+#undef P1x
+#undef P1y
+#undef P1z
+#undef P2x
+#undef P2y
+#undef P2z
+#undef Px
+#undef Py
+#undef Pz
+#undef t1
+#undef t2
+#undef t3
+#undef t4
+#undef t5
+#undef t6
+#undef t7
+#undef t8
+#undef t9
+#undef t10
+#endif  // MG_TLS == MG_TLS_BUILTIN || defined(MG_OTA_PUBLIC_KEY)

src/tls_p384.h

@@ -0,0 +1,40 @@
+// P-384 from BearSSL, https://bearssl.org commit 7bea48e
+// P-384 signature verification, used by built-in TLS for certificates and
+// CertificateVerify. Shared bignum and ECDSA code is in tls_p256.c
+//
+// Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+//
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+// BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+// ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+//
+// Mongoose changes: br_ / BR_ names are prefixed with mg_ / MG_, static
+// functions with p384_. Trimmed to P-384. Structs are not typedef-ed
+#pragma once
+
+#include "arch.h"
+#include "config.h"
+#include "tls.h"
+
+#if MG_TLS == MG_TLS_BUILTIN || defined(MG_OTA_PUBLIC_KEY)
+// Verify ECDSA P-384 signature r || s over hash. Public key is X || Y.
+// Return 1 on success, 0 on failure
+int mg_p384_verify(const uint8_t public_key[96], const uint8_t *hash,
+                   size_t hash_size, const uint8_t signature[96]);
+#endif  // MG_TLS == MG_TLS_BUILTIN || defined(MG_OTA_PUBLIC_KEY)

src/tls_uecc.h

@@ -1,659 +0,0 @@
-#pragma once
-#include "arch.h"
-
-/* Copyright 2014, Kenneth MacKay. Licensed under the BSD 2-clause license. */
-
-#ifndef _UECC_H_
-#define _UECC_H_
-
-/* Platform selection options.
-If MG_UECC_PLATFORM is not defined, the code will try to guess it based on
-compiler macros. Possible values for MG_UECC_PLATFORM are defined below: */
-#define mg_uecc_arch_other 0
-#define mg_uecc_x86 1
-#define mg_uecc_x86_64 2
-#define mg_uecc_arm 3
-#define mg_uecc_arm_thumb 4
-#define mg_uecc_arm_thumb2 5
-#define mg_uecc_arm64 6
-#define mg_uecc_avr 7
-
-/* If desired, you can define MG_UECC_WORD_SIZE as appropriate for your platform
-(1, 4, or 8 bytes). If MG_UECC_WORD_SIZE is not explicitly defined then it will
-be automatically set based on your platform. */
-
-/* Optimization level; trade speed for code size.
-   Larger values produce code that is faster but larger.
-   Currently supported values are 0 - 4; 0 is unusably slow for most
-   applications. Optimization level 4 currently only has an effect ARM platforms
-   where more than one curve is enabled. */
-#ifndef MG_UECC_OPTIMIZATION_LEVEL
-#define MG_UECC_OPTIMIZATION_LEVEL 2
-#endif
-
-/* MG_UECC_SQUARE_FUNC - If enabled (defined as nonzero), this will cause a
-specific function to be used for (scalar) squaring instead of the generic
-multiplication function. This can make things faster somewhat faster, but
-increases the code size. */
-#ifndef MG_UECC_SQUARE_FUNC
-#define MG_UECC_SQUARE_FUNC 0
-#endif
-
-/* MG_UECC_VLI_NATIVE_LITTLE_ENDIAN - If enabled (defined as nonzero), this will
-switch to native little-endian format for *all* arrays passed in and out of the
-public API. This includes public and private keys, shared secrets, signatures
-and message hashes. Using this switch reduces the amount of call stack memory
-used by uECC, since less intermediate translations are required. Note that this
-will *only* work on native little-endian processors and it will treat the
-uint8_t arrays passed into the public API as word arrays, therefore requiring
-the provided byte arrays to be word aligned on architectures that do not support
-unaligned accesses. IMPORTANT: Keys and signatures generated with
-MG_UECC_VLI_NATIVE_LITTLE_ENDIAN=1 are incompatible with keys and signatures
-generated with MG_UECC_VLI_NATIVE_LITTLE_ENDIAN=0; all parties must use the same
-endianness. */
-#ifndef MG_UECC_VLI_NATIVE_LITTLE_ENDIAN
-#define MG_UECC_VLI_NATIVE_LITTLE_ENDIAN 0
-#endif
-
-/* Curve support selection. Set to 0 to remove that curve. */
-#ifndef MG_UECC_SUPPORTS_secp160r1
-#define MG_UECC_SUPPORTS_secp160r1 0
-#endif
-#ifndef MG_UECC_SUPPORTS_secp192r1
-#define MG_UECC_SUPPORTS_secp192r1 0
-#endif
-#ifndef MG_UECC_SUPPORTS_secp224r1
-#define MG_UECC_SUPPORTS_secp224r1 0
-#endif
-#ifndef MG_UECC_SUPPORTS_secp256r1
-#define MG_UECC_SUPPORTS_secp256r1 1
-#endif
-#ifndef MG_UECC_SUPPORTS_secp256k1
-#define MG_UECC_SUPPORTS_secp256k1 0
-#endif
-#ifndef MG_UECC_SUPPORTS_secp384r1
-#define MG_UECC_SUPPORTS_secp384r1 1
-#endif
-
-/* Specifies whether compressed point format is supported.
-   Set to 0 to disable point compression/decompression functions. */
-#ifndef MG_UECC_SUPPORT_COMPRESSED_POINT
-#define MG_UECC_SUPPORT_COMPRESSED_POINT 1
-#endif
-
-struct MG_UECC_Curve_t;
-typedef const struct MG_UECC_Curve_t *MG_UECC_Curve;
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#if MG_UECC_SUPPORTS_secp160r1
-MG_UECC_Curve mg_uecc_secp160r1(void);
-#endif
-#if MG_UECC_SUPPORTS_secp192r1
-MG_UECC_Curve mg_uecc_secp192r1(void);
-#endif
-#if MG_UECC_SUPPORTS_secp224r1
-MG_UECC_Curve mg_uecc_secp224r1(void);
-#endif
-#if MG_UECC_SUPPORTS_secp256r1
-MG_UECC_Curve mg_uecc_secp256r1(void);
-#endif
-#if MG_UECC_SUPPORTS_secp256k1
-MG_UECC_Curve mg_uecc_secp256k1(void);
-#endif
-#if MG_UECC_SUPPORTS_secp384r1
-MG_UECC_Curve mg_uecc_secp384r1(void);
-#endif
-
-/* MG_UECC_RNG_Function type
-The RNG function should fill 'size' random bytes into 'dest'. It should return 1
-if 'dest' was filled with random data, or 0 if the random data could not be
-generated. The filled-in values should be either truly random, or from a
-cryptographically-secure PRNG.
-
-A correctly functioning RNG is required before calling mg_uecc_make_key() or
-mg_uecc_sign().
-
-Setting a correctly functioning RNG function improves the resistance to
-side-channel attacks for mg_uecc_shared_secret() and
-mg_uecc_sign_deterministic().
-*/
-typedef int (*MG_UECC_RNG_Function)(uint8_t *dest, unsigned size);
-
-// Mongoose: mg_uecc_make_key() and mg_uecc_sign() use mg_random() when no
-// explicit uECC RNG is installed. If mg_random() cannot provide a strong source,
-// those operations fail. Deterministic signing works without RNG, but only an
-// explicit uECC RNG enables its optional side-channel blinding.
-
-/* mg_uecc_set_rng() function.
-Set the function that will be used to generate random bytes. The RNG function
-should return 1 if the random data was generated, or 0 if the random data could
-not be generated.
-
-Mongoose: this overrides the default mg_random() fallback used by
-mg_uecc_make_key() and mg_uecc_sign(). Do not call mg_uecc_set_rng() unless the
-application must provide its own cryptographic RNG.
-
-Inputs:
-    rng_function - The function that will be used to generate random bytes.
-*/
-void mg_uecc_set_rng(MG_UECC_RNG_Function rng_function);
-
-/* mg_uecc_get_rng() function.
-
-Returns the function that will be used to generate random bytes.
-*/
-MG_UECC_RNG_Function mg_uecc_get_rng(void);
-
-/* mg_uecc_curve_private_key_size() function.
-
-Returns the size of a private key for the curve in bytes.
-*/
-int mg_uecc_curve_private_key_size(MG_UECC_Curve curve);
-
-/* mg_uecc_curve_public_key_size() function.
-
-Returns the size of a public key for the curve in bytes.
-*/
-int mg_uecc_curve_public_key_size(MG_UECC_Curve curve);
-
-/* mg_uecc_make_key() function.
-Create a public/private key pair.
-
-Outputs:
-    public_key  - Will be filled in with the public key. Must be at least 2 *
-the curve size (in bytes) long. For example, if the curve is secp256r1,
-public_key must be 64 bytes long. private_key - Will be filled in with the
-private key. Must be as long as the curve order; this is typically the same as
-the curve size, except for secp160r1. For example, if the curve is secp256r1,
-private_key must be 32 bytes long.
-
-                  For secp160r1, private_key must be 21 bytes long! Note that
-the first byte will almost always be 0 (there is about a 1 in 2^80 chance of it
-being non-zero).
-
-Returns 1 if the key pair was generated successfully, 0 if an error occurred.
-*/
-int mg_uecc_make_key(uint8_t *public_key, uint8_t *private_key,
-                     MG_UECC_Curve curve);
-
-/* mg_uecc_shared_secret() function.
-Compute a shared secret given your secret key and someone else's public key. If
-the public key is not from a trusted source and has not been previously
-verified, you should verify it first using mg_uecc_valid_public_key(). Note: It
-is recommended that you hash the result of mg_uecc_shared_secret() before using
-it for symmetric encryption or HMAC.
-
-Inputs:
-    public_key  - The public key of the remote party.
-    private_key - Your private key.
-
-Outputs:
-    secret - Will be filled in with the shared secret value. Must be the same
-size as the curve size; for example, if the curve is secp256r1, secret must be
-32 bytes long.
-
-Returns 1 if the shared secret was generated successfully, 0 if an error
-occurred.
-*/
-int mg_uecc_shared_secret(const uint8_t *public_key, const uint8_t *private_key,
-                          uint8_t *secret, MG_UECC_Curve curve);
-
-#if MG_UECC_SUPPORT_COMPRESSED_POINT
-/* mg_uecc_compress() function.
-Compress a public key.
-
-Inputs:
-    public_key - The public key to compress.
-
-Outputs:
-    compressed - Will be filled in with the compressed public key. Must be at
-least (curve size + 1) bytes long; for example, if the curve is secp256r1,
-                 compressed must be 33 bytes long.
-*/
-void mg_uecc_compress(const uint8_t *public_key, uint8_t *compressed,
-                      MG_UECC_Curve curve);
-
-/* mg_uecc_decompress() function.
-Decompress a compressed public key.
-
-Inputs:
-    compressed - The compressed public key.
-
-Outputs:
-    public_key - Will be filled in with the decompressed public key.
-*/
-void mg_uecc_decompress(const uint8_t *compressed, uint8_t *public_key,
-                        MG_UECC_Curve curve);
-#endif /* MG_UECC_SUPPORT_COMPRESSED_POINT */
-
-/* mg_uecc_valid_public_key() function.
-Check to see if a public key is valid.
-
-Note that you are not required to check for a valid public key before using any
-other uECC functions. However, you may wish to avoid spending CPU time computing
-a shared secret or verifying a signature using an invalid public key.
-
-Inputs:
-    public_key - The public key to check.
-
-Returns 1 if the public key is valid, 0 if it is invalid.
-*/
-int mg_uecc_valid_public_key(const uint8_t *public_key, MG_UECC_Curve curve);
-
-/* mg_uecc_compute_public_key() function.
-Compute the corresponding public key for a private key.
-
-Inputs:
-    private_key - The private key to compute the public key for
-
-Outputs:
-    public_key - Will be filled in with the corresponding public key
-
-Returns 1 if the key was computed successfully, 0 if an error occurred.
-*/
-int mg_uecc_compute_public_key(const uint8_t *private_key, uint8_t *public_key,
-                               MG_UECC_Curve curve);
-
-/* mg_uecc_sign() function.
-Generate an ECDSA signature for a given hash value.
-
-Usage: Compute a hash of the data you wish to sign (SHA-2 is recommended) and
-pass it in to this function along with your private key.
-
-Inputs:
-    private_key  - Your private key.
-    message_hash - The hash of the message to sign.
-    hash_size    - The size of message_hash in bytes.
-
-Outputs:
-    signature - Will be filled in with the signature value. Must be at least 2 *
-curve size long. For example, if the curve is secp256r1, signature must be 64
-bytes long.
-
-Returns 1 if the signature generated successfully, 0 if an error occurred.
-*/
-int mg_uecc_sign(const uint8_t *private_key, const uint8_t *message_hash,
-                 unsigned hash_size, uint8_t *signature, MG_UECC_Curve curve);
-
-/* MG_UECC_HashContext structure.
-This is used to pass in an arbitrary hash function to
-mg_uecc_sign_deterministic(). The structure will be used for multiple hash
-computations; each time a new hash is computed, init_hash() will be called,
-followed by one or more calls to update_hash(), and finally a call to
-finish_hash() to produce the resulting hash.
-
-The intention is that you will create a structure that includes
-MG_UECC_HashContext followed by any hash-specific data. For example:
-
-typedef struct SHA256_HashContext {
-    MG_UECC_HashContext uECC;
-    SHA256_CTX ctx;
-} SHA256_HashContext;
-
-void init_SHA256(MG_UECC_HashContext *base) {
-    SHA256_HashContext *context = (SHA256_HashContext *)base;
-    SHA256_Init(&context->ctx);
-}
-
-void update_SHA256(MG_UECC_HashContext *base,
-                   const uint8_t *message,
-                   unsigned message_size) {
-    SHA256_HashContext *context = (SHA256_HashContext *)base;
-    SHA256_Update(&context->ctx, message, message_size);
-}
-
-void finish_SHA256(MG_UECC_HashContext *base, uint8_t *hash_result) {
-    SHA256_HashContext *context = (SHA256_HashContext *)base;
-    SHA256_Final(hash_result, &context->ctx);
-}
-
-... when signing ...
-{
-    uint8_t tmp[32 + 32 + 64];
-    SHA256_HashContext ctx = {{&init_SHA256, &update_SHA256, &finish_SHA256, 64,
-32, tmp}}; mg_uecc_sign_deterministic(key, message_hash, &ctx.uECC, signature);
-}
-*/
-typedef struct MG_UECC_HashContext {
-  void (*init_hash)(const struct MG_UECC_HashContext *context);
-  void (*update_hash)(const struct MG_UECC_HashContext *context,
-                      const uint8_t *message, unsigned message_size);
-  void (*finish_hash)(const struct MG_UECC_HashContext *context,
-                      uint8_t *hash_result);
-  unsigned
-      block_size; /* Hash function block size in bytes, eg 64 for SHA-256. */
-  unsigned
-      result_size; /* Hash function result size in bytes, eg 32 for SHA-256. */
-  uint8_t *tmp;    /* Must point to a buffer of at least (2 * result_size +
-                      block_size) bytes. */
-} MG_UECC_HashContext;
-
-/* mg_uecc_sign_deterministic() function.
-Generate an ECDSA signature for a given hash value, using a deterministic
-algorithm (see RFC 6979). You do not need to set the RNG using mg_uecc_set_rng()
-before calling this function; however, if the RNG is defined it will improve
-resistance to side-channel attacks.
-
-Usage: Compute a hash of the data you wish to sign (SHA-2 is recommended) and
-pass it to this function along with your private key and a hash context. Note
-that the message_hash does not need to be computed with the same hash function
-used by hash_context.
-
-Inputs:
-    private_key  - Your private key.
-    message_hash - The hash of the message to sign.
-    hash_size    - The size of message_hash in bytes.
-    hash_context - A hash context to use.
-
-Outputs:
-    signature - Will be filled in with the signature value.
-
-Returns 1 if the signature generated successfully, 0 if an error occurred.
-*/
-int mg_uecc_sign_deterministic(const uint8_t *private_key,
-                               const uint8_t *message_hash, unsigned hash_size,
-                               const MG_UECC_HashContext *hash_context,
-                               uint8_t *signature, MG_UECC_Curve curve);
-
-/* mg_uecc_verify() function.
-Verify an ECDSA signature.
-
-Usage: Compute the hash of the signed data using the same hash as the signer and
-pass it to this function along with the signer's public key and the signature
-values (r and s).
-
-Inputs:
-    public_key   - The signer's public key.
-    message_hash - The hash of the signed data.
-    hash_size    - The size of message_hash in bytes.
-    signature    - The signature value.
-
-Returns 1 if the signature is valid, 0 if it is invalid.
-*/
-int mg_uecc_verify(const uint8_t *public_key, const uint8_t *message_hash,
-                   unsigned hash_size, const uint8_t *signature,
-                   MG_UECC_Curve curve);
-
-#ifdef __cplusplus
-} /* end of extern "C" */
-#endif
-
-#endif /* _UECC_H_ */
-
-/* Copyright 2015, Kenneth MacKay. Licensed under the BSD 2-clause license. */
-
-#ifndef _UECC_TYPES_H_
-#define _UECC_TYPES_H_
-
-#ifndef MG_UECC_PLATFORM
-#if defined(__AVR__) && __AVR__
-#define MG_UECC_PLATFORM mg_uecc_avr
-#elif defined(__thumb2__) || \
-    defined(_M_ARMT) /* I think MSVC only supports Thumb-2 targets */
-#define MG_UECC_PLATFORM mg_uecc_arm_thumb2
-#elif defined(__thumb__)
-#define MG_UECC_PLATFORM mg_uecc_arm_thumb
-#elif defined(__arm__) || defined(_M_ARM)
-#define MG_UECC_PLATFORM mg_uecc_arm
-#elif defined(__aarch64__)
-#define MG_UECC_PLATFORM mg_uecc_arm64
-#elif defined(__i386__) || defined(_M_IX86) || defined(_X86_) || \
-    defined(__I86__)
-#define MG_UECC_PLATFORM mg_uecc_x86
-#elif defined(__amd64__) || defined(_M_X64)
-#define MG_UECC_PLATFORM mg_uecc_x86_64
-#else
-#define MG_UECC_PLATFORM mg_uecc_arch_other
-#endif
-#endif
-
-#ifndef MG_UECC_ARM_USE_UMAAL
-#if (MG_UECC_PLATFORM == mg_uecc_arm) && (__ARM_ARCH >= 6)
-#define MG_UECC_ARM_USE_UMAAL 1
-#elif (MG_UECC_PLATFORM == mg_uecc_arm_thumb2) && (__ARM_ARCH >= 6) && \
-    (!defined(__ARM_ARCH_7M__) || !__ARM_ARCH_7M__)
-#define MG_UECC_ARM_USE_UMAAL 1
-#else
-#define MG_UECC_ARM_USE_UMAAL 0
-#endif
-#endif
-
-#ifndef MG_UECC_WORD_SIZE
-#if MG_UECC_PLATFORM == mg_uecc_avr
-#define MG_UECC_WORD_SIZE 1
-#elif (MG_UECC_PLATFORM == mg_uecc_x86_64 || MG_UECC_PLATFORM == mg_uecc_arm64)
-#define MG_UECC_WORD_SIZE 8
-#else
-#define MG_UECC_WORD_SIZE 4
-#endif
-#endif
-
-#if (MG_UECC_WORD_SIZE != 1) && (MG_UECC_WORD_SIZE != 4) && \
-    (MG_UECC_WORD_SIZE != 8)
-#error "Unsupported value for MG_UECC_WORD_SIZE"
-#endif
-
-#if ((MG_UECC_PLATFORM == mg_uecc_avr) && (MG_UECC_WORD_SIZE != 1))
-#pragma message("MG_UECC_WORD_SIZE must be 1 for AVR")
-#undef MG_UECC_WORD_SIZE
-#define MG_UECC_WORD_SIZE 1
-#endif
-
-#if ((MG_UECC_PLATFORM == mg_uecc_arm ||         \
-      MG_UECC_PLATFORM == mg_uecc_arm_thumb ||   \
-      MG_UECC_PLATFORM == mg_uecc_arm_thumb2) && \
-     (MG_UECC_WORD_SIZE != 4))
-#pragma message("MG_UECC_WORD_SIZE must be 4 for ARM")
-#undef MG_UECC_WORD_SIZE
-#define MG_UECC_WORD_SIZE 4
-#endif
-
-typedef int8_t wordcount_t;
-typedef int16_t bitcount_t;
-typedef int8_t cmpresult_t;
-
-#if (MG_UECC_WORD_SIZE == 1)
-
-typedef uint8_t mg_uecc_word_t;
-typedef uint16_t mg_uecc_dword_t;
-
-#define HIGH_BIT_SET 0x80
-#define MG_UECC_WORD_BITS 8
-#define MG_UECC_WORD_BITS_SHIFT 3
-#define MG_UECC_WORD_BITS_MASK 0x07
-
-#elif (MG_UECC_WORD_SIZE == 4)
-
-typedef uint32_t mg_uecc_word_t;
-typedef uint64_t mg_uecc_dword_t;
-
-#define HIGH_BIT_SET 0x80000000
-#define MG_UECC_WORD_BITS 32
-#define MG_UECC_WORD_BITS_SHIFT 5
-#define MG_UECC_WORD_BITS_MASK 0x01F
-
-#elif (MG_UECC_WORD_SIZE == 8)
-
-typedef uint64_t mg_uecc_word_t;
-
-#define HIGH_BIT_SET 0x8000000000000000U
-#define MG_UECC_WORD_BITS 64
-#define MG_UECC_WORD_BITS_SHIFT 6
-#define MG_UECC_WORD_BITS_MASK 0x03F
-
-#endif /* MG_UECC_WORD_SIZE */
-
-#endif /* _UECC_TYPES_H_ */
-
-/* Copyright 2015, Kenneth MacKay. Licensed under the BSD 2-clause license. */
-
-#ifndef _UECC_VLI_H_
-#define _UECC_VLI_H_
-
-// #include "types.h"
-// #include "uECC.h"
-
-/* Functions for raw large-integer manipulation. These are only available
-   if uECC.c is compiled with MG_UECC_ENABLE_VLI_API defined to 1. */
-#ifndef MG_UECC_ENABLE_VLI_API
-#define MG_UECC_ENABLE_VLI_API 0
-#endif
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#if MG_UECC_ENABLE_VLI_API
-
-void mg_uecc_vli_clear(mg_uecc_word_t *vli, wordcount_t num_words);
-
-/* Constant-time comparison to zero - secure way to compare long integers */
-/* Returns 1 if vli == 0, 0 otherwise. */
-mg_uecc_word_t mg_uecc_vli_isZero(const mg_uecc_word_t *vli,
-                                  wordcount_t num_words);
-
-/* Returns nonzero if bit 'bit' of vli is set. */
-mg_uecc_word_t mg_uecc_vli_testBit(const mg_uecc_word_t *vli, bitcount_t bit);
-
-/* Counts the number of bits required to represent vli. */
-bitcount_t mg_uecc_vli_numBits(const mg_uecc_word_t *vli,
-                               const wordcount_t max_words);
-
-/* Sets dest = src. */
-void mg_uecc_vli_set(mg_uecc_word_t *dest, const mg_uecc_word_t *src,
-                     wordcount_t num_words);
-
-/* Constant-time comparison function - secure way to compare long integers */
-/* Returns one if left == right, zero otherwise */
-mg_uecc_word_t mg_uecc_vli_equal(const mg_uecc_word_t *left,
-                                 const mg_uecc_word_t *right,
-                                 wordcount_t num_words);
-
-/* Constant-time comparison function - secure way to compare long integers */
-/* Returns sign of left - right, in constant time. */
-cmpresult_t mg_uecc_vli_cmp(const mg_uecc_word_t *left,
-                            const mg_uecc_word_t *right, wordcount_t num_words);
-
-/* Computes vli = vli >> 1. */
-void mg_uecc_vli_rshift1(mg_uecc_word_t *vli, wordcount_t num_words);
-
-/* Computes result = left + right, returning carry. Can modify in place. */
-mg_uecc_word_t mg_uecc_vli_add(mg_uecc_word_t *result,
-                               const mg_uecc_word_t *left,
-                               const mg_uecc_word_t *right,
-                               wordcount_t num_words);
-
-/* Computes result = left - right, returning borrow. Can modify in place. */
-mg_uecc_word_t mg_uecc_vli_sub(mg_uecc_word_t *result,
-                               const mg_uecc_word_t *left,
-                               const mg_uecc_word_t *right,
-                               wordcount_t num_words);
-
-/* Computes result = left * right. Result must be 2 * num_words long. */
-void mg_uecc_vli_mult(mg_uecc_word_t *result, const mg_uecc_word_t *left,
-                      const mg_uecc_word_t *right, wordcount_t num_words);
-
-/* Computes result = left^2. Result must be 2 * num_words long. */
-void mg_uecc_vli_square(mg_uecc_word_t *result, const mg_uecc_word_t *left,
-                        wordcount_t num_words);
-
-/* Computes result = (left + right) % mod.
-   Assumes that left < mod and right < mod, and that result does not overlap
-   mod. */
-void mg_uecc_vli_modAdd(mg_uecc_word_t *result, const mg_uecc_word_t *left,
-                        const mg_uecc_word_t *right, const mg_uecc_word_t *mod,
-                        wordcount_t num_words);
-
-/* Computes result = (left - right) % mod.
-   Assumes that left < mod and right < mod, and that result does not overlap
-   mod. */
-void mg_uecc_vli_modSub(mg_uecc_word_t *result, const mg_uecc_word_t *left,
-                        const mg_uecc_word_t *right, const mg_uecc_word_t *mod,
-                        wordcount_t num_words);
-
-/* Computes result = product % mod, where product is 2N words long.
-   Currently only designed to work for mod == curve->p or curve_n. */
-void mg_uecc_vli_mmod(mg_uecc_word_t *result, mg_uecc_word_t *product,
-                      const mg_uecc_word_t *mod, wordcount_t num_words);
-
-/* Calculates result = product (mod curve->p), where product is up to
-   2 * curve->num_words long. */
-void mg_uecc_vli_mmod_fast(mg_uecc_word_t *result, mg_uecc_word_t *product,
-                           MG_UECC_Curve curve);
-
-/* Computes result = (left * right) % mod.
-   Currently only designed to work for mod == curve->p or curve_n. */
-void mg_uecc_vli_modMult(mg_uecc_word_t *result, const mg_uecc_word_t *left,
-                         const mg_uecc_word_t *right, const mg_uecc_word_t *mod,
-                         wordcount_t num_words);
-
-/* Computes result = (left * right) % curve->p. */
-void mg_uecc_vli_modMult_fast(mg_uecc_word_t *result,
-                              const mg_uecc_word_t *left,
-                              const mg_uecc_word_t *right, MG_UECC_Curve curve);
-
-/* Computes result = left^2 % mod.
-   Currently only designed to work for mod == curve->p or curve_n. */
-void mg_uecc_vli_modSquare(mg_uecc_word_t *result, const mg_uecc_word_t *left,
-                           const mg_uecc_word_t *mod, wordcount_t num_words);
-
-/* Computes result = left^2 % curve->p. */
-void mg_uecc_vli_modSquare_fast(mg_uecc_word_t *result,
-                                const mg_uecc_word_t *left,
-                                MG_UECC_Curve curve);
-
-/* Computes result = (1 / input) % mod.*/
-void mg_uecc_vli_modInv(mg_uecc_word_t *result, const mg_uecc_word_t *input,
-                        const mg_uecc_word_t *mod, wordcount_t num_words);
-
-#if MG_UECC_SUPPORT_COMPRESSED_POINT
-/* Calculates a = sqrt(a) (mod curve->p) */
-void mg_uecc_vli_mod_sqrt(mg_uecc_word_t *a, MG_UECC_Curve curve);
-#endif
-
-/* Converts an integer in uECC native format to big-endian bytes. */
-void mg_uecc_vli_nativeToBytes(uint8_t *bytes, int num_bytes,
-                               const mg_uecc_word_t *native);
-/* Converts big-endian bytes to an integer in uECC native format. */
-void mg_uecc_vli_bytesToNative(mg_uecc_word_t *native, const uint8_t *bytes,
-                               int num_bytes);
-
-unsigned mg_uecc_curve_num_words(MG_UECC_Curve curve);
-unsigned mg_uecc_curve_num_bytes(MG_UECC_Curve curve);
-unsigned mg_uecc_curve_num_bits(MG_UECC_Curve curve);
-unsigned mg_uecc_curve_num_n_words(MG_UECC_Curve curve);
-unsigned mg_uecc_curve_num_n_bytes(MG_UECC_Curve curve);
-unsigned mg_uecc_curve_num_n_bits(MG_UECC_Curve curve);
-
-const mg_uecc_word_t *mg_uecc_curve_p(MG_UECC_Curve curve);
-const mg_uecc_word_t *mg_uecc_curve_n(MG_UECC_Curve curve);
-const mg_uecc_word_t *mg_uecc_curve_G(MG_UECC_Curve curve);
-const mg_uecc_word_t *mg_uecc_curve_b(MG_UECC_Curve curve);
-
-int mg_uecc_valid_point(const mg_uecc_word_t *point, MG_UECC_Curve curve);
-
-/* Multiplies a point by a scalar. Points are represented by the X coordinate
-   followed by the Y coordinate in the same array, both coordinates are
-   curve->num_words long. Note that scalar must be curve->num_n_words long (NOT
-   curve->num_words). */
-void mg_uecc_point_mult(mg_uecc_word_t *result, const mg_uecc_word_t *point,
-                        const mg_uecc_word_t *scalar, MG_UECC_Curve curve);
-
-/* Generates a random integer in the range 0 < random < top.
-   Both random and top have num_words words. */
-int mg_uecc_generate_random_int(mg_uecc_word_t *random,
-                                const mg_uecc_word_t *top,
-                                wordcount_t num_words);
-
-#endif /* MG_UECC_ENABLE_VLI_API */
-
-#ifdef __cplusplus
-} /* end of extern "C" */
-#endif
-
-#endif /* _UECC_VLI_H_ */
-
-// End of uecc BSD-2

src/tls_x25519.c

@@ -1,262 +0,0 @@
-/**
- * Adapted from STROBE: https://strobe.sourceforge.io/
- * Copyright (c) 2015-2016 Cryptography Research, Inc.
- * Author: Mike Hamburg
- * License: MIT License
- */
-#include "tls.h"
-#include "tls_x25519.h"
-#include "util.h"
-
-#if MG_TLS == MG_TLS_BUILTIN
-
-const uint8_t X25519_BASE_POINT[X25519_BYTES] = {9};
-
-#define X25519_WBITS 32
-
-typedef uint32_t limb_t;
-typedef uint64_t dlimb_t;
-typedef int64_t sdlimb_t;
-
-#define NLIMBS (256 / X25519_WBITS)
-typedef limb_t mg_fe[NLIMBS];
-
-static limb_t umaal(limb_t *carry, limb_t acc, limb_t mand, limb_t mier) {
-  dlimb_t tmp = (dlimb_t) mand * mier + acc + *carry;
-  *carry = (limb_t) (tmp >> X25519_WBITS);
-  return (limb_t) tmp;
-}
-
-// These functions are implemented in terms of umaal on ARM
-static limb_t adc(limb_t *carry, limb_t acc, limb_t mand) {
-  dlimb_t total = (dlimb_t) *carry + acc + mand;
-  *carry = (limb_t) (total >> X25519_WBITS);
-  return (limb_t) total;
-}
-
-static limb_t adc0(limb_t *carry, limb_t acc) {
-  dlimb_t total = (dlimb_t) *carry + acc;
-  *carry = (limb_t) (total >> X25519_WBITS);
-  return (limb_t) total;
-}
-
-// - Precondition: carry is small.
-// - Invariant: result of propagate is < 2^255 + 1 word
-// - In particular, always less than 2p.
-// - Also, output x >= min(x,19)
-static void propagate(mg_fe x, limb_t over) {
-  unsigned i;
-  limb_t carry;
-  over = x[NLIMBS - 1] >> (X25519_WBITS - 1) | over << 1;
-  x[NLIMBS - 1] &= ~((limb_t) 1 << (X25519_WBITS - 1));
-
-  carry = over * 19;
-  for (i = 0; i < NLIMBS; i++) {
-    x[i] = adc0(&carry, x[i]);
-  }
-}
-
-static void add(mg_fe out, const mg_fe a, const mg_fe b) {
-  unsigned i;
-  limb_t carry = 0;
-  for (i = 0; i < NLIMBS; i++) {
-    out[i] = adc(&carry, a[i], b[i]);
-  }
-  propagate(out, carry);
-}
-
-static void sub(mg_fe out, const mg_fe a, const mg_fe b) {
-  unsigned i;
-  sdlimb_t carry = -38;
-  for (i = 0; i < NLIMBS; i++) {
-    carry = carry + a[i] - b[i];
-    out[i] = (limb_t) carry;
-    carry >>= X25519_WBITS;
-  }
-  propagate(out, (limb_t) (1 + carry));
-}
-
-// `b` can contain less than 8 limbs, thus we use `limb_t *` instead of `mg_fe`
-// to avoid build warnings
-static void mul(mg_fe out, const mg_fe a, const limb_t *b, unsigned nb) {
-  limb_t accum[2 * NLIMBS] = {0};
-  unsigned i, j;
-
-  limb_t carry2;
-  for (i = 0; i < nb; i++) {
-    limb_t mand = b[i];
-    carry2 = 0;
-    for (j = 0; j < NLIMBS; j++) {
-      limb_t tmp;                        // "a" may be misaligned
-      memcpy(&tmp, &a[j], sizeof(tmp));  // So make an aligned copy
-      accum[i + j] = umaal(&carry2, accum[i + j], mand, tmp);
-    }
-    accum[i + j] = carry2;
-  }
-
-  carry2 = 0;
-  for (j = 0; j < NLIMBS; j++) {
-    out[j] = umaal(&carry2, accum[j], 38, accum[j + NLIMBS]);
-  }
-  propagate(out, carry2);
-}
-
-static void sqr(mg_fe out, const mg_fe a) {
-  mul(out, a, a, NLIMBS);
-}
-static void mul1(mg_fe out, const mg_fe a) {
-  mul(out, a, out, NLIMBS);
-}
-static void sqr1(mg_fe a) {
-  mul1(a, a);
-}
-
-static void condswap(limb_t a[2 * NLIMBS], limb_t b[2 * NLIMBS],
-                     limb_t doswap) {
-  unsigned i;
-  for (i = 0; i < 2 * NLIMBS; i++) {
-    limb_t xor_ab = (a[i] ^ b[i]) & doswap;
-    a[i] ^= xor_ab;
-    b[i] ^= xor_ab;
-  }
-}
-
-// Canonicalize a field element x, reducing it to the least residue which is
-// congruent to it mod 2^255-19
-// - Precondition: x < 2^255 + 1 word
-static limb_t canon(mg_fe x) {
-  // First, add 19.
-  unsigned i;
-  limb_t carry0 = 19;
-  limb_t res;
-  sdlimb_t carry;
-  for (i = 0; i < NLIMBS; i++) {
-    x[i] = adc0(&carry0, x[i]);
-  }
-  propagate(x, carry0);
-
-  // Here, 19 <= x2 < 2^255
-  // - This is because we added 19, so before propagate it can't be less
-  // than 19. After propagate, it still can't be less than 19, because if
-  // propagate does anything it adds 19.
-  // - We know that the high bit must be clear, because either the input was ~
-  // 2^255 + one word + 19 (in which case it propagates to at most 2 words) or
-  // it was < 2^255. So now, if we subtract 19, we will get back to something in
-  // [0,2^255-19).
-  carry = -19;
-  res = 0;
-  for (i = 0; i < NLIMBS; i++) {
-    carry += x[i];
-    res |= x[i] = (limb_t) carry;
-    carry >>= X25519_WBITS;
-  }
-  return (limb_t) (((dlimb_t) res - 1) >> X25519_WBITS);
-}
-
-static const limb_t a24[1] = {121665};
-
-static void ladder_part1(mg_fe xs[5]) {
-  limb_t *x2 = xs[0], *z2 = xs[1], *x3 = xs[2], *z3 = xs[3], *t1 = xs[4];
-  add(t1, x2, z2);                                 // t1 = A
-  sub(z2, x2, z2);                                 // z2 = B
-  add(x2, x3, z3);                                 // x2 = C
-  sub(z3, x3, z3);                                 // z3 = D
-  mul1(z3, t1);                                    // z3 = DA
-  mul1(x2, z2);                                    // x3 = BC
-  add(x3, z3, x2);                                 // x3 = DA+CB
-  sub(z3, z3, x2);                                 // z3 = DA-CB
-  sqr1(t1);                                        // t1 = AA
-  sqr1(z2);                                        // z2 = BB
-  sub(x2, t1, z2);                                 // x2 = E = AA-BB
-  mul(z2, x2, a24, sizeof(a24) / sizeof(a24[0]));  // z2 = E*a24
-  add(z2, z2, t1);                                 // z2 = E*a24 + AA
-}
-
-static void ladder_part2(mg_fe xs[5], const mg_fe x1) {
-  limb_t *x2 = xs[0], *z2 = xs[1], *x3 = xs[2], *z3 = xs[3], *t1 = xs[4];
-  sqr1(z3);         // z3 = (DA-CB)^2
-  mul1(z3, x1);     // z3 = x1 * (DA-CB)^2
-  sqr1(x3);         // x3 = (DA+CB)^2
-  mul1(z2, x2);     // z2 = AA*(E*a24+AA)
-  sub(x2, t1, x2);  // x2 = BB again
-  mul1(x2, t1);     // x2 = AA*BB
-}
-
-static void x25519_core(mg_fe xs[5], const uint8_t scalar[X25519_BYTES],
-                        const uint8_t *x1, int clamp) {
-  int i;
-  mg_fe x1_limbs;
-  limb_t swap = 0;
-  limb_t *x2 = xs[0], *x3 = xs[2], *z3 = xs[3];
-  memset(xs, 0, 4 * sizeof(mg_fe));
-  x2[0] = z3[0] = 1;
-  for (i = 0; i < NLIMBS; i++) {
-    x3[i] = x1_limbs[i] =
-        MG_U32(x1[i * 4 + 3], x1[i * 4 + 2], x1[i * 4 + 1], x1[i * 4]);
-  }
-
-  for (i = 255; i >= 0; i--) {
-    uint8_t bytei = scalar[i / 8];
-    limb_t doswap;
-    if (clamp) {
-      if (i / 8 == 0) {
-        bytei &= (uint8_t) ~7U;
-      } else if (i / 8 == X25519_BYTES - 1) {
-        bytei &= 0x7F;
-        bytei |= 0x40;
-      }
-    }
-    doswap = 0 - (limb_t) ((bytei >> (i % 8)) & 1);
-    condswap(x2, x3, swap ^ doswap);
-    swap = doswap;
-
-    ladder_part1(xs);
-    ladder_part2(xs, (const limb_t *) x1_limbs);
-  }
-  condswap(x2, x3, swap);
-}
-
-int mg_tls_x25519(uint8_t out[X25519_BYTES], const uint8_t scalar[X25519_BYTES],
-                  const uint8_t x1[X25519_BYTES], int clamp) {
-  int i, ret;
-  mg_fe xs[5], out_limbs;
-  limb_t *x2, *z2, *z3, *prev;
-  static const struct {
-    uint8_t a, c, n;
-  } steps[13] = {{2, 1, 1},  {2, 1, 1},  {4, 2, 3},  {2, 4, 6},  {3, 1, 1},
-                 {3, 2, 12}, {4, 3, 25}, {2, 3, 25}, {2, 4, 50}, {3, 2, 125},
-                 {3, 1, 2},  {3, 1, 2},  {3, 1, 1}};
-  x25519_core(xs, scalar, x1, clamp);
-
-  // Precomputed inversion chain
-  x2 = xs[0];
-  z2 = xs[1];
-  z3 = xs[3];
-
-  prev = z2;
-  for (i = 0; i < 13; i++) {
-    int j;
-    limb_t *a = xs[steps[i].a];
-    for (j = steps[i].n; j > 0; j--) {
-      sqr(a, prev);
-      prev = a;
-    }
-    mul1(a, xs[steps[i].c]);
-  }
-
-  // Here prev = z3
-  // x2 /= z2
-  mul(out_limbs, x2, z3, NLIMBS);
-  ret = (int) canon(out_limbs);
-  if (!clamp) ret = 0;
-  for (i = 0; i < NLIMBS; i++) {
-    uint32_t n = out_limbs[i];
-    out[i * 4] = (uint8_t) (n & 0xff);
-    out[i * 4 + 1] = (uint8_t) ((n >> 8) & 0xff);
-    out[i * 4 + 2] = (uint8_t) ((n >> 16) & 0xff);
-    out[i * 4 + 3] = (uint8_t) ((n >> 24) & 0xff);
-  }
-  return ret;
-}
-
-#endif

src/tls_x25519.h

@@ -1,13 +0,0 @@
-#ifndef TLS_X15519_H
-#define TLS_X15519_H
-
-#include "arch.h"
-
-#define X25519_BYTES 32
-extern const uint8_t X25519_BASE_POINT[X25519_BYTES];
-
-int mg_tls_x25519(uint8_t out[X25519_BYTES], const uint8_t scalar[X25519_BYTES],
-                  const uint8_t x1[X25519_BYTES], int clamp);
-
-
-#endif /* TLS_X15519_H */

src/util.c

@@ -1,5 +1,6 @@
 #include "util.h"
 #include "log.h"
+#include "net.h"
 
 // Not using memset for zeroing memory, cause it can be dropped by compiler
 // See https://github.com/cesanta/mongoose/pull/1265
@@ -43,11 +44,12 @@ bool mg_random(void *buf, size_t len) {
   success = true;
 #elif MG_ARCH == MG_ARCH_CUBE && defined(HAL_RNG_MODULE_ENABLED)
   extern RNG_HandleTypeDef hrng;
+  success = true;
   for (size_t n = 0; n < len; n += sizeof(uint32_t)) {
-    uint32_t r = HAL_RNG_ReadLastRandomNumber(&hrng);
+    uint32_t r = 0;
+    if (HAL_RNG_GenerateRandomNumber(&hrng, &r) != HAL_OK) success = false;
     memcpy((char *) buf + n, &r, n + sizeof(r) > len ? len - n : sizeof(r));
   }
-  success = true;
 #elif MG_ARCH == MG_ARCH_PICOSDK
   while (len--) *p++ = (unsigned char) (get_rand_32() & 255);
   success = true;
@@ -142,22 +144,21 @@ uint16_t mg_crc16(uint16_t crc, const char *buf, size_t len) {
   return (uint16_t) ~c;
 }
 
-static int isbyte(int n) {
+// Parse "IP" or "IP/BITS" into net and mask. The whole spec must be valid
-  return n >= 0 && n <= 255;
+static bool parse_net(struct mg_str spec, uint32_t *net, uint32_t *mask) {
-}
+  struct mg_str caps[3], ip = spec, bits = mg_str("32");
-
+  struct mg_addr addr;
-static int parse_net(const char *spec, uint32_t *net, uint32_t *mask) {
+  uint8_t n = 0;
-  int n, a, b, c, d, slash = 32, len = 0;
+  if (mg_match(spec, mg_str("*/*"), caps)) ip = caps[0], bits = caps[1];
-  if ((sscanf(spec, "%d.%d.%d.%d/%d%n", &a, &b, &c, &d, &slash, &n) == 5 ||
+  // ip.len == 0 check: mg_aton() parses an empty string as 0.0.0.0
-       sscanf(spec, "%d.%d.%d.%d%n", &a, &b, &c, &d, &n) == 4) &&
+  if (ip.len == 0 || !mg_aton(ip, &addr) || addr.is_ip6 ||
-      isbyte(a) && isbyte(b) && isbyte(c) && isbyte(d) && slash >= 0 &&
+      !mg_str_to_num(bits, 10, &n, sizeof(n)) || n > 32) {
-      slash < 33) {
+    return false;
-    len = n;
-    *net = ((uint32_t) a << 24) | ((uint32_t) b << 16) | ((uint32_t) c << 8) |
-           (uint32_t) d;
-    *mask = slash ? (uint32_t) (0xffffffffU << (32 - slash)) : (uint32_t) 0;
   }
-  return len;
+  memcpy(net, addr.addr.ip, sizeof(*net));
+  *net = mg_ntohl(*net);
+  *mask = n ? (uint32_t) (0xffffffffU << (32 - n)) : (uint32_t) 0;
+  return true;
 }
 
 int mg_check_ip_acl(struct mg_str acl, struct mg_addr *remote_ip) {
@@ -171,7 +172,9 @@ int mg_check_ip_acl(struct mg_str acl, struct mg_addr *remote_ip) {
     while (mg_span(acl, &entry, &acl, ',')) {
       uint32_t net, mask;
       if (entry.buf[0] != '+' && entry.buf[0] != '-') return -1;
-      if (parse_net(&entry.buf[1], &net, &mask) == 0) return -2;
+      if (!parse_net(mg_str_n(entry.buf + 1, entry.len - 1), &net, &mask)) {
+        return -2;
+      }
       if ((mg_ntohl(remote_ip4) & mask) == net) allowed = entry.buf[0];
     }
   }
@@ -197,7 +200,7 @@ bool mg_path_is_sane(const struct mg_str path) {
 #if MG_ENABLE_CUSTOM_MILLIS
 #else
 uint64_t mg_millis(void) {
-#if MG_ARCH == MG_ARCH_ESP8266 || MG_ARCH == MG_ARCH_ESP32 || MG_ENABLE_FREERTOS
+#if MG_ARCH == MG_ARCH_ESP32 || MG_ENABLE_FREERTOS
   return xTaskGetTickCount() * portTICK_PERIOD_MS;
 #elif MG_ARCH == MG_ARCH_THREADX
   return tx_time_get() * (1000 /* MS per SEC */ / TX_TIMER_TICKS_PER_SECOND);

src/ws.c

@@ -287,7 +287,7 @@ void mg_ws_upgrade(struct mg_connection *c, struct mg_http_message *hm,
     ws_handshake(c, wskey, wsproto, fmt, &ap);
     va_end(ap);
     c->is_websocket = 1;
-    c->is_resp = 0;
+    c->pfn_data = NULL;  // HTTP response done; mg_ws_cb uses it as an offset
     mg_call(c, MG_EV_WS_OPEN, hm);
   }
 }

test/Makefile

@@ -1,6 +1,6 @@
 SRCS = mongoose.c unit_test.c packed_fs.c
 HDRS = $(wildcard ../src/*.h) $(wildcard ../src/drivers/*.h)
-DEFS ?= -DMG_MAX_HTTP_HEADERS=7 -DMG_ENABLE_LINES -DMG_ENABLE_SSI=1 -DMG_ENABLE_ASSERT=1 -DMG_ENABLE_IPV6=$(IPV6)
+DEFS ?= -DMG_MAX_HTTP_HEADERS=7 -DMG_ENABLE_LINES -DMG_ENABLE_SSI=1 -DMG_ENABLE_ASSERT=1 -DMG_ENABLE_IPV6=$(IPV6) -DMG_ENABLE_MDASH=$(MDASH)
 WARN ?= -pedantic -W -Wall -Werror -Wshadow -Wdouble-promotion -fno-common -Wconversion -Wundef
 OPTS ?= -O3 -g3
 INCS ?= -Isrc -I.
@@ -13,11 +13,12 @@ DOCKER_BIN ?= docker
 DOCKER ?= $(DOCKER_BIN) run --platform linux/amd64 --net=host --rm $(ENV) -v $(ROOT_DIR):$(ROOT_DIR) -w $(CWD)
 VCFLAGS ?= /nologo /W3 /O2 /MD /I.
 IPV6 ?= 1
+MDASH ?= 1
 ASAN ?= -fsanitize=address,undefined,alignment -fno-sanitize-recover=all -fno-omit-frame-pointer -fno-common
 ASAN_OPTIONS ?= detect_leaks=1
-# This does not include ESP32, ESP8266, Microchip; all examples that are directly placed under an OS tutorial. Also, it is needed that way...
+TUTORIALS_EMBEDDED := $(dir $(wildcard ../tutorials/esp32/*/Makefile)) $(dir $(wildcard ../tutorials/infineon/*/Makefile)) $(dir $(wildcard ../tutorials/microchip/*/*/Makefile)) $(dir $(wildcard ../tutorials/nordic/*/Makefile)) $(dir $(wildcard ../tutorials/nxp/*/*/Makefile)) $(dir $(wildcard ../tutorials/pico-sdk/*/Makefile)) $(dir $(wildcard ../tutorials/rp/*/Makefile)) $(dir $(wildcard ../tutorials/renesas/*/Makefile)) $(dir $(wildcard ../tutorials/stm32/*/Makefile)) $(dir $(wildcard ../tutorials/stm32/*/*/Makefile)) $(dir $(wildcard ../tutorials/ti/*/Makefile)) $(dir $(wildcard ../tutorials/wch/*/Makefile))
-TUTORIALS_EMBEDDED := $(dir $(wildcard ../tutorials/infineon/*/Makefile)) $(dir $(wildcard ../tutorials/nxp/*/Makefile)) $(dir $(wildcard ../tutorials/rp/*/Makefile)) $(dir $(wildcard ../tutorials/renesas/*/Makefile)) $(dir $(wildcard ../tutorials/stm32/*/*/Makefile)) $(dir $(wildcard ../tutorials/ti/*/Makefile)) $(dir $(wildcard ../tutorials/wch/*/Makefile))
+TUTORIALS_ZEPHYR := $(dir $(wildcard ../tutorials/zephyr/*/Makefile))
-TUTORIALS := ../tutorials/micropython/ $(filter-out $(TUTORIALS_EMBEDDED), $(dir $(wildcard ../tutorials/*/*/Makefile)))
+TUTORIALS := ../tutorials/micropython/ $(filter-out $(TUTORIALS_EMBEDDED) $(TUTORIALS_ZEPHYR), $(dir $(wildcard ../tutorials/*/*/Makefile)))
 TUTORIALS_QUICK := $(filter-out ../tutorials/micropython/ ../tutorials/tcpip/pcap-driver/, $(TUTORIALS))
 TUTORIALS_MAC := $(filter-out ../tutorials/micropython/ ../tutorials/tcpip/pcap-driver/ ../tutorials/tcpip/tap-driver/, $(TUTORIALS))
 TUTORIALS_WIN := $(dir $(wildcard ../tutorials/http/file-*/Makefile) $(wildcard ../tutorials/http/http-*/Makefile) $(wildcard ../tutorials/mqtt/*/Makefile) $(wildcard ../tutorials/websocket/*/Makefile) $(wildcard ../tutorials/webui/*/Makefile))
@@ -75,19 +76,10 @@ LDFLAGS += -L$(WOLFSSL)/lib -lwolfssl
 endif
 
 ifeq "$(SSL)" "BUILTIN"
-DEFS += -DMG_TLS=MG_TLS_BUILTIN
+# Small TLS records: several records per TCP segment, tests record handling
+DEFS += -DMG_TLS=MG_TLS_BUILTIN -DMG_TLS_RECORD_SIZE=256
 endif
 
-tls_multirec/server: FORCE
-ifneq "$(SSL)" ""
-ifeq "$(MULTIREC)" ""
-	$(MAKE) -C tls_multirec CC=gcc
-endif
-endif
-	true
-
-FORCE:
-	true
 
 
 all:
@@ -106,13 +98,13 @@ mongoose.c: Makefile $(wildcard ../src/*.c) $(wildcard ../src/drivers/*.c)
 	cd .. && (export LC_ALL=C ; cat src/license.h; echo; echo '#include "mongoose.h"' ; (for F in src/*.c src/drivers/*.c ; do echo; echo '#ifdef MG_ENABLE_LINES'; echo "#line 1 \"$$F\""; echo '#endif'; cat $$F | sed -e 's,#include ".*,,'; done))> $@
 
 mongoose.h: $(HDRS) Makefile
-	cd .. && (export LC_ALL=C ; cat src/license.h; echo; echo '#ifndef MONGOOSE_H'; echo '#define MONGOOSE_H'; echo; cat src/version.h ; echo; echo '#ifdef __cplusplus'; echo 'extern "C" {'; echo '#endif'; cat src/arch.h src/arch_*.h src/os_*.h src/net_ft.h src/net_lwip.h src/net_rl.h src/config.h src/profile.h src/str.h src/queue.h src/fmt.h src/printf.h src/log.h src/timer.h src/fs.h src/util.h src/url.h src/iobuf.h src/base64.h src/md5.h src/sha1.h src/sha256.h src/event.h src/net.h src/http.h src/ssi.h src/tls.h src/tls_x25519.h src/tls_aes128.h src/tls_uecc.h src/tls_chacha20.h src/tls_rsa.h src/tls_mbed.h src/tls_openssl.h src/ws.h src/sntp.h src/mqtt.h src/dns.h src/modbus.h src/json.h src/jwt.h src/rpc.h src/dash.h src/ota.h src/health.h src/mdash.h src/flash.h src/wifi.h src/l2.h src/net_builtin.h src/bsd.h src/drivers/*.h | sed -e '/keep/! s,#include ".*,,' -e 's,^#pragma once,,'; echo; echo '#ifdef __cplusplus'; echo '}'; echo '#endif'; echo '#endif  // MONGOOSE_H')> $@
+	cd .. && (export LC_ALL=C ; cat src/license.h; echo; echo '#ifndef MONGOOSE_H'; echo '#define MONGOOSE_H'; echo; cat src/version.h ; echo; echo '#ifdef __cplusplus'; echo 'extern "C" {'; echo '#endif'; cat src/arch.h src/arch_*.h src/os_*.h src/net_ft.h src/net_lwip.h src/net_rl.h src/config.h src/profile.h src/str.h src/queue.h src/fmt.h src/printf.h src/log.h src/timer.h src/fs.h src/lfs.h src/util.h src/url.h src/iobuf.h src/base64.h src/md5.h src/sha1.h src/sha256.h src/event.h src/net.h src/http.h src/ssi.h src/tls.h src/tls_aes128.h src/tls_p256.h src/tls_p384.h src/tls_chacha20.h src/tls_rsa.h src/tls_mbed.h src/tls_openssl.h src/ws.h src/sntp.h src/mqtt.h src/dns.h src/modbus.h src/json.h src/jwt.h src/rpc.h src/dash.h src/ota.h src/health.h src/mdash.h src/flash.h src/wifi.h src/l2.h src/net_builtin.h src/bsd.h src/drivers/*.h | sed -e '/keep/! s,#include ".*,,' -e 's,^#pragma once,,'; echo; echo '#ifdef __cplusplus'; echo '}'; echo '#endif'; echo '#endif  // MONGOOSE_H')> $@
 
 # Check that all external (exported) symbols have "mg_" prefix
 mg_prefix: mongoose.c mongoose.h
 	$(CC) mongoose.c $(CFLAGS) -c -o /tmp/x.o && nm /tmp/x.o | grep ' T ' | grep -v 'mg_' ; test $$? = 1
 
-test: Makefile mongoose.h $(SRCS) tls_multirec/server
+test: Makefile mongoose.h $(SRCS)
 	$(CC) $(SRCS) $(CFLAGS) $(LDFLAGS) -o unit_test
 	ASAN_OPTIONS=$(ASAN_OPTIONS) $(RUN) ./unit_test
 
@@ -262,13 +254,13 @@ packed_fs.c: Makefile data/ssi.h fuzz.c data/a.txt data/range.txt data/ca.pem ce
 
 clean: clean_tutorials clean_tutorials_embedded
 	rm -rf $(PROG) *.exe *.o *.dSYM *_test ut fuzzer *.gcov *.gcno *.gcda *.obj *.exe *.ilk *.pdb slow-unit* _CL_* infer-out data.txt crash-* packed_fs.c pack
-	$(MAKE) -C tls_multirec $@
 	$(MAKE) -C ../resources/I-CUBE-Mongoose $@
 	#find tutorials -maxdepth 3 -name zephyr -prune -o -name Makefile -print | xargs dirname | xargs -n1 make clean -C
 
 
 # MIP (net_builtin + L2 + driver) TESTS
 
+mip_test: MDASH = 0
 mip_test: mip_test.c mongoose.c mongoose.h packed_fs.c Makefile
 	$(CC) mip_test.c packed_fs.c $(CFLAGS) $(LDFLAGS) -o $@
 	ASAN_OPTIONS=$(ASAN_OPTIONS) $(RUN) ./$@
@@ -285,7 +277,7 @@ atcmd_test: atcmd_test.c mongoose.c mongoose.h Makefile
 	$(CC) atcmd_test.c $(CFLAGS) $(LDFLAGS) -o $@
 	ASAN_OPTIONS=$(ASAN_OPTIONS) $(RUN) ./$@
 
-mip_tap_test: mip_x_test.c mip_tap_test.c mongoose.c mongoose.h packed_fs.c Makefile tls_multirec/server
+mip_tap_test: mip_x_test.c mip_tap_test.c mongoose.c mongoose.h packed_fs.c Makefile
 	$(CC) mip_tap_test.c packed_fs.c $(CFLAGS) $(LDFLAGS) -o $@
 	ASAN_OPTIONS=$(ASAN_OPTIONS) $(RUN) ./$@
 
@@ -298,7 +290,7 @@ port_tap_bridge: port_tap_bridge.c
 	cc port_tap_bridge.c -o $@
 
 # requires port_tap_bridge to be running
-mip_port_test: mip_x_test.c mip_port_test.c mongoose.c mongoose.h packed_fs.c Makefile tls_multirec/server
+mip_port_test: mip_x_test.c mip_port_test.c mongoose.c mongoose.h packed_fs.c Makefile
 	$(CC) mip_port_test.c packed_fs.c $(CFLAGS) $(LDFLAGS) -o $@
 	ASAN_OPTIONS=$(ASAN_OPTIONS) $(RUN) ./$@
 
@@ -307,6 +299,7 @@ mip_diabish: CC = gcc
 mip_diabish: CFLAGS += -std=gnu89 -Werror=declaration-after-statement -Werror=vla -Wno-pedantic
 mip_diabish: mip_test
 
+mip_vc98: MDASH = 0
 mip_vc98: mip_test.c mongoose.c mongoose.h packed_fs.c Makefile
 	$(DOCKER) mdashnet/vc98 wine cl mip_test.c packed_fs.c $(VCFLAGS) $(DEFS) $(TFLAGS) /Fe$@.exe
 	$(DOCKER) -e WINEPREFIX=/tmp/wineprefix mdashnet/vc98 wine $@.exe

test/arduino/Makefile

@@ -29,20 +29,20 @@ teensy-board:
 	touch teensy-board
 
 seeeduino-xiao: arduino seeeduino-xiao-board
-	cd $(ROOT)/tutorials/mqtt/mqtt-client/arduino/sim800-mqtt && $(ARD)/arduino/arduino --verbose --verify --board Seeeduino:samd:seeed_XIAO_m0 sim800-mqtt.ino
+	cd $(ROOT)/tutorials/arduino/sim800-mqtt && $(ARD)/arduino/arduino --verbose --verify --board Seeeduino:samd:seeed_XIAO_m0 sim800-mqtt.ino
-	cd $(ROOT)/tutorials/http/http-server/arduino/w5500-http &&  $(ARD)/arduino/arduino --verbose --verify --board Seeeduino:samd:seeed_XIAO_m0 w5500-http.ino
+	cd $(ROOT)/tutorials/arduino/w5500-http &&  $(ARD)/arduino/arduino --verbose --verify --board Seeeduino:samd:seeed_XIAO_m0 w5500-http.ino
-	cd $(ROOT)/tutorials/mqtt/mqtt-client/arduino/w5500-mqtt &&  $(ARD)/arduino/arduino --verbose --verify --board Seeeduino:samd:seeed_XIAO_m0 w5500-mqtt.ino
+	cd $(ROOT)/tutorials/arduino/w5500-mqtt &&  $(ARD)/arduino/arduino --verbose --verify --board Seeeduino:samd:seeed_XIAO_m0 w5500-mqtt.ino
 
 arduino-nano: arduino
-	cd $(ROOT)/tutorials/mqtt/mqtt-client/arduino/nano-w5500-mqtt && $(ARD)/arduino/arduino --pref compiler.cpp.extra_flags=-DMG_ENABLE_LOG=0 --verbose --verify --board arduino:avr:nano nano-w5500-mqtt.ino
+	cd $(ROOT)/tutorials/arduino/nano-w5500-mqtt && $(ARD)/arduino/arduino --pref compiler.cpp.extra_flags=-DMG_ENABLE_LOG=0 --verbose --verify --board arduino:avr:nano nano-w5500-mqtt.ino
 
 esp32: arduino esp32-board
-	cd $(ROOT)/tutorials/mqtt/mqtt-client/arduino/esp32-mqtt && $(ARD)/arduino/arduino --verbose --verify --board esp32:esp32:node32s esp32-mqtt.ino
+	cd $(ROOT)/tutorials/arduino/esp32-mqtt && $(ARD)/arduino/arduino --verbose --verify --board esp32:esp32:node32s esp32-mqtt.ino
 	# Needs a board with 'LED_BUILTIN', yet somehow invocation is missing that definition (lack of include somehow amended by the IDE)
-	#cd $(ROOT)/tutorials/http/http-server/arduino/esp32-http && $(ARD)/arduino/arduino --verbose --verify --board esp32:esp32:esp32 esp32-http.ino
+	#cd $(ROOT)/tutorials/arduino/esp32-http && $(ARD)/arduino/arduino --verbose --verify --board esp32:esp32:esp32 esp32-http.ino
 
 teensy41: arduino teensy-board
-	cd $(ROOT)/tutorials/http/http-server/arduino/teensy41-http && $(ARD)/arduino/arduino --verbose --verify --board teensy41-http.ino
+	cd $(ROOT)/tutorials/arduino/teensy41-http && $(ARD)/arduino/arduino --verbose --verify --board teensy41-http.ino
 
 
 

test/bsd/Makefile

@@ -13,18 +13,21 @@ else
 C_WARN ?= -Wno-deprecated
 endif
 
-.PHONY: all bsd_test bsd_client shm_tap_bridge shm_port_bridge bsd_s390 clean
+.PHONY: all bsd bsd_test bsd_client bsd_nortos bsd_nortos_test shm_tap_bridge \
+        shm_port_bridge bsd_s390 bsd_nortos_s390 clean
 
 TEST_SOURCES = bsd_shm_test.c
 # A C++ application compiles its sources as C++, linking Mongoose and FreeRTOS as C.
 # FreeRTOS does not build as C++, so C sources are compiled separately.
 C_SOURCES = ../../mongoose.c
-C_SOURCES += FreeRTOS-Kernel/portable/MemMang/heap_4.c
+FREERTOS_SOURCES = FreeRTOS-Kernel/portable/MemMang/heap_4.c
-C_SOURCES += FreeRTOS-Kernel/portable/ThirdParty/GCC/Posix/port.c
+FREERTOS_SOURCES += FreeRTOS-Kernel/portable/ThirdParty/GCC/Posix/port.c
-C_SOURCES += FreeRTOS-Kernel/portable/ThirdParty/GCC/Posix/utils/wait_for_event.c
+FREERTOS_SOURCES += FreeRTOS-Kernel/portable/ThirdParty/GCC/Posix/utils/wait_for_event.c
-C_SOURCES += $(wildcard FreeRTOS-Kernel/*.c)
+FREERTOS_SOURCES += $(wildcard FreeRTOS-Kernel/*.c)
 C_OBJECTS = $(notdir $(C_SOURCES:.c=.o))
+FREERTOS_OBJECTS = $(notdir $(FREERTOS_SOURCES:.c=.o))
 C_INPUTS = $(foreach S,$(C_SOURCES),-x c $(S))
+FREERTOS_INPUTS = $(foreach S,$(FREERTOS_SOURCES),-x c $(S))
 CFLAGS += -IFreeRTOS-Kernel/include 
 CFLAGS += -IFreeRTOS-Kernel/portable/ThirdParty/GCC/Posix -Wno-conversion -Wno-undef
 
@@ -47,8 +50,19 @@ CFLAGS_MONGOOSE += -DMG_ARCH=MG_ARCH_CUSTOM
 all bsd: shm_tap_bridge bsd_client FreeRTOS-Kernel bsd_test
 	ASAN_OPTIONS=$(ASAN_OPTIONS) $(RUN) ./bsd_test $(ARGS)
 
+# also
+bsd_nortos: shm_tap_bridge bsd_client bsd_nortos_test
+	ASAN_OPTIONS=$(ASAN_OPTIONS) $(RUN) ./bsd_nortos_test $(ARGS)
+
 # requires shm_tap_bridge to be running
+bsd_test: CFLAGS_MONGOOSE += -DMG_ENABLE_FREERTOS=1
 bsd_test: FreeRTOS-Kernel
+	$(CC) $(C_INPUTS) $(FREERTOS_INPUTS) -c $(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA)
+	$(CC) -x $(TEST_LANGUAGE) -c $(TEST_SOURCES) $(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA)
+	$(CC) $(C_OBJECTS) $(FREERTOS_OBJECTS) $(TEST_SOURCES:.c=.o) $(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA) -o $@
+
+bsd_nortos_test: CFLAGS_MONGOOSE += -DMG_ENABLE_FREERTOS=0
+bsd_nortos_test:
 	$(CC) $(C_INPUTS) -c $(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA)
 	$(CC) -x $(TEST_LANGUAGE) -c $(TEST_SOURCES) $(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA)
 	$(CC) $(C_OBJECTS) $(TEST_SOURCES:.c=.o) $(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA) -o $@
@@ -61,12 +75,21 @@ shm_tap_bridge: shm_tap_bridge.c shm_queue.h
 	$(CC) shm_tap_bridge.c -pthread -o $@
 
 # requires test/port_tap_bridge to be running
+bsd_s390: CFLAGS_MONGOOSE += -DMG_ENABLE_BSD_PROTOTYPES=0
 bsd_s390: ASAN=
 bsd_s390: CC = $(DOCKER) mdashnet/s390 cc
 bsd_s390: RUN = $(DOCKER) --init mdashnet/s390
 bsd_s390: shm_port_bridge bsd_client FreeRTOS-Kernel bsd_test
 	$(RUN) sh -c './shm_port_bridge & pid=$$!; sleep 1; ./bsd_test; rc=$$?; kill $$pid >/dev/null 2>&1; wait $$pid >/dev/null 2>&1; exit $$rc'
 
+#also
+bsd_nortos_s390: CFLAGS_MONGOOSE += -DMG_ENABLE_BSD_PROTOTYPES=0
+bsd_nortos_s390: ASAN=
+bsd_nortos_s390: CC = $(DOCKER) mdashnet/s390 cc
+bsd_nortos_s390: RUN = $(DOCKER) --init mdashnet/s390
+bsd_nortos_s390: shm_port_bridge bsd_client bsd_nortos_test
+	$(RUN) sh -c './shm_port_bridge & pid=$$!; sleep 1; ./bsd_nortos_test; rc=$$?; kill $$pid >/dev/null 2>&1; wait $$pid >/dev/null 2>&1; exit $$rc'
+
 shm_port_bridge: shm_port_bridge.c shm_queue.h
 	$(CC) shm_port_bridge.c $(CFLAGS) -pthread -o $@
 

test/bsd/bsd_client.c

@@ -1,4 +1,5 @@
 #include <arpa/inet.h>
+#include <errno.h>
 #include <pthread.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -91,22 +92,80 @@ fail:
   exit(1);
 }
 
+enum wait_mode { WAIT_ABORT, WAIT_DRAIN, WAIT_HOLD, WAIT_CLOSE };
+
+// Wait for output, optionally draining through the final marker.
+static int wait_data(const char *host, enum wait_mode mode) {
+  struct sockaddr_in sa;
+  struct timeval timeout;
+  char buf[512];
+  ssize_t n;
+  size_t i;
+  int fd = socket(AF_INET, SOCK_STREAM, 0);
+
+  if (fd < 0) return 1;
+  memset(&sa, 0, sizeof(sa));
+  sa.sin_family = AF_INET;
+  sa.sin_port = htons(PORT);
+  if (inet_pton(AF_INET, host, &sa.sin_addr) != 1) goto fail;
+  timeout.tv_sec = 5, timeout.tv_usec = 0;
+  if (setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)) != 0)
+    goto fail;
+  if (connect(fd, (struct sockaddr *) &sa, sizeof(sa)) != 0) goto fail;
+  if (mode == WAIT_HOLD) {
+    usleep(100000);  // Keep the peer connected while the server fails TX
+    close(fd);
+    return 0;
+  }
+  if (mode == WAIT_CLOSE) {
+    n = recv(fd, buf, sizeof(buf), 0);
+    close(fd);
+    return n == 0 || (n < 0 && errno == ECONNRESET) ? 0 : 1;
+  }
+  for (;;) {
+    n = recv(fd, buf, sizeof(buf), 0);
+    if (n <= 0) goto fail;
+    if (mode == WAIT_ABORT) break;
+    for (i = 0; i < (size_t) n; i++) {
+      if (buf[i] == '\1') break;
+    }
+    if (i < (size_t) n) break;
+  }
+  close(fd);
+  return 0;
+
+fail:
+  close(fd);
+  return 1;
+}
+
 int main(int argc, char *argv[]) {
   pthread_t threads[NUM_CONNECTIONS];
-  int i;
+  int connections = NUM_CONNECTIONS, i;
 
-  if (argc != 2) {
+  if (argc == 3 && strcmp(argv[2], "waitandabort") == 0)
-    fprintf(stderr, "usage: %s IP\n", argv[0]);
+    return wait_data(argv[1], WAIT_ABORT);
+  if (argc == 3 && strcmp(argv[2], "waitanddrain") == 0)
+    return wait_data(argv[1], WAIT_DRAIN);
+  if (argc == 3 && strcmp(argv[2], "hold") == 0)
+    return wait_data(argv[1], WAIT_HOLD);
+  if (argc == 3 && strcmp(argv[2], "expectclose") == 0)
+    return wait_data(argv[1], WAIT_CLOSE);
+  if (argc == 3) connections = atoi(argv[2]);
+  if ((argc != 2 && argc != 3) || connections < 1 ||
+      connections > NUM_CONNECTIONS) {
+    fprintf(stderr, "usage: %s IP [connections|waitandabort|waitanddrain|hold|expectclose]\n",
+            argv[0]);
     return 1;
   }
 
   srandom(1);
 
-  for (i = 0; i < NUM_CONNECTIONS; i++) {
+  for (i = 0; i < connections; i++) {
     if (pthread_create(&threads[i], NULL, worker, argv[1]) != 0) return 1;
   }
 
-  for (i = 0; i < NUM_CONNECTIONS; i++) {
+  for (i = 0; i < connections; i++) {
     if (pthread_join(threads[i], NULL) != 0) return 1;
   }
 

test/bsd/bsd_x_test.c

@@ -1,11 +1,11 @@
 #define BSDTEST_USING_DHCP 1
 
+#include <errno.h>
 #include <spawn.h>
 #include <sys/wait.h>
 
 static int s_num_tests = 0;
 static bool s_error = false;
-static volatile bool s_done = false, s_wait;
 
 #ifdef NO_ABORT
 static int s_abort = 0;
@@ -30,15 +30,177 @@ static int s_abort = 0;
     }                                                           \
   } while (0)
 
+#define DASHBOARD(x) \
+  printf("HEALTH_DASHBOARD\t\"%s\": %s,\n", x, s_error ? "false" : "true")
+
+static pid_t start_client(const char *ip, const char *connections) {
+  char *cmd[4];
+  pid_t pid;
+  extern char **environ;
+
+  cmd[0] = (char *) "./bsd_client";
+  cmd[1] = (char *) ip;
+  cmd[2] = (char *) connections;
+  cmd[3] = NULL;
+  ASSERT(posix_spawn(&pid, cmd[0], NULL, NULL, cmd, environ) == 0);
+  return pid;
+}
+
+static bool client_done(pid_t pid, int *status) {
+  pid_t r = waitpid(pid, status, WNOHANG);
+  ASSERT(r >= 0);
+  return r == pid;
+}
+
+static void check_client(int status) {
+  ASSERT(WIFEXITED(status));
+  ASSERT(WEXITSTATUS(status) == 0);
+}
+
+static int open_listener(int backlog, bool nonblock) {
+  int lfd = socket(AF_INET, SOCK_STREAM, 0);
+  struct sockaddr_in sa;
+
+  memset(&sa, 0, sizeof(sa));
+  sa.sin_family = AF_INET;
+  sa.sin_port = htons(1234);
+  sa.sin_addr.s_addr = INADDR_ANY;
+  ASSERT(lfd >= 0);
+  ASSERT(bind(lfd, (struct sockaddr *) &sa, sizeof(sa)) == 0);
+  ASSERT(listen(lfd, backlog) == 0);
+  if (nonblock) ASSERT(fcntl(lfd, F_SETFL, O_NONBLOCK) == 0);
+  else ASSERT((fcntl(lfd, F_GETFL, 0) & O_NONBLOCK) == 0);
+  MG_INFO(("BSD echo server on :1234"));
+  return lfd;
+}
+
+static void wait_ready(struct mg_mgr *mgr) {
+  // Stack initialization, Network configuration (DHCP lease, ...)
+#if BSDTEST_USING_DHCP == 0
+  MG_INFO(("MIF configuration: Static IP"));
+  ASSERT(mgr->ifp->ip != 0);  // Check we have a satic IP assigned
+  mg_mgr_poll(mgr, 0);  // For initialisation
+#else
+  MG_INFO(("MIF configuration: DHCP"));
+  ASSERT(mgr->ifp->ip == 0);  // Check we are set for DHCP
+  while (mgr->ifp->ip == 0 && mg_millis() < 5000) mg_mgr_poll(mgr, 0);
+  if (mgr->ifp->ip == 0) MG_ERROR(("No ip assigned (DHCP lease may have failed).\n"));
+  ASSERT(mgr->ifp->ip != 0);  // We have an IP (lease or static)
+#endif
+  while (mgr->ifp->state != MG_TCPIP_STATE_READY) mg_mgr_poll(mgr, 0);
+  MG_INFO(("Interface started, starting main loop"));
+}
+
+#if !MG_ENABLE_FREERTOS
+static bool s_fail_alloc;
+
+void *mg_calloc(size_t count, size_t size) {
+  return s_fail_alloc ? NULL : calloc(count, size);
+}
+
+void mg_free(void *ptr) {
+  free(ptr);
+}
+
+static uint64_t s_bootmillis = 0;
+
+uint64_t mg_millis(void) {
+  struct timespec ts = {0, 0};
+  // See #1615 - prefer monotonic clock
+#if defined(CLOCK_MONOTONIC_RAW)
+  // Raw hardware-based time that is not subject to NTP adjustment
+  clock_gettime(CLOCK_MONOTONIC_RAW, &ts);
+#elif defined(CLOCK_MONOTONIC)
+  // Affected by the incremental adjustments performed by adjtime and NTP
+  clock_gettime(CLOCK_MONOTONIC, &ts);
+#else
+  // Affected by discontinuous jumps in the system time and by the incremental
+  // adjustments performed by adjtime and NTP
+  clock_gettime(CLOCK_REALTIME, &ts);
+#endif
+  return ((uint64_t) ts.tv_sec * 1000 + (uint64_t) ts.tv_nsec / 1000000) - s_bootmillis;
+}
+
+#endif
+
+#if MG_ENABLE_FREERTOS
+static volatile bool s_done = false, s_wait, s_accept_waiting;
+static volatile bool s_accept_done, s_dontwait_done, s_nonblock_done;
+static volatile bool s_select_waiting, s_select_done;
+static volatile bool s_poll_waiting, s_poll_done;
+static volatile bool s_ready_waiting, s_ready_done;
+static volatile bool s_backlog_ready, s_backlog_full, s_backlog_accept;
+static volatile bool s_tx_held, s_tx_waits, s_tx_fail, s_tx_error;
+static volatile bool s_send_waiting;
+static volatile bool s_send_done, s_send_expect_error;
+static volatile bool s_recv_start, s_recv_waiting, s_recv_done;
+static volatile bool s_recv_expect_error;
+static size_t (*s_tx)(const void *, size_t, struct mg_tcpip_if *);
+
 struct client_data {
   char hostname[64];
   uint32_t ip;
   bool done;
 };
 
+static void echo_task(void *args);
+static void echo_dontwait_task(void *args);
+static void echo_nonblock_task(void *args);
+static void send_task(void *args);
+static void recv_wait_task(void *args);
+static void select_task(void *args);
+static void readiness_task(void *args);
+static void backlog_task(void *args);
+static void tx_gate_task(void *args);
+
+struct atask_args {
+  bool listener_nonblock;
+  bool worker_nonblock;
+  bool once;
+  bool receiver;
+  TaskFunction_t task;
+  TaskFunction_t gate;
+};
+
+static const struct atask_args s_echo_server = {true,  false,     false,
+                                                false, echo_task, NULL};
+static const struct atask_args s_accept_server = {false, false,     true,
+                                                  false, echo_task, NULL};
+static const struct atask_args s_nonblock_accept_server = {
+    true, false, true, false, echo_task, NULL};
+static const struct atask_args s_dontwait_server = {
+    true, false, false, false, echo_dontwait_task, NULL};
+static const struct atask_args s_nonblock_server = {
+    true, true, false, false, echo_nonblock_task, NULL};
+static const struct atask_args s_send_server = {true, false,     false,
+                                                true, send_task, tx_gate_task};
+static const struct atask_args s_send_error_server = {
+    true, false, false, false, send_task, tx_gate_task};
+
+static size_t tx_gate(const void *buf, size_t len, struct mg_tcpip_if *ifp) {
+  if (s_tx_fail) return (size_t) -1;  // Force MG_IO_ERR after send() waits
+  if (s_tx_held) {
+    s_tx_waits = true;
+    return 0;  // Gate TX: MG_IO_WAIT leaves c->send queued
+  }
+  return s_tx(buf, len, ifp);
+}
+
+static void run_client(const char *ip, const char *connections) {
+  int status;
+  pid_t pid = start_client(ip, connections);
+
+  while (!client_done(pid, &status)) {
+    vTaskDelay(pdMS_TO_TICKS(10));
+  }
+  check_client(status);
+}
+
 // client_task: connects to hostname:80, fetches "/", logs response length.
 static void client_task(void *args) {
-  int fd, c;
+  fd_set w, e;
+  struct pollfd p;
+  int fd;
   struct client_data *d = (struct client_data *) args;
   char req[256];
   fd = socket(AF_INET, SOCK_STREAM, 0);
@@ -47,14 +209,20 @@ static void client_task(void *args) {
   sa.sin_family = AF_INET;
   sa.sin_port = htons(80);
   memcpy(&sa.sin_addr, &d->ip, 4);
-  c = connect(fd, (struct sockaddr *) &sa, sizeof(sa));
+  ASSERT(fcntl(fd, F_SETFL, O_NONBLOCK) == 0);
-  ASSERT(c >= 0);
+  ASSERT(connect(fd, (struct sockaddr *) &sa, sizeof(sa)) < 0 &&
-  if (c < 0) {
+         errno == EINPROGRESS);
-    MG_ERROR(("connect failed"));
+  FD_ZERO(&w);
-    close(fd);
+  FD_ZERO(&e);
-    vTaskDelete(NULL);
+  FD_SET(fd, &w);
-    return;
+  FD_SET(fd, &e);
-  }
+  ASSERT(select(fd + 1, NULL, &w, &e, NULL) == 1);
+  ASSERT(FD_ISSET(fd, &w));
+  ASSERT(!FD_ISSET(fd, &e));
+  p.fd = fd, p.events = POLLOUT, p.revents = 0;
+  ASSERT(poll(&p, 1, 0) == 1);
+  ASSERT(p.revents == POLLOUT);
+  ASSERT(fcntl(fd, F_SETFL, 0) == 0);
   snprintf(req, sizeof(req),"GET / HTTP/1.0\r\nHost: %s\r\n\r\n", d->hostname);
   send(fd, req, strlen(req), 0);
   size_t total = 0;
@@ -69,84 +237,475 @@ static void client_task(void *args) {
   (void) args;
 }
 
-// echo_task: one per accepted connection.  Echoes data back.
+// Echo data back from one accepted connection.
-static void echo_task(void *args) {
+static void echo_task_common(int fd, int flags, volatile bool *done) {
-  int fd = (int) (uintptr_t) args;
+  bool nonblock = (fcntl(fd, F_GETFL, 0) & O_NONBLOCK) != 0;
+  bool dontwait = (flags & MSG_DONTWAIT) != 0;
+  bool echoed = false, eagain = false;
   static const size_t sizes[] = {1, 7, 17, 255, 256, 257, 511, 512};
   char buf[512];
   size_t i = 0;
   ssize_t n;
+
   MG_INFO(("Echo task started: %d", fd));
-  while ((n = recv(fd, buf, sizes[i++ % (sizeof(sizes) / sizeof(sizes[0]))], 0)) > 0)
+  for (;;) {
-    send(fd, buf, (size_t) n, 0);
+    n = recv(fd, buf, sizes[i++ % (sizeof(sizes) / sizeof(sizes[0]))], flags);
+    if (n > 0) {
+      if (!nonblock) {
+        ssize_t w = send(fd, buf, (size_t) n, 0);
+        if (done != NULL) ASSERT(w == n);
+        echoed = w == n;
+      } else {
+        size_t sent = 0;
+        while (sent < (size_t) n) {
+          ssize_t w = send(fd, buf + sent, (size_t) n - sent, 0);
+          if (w > 0) sent += (size_t) w;
+          else if (w < 0 && errno == EAGAIN) vTaskDelay(1);
+          else {
+            ASSERT(w > 0);
+            break;
+          }
+        }
+        if (sent != (size_t) n) break;
+        echoed = true;
+      }
+    } else if ((nonblock || dontwait) && n < 0 && errno == EAGAIN) {
+      if (echoed) eagain = true;
+      vTaskDelay(1);
+    } else {
+      break;
+    }
+  }
+  if (done != NULL) {
+    ASSERT(eagain);
+    *done = true;
+  }
   close(fd);
   vTaskDelete(NULL);
 }
 
+static void echo_task(void *args) {
+  echo_task_common((int) (uintptr_t) args, 0, NULL);
+}
+
+static void echo_dontwait_task(void *args) {
+  echo_task_common((int) (uintptr_t) args, MSG_DONTWAIT, &s_dontwait_done);
+}
+
+static void echo_nonblock_task(void *args) {
+  echo_task_common((int) (uintptr_t) args, 0, &s_nonblock_done);
+}
+
+static void tx_gate_task(void *args) {
+  // receiver/sender > network task > gate: final send is waiting
+  while (!s_send_waiting) vTaskDelay(1);
+  ASSERT(!s_send_done);
+  if (s_send_expect_error) s_tx_error = s_tx_fail = true;
+  else s_tx_held = false;
+  vTaskDelete(NULL);
+  (void) args;
+}
+
+static void recv_wait_task(void *args) {
+  char buf;
+  int fd = (int) (uintptr_t) args;
+  ssize_t n;
+
+  while (!s_recv_start) vTaskDelay(1);
+  s_recv_waiting = true;  // send_task starts after recv() is waiting
+  n = recv(fd, &buf, sizeof(buf), 0);
+  if (s_recv_expect_error) {
+    ASSERT(n < 0 && errno == EIO);  // bsd_client aborts with unread data
+  } else {
+    ASSERT(n == 0);  // bsd_client drains, then closes
+  }
+  s_recv_done = true;
+  close(fd);  // Receiver owns the shared socket close
+  vTaskDelete(NULL);
+}
+
+static void send_task(void *args) {
+  static const char buf[512] = {0};
+  static const char marker = '\1';
+  int fd = (int) (uintptr_t) args;
+  ssize_t n;
+
+  ASSERT(fcntl(fd, F_SETFL, O_NONBLOCK) == 0);
+  s_tx_held = true;  // Gate TX until c->send fills
+  do {
+    n = send(fd, buf, sizeof(buf), 0);
+  } while (n == (ssize_t) sizeof(buf));
+  ASSERT(n < 0 && errno == EAGAIN);  // Full c->send: O_NONBLOCK
+  while (!s_tx_waits) vTaskDelay(1);  // Next write_conn hits the gate
+
+  ASSERT(fcntl(fd, F_SETFL, 0) == 0);
+  n = send(fd, buf, sizeof(buf), MSG_DONTWAIT);
+  ASSERT(n < 0 && errno == EAGAIN);  // Same full c->send: MSG_DONTWAIT
+
+  if (!s_send_expect_error) {
+    s_recv_start = true;  // O_NONBLOCK is per socket; now start the receiver
+    while (!s_recv_waiting) vTaskDelay(1);
+  }
+  s_send_waiting = true;  // Gate task releases TX after this send blocks
+  n = send(fd, &marker, sizeof(marker), 0);
+  if (s_send_expect_error) ASSERT(n < 0 && errno == EPIPE);
+  else ASSERT(n == (ssize_t) sizeof(marker));
+  s_send_done = true;
+  vTaskDelete(NULL);
+}
+
 // accept loop.  Waits for incoming connections on port 1234 and spawns
 // an echo_task for each one, allowing concurrent clients.
 static void atask(void *args) {
+  const struct atask_args *cfg = (const struct atask_args *) args;
   BaseType_t result;
-  mg_bsd_init();
+  int lfd = open_listener(5, cfg->listener_nonblock);
-  int lfd = socket(AF_INET, SOCK_STREAM, 0);
+  if (cfg->once && cfg->listener_nonblock) {
-  struct sockaddr_in sa;
+    ASSERT(accept(lfd, NULL, NULL) < 0 && errno == EAGAIN);
-  memset(&sa, 0, sizeof(sa));
+    s_accept_waiting = true;
-  sa.sin_family = AF_INET;
+  }
-  sa.sin_port = htons(1234);
-  sa.sin_addr.s_addr = INADDR_ANY;
-  bind(lfd, (struct sockaddr *) &sa, sizeof(sa));
-  listen(lfd, 5);
-  fcntl(lfd, F_SETFL, O_NONBLOCK);
-  MG_INFO(("BSD echo server on :1234"));
   while (!s_wait) {
-    int fd = accept(lfd, NULL, NULL);
+    int fd;
-    if (fd < 0) { vTaskDelay(pdMS_TO_TICKS(10)); continue; }
+
-    // echo_task at higher priority than task1
+    if (cfg->once && !cfg->listener_nonblock) s_accept_waiting = true;
-    result = xTaskCreate(echo_task, "echo", 512, (void *) (uintptr_t) fd,
+    fd = accept(lfd, NULL, NULL);
+    if (fd < 0) {
+      if (!cfg->listener_nonblock) {
+        ASSERT(fd >= 0);
+        break;
+      }
+      vTaskDelay(pdMS_TO_TICKS(10));
+      continue;
+    }
+    // Accepted sockets start blocking, regardless of listener flags
+    ASSERT((fcntl(fd, F_GETFL, 0) & O_NONBLOCK) == 0);
+    if (cfg->worker_nonblock) ASSERT(fcntl(fd, F_SETFL, O_NONBLOCK) == 0);
+    // Worker tasks run at higher priority than task1
+    if (cfg->receiver) {
+      result = xTaskCreate(recv_wait_task, "recv", 512,
+                           (void *) (uintptr_t) fd,
+                           configMAX_PRIORITIES - 1, NULL);
+      ASSERT(result == pdPASS);
+    }
+    if (cfg->gate != NULL) {
+      result = xTaskCreate(cfg->gate, "gate", 256, NULL,
+                           configMAX_PRIORITIES - 3, NULL);
+      ASSERT(result == pdPASS);
+    }
+    result = xTaskCreate(cfg->task, "echo", 512, (void *) (uintptr_t) fd,
                          configMAX_PRIORITIES - 1, NULL);
     MG_INFO(("Echo task %d: %s", fd, result == pdPASS ? "created" : "FAILED"));
     ASSERT(result == pdPASS);
+    if (cfg->once) break;
   }
   close(lfd);
-  s_wait = false;
+  if (cfg->once) s_accept_done = true;
+  else s_wait = false;
   vTaskDelete(NULL);
-  (void) args;
 }
 
+static void select_task(void *args) {
+  struct timeval zero = {0, 0};
+  fd_set r, w, e;
+  int fd, lfd, n;
+
+  (void) args;
+  lfd = open_listener(5, true);
+  FD_ZERO(&r);
+  FD_SET(lfd, &r);
+  ASSERT(select(lfd, &r, NULL, NULL, &zero) == 0);
+  ASSERT(!FD_ISSET(lfd, &r));
+  FD_ZERO(&r);
+  FD_SET(lfd + 1, &r);
+  ASSERT(select(lfd + 2, &r, NULL, NULL, &zero) < 0 && errno == EBADF);
+  FD_ZERO(&r);
+  FD_ZERO(&w);
+  FD_ZERO(&e);
+  FD_SET(lfd, &r);
+  FD_SET(lfd, &w);
+  FD_SET(lfd, &e);
+  s_select_waiting = true;
+  n = select(lfd + 1, &r, &w, &e, NULL);
+  ASSERT(n == 1);
+  ASSERT(FD_ISSET(lfd, &r));
+  ASSERT(!FD_ISSET(lfd, &w));
+  ASSERT(!FD_ISSET(lfd, &e));
+  fd = accept(lfd, NULL, NULL);
+  ASSERT(fd >= 0);
+  ASSERT(close(fd) == 0);
+  ASSERT(close(lfd) == 0);
+  s_select_done = true;
+  vTaskDelete(NULL);
+}
+
+static void poll_task(void *args) {
+  struct pollfd p;
+  int fd, lfd;
+
+  (void) args;
+  lfd = open_listener(5, true);
+  p.fd = lfd, p.events = POLLIN, p.revents = 0;
+  ASSERT(poll(&p, 1, 0) == 0);
+  ASSERT(p.revents == 0);
+  p.fd = lfd + 1, p.revents = 0;
+  ASSERT(poll(&p, 1, 0) == 1);
+  ASSERT(p.revents == POLLNVAL);
+  p.fd = lfd, p.revents = 0;
+  s_poll_waiting = true;
+  ASSERT(poll(&p, 1, -1) == 1);
+  ASSERT(p.revents == POLLIN);
+  fd = accept(lfd, NULL, NULL);
+  ASSERT(fd >= 0);
+  ASSERT(close(fd) == 0);
+  ASSERT(close(lfd) == 0);
+  s_poll_done = true;
+  vTaskDelete(NULL);
+}
+
+static void readiness_task(void *args) {
+  struct pollfd p;
+  fd_set r, w;
+  int fd, lfd;
+
+  (void) args;
+  lfd = open_listener(5, true);
+  s_ready_waiting = true;
+  while ((fd = accept(lfd, NULL, NULL)) < 0) {
+    ASSERT(errno == EAGAIN);
+    vTaskDelay(1);
+  }
+  ASSERT(fcntl(fd, F_SETFL, O_NONBLOCK) == 0);
+  FD_ZERO(&r);
+  FD_SET(fd, &r);
+  ASSERT(select(fd + 1, &r, NULL, NULL, NULL) == 1);
+  ASSERT(FD_ISSET(fd, &r));
+  p.fd = fd, p.events = POLLIN, p.revents = 0;
+  ASSERT(poll(&p, 1, 0) == 1);
+  ASSERT(p.revents == POLLIN);
+  FD_ZERO(&w);
+  FD_SET(fd, &w);
+  ASSERT(select(fd + 1, NULL, &w, NULL, NULL) == 1);
+  ASSERT(FD_ISSET(fd, &w));
+  p.events = POLLOUT, p.revents = 0;
+  ASSERT(poll(&p, 1, 0) == 1);
+  ASSERT(p.revents == POLLOUT);
+  ASSERT(close(lfd) == 0);
+  echo_task_common(fd, 0, &s_ready_done);
+}
+
+static void backlog_task(void *args) {
+  struct pollfd p;
+  BaseType_t result;
+  int fd, lfd;
+
+  (void) args;
+  lfd = open_listener(1, true);
+  p.fd = lfd, p.events = POLLIN, p.revents = 0;
+  s_backlog_ready = true;
+  while (poll(&p, 1, 0) == 0) vTaskDelay(1);
+  ASSERT(p.revents == POLLIN);
+  s_backlog_full = true;  // One orphan occupies the BSD backlog
+  while (!s_backlog_accept) vTaskDelay(1);
+  ASSERT((fd = accept(lfd, NULL, NULL)) >= 0);
+  result = xTaskCreate(echo_task, "echo", 512, (void *) (uintptr_t) fd,
+                       configMAX_PRIORITIES - 1, NULL);
+  ASSERT(result == pdPASS);
+  ASSERT(close(lfd) == 0);
+  vTaskDelete(NULL);
+}
 
 // task2: tests owner.
 static void task2(void *args) {
   struct mg_mgr *mgr = (struct mg_mgr *)args;  // Event manager
-  char *ip, *cmd[3];
+  char *ip;
-  pid_t pid;
   int status;
-  extern char **environ;
+  pid_t first, second;
-
-#define DASHBOARD(x)  printf("HEALTH_DASHBOARD\t\"%s\": %s,\n", x, s_error ? "false":"true");
 
   vTaskDelay(pdMS_TO_TICKS(500));  // 500 ms
   s_error = false;
   s_wait = false;
-  // atask at higher priority than task1
-  xTaskCreate(atask, "atask", 256,  NULL, configMAX_PRIORITIES - 1, NULL);
   ip = mg_mprintf("%M", mg_print_ip4, &mgr->ifp->ip);
-  cmd[0] = (char *) "./bsd_client";
+  s_poll_waiting = s_poll_done = false;
-  cmd[1] = ip;
+  ASSERT(xTaskCreate(poll_task, "poll", 512, NULL,
-  cmd[2] = NULL;
+                     configMAX_PRIORITIES - 1, NULL) == pdPASS);
-  ASSERT(posix_spawn(&pid, cmd[0], NULL, NULL, cmd, environ) == 0);
+  while (!s_poll_waiting) vTaskDelay(1);
-  for (;;) {
+  ASSERT(!s_poll_done);
-    pid_t r = waitpid(pid, &status, WNOHANG);
+  run_client(ip, "hold");
-    ASSERT(r >= 0);
+  while (!s_poll_done) vTaskDelay(1);
-    if (r == pid) break;
+  DASHBOARD("poll_read");
-    vTaskDelay(pdMS_TO_TICKS(10));
+
-  }
+  s_select_waiting = s_select_done = false;
-  ASSERT(WIFEXITED(status));
+  ASSERT(xTaskCreate(select_task, "select", 512, NULL,
-  ASSERT(WEXITSTATUS(status) == 0);
+                     configMAX_PRIORITIES - 1, NULL) == pdPASS);
-  mg_free(ip);
+  while (!s_select_waiting) vTaskDelay(1);
+  ASSERT(!s_select_done);
+  run_client(ip, "hold");
+  while (!s_select_done) vTaskDelay(1);
+  DASHBOARD("select_read");
+
+  s_error = false;
+  s_ready_waiting = s_ready_done = false;
+  ASSERT(xTaskCreate(readiness_task, "ready", 512, NULL,
+                     configMAX_PRIORITIES - 1, NULL) == pdPASS);
+  while (!s_ready_waiting) vTaskDelay(1);
+  run_client(ip, "1");
+  while (!s_ready_done) vTaskDelay(1);
+  DASHBOARD("select_child_read");
+  DASHBOARD("poll_child_read");
+  DASHBOARD("select_child_write");
+  DASHBOARD("poll_child_write");
+
+  #if 0
+  s_error = false;
+  s_backlog_ready = s_backlog_full = s_backlog_accept = false;
+  ASSERT(xTaskCreate(backlog_task, "backlog", 512, NULL,
+                     configMAX_PRIORITIES - 1, NULL) == pdPASS);
+  while (!s_backlog_ready) vTaskDelay(1);
+  first = start_client(ip, "1");  // Fills listen(fd, 1)'s pending accept
+  while (!s_backlog_full) vTaskDelay(1);
+  second = start_client(ip, "expectclose");  // Rejected over the backlog
+  while (!client_done(second, &status)) vTaskDelay(1);
+  check_client(status);
+  s_backlog_accept = true;
+  while (!client_done(first, &status)) vTaskDelay(1);
+  check_client(status);
+  DASHBOARD("listen_backlog");
+#else
+    (void) first;
+    (void) second;
+    (void) status;
+    (void) backlog_task;
+#endif
+
+  s_error = false;
+  // atask at higher priority than task1
+  s_accept_waiting = s_accept_done = false;
+  ASSERT(xTaskCreate(atask, "atask", 256, (void *) &s_accept_server,
+                     configMAX_PRIORITIES - 1, NULL) == pdPASS);
+  while (!s_accept_waiting) vTaskDelay(pdMS_TO_TICKS(10));
+  ASSERT(!s_accept_done);
+  run_client(ip, "1");
+  while (!s_accept_done) vTaskDelay(pdMS_TO_TICKS(10));
+  DASHBOARD("blocking_accept");
+
+  s_error = false;
+  s_wait = false;
+  s_accept_waiting = s_accept_done = false;
+  ASSERT(xTaskCreate(atask, "atask", 256, (void *) &s_nonblock_accept_server,
+                     configMAX_PRIORITIES - 1, NULL) == pdPASS);
+  while (!s_accept_waiting) vTaskDelay(pdMS_TO_TICKS(10));
+  run_client(ip, "1");
+  while (!s_accept_done) vTaskDelay(pdMS_TO_TICKS(10));
+  DASHBOARD("nonblocking_accept");
+
+  s_error = false;
+  s_wait = false;
+  ASSERT(xTaskCreate(atask, "atask", 256, (void *) &s_echo_server,
+                     configMAX_PRIORITIES - 1, NULL) == pdPASS);
+  run_client(ip, NULL);
   s_wait = true;
   while (s_wait) vTaskDelay(pdMS_TO_TICKS(10));
   DASHBOARD("accept");
 
+  s_error = false;
+  s_wait = false;
+  s_dontwait_done = false;
+  ASSERT(xTaskCreate(atask, "atask", 256, (void *) &s_dontwait_server,
+                     configMAX_PRIORITIES - 1, NULL) == pdPASS);
+  run_client(ip, "1");
+  while (!s_dontwait_done) vTaskDelay(pdMS_TO_TICKS(10));
+  s_wait = true;
+  while (s_wait) vTaskDelay(pdMS_TO_TICKS(10));
+  DASHBOARD("dontwait_recv");
+
+  s_error = false;
+  s_wait = false;
+  s_nonblock_done = false;
+  ASSERT(xTaskCreate(atask, "atask", 256, (void *) &s_nonblock_server,
+                     configMAX_PRIORITIES - 1, NULL) == pdPASS);
+  run_client(ip, "1");
+  while (!s_nonblock_done) vTaskDelay(pdMS_TO_TICKS(10));
+  s_wait = true;
+  while (s_wait) vTaskDelay(pdMS_TO_TICKS(10));
+  DASHBOARD("nonblocking_recv");
+
+  s_error = false;
+  s_wait = s_tx_held = s_tx_waits = s_tx_fail = s_tx_error = false;
+  s_send_waiting = false;
+  s_send_done = s_send_expect_error = false;
+  s_recv_start = s_recv_waiting = s_recv_done = s_recv_expect_error = false;
+  ASSERT(xTaskCreate(atask, "atask", 256, (void *) &s_send_server,
+                     configMAX_PRIORITIES - 1, NULL) == pdPASS);
+  run_client(ip, "waitanddrain");  // Peer drains through the final marker
+  ASSERT(s_send_done);
+  DASHBOARD("nonblocking_send");
+  DASHBOARD("blocking_send");
+  while (!s_recv_done) vTaskDelay(pdMS_TO_TICKS(10));
+  DASHBOARD("blocking_recv");
+  DASHBOARD("shared_socket");
+  s_wait = true;
+  while (s_wait) vTaskDelay(pdMS_TO_TICKS(10));
+
+  s_error = false;
+  s_wait = s_tx_held = s_tx_waits = s_tx_fail = s_tx_error = false;
+  s_send_waiting = false;
+  s_send_done = s_send_expect_error = false;
+  s_recv_start = s_recv_waiting = s_recv_done = false;
+  s_recv_expect_error = true;
+  ASSERT(xTaskCreate(atask, "atask", 256, (void *) &s_send_server,
+                     configMAX_PRIORITIES - 1, NULL) == pdPASS);
+  run_client(ip, "waitandabort");  // Peer leaves data unread and sends RST
+  ASSERT(s_send_done);
+  while (!s_recv_done) vTaskDelay(pdMS_TO_TICKS(10));
+  DASHBOARD("error_wakeup");
+  s_wait = true;
+  while (s_wait) vTaskDelay(pdMS_TO_TICKS(10));
+
+  s_error = false;
+  s_wait = s_tx_held = s_tx_waits = s_tx_fail = s_tx_error = false;
+  s_send_waiting = false;
+  s_send_done = false;
+  s_send_expect_error = true;
+  ASSERT(xTaskCreate(atask, "atask", 256, (void *) &s_send_error_server,
+                     configMAX_PRIORITIES - 1, NULL) == pdPASS);
+  run_client(ip, "hold");  // Peer stays connected while the driver fails TX
+  while (!s_tx_error) vTaskDelay(pdMS_TO_TICKS(10));
+  ASSERT(s_send_done);
+  DASHBOARD("send_error_wakeup");
+  s_wait = true;
+  while (s_wait) vTaskDelay(pdMS_TO_TICKS(10));
+  s_tx_held = s_tx_fail = s_tx_error = s_send_expect_error = false;
+
+  mg_free(ip);
+
+  s_error = false;
+  {
+    fd_set e;
+    struct pollfd p;
+    int fd = socket(AF_INET, SOCK_STREAM, 0);
+    struct sockaddr_in sa;
+    memset(&sa, 0, sizeof(sa));
+    sa.sin_family = AF_INET;
+    sa.sin_port = htons(1234);
+    ASSERT(fcntl(fd, F_SETFL, O_NONBLOCK) == 0);
+    ASSERT(connect(fd, (struct sockaddr *) &sa, sizeof(sa)) < 0 &&
+           errno == EINPROGRESS);
+    FD_ZERO(&e);
+    FD_SET(fd, &e);
+    ASSERT(select(fd + 1, NULL, NULL, &e, NULL) == 1);
+    ASSERT(FD_ISSET(fd, &e));
+    p.fd = fd, p.events = 0, p.revents = 0;
+    ASSERT(poll(&p, 1, -1) == 1);
+    ASSERT((p.revents & POLLERR) != 0);
+    p.events = POLLOUT, p.revents = 0;
+    ASSERT(poll(&p, 1, 0) == 1);
+    ASSERT((p.revents & POLLERR) != 0);
+    ASSERT((p.revents & POLLOUT) == 0);
+    ASSERT(close(fd) == 0);
+  }
+  DASHBOARD("select_error");
+  DASHBOARD("poll_error");
+
   vTaskDelay(pdMS_TO_TICKS(500));  // 500 ms
   s_error = false;
   {
@@ -188,6 +747,7 @@ static void task2(void *args) {
     while (!cd[0].done || !cd[1].done || !cd[2].done) vTaskDelay(pdMS_TO_TICKS(10));
   }
   DASHBOARD("connect");
+  DASHBOARD("select_write");
   // End task 1
   s_done = true;
   while (s_done) vTaskDelay(pdMS_TO_TICKS(10));
@@ -206,35 +766,205 @@ static void task2(void *args) {
 static void task1(void *args) {
   struct mg_mgr *mgr = (struct mg_mgr *)args;  // Event manager
 
-  // Stack initialization, Network configuration (DHCP lease, ...)
+  wait_ready(mgr);
-#if BSDTEST_USING_DHCP == 0
-  MG_INFO(("MIF configuration: Static IP"));
-  ASSERT(mif.ip != 0);     // Check we have a satic IP assigned
-  mg_mgr_poll(&mgr, 0);  // For initialisation
-#else
-  MG_INFO(("MIF configuration: DHCP"));
-  ASSERT(mgr->ifp->ip == 0);  // Check we are set for DHCP
-  while (mgr->ifp->ip == 0 && mg_millis() < 5000) {
-    mg_mgr_poll(mgr, 0);
-  }
-  if (mgr->ifp->ip == 0) MG_ERROR(("No ip assigned (DHCP lease may have failed).\n"));
-  ASSERT(mgr->ifp->ip != 0);  // We have an IP (lease or static)
-#endif
-  while (mgr->ifp->state != MG_TCPIP_STATE_READY) {
-    mg_mgr_poll(mgr, 0);
-  }
-  MG_INFO(("Interface started, starting main loop"));
   xTaskCreate(task2, "task2", 256,  mgr, configMAX_PRIORITIES - 2, NULL);
 
   while (!s_done) {
     mg_mgr_poll(mgr, 0);
-    mg_bsd_poll(mgr);
     vTaskDelay(1);  // Let idle reclaim deleted echo tasks
   }
   s_done = false;
   vTaskDelete(NULL);
 }
 
+#else
+
+#define NORTOS_ECHO_CLIENTS 3
+
+struct nortos_echo_client {
+  int fd;
+  size_t len, sent;
+  bool eof;
+  char buf[512];
+};
+
+static int nortos_accept(struct mg_mgr *mgr, int lfd) {
+  int fd;
+
+  while ((fd = accept(lfd, NULL, NULL)) < 0) {
+    ASSERT(errno == EAGAIN);
+    mg_mgr_poll(mgr, 0);
+  }
+  return fd;
+}
+
+static void nortos_wait_client(struct mg_mgr *mgr, pid_t pid) {
+  int status;
+
+  while (!client_done(pid, &status)) mg_mgr_poll(mgr, 0);
+  check_client(status);
+}
+
+static void nortos_echo(struct mg_mgr *mgr, struct nortos_echo_client *clients,
+                        size_t count, pid_t pid) {
+  struct pollfd p[NORTOS_ECHO_CLIENTS];
+  fd_set r;
+  size_t i, live = count;
+  int maxfd, result;
+  ssize_t n;
+
+  while (live > 0) {
+    for (i = 0; i < count; i++) {
+      struct nortos_echo_client *c = &clients[i];
+      if (!c->eof && c->sent < c->len) {
+        n = send(c->fd, c->buf + c->sent, c->len - c->sent, 0);
+        if (n > 0) c->sent += (size_t) n;
+        else ASSERT(n < 0 && errno == EAGAIN);
+      }
+    }
+
+    FD_ZERO(&r);
+    maxfd = -1;
+    for (i = 0; i < count; i++) {
+      struct nortos_echo_client *c = &clients[i];
+      p[i].fd = -1, p[i].events = POLLIN, p[i].revents = 0;
+      if (!c->eof && c->sent == c->len) {
+        p[i].fd = c->fd;
+        FD_SET(c->fd, &r);
+        if (c->fd > maxfd) maxfd = c->fd;
+      }
+    }
+    if (maxfd >= 0) {
+      result = poll(p, (nfds_t) count, 0);
+      ASSERT(result >= 0);
+      if (result > 0) {
+        ASSERT(select(maxfd + 1, &r, NULL, NULL, NULL) == result);
+        for (i = 0; i < count; i++) {
+          struct nortos_echo_client *c = &clients[i];
+          bool readable = (p[i].revents & POLLIN) != 0;
+
+          ASSERT(p[i].revents == (readable ? POLLIN : 0));
+          ASSERT(FD_ISSET(c->fd, &r) == readable);
+          if (readable) {
+            n = recv(c->fd, c->buf, sizeof(c->buf), 0);
+            ASSERT(n >= 0);
+            if (n > 0) c->len = (size_t) n, c->sent = 0;
+            else c->eof = true, live--;
+          }
+        }
+      }
+    }
+    mg_mgr_poll(mgr, 0);
+  }
+  nortos_wait_client(mgr, pid);
+}
+
+static void nortos_test(struct mg_mgr *mgr) {
+  static const char bootstrap = '\0';
+  static const char grow[512] = {0};
+  static const char marker = '\1';
+  struct sockaddr_in sa;
+  struct timeval zero = {0, 0};
+  struct pollfd p;
+  fd_set r, w, e;
+  char buf;
+  char *ip;
+  pid_t pid;
+  size_t i, j;
+  int fd, lfd, n;
+  struct nortos_echo_client clients[NORTOS_ECHO_CLIENTS];
+
+  ip = mg_mprintf("%M", mg_print_ip4, &mgr->ifp->ip);
+  ASSERT(ip != NULL);
+  lfd = open_listener(5, true);
+  p.fd = lfd, p.events = POLLIN, p.revents = 0;
+  ASSERT(poll(&p, 1, 10) == 0);
+  ASSERT(p.revents == 0);
+  p.fd = lfd + 1, p.revents = 0;
+  ASSERT(poll(&p, 1, 10) == 1);
+  ASSERT(p.revents == POLLNVAL);
+  p.fd = lfd, p.revents = 0;
+  FD_ZERO(&r);
+  FD_SET(lfd, &r);
+  ASSERT(select(lfd, &r, NULL, NULL, &zero) == 0);
+  ASSERT(!FD_ISSET(lfd, &r));
+  FD_ZERO(&r);
+  FD_SET(lfd + 1, &r);
+  ASSERT(select(lfd + 2, &r, NULL, NULL, &zero) < 0 && errno == EBADF);
+  ASSERT(accept(lfd, NULL, NULL) < 0 && errno == EAGAIN);
+  DASHBOARD("nortos_nonblocking_accept");
+
+  pid = start_client(ip, "waitanddrain");
+  do {
+    p.revents = 0;
+    n = poll(&p, 1, 10);
+    if (n == 0) mg_mgr_poll(mgr, 0);
+  } while (n == 0);
+  ASSERT(n == 1);
+  ASSERT(p.revents == POLLIN);
+  DASHBOARD("nortos_poll_read");
+  do {
+    FD_ZERO(&r);
+    FD_ZERO(&w);
+    FD_ZERO(&e);
+    FD_SET(lfd, &r);
+    FD_SET(lfd, &w);
+    FD_SET(lfd, &e);
+    n = select(lfd + 1, &r, &w, &e, NULL);
+    if (n == 0) mg_mgr_poll(mgr, 0);
+  } while (n == 0);
+  ASSERT(n == 1);
+  ASSERT(FD_ISSET(lfd, &r));
+  ASSERT(!FD_ISSET(lfd, &w));
+  ASSERT(!FD_ISSET(lfd, &e));
+  DASHBOARD("nortos_select_read");
+  fd = nortos_accept(mgr, lfd);
+  ASSERT(recv(fd, &buf, sizeof(buf), MSG_DONTWAIT) < 0 && errno == EAGAIN);
+  DASHBOARD("nortos_dontwait_recv");
+  ASSERT(fcntl(fd, F_SETFL, O_NONBLOCK) == 0);
+  ASSERT(recv(fd, &buf, sizeof(buf), 0) < 0 && errno == EAGAIN);
+  DASHBOARD("nortos_nonblocking_recv");
+
+  ASSERT(send(fd, &bootstrap, sizeof(bootstrap), 0) ==
+         (ssize_t) sizeof(bootstrap));
+  s_fail_alloc = true;  // Fail growth after c->send has been bootstrapped
+  ASSERT(send(fd, grow, sizeof(grow), 0) < 0 && errno == EAGAIN);
+  s_fail_alloc = false;
+  ASSERT(send(fd, &marker, sizeof(marker), 0) == (ssize_t) sizeof(marker));
+  nortos_wait_client(mgr, pid);
+  ASSERT(close(fd) == 0);
+  DASHBOARD("nortos_nonblocking_send");
+
+  memset(clients, 0, sizeof(clients));
+  pid = start_client(ip, "3");
+  for (i = 0; i < NORTOS_ECHO_CLIENTS; i++) {
+    clients[i].fd = nortos_accept(mgr, lfd);
+    ASSERT(fcntl(clients[i].fd, F_SETFL, O_NONBLOCK) == 0);
+    for (j = 0; j < i; j++) ASSERT(clients[i].fd != clients[j].fd);
+  }
+  nortos_echo(mgr, clients, NORTOS_ECHO_CLIENTS, pid);
+  for (i = 0; i < NORTOS_ECHO_CLIENTS; i++)
+    ASSERT(close(clients[i].fd) == 0);
+  ASSERT(close(lfd) == 0);
+  DASHBOARD("nortos_select_children");
+  DASHBOARD("nortos_poll_children");
+  DASHBOARD("nortos_echo");
+
+  fd = socket(AF_INET, SOCK_STREAM, 0);
+  memset(&sa, 0, sizeof(sa));
+  sa.sin_family = AF_INET;
+  sa.sin_port = htons(1234);
+  ASSERT(fcntl(fd, F_SETFL, O_NONBLOCK) == 0);
+  ASSERT(connect(fd, (struct sockaddr *) &sa, sizeof(sa)) < 0 &&
+         errno == EINPROGRESS);
+  ASSERT(close(fd) == 0);
+  mg_mgr_poll(mgr, 0);
+  DASHBOARD("nortos_nonblocking_connect");
+  mg_free(ip);
+}
+
+#endif  // MG_ENABLE_FREERTOS
+
 static bool bsd_x_test(struct mg_tcpip_driver *driver, void *driver_data, const char *mac, const char *debug_level) {
   if (debug_level == NULL) debug_level = "3";
   mg_log_set(atoi(debug_level));
@@ -263,8 +993,21 @@ static bool bsd_x_test(struct mg_tcpip_driver *driver, void *driver_data, const
   MG_INFO(("Init done, starting interface"));
   usleep(200000);  // 200 ms
 
+#if MG_ENABLE_FREERTOS
+  s_tx = driver->tx;
+  driver->tx = tx_gate;
   xTaskCreate(task1, "task1", 2048, &mgr, configMAX_PRIORITIES - 2, NULL);
   vTaskStartScheduler();
+  driver->tx = s_tx;
+#else
+  s_bootmillis = mg_millis();
+  wait_ready(&mgr);
+  nortos_test(&mgr);
+  s_error = false;
+  mg_mgr_free(&mgr);
+  ASSERT(mgr.conns == NULL);
+  printf("HEALTH_DASHBOARD\t\"cleanup\": %s\n", s_error ? "false" : "true");
+#endif
 
 #ifdef NO_ABORT
   if (s_abort != 0) return false;

test/bsd/mongoose_config.h

@@ -1,18 +1,13 @@
 #pragma once
 
 // See https://mongoose.ws/documentation/#build-options
-//#undef MG_ARCH
-//#define MG_ARCH MG_ARCH_UNIX
-#define MG_ENABLE_FREERTOS 1
 
 #define MG_ENABLE_TCPIP 1
 #define MG_ENABLE_TCPIP_DRIVER_INIT 0
 #define MG_ENABLE_BSD_SOCKETS 1
-#define MG_ENABLE_BSD_LOG 1
 #define MG_ENABLE_LINES 1 
 #define MG_ENABLE_CUSTOM_RANDOM 1
 
-//#include <ctype.h>
 #include <inttypes.h>
 #include <limits.h>
 #include <stdarg.h>
@@ -24,7 +19,16 @@
 #include <string.h>
 
 #include <sys/stat.h>
-#include <sys/time.h>
 #include <sys/types.h>
 #include <time.h>
 #include <unistd.h>
+
+#if MG_ENABLE_FREERTOS
+
+
+#else
+
+#define MG_ENABLE_CUSTOM_CALLOC 1
+#define MG_ENABLE_CUSTOM_MILLIS 1
+
+#endif

test/esp-idf/Makefile

@@ -1,5 +1,5 @@
 ROOT ?= $(realpath $(CURDIR)/../..)
-PROJECTS ?= ../../tutorials/http/device-dashboard/esp32/ ../../tutorials/micropython/esp32/ ../../tutorials/http/uart-bridge/esp32/
+PROJECTS ?= ../../tutorials/esp32/device-dashboard/ ../../tutorials/micropython/esp32/ ../../tutorials/esp32/uart-bridge/
 TARGET ?= Debug
 DOCKER = docker run --rm -v $(ROOT):$(ROOT) -v $(CURDIR):/root -w $(CURDIR) 
 IMAGE ?= espressif/idf

test/mip_x_test.c

@@ -176,7 +176,6 @@ static void fcb(struct mg_connection *c, int ev, void *ev_data) {
     snprintf(fd->buf, FETCH_BUF_SIZE, "%.*s", (int) hm->message.len,
              hm->message.buf);
     fd->code = atoi(hm->uri.buf);
-    fd->closed = 1;
     c->is_closing = 1;
     MG_DEBUG(("CODE: %d, MSG: %.*s", fd->code, (int) hm->message.len,
               hm->message.buf));
@@ -214,7 +213,8 @@ static int fetch(struct mg_mgr *mgr, char *buf, const char *url,
                    // given enough traffic, the timer expires before we get a
                    // chance to see the response
   }
-  if (!fd.closed) c->is_closing = 1;
+  if (!fd.closed) // failed, force closure and conn removal, and loop end
+    ((struct connstate *) (c + 1))->is_closing = 1;
   mg_mgr_poll(mgr, 0);
   return fd.code;
 }
@@ -480,8 +480,7 @@ static void test_http_server(struct mg_mgr *mgr) {
 }
 
 static void test_tls(struct mg_mgr *mgr) {
-#if MG_TLS
+#if MG_TLS && 0  // TODO(cpq): restore multi-record TLS test
-  char *url;
   char buf[FETCH_BUF_SIZE];  // make sure it can hold Makefile
   mg_mem_files = mg_packed_files;  // Use generated packed filesystem
   struct mg_str data = mg_unpacked("/Makefile");
@@ -496,7 +495,8 @@ static void test_tls(struct mg_mgr *mgr) {
   // - Fire patched server, test multiple TLS records per TCP segment handling
   // skip other TLS stacks to avoid "bad client hello", we are 1.3 only
   if (access("tls_multirec/server", X_OK) == 0) {
-    url = mg_mprintf("https://%s:8443", host_ip);  
+    char url[256];
+    mg_snrintf(url, sizeof(url), "https://%s:8443", host_ip);
     ASSERT(system("tls_multirec/server -d tls_multirec &") == 0);
     sleep(1);
     // fetch() needs to loop enough times in order to process all TLS records;
@@ -504,7 +504,6 @@ static void test_tls(struct mg_mgr *mgr) {
     ASSERT(fetch(mgr, buf, url, "GET /thefile HTTP/1.0\n\n") == 200);
     ASSERT(cmpbody(buf, data.buf) == 0);  // "thefile" links to Makefile
     ASSERT(system("killall tls_multirec/server") == 0);
-    free(url);
   } else {
     printf("SKIPPED TLS MULTIPLE RECORDS TEST, tls_multirec/server NOT PRESENT\n");
   }
@@ -512,7 +511,6 @@ static void test_tls(struct mg_mgr *mgr) {
   printf("SKIPPED TLS MULTIPLE RECORDS TEST, not a known TLS 1.3 stack\n");
   (void) cmpbody("", "");
   (void) mgr;
-  (void) url; // these three: NO SIMPLE TLS TEST
   (void) buf;
   (void) data;
 #endif
@@ -593,6 +591,7 @@ bool mip_x_test(struct mg_mgr *mgr) {
 
   // Clear
   s_error = false;
+  mg_mgr_poll(mgr, 0); // prevent mDash from trashing mg_mgr_free()
   mg_mgr_free(mgr);
   ASSERT(mgr->conns == NULL);  // Deconstruction OK
   printf("HEALTH_DASHBOARD\t\"cleanup\": %s\n", s_error ? "false":"true");

test/tls_multirec/Makefile

@@ -1,9 +0,0 @@
-CFLAGS = -g -I.  # This is a known version, no need to check
-CFLAGS_MONGOOSE += -DMG_ENABLE_LINES=1 -DMG_ENABLE_IPV6=1
-CFLAGS_EXTRA ?= -DMG_TLS=MG_TLS_BUILTIN
-
-server: main.c patched_mongoose.c mongoose.h Makefile
-	$(CC) main.c patched_mongoose.c $(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA) -o $@
-
-clean:
-	rm -rf server *.exe *.o *.dSYM

test/tls_multirec/main.c

@@ -1,184 +0,0 @@
-// Copyright (c) 2020 Cesanta Software Limited
-// All rights reserved
-
-#include <signal.h>
-#include "mongoose.h"
-
-static int s_debug_level = MG_LL_INFO;
-static const char *s_root_dir = ".";
-static const char *s_addr1 = "http://0.0.0.0:8000";
-static const char *s_addr2 = "https://0.0.0.0:8443";
-static const char *s_enable_hexdump = "no";
-static const char *s_ssi_pattern = "#.html";
-static const char *s_upload_dir = NULL;  // File uploads disabled by default
-
-// Self signed certificates, see
-// https://github.com/cesanta/mongoose/blob/master/test/certs/generate.sh
-#ifdef TLS_TWOWAY
-static const char *s_tls_ca =
-    "-----BEGIN CERTIFICATE-----\n"
-    "MIIBFTCBvAIJAMNTFtpfcq8NMAoGCCqGSM49BAMCMBMxETAPBgNVBAMMCE1vbmdv\n"
-    "b3NlMB4XDTI0MDUwNzE0MzczNloXDTM0MDUwNTE0MzczNlowEzERMA8GA1UEAwwI\n"
-    "TW9uZ29vc2UwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASuP+86T/rOWnGpEVhl\n"
-    "fxYZ+pjMbCmDZ+vdnP0rjoxudwRMRQCv5slRlDK7Lxue761sdvqxWr0Ma6TFGTNg\n"
-    "epsRMAoGCCqGSM49BAMCA0gAMEUCIQCwb2CxuAKm51s81S6BIoy1IcandXSohnqs\n"
-    "us64BAA7QgIgGGtUrpkgFSS0oPBlCUG6YPHFVw42vTfpTC0ySwAS0M4=\n"
-    "-----END CERTIFICATE-----\n";
-#endif
-static const char *s_tls_cert =
-    "-----BEGIN CERTIFICATE-----\n"
-    "MIIBMTCB2aADAgECAgkAluqkgeuV/zUwCgYIKoZIzj0EAwIwEzERMA8GA1UEAwwI\n"
-    "TW9uZ29vc2UwHhcNMjQwNTA3MTQzNzM2WhcNMzQwNTA1MTQzNzM2WjARMQ8wDQYD\n"
-    "VQQDDAZzZXJ2ZXIwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASo3oEiG+BuTt5y\n"
-    "ZRyfwNr0C+SP+4M0RG2pYkb2v+ivbpfi72NHkmXiF/kbHXtgmSrn/PeTqiA8M+mg\n"
-    "BhYjDX+zoxgwFjAUBgNVHREEDTALgglsb2NhbGhvc3QwCgYIKoZIzj0EAwIDRwAw\n"
-    "RAIgTXW9MITQSwzqbNTxUUdt9DcB+8pPUTbWZpiXcA26GMYCIBiYw+DSFMLHmkHF\n"
-    "+5U3NXW3gVCLN9ntD5DAx8LTG8sB\n"
-    "-----END CERTIFICATE-----\n";
-
-static const char *s_tls_key =
-    "-----BEGIN EC PRIVATE KEY-----\n"
-    "MHcCAQEEIAVdo8UAScxG7jiuNY2UZESNX/KPH8qJ0u0gOMMsAzYWoAoGCCqGSM49\n"
-    "AwEHoUQDQgAEqN6BIhvgbk7ecmUcn8Da9Avkj/uDNERtqWJG9r/or26X4u9jR5Jl\n"
-    "4hf5Gx17YJkq5/z3k6ogPDPpoAYWIw1/sw==\n"
-    "-----END EC PRIVATE KEY-----\n";
-
-// Handle interrupts, like Ctrl-C
-static int s_signo;
-static void signal_handler(int signo) {
-  s_signo = signo;
-}
-
-// Event handler for the listening connection.
-// Simply serve static files from `s_root_dir`
-static void cb(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_ACCEPT && c->fn_data != NULL) {
-    struct mg_tls_opts opts;
-    memset(&opts, 0, sizeof(opts));
-#ifdef TLS_TWOWAY
-    opts.ca = mg_str(s_tls_ca);
-#endif
-    opts.cert = mg_str(s_tls_cert);
-    opts.key = mg_str(s_tls_key);
-    mg_tls_init(c, &opts);
-  }
-  if (ev == MG_EV_HTTP_MSG) {
-    struct mg_http_message *hm = (struct mg_http_message *) ev_data;
-
-    if (mg_match(hm->uri, mg_str("/upload"), NULL)) {
-      // Serve file upload
-      if (s_upload_dir == NULL) {
-        mg_http_reply(c, 403, "", "Denied: file upload directory not set\n");
-      } else {
-        struct mg_http_part part;
-        size_t pos = 0, total_bytes = 0, num_files = 0;
-        while ((pos = mg_http_next_multipart(hm->body, pos, &part)) > 0) {
-          char path[MG_PATH_MAX];
-          MG_INFO(("Chunk name: [%.*s] filename: [%.*s] length: %lu bytes",
-                   part.name.len, part.name.buf, part.filename.len,
-                   part.filename.buf, part.body.len));
-          mg_snprintf(path, sizeof(path), "%s/%.*s", s_upload_dir,
-                      part.filename.len, part.filename.buf);
-          if (mg_path_is_sane(mg_str(path))) {
-            mg_file_write(&mg_fs_posix, path, part.body.buf, part.body.len);
-            total_bytes += part.body.len;
-            num_files++;
-          } else {
-            MG_ERROR(("Rejecting dangerous path %s", path));
-          }
-        }
-        mg_http_reply(c, 200, "", "Uploaded %lu files, %lu bytes\n", num_files,
-                      total_bytes);
-      }
-    } else {
-      // Serve web root directory
-      struct mg_http_serve_opts opts = {0};
-      opts.root_dir = s_root_dir;
-      opts.ssi_pattern = s_ssi_pattern;
-      mg_http_serve_dir(c, hm, &opts);
-    }
-
-    // Log request
-    MG_INFO(("%.*s %.*s %lu -> %.*s %lu", hm->method.len, hm->method.buf,
-             hm->uri.len, hm->uri.buf, hm->body.len, 3, c->send.buf + 9,
-             c->send.len));
-  }
-}
-
-static void usage(const char *prog) {
-  fprintf(stderr,
-          "Mongoose v.%s\n"
-          "Usage: %s OPTIONS\n"
-          "  -H yes|no - enable traffic hexdump, default: '%s'\n"
-          "  -S PAT    - SSI filename pattern, default: '%s'\n"
-          "  -d DIR    - directory to serve, default: '%s'\n"
-          "  -l ADDR   - listening address, default: '%s'\n"
-          "  -u DIR    - file upload directory, default: unset\n"
-          "  -v LEVEL  - debug level, from 0 to 4, default: %d\n",
-          MG_VERSION, prog, s_enable_hexdump, s_ssi_pattern, s_root_dir,
-          s_addr1, s_debug_level);
-  exit(EXIT_FAILURE);
-}
-
-int main(int argc, char *argv[]) {
-  char path[MG_PATH_MAX] = ".";
-  struct mg_mgr mgr;
-  struct mg_connection *c;
-  int i;
-
-  // Parse command-line flags
-  for (i = 1; i < argc; i++) {
-    if (strcmp(argv[i], "-d") == 0) {
-      s_root_dir = argv[++i];
-    } else if (strcmp(argv[i], "-H") == 0) {
-      s_enable_hexdump = argv[++i];
-    } else if (strcmp(argv[i], "-S") == 0) {
-      s_ssi_pattern = argv[++i];
-    } else if (strcmp(argv[i], "-l") == 0) {
-      s_addr1 = argv[++i];
-    } else if (strcmp(argv[i], "-l2") == 0) {
-      s_addr2 = argv[++i];
-    } else if (strcmp(argv[i], "-u") == 0) {
-      s_upload_dir = argv[++i];
-    } else if (strcmp(argv[i], "-v") == 0) {
-      s_debug_level = atoi(argv[++i]);
-    } else {
-      usage(argv[0]);
-    }
-  }
-
-  // Root directory must not contain double dots. Make it absolute
-  // Do the conversion only if the root dir spec does not contain overrides
-  if (strchr(s_root_dir, ',') == NULL) {
-    realpath(s_root_dir, path);
-    s_root_dir = path;
-  }
-
-  // Initialise stuff
-  signal(SIGINT, signal_handler);
-  signal(SIGTERM, signal_handler);
-  mg_log_set(s_debug_level);
-  mg_mgr_init(&mgr);
-  if ((c = mg_http_listen(&mgr, s_addr1, cb, NULL)) == NULL) {
-    MG_ERROR(("Cannot listen on %s. Use http://ADDR:PORT or :PORT",
-              s_addr1));
-    exit(EXIT_FAILURE);
-  }
-  if ((c = mg_http_listen(&mgr, s_addr2, cb, (void *) 1)) == NULL) {
-    MG_ERROR(("Cannot listen on %s. Use http://ADDR:PORT or :PORT",
-              s_addr2));
-    exit(EXIT_FAILURE);
-  }
-  if (mg_casecmp(s_enable_hexdump, "yes") == 0) c->is_hexdumping = 1;
-
-  // Start infinite event loop
-  MG_INFO(("Mongoose version : v%s", MG_VERSION));
-  MG_INFO(("HTTP listener    : %s", s_addr1));
-  MG_INFO(("HTTPS listener   : %s", s_addr2));
-  MG_INFO(("Web root         : [%s]", s_root_dir));
-  MG_INFO(("Upload dir       : [%s]", s_upload_dir ? s_upload_dir : "unset"));
-  while (s_signo == 0) mg_mgr_poll(&mgr, 1000);
-  mg_mgr_free(&mgr);
-  MG_INFO(("Exiting on signal %d", s_signo));
-  return 0;
-}

test/tls_multirec/thefile

@@ -1 +0,0 @@
-../Makefile

test/tls_multirec/tls_multirec.diff

@@ -1,22 +0,0 @@
-diff --git a/mongoose.c b/mongoose.c
-index 44539e81..b3f1c83a 100644
---- a/mongoose.c
-+++ b/mongoose.c
-@@ -11300,9 +11300,16 @@ void mg_tls_free(struct mg_connection *c) {
- long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) {
-   struct tls_data *tls = (struct tls_data *) c->tls;
-   long n = MG_IO_WAIT;
-+  size_t maxsize = 256, encrypted = 0;
-   if (len > MG_IO_SIZE) len = MG_IO_SIZE;
-   if (len > 16384) len = 16384;
--  mg_tls_encrypt(c, (const uint8_t *) buf, len, MG_TLS_APP_DATA);
-+  while (encrypted < len) {
-+    const uint8_t *chunk = (const uint8_t *) buf + encrypted;
-+    size_t chunksize = len - encrypted;
-+    if (chunksize > maxsize) chunksize = maxsize;
-+    mg_tls_encrypt(c, chunk, chunksize, MG_TLS_APP_DATA);
-+    encrypted += chunksize;
-+  }
-   while (tls->send.len > 0 &&
-          (n = mg_io_send(c, tls->send.buf, tls->send.len)) > 0) {
-     mg_iobuf_del(&tls->send, 0, (size_t) n);

test/unit_test.c

@@ -803,11 +803,18 @@ static void test_mqtt_parse(void) {
   struct mg_mqtt_prop prop;
   // MQTT5 PUBLISH with Subscription Identifier = 5
   const uint8_t sub_id_pkt[] = {0x30, 0x06, 0x00, 0x01, 'x', 0x02, 0x0B, 0x05};
+  // MQTT5 CONNACK with Server Keep Alive = 60
+  const uint8_t connack_pkt[] = {0x20, 0x06, 0x00, 0x00, 0x03, 0x13, 0x00, 0x3C};
 
   memset(&mm, 0, sizeof(struct mg_mqtt_message));
   memset(&prop, 0, sizeof(struct mg_mqtt_prop));
   ASSERT(mg_mqtt_parse(sub_id_pkt, sizeof(sub_id_pkt), 5, &mm) == MQTT_OK);
   mg_mqtt_next_prop(&mm, &prop, 0);
+
+  ASSERT(mg_mqtt_parse(connack_pkt, sizeof(connack_pkt), 5, &mm) == MQTT_OK);
+  ASSERT(mm.ack == 0);
+  ASSERT(mg_mqtt_next_prop(&mm, &prop, 0) > 0);
+  ASSERT(prop.id == MQTT_PROP_SERVER_KEEP_ALIVE && prop.iv == 60);
 }
 
 static void test_mqtt(void) {
@@ -826,7 +833,16 @@ static void test_mqtt(void) {
 static void eh1(struct mg_connection *c, int ev, void *ev_data) {
   struct mg_tls_opts *topts = (struct mg_tls_opts *) c->fn_data;
   if (ev == MG_EV_ACCEPT && topts != NULL) mg_tls_init(c, topts);
-  if (ev == MG_EV_HTTP_MSG) {
+  if (ev == MG_EV_HTTP_HDRS &&
+      mg_match(((struct mg_http_message *) ev_data)->uri, mg_str("/big.bin"),
+               NULL)) {
+    // mg_http_serve_upload: streams big uploads, called from MG_EV_HTTP_HDRS
+    struct mg_http_serve_opts sopts;
+    memset(&sopts, 0, sizeof(sopts));
+    sopts.root_dir = "./data";
+    sopts.enable_upload = true;
+    mg_http_serve_upload(c, (struct mg_http_message *) ev_data, &sopts);
+  } else if (ev == MG_EV_HTTP_MSG) {
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     MG_INFO(("[%.*s %.*s] message len %d", (int) hm->method.len, hm->method.buf,
              (int) hm->uri.len, hm->uri.buf, (int) hm->message.len));
@@ -857,6 +873,7 @@ static void eh1(struct mg_connection *c, int ev, void *ev_data) {
       memset(&sopts, 0, sizeof(sopts));
       sopts.root_dir = ".";
       sopts.extra_headers = "A: B\r\nE: F\r\n";
+      sopts.enable_dir_listing = true;
       mg_http_serve_dir(c, hm, &sopts);
     } else if (mg_match(hm->uri, mg_str("/servefile"), NULL)) {
       struct mg_http_serve_opts sopts;
@@ -874,6 +891,8 @@ static void eh1(struct mg_connection *c, int ev, void *ev_data) {
       sopts.root_dir = "./data";
       sopts.ssi_pattern = "#.shtml";
       sopts.extra_headers = "C: D\r\n";
+      sopts.enable_delete = true;
+      sopts.enable_upload = true;
       mg_http_serve_dir(c, hm, &sopts);
     }
   } else if (ev == MG_EV_WS_OPEN) {
@@ -906,6 +925,10 @@ static void fcb(struct mg_connection *c, int ev, void *ev_data) {
   }
 }
 
+// Max number of mg_mgr_poll() calls fetch() waits for a response. Large
+// transfers over builtin TLS with small records (MG_TLS_RECORD_SIZE) need more
+static int s_fetch_polls = 100;
+
 static int fetch(struct mg_mgr *mgr, char *buf, const char *url,
                  const char *fmt, ...) {
   struct fetch_data fd = {buf, 0, 0};
@@ -934,7 +957,7 @@ static int fetch(struct mg_mgr *mgr, char *buf, const char *url,
   mg_vprintf(c, fmt, &ap);
   va_end(ap);
   buf[0] = '\0';
-  for (i = 0; i < 100 && buf[0] == '\0'; i++) mg_mgr_poll(mgr, 1);
+  for (i = 0; i < s_fetch_polls && buf[0] == '\0'; i++) mg_mgr_poll(mgr, 1);
   if (!fd.closed) c->is_closing = 1;
   mg_mgr_poll(mgr, 1);
   return fd.code;
@@ -1297,16 +1320,39 @@ ASSERT(system("touch 'dirtest/a<b&c>.txt'") == 0);
 #endif
   ASSERT(fetch(&mgr, buf, url, "GET /dirtest/ HTTP/1.0\n\n") == 200);
   MG_DEBUG(("%s", buf));
-  ASSERT(mgstrstr(mg_str(buf), mg_str(">Index of /dirtest/<")) != NULL);
+  ASSERT(mgstrstr(mg_str(buf), mg_str("fuzz.c")) != NULL);
-  ASSERT(mgstrstr(mg_str(buf), mg_str(">fuzz.c<")) != NULL);
 #if MG_ARCH == MG_ARCH_UNIX
-  ASSERT(mgstrstr(mg_str(buf), mg_str(">a&lt;b&amp;c&gt;.txt<")) != NULL);
+  ASSERT(mgstrstr(mg_str(buf), mg_str("a<b&c>.txt")) != NULL);
   if (system("rm 'dirtest/a<b&c>.txt'") == 0) (void) 0;
 #endif
   ASSERT(cmpheader(buf, "A", "B"));
   ASSERT(!cmpheader(buf, "C", "D"));
   ASSERT(cmpheader(buf, "E", "F"));
 
+  {
+    // mg_http_serve_dir: allow_upload, small file first (buffered), then a
+    // big one (mg_http_serve_upload, streamed - see the MG_EV_HTTP_HDRS
+    // branch in eh1), then allow_delete
+    struct mg_str big = mg_file_read(&mg_fs_posix, "mongoose.c");
+    struct mg_str got;
+    ASSERT(big.len > MG_IO_SIZE);
+    ASSERT(fetch(&mgr, buf, url,
+                 "POST /del_me.txt HTTP/1.0\r\nContent-Length: 1\r\n\r\nx") ==
+           200);
+    ASSERT(fetch(&mgr, buf, url, "GET /del_me.txt HTTP/1.0\n\n") == 200);
+    ASSERT(fetch(&mgr, buf, url,
+                 "POST /big.bin HTTP/1.0\r\nContent-Length: %d\r\n\r\n%.*s",
+                 (int) big.len, (int) big.len, big.buf) == 200);
+    got = mg_file_read(&mg_fs_posix, "data/big.bin");
+    ASSERT(got.len == big.len && memcmp(got.buf, big.buf, big.len) == 0);
+    mg_free((void *) got.buf);
+    mg_free((void *) big.buf);
+    remove("data/big.bin");
+    ASSERT(fetch(&mgr, buf, url, "DELETE /del_me.txt HTTP/1.0\n\n") == 200);
+    ASSERT(fetch(&mgr, buf, url, "GET /del_me.txt HTTP/1.0\n\n") == 404);
+    ASSERT(fetch(&mgr, buf, url, "DELETE /del_me.txt HTTP/1.0\n\n") == 404);
+  }
+
   {
     // Credentials
     struct mg_http_message hm;
@@ -1480,7 +1526,6 @@ static void test_http_404(void) {
 }
 
 static void test_tls(void) {
-//  return;
 #if MG_TLS
   struct mg_mgr mgr;
   struct mg_connection *c;
@@ -1503,6 +1548,7 @@ static void test_tls(void) {
   // POST a large file, several MSS but less than max TLS record length
   // make sure we drain TLS buffers and read all, #2619
   ASSERT(data.len > 3100 && data.len < 16384);  // pick another file on failure
+  s_fetch_polls = 5000;  // Many small TLS records, one is decrypted per poll
   ASSERT(fetch(&mgr, buf, url,
                "POST /body HTTP/1.0\n"
                "Content-Length: %lu\n\n"
@@ -1519,29 +1565,7 @@ static void test_tls(void) {
                "%s",
                bd.len, bd.buf) == 200);
   ASSERT(cmpbody(buf, bd.buf) == 0);
-#if MG_TLS == MG_TLS_BUILTIN && defined(__linux__) && \
+  s_fetch_polls = 100;
-    MG_ENABLE_CHACHA20  // skip for non-CHACHA tests
-  // fire patched server, test multiple TLS records per TCP segment handling
-  // skip other TLS stacks to avoid "bad client hello", we are 1.3 only
-  if (access("tls_multirec/server", X_OK) == 0) {
-    ASSERT(system("tls_multirec/server -d tls_multirec &") == 0);
-    sleep(1);
-    // fetch() needs to loop enough times in order to process all TLS records;
-    // otherwise it will end with 200 and shorter file contents
-    ASSERT(fetch(&mgr, buf, "https://localhost:8443",
-                 "GET /thefile HTTP/1.0\n\n") == 200);
-    data = mg_unpacked("/Makefile");
-    ASSERT(cmpbody(buf, data.buf) == 0);  // "thefile" links to Makefile
-    ASSERT(system("killall tls_multirec/server") == 0);
-  } else {
-    printf("\nSKIPPED TLS MULTIPLE RECORDS TEST, tls_multirec/server NOT PRESENT\n");
-  }
-#else
-  printf(
-      "\n Skipping multiple TLS records per TCP segment handling test, server "
-      "is 1.3 only; re-enable when other stacks can be easily configured for "
-      "1.3\n");
-#endif
 
   // Repeat the simplest test with two-way authentication
   opts.ca = mg_unpacked("/certs/ca.crt");  // configure the server for two-way
@@ -3104,26 +3128,83 @@ static void uc(struct mg_connection *c, int ev, void *ev_data) {
   }
 }
 
-static int s_su_done;
+static int s_su_done;  // 1: upload ended, -1: upload rejected
+static int s_su_end;   // Number of end calls
 
-static void su_cb(struct mg_connection *c, const char *errmsg) {
+// mg_http_stream_body() callback, saves the body to a file named as the URI
-  s_su_done = errmsg ? -1 : 1;
+static bool su_cb(struct mg_http_message *hm, struct mg_str *data, void **p) {
-  mg_http_reply(c, errmsg ? 400 : 200, "", errmsg ? errmsg : "ok\n");
+  if (hm != NULL) {  // Start
-  c->is_draining = 1;
+    char path[100];
+    struct mg_str name = mg_str_n(hm->uri.buf + 1, hm->uri.len - 1);
+    *p = NULL;
+    if (!mg_path_is_sane(name)) {
+      s_su_done = -1;
+      return false;
+    }
+    mg_snprintf(path, sizeof(path), "./%.*s", (int) name.len, name.buf);
+    *p = mg_fs_open(&mg_fs_posix, path, MG_FS_WRITE);
+    return *p != NULL;
+  } else if (data != NULL) {  // Next chunk
+    struct mg_fd *fd = (struct mg_fd *) *p;
+    return fd != NULL && fd->fs->wr(fd->fd, data->buf, data->len) == data->len;
+  }
+  s_su_end++;  // End, also called when the connection drops
+  if (*p != NULL) mg_fs_close((struct mg_fd *) *p);
+  *p = NULL;
+  if (s_su_done == 0) s_su_done = 1;
+  return true;
 }
 
 static void su(struct mg_connection *c, int ev, void *ev_data) {
   if (ev == MG_EV_HTTP_HDRS) {
-    struct mg_http_message *hm = (struct mg_http_message *) ev_data;
+    mg_http_stream_body(c, (struct mg_http_message *) ev_data, su_cb, NULL);
-    struct mg_str name = mg_str_n(hm->uri.buf + 1, hm->uri.len - 1);
+  } else if (ev == MG_EV_HTTP_MSG) {  // Only for requests that were not streamed
-    mg_http_start_upload(c, hm, name, mg_str("."), &mg_fs_posix, su_cb);
+    mg_http_reply(c, 400, "", "not streamed\n");
   }
 }
 
-static void cu(struct mg_connection *c, int ev, void *ev_data) {
+// Client that announces a large body, sends a few bytes and stays silent
-  if (ev == MG_EV_CONNECT)
+static void cd(struct mg_connection *c, int ev, void *ev_data) {
-    mg_printf(c, "POST %s HTTP/1.0\r\nContent-Length: 8\r\n\r\nfoo\nbar\n",
+  if (ev == MG_EV_CONNECT) {
-              (char *) c->fn_data);
+    mg_printf(c, "POST /su_drop.txt HTTP/1.0\r\nContent-Length: 100000\r\n\r\nfoo\n");
+  }
+  (void) ev_data;
+}
+
+static char s_cr_buf[4096];  // Response body streamed by the client
+static size_t s_cr_len;
+static int s_cr_end;
+
+static bool cr_cb(struct mg_http_message *hm, struct mg_str *data, void **p) {
+  (void) p;
+  if (hm != NULL) {
+    s_cr_len = 0;
+  } else if (data != NULL) {
+    ASSERT(s_cr_len + data->len <= sizeof(s_cr_buf));
+    memcpy(s_cr_buf + s_cr_len, data->buf, data->len);
+    s_cr_len += data->len;
+  } else {
+    s_cr_end++;
+  }
+  return true;
+}
+
+// Client that streams the response body with mg_http_stream_body()
+static void cr(struct mg_connection *c, int ev, void *ev_data) {
+  if (ev == MG_EV_CONNECT) {
+    mg_printf(c, "GET / HTTP/1.0\r\n\r\n");
+  } else if (ev == MG_EV_HTTP_HDRS) {
+    ASSERT(mg_http_stream_body(c, (struct mg_http_message *) ev_data, cr_cb,
+                               NULL));
+  }
+}
+
+static void cs(struct mg_connection *c, int ev, void *ev_data) {
+  if (ev == MG_EV_HTTP_MSG) {
+    char body[3000];
+    memset(body, 'x', sizeof(body));
+    mg_http_reply(c, 200, "", "%.*s", (int) sizeof(body), body);
+  }
   (void) ev_data;
 }
 
@@ -3141,16 +3222,18 @@ static void test_http_upload(void) {
   mg_mgr_free(&mgr);
   ASSERT(mgr.conns == NULL);
 
-  // mg_http_start_upload: successful upload, file content verified
+  // mg_http_stream_body: successful upload, file content verified
   {
     char buf[FETCH_BUF_SIZE];
     struct mg_str fc;
     remove("su_ok.txt");
+    s_su_done = s_su_end = 0;
     mg_mgr_init(&mgr);
     mg_http_listen(&mgr, "http://127.0.0.1:12355", su, NULL);
     ASSERT(fetch(&mgr, buf, "http://127.0.0.1:12355",
                  "POST /su_ok.txt HTTP/1.0\r\nContent-Length: 8\r\n\r\nfoo\nbar\n") ==
            200);
+    ASSERT(s_su_done == 1 && s_su_end == 1);
     fc = mg_file_read(&mg_fs_posix, "su_ok.txt");
     ASSERT(mg_strcmp(fc, mg_str("foo\nbar\n")) == 0);
     mg_free((void *) fc.buf);
@@ -3159,14 +3242,68 @@ static void test_http_upload(void) {
     ASSERT(mgr.conns == NULL);
   }
 
-  // mg_http_start_upload: path traversal rejected, callback gets error
+  // mg_http_stream_body: path traversal rejected by the callback, "500" sent
   {
-    s_su_done = 0;
+    char buf[FETCH_BUF_SIZE];
+    s_su_done = s_su_end = 0;
     mg_mgr_init(&mgr);
     mg_http_listen(&mgr, "http://127.0.0.1:12356", su, NULL);
-    mg_http_connect(&mgr, "http://127.0.0.1:12356", cu, (void *) "/../evil.txt");
+    ASSERT(fetch(&mgr, buf, "http://127.0.0.1:12356",
-    for (i = 0; i < 50 && !s_su_done; i++) mg_mgr_poll(&mgr, 5);
+                 "POST /../evil.txt HTTP/1.0\r\nContent-Length: 8\r\n\r\nfoo\nbar\n") ==
-    ASSERT(s_su_done == -1);
+           500);
+    ASSERT(s_su_done == -1 && s_su_end == 1);
+    ASSERT(fopen("../evil.txt", "r") == NULL);
+    mg_mgr_free(&mgr);
+    ASSERT(mgr.conns == NULL);
+  }
+
+  // mg_http_stream_body: chunked request is not streamed, caller replies "400"
+  {
+    char buf[FETCH_BUF_SIZE];
+    s_su_done = s_su_end = 0;
+    remove("su_chunked.txt");
+    mg_mgr_init(&mgr);
+    mg_http_listen(&mgr, "http://127.0.0.1:12393", su, NULL);
+    ASSERT(fetch(&mgr, buf, "http://127.0.0.1:12393",
+                 "POST /su_chunked.txt HTTP/1.1\r\n"
+                 "Transfer-Encoding: chunked\r\n\r\n"
+                 "3\r\nfoo\r\n0\r\n\r\n") == 400);
+    ASSERT(s_su_done == 0 && s_su_end == 0);  // The callback was never called
+    ASSERT(fopen("su_chunked.txt", "r") == NULL);
+    mg_mgr_free(&mgr);
+    ASSERT(mgr.conns == NULL);
+  }
+
+  // mg_http_stream_body: connection drops mid-body, the end call still happens
+  {
+    struct mg_connection *cc;
+    s_su_done = s_su_end = 0;
+    remove("su_drop.txt");
+    mg_mgr_init(&mgr);
+    mg_http_listen(&mgr, "http://127.0.0.1:12391", su, NULL);
+    cc = mg_http_connect(&mgr, "http://127.0.0.1:12391", cd, NULL);
+    ASSERT(cc != NULL);
+    for (i = 0; i < 20; i++) mg_mgr_poll(&mgr, 5);
+    ASSERT(s_su_end == 0);  // Still waiting for the rest of the body
+    cc->is_closing = 1;
+    for (i = 0; i < 20; i++) mg_mgr_poll(&mgr, 5);
+    ASSERT(s_su_end == 1);
+    remove("su_drop.txt");
+    mg_mgr_free(&mgr);
+    ASSERT(mgr.conns == NULL);
+  }
+
+  // mg_http_stream_body on a client connection: response body is streamed
+  {
+    s_cr_end = 0;
+    s_cr_len = 0;
+    mg_mgr_init(&mgr);
+    mg_http_listen(&mgr, "http://127.0.0.1:12392", cs, NULL);
+    mg_http_connect(&mgr, "http://127.0.0.1:12392", cr, NULL);
+    for (i = 0; i < 50 && s_cr_end == 0; i++) mg_mgr_poll(&mgr, 5);
+    ASSERT(s_cr_end == 1);
+    ASSERT(s_cr_len == 3000);
+    ASSERT(s_cr_buf[0] == 'x' && s_cr_buf[2999] == 'x');
     mg_mgr_free(&mgr);
     ASSERT(mgr.conns == NULL);
   }
@@ -3203,7 +3340,7 @@ static void eY(struct mg_connection *c, int ev, void *ev_data) {
     c->data[0]++;
     if (c->data[0] == 10) mg_send(c, "a", 1);
     if (c->data[0] == 12) mg_send(c, "bc", 2);
-    if (c->data[0] == 30) mg_send(c, "d", 1), c->is_resp = 0, c->data[0] = 0;
+    if (c->data[0] == 30) mg_send(c, "d", 1), c->pfn_data = NULL, c->data[0] = 0;
   }
   (void) ev_data;
 }
@@ -3239,7 +3376,7 @@ static void test_http_chunked_case(mg_event_handler_t s, mg_event_handler_t c,
   struct mg_mgr mgr;
   uint32_t i, crc = 0, expected_crc = mg_crc32(0, expected, strlen(expected));
   struct mg_connection *conn;
-  static uint16_t port = 32344;  // To prevent bind errors on Windows 
+  static uint16_t port = 32344;  // To prevent bind errors on Windows
   mg_snprintf(url, sizeof(url), "http://127.0.0.1:%d", port++);
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, url, s, NULL);
@@ -3422,6 +3559,7 @@ static void eh7(struct mg_connection *c, int ev, void *ev_data) {
     memset(&sopts, 0, sizeof(sopts));
     sopts.root_dir = "/";
     sopts.fs = &mg_fs_packed;
+    sopts.enable_dir_listing = true;
     mg_mem_files = mg_packed_files;
     mg_http_serve_dir(c, hm, &sopts);
   }
@@ -3507,6 +3645,14 @@ static void test_check_ip_acl(void) {
   ASSERT(mg_check_ip_acl(mg_str("-0.0.0.0/0,+1.0.0.0/8"), &ip) == 1);
   ASSERT(mg_check_ip_acl(mg_str("-0.0.0.0/0,+1.2.3.4"), &ip) == 1);
   ASSERT(mg_check_ip_acl(mg_str("-0.0.0.0/0,+1.0.0.0/16"), &ip) == 0);
+  ASSERT(mg_check_ip_acl(mg_str("+1.2.3.4xyz"), &ip) == -2);     // junk
+  ASSERT(mg_check_ip_acl(mg_str("+1.2.3.4/32abc"), &ip) == -2);  // junk
+  ASSERT(mg_check_ip_acl(mg_str("+1.2.3.4/"), &ip) == -2);
+  ASSERT(mg_check_ip_acl(mg_str("+1.2.3.4/33"), &ip) == -2);
+  ASSERT(mg_check_ip_acl(mg_str("+1.2.3.256"), &ip) == -2);
+  ASSERT(mg_check_ip_acl(mg_str("+"), &ip) == -2);
+  // Not NUL-terminated: must not read past the end of the ACL
+  ASSERT(mg_check_ip_acl(mg_str_n("+1.2.3.4xyz", 8), &ip) == 1);
   ip.is_ip6 = true;
   ASSERT(mg_check_ip_acl(mg_str("-0.0.0.0/0"), &ip) ==
          -1);  // not yet supported
@@ -3591,6 +3737,7 @@ static void h7(struct mg_connection *c, int ev, void *ev_data) {
     struct mg_http_serve_opts opts;
     memset(&opts, 0, sizeof(opts));
     opts.root_dir = "./data,/foo=./dirtest";
+    opts.enable_dir_listing = true;
     mg_http_serve_dir(c, hm, &opts);
   }
 }
@@ -4259,18 +4406,39 @@ static void test_split(void) {
   ASSERT(mg_strcmp(b, mg_str("")) == 0);
 }
 
-static void test_x25519(void) {
+// RFC 6979 A.2.5: P-256, SHA-256, message "sample"
+static void test_p256(void) {
 #if MG_TLS == MG_TLS_BUILTIN
-  uint8_t key[X25519_BYTES];
+  static const uint8_t x[32] = {
-  uint8_t buf[X25519_BYTES];
+      0xc9, 0xaf, 0xa9, 0xd8, 0x45, 0xba, 0x75, 0x16, 0x6b, 0x5c, 0x21,
-  char tmp[100];
+      0x57, 0x67, 0xb1, 0xd6, 0x93, 0x4e, 0x50, 0xc3, 0xdb, 0x36, 0xe8,
-  size_t i;
+      0x9b, 0x12, 0x7b, 0x8a, 0x62, 0x2b, 0x12, 0x0f, 0x67, 0x21};
-  for (i = 0; i < sizeof(key); i++) key[i] = (uint8_t) i;
+  static const uint8_t ux[8] = {0x60, 0xfe, 0xd4, 0xba, 0x25, 0x5a, 0x9d, 0x31};
-  for (i = 0; i < sizeof(buf); i++) buf[i] = 0;
+  static const uint8_t uy[8] = {0x79, 0x03, 0xfe, 0x10, 0x08, 0xb8, 0xbc, 0x99};
-  mg_tls_x25519(buf, key, X25519_BASE_POINT, 1);
+  static const uint8_t rs[64] = {
-  mg_snprintf(tmp, sizeof(tmp), "%M", mg_print_hex, sizeof(buf), buf);
+      0xef, 0xd4, 0x8b, 0x2a, 0xac, 0xb6, 0xa8, 0xfd, 0x11, 0x40, 0xdd, 0x9c,
-  MG_INFO(("%s", tmp));
+      0xd4, 0x5e, 0x81, 0xd6, 0x9d, 0x2c, 0x87, 0x7b, 0x56, 0xaa, 0xf9, 0x91,
-  ASSERT(mg_strcmp(mg_str("8f40c5adb6"), mg_str_n(tmp, 10)) == 0);
+      0xc3, 0x4d, 0x0e, 0xa8, 0x4e, 0xaf, 0x37, 0x16, 0xf7, 0xcb, 0x1c, 0x94,
+      0x2d, 0x65, 0x7c, 0x41, 0xd4, 0x36, 0xc7, 0xa1, 0xb6, 0xe2, 0x9f, 0x65,
+      0xf3, 0xe9, 0x00, 0xdb, 0xb9, 0xaf, 0xf4, 0x06, 0x4d, 0xc4, 0xab, 0x2f,
+      0x84, 0x3a, 0xcd, 0xa8};
+  uint8_t pub[64], hash[32], sig[64], prv2[32], pub2[64], sec1[32], sec2[32];
+  mg_sha256(hash, (uint8_t *) "sample", 6);
+  ASSERT(mg_p256_compute_public_key(x, pub) == 1);
+  ASSERT(memcmp(pub, ux, sizeof(ux)) == 0);
+  ASSERT(memcmp(pub + 32, uy, sizeof(uy)) == 0);
+  ASSERT(mg_p256_sign(x, hash, sizeof(hash), sig) == 1);
+  ASSERT(memcmp(sig, rs, sizeof(rs)) == 0);
+  ASSERT(mg_p256_verify(pub, hash, sizeof(hash), sig) == 1);
+  sig[10] ^= 1;
+  ASSERT(mg_p256_verify(pub, hash, sizeof(hash), sig) == 0);
+  // ECDH: both sides compute the same secret
+  ASSERT(mg_p256_make_key(pub2, prv2) == 1);
+  ASSERT(mg_p256_shared_secret(pub2, x, sec1) == 1);
+  ASSERT(mg_p256_shared_secret(pub, prv2, sec2) == 1);
+  ASSERT(memcmp(sec1, sec2, sizeof(sec1)) == 0);
+  pub2[63] ^= 1;  // Not on the curve anymore
+  ASSERT(mg_p256_shared_secret(pub2, x, sec1) == 0);
 #endif
 }
 
@@ -4493,8 +4661,8 @@ static void test_jwt(void) {
     opts.kid = mg_str("ec-key-1");
     opts.private_key = key;
     opts.public_key = pub;
-    ASSERT(mg_uecc_parse_private_key(mg_str(key_pem), key, sizeof(key)) == 32);
+    ASSERT(mg_p256_parse_private_key(mg_str(key_pem), key, sizeof(key)) == 32);
-    ASSERT(mg_uecc_compute_public_key(key, pub, mg_uecc_secp256r1()) == 1);
+    ASSERT(mg_p256_compute_public_key(key, pub) == 1);
     n = mg_jwt_sign_es256(&opts, jwt, sizeof(jwt));
     ASSERT(n > 0 && n + 1 < sizeof(jwt));
     jwt[n] = '\0';
@@ -4516,7 +4684,7 @@ static void test_crypto(void) {
   test_sha1();
   test_sha256();
   test_sha384();
-  test_x25519();
+  test_p256();
   test_rsa();
   test_jwt();
 }
@@ -4651,23 +4819,7 @@ static struct mg_field test_files_fields[] = {
     {NULL, MG_VAL_INT, NULL, 0},
 };
 static struct mg_field_set test_files_set = {
-    "files", test_files_fields, NULL, &s_test_file_index, test_upload_dir, NULL};
+    "files", test_files_fields, NULL, &s_test_file_index, NULL};
-static struct test_file_entry s_delete_file;
-static char s_deleted_file[sizeof(s_delete_file.name)];
-static char s_uploaded_file[sizeof(s_delete_file.name)];
-static struct mg_field_set *s_delete_file_set;
-static bool delete_file_fn(enum mg_dash_op op, struct mg_dash_user *u) {
-  if (op == MG_DASH_READ) return mg_dash_dir_read(s_delete_file_set, u);
-  if (op == MG_DASH_WRITE) {
-    mg_snprintf(s_uploaded_file, sizeof(s_uploaded_file), "%s",
-                s_delete_file.name);
-  }
-  if (op == MG_DASH_DELETE) {
-    mg_snprintf(s_deleted_file, sizeof(s_deleted_file), "%s",
-                s_delete_file.name);
-  }
-  return true;
-}
 static bool arr_fn(enum mg_dash_op op, struct mg_dash_user *u) {
   (void) u;
   if (op == MG_DASH_READ) {
@@ -4714,20 +4866,18 @@ static void test_dash(void) {
       {"admin", MG_VAL_INT, &admin, sizeof(admin)},
       {NULL, MG_VAL_INT, NULL, 0},
   };
-  struct mg_field_set set1 = {"set1", fields1, set1_fn, NULL, NULL, NULL};
+  struct mg_field_set set1 = {"set1", fields1, set1_fn, NULL, NULL};
-  struct mg_field_set set2 = {"set2", fields2, set2_fn, NULL, NULL, NULL};
+  struct mg_field_set set2 = {"set2", fields2, set2_fn, NULL, NULL};
-  struct mg_field_set set3 = {"set3", fields3, set3_fn, NULL, NULL, NULL};
+  struct mg_field_set set3 = {"set3", fields3, set3_fn, NULL, NULL};
   struct mg_field arr_fields[] = {
       {"val", MG_VAL_INT, &s_arr_val, sizeof(s_arr_val)},
       {NULL, MG_VAL_INT, NULL, 0},
   };
-  struct mg_field_set arr_set = {"arr", arr_fields, arr_fn, &s_arr_index, NULL,
+  struct mg_field_set arr_set = {"arr", arr_fields, arr_fn, &s_arr_index, NULL};
-                                 NULL};
   const char *get_all_expected =
       "{\"arr\":17,\"set3\":{\"admin\":7},"
       "\"set2\":{\"two\":false},"
-      "\"set1\":{\"one\":1,\"three\":\"t: 1\"},"
+      "\"set1\":{\"one\":1,\"three\":\"t: 1\"}}\n";
-      "\"files\":0}\n";
   const char *set1_req = "POST /api/set HTTP/1.0\nContent-Length: 18\n\n"
                          "{\"set1\":{\"one\":2}}";
   const char *set1_set3_req = "POST /api/set HTTP/1.0\n"
@@ -5080,51 +5230,40 @@ static void test_dash(void) {
     ASSERT(mg_http_listen(&mgr2, url2, mg_dash_ev_handler, &dash2) != NULL);
     ASSERT(fetch(&mgr2, buf, url2, "GET /api/get HTTP/1.0\n\n") == 200);
     ASSERT(strstr(buf, files_probe) == NULL);  // no files fieldset
-    ASSERT(fetch(&mgr2, buf, url2, "GET /fs/files/test.txt HTTP/1.0\n\n") == 404);
+    ASSERT(fetch(&mgr2, buf, url2, "GET /fs/test.txt HTTP/1.0\n\n") == 404);
     ASSERT(fetch(&mgr2, buf, url2,
-                 "POST /fs/files/test.txt HTTP/1.0\nContent-Length: 5\n\nhello") ==
+                 "POST /fs/test.txt HTTP/1.0\nContent-Length: 5\n\nhello") ==
            404);
     mg_mgr_free(&mgr2);
   }
 
-  // Test files fieldset with get_dir: /fs/ endpoints active
+  // Test the built-in file manager (struct mg_dash::files_dir): /fs/ active
   {
     const char *url3 = "http://localhost:26354";
     struct mg_mgr mgr3;
     struct mg_dash dash3;
-    static int idx3;
+    struct mg_str uploaded;
-    static struct mg_field ff3[] = {
-        {"name", MG_VAL_STR, s_delete_file.name, sizeof(s_delete_file.name)},
-        {"size", MG_VAL_UINT64, &s_delete_file.size, 0},
-        {NULL, MG_VAL_INT, NULL, 0},
-    };
-    static struct mg_field_set fset3 = {"files", ff3, delete_file_fn, &idx3,
-                                        test_upload_dir, NULL};
     memset(&dash3, 0, sizeof(dash3));
-    s_deleted_file[0] = '\0';
+    dash3.files_dir = test_upload_dir;
-    s_uploaded_file[0] = '\0';
-    s_delete_file_set = &fset3;
-    MG_DASH_ADD_FIELD_SET(&dash3, &fset3);
     mg_mgr_init(&mgr3);
     mg_mem_files = mg_packed_files;
     ASSERT(mg_http_listen(&mgr3, url3, mg_dash_ev_handler, &dash3) != NULL);
     ASSERT(fetch(&mgr3, buf, url3, "GET /api/get HTTP/1.0\n\n") == 200);
-    ASSERT(strstr(buf, files_probe) != NULL);  // files fieldset present
+    ASSERT(strstr(buf, files_probe) == NULL);  // files manager is not a fieldset
     ASSERT(fetch(&mgr3, buf, url3,
-                 "DELETE /fs/files/nofile.txt HTTP/1.0\n\n") == 200);
+                 "DELETE /fs/nofile.txt HTTP/1.0\n\n") == 404);
-    ASSERT(strcmp(s_deleted_file, "nofile.txt") == 0);
     ASSERT(fetch(&mgr3, buf, url3,
-                 "DELETE /fs/files/..%2Fevil.txt HTTP/1.0\n\n") == 400);
+                 "DELETE /fs/..%2Fevil.txt HTTP/1.0\n\n") == 400);
-    ASSERT(strcmp(s_deleted_file, "nofile.txt") == 0);
     ASSERT(fetch(&mgr3, buf, url3,
-                 "PUT /fs/files/test.bin HTTP/1.0\nContent-Length: 4\n\ndata") ==
+                 "PUT /fs/test.bin HTTP/1.0\nContent-Length: 4\n\ndata") ==
            200);
-    ASSERT(strcmp(s_uploaded_file, "test.bin") == 0);
+    uploaded = mg_file_read(&mg_fs_posix, "mongoose_dash_test/test.bin");
+    ASSERT(mg_strcmp(uploaded, mg_str("data")) == 0);
+    mg_free((void *) uploaded.buf);
     ASSERT(fetch(&mgr3, buf, url3,
-                 "PUT /fs/files/..%2Fevil.bin HTTP/1.0\nContent-Length: "
+                 "PUT /fs/..%2Fevil.bin HTTP/1.0\nContent-Length: "
                  "4\n\ndata") == 400);
-    ASSERT(strcmp(s_uploaded_file, "test.bin") == 0);
+    ASSERT(fetch(&mgr3, buf, url3, "GET /fs/ HTTP/1.0\n\n") == 200);
-    ASSERT(fetch(&mgr3, buf, url3, "GET /api/get/files/0 HTTP/1.0\n\n") == 200);
     ASSERT(strstr(buf, test_bin_probe) != NULL);
     mg_mgr_free(&mgr3);
   }

tutorials/README.md

@@ -9,13 +9,13 @@ The fastest way to quickly get Mongoose running on your hardware is to follow ou
 
 Steps to get the most out of this code base:
 
-- Most code here has a README.md file that points to a verbose tutorial describing how to get the intended functionality out of Mongoose Network Library. Code there runs as is in Windows, Ubuntu Linux, and Mac (very few cases don't run in Windows).
+- Most workstation code here has a README.md file that points to a verbose tutorial describing how to get the intended functionality out of Mongoose Network Library. Code there runs as is in Windows, Ubuntu Linux, and Mac (very few cases don't run in Windows).
   - Navigate your way to the desired protocol or function, read the README.md file
   - Follow the linked tutorial
   - In cases were there is no tutorial:
     - Follow the [Build Tools](https://mongoose.ws/documentation/tutorials/tools/) tutorial to setup your development environment.
     - run `make all`
-- Embedded hardware tutorials are conveniently linked from OS tutorials, or grouped by vendor and board.
+- Embedded hardware tutorials are grouped by vendor and board.
   - Navigate your way to the desired board or the closest one, read the README.md file. In most cases you'll find a link to our [Wizard](https://mongoose.ws/wizard/); for others, there is a link to a [Tutorial](https://mongoose.ws/documentation/#tutorials), as described at the top of this text. The Wizard will also link you to the tutorials you'll need.
   - In cases were there you don't find a link to a tutorial:
     - Follow the [Build Tools](https://mongoose.ws/documentation/tutorials/tools/) tutorial to setup your development environment.
@@ -28,7 +28,8 @@ Steps to get the most out of this code base:
 Rules for creating a new example:
 
 - Makefile golden reference for desktop/server examples: [http-server](http/http-server/)
-- Makefile golden reference for embedded examples: [stm32/nucleo-f746zg-baremetal-builtin-rndis](stm32/nucleo-f746zg-baremetal-builtin-rndis/)
+- Makefile golden reference for embedded examples: [stm32/nucleo-f746zg/minimal](stm32/nucleo-f746zg/minimal/)
+- Desktop/server examples compile `$(REPO_ROOT)/mongoose.c` and add `$(REPO_ROOT)` to their include path
 - Examples must build on Windows, Mac and Ubuntu Linux systems
 - Assume that users installed their tools according to the [Build Tools](https://mongoose.ws/documentation/tutorials/tools/) tutorial
 - Makefiles must not include other Makefiles
@@ -37,5 +38,5 @@ Rules for creating a new example:
 - Use `$(CFLAGS) $(CFLAGS_MONGOOSE) $(CFLAGS_EXTRA)` to compile
 - If an external repository is required, download it on demand using git shallow clone. See the embedded examples golden reference
 - Keep Makefiles as short as possible, but verbose to understand them easily
-- Symlink files when required, like `mongoose.c`, `ca.pem`, etc. Make no copies
+- Symlink files when required, like `ca.pem`, etc. Make no copies
 - Examples README.md files should contain only the title and the link to the corresponding mongoose.ws tutorial page

tutorials/arduino/esp32-http

@@ -1 +0,0 @@
-../http/http-server/arduino/esp32-http

tutorials/arduino/esp32-mqtt

@@ -1 +0,0 @@
-../mqtt/mqtt-client/arduino/esp32-mqtt

tutorials/arduino/sim800-mqtt

@@ -1 +0,0 @@
-../mqtt/mqtt-client/arduino/sim800-mqtt/