From 992e344019102e4a680de422441e828c34ffad85 Mon Sep 17 00:00:00 2001
From: jcorporation <mail@jcgames.de>
Date: Wed, 9 Oct 2024 21:53:07 +0200
Subject: [PATCH] Revert "Upd: mongoose to current master #1344"

This reverts commit 80dcd0a4617621e8a44001fd2138490de84be7af.
---
 CHANGELOG.md             |    1 +
 dist/mongoose/mongoose.c | 2638 +++++++++-----------------------------
 dist/mongoose/mongoose.h |  486 +++----
 3 files changed, 727 insertions(+), 2398 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6764c3328..af1639b5f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,7 @@ This is a small maintenance release.
 - Upd: Add Lua integer sanity checks
 - Upd: Mongoose to current master
 - Fix: Contextmenu for songs #1356
+- Upd: translations
 
 ***
 
diff --git a/dist/mongoose/mongoose.c b/dist/mongoose/mongoose.c
index 6099c3a7f..8d2a896f8 100644
--- a/dist/mongoose/mongoose.c
+++ b/dist/mongoose/mongoose.c
@@ -2401,7 +2401,7 @@ int mg_url_decode(const char *src, size_t src_len, char *dst, size_t dst_len,
 }
 
 static bool isok(uint8_t c) {
-  return c == '\n' || c == '\r' || c == '\t' || c >= ' ';
+  return c == '\n' || c == '\r' || c >= ' ';
 }
 
 int mg_http_get_request_len(const unsigned char *buf, size_t buf_len) {
@@ -2463,11 +2463,9 @@ static bool mg_http_parse_headers(const char *s, const char *end,
     if (s >= end || clen(s, end) == 0) return false;  // Invalid UTF-8
     if (*s++ != ':') return false;  // Invalid, not followed by :
     // if (clen(s, end) == 0) return false;        // Invalid UTF-8
-    while (s < end && (s[0] == ' ' || s[0] == '\t')) s++;  // Skip spaces
+    while (s < end && s[0] == ' ') s++;  // Skip spaces
     if ((s = skiptorn(s, end, &v)) == NULL) return false;
-    while (v.len > 0 && (v.buf[v.len - 1] == ' ' || v.buf[v.len - 1] == '\t')) {
-      v.len--;  // Trim spaces
-    }
+    while (v.len > 0 && v.buf[v.len - 1] == ' ') v.len--;  // Trim spaces
     // MG_INFO(("--HH [%.*s] [%.*s]", (int) k.len, k.buf, (int) v.len, v.buf));
     h[i].name = k, h[i].value = v;  // Success. Assign values
   }
@@ -2737,7 +2735,7 @@ static struct mg_str s_known_types[] = {
 // clang-format on
 
 static struct mg_str guess_content_type(struct mg_str path, const char *extra) {
-  struct mg_str entry, k, v, s = mg_str(extra), asterisk = mg_str_n("*", 1);
+  struct mg_str entry, k, v, s = mg_str(extra);
   size_t i = 0;
 
   // Shrink path to its extension only
@@ -2747,9 +2745,7 @@ static struct mg_str guess_content_type(struct mg_str path, const char *extra) {
 
   // Process user-provided mime type overrides, if any
   while (mg_span(s, &entry, &s, ',')) {
-    if (mg_span(entry, &k, &v, '=') &&
-        (mg_strcmp(asterisk, k) == 0 || mg_strcmp(path, k) == 0))
-      return v;
+    if (mg_span(entry, &k, &v, '=') && mg_strcmp(path, k) == 0) return v;
   }
 
   // Process built-in mime types
@@ -2855,6 +2851,7 @@ void mg_http_serve_file(struct mg_connection *c, struct mg_http_message *hm,
               etag, (uint64_t) cl, gzip ? "Content-Encoding: gzip\r\n" : "",
               range, opts->extra_headers ? opts->extra_headers : "");
     if (mg_strcasecmp(hm->method, mg_str("HEAD")) == 0) {
+      c->is_draining = 1;
       c->is_resp = 0;
       mg_fs_close(fd);
     } else {
@@ -3215,9 +3212,7 @@ static int skip_chunk(const char *buf, int len, int *pl, int *dl) {
 }
 
 static void http_cb(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_READ || ev == MG_EV_CLOSE ||
-      (ev == MG_EV_POLL && c->is_accepted && !c->is_draining &&
-       c->recv.len > 0)) {  // see #2796
+  if (ev == MG_EV_READ || ev == MG_EV_CLOSE) {
     struct mg_http_message hm;
     size_t ofs = 0;  // Parsing offset
     while (c->is_resp == 0 && ofs < c->recv.len) {
@@ -3225,7 +3220,6 @@ static void http_cb(struct mg_connection *c, int ev, void *ev_data) {
       int n = mg_http_parse(buf, c->recv.len - ofs, &hm);
       struct mg_str *te;  // Transfer - encoding header
       bool is_chunked = false;
-      size_t old_len = c->recv.len;
       if (n < 0) {
         // We don't use mg_error() here, to avoid closing pipelined requests
         // prematurely, see #2592
@@ -3237,12 +3231,6 @@ static void http_cb(struct mg_connection *c, int ev, void *ev_data) {
       }
       if (n == 0) break;                 // Request is not buffered yet
       mg_call(c, MG_EV_HTTP_HDRS, &hm);  // Got all HTTP headers
-      if (c->recv.len != old_len) {
-        // User manipulated received data. Wash our hands
-        MG_DEBUG(("%lu detaching HTTP handler", c->id));
-        c->pfn = NULL;
-        return;
-      }
       if (ev == MG_EV_CLOSE) {           // If client did not set Content-Length
         hm.message.len = c->recv.len - ofs;  // and closes now, deliver MSG
         hm.body.len = hm.message.len - (size_t) (hm.body.buf - hm.message.buf);
@@ -3265,7 +3253,6 @@ static void http_cb(struct mg_connection *c, int ev, void *ev_data) {
           // contain a Content-length header. Other requests can also contain a
           // body, but their content has no defined semantics (RFC 7231)
           require_content_len = true;
-          ofs += (size_t) n;  // this request has been processed
         } else if (is_response) {
           // HTTP spec 7.2 Entity body: All other responses must include a body
           // or Content-Length header field defined with a value of 0.
@@ -3308,13 +3295,6 @@ static void http_cb(struct mg_connection *c, int ev, void *ev_data) {
 
       if (c->is_accepted) c->is_resp = 1;  // Start generating response
       mg_call(c, MG_EV_HTTP_MSG, &hm);     // User handler can clear is_resp
-      if (c->is_accepted) {
-        struct mg_str *cc = mg_http_get_header(&hm, "Connection");
-        if (cc != NULL && mg_strcasecmp(*cc, mg_str("close")) == 0) {
-          c->is_draining = 1;  // honor "Connection: close"
-          break;
-        }
-      }
     }
     if (ofs > 0) mg_iobuf_del(&c->recv, 0, ofs);  // Delete processed data
   }
@@ -4723,7 +4703,7 @@ static bool mg_aton6(struct mg_str str, struct mg_addr *addr) {
     if ((str.buf[i] >= '0' && str.buf[i] <= '9') ||
         (str.buf[i] >= 'a' && str.buf[i] <= 'f') ||
         (str.buf[i] >= 'A' && str.buf[i] <= 'F')) {
-      unsigned long val = 0;  // TODO(): This loops on chars, refactor
+      unsigned long val;  // TODO(): This loops on chars, refactor
       if (i > j + 3) return false;
       // MG_DEBUG(("%lu %lu [%.*s]", i, j, (int) (i - j + 1), &str.buf[j]));
       mg_str_to_num(mg_str_n(&str.buf[j], i - j + 1), 16, &val, sizeof(val));
@@ -4929,7 +4909,7 @@ void mg_mgr_init(struct mg_mgr *mgr) {
 #endif
 
 #define MIP_TCP_ACK_MS 150    // Timeout for ACKing
-#define MIP_ARP_RESP_MS 100   // Timeout for ARP response
+#define MIP_TCP_ARP_MS 100    // Timeout for ARP response
 #define MIP_TCP_SYN_MS 15000  // Timeout for connection establishment
 #define MIP_TCP_FIN_MS 1000   // Timeout for closing connection
 #define MIP_TCP_WIN 6000      // TCP window size
@@ -5058,10 +5038,6 @@ struct pkt {
   struct dhcp *dhcp;
 };
 
-static void mg_tcpip_call(struct mg_tcpip_if *ifp, int ev, void *ev_data) {
-  if (ifp->fn != NULL) ifp->fn(ifp, ev, ev_data);
-}
-
 static void send_syn(struct mg_connection *c);
 
 static void mkpay(struct pkt *pkt, void *p) {
@@ -5090,7 +5066,7 @@ static void settmout(struct mg_connection *c, uint8_t type) {
   struct mg_tcpip_if *ifp = (struct mg_tcpip_if *) c->mgr->priv;
   struct connstate *s = (struct connstate *) (c + 1);
   unsigned n = type == MIP_TTYPE_ACK   ? MIP_TCP_ACK_MS
-               : type == MIP_TTYPE_ARP ? MIP_ARP_RESP_MS
+               : type == MIP_TTYPE_ARP ? MIP_TCP_ARP_MS
                : type == MIP_TTYPE_SYN ? MIP_TCP_SYN_MS
                : type == MIP_TTYPE_FIN ? MIP_TCP_FIN_MS
                                        : MIP_TCP_KEEPALIVE_MS;
@@ -5124,14 +5100,13 @@ static void onstatechange(struct mg_tcpip_if *ifp) {
     MG_INFO(("READY, IP: %M", mg_print_ip4, &ifp->ip));
     MG_INFO(("       GW: %M", mg_print_ip4, &ifp->gw));
     MG_INFO(("      MAC: %M", mg_print_mac, &ifp->mac));
-    arp_ask(ifp, ifp->gw);  // unsolicited GW ARP request
+    arp_ask(ifp, ifp->gw);
   } else if (ifp->state == MG_TCPIP_STATE_UP) {
     MG_ERROR(("Link up"));
     srand((unsigned int) mg_millis());
   } else if (ifp->state == MG_TCPIP_STATE_DOWN) {
     MG_ERROR(("Link down"));
   }
-  mg_tcpip_call(ifp, MG_TCPIP_EV_ST_CHG, &ifp->state);
 }
 
 static struct ip *tx_ip(struct mg_tcpip_if *ifp, uint8_t *mac_dst,
@@ -5192,25 +5167,20 @@ static void tx_dhcp(struct mg_tcpip_if *ifp, uint8_t *mac_dst, uint32_t ip_src,
 
 static const uint8_t broadcast[] = {255, 255, 255, 255, 255, 255};
 
-// RFC-2131 #4.3.6, #4.4.1; RFC-2132 #9.8
+// RFC-2131 #4.3.6, #4.4.1
 static void tx_dhcp_request_sel(struct mg_tcpip_if *ifp, uint32_t ip_req,
                                 uint32_t ip_srv) {
   uint8_t opts[] = {
-      53, 1, 3,                   // Type: DHCP request
-      12, 3, 'm', 'i', 'p',       // Host name: "mip"
-      54, 4, 0,   0,   0,   0,    // DHCP server ID
-      50, 4, 0,   0,   0,   0,    // Requested IP
-      55, 2, 1,   3,   255, 255,  // GW, mask [DNS] [SNTP]
-      255                         // End of options
+      53, 1, 3,                 // Type: DHCP request
+      55, 2, 1,   3,            // GW and mask
+      12, 3, 'm', 'i', 'p',     // Host name: "mip"
+      54, 4, 0,   0,   0,   0,  // DHCP server ID
+      50, 4, 0,   0,   0,   0,  // Requested IP
+      255                       // End of options
   };
-  uint8_t addopts = 0;
-  memcpy(opts + 10, &ip_srv, sizeof(ip_srv));
-  memcpy(opts + 16, &ip_req, sizeof(ip_req));
-  if (ifp->enable_req_dns) opts[24 + addopts++] = 6;    // DNS
-  if (ifp->enable_req_sntp) opts[24 + addopts++] = 42;  // SNTP
-  opts[21] += addopts;
-  tx_dhcp(ifp, (uint8_t *) broadcast, 0, 0xffffffff, opts,
-          sizeof(opts) + addopts - 2, false);
+  memcpy(opts + 14, &ip_srv, sizeof(ip_srv));
+  memcpy(opts + 20, &ip_req, sizeof(ip_req));
+  tx_dhcp(ifp, (uint8_t *) broadcast, 0, 0xffffffff, opts, sizeof(opts), false);
   MG_DEBUG(("DHCP req sent"));
 }
 
@@ -5250,8 +5220,6 @@ static struct mg_connection *getpeer(struct mg_mgr *mgr, struct pkt *pkt,
   return c;
 }
 
-static void mac_resolved(struct mg_connection *c);
-
 static void rx_arp(struct mg_tcpip_if *ifp, struct pkt *pkt) {
   if (pkt->arp->op == mg_htons(1) && pkt->arp->tpa == ifp->ip) {
     // ARP request. Make a response, then send
@@ -5284,7 +5252,8 @@ static void rx_arp(struct mg_tcpip_if *ifp, struct pkt *pkt) {
         MG_DEBUG(("%lu ARP resolved %M -> %M", c->id, mg_print_ip4, c->rem.ip,
                   mg_print_mac, s->mac));
         c->is_arplooking = 0;
-        mac_resolved(c);
+        send_syn(c);
+        settmout(c, MIP_TTYPE_SYN);
       }
     }
   }
@@ -5307,7 +5276,7 @@ static void rx_icmp(struct mg_tcpip_if *ifp, struct pkt *pkt) {
 }
 
 static void rx_dhcp_client(struct mg_tcpip_if *ifp, struct pkt *pkt) {
-  uint32_t ip = 0, gw = 0, mask = 0, lease = 0, dns = 0, sntp = 0;
+  uint32_t ip = 0, gw = 0, mask = 0, lease = 0;
   uint8_t msgtype = 0, state = ifp->state;
   // perform size check first, then access fields
   uint8_t *p = pkt->dhcp->options,
@@ -5320,12 +5289,6 @@ static void rx_dhcp_client(struct mg_tcpip_if *ifp, struct pkt *pkt) {
     } else if (p[0] == 3 && p[1] == sizeof(ifp->gw) && p + 6 < end) {  // GW
       memcpy(&gw, p + 2, sizeof(gw));
       ip = pkt->dhcp->yiaddr;
-    } else if (ifp->enable_req_dns && p[0] == 6 && p[1] == sizeof(dns) &&
-               p + 6 < end) {  // DNS
-      memcpy(&dns, p + 2, sizeof(dns));
-    } else if (ifp->enable_req_sntp && p[0] == 42 && p[1] == sizeof(sntp) &&
-               p + 6 < end) {  // SNTP
-      memcpy(&sntp, p + 2, sizeof(sntp));
     } else if (p[0] == 51 && p[1] == 4 && p + 6 < end) {  // Lease
       memcpy(&lease, p + 2, sizeof(lease));
       lease = mg_ntohl(lease);
@@ -5354,10 +5317,6 @@ static void rx_dhcp_client(struct mg_tcpip_if *ifp, struct pkt *pkt) {
       uint64_t rand;
       mg_random(&rand, sizeof(rand));
       srand((unsigned int) (rand + mg_millis()));
-      if (ifp->enable_req_dns && dns != 0)
-        mg_tcpip_call(ifp, MG_TCPIP_EV_DHCP_DNS, &dns);
-      if (ifp->enable_req_sntp && sntp != 0)
-        mg_tcpip_call(ifp, MG_TCPIP_EV_DHCP_SNTP, &sntp);
     } else if (ifp->state == MG_TCPIP_STATE_READY && ifp->ip == ip) {  // renew
       ifp->lease_expire = ifp->now + lease * 1000;
       MG_INFO(("Lease: %u sec (%lld)", lease, ifp->lease_expire / 1000));
@@ -5665,7 +5624,6 @@ static void rx_tcp(struct mg_tcpip_if *ifp, struct pkt *pkt) {
     c->is_connecting = 0;  // Client connected
     settmout(c, MIP_TTYPE_KEEPALIVE);
     mg_call(c, MG_EV_CONNECT, NULL);  // Let user know
-    if (c->is_tls_hs) mg_tls_handshake(c);
   } else if (c != NULL && c->is_connecting && pkt->tcp->flags != TH_ACK) {
     // mg_hexdump(pkt->raw.buf, pkt->raw.len);
     tx_tcp_pkt(ifp, pkt, TH_RST | TH_ACK, pkt->tcp->ack, NULL, 0);
@@ -5868,20 +5826,18 @@ static void mg_tcpip_poll(struct mg_tcpip_if *ifp, uint64_t now) {
 
   // Process timeouts
   for (c = ifp->mgr->conns; c != NULL; c = c->next) {
-    if ((c->is_udp && !c->is_arplooking) || c->is_listening || c->is_resolving) continue;
+    if (c->is_udp || c->is_listening || c->is_resolving) continue;
     struct connstate *s = (struct connstate *) (c + 1);
     uint32_t rem_ip;
     memcpy(&rem_ip, c->rem.ip, sizeof(uint32_t));
     if (now > s->timer) {
-      if (s->ttype == MIP_TTYPE_ARP) {
-        mg_error(c, "ARP timeout");
-      } else if (c->is_udp) {
-        continue;
-      } else if (s->ttype == MIP_TTYPE_ACK && s->acked != s->ack) {
+      if (s->ttype == MIP_TTYPE_ACK && s->acked != s->ack) {
         MG_VERBOSE(("%lu ack %x %x", c->id, s->seq, s->ack));
         tx_tcp(ifp, s->mac, rem_ip, TH_ACK, c->loc.port, c->rem.port,
                mg_htonl(s->seq), mg_htonl(s->ack), NULL, 0);
         s->acked = s->ack;
+      } else if (s->ttype == MIP_TTYPE_ARP) {
+        mg_error(c, "ARP timeout");
       } else if (s->ttype == MIP_TTYPE_SYN) {
         mg_error(c, "Connection timeout");
       } else if (s->ttype == MIP_TTYPE_FIN) {
@@ -5962,16 +5918,6 @@ static void send_syn(struct mg_connection *c) {
          0);
 }
 
-static void mac_resolved(struct mg_connection *c) {
-  if (c->is_udp) {
-    c->is_connecting = 0;
-    mg_call(c, MG_EV_CONNECT, NULL);
-  } else {
-    send_syn(c);
-    settmout(c, MIP_TTYPE_SYN);
-  }
-}
-
 void mg_connect_resolved(struct mg_connection *c) {
   struct mg_tcpip_if *ifp = (struct mg_tcpip_if *) c->mgr->priv;
   uint32_t rem_ip;
@@ -5983,29 +5929,32 @@ void mg_connect_resolved(struct mg_connection *c) {
   MG_DEBUG(("%lu %M -> %M", c->id, mg_print_ip_port, &c->loc, mg_print_ip_port,
             &c->rem));
   mg_call(c, MG_EV_RESOLVE, NULL);
-  c->is_connecting = 1;
   if (c->is_udp && (rem_ip == 0xffffffff || rem_ip == (ifp->ip | ~ifp->mask))) {
     struct connstate *s = (struct connstate *) (c + 1);
     memset(s->mac, 0xFF, sizeof(s->mac));  // global or local broadcast
-    mac_resolved(c);
-  } else if (ifp->ip && ((rem_ip & ifp->mask) == (ifp->ip & ifp->mask)) &&
-             rem_ip != ifp->gw) {  // skip if gw (onstatechange -> READY -> ARP)
+  } else if (ifp->ip && ((rem_ip & ifp->mask) == (ifp->ip & ifp->mask))) {
     // If we're in the same LAN, fire an ARP lookup.
     MG_DEBUG(("%lu ARP lookup...", c->id));
     arp_ask(ifp, rem_ip);
     settmout(c, MIP_TTYPE_ARP);
     c->is_arplooking = 1;
+    c->is_connecting = 1;
   } else if ((*((uint8_t *) &rem_ip) & 0xE0) == 0xE0) {
     struct connstate *s = (struct connstate *) (c + 1);  // 224 to 239, E0 to EF
     uint8_t mcastp[3] = {0x01, 0x00, 0x5E};              // multicast group
     memcpy(s->mac, mcastp, 3);
     memcpy(s->mac + 3, ((uint8_t *) &rem_ip) + 1, 3);  // 23 LSb
     s->mac[3] &= 0x7F;
-    mac_resolved(c);
   } else {
     struct connstate *s = (struct connstate *) (c + 1);
     memcpy(s->mac, ifp->gwmac, sizeof(ifp->gwmac));
-    mac_resolved(c);
+    if (c->is_udp) {
+      mg_call(c, MG_EV_CONNECT, NULL);
+    } else {
+      send_syn(c);
+      settmout(c, MIP_TTYPE_SYN);
+      c->is_connecting = 1;
+    }
   }
 }
 
@@ -6081,9 +6030,6 @@ bool mg_send(struct mg_connection *c, const void *buf, size_t len) {
   memcpy(&rem_ip, c->rem.ip, sizeof(uint32_t));
   if (ifp->ip == 0 || ifp->state != MG_TCPIP_STATE_READY) {
     mg_error(c, "net down");
-  } else if (c->is_udp && (c->is_arplooking || c->is_resolving)) {
-    // Fail to send, no target MAC or IP
-    MG_VERBOSE(("still resolving..."));
   } else if (c->is_udp) {
     struct connstate *s = (struct connstate *) (c + 1);
     len = trim_len(c, len);  // Trimming length if necessary
@@ -6685,7 +6631,8 @@ void mg_rpc_add(struct mg_rpc **head, struct mg_str method,
                 void (*fn)(struct mg_rpc_req *), void *fn_data) {
   struct mg_rpc *rpc = (struct mg_rpc *) calloc(1, sizeof(*rpc));
   if (rpc != NULL) {
-    rpc->method = mg_strdup(method);
+    rpc->method.buf = mg_mprintf("%.*s", method.len, method.buf);
+    rpc->method.len = method.len;
     rpc->fn = fn;
     rpc->fn_data = fn_data;
     rpc->next = *head, *head = rpc;
@@ -7177,12 +7124,6 @@ void mg_hmac_sha256(uint8_t dst[32], uint8_t *key, size_t keysz, uint8_t *data,
 #define SNTP_TIME_OFFSET 2208988800U  // (1970 - 1900) in seconds
 #define SNTP_MAX_FRAC 4294967295.0    // 2 ** 32 - 1
 
-static uint64_t s_boot_timestamp = 0;  // Updated by SNTP
-
-uint64_t mg_now(void) {
-  return mg_millis() + s_boot_timestamp;
-}
-
 static int64_t gettimestamp(const uint32_t *data) {
   uint32_t sec = mg_ntohl(data[0]), frac = mg_ntohl(data[1]);
   if (sec) sec -= SNTP_TIME_OFFSET;
@@ -7190,7 +7131,7 @@ static int64_t gettimestamp(const uint32_t *data) {
 }
 
 int64_t mg_sntp_parse(const unsigned char *buf, size_t len) {
-  int64_t epoch_milliseconds = -1;
+  int64_t res = -1;
   int mode = len > 0 ? buf[0] & 7 : 0;
   int version = len > 0 ? (buf[0] >> 3) & 7 : 0;
   if (len < 48) {
@@ -7201,36 +7142,31 @@ int64_t mg_sntp_parse(const unsigned char *buf, size_t len) {
     MG_ERROR(("%s", "server sent a kiss of death"));
   } else if (version == 4 || version == 3) {
     // int64_t ref = gettimestamp((uint32_t *) &buf[16]);
-    int64_t origin_time = gettimestamp((uint32_t *) &buf[24]);
-    int64_t receive_time = gettimestamp((uint32_t *) &buf[32]);
-    int64_t transmit_time = gettimestamp((uint32_t *) &buf[40]);
-    int64_t now = (int64_t) mg_millis();
-    int64_t latency = (now - origin_time) - (transmit_time - receive_time);
-    epoch_milliseconds = transmit_time + latency / 2;
-    s_boot_timestamp = (uint64_t) (epoch_milliseconds - now);
+    int64_t t0 = gettimestamp((uint32_t *) &buf[24]);
+    int64_t t1 = gettimestamp((uint32_t *) &buf[32]);
+    int64_t t2 = gettimestamp((uint32_t *) &buf[40]);
+    int64_t t3 = (int64_t) mg_millis();
+    int64_t delta = (t3 - t0) - (t2 - t1);
+    MG_VERBOSE(("%lld %lld %lld %lld delta:%lld", t0, t1, t2, t3, delta));
+    res = t2 + delta / 2;
   } else {
     MG_ERROR(("unexpected version: %d", version));
   }
-  return epoch_milliseconds;
+  return res;
 }
 
 static void sntp_cb(struct mg_connection *c, int ev, void *ev_data) {
-  uint64_t *expiration_time = (uint64_t *) c->data;
-  if (ev == MG_EV_OPEN) {
-    *expiration_time = mg_millis() + 3000;  // Store expiration time in 3s
-  } else if (ev == MG_EV_CONNECT) {
-    mg_sntp_request(c);
-  } else if (ev == MG_EV_READ) {
+  if (ev == MG_EV_READ) {
     int64_t milliseconds = mg_sntp_parse(c->recv.buf, c->recv.len);
     if (milliseconds > 0) {
-      s_boot_timestamp = (uint64_t) milliseconds - mg_millis();
-      mg_call(c, MG_EV_SNTP_TIME, (uint64_t *) &milliseconds);
       MG_DEBUG(("%lu got time: %lld ms from epoch", c->id, milliseconds));
+      mg_call(c, MG_EV_SNTP_TIME, (uint64_t *) &milliseconds);
+      MG_VERBOSE(("%u.%u", (unsigned) (milliseconds / 1000),
+                  (unsigned) (milliseconds % 1000)));
     }
-    // mg_iobuf_del(&c->recv, 0, c->recv.len);  // Free receive buffer
-    c->is_closing = 1;
-  } else if (ev == MG_EV_POLL) {
-    if (mg_millis() > *expiration_time) c->is_closing = 1;
+    mg_iobuf_del(&c->recv, 0, c->recv.len);  // Free receive buffer
+  } else if (ev == MG_EV_CONNECT) {
+    mg_sntp_request(c);
   } else if (ev == MG_EV_CLOSE) {
   }
   (void) ev_data;
@@ -7255,10 +7191,7 @@ struct mg_connection *mg_sntp_connect(struct mg_mgr *mgr, const char *url,
                                       mg_event_handler_t fn, void *fnd) {
   struct mg_connection *c = NULL;
   if (url == NULL) url = "udp://time.google.com:123";
-  if ((c = mg_connect(mgr, url, fn, fnd)) != NULL) {
-    c->pfn = sntp_cb;
-    sntp_cb(c, MG_EV_OPEN, (void *) url);
-  }
+  if ((c = mg_connect(mgr, url, fn, fnd)) != NULL) c->pfn = sntp_cb;
   return c;
 }
 
@@ -7543,30 +7476,17 @@ static void read_conn(struct mg_connection *c) {
     size_t len = c->recv.size - c->recv.len;
     long n = -1;
     if (c->is_tls) {
-      // Do not read to the raw TLS buffer if it already has enough.
-      // This is to prevent overflowing c->rtls if our reads are slow
-      long m;
-      if (c->rtls.len < 16 * 1024 + 40) {  // TLS record, header, MAC, padding
-        if (!ioalloc(c, &c->rtls)) return;
-        n = recv_raw(c, (char *) &c->rtls.buf[c->rtls.len],
-                     c->rtls.size - c->rtls.len);
+      if (!ioalloc(c, &c->rtls)) return;
+      n = recv_raw(c, (char *) &c->rtls.buf[c->rtls.len],
+                   c->rtls.size - c->rtls.len);
+      if (n == MG_IO_ERR && c->rtls.len == 0) {
+        // Close only if we have fully drained both raw (rtls) and TLS buffers
+        c->is_closing = 1;
+      } else {
         if (n > 0) c->rtls.len += (size_t) n;
+        if (c->is_tls_hs) mg_tls_handshake(c);
+        n = c->is_tls_hs ? (long) MG_IO_WAIT : mg_tls_recv(c, buf, len);
       }
-      // there can still be > 16K from last iteration, always mg_tls_recv()
-      m = c->is_tls_hs ? (long) MG_IO_WAIT : mg_tls_recv(c, buf, len);
-      if (n == MG_IO_ERR) {
-        if (c->rtls.len == 0 || m < 0) {
-          // Close only when we have fully drained both rtls and TLS buffers
-          c->is_closing = 1;  // or there's nothing we can do about it.
-          m = -1;
-        } else { // see #2885
-          // TLS buffer is capped to max record size, even though, there can
-          // be more than one record, give TLS a chance to process them.
-        }
-      } else if (c->is_tls_hs) {
-        mg_tls_handshake(c);
-      }
-      n = m;
     } else {
       n = recv_raw(c, buf, len);
     }
@@ -7633,9 +7553,8 @@ static void setsockopts(struct mg_connection *c) {
 
 void mg_connect_resolved(struct mg_connection *c) {
   int type = c->is_udp ? SOCK_DGRAM : SOCK_STREAM;
-  int proto = type == SOCK_DGRAM ? IPPROTO_UDP : IPPROTO_TCP;
   int rc, af = c->rem.is_ip6 ? AF_INET6 : AF_INET;  // c->rem has resolved IP
-  c->fd = S2PTR(socket(af, type, proto));           // Create outbound socket
+  c->fd = S2PTR(socket(af, type, 0));               // Create outbound socket
   c->is_resolving = 0;                              // Clear resolving flag
   if (FD(c) == MG_INVALID_SOCKET) {
     mg_error(c, "socket(): %d", MG_SOCK_ERR(-1));
@@ -7788,15 +7707,15 @@ static void mg_iotest(struct mg_mgr *mgr, int ms) {
   n = 0;
   for (struct mg_connection *c = mgr->conns; c != NULL; c = c->next) {
     c->is_readable = c->is_writable = 0;
-    if (c->is_closing) ms = 1;
     if (skip_iotest(c)) {
       // Socket not valid, ignore
+    } else if (c->rtls.len > 0 || mg_tls_pending(c) > 0) {
+      ms = 1;  // Don't wait if TLS is ready
     } else {
-      // Don't wait if TLS is ready
-      if (c->rtls.len > 0 || mg_tls_pending(c) > 0) ms = 1;
       fds[n].fd = FD(c);
       if (can_read(c)) fds[n].events |= POLLIN;
       if (can_write(c)) fds[n].events |= POLLOUT;
+      if (c->is_closing) ms = 1;
       n++;
     }
   }
@@ -7812,6 +7731,8 @@ static void mg_iotest(struct mg_mgr *mgr, int ms) {
   for (struct mg_connection *c = mgr->conns; c != NULL; c = c->next) {
     if (skip_iotest(c)) {
       // Socket not valid, ignore
+    } else if (c->rtls.len > 0 || mg_tls_pending(c) > 0) {
+      c->is_readable = 1;
     } else {
       if (fds[n].revents & POLLERR) {
         mg_error(c, "socket error");
@@ -7843,7 +7764,7 @@ static void mg_iotest(struct mg_mgr *mgr, int ms) {
     if (can_write(c)) FD_SET(FD(c), &wset);
     if (c->rtls.len > 0 || mg_tls_pending(c) > 0) tvp = &tv_zero;
     if (FD(c) > maxfd) maxfd = FD(c);
-    if (c->is_closing) tvp = &tv_zero;
+    if (c->is_closing) ms = 1;
   }
 
   if ((rc = select((int) maxfd + 1, &rset, &wset, &eset, tvp)) < 0) {
@@ -7879,8 +7800,8 @@ static bool mg_socketpair(MG_SOCKET_TYPE sp[2], union usa usa[2]) {
   *(uint32_t *) &usa->sin.sin_addr = mg_htonl(0x7f000001U);  // 127.0.0.1
   usa[1] = usa[0];
 
-  if ((sp[0] = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) != MG_INVALID_SOCKET &&
-      (sp[1] = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) != MG_INVALID_SOCKET &&
+  if ((sp[0] = socket(AF_INET, SOCK_DGRAM, 0)) != MG_INVALID_SOCKET &&
+      (sp[1] = socket(AF_INET, SOCK_DGRAM, 0)) != MG_INVALID_SOCKET &&
       bind(sp[0], &usa[0].sa, n) == 0 &&          //
       bind(sp[1], &usa[1].sa, n) == 0 &&          //
       getsockname(sp[0], &usa[0].sa, &n) == 0 &&  //
@@ -8023,7 +7944,7 @@ static char *mg_ssi(const char *path, const char *root, int depth) {
       if (intag && ch == '>' && buf[len - 1] == '-' && buf[len - 2] == '-') {
         buf[len++] = (char) (ch & 0xff);
         buf[len] = '\0';
-        if (sscanf(buf, "<!--#include file=\"%[^\"]", arg) > 0) {
+        if (sscanf(buf, "<!--#include file=\"%[^\"]", arg)) {
           char tmp[MG_PATH_MAX + MG_SSI_BUFSIZ + 10],
               *p = (char *) path + strlen(path), *data;
           while (p > path && p[-1] != MG_DIRSEP && p[-1] != '/') p--;
@@ -8035,7 +7956,7 @@ static char *mg_ssi(const char *path, const char *root, int depth) {
           } else {
             MG_ERROR(("%s: file=%s error or too deep", path, arg));
           }
-        } else if (sscanf(buf, "<!--#include virtual=\"%[^\"]", arg) > 0) {
+        } else if (sscanf(buf, "<!--#include virtual=\"%[^\"]", arg)) {
           char tmp[MG_PATH_MAX + MG_SSI_BUFSIZ + 10], *data;
           mg_snprintf(tmp, sizeof(tmp), "%s%s", root, arg);
           if (depth < MG_MAX_SSI_DEPTH &&
@@ -8125,20 +8046,6 @@ int mg_casecmp(const char *s1, const char *s2) {
   return diff;
 }
 
-struct mg_str mg_strdup(const struct mg_str s) {
-  struct mg_str r = {NULL, 0};
-  if (s.len > 0 && s.buf != NULL) {
-    char *sc = (char *) calloc(1, s.len + 1);
-    if (sc != NULL) {
-      memcpy(sc, s.buf, s.len);
-      sc[s.len] = '\0';
-      r.buf = sc;
-      r.len = s.len;
-    }
-  }
-  return r;
-}
-
 int mg_strcmp(const struct mg_str str1, const struct mg_str str2) {
   size_t i = 0;
   while (i < str1.len && i < str2.len) {
@@ -8171,9 +8078,7 @@ bool mg_match(struct mg_str s, struct mg_str p, struct mg_str *caps) {
   size_t i = 0, j = 0, ni = 0, nj = 0;
   if (caps) caps->buf = NULL, caps->len = 0;
   while (i < p.len || j < s.len) {
-    if (i < p.len && j < s.len &&
-        (p.buf[i] == '?' ||
-         (p.buf[i] != '*' && p.buf[i] != '#' && s.buf[j] == p.buf[i]))) {
+    if (i < p.len && j < s.len && (p.buf[i] == '?' || s.buf[j] == p.buf[i])) {
       if (caps == NULL) {
       } else if (p.buf[i] == '?') {
         caps->buf = &s.buf[j], caps->len = 1;     // Finalize `?` cap
@@ -8216,10 +8121,10 @@ bool mg_span(struct mg_str s, struct mg_str *a, struct mg_str *b, char sep) {
 
 bool mg_str_to_num(struct mg_str str, int base, void *val, size_t val_len) {
   size_t i = 0, ndigits = 0;
-  uint64_t max = val_len == sizeof(uint8_t)    ? 0xFF
+  uint64_t max = val_len == sizeof(uint8_t)   ? 0xFF
                  : val_len == sizeof(uint16_t) ? 0xFFFF
                  : val_len == sizeof(uint32_t) ? 0xFFFFFFFF
-                                               : (uint64_t) ~0;
+                                : (uint64_t) ~0;
   uint64_t result = 0;
   if (max == (uint64_t) ~0 && val_len != sizeof(uint64_t)) return false;
   if (base == 0 && str.len >= 2) {
@@ -8235,7 +8140,7 @@ bool mg_str_to_num(struct mg_str str, int base, void *val, size_t val_len) {
     case 2:
       while (i < str.len && (str.buf[i] == '0' || str.buf[i] == '1')) {
         uint64_t digit = (uint64_t) (str.buf[i] - '0');
-        if (result > max / 2) return false;  // Overflow
+        if (result > max/2) return false;  // Overflow
         result *= 2;
         if (result > max - digit) return false;  // Overflow
         result += digit;
@@ -8245,12 +8150,12 @@ bool mg_str_to_num(struct mg_str str, int base, void *val, size_t val_len) {
     case 10:
       while (i < str.len && str.buf[i] >= '0' && str.buf[i] <= '9') {
         uint64_t digit = (uint64_t) (str.buf[i] - '0');
-        if (result > max / 10) return false;  // Overflow
+        if (result > max/10) return false;  // Overflow
         result *= 10;
         if (result > max - digit) return false;  // Overflow
         result += digit;
         i++, ndigits++;
-      }
+    }
       break;
     case 16:
       while (i < str.len) {
@@ -8260,7 +8165,7 @@ bool mg_str_to_num(struct mg_str str, int base, void *val, size_t val_len) {
                          : (c >= 'a' && c <= 'f') ? (uint64_t) (c - 'W')
                                                   : (uint64_t) ~0;
         if (digit == (uint64_t) ~0) break;
-        if (result > max / 16) return false;  // Overflow
+        if (result > max/16) return false;  // Overflow
         result *= 16;
         if (result > max - digit) return false;  // Overflow
         result += digit;
@@ -9467,16 +9372,8 @@ int mg_aes_gcm_decrypt(unsigned char *output, const unsigned char *input,
 
 
 
-
-
-
-
-
-
 #if MG_TLS == MG_TLS_BUILTIN
 
-#define CHACHA20 1
-
 /* TLS 1.3 Record Content Type (RFC8446 B.1) */
 #define MG_TLS_CHANGE_CIPHER 20
 #define MG_TLS_ALERT 21
@@ -9489,7 +9386,6 @@ int mg_aes_gcm_decrypt(unsigned char *output, const unsigned char *input,
 #define MG_TLS_SERVER_HELLO 2
 #define MG_TLS_ENCRYPTED_EXTENSIONS 8
 #define MG_TLS_CERTIFICATE 11
-#define MG_TLS_CERTIFICATE_REQUEST 13
 #define MG_TLS_CERTIFICATE_VERIFY 15
 #define MG_TLS_FINISHED 20
 
@@ -9511,48 +9407,43 @@ enum mg_tls_hs_state {
   MG_TLS_STATE_SERVER_CONNECTED    // Done
 };
 
-// encryption keys for a TLS connection
-struct tls_enc {
-  uint32_t sseq;  // server sequence number, used in encryption
-  uint32_t cseq;  // client sequence number, used in decryption
-  // keys for AES encryption or ChaCha20
-  uint8_t handshake_secret[32];
-  uint8_t server_write_key[32];
-  uint8_t server_write_iv[12];
-  uint8_t server_finished_key[32];
-  uint8_t client_write_key[32];
-  uint8_t client_write_iv[12];
-  uint8_t client_finished_key[32];
-};
-
 // per-connection TLS data
 struct tls_data {
   enum mg_tls_hs_state state;  // keep track of connection handshake progress
 
   struct mg_iobuf send;  // For the receive path, we're reusing c->rtls
-  size_t recv_offset;    // While c->rtls contains full records, reuse that
-  size_t recv_len;       // buffer but point at individual decrypted messages
-
+  struct mg_iobuf recv;  // While c->rtls contains full records, recv reuses
+                         // the same underlying buffer but points at individual
+                         // decrypted messages
   uint8_t content_type;  // Last received record content type
 
   mg_sha256_ctx sha256;  // incremental SHA-256 hash for TLS handshake
 
+  uint32_t sseq;  // server sequence number, used in encryption
+  uint32_t cseq;  // client sequence number, used in decryption
+
   uint8_t random[32];      // client random from ClientHello
   uint8_t session_id[32];  // client session ID between the handshake states
   uint8_t x25519_cli[32];  // client X25519 key between the handshake states
   uint8_t x25519_sec[32];  // x25519 secret between the handshake states
 
-  int skip_verification;   // perform checks on server certificate?
-  int cert_requested;      // client received a CertificateRequest?
-  struct mg_str cert_der;  // certificate in DER format
-  uint8_t ec_key[32];      // EC private key
-  char hostname[254];      // server hostname (client extension)
+  int skip_verification;          // perform checks on server certificate?
+  struct mg_str server_cert_der;  // server certificate in DER format
+  uint8_t server_key[32];         // server EC private key
+  char hostname[254];             // server hostname (client extension)
 
   uint8_t certhash[32];  // certificate message hash
   uint8_t pubkey[64];    // server EC public key to verify cert
   uint8_t sighash[32];   // server EC public key to verify cert
 
-  struct tls_enc enc;
+  // keys for AES encryption
+  uint8_t handshake_secret[32];
+  uint8_t server_write_key[16];
+  uint8_t server_write_iv[12];
+  uint8_t server_finished_key[32];
+  uint8_t client_write_key[16];
+  uint8_t client_write_iv[12];
+  uint8_t client_finished_key[32];
 };
 
 #define MG_LOAD_BE16(p) ((uint16_t) ((MG_U8P(p)[0] << 8U) | MG_U8P(p)[1]))
@@ -9561,36 +9452,39 @@ struct tls_data {
 #define MG_STORE_BE16(p, n)           \
   do {                                \
     MG_U8P(p)[0] = ((n) >> 8U) & 255; \
-    MG_U8P(p)[1] = (n) &255;          \
+    MG_U8P(p)[1] = (n) & 255;         \
   } while (0)
 
 #define TLS_RECHDR_SIZE 5  // 1 byte type, 2 bytes version, 2 bytes length
 #define TLS_MSGHDR_SIZE 4  // 1 byte type, 3 bytes length
 
-#ifdef MG_TLS_SSLKEYLOGFILE
+#if 1
+static void mg_ssl_key_log(const char *label, uint8_t client_random[32],
+                           uint8_t *secret, size_t secretsz) {
+  (void) label;
+  (void) client_random;
+  (void) secret;
+  (void) secretsz;
+}
+#else
 #include <stdio.h>
 static void mg_ssl_key_log(const char *label, uint8_t client_random[32],
                            uint8_t *secret, size_t secretsz) {
   char *keylogfile = getenv("SSLKEYLOGFILE");
-  size_t i;
-  if (keylogfile != NULL) {
-    MG_DEBUG(("Dumping key log into %s", keylogfile));
-    FILE *f = fopen(keylogfile, "a");
-    if (f != NULL) {
-      fprintf(f, "%s ", label);
-      for (i = 0; i < 32; i++) {
-        fprintf(f, "%02x", client_random[i]);
-      }
-      fprintf(f, " ");
-      for (i = 0; i < secretsz; i++) {
-        fprintf(f, "%02x", secret[i]);
-      }
-      fprintf(f, "\n");
-      fclose(f);
-    } else {
-      MG_ERROR(("Cannot open %s", keylogfile));
-    }
+  if (keylogfile == NULL) {
+    return;
+  }
+  FILE *f = fopen(keylogfile, "a");
+  fprintf(f, "%s ", label);
+  for (int i = 0; i < 32; i++) {
+    fprintf(f, "%02x", client_random[i]);
+  }
+  fprintf(f, " ");
+  for (unsigned int i = 0; i < secretsz; i++) {
+    fprintf(f, "%02x", secret[i]);
   }
+  fprintf(f, "\n");
+  fclose(f);
 }
 #endif
 
@@ -9679,17 +9573,14 @@ static void mg_tls_drop_record(struct mg_connection *c) {
 static void mg_tls_drop_message(struct mg_connection *c) {
   uint32_t len;
   struct tls_data *tls = (struct tls_data *) c->tls;
-  unsigned char *recv_buf = &c->rtls.buf[tls->recv_offset];
-  if (tls->recv_len == 0) return;
-  len = MG_LOAD_BE24(recv_buf + 1) + TLS_MSGHDR_SIZE;
-  if (tls->recv_len < len) {
-    mg_error(c, "wrong size");
+  if (tls->recv.len == 0) {
     return;
   }
-  mg_sha256_update(&tls->sha256, recv_buf, len);
-  tls->recv_offset += len;
-  tls->recv_len -= len;
-  if (tls->recv_len == 0) {
+  len = MG_LOAD_BE24(tls->recv.buf + 1);
+  mg_sha256_update(&tls->sha256, tls->recv.buf, len + TLS_MSGHDR_SIZE);
+  tls->recv.buf += len + TLS_MSGHDR_SIZE;
+  tls->recv.len -= len + TLS_MSGHDR_SIZE;
+  if (tls->recv.len == 0) {
     mg_tls_drop_record(c);
   }
 }
@@ -9722,19 +9613,14 @@ static void mg_tls_generate_handshake_keys(struct mg_connection *c) {
   uint8_t hello_hash[32];
   uint8_t server_hs_secret[32];
   uint8_t client_hs_secret[32];
-#if CHACHA20
-  const size_t keysz = 32;
-#else
-  const size_t keysz = 16;
-#endif
 
   mg_hmac_sha256(early_secret, NULL, 0, zeros, sizeof(zeros));
   mg_tls_derive_secret("tls13 derived", early_secret, 32, zeros_sha256_digest,
                        32, pre_extract_secret, 32);
-  mg_hmac_sha256(tls->enc.handshake_secret, pre_extract_secret,
+  mg_hmac_sha256(tls->handshake_secret, pre_extract_secret,
                  sizeof(pre_extract_secret), tls->x25519_sec,
                  sizeof(tls->x25519_sec));
-  mg_tls_hexdump("hs secret", tls->enc.handshake_secret, 32);
+  mg_tls_hexdump("hs secret", tls->handshake_secret, 32);
 
   // mg_sha256_final is not idempotent, need to copy sha256 context to calculate
   // the digest
@@ -9743,40 +9629,37 @@ static void mg_tls_generate_handshake_keys(struct mg_connection *c) {
 
   mg_tls_hexdump("hello hash", hello_hash, 32);
   // derive keys needed for the rest of the handshake
-  mg_tls_derive_secret("tls13 s hs traffic", tls->enc.handshake_secret, 32,
+  mg_tls_derive_secret("tls13 s hs traffic", tls->handshake_secret, 32,
                        hello_hash, 32, server_hs_secret, 32);
-  mg_tls_derive_secret("tls13 c hs traffic", tls->enc.handshake_secret, 32,
-                       hello_hash, 32, client_hs_secret, 32);
-
   mg_tls_derive_secret("tls13 key", server_hs_secret, 32, NULL, 0,
-                       tls->enc.server_write_key, keysz);
+                       tls->server_write_key, 16);
   mg_tls_derive_secret("tls13 iv", server_hs_secret, 32, NULL, 0,
-                       tls->enc.server_write_iv, 12);
+                       tls->server_write_iv, 12);
   mg_tls_derive_secret("tls13 finished", server_hs_secret, 32, NULL, 0,
-                       tls->enc.server_finished_key, 32);
+                       tls->server_finished_key, 32);
 
+  mg_tls_derive_secret("tls13 c hs traffic", tls->handshake_secret, 32,
+                       hello_hash, 32, client_hs_secret, 32);
   mg_tls_derive_secret("tls13 key", client_hs_secret, 32, NULL, 0,
-                       tls->enc.client_write_key, keysz);
+                       tls->client_write_key, 16);
   mg_tls_derive_secret("tls13 iv", client_hs_secret, 32, NULL, 0,
-                       tls->enc.client_write_iv, 12);
+                       tls->client_write_iv, 12);
   mg_tls_derive_secret("tls13 finished", client_hs_secret, 32, NULL, 0,
-                       tls->enc.client_finished_key, 32);
+                       tls->client_finished_key, 32);
 
   mg_tls_hexdump("s hs traffic", server_hs_secret, 32);
-  mg_tls_hexdump("s key", tls->enc.server_write_key, keysz);
-  mg_tls_hexdump("s iv", tls->enc.server_write_iv, 12);
-  mg_tls_hexdump("s finished", tls->enc.server_finished_key, 32);
+  mg_tls_hexdump("s key", tls->server_write_key, 16);
+  mg_tls_hexdump("s iv", tls->server_write_iv, 12);
+  mg_tls_hexdump("s finished", tls->server_finished_key, 32);
   mg_tls_hexdump("c hs traffic", client_hs_secret, 32);
-  mg_tls_hexdump("c key", tls->enc.client_write_key, keysz);
-  mg_tls_hexdump("c iv", tls->enc.client_write_iv, 12);
-  mg_tls_hexdump("c finished", tls->enc.client_finished_key, 32);
+  mg_tls_hexdump("c key", tls->client_write_key, 16);
+  mg_tls_hexdump("c iv", tls->client_write_iv, 16);
+  mg_tls_hexdump("c finished", tls->client_finished_key, 32);
 
-#ifdef MG_TLS_SSLKEYLOGFILE
   mg_ssl_key_log("SERVER_HANDSHAKE_TRAFFIC_SECRET", tls->random,
                  server_hs_secret, 32);
   mg_ssl_key_log("CLIENT_HANDSHAKE_TRAFFIC_SECRET", tls->random,
                  client_hs_secret, 32);
-#endif
 }
 
 static void mg_tls_generate_application_keys(struct mg_connection *c) {
@@ -9786,47 +9669,40 @@ static void mg_tls_generate_application_keys(struct mg_connection *c) {
   uint8_t master_secret[32];
   uint8_t server_secret[32];
   uint8_t client_secret[32];
-#if CHACHA20
-  const size_t keysz = 32;
-#else
-  const size_t keysz = 16;
-#endif
 
   mg_sha256_ctx sha256;
   memmove(&sha256, &tls->sha256, sizeof(mg_sha256_ctx));
   mg_sha256_final(hash, &sha256);
 
-  mg_tls_derive_secret("tls13 derived", tls->enc.handshake_secret, 32,
+  mg_tls_derive_secret("tls13 derived", tls->handshake_secret, 32,
                        zeros_sha256_digest, 32, premaster_secret, 32);
   mg_hmac_sha256(master_secret, premaster_secret, 32, zeros, 32);
 
   mg_tls_derive_secret("tls13 s ap traffic", master_secret, 32, hash, 32,
                        server_secret, 32);
   mg_tls_derive_secret("tls13 key", server_secret, 32, NULL, 0,
-                       tls->enc.server_write_key, keysz);
+                       tls->server_write_key, 16);
   mg_tls_derive_secret("tls13 iv", server_secret, 32, NULL, 0,
-                       tls->enc.server_write_iv, 12);
+                       tls->server_write_iv, 12);
   mg_tls_derive_secret("tls13 c ap traffic", master_secret, 32, hash, 32,
                        client_secret, 32);
   mg_tls_derive_secret("tls13 key", client_secret, 32, NULL, 0,
-                       tls->enc.client_write_key, keysz);
+                       tls->client_write_key, 16);
   mg_tls_derive_secret("tls13 iv", client_secret, 32, NULL, 0,
-                       tls->enc.client_write_iv, 12);
+                       tls->client_write_iv, 12);
 
   mg_tls_hexdump("s ap traffic", server_secret, 32);
-  mg_tls_hexdump("s key", tls->enc.server_write_key, keysz);
-  mg_tls_hexdump("s iv", tls->enc.server_write_iv, 12);
-  mg_tls_hexdump("s finished", tls->enc.server_finished_key, 32);
+  mg_tls_hexdump("s key", tls->server_write_key, 16);
+  mg_tls_hexdump("s iv", tls->server_write_iv, 12);
+  mg_tls_hexdump("s finished", tls->server_finished_key, 32);
   mg_tls_hexdump("c ap traffic", client_secret, 32);
-  mg_tls_hexdump("c key", tls->enc.client_write_key, keysz);
-  mg_tls_hexdump("c iv", tls->enc.client_write_iv, 12);
-  mg_tls_hexdump("c finished", tls->enc.client_finished_key, 32);
-  tls->enc.sseq = tls->enc.cseq = 0;
+  mg_tls_hexdump("c key", tls->client_write_key, 16);
+  mg_tls_hexdump("c iv", tls->client_write_iv, 16);
+  mg_tls_hexdump("c finished", tls->client_finished_key, 32);
+  tls->sseq = tls->cseq = 0;
 
-#ifdef MG_TLS_SSLKEYLOGFILE
   mg_ssl_key_log("SERVER_TRAFFIC_SECRET_0", tls->random, server_secret, 32);
   mg_ssl_key_log("CLIENT_TRAFFIC_SECRET_0", tls->random, client_secret, 32);
-#endif
 }
 
 // AES GCM encryption of the message + put encoded data into the write buffer
@@ -9844,21 +9720,21 @@ static void mg_tls_encrypt(struct mg_connection *c, const uint8_t *msg,
                                 (uint8_t) (encsz & 0xff)};
   uint8_t nonce[12];
 
-  uint32_t seq = c->is_client ? tls->enc.cseq : tls->enc.sseq;
-  uint8_t *key =
-      c->is_client ? tls->enc.client_write_key : tls->enc.server_write_key;
-  uint8_t *iv =
-      c->is_client ? tls->enc.client_write_iv : tls->enc.server_write_iv;
-
-#if !CHACHA20
   mg_gcm_initialize();
-#endif
 
-  memmove(nonce, iv, sizeof(nonce));
-  nonce[8] ^= (uint8_t) ((seq >> 24) & 255U);
-  nonce[9] ^= (uint8_t) ((seq >> 16) & 255U);
-  nonce[10] ^= (uint8_t) ((seq >> 8) & 255U);
-  nonce[11] ^= (uint8_t) ((seq) &255U);
+  if (c->is_client) {
+    memmove(nonce, tls->client_write_iv, sizeof(tls->client_write_iv));
+    nonce[8] ^= (uint8_t) ((tls->cseq >> 24) & 255U);
+    nonce[9] ^= (uint8_t) ((tls->cseq >> 16) & 255U);
+    nonce[10] ^= (uint8_t) ((tls->cseq >> 8) & 255U);
+    nonce[11] ^= (uint8_t) ((tls->cseq) & 255U);
+  } else {
+    memmove(nonce, tls->server_write_iv, sizeof(tls->server_write_iv));
+    nonce[8] ^= (uint8_t) ((tls->sseq >> 24) & 255U);
+    nonce[9] ^= (uint8_t) ((tls->sseq >> 16) & 255U);
+    nonce[10] ^= (uint8_t) ((tls->sseq >> 8) & 255U);
+    nonce[11] ^= (uint8_t) ((tls->sseq) & 255U);
+  }
 
   mg_iobuf_add(wio, wio->len, hdr, sizeof(hdr));
   mg_iobuf_resize(wio, wio->len + encsz);
@@ -9866,27 +9742,17 @@ static void mg_tls_encrypt(struct mg_connection *c, const uint8_t *msg,
   tag = wio->buf + wio->len + msgsz + 1;
   memmove(outmsg, msg, msgsz);
   outmsg[msgsz] = msgtype;
-#if CHACHA20
-  (void) tag;  // tag is only used in aes gcm
-  {
-    size_t maxlen = MG_IO_SIZE > 16384 ? 16384 : MG_IO_SIZE;
-    uint8_t *enc = (uint8_t *) calloc(1, maxlen + 256 + 1);
-    if (enc == NULL) {
-      mg_error(c, "TLS OOM");
-      return;
-    } else {
-      size_t n = mg_chacha20_poly1305_encrypt(enc, key, nonce, associated_data,
-                                              sizeof(associated_data), outmsg,
-                                              msgsz + 1);
-      memmove(outmsg, enc, n);
-      free(enc);
-    }
+  if (c->is_client) {
+    mg_aes_gcm_encrypt(outmsg, outmsg, msgsz + 1, tls->client_write_key,
+                       sizeof(tls->client_write_key), nonce, sizeof(nonce),
+                       associated_data, sizeof(associated_data), tag, 16);
+    tls->cseq++;
+  } else {
+    mg_aes_gcm_encrypt(outmsg, outmsg, msgsz + 1, tls->server_write_key,
+                       sizeof(tls->server_write_key), nonce, sizeof(nonce),
+                       associated_data, sizeof(associated_data), tag, 16);
+    tls->sseq++;
   }
-#else
-  mg_aes_gcm_encrypt(outmsg, outmsg, msgsz + 1, key, 16, nonce, sizeof(nonce),
-                     associated_data, sizeof(associated_data), tag, 16);
-#endif
-  c->is_client ? tls->enc.cseq++ : tls->enc.sseq++;
   wio->len += encsz;
 }
 
@@ -9898,14 +9764,7 @@ static int mg_tls_recv_record(struct mg_connection *c) {
   uint8_t *msg;
   uint8_t nonce[12];
   int r;
-
-  uint32_t seq = c->is_client ? tls->enc.sseq : tls->enc.cseq;
-  uint8_t *key =
-      c->is_client ? tls->enc.server_write_key : tls->enc.client_write_key;
-  uint8_t *iv =
-      c->is_client ? tls->enc.server_write_iv : tls->enc.client_write_iv;
-
-  if (tls->recv_len > 0) {
+  if (tls->recv.len > 0) {
     return 0; /* some data from previous record is still present */
   }
   for (;;) {
@@ -9926,59 +9785,43 @@ static int mg_tls_recv_record(struct mg_connection *c) {
     }
   }
 
-#if !CHACHA20
   mg_gcm_initialize();
-#endif
-
   msgsz = MG_LOAD_BE16(rio->buf + 3);
   msg = rio->buf + 5;
-  memmove(nonce, iv, sizeof(nonce));
-  nonce[8] ^= (uint8_t) ((seq >> 24) & 255U);
-  nonce[9] ^= (uint8_t) ((seq >> 16) & 255U);
-  nonce[10] ^= (uint8_t) ((seq >> 8) & 255U);
-  nonce[11] ^= (uint8_t) ((seq) &255U);
-#if CHACHA20
-  {
-    uint8_t *dec = (uint8_t *) calloc(1, msgsz);
-    size_t n;
-    if (dec == NULL) {
-      mg_error(c, "TLS OOM");
-      return -1;
-    }
-    n = mg_chacha20_poly1305_decrypt(dec, key, nonce, msg, msgsz);
-    memmove(msg, dec, n);
-    free(dec);
-  }
-#else
-  if (msgsz < 16) {
-    mg_error(c, "wrong size");
-    return -1;
+  if (c->is_client) {
+    memmove(nonce, tls->server_write_iv, sizeof(tls->server_write_iv));
+    nonce[8] ^= (uint8_t) ((tls->sseq >> 24) & 255U);
+    nonce[9] ^= (uint8_t) ((tls->sseq >> 16) & 255U);
+    nonce[10] ^= (uint8_t) ((tls->sseq >> 8) & 255U);
+    nonce[11] ^= (uint8_t) ((tls->sseq) & 255U);
+    mg_aes_gcm_decrypt(msg, msg, msgsz - 16, tls->server_write_key,
+                       sizeof(tls->server_write_key), nonce, sizeof(nonce));
+    tls->sseq++;
+  } else {
+    memmove(nonce, tls->client_write_iv, sizeof(tls->client_write_iv));
+    nonce[8] ^= (uint8_t) ((tls->cseq >> 24) & 255U);
+    nonce[9] ^= (uint8_t) ((tls->cseq >> 16) & 255U);
+    nonce[10] ^= (uint8_t) ((tls->cseq >> 8) & 255U);
+    nonce[11] ^= (uint8_t) ((tls->cseq) & 255U);
+    mg_aes_gcm_decrypt(msg, msg, msgsz - 16, tls->client_write_key,
+                       sizeof(tls->client_write_key), nonce, sizeof(nonce));
+    tls->cseq++;
   }
-  mg_aes_gcm_decrypt(msg, msg, msgsz - 16, key, 16, nonce, sizeof(nonce));
-#endif
   r = msgsz - 16 - 1;
   tls->content_type = msg[msgsz - 16 - 1];
-  tls->recv_offset = (size_t) msg - (size_t) rio->buf;
-  tls->recv_len = msgsz - 16 - 1;
-  c->is_client ? tls->enc.sseq++ : tls->enc.cseq++;
+  tls->recv.buf = msg;
+  tls->recv.size = tls->recv.len = msgsz - 16 - 1;
   return r;
 }
 
 static void mg_tls_calc_cert_verify_hash(struct mg_connection *c,
-                                         uint8_t hash[32], int is_client) {
+                                         uint8_t hash[32]) {
   struct tls_data *tls = (struct tls_data *) c->tls;
-  uint8_t server_context[34] = "TLS 1.3, server CertificateVerify";
-  uint8_t client_context[34] = "TLS 1.3, client CertificateVerify";
-  uint8_t sig_content[130];
+  uint8_t sig_content[130] = {
+      "                                "
+      "                                "
+      "TLS 1.3, server CertificateVerify\0"};
   mg_sha256_ctx sha256;
-
-  memset(sig_content, 0x20, 64);
-  if (is_client) {
-    memmove(sig_content + 64, client_context, sizeof(client_context));
-  } else {
-    memmove(sig_content + 64, server_context, sizeof(server_context));
-  }
-
   memmove(&sha256, &tls->sha256, sizeof(mg_sha256_ctx));
   mg_sha256_final(sig_content + 98, &sha256);
 
@@ -10017,10 +9860,8 @@ static int mg_tls_server_recv_hello(struct mg_connection *c) {
     MG_INFO(("bad session id len"));
   }
   cipher_suites_len = MG_LOAD_BE16(rio->buf + 44 + session_id_len);
-  if (cipher_suites_len > (rio->len - 46 - session_id_len)) goto fail;
   ext_len = MG_LOAD_BE16(rio->buf + 48 + session_id_len + cipher_suites_len);
   ext = rio->buf + 50 + session_id_len + cipher_suites_len;
-  if (ext_len > (rio->len - 50 - session_id_len - cipher_suites_len)) goto fail;
   for (j = 0; j < ext_len;) {
     uint16_t k;
     uint16_t key_exchange_len;
@@ -10031,14 +9872,10 @@ static int mg_tls_server_recv_hello(struct mg_connection *c) {
       j += (uint16_t) (n + 4);
       continue;
     }
-    key_exchange_len = MG_LOAD_BE16(ext + j + 4);
+    key_exchange_len = MG_LOAD_BE16(ext + j + 5);
     key_exchange = ext + j + 6;
-    if (key_exchange_len >
-        rio->len - (uint16_t) ((size_t) key_exchange - (size_t) rio->buf) - 2)
-      goto fail;
     for (k = 0; k < key_exchange_len;) {
       uint16_t m = MG_LOAD_BE16(key_exchange + k + 2);
-      if (m > (key_exchange_len - k - 4)) goto fail;
       if (m == 32 && key_exchange[k] == 0x00 && key_exchange[k + 1] == 0x1d) {
         memmove(tls->x25519_cli, key_exchange + k + 4, m);
         mg_tls_drop_record(c);
@@ -10048,7 +9885,6 @@ static int mg_tls_server_recv_hello(struct mg_connection *c) {
     }
     j += (uint16_t) (n + 4);
   }
-fail:
   mg_error(c, "bad client hello");
   return -1;
 }
@@ -10062,33 +9898,56 @@ static void mg_tls_server_send_hello(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   struct mg_iobuf *wio = &tls->send;
 
-  // clang-format off
   uint8_t msg_server_hello[122] = {
-      // server hello, tls 1.2
-      0x02, 0x00, 0x00, 0x76, 0x03, 0x03,
-      // random (32 bytes)
-      PLACEHOLDER_32B,
-      // session ID length + session ID (32 bytes)
-      0x20, PLACEHOLDER_32B,
+    // server hello, tls 1.2
+    0x02,
+    0x00,
+    0x00,
+    0x76,
+    0x03,
+    0x03,
+    // random (32 bytes)
+    PLACEHOLDER_32B,
+    // session ID length + session ID (32 bytes)
+    0x20,
+    PLACEHOLDER_32B,
 #if defined(CHACHA20) && CHACHA20
-      // TLS_CHACHA20_POLY1305_SHA256 + no compression
-      0x13, 0x03, 0x00,
+    // TLS_CHACHA20_POLY1305_SHA256 + no compression
+    0x13,
+    0x03,
+    0x00,
 #else
-      // TLS_AES_128_GCM_SHA256 + no compression
-      0x13, 0x01, 0x00,
-#endif
-      // extensions + keyshare
-      0x00, 0x2e, 0x00, 0x33, 0x00, 0x24, 0x00, 0x1d, 0x00, 0x20,
-      // x25519 keyshare
-      PLACEHOLDER_32B,
-      // supported versions (tls1.3 == 0x304)
-      0x00, 0x2b, 0x00, 0x02, 0x03, 0x04};
-  // clang-format on
+    // TLS_AES_128_GCM_SHA256 + no compression
+    0x13,
+    0x01,
+    0x00,
+#endif
+    // extensions + keyshare
+    0x00,
+    0x2e,
+    0x00,
+    0x33,
+    0x00,
+    0x24,
+    0x00,
+    0x1d,
+    0x00,
+    0x20,
+    // x25519 keyshare
+    PLACEHOLDER_32B,
+    // supported versions (tls1.3 == 0x304)
+    0x00,
+    0x2b,
+    0x00,
+    0x02,
+    0x03,
+    0x04
+  };
 
   // calculate keyshare
   uint8_t x25519_pub[X25519_BYTES];
   uint8_t x25519_prv[X25519_BYTES];
-  if (!mg_random(x25519_prv, sizeof(x25519_prv))) mg_error(c, "RNG"); 
+  mg_random(x25519_prv, sizeof(x25519_prv));
   mg_tls_x25519(x25519_pub, x25519_prv, X25519_BASE_POINT, 1);
   mg_tls_x25519(tls->x25519_sec, x25519_prv, tls->x25519_cli, 1);
   mg_tls_hexdump("s x25519 sec", tls->x25519_sec, sizeof(tls->x25519_sec));
@@ -10118,7 +9977,7 @@ static void mg_tls_server_send_ext(struct mg_connection *c) {
 static void mg_tls_server_send_cert(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   // server DER certificate (empty)
-  size_t n = tls->cert_der.len;
+  size_t n = tls->server_cert_der.len;
   uint8_t *cert = (uint8_t *) calloc(1, 13 + n);
   if (cert == NULL) {
     mg_error(c, "tls cert oom");
@@ -10137,7 +9996,7 @@ static void mg_tls_server_send_cert(struct mg_connection *c) {
   cert[9] = (uint8_t) (((n) >> 8) & 255U);
   cert[10] = (uint8_t) (n & 255U);
   // bytes 11+ are certificate in DER format
-  memmove(cert + 11, tls->cert_der.buf, n);
+  memmove(cert + 11, tls->server_cert_der.buf, n);
   cert[11 + n] = cert[12 + n] = 0;  // certificate extensions (none)
   mg_sha256_update(&tls->sha256, cert, 13 + n);
   mg_tls_encrypt(c, cert, 13 + n, MG_TLS_HANDSHAKE);
@@ -10166,7 +10025,7 @@ static void finish_SHA256(const MG_UECC_HashContext *base,
   mg_sha256_final(hash_result, &c->ctx);
 }
 
-static void mg_tls_send_cert_verify(struct mg_connection *c, int is_client) {
+static void mg_tls_server_send_cert_verify(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   // server certificate verify packet
   uint8_t verify[82] = {0x0f, 0x00, 0x00, 0x00, 0x04, 0x03, 0x00, 0x00};
@@ -10178,10 +10037,10 @@ static void mg_tls_send_cert_verify(struct mg_connection *c, int is_client) {
   int neg1, neg2;
   uint8_t sig[64] = {0};
 
-  mg_tls_calc_cert_verify_hash(c, (uint8_t *) hash, is_client);
+  mg_tls_calc_cert_verify_hash(c, (uint8_t *) hash);
 
-  mg_uecc_sign_deterministic(tls->ec_key, hash, sizeof(hash), &ctx.uECC, sig,
-                             mg_uecc_secp256r1());
+  mg_uecc_sign_deterministic(tls->server_key, hash, sizeof(hash), &ctx.uECC,
+                             sig, mg_uecc_secp256r1());
 
   neg1 = !!(sig[0] & 0x80);
   neg2 = !!(sig[32] & 0x80);
@@ -10211,7 +10070,7 @@ static void mg_tls_server_send_finish(struct mg_connection *c) {
   uint8_t finish[36] = {0x14, 0, 0, 32};
   memmove(&sha256, &tls->sha256, sizeof(mg_sha256_ctx));
   mg_sha256_final(hash, &sha256);
-  mg_hmac_sha256(finish + 4, tls->enc.server_finished_key, 32, hash, 32);
+  mg_hmac_sha256(finish + 4, tls->server_finished_key, 32, hash, 32);
   mg_tls_encrypt(c, finish, sizeof(finish), MG_TLS_HANDSHAKE);
   mg_io_send(c, wio->buf, wio->len);
   wio->len = 0;
@@ -10221,7 +10080,6 @@ static void mg_tls_server_send_finish(struct mg_connection *c) {
 
 static int mg_tls_server_recv_finish(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
-  unsigned char *recv_buf;
   // we have to backup sha256 value to restore it later, since Finished record
   // is exceptional and is not supposed to be added to the rolling hash
   // calculation.
@@ -10229,9 +10087,8 @@ static int mg_tls_server_recv_finish(struct mg_connection *c) {
   if (mg_tls_recv_record(c) < 0) {
     return -1;
   }
-  recv_buf = &c->rtls.buf[tls->recv_offset];
-  if (recv_buf[0] != MG_TLS_FINISHED) {
-    mg_error(c, "expected Finish but got msg 0x%02x", recv_buf[0]);
+  if (tls->recv.buf[0] != MG_TLS_FINISHED) {
+    mg_error(c, "expected Finish but got msg 0x%02x", tls->recv.buf[0]);
     return -1;
   }
   mg_tls_drop_message(c);
@@ -10245,97 +10102,158 @@ static void mg_tls_client_send_hello(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   struct mg_iobuf *wio = &tls->send;
 
+  const char *hostname = tls->hostname;
+  size_t hostnamesz = strlen(tls->hostname);
   uint8_t x25519_pub[X25519_BYTES];
 
-  // the only signature algorithm we actually support
-  uint8_t secp256r1_sig_algs[8] = {
-      0x00, 0x0d, 0x00, 0x04, 0x00, 0x02, 0x04, 0x03,
-  };
-  // all popular signature algorithms (if we don't care about verification)
-  uint8_t all_sig_algs[34] = {
-      0x00, 0x0d, 0x00, 0x1e, 0x00, 0x1c, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03,
-      0x08, 0x07, 0x08, 0x08, 0x08, 0x09, 0x08, 0x0a, 0x08, 0x0b, 0x08, 0x04,
-      0x08, 0x05, 0x08, 0x06, 0x04, 0x01, 0x05, 0x01, 0x06, 0x01};
-  uint8_t server_name_ext[9] = {0x00, 0x00, 0x00, 0xfe, 0x00,
-                                0xfe, 0x00, 0x00, 0xfe};
-
-  // clang-format off
-  uint8_t msg_client_hello[145] = {
-      // TLS Client Hello header reported as TLS1.2 (5)
-      0x16, 0x03, 0x03, 0x00, 0xfe,
-      // client hello, tls 1.2 (6)
-      0x01, 0x00, 0x00, 0x8c, 0x03, 0x03,
-      // random (32 bytes)
-      PLACEHOLDER_32B,
-      // session ID length + session ID (32 bytes)
-      0x20, PLACEHOLDER_32B, 0x00,
-      0x02,  // size = 2 bytes
+  uint8_t msg_client_hello[162 + 32] = {
+    // TLS Client Hello header reported as TLS1.2 (5)
+    0x16,
+    0x03,
+    0x01,
+    0x00,
+    0xfe,
+    // server hello, tls 1.2 (6)
+    0x01,
+    0x00,
+    0x00,
+    0x8c,
+    0x03,
+    0x03,
+    // random (32 bytes)
+    PLACEHOLDER_32B,
+    // session ID length + session ID (32 bytes)
+    0x20,
+    PLACEHOLDER_32B,
 #if defined(CHACHA20) && CHACHA20
-      // TLS_CHACHA20_POLY1305_SHA256
-      0x13, 0x03,
+    // TLS_CHACHA20_POLY1305_SHA256 + no compression
+    0x13,
+    0x03,
+    0x00,
 #else
-      // TLS_AES_128_GCM_SHA256
-      0x13, 0x01,
-#endif
-      // no compression
-      0x01, 0x00,
-      // extensions + keyshare
-      0x00, 0xfe,
-      // x25519 keyshare
-      0x00, 0x33, 0x00, 0x26, 0x00, 0x24, 0x00, 0x1d, 0x00, 0x20,
-      PLACEHOLDER_32B,
-      // supported groups (x25519)
-      0x00, 0x0a, 0x00, 0x04, 0x00, 0x02, 0x00, 0x1d,
-      // supported versions (tls1.3 == 0x304)
-      0x00, 0x2b, 0x00, 0x03, 0x02, 0x03, 0x04,
-      // session ticket (none)
-      0x00, 0x23, 0x00, 0x00, // 144 bytes till here
-	};
-  // clang-format on
-  const char *hostname = tls->hostname;
-  size_t hostnamesz = strlen(tls->hostname);
-  size_t hostname_extsz = hostnamesz ? hostnamesz + 9 : 0;
-  uint8_t *sig_alg = tls->skip_verification ? all_sig_algs : secp256r1_sig_algs;
-  size_t sig_alg_sz = tls->skip_verification ? sizeof(all_sig_algs)
-                                             : sizeof(secp256r1_sig_algs);
-
-  // patch ClientHello with correct hostname ext length (if any)
-  MG_STORE_BE16(msg_client_hello + 3,
-                hostname_extsz + 183 - 9 - 34 + sig_alg_sz);
-  MG_STORE_BE16(msg_client_hello + 7,
-                hostname_extsz + 179 - 9 - 34 + sig_alg_sz);
-  MG_STORE_BE16(msg_client_hello + 82,
-                hostname_extsz + 104 - 9 - 34 + sig_alg_sz);
+    0x00,
+    0x02,  // size = 2 bytes
+    0x13,
+    0x01,  // TLS_AES_128_GCM_SHA256
+    0x01,
+    0x00,  // no compression
+#endif
+
+    // extensions + keyshare
+    0x00,
+    0xfe,
+    // x25519 keyshare
+    0x00,
+    0x33,
+    0x00,
+    0x26,
+    0x00,
+    0x24,
+    0x00,
+    0x1d,
+    0x00,
+    0x20,
+    PLACEHOLDER_32B,
+    // supported groups (x25519)
+    0x00,
+    0x0a,
+    0x00,
+    0x04,
+    0x00,
+    0x02,
+    0x00,
+    0x1d,
+    // supported versions (tls1.3 == 0x304)
+    0x00,
+    0x2b,
+    0x00,
+    0x03,
+    0x02,
+    0x03,
+    0x04,
+    // session ticket (none)
+    0x00,
+    0x23,
+    0x00,
+    0x00,
+    // signature algorithms (we don't care, so list all the common ones)
+    0x00,
+    0x0d,
+    0x00,
+    0x24,
+    0x00,
+    0x22,
+    0x04,
+    0x03,
+    0x05,
+    0x03,
+    0x06,
+    0x03,
+    0x08,
+    0x07,
+    0x08,
+    0x08,
+    0x08,
+    0x1a,
+    0x08,
+    0x1b,
+    0x08,
+    0x1c,
+    0x08,
+    0x09,
+    0x08,
+    0x0a,
+    0x08,
+    0x0b,
+    0x08,
+    0x04,
+    0x08,
+    0x05,
+    0x08,
+    0x06,
+    0x04,
+    0x01,
+    0x05,
+    0x01,
+    0x06,
+    0x01,
+    // server name
+    0x00,
+    0x00,
+    0x00,
+    0xfe,
+    0x00,
+    0xfe,
+    0x00,
+    0x00,
+    0xfe
+  };
 
-  if (hostnamesz > 0) {
-    MG_STORE_BE16(server_name_ext + 2, hostnamesz + 5);
-    MG_STORE_BE16(server_name_ext + 4, hostnamesz + 3);
-    MG_STORE_BE16(server_name_ext + 7, hostnamesz);
-  }
+  // patch ClientHello with correct hostname length + offset:
+  MG_STORE_BE16(msg_client_hello + 3, hostnamesz + 189);
+  MG_STORE_BE16(msg_client_hello + 7, hostnamesz + 185);
+  MG_STORE_BE16(msg_client_hello + 82, hostnamesz + 110);
+  MG_STORE_BE16(msg_client_hello + 187, hostnamesz + 5);
+  MG_STORE_BE16(msg_client_hello + 189, hostnamesz + 3);
+  MG_STORE_BE16(msg_client_hello + 192, hostnamesz);
 
   // calculate keyshare
-  if (!mg_random(tls->x25519_cli, sizeof(tls->x25519_cli))) mg_error(c, "RNG");
+  mg_random(tls->x25519_cli, sizeof(tls->x25519_cli));
   mg_tls_x25519(x25519_pub, tls->x25519_cli, X25519_BASE_POINT, 1);
 
   // fill in the gaps: random + session ID + keyshare
-  if (!mg_random(tls->session_id, sizeof(tls->session_id))) mg_error(c, "RNG");
-  if (!mg_random(tls->random, sizeof(tls->random))) mg_error(c, "RNG");
+  mg_random(tls->session_id, sizeof(tls->session_id));
+  mg_random(tls->random, sizeof(tls->random));
   memmove(msg_client_hello + 11, tls->random, sizeof(tls->random));
   memmove(msg_client_hello + 44, tls->session_id, sizeof(tls->session_id));
   memmove(msg_client_hello + 94, x25519_pub, sizeof(x25519_pub));
 
-  // client hello message
+  // server hello message
   mg_iobuf_add(wio, wio->len, msg_client_hello, sizeof(msg_client_hello));
+  mg_iobuf_add(wio, wio->len, hostname, strlen(hostname));
   mg_sha256_update(&tls->sha256, msg_client_hello + 5,
                    sizeof(msg_client_hello) - 5);
-  mg_iobuf_add(wio, wio->len, sig_alg, sig_alg_sz);
-  mg_sha256_update(&tls->sha256, sig_alg, sig_alg_sz);
-  if (hostnamesz > 0) {
-    mg_iobuf_add(wio, wio->len, server_name_ext, sizeof(server_name_ext));
-    mg_iobuf_add(wio, wio->len, hostname, hostnamesz);
-    mg_sha256_update(&tls->sha256, server_name_ext, sizeof(server_name_ext));
-    mg_sha256_update(&tls->sha256, (uint8_t *) hostname, hostnamesz);
-  }
+  mg_sha256_update(&tls->sha256, (uint8_t *) hostname, strlen(hostname));
 
   // change cipher message
   mg_iobuf_add(wio, wio->len, (const char *) "\x14\x03\x03\x00\x01\x01", 6);
@@ -10369,7 +10287,6 @@ static int mg_tls_client_recv_hello(struct mg_connection *c) {
 
   ext_len = MG_LOAD_BE16(rio->buf + 5 + 39 + 32 + 3);
   ext = rio->buf + 5 + 39 + 32 + 3 + 2;
-  if (ext_len > (rio->len - (5 + 39 + 32 + 3 + 2))) goto fail;
 
   for (j = 0; j < ext_len;) {
     uint16_t ext_type = MG_LOAD_BE16(ext + j);
@@ -10377,7 +10294,6 @@ static int mg_tls_client_recv_hello(struct mg_connection *c) {
     uint16_t group;
     uint8_t *key_exchange;
     uint16_t key_exchange_len;
-    if (ext_len2 > (ext_len - j - 4)) goto fail;
     if (ext_type != 0x0033) {  // not a key share extension, ignore
       j += (uint16_t) (ext_len2 + 4);
       continue;
@@ -10400,20 +10316,18 @@ static int mg_tls_client_recv_hello(struct mg_connection *c) {
     mg_tls_generate_handshake_keys(c);
     return 0;
   }
-fail:
   mg_error(c, "bad client hello");
   return -1;
 }
 
 static int mg_tls_client_recv_ext(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
-  unsigned char *recv_buf;
   if (mg_tls_recv_record(c) < 0) {
     return -1;
   }
-  recv_buf = &c->rtls.buf[tls->recv_offset];
-  if (recv_buf[0] != MG_TLS_ENCRYPTED_EXTENSIONS) {
-    mg_error(c, "expected server extensions but got msg 0x%02x", recv_buf[0]);
+  if (tls->recv.buf[0] != MG_TLS_ENCRYPTED_EXTENSIONS) {
+    mg_error(c, "expected server extensions but got msg 0x%02x",
+             tls->recv.buf[0]);
     return -1;
   }
   mg_tls_drop_message(c);
@@ -10426,19 +10340,12 @@ static int mg_tls_client_recv_cert(struct mg_connection *c) {
   struct mg_der_tlv oid, pubkey, seq, subj;
   int subj_match = 0;
   struct tls_data *tls = (struct tls_data *) c->tls;
-  unsigned char *recv_buf;
   if (mg_tls_recv_record(c) < 0) {
     return -1;
   }
-  recv_buf = &c->rtls.buf[tls->recv_offset];
-  if (recv_buf[0] == MG_TLS_CERTIFICATE_REQUEST) {
-    MG_VERBOSE(("got certificate request"));
-    mg_tls_drop_message(c);
-    tls->cert_requested = 1;
-    return -1;
-  }
-  if (recv_buf[0] != MG_TLS_CERTIFICATE) {
-    mg_error(c, "expected server certificate but got msg 0x%02x", recv_buf[0]);
+  if (tls->recv.buf[0] != MG_TLS_CERTIFICATE) {
+    mg_error(c, "expected server certificate but got msg 0x%02x",
+             tls->recv.buf[0]);
     return -1;
   }
   if (tls->skip_verification) {
@@ -10446,15 +10353,15 @@ static int mg_tls_client_recv_cert(struct mg_connection *c) {
     return 0;
   }
 
-  if (tls->recv_len < 11) {
+  if (tls->recv.len < 11) {
     mg_error(c, "certificate list too short");
     return -1;
   }
 
-  cert = recv_buf + 11;
-  certsz = MG_LOAD_BE24(recv_buf + 8);
-  if (certsz > tls->recv_len - 11) {
-    mg_error(c, "certificate too long: %d vs %d", certsz, tls->recv_len - 11);
+  cert = tls->recv.buf + 11;
+  certsz = MG_LOAD_BE24(tls->recv.buf + 8);
+  if (certsz > tls->recv.len - 11) {
+    mg_error(c, "certificate too long: %d vs %d", certsz, tls->recv.len - 11);
     return -1;
   }
 
@@ -10522,19 +10429,18 @@ static int mg_tls_client_recv_cert(struct mg_connection *c) {
   } while (0);
 
   mg_tls_drop_message(c);
-  mg_tls_calc_cert_verify_hash(c, tls->sighash, 0);
+  mg_tls_calc_cert_verify_hash(c, tls->sighash);
   return 0;
 }
 
 static int mg_tls_client_recv_cert_verify(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
-  unsigned char *recv_buf;
   if (mg_tls_recv_record(c) < 0) {
     return -1;
   }
-  recv_buf = &c->rtls.buf[tls->recv_offset];
-  if (recv_buf[0] != MG_TLS_CERTIFICATE_VERIFY) {
-    mg_error(c, "expected server certificate verify but got msg 0x%02x", recv_buf[0]);
+  if (tls->recv.buf[0] != MG_TLS_CERTIFICATE_VERIFY) {
+    mg_error(c, "expected server certificate verify but got msg 0x%02x",
+             tls->recv.buf[0]);
     return -1;
   }
   // Ignore CertificateVerify is strict checks are not required
@@ -10547,7 +10453,7 @@ static int mg_tls_client_recv_cert_verify(struct mg_connection *c) {
   do {
     uint8_t sig[64];
     struct mg_der_tlv seq, a, b;
-    if (mg_der_to_tlv(recv_buf + 8, tls->recv_len - 8, &seq) < 0) {
+    if (mg_der_to_tlv(tls->recv.buf + 8, tls->recv.len - 8, &seq) < 0) {
       mg_error(c, "verification message is not an ASN.1 DER sequence");
       return -1;
     }
@@ -10585,13 +10491,12 @@ static int mg_tls_client_recv_cert_verify(struct mg_connection *c) {
 
 static int mg_tls_client_recv_finish(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
-  unsigned char *recv_buf;
   if (mg_tls_recv_record(c) < 0) {
     return -1;
   }
-  recv_buf = &c->rtls.buf[tls->recv_offset];
-  if (recv_buf[0] != MG_TLS_FINISHED) {
-    mg_error(c, "expected server finished but got msg 0x%02x", recv_buf[0]);
+  if (tls->recv.buf[0] != MG_TLS_FINISHED) {
+    mg_error(c, "expected server finished but got msg 0x%02x",
+             tls->recv.buf[0]);
     return -1;
   }
   mg_tls_drop_message(c);
@@ -10606,7 +10511,7 @@ static void mg_tls_client_send_finish(struct mg_connection *c) {
   uint8_t finish[36] = {0x14, 0, 0, 32};
   memmove(&sha256, &tls->sha256, sizeof(mg_sha256_ctx));
   mg_sha256_final(hash, &sha256);
-  mg_hmac_sha256(finish + 4, tls->enc.client_finished_key, 32, hash, 32);
+  mg_hmac_sha256(finish + 4, tls->client_finished_key, 32, hash, 32);
   mg_tls_encrypt(c, finish, sizeof(finish), MG_TLS_HANDSHAKE);
   mg_io_send(c, wio->buf, wio->len);
   wio->len = 0;
@@ -10647,29 +10552,12 @@ static void mg_tls_client_handshake(struct mg_connection *c) {
       if (mg_tls_client_recv_finish(c) < 0) {
         break;
       }
-      if (tls->cert_requested) {
-        /* for mTLS we should generate application keys at this point
-         * but then restore handshake keys and continue with
-         * the rest of the handshake */
-        struct tls_enc app_keys;
-        struct tls_enc hs_keys = tls->enc;
-        mg_tls_generate_application_keys(c);
-        app_keys = tls->enc;
-        tls->enc = hs_keys;
-        mg_tls_server_send_cert(c);
-        mg_tls_send_cert_verify(c, 1);
-        mg_tls_client_send_finish(c);
-        tls->enc = app_keys;
-      } else {
-        mg_tls_client_send_finish(c);
-        mg_tls_generate_application_keys(c);
-      }
+      mg_tls_client_send_finish(c);
+      mg_tls_generate_application_keys(c);
       tls->state = MG_TLS_STATE_CLIENT_CONNECTED;
       c->is_tls_hs = 0;
       break;
-    default:
-      mg_error(c, "unexpected client state: %d", tls->state);
-      break;
+    default: mg_error(c, "unexpected client state: %d", tls->state); break;
   }
 }
 
@@ -10684,7 +10572,7 @@ static void mg_tls_server_handshake(struct mg_connection *c) {
       mg_tls_generate_handshake_keys(c);
       mg_tls_server_send_ext(c);
       mg_tls_server_send_cert(c);
-      mg_tls_send_cert_verify(c, 0);
+      mg_tls_server_send_cert_verify(c);
       mg_tls_server_send_finish(c);
       tls->state = MG_TLS_STATE_SERVER_NEGOTIATED;
       // fallthrough
@@ -10696,9 +10584,7 @@ static void mg_tls_server_handshake(struct mg_connection *c) {
       tls->state = MG_TLS_STATE_SERVER_CONNECTED;
       c->is_tls_hs = 0;
       return;
-    default:
-      mg_error(c, "unexpected server state: %d", tls->state);
-      break;
+    default: mg_error(c, "unexpected server state: %d", tls->state); break;
   }
 }
 
@@ -10715,9 +10601,10 @@ static int mg_parse_pem(const struct mg_str pem, const struct mg_str label,
   size_t n = 0, m = 0;
   char *s;
   const char *c;
-  struct mg_str caps[6];  // number of wildcards + 1
+  struct mg_str caps[5];
   if (!mg_match(pem, mg_str("#-----BEGIN #-----#-----END #-----#"), caps)) {
-    *der = mg_strdup(pem);
+    der->buf = mg_mprintf("%.*s", pem.len, pem.buf);
+    der->len = pem.len;
     return 0;
   }
   if (mg_strcmp(caps[1], label) != 0 || mg_strcmp(caps[3], label) != 0) {
@@ -10755,7 +10642,7 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
       c->is_client ? MG_TLS_STATE_CLIENT_START : MG_TLS_STATE_SERVER_START;
 
   tls->skip_verification = opts->skip_verification;
-  //tls->send.align = MG_IO_SIZE;
+  tls->send.align = MG_IO_SIZE;
 
   c->tls = tls;
   c->is_tls = c->is_tls_hs = 1;
@@ -10765,19 +10652,19 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
   if (opts->name.len > 0) {
     if (opts->name.len >= sizeof(tls->hostname) - 1) {
       mg_error(c, "hostname too long");
-      return;
     }
     strncpy((char *) tls->hostname, opts->name.buf, sizeof(tls->hostname) - 1);
     tls->hostname[opts->name.len] = 0;
   }
 
-  if (opts->cert.buf == NULL) {
-    MG_VERBOSE(("no certificate provided"));
+  if (c->is_client) {
+    tls->server_cert_der.buf = NULL;
     return;
   }
 
   // parse PEM or DER certificate
-  if (mg_parse_pem(opts->cert, mg_str_s("CERTIFICATE"), &tls->cert_der) < 0) {
+  if (mg_parse_pem(opts->cert, mg_str_s("CERTIFICATE"), &tls->server_cert_der) <
+      0) {
     MG_ERROR(("Failed to load certificate"));
     return;
   }
@@ -10802,7 +10689,7 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
     if (memcmp(key.buf + 2, "\x02\x01\x01\x04\x20", 5) != 0) {
       MG_ERROR(("EC private key: ASN.1 bad data"));
     }
-    memmove(tls->ec_key, key.buf + 7, 32);
+    memmove(tls->server_key, key.buf + 7, 32);
     free((void *) key.buf);
   } else if (mg_parse_pem(opts->key, mg_str_s("PRIVATE KEY"), &key) == 0) {
     mg_error(c, "PKCS8 private key format is not supported");
@@ -10815,7 +10702,7 @@ void mg_tls_free(struct mg_connection *c) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   if (tls != NULL) {
     mg_iobuf_free(&tls->send);
-    free((void *) tls->cert_der.buf);
+    free((void *) tls->server_cert_der.buf);
   }
   free(c->tls);
   c->tls = NULL;
@@ -10825,7 +10712,6 @@ long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) {
   struct tls_data *tls = (struct tls_data *) c->tls;
   long n = MG_IO_WAIT;
   if (len > MG_IO_SIZE) len = MG_IO_SIZE;
-  if (len > 16384) len = 16384;
   mg_tls_encrypt(c, (const uint8_t *) buf, len, MG_TLS_APP_DATA);
   while (tls->send.len > 0 &&
          (n = mg_io_send(c, tls->send.buf, tls->send.len)) > 0) {
@@ -10838,25 +10724,22 @@ long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) {
 long mg_tls_recv(struct mg_connection *c, void *buf, size_t len) {
   int r = 0;
   struct tls_data *tls = (struct tls_data *) c->tls;
-  unsigned char *recv_buf;
   size_t minlen;
 
   r = mg_tls_recv_record(c);
   if (r < 0) {
     return r;
   }
-  recv_buf = &c->rtls.buf[tls->recv_offset];
-
   if (tls->content_type != MG_TLS_APP_DATA) {
-    tls->recv_len = 0;
+    tls->recv.len = 0;
     mg_tls_drop_record(c);
     return MG_IO_WAIT;
   }
-  minlen = len < tls->recv_len ? len : tls->recv_len;
-  memmove(buf, recv_buf, minlen);
-  tls->recv_offset += minlen;
-  tls->recv_len -= minlen;
-  if (tls->recv_len == 0) {
+  minlen = len < tls->recv.len ? len : tls->recv.len;
+  memmove(buf, tls->recv.buf, minlen);
+  tls->recv.buf += minlen;
+  tls->recv.len -= minlen;
+  if (tls->recv.len == 0) {
     mg_tls_drop_record(c);
   }
   return (long) minlen;
@@ -10875,1351 +10758,6 @@ void mg_tls_ctx_free(struct mg_mgr *mgr) {
 }
 #endif
 
-#ifdef MG_ENABLE_LINES
-#line 1 "src/tls_chacha20.c"
-#endif
-// portable8439 v1.0.1
-// Source: https://github.com/DavyLandman/portable8439
-// Licensed under CC0-1.0
-// Contains poly1305-donna e6ad6e091d30d7f4ec2d4f978be1fcfcbce72781 (Public
-// Domain)
-
-
-
-
-#if MG_TLS == MG_TLS_BUILTIN
-// ******* BEGIN: chacha-portable/chacha-portable.h ********
-
-#if !defined(__cplusplus) && !defined(_MSC_VER) && \
-    (!defined(__STDC_VERSION__) || __STDC_VERSION__ < 199901L)
-#error "C99 or newer required"
-#endif
-
-#define CHACHA20_KEY_SIZE (32)
-#define CHACHA20_NONCE_SIZE (12)
-
-#if defined(_MSC_VER) || defined(__cplusplus)
-// add restrict support
-#if (defined(_MSC_VER) && _MSC_VER >= 1900) || defined(__clang__) || \
-    defined(__GNUC__)
-#define restrict __restrict
-#else
-#define restrict
-#endif
-#endif
-
-// xor data with a ChaCha20 keystream as per RFC8439
-static PORTABLE_8439_DECL void chacha20_xor_stream(
-    uint8_t *restrict dest, const uint8_t *restrict source, size_t length,
-    const uint8_t key[CHACHA20_KEY_SIZE],
-    const uint8_t nonce[CHACHA20_NONCE_SIZE], uint32_t counter);
-
-static PORTABLE_8439_DECL void rfc8439_keygen(
-    uint8_t poly_key[32], const uint8_t key[CHACHA20_KEY_SIZE],
-    const uint8_t nonce[CHACHA20_NONCE_SIZE]);
-
-// ******* END:   chacha-portable/chacha-portable.h ********
-// ******* BEGIN: poly1305-donna/poly1305-donna.h ********
-
-#include <stddef.h>
-
-typedef struct poly1305_context {
-  size_t aligner;
-  unsigned char opaque[136];
-} poly1305_context;
-
-static PORTABLE_8439_DECL void poly1305_init(poly1305_context *ctx,
-                                             const unsigned char key[32]);
-static PORTABLE_8439_DECL void poly1305_update(poly1305_context *ctx,
-                                               const unsigned char *m,
-                                               size_t bytes);
-static PORTABLE_8439_DECL void poly1305_finish(poly1305_context *ctx,
-                                               unsigned char mac[16]);
-
-// ******* END:   poly1305-donna/poly1305-donna.h ********
-// ******* BEGIN: chacha-portable.c ********
-
-#include <assert.h>
-#include <string.h>
-
-// this is a fresh implementation of chacha20, based on the description in
-// rfc8349 it's such a nice compact algorithm that it is easy to do. In
-// relationship to other c implementation this implementation:
-//  - pure c99
-//  - big & little endian support
-//  - safe for architectures that don't support unaligned reads
-//
-// Next to this, we try to be fast as possible without resorting inline
-// assembly.
-
-// based on https://sourceforge.net/p/predef/wiki/Endianness/
-#if defined(__BYTE_ORDER__) && defined(__ORDER_LITTLE_ENDIAN__) && \
-    __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
-#define __HAVE_LITTLE_ENDIAN 1
-#elif defined(__LITTLE_ENDIAN__) || defined(__ARMEL__) ||                 \
-    defined(__THUMBEL__) || defined(__AARCH64EL__) || defined(_MIPSEL) || \
-    defined(__MIPSEL) || defined(__MIPSEL__) || defined(__XTENSA_EL__) || \
-    defined(__AVR__) || defined(LITTLE_ENDIAN)
-#define __HAVE_LITTLE_ENDIAN 1
-#endif
-
-#ifndef TEST_SLOW_PATH
-#if defined(__HAVE_LITTLE_ENDIAN)
-#define FAST_PATH
-#endif
-#endif
-
-#define CHACHA20_STATE_WORDS (16)
-#define CHACHA20_BLOCK_SIZE (CHACHA20_STATE_WORDS * sizeof(uint32_t))
-
-#ifdef FAST_PATH
-#define store_32_le(target, source) memcpy(&(target), source, sizeof(uint32_t))
-#else
-#define store_32_le(target, source)                                 \
-  target = (uint32_t) (source)[0] | ((uint32_t) (source)[1]) << 8 | \
-           ((uint32_t) (source)[2]) << 16 | ((uint32_t) (source)[3]) << 24
-#endif
-
-static void initialize_state(uint32_t state[CHACHA20_STATE_WORDS],
-                             const uint8_t key[CHACHA20_KEY_SIZE],
-                             const uint8_t nonce[CHACHA20_NONCE_SIZE],
-                             uint32_t counter) {
-#ifdef static_assert
-  static_assert(sizeof(uint32_t) == 4,
-                "We don't support systems that do not conform to standard of "
-                "uint32_t being exact 32bit wide");
-#endif
-  state[0] = 0x61707865;
-  state[1] = 0x3320646e;
-  state[2] = 0x79622d32;
-  state[3] = 0x6b206574;
-  store_32_le(state[4], key);
-  store_32_le(state[5], key + 4);
-  store_32_le(state[6], key + 8);
-  store_32_le(state[7], key + 12);
-  store_32_le(state[8], key + 16);
-  store_32_le(state[9], key + 20);
-  store_32_le(state[10], key + 24);
-  store_32_le(state[11], key + 28);
-  state[12] = counter;
-  store_32_le(state[13], nonce);
-  store_32_le(state[14], nonce + 4);
-  store_32_le(state[15], nonce + 8);
-}
-
-#define increment_counter(state) (state)[12]++
-
-// source: http://blog.regehr.org/archives/1063
-#define rotl32a(x, n) ((x) << (n)) | ((x) >> (32 - (n)))
-
-#define Qround(a, b, c, d) \
-  a += b;                  \
-  d ^= a;                  \
-  d = rotl32a(d, 16);      \
-  c += d;                  \
-  b ^= c;                  \
-  b = rotl32a(b, 12);      \
-  a += b;                  \
-  d ^= a;                  \
-  d = rotl32a(d, 8);       \
-  c += d;                  \
-  b ^= c;                  \
-  b = rotl32a(b, 7);
-
-#define TIMES16(x)                                                          \
-  x(0) x(1) x(2) x(3) x(4) x(5) x(6) x(7) x(8) x(9) x(10) x(11) x(12) x(13) \
-      x(14) x(15)
-
-static void core_block(const uint32_t *restrict start,
-                       uint32_t *restrict output) {
-  int i;
-// instead of working on the output array,
-// we let the compiler allocate 16 local variables on the stack
-#define __LV(i) uint32_t __t##i = start[i];
-  TIMES16(__LV)
-
-#define __Q(a, b, c, d) Qround(__t##a, __t##b, __t##c, __t##d)
-
-  for (i = 0; i < 10; i++) {
-    __Q(0, 4, 8, 12);
-    __Q(1, 5, 9, 13);
-    __Q(2, 6, 10, 14);
-    __Q(3, 7, 11, 15);
-    __Q(0, 5, 10, 15);
-    __Q(1, 6, 11, 12);
-    __Q(2, 7, 8, 13);
-    __Q(3, 4, 9, 14);
-  }
-
-#define __FIN(i) output[i] = start[i] + __t##i;
-  TIMES16(__FIN)
-}
-
-#define U8(x) ((uint8_t) ((x) &0xFF))
-
-#ifdef FAST_PATH
-#define xor32_le(dst, src, pad)            \
-  uint32_t __value;                        \
-  memcpy(&__value, src, sizeof(uint32_t)); \
-  __value ^= *(pad);                       \
-  memcpy(dst, &__value, sizeof(uint32_t));
-#else
-#define xor32_le(dst, src, pad)           \
-  (dst)[0] = (src)[0] ^ U8(*(pad));       \
-  (dst)[1] = (src)[1] ^ U8(*(pad) >> 8);  \
-  (dst)[2] = (src)[2] ^ U8(*(pad) >> 16); \
-  (dst)[3] = (src)[3] ^ U8(*(pad) >> 24);
-#endif
-
-#define index8_32(a, ix) ((a) + ((ix) * sizeof(uint32_t)))
-
-#define xor32_blocks(dest, source, pad, words)                    \
-  for (i = 0; i < words; i++) {                                   \
-    xor32_le(index8_32(dest, i), index8_32(source, i), (pad) + i) \
-  }
-
-static void xor_block(uint8_t *restrict dest, const uint8_t *restrict source,
-                      const uint32_t *restrict pad, unsigned int chunk_size) {
-  unsigned int i, full_blocks = chunk_size / (unsigned int) sizeof(uint32_t);
-  // have to be carefull, we are going back from uint32 to uint8, so endianness
-  // matters again
-  xor32_blocks(dest, source, pad, full_blocks)
-
-      dest += full_blocks * sizeof(uint32_t);
-  source += full_blocks * sizeof(uint32_t);
-  pad += full_blocks;
-
-  switch (chunk_size % sizeof(uint32_t)) {
-    case 1:
-      dest[0] = source[0] ^ U8(*pad);
-      break;
-    case 2:
-      dest[0] = source[0] ^ U8(*pad);
-      dest[1] = source[1] ^ U8(*pad >> 8);
-      break;
-    case 3:
-      dest[0] = source[0] ^ U8(*pad);
-      dest[1] = source[1] ^ U8(*pad >> 8);
-      dest[2] = source[2] ^ U8(*pad >> 16);
-      break;
-  }
-}
-
-static void chacha20_xor_stream(uint8_t *restrict dest,
-                                const uint8_t *restrict source, size_t length,
-                                const uint8_t key[CHACHA20_KEY_SIZE],
-                                const uint8_t nonce[CHACHA20_NONCE_SIZE],
-                                uint32_t counter) {
-  uint32_t state[CHACHA20_STATE_WORDS];
-  uint32_t pad[CHACHA20_STATE_WORDS];
-  size_t i, b, last_block, full_blocks = length / CHACHA20_BLOCK_SIZE;
-  initialize_state(state, key, nonce, counter);
-  for (b = 0; b < full_blocks; b++) {
-    core_block(state, pad);
-    increment_counter(state);
-    xor32_blocks(dest, source, pad, CHACHA20_STATE_WORDS) dest +=
-        CHACHA20_BLOCK_SIZE;
-    source += CHACHA20_BLOCK_SIZE;
-  }
-  last_block = length % CHACHA20_BLOCK_SIZE;
-  if (last_block > 0) {
-    core_block(state, pad);
-    xor_block(dest, source, pad, (unsigned int) last_block);
-  }
-}
-
-#ifdef FAST_PATH
-#define serialize(poly_key, result) memcpy(poly_key, result, 32)
-#else
-#define store32_le(target, source)   \
-  (target)[0] = U8(*(source));       \
-  (target)[1] = U8(*(source) >> 8);  \
-  (target)[2] = U8(*(source) >> 16); \
-  (target)[3] = U8(*(source) >> 24);
-
-#define serialize(poly_key, result)                 \
-  for (i = 0; i < 32 / sizeof(uint32_t); i++) {     \
-    store32_le(index8_32(poly_key, i), result + i); \
-  }
-#endif
-
-static void rfc8439_keygen(uint8_t poly_key[32],
-                           const uint8_t key[CHACHA20_KEY_SIZE],
-                           const uint8_t nonce[CHACHA20_NONCE_SIZE]) {
-  uint32_t state[CHACHA20_STATE_WORDS];
-  uint32_t result[CHACHA20_STATE_WORDS];
-  size_t i;
-  initialize_state(state, key, nonce, 0);
-  core_block(state, result);
-  serialize(poly_key, result);
-  (void) i;
-}
-// ******* END: chacha-portable.c ********
-// ******* BEGIN: poly1305-donna.c ********
-
-/* auto detect between 32bit / 64bit */
-#if /* uint128 available on 64bit system*/                              \
-    (defined(__SIZEOF_INT128__) &&                                      \
-     defined(__LP64__))                       /* MSVC 64bit compiler */ \
-    || (defined(_MSC_VER) && defined(_M_X64)) /* gcc >= 4.4 64bit */    \
-    || (defined(__GNUC__) && defined(__LP64__) &&                       \
-        ((__GNUC__ > 4) || ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 4))))
-#define __GUESS64
-#else
-#define __GUESS32
-#endif
-
-#if defined(POLY1305_8BIT)
-/*
-        poly1305 implementation using 8 bit * 8 bit = 16 bit multiplication and
-32 bit addition
-
-        based on the public domain reference version in supercop by djb
-static */
-
-#if defined(_MSC_VER) && _MSC_VER < 1700
-#define POLY1305_NOINLINE
-#elif defined(_MSC_VER)
-#define POLY1305_NOINLINE __declspec(noinline)
-#elif defined(__GNUC__)
-#define POLY1305_NOINLINE __attribute__((noinline))
-#else
-#define POLY1305_NOINLINE
-#endif
-
-#define poly1305_block_size 16
-
-/* 17 + sizeof(size_t) + 51*sizeof(unsigned char) */
-typedef struct poly1305_state_internal_t {
-  unsigned char buffer[poly1305_block_size];
-  size_t leftover;
-  unsigned char h[17];
-  unsigned char r[17];
-  unsigned char pad[17];
-  unsigned char final;
-} poly1305_state_internal_t;
-
-static void poly1305_init(poly1305_context *ctx, const unsigned char key[32]) {
-  poly1305_state_internal_t *st = (poly1305_state_internal_t *) ctx;
-  size_t i;
-
-  st->leftover = 0;
-
-  /* h = 0 */
-  for (i = 0; i < 17; i++) st->h[i] = 0;
-
-  /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */
-  st->r[0] = key[0] & 0xff;
-  st->r[1] = key[1] & 0xff;
-  st->r[2] = key[2] & 0xff;
-  st->r[3] = key[3] & 0x0f;
-  st->r[4] = key[4] & 0xfc;
-  st->r[5] = key[5] & 0xff;
-  st->r[6] = key[6] & 0xff;
-  st->r[7] = key[7] & 0x0f;
-  st->r[8] = key[8] & 0xfc;
-  st->r[9] = key[9] & 0xff;
-  st->r[10] = key[10] & 0xff;
-  st->r[11] = key[11] & 0x0f;
-  st->r[12] = key[12] & 0xfc;
-  st->r[13] = key[13] & 0xff;
-  st->r[14] = key[14] & 0xff;
-  st->r[15] = key[15] & 0x0f;
-  st->r[16] = 0;
-
-  /* save pad for later */
-  for (i = 0; i < 16; i++) st->pad[i] = key[i + 16];
-  st->pad[16] = 0;
-
-  st->final = 0;
-}
-
-static void poly1305_add(unsigned char h[17], const unsigned char c[17]) {
-  unsigned short u;
-  unsigned int i;
-  for (u = 0, i = 0; i < 17; i++) {
-    u += (unsigned short) h[i] + (unsigned short) c[i];
-    h[i] = (unsigned char) u & 0xff;
-    u >>= 8;
-  }
-}
-
-static void poly1305_squeeze(unsigned char h[17], unsigned long hr[17]) {
-  unsigned long u;
-  unsigned int i;
-  u = 0;
-  for (i = 0; i < 16; i++) {
-    u += hr[i];
-    h[i] = (unsigned char) u & 0xff;
-    u >>= 8;
-  }
-  u += hr[16];
-  h[16] = (unsigned char) u & 0x03;
-  u >>= 2;
-  u += (u << 2); /* u *= 5; */
-  for (i = 0; i < 16; i++) {
-    u += h[i];
-    h[i] = (unsigned char) u & 0xff;
-    u >>= 8;
-  }
-  h[16] += (unsigned char) u;
-}
-
-static void poly1305_freeze(unsigned char h[17]) {
-  const unsigned char minusp[17] = {0x05, 0x00, 0x00, 0x00, 0x00, 0x00,
-                                    0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                                    0x00, 0x00, 0x00, 0x00, 0xfc};
-  unsigned char horig[17], negative;
-  unsigned int i;
-
-  /* compute h + -p */
-  for (i = 0; i < 17; i++) horig[i] = h[i];
-  poly1305_add(h, minusp);
-
-  /* select h if h < p, or h + -p if h >= p */
-  negative = -(h[16] >> 7);
-  for (i = 0; i < 17; i++) h[i] ^= negative & (horig[i] ^ h[i]);
-}
-
-static void poly1305_blocks(poly1305_state_internal_t *st,
-                            const unsigned char *m, size_t bytes) {
-  const unsigned char hibit = st->final ^ 1; /* 1 << 128 */
-
-  while (bytes >= poly1305_block_size) {
-    unsigned long hr[17], u;
-    unsigned char c[17];
-    unsigned int i, j;
-
-    /* h += m */
-    for (i = 0; i < 16; i++) c[i] = m[i];
-    c[16] = hibit;
-    poly1305_add(st->h, c);
-
-    /* h *= r */
-    for (i = 0; i < 17; i++) {
-      u = 0;
-      for (j = 0; j <= i; j++) {
-        u += (unsigned short) st->h[j] * st->r[i - j];
-      }
-      for (j = i + 1; j < 17; j++) {
-        unsigned long v = (unsigned short) st->h[j] * st->r[i + 17 - j];
-        v = ((v << 8) + (v << 6)); /* v *= (5 << 6); */
-        u += v;
-      }
-      hr[i] = u;
-    }
-
-    /* (partial) h %= p */
-    poly1305_squeeze(st->h, hr);
-
-    m += poly1305_block_size;
-    bytes -= poly1305_block_size;
-  }
-}
-
-static POLY1305_NOINLINE void poly1305_finish(poly1305_context *ctx,
-                                              unsigned char mac[16]) {
-  poly1305_state_internal_t *st = (poly1305_state_internal_t *) ctx;
-  size_t i;
-
-  /* process the remaining block */
-  if (st->leftover) {
-    size_t i = st->leftover;
-    st->buffer[i++] = 1;
-    for (; i < poly1305_block_size; i++) st->buffer[i] = 0;
-    st->final = 1;
-    poly1305_blocks(st, st->buffer, poly1305_block_size);
-  }
-
-  /* fully reduce h */
-  poly1305_freeze(st->h);
-
-  /* h = (h + pad) % (1 << 128) */
-  poly1305_add(st->h, st->pad);
-  for (i = 0; i < 16; i++) mac[i] = st->h[i];
-
-  /* zero out the state */
-  for (i = 0; i < 17; i++) st->h[i] = 0;
-  for (i = 0; i < 17; i++) st->r[i] = 0;
-  for (i = 0; i < 17; i++) st->pad[i] = 0;
-}
-#elif defined(POLY1305_16BIT)
-/*
-        poly1305 implementation using 16 bit * 16 bit = 32 bit multiplication
-and 32 bit addition static */
-
-#if defined(_MSC_VER) && _MSC_VER < 1700
-#define POLY1305_NOINLINE
-#elif defined(_MSC_VER)
-#define POLY1305_NOINLINE __declspec(noinline)
-#elif defined(__GNUC__)
-#define POLY1305_NOINLINE __attribute__((noinline))
-#else
-#define POLY1305_NOINLINE
-#endif
-
-#define poly1305_block_size 16
-
-/* 17 + sizeof(size_t) + 18*sizeof(unsigned short) */
-typedef struct poly1305_state_internal_t {
-  unsigned char buffer[poly1305_block_size];
-  size_t leftover;
-  unsigned short r[10];
-  unsigned short h[10];
-  unsigned short pad[8];
-  unsigned char final;
-} poly1305_state_internal_t;
-
-/* interpret two 8 bit unsigned integers as a 16 bit unsigned integer in little
- * endian */
-static unsigned short U8TO16(const unsigned char *p) {
-  return (((unsigned short) (p[0] & 0xff)) |
-          ((unsigned short) (p[1] & 0xff) << 8));
-}
-
-/* store a 16 bit unsigned integer as two 8 bit unsigned integers in little
- * endian */
-static void U16TO8(unsigned char *p, unsigned short v) {
-  p[0] = (v) &0xff;
-  p[1] = (v >> 8) & 0xff;
-}
-
-static void poly1305_init(poly1305_context *ctx, const unsigned char key[32]) {
-  poly1305_state_internal_t *st = (poly1305_state_internal_t *) ctx;
-  unsigned short t0, t1, t2, t3, t4, t5, t6, t7;
-  size_t i;
-
-  /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */
-  t0 = U8TO16(&key[0]);
-  st->r[0] = (t0) &0x1fff;
-  t1 = U8TO16(&key[2]);
-  st->r[1] = ((t0 >> 13) | (t1 << 3)) & 0x1fff;
-  t2 = U8TO16(&key[4]);
-  st->r[2] = ((t1 >> 10) | (t2 << 6)) & 0x1f03;
-  t3 = U8TO16(&key[6]);
-  st->r[3] = ((t2 >> 7) | (t3 << 9)) & 0x1fff;
-  t4 = U8TO16(&key[8]);
-  st->r[4] = ((t3 >> 4) | (t4 << 12)) & 0x00ff;
-  st->r[5] = ((t4 >> 1)) & 0x1ffe;
-  t5 = U8TO16(&key[10]);
-  st->r[6] = ((t4 >> 14) | (t5 << 2)) & 0x1fff;
-  t6 = U8TO16(&key[12]);
-  st->r[7] = ((t5 >> 11) | (t6 << 5)) & 0x1f81;
-  t7 = U8TO16(&key[14]);
-  st->r[8] = ((t6 >> 8) | (t7 << 8)) & 0x1fff;
-  st->r[9] = ((t7 >> 5)) & 0x007f;
-
-  /* h = 0 */
-  for (i = 0; i < 10; i++) st->h[i] = 0;
-
-  /* save pad for later */
-  for (i = 0; i < 8; i++) st->pad[i] = U8TO16(&key[16 + (2 * i)]);
-
-  st->leftover = 0;
-  st->final = 0;
-}
-
-static void poly1305_blocks(poly1305_state_internal_t *st,
-                            const unsigned char *m, size_t bytes) {
-  const unsigned short hibit = (st->final) ? 0 : (1 << 11); /* 1 << 128 */
-  unsigned short t0, t1, t2, t3, t4, t5, t6, t7;
-  unsigned long d[10];
-  unsigned long c;
-
-  while (bytes >= poly1305_block_size) {
-    size_t i, j;
-
-    /* h += m[i] */
-    t0 = U8TO16(&m[0]);
-    st->h[0] += (t0) &0x1fff;
-    t1 = U8TO16(&m[2]);
-    st->h[1] += ((t0 >> 13) | (t1 << 3)) & 0x1fff;
-    t2 = U8TO16(&m[4]);
-    st->h[2] += ((t1 >> 10) | (t2 << 6)) & 0x1fff;
-    t3 = U8TO16(&m[6]);
-    st->h[3] += ((t2 >> 7) | (t3 << 9)) & 0x1fff;
-    t4 = U8TO16(&m[8]);
-    st->h[4] += ((t3 >> 4) | (t4 << 12)) & 0x1fff;
-    st->h[5] += ((t4 >> 1)) & 0x1fff;
-    t5 = U8TO16(&m[10]);
-    st->h[6] += ((t4 >> 14) | (t5 << 2)) & 0x1fff;
-    t6 = U8TO16(&m[12]);
-    st->h[7] += ((t5 >> 11) | (t6 << 5)) & 0x1fff;
-    t7 = U8TO16(&m[14]);
-    st->h[8] += ((t6 >> 8) | (t7 << 8)) & 0x1fff;
-    st->h[9] += ((t7 >> 5)) | hibit;
-
-    /* h *= r, (partial) h %= p */
-    for (i = 0, c = 0; i < 10; i++) {
-      d[i] = c;
-      for (j = 0; j < 10; j++) {
-        d[i] += (unsigned long) st->h[j] *
-                ((j <= i) ? st->r[i - j] : (5 * st->r[i + 10 - j]));
-        /* Sum(h[i] * r[i] * 5) will overflow slightly above 6 products with an
-         * unclamped r, so carry at 5 */
-        if (j == 4) {
-          c = (d[i] >> 13);
-          d[i] &= 0x1fff;
-        }
-      }
-      c += (d[i] >> 13);
-      d[i] &= 0x1fff;
-    }
-    c = ((c << 2) + c); /* c *= 5 */
-    c += d[0];
-    d[0] = ((unsigned short) c & 0x1fff);
-    c = (c >> 13);
-    d[1] += c;
-
-    for (i = 0; i < 10; i++) st->h[i] = (unsigned short) d[i];
-
-    m += poly1305_block_size;
-    bytes -= poly1305_block_size;
-  }
-}
-
-static POLY1305_NOINLINE void poly1305_finish(poly1305_context *ctx,
-                                              unsigned char mac[16]) {
-  poly1305_state_internal_t *st = (poly1305_state_internal_t *) ctx;
-  unsigned short c;
-  unsigned short g[10];
-  unsigned short mask;
-  unsigned long f;
-  size_t i;
-
-  /* process the remaining block */
-  if (st->leftover) {
-    size_t i = st->leftover;
-    st->buffer[i++] = 1;
-    for (; i < poly1305_block_size; i++) st->buffer[i] = 0;
-    st->final = 1;
-    poly1305_blocks(st, st->buffer, poly1305_block_size);
-  }
-
-  /* fully carry h */
-  c = st->h[1] >> 13;
-  st->h[1] &= 0x1fff;
-  for (i = 2; i < 10; i++) {
-    st->h[i] += c;
-    c = st->h[i] >> 13;
-    st->h[i] &= 0x1fff;
-  }
-  st->h[0] += (c * 5);
-  c = st->h[0] >> 13;
-  st->h[0] &= 0x1fff;
-  st->h[1] += c;
-  c = st->h[1] >> 13;
-  st->h[1] &= 0x1fff;
-  st->h[2] += c;
-
-  /* compute h + -p */
-  g[0] = st->h[0] + 5;
-  c = g[0] >> 13;
-  g[0] &= 0x1fff;
-  for (i = 1; i < 10; i++) {
-    g[i] = st->h[i] + c;
-    c = g[i] >> 13;
-    g[i] &= 0x1fff;
-  }
-
-  /* select h if h < p, or h + -p if h >= p */
-  mask = (c ^ 1) - 1;
-  for (i = 0; i < 10; i++) g[i] &= mask;
-  mask = ~mask;
-  for (i = 0; i < 10; i++) st->h[i] = (st->h[i] & mask) | g[i];
-
-  /* h = h % (2^128) */
-  st->h[0] = ((st->h[0]) | (st->h[1] << 13)) & 0xffff;
-  st->h[1] = ((st->h[1] >> 3) | (st->h[2] << 10)) & 0xffff;
-  st->h[2] = ((st->h[2] >> 6) | (st->h[3] << 7)) & 0xffff;
-  st->h[3] = ((st->h[3] >> 9) | (st->h[4] << 4)) & 0xffff;
-  st->h[4] = ((st->h[4] >> 12) | (st->h[5] << 1) | (st->h[6] << 14)) & 0xffff;
-  st->h[5] = ((st->h[6] >> 2) | (st->h[7] << 11)) & 0xffff;
-  st->h[6] = ((st->h[7] >> 5) | (st->h[8] << 8)) & 0xffff;
-  st->h[7] = ((st->h[8] >> 8) | (st->h[9] << 5)) & 0xffff;
-
-  /* mac = (h + pad) % (2^128) */
-  f = (unsigned long) st->h[0] + st->pad[0];
-  st->h[0] = (unsigned short) f;
-  for (i = 1; i < 8; i++) {
-    f = (unsigned long) st->h[i] + st->pad[i] + (f >> 16);
-    st->h[i] = (unsigned short) f;
-  }
-
-  for (i = 0; i < 8; i++) U16TO8(mac + (i * 2), st->h[i]);
-
-  /* zero out the state */
-  for (i = 0; i < 10; i++) st->h[i] = 0;
-  for (i = 0; i < 10; i++) st->r[i] = 0;
-  for (i = 0; i < 8; i++) st->pad[i] = 0;
-}
-#elif defined(POLY1305_32BIT) || \
-    (!defined(POLY1305_64BIT) && defined(__GUESS32))
-/*
-        poly1305 implementation using 32 bit * 32 bit = 64 bit multiplication
-and 64 bit addition static */
-
-#if defined(_MSC_VER) && _MSC_VER < 1700
-#define POLY1305_NOINLINE
-#elif defined(_MSC_VER)
-#define POLY1305_NOINLINE __declspec(noinline)
-#elif defined(__GNUC__)
-#define POLY1305_NOINLINE __attribute__((noinline))
-#else
-#define POLY1305_NOINLINE
-#endif
-
-#define poly1305_block_size 16
-
-/* 17 + sizeof(size_t) + 14*sizeof(unsigned long) */
-typedef struct poly1305_state_internal_t {
-  unsigned long r[5];
-  unsigned long h[5];
-  unsigned long pad[4];
-  size_t leftover;
-  unsigned char buffer[poly1305_block_size];
-  unsigned char final;
-} poly1305_state_internal_t;
-
-/* interpret four 8 bit unsigned integers as a 32 bit unsigned integer in little
- * endian */
-static unsigned long U8TO32(const unsigned char *p) {
-  return (((unsigned long) (p[0] & 0xff)) |
-          ((unsigned long) (p[1] & 0xff) << 8) |
-          ((unsigned long) (p[2] & 0xff) << 16) |
-          ((unsigned long) (p[3] & 0xff) << 24));
-}
-
-/* store a 32 bit unsigned integer as four 8 bit unsigned integers in little
- * endian */
-static void U32TO8(unsigned char *p, unsigned long v) {
-  p[0] = (unsigned char) ((v) &0xff);
-  p[1] = (unsigned char) ((v >> 8) & 0xff);
-  p[2] = (unsigned char) ((v >> 16) & 0xff);
-  p[3] = (unsigned char) ((v >> 24) & 0xff);
-}
-
-static void poly1305_init(poly1305_context *ctx, const unsigned char key[32]) {
-  poly1305_state_internal_t *st = (poly1305_state_internal_t *) ctx;
-
-  /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */
-  st->r[0] = (U8TO32(&key[0])) & 0x3ffffff;
-  st->r[1] = (U8TO32(&key[3]) >> 2) & 0x3ffff03;
-  st->r[2] = (U8TO32(&key[6]) >> 4) & 0x3ffc0ff;
-  st->r[3] = (U8TO32(&key[9]) >> 6) & 0x3f03fff;
-  st->r[4] = (U8TO32(&key[12]) >> 8) & 0x00fffff;
-
-  /* h = 0 */
-  st->h[0] = 0;
-  st->h[1] = 0;
-  st->h[2] = 0;
-  st->h[3] = 0;
-  st->h[4] = 0;
-
-  /* save pad for later */
-  st->pad[0] = U8TO32(&key[16]);
-  st->pad[1] = U8TO32(&key[20]);
-  st->pad[2] = U8TO32(&key[24]);
-  st->pad[3] = U8TO32(&key[28]);
-
-  st->leftover = 0;
-  st->final = 0;
-}
-
-static void poly1305_blocks(poly1305_state_internal_t *st,
-                            const unsigned char *m, size_t bytes) {
-  const unsigned long hibit = (st->final) ? 0 : (1UL << 24); /* 1 << 128 */
-  unsigned long r0, r1, r2, r3, r4;
-  unsigned long s1, s2, s3, s4;
-  unsigned long h0, h1, h2, h3, h4;
-  uint64_t d0, d1, d2, d3, d4;
-  unsigned long c;
-
-  r0 = st->r[0];
-  r1 = st->r[1];
-  r2 = st->r[2];
-  r3 = st->r[3];
-  r4 = st->r[4];
-
-  s1 = r1 * 5;
-  s2 = r2 * 5;
-  s3 = r3 * 5;
-  s4 = r4 * 5;
-
-  h0 = st->h[0];
-  h1 = st->h[1];
-  h2 = st->h[2];
-  h3 = st->h[3];
-  h4 = st->h[4];
-
-  while (bytes >= poly1305_block_size) {
-    /* h += m[i] */
-    h0 += (U8TO32(m + 0)) & 0x3ffffff;
-    h1 += (U8TO32(m + 3) >> 2) & 0x3ffffff;
-    h2 += (U8TO32(m + 6) >> 4) & 0x3ffffff;
-    h3 += (U8TO32(m + 9) >> 6) & 0x3ffffff;
-    h4 += (U8TO32(m + 12) >> 8) | hibit;
-
-    /* h *= r */
-    d0 = ((uint64_t) h0 * r0) + ((uint64_t) h1 * s4) + ((uint64_t) h2 * s3) +
-         ((uint64_t) h3 * s2) + ((uint64_t) h4 * s1);
-    d1 = ((uint64_t) h0 * r1) + ((uint64_t) h1 * r0) + ((uint64_t) h2 * s4) +
-         ((uint64_t) h3 * s3) + ((uint64_t) h4 * s2);
-    d2 = ((uint64_t) h0 * r2) + ((uint64_t) h1 * r1) + ((uint64_t) h2 * r0) +
-         ((uint64_t) h3 * s4) + ((uint64_t) h4 * s3);
-    d3 = ((uint64_t) h0 * r3) + ((uint64_t) h1 * r2) + ((uint64_t) h2 * r1) +
-         ((uint64_t) h3 * r0) + ((uint64_t) h4 * s4);
-    d4 = ((uint64_t) h0 * r4) + ((uint64_t) h1 * r3) + ((uint64_t) h2 * r2) +
-         ((uint64_t) h3 * r1) + ((uint64_t) h4 * r0);
-
-    /* (partial) h %= p */
-    c = (unsigned long) (d0 >> 26);
-    h0 = (unsigned long) d0 & 0x3ffffff;
-    d1 += c;
-    c = (unsigned long) (d1 >> 26);
-    h1 = (unsigned long) d1 & 0x3ffffff;
-    d2 += c;
-    c = (unsigned long) (d2 >> 26);
-    h2 = (unsigned long) d2 & 0x3ffffff;
-    d3 += c;
-    c = (unsigned long) (d3 >> 26);
-    h3 = (unsigned long) d3 & 0x3ffffff;
-    d4 += c;
-    c = (unsigned long) (d4 >> 26);
-    h4 = (unsigned long) d4 & 0x3ffffff;
-    h0 += c * 5;
-    c = (h0 >> 26);
-    h0 = h0 & 0x3ffffff;
-    h1 += c;
-
-    m += poly1305_block_size;
-    bytes -= poly1305_block_size;
-  }
-
-  st->h[0] = h0;
-  st->h[1] = h1;
-  st->h[2] = h2;
-  st->h[3] = h3;
-  st->h[4] = h4;
-}
-
-static POLY1305_NOINLINE void poly1305_finish(poly1305_context *ctx,
-                                              unsigned char mac[16]) {
-  poly1305_state_internal_t *st = (poly1305_state_internal_t *) ctx;
-  unsigned long h0, h1, h2, h3, h4, c;
-  unsigned long g0, g1, g2, g3, g4;
-  uint64_t f;
-  unsigned long mask;
-
-  /* process the remaining block */
-  if (st->leftover) {
-    size_t i = st->leftover;
-    st->buffer[i++] = 1;
-    for (; i < poly1305_block_size; i++) st->buffer[i] = 0;
-    st->final = 1;
-    poly1305_blocks(st, st->buffer, poly1305_block_size);
-  }
-
-  /* fully carry h */
-  h0 = st->h[0];
-  h1 = st->h[1];
-  h2 = st->h[2];
-  h3 = st->h[3];
-  h4 = st->h[4];
-
-  c = h1 >> 26;
-  h1 = h1 & 0x3ffffff;
-  h2 += c;
-  c = h2 >> 26;
-  h2 = h2 & 0x3ffffff;
-  h3 += c;
-  c = h3 >> 26;
-  h3 = h3 & 0x3ffffff;
-  h4 += c;
-  c = h4 >> 26;
-  h4 = h4 & 0x3ffffff;
-  h0 += c * 5;
-  c = h0 >> 26;
-  h0 = h0 & 0x3ffffff;
-  h1 += c;
-
-  /* compute h + -p */
-  g0 = h0 + 5;
-  c = g0 >> 26;
-  g0 &= 0x3ffffff;
-  g1 = h1 + c;
-  c = g1 >> 26;
-  g1 &= 0x3ffffff;
-  g2 = h2 + c;
-  c = g2 >> 26;
-  g2 &= 0x3ffffff;
-  g3 = h3 + c;
-  c = g3 >> 26;
-  g3 &= 0x3ffffff;
-  g4 = h4 + c - (1UL << 26);
-
-  /* select h if h < p, or h + -p if h >= p */
-  mask = (g4 >> ((sizeof(unsigned long) * 8) - 1)) - 1;
-  g0 &= mask;
-  g1 &= mask;
-  g2 &= mask;
-  g3 &= mask;
-  g4 &= mask;
-  mask = ~mask;
-  h0 = (h0 & mask) | g0;
-  h1 = (h1 & mask) | g1;
-  h2 = (h2 & mask) | g2;
-  h3 = (h3 & mask) | g3;
-  h4 = (h4 & mask) | g4;
-
-  /* h = h % (2^128) */
-  h0 = ((h0) | (h1 << 26)) & 0xffffffff;
-  h1 = ((h1 >> 6) | (h2 << 20)) & 0xffffffff;
-  h2 = ((h2 >> 12) | (h3 << 14)) & 0xffffffff;
-  h3 = ((h3 >> 18) | (h4 << 8)) & 0xffffffff;
-
-  /* mac = (h + pad) % (2^128) */
-  f = (uint64_t) h0 + st->pad[0];
-  h0 = (unsigned long) f;
-  f = (uint64_t) h1 + st->pad[1] + (f >> 32);
-  h1 = (unsigned long) f;
-  f = (uint64_t) h2 + st->pad[2] + (f >> 32);
-  h2 = (unsigned long) f;
-  f = (uint64_t) h3 + st->pad[3] + (f >> 32);
-  h3 = (unsigned long) f;
-
-  U32TO8(mac + 0, h0);
-  U32TO8(mac + 4, h1);
-  U32TO8(mac + 8, h2);
-  U32TO8(mac + 12, h3);
-
-  /* zero out the state */
-  st->h[0] = 0;
-  st->h[1] = 0;
-  st->h[2] = 0;
-  st->h[3] = 0;
-  st->h[4] = 0;
-  st->r[0] = 0;
-  st->r[1] = 0;
-  st->r[2] = 0;
-  st->r[3] = 0;
-  st->r[4] = 0;
-  st->pad[0] = 0;
-  st->pad[1] = 0;
-  st->pad[2] = 0;
-  st->pad[3] = 0;
-}
-
-#else
-/*
-        poly1305 implementation using 64 bit * 64 bit = 128 bit multiplication
-and 128 bit addition static */
-
-#if defined(_MSC_VER)
-
-typedef struct uint128_t {
-  uint64_t lo;
-  uint64_t hi;
-} uint128_t;
-
-#define MUL128(out, x, y) out.lo = _umul128((x), (y), &out.hi)
-#define ADD(out, in)                \
-  {                                 \
-    uint64_t t = out.lo;            \
-    out.lo += in.lo;                \
-    out.hi += (out.lo < t) + in.hi; \
-  }
-#define ADDLO(out, in)      \
-  {                         \
-    uint64_t t = out.lo;    \
-    out.lo += in;           \
-    out.hi += (out.lo < t); \
-  }
-#define SHR(in, shift) (__shiftright128(in.lo, in.hi, (shift)))
-#define LO(in) (in.lo)
-
-#if defined(_MSC_VER) && _MSC_VER < 1700
-#define POLY1305_NOINLINE
-#else
-#define POLY1305_NOINLINE __declspec(noinline)
-#endif
-#elif defined(__GNUC__)
-#if defined(__SIZEOF_INT128__)
-// Get rid of GCC warning "ISO C does not support '__int128' types"
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wpedantic"
-typedef unsigned __int128 uint128_t;
-#pragma GCC diagnostic pop
-#else
-typedef unsigned uint128_t __attribute__((mode(TI)));
-#endif
-
-#define MUL128(out, x, y) out = ((uint128_t) x * y)
-#define ADD(out, in) out += in
-#define ADDLO(out, in) out += in
-#define SHR(in, shift) (uint64_t)(in >> (shift))
-#define LO(in) (uint64_t)(in)
-
-#define POLY1305_NOINLINE __attribute__((noinline))
-#endif
-
-#define poly1305_block_size 16
-
-/* 17 + sizeof(size_t) + 8*sizeof(uint64_t) */
-typedef struct poly1305_state_internal_t {
-  uint64_t r[3];
-  uint64_t h[3];
-  uint64_t pad[2];
-  size_t leftover;
-  unsigned char buffer[poly1305_block_size];
-  unsigned char final;
-} poly1305_state_internal_t;
-
-/* interpret eight 8 bit unsigned integers as a 64 bit unsigned integer in
- * little endian */
-static uint64_t U8TO64(const unsigned char *p) {
-  return (((uint64_t) (p[0] & 0xff)) | ((uint64_t) (p[1] & 0xff) << 8) |
-          ((uint64_t) (p[2] & 0xff) << 16) | ((uint64_t) (p[3] & 0xff) << 24) |
-          ((uint64_t) (p[4] & 0xff) << 32) | ((uint64_t) (p[5] & 0xff) << 40) |
-          ((uint64_t) (p[6] & 0xff) << 48) | ((uint64_t) (p[7] & 0xff) << 56));
-}
-
-/* store a 64 bit unsigned integer as eight 8 bit unsigned integers in little
- * endian */
-static void U64TO8(unsigned char *p, uint64_t v) {
-  p[0] = (unsigned char) ((v) &0xff);
-  p[1] = (unsigned char) ((v >> 8) & 0xff);
-  p[2] = (unsigned char) ((v >> 16) & 0xff);
-  p[3] = (unsigned char) ((v >> 24) & 0xff);
-  p[4] = (unsigned char) ((v >> 32) & 0xff);
-  p[5] = (unsigned char) ((v >> 40) & 0xff);
-  p[6] = (unsigned char) ((v >> 48) & 0xff);
-  p[7] = (unsigned char) ((v >> 56) & 0xff);
-}
-
-static void poly1305_init(poly1305_context *ctx, const unsigned char key[32]) {
-  poly1305_state_internal_t *st = (poly1305_state_internal_t *) ctx;
-  uint64_t t0, t1;
-
-  /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */
-  t0 = U8TO64(&key[0]);
-  t1 = U8TO64(&key[8]);
-
-  st->r[0] = (t0) &0xffc0fffffff;
-  st->r[1] = ((t0 >> 44) | (t1 << 20)) & 0xfffffc0ffff;
-  st->r[2] = ((t1 >> 24)) & 0x00ffffffc0f;
-
-  /* h = 0 */
-  st->h[0] = 0;
-  st->h[1] = 0;
-  st->h[2] = 0;
-
-  /* save pad for later */
-  st->pad[0] = U8TO64(&key[16]);
-  st->pad[1] = U8TO64(&key[24]);
-
-  st->leftover = 0;
-  st->final = 0;
-}
-
-static void poly1305_blocks(poly1305_state_internal_t *st,
-                            const unsigned char *m, size_t bytes) {
-  const uint64_t hibit = (st->final) ? 0 : ((uint64_t) 1 << 40); /* 1 << 128 */
-  uint64_t r0, r1, r2;
-  uint64_t s1, s2;
-  uint64_t h0, h1, h2;
-  uint64_t c;
-  uint128_t d0, d1, d2, d;
-
-  r0 = st->r[0];
-  r1 = st->r[1];
-  r2 = st->r[2];
-
-  h0 = st->h[0];
-  h1 = st->h[1];
-  h2 = st->h[2];
-
-  s1 = r1 * (5 << 2);
-  s2 = r2 * (5 << 2);
-
-  while (bytes >= poly1305_block_size) {
-    uint64_t t0, t1;
-
-    /* h += m[i] */
-    t0 = U8TO64(&m[0]);
-    t1 = U8TO64(&m[8]);
-
-    h0 += ((t0) &0xfffffffffff);
-    h1 += (((t0 >> 44) | (t1 << 20)) & 0xfffffffffff);
-    h2 += (((t1 >> 24)) & 0x3ffffffffff) | hibit;
-
-    /* h *= r */
-    MUL128(d0, h0, r0);
-    MUL128(d, h1, s2);
-    ADD(d0, d);
-    MUL128(d, h2, s1);
-    ADD(d0, d);
-    MUL128(d1, h0, r1);
-    MUL128(d, h1, r0);
-    ADD(d1, d);
-    MUL128(d, h2, s2);
-    ADD(d1, d);
-    MUL128(d2, h0, r2);
-    MUL128(d, h1, r1);
-    ADD(d2, d);
-    MUL128(d, h2, r0);
-    ADD(d2, d);
-
-    /* (partial) h %= p */
-    c = SHR(d0, 44);
-    h0 = LO(d0) & 0xfffffffffff;
-    ADDLO(d1, c);
-    c = SHR(d1, 44);
-    h1 = LO(d1) & 0xfffffffffff;
-    ADDLO(d2, c);
-    c = SHR(d2, 42);
-    h2 = LO(d2) & 0x3ffffffffff;
-    h0 += c * 5;
-    c = (h0 >> 44);
-    h0 = h0 & 0xfffffffffff;
-    h1 += c;
-
-    m += poly1305_block_size;
-    bytes -= poly1305_block_size;
-  }
-
-  st->h[0] = h0;
-  st->h[1] = h1;
-  st->h[2] = h2;
-}
-
-static POLY1305_NOINLINE void poly1305_finish(poly1305_context *ctx,
-                                              unsigned char mac[16]) {
-  poly1305_state_internal_t *st = (poly1305_state_internal_t *) ctx;
-  uint64_t h0, h1, h2, c;
-  uint64_t g0, g1, g2;
-  uint64_t t0, t1;
-
-  /* process the remaining block */
-  if (st->leftover) {
-    size_t i = st->leftover;
-    st->buffer[i] = 1;
-    for (i = i + 1; i < poly1305_block_size; i++) st->buffer[i] = 0;
-    st->final = 1;
-    poly1305_blocks(st, st->buffer, poly1305_block_size);
-  }
-
-  /* fully carry h */
-  h0 = st->h[0];
-  h1 = st->h[1];
-  h2 = st->h[2];
-
-  c = (h1 >> 44);
-  h1 &= 0xfffffffffff;
-  h2 += c;
-  c = (h2 >> 42);
-  h2 &= 0x3ffffffffff;
-  h0 += c * 5;
-  c = (h0 >> 44);
-  h0 &= 0xfffffffffff;
-  h1 += c;
-  c = (h1 >> 44);
-  h1 &= 0xfffffffffff;
-  h2 += c;
-  c = (h2 >> 42);
-  h2 &= 0x3ffffffffff;
-  h0 += c * 5;
-  c = (h0 >> 44);
-  h0 &= 0xfffffffffff;
-  h1 += c;
-
-  /* compute h + -p */
-  g0 = h0 + 5;
-  c = (g0 >> 44);
-  g0 &= 0xfffffffffff;
-  g1 = h1 + c;
-  c = (g1 >> 44);
-  g1 &= 0xfffffffffff;
-  g2 = h2 + c - ((uint64_t) 1 << 42);
-
-  /* select h if h < p, or h + -p if h >= p */
-  c = (g2 >> ((sizeof(uint64_t) * 8) - 1)) - 1;
-  g0 &= c;
-  g1 &= c;
-  g2 &= c;
-  c = ~c;
-  h0 = (h0 & c) | g0;
-  h1 = (h1 & c) | g1;
-  h2 = (h2 & c) | g2;
-
-  /* h = (h + pad) */
-  t0 = st->pad[0];
-  t1 = st->pad[1];
-
-  h0 += ((t0) &0xfffffffffff);
-  c = (h0 >> 44);
-  h0 &= 0xfffffffffff;
-  h1 += (((t0 >> 44) | (t1 << 20)) & 0xfffffffffff) + c;
-  c = (h1 >> 44);
-  h1 &= 0xfffffffffff;
-  h2 += (((t1 >> 24)) & 0x3ffffffffff) + c;
-  h2 &= 0x3ffffffffff;
-
-  /* mac = h % (2^128) */
-  h0 = ((h0) | (h1 << 44));
-  h1 = ((h1 >> 20) | (h2 << 24));
-
-  U64TO8(&mac[0], h0);
-  U64TO8(&mac[8], h1);
-
-  /* zero out the state */
-  st->h[0] = 0;
-  st->h[1] = 0;
-  st->h[2] = 0;
-  st->r[0] = 0;
-  st->r[1] = 0;
-  st->r[2] = 0;
-  st->pad[0] = 0;
-  st->pad[1] = 0;
-}
-
-#endif
-
-static void poly1305_update(poly1305_context *ctx, const unsigned char *m,
-                            size_t bytes) {
-  poly1305_state_internal_t *st = (poly1305_state_internal_t *) ctx;
-  size_t i;
-
-  /* handle leftover */
-  if (st->leftover) {
-    size_t want = (poly1305_block_size - st->leftover);
-    if (want > bytes) want = bytes;
-    for (i = 0; i < want; i++) st->buffer[st->leftover + i] = m[i];
-    bytes -= want;
-    m += want;
-    st->leftover += want;
-    if (st->leftover < poly1305_block_size) return;
-    poly1305_blocks(st, st->buffer, poly1305_block_size);
-    st->leftover = 0;
-  }
-
-  /* process full blocks */
-  if (bytes >= poly1305_block_size) {
-    size_t want = (bytes & (size_t) ~(poly1305_block_size - 1));
-    poly1305_blocks(st, m, want);
-    m += want;
-    bytes -= want;
-  }
-
-  /* store leftover */
-  if (bytes) {
-    for (i = 0; i < bytes; i++) st->buffer[st->leftover + i] = m[i];
-    st->leftover += bytes;
-  }
-}
-
-// ******* END: poly1305-donna.c ********
-// ******* BEGIN: portable8439.c ********
-
-#define __CHACHA20_BLOCK_SIZE (64)
-#define __POLY1305_KEY_SIZE (32)
-
-static PORTABLE_8439_DECL uint8_t __ZEROES[16] = {0};
-static PORTABLE_8439_DECL void pad_if_needed(poly1305_context *ctx,
-                                             size_t size) {
-  size_t padding = size % 16;
-  if (padding != 0) {
-    poly1305_update(ctx, __ZEROES, 16 - padding);
-  }
-}
-
-#define __u8(v) ((uint8_t) ((v) &0xFF))
-
-// TODO: make this depending on the unaligned/native read size possible
-static PORTABLE_8439_DECL void write_64bit_int(poly1305_context *ctx,
-                                               uint64_t value) {
-  uint8_t result[8];
-  result[0] = __u8(value);
-  result[1] = __u8(value >> 8);
-  result[2] = __u8(value >> 16);
-  result[3] = __u8(value >> 24);
-  result[4] = __u8(value >> 32);
-  result[5] = __u8(value >> 40);
-  result[6] = __u8(value >> 48);
-  result[7] = __u8(value >> 56);
-  poly1305_update(ctx, result, 8);
-}
-
-static PORTABLE_8439_DECL void poly1305_calculate_mac(
-    uint8_t *mac, const uint8_t *cipher_text, size_t cipher_text_size,
-    const uint8_t key[RFC_8439_KEY_SIZE],
-    const uint8_t nonce[RFC_8439_NONCE_SIZE], const uint8_t *ad,
-    size_t ad_size) {
-  // init poly key (section 2.6)
-  uint8_t poly_key[__POLY1305_KEY_SIZE] = {0};
-  poly1305_context poly_ctx;
-  rfc8439_keygen(poly_key, key, nonce);
-  // start poly1305 mac
-  poly1305_init(&poly_ctx, poly_key);
-
-  if (ad != NULL && ad_size > 0) {
-    // write AD if present
-    poly1305_update(&poly_ctx, ad, ad_size);
-    pad_if_needed(&poly_ctx, ad_size);
-  }
-
-  // now write the cipher text
-  poly1305_update(&poly_ctx, cipher_text, cipher_text_size);
-  pad_if_needed(&poly_ctx, cipher_text_size);
-
-  // write sizes
-  write_64bit_int(&poly_ctx, ad_size);
-  write_64bit_int(&poly_ctx, cipher_text_size);
-
-  // calculate MAC
-  poly1305_finish(&poly_ctx, mac);
-}
-
-#define PM(p) ((size_t) (p))
-
-// pointers overlap if the smaller either ahead of the end,
-// or its end is before the start of the other
-//
-// s_size should be smaller or equal to b_size
-#define OVERLAPPING(s, s_size, b, b_size) \
-  (PM(s) < PM((b) + (b_size))) && (PM(b) < PM((s) + (s_size)))
-
-PORTABLE_8439_DECL size_t mg_chacha20_poly1305_encrypt(
-    uint8_t *restrict cipher_text, const uint8_t key[RFC_8439_KEY_SIZE],
-    const uint8_t nonce[RFC_8439_NONCE_SIZE], const uint8_t *restrict ad,
-    size_t ad_size, const uint8_t *restrict plain_text,
-    size_t plain_text_size) {
-  size_t new_size = plain_text_size + RFC_8439_TAG_SIZE;
-  if (OVERLAPPING(plain_text, plain_text_size, cipher_text, new_size)) {
-    return (size_t) -1;
-  }
-  chacha20_xor_stream(cipher_text, plain_text, plain_text_size, key, nonce, 1);
-  poly1305_calculate_mac(cipher_text + plain_text_size, cipher_text,
-                         plain_text_size, key, nonce, ad, ad_size);
-  return new_size;
-}
-
-PORTABLE_8439_DECL size_t mg_chacha20_poly1305_decrypt(
-    uint8_t *restrict plain_text, const uint8_t key[RFC_8439_KEY_SIZE],
-    const uint8_t nonce[RFC_8439_NONCE_SIZE],
-    const uint8_t *restrict cipher_text, size_t cipher_text_size) {
-  // first we calculate the mac and see if it lines up, only then do we decrypt
-  size_t actual_size = cipher_text_size - RFC_8439_TAG_SIZE;
-  if (OVERLAPPING(plain_text, actual_size, cipher_text, cipher_text_size)) {
-    return (size_t) -1;
-  }
-
-  chacha20_xor_stream(plain_text, cipher_text, actual_size, key, nonce, 1);
-  return actual_size;
-}
-// ******* END:   portable8439.c ********
-#endif  // MG_TLS == MG_TLS_BUILTIN
-
 #ifdef MG_ENABLE_LINES
 #line 1 "src/tls_dummy.c"
 #endif
@@ -12530,9 +11068,8 @@ static STACK_OF(X509_INFO) * load_ca_certs(struct mg_str ca) {
 }
 
 static bool add_ca_certs(SSL_CTX *ctx, STACK_OF(X509_INFO) * certs) {
-  int i;
   X509_STORE *cert_store = SSL_CTX_get_cert_store(ctx);
-  for (i = 0; i < sk_X509_INFO_num(certs); i++) {
+  for (int i = 0; i < sk_X509_INFO_num(certs); i++) {
     X509_INFO *cert_info = sk_X509_INFO_value(certs, i);
     if (cert_info->x509 && !X509_STORE_add_cert(cert_store, cert_info->x509))
       return false;
@@ -12588,36 +11125,13 @@ static int mg_bio_write(BIO *bio, const char *buf, int len) {
   return len;
 }
 
-#ifdef MG_TLS_SSLKEYLOGFILE
-static void ssl_keylog_cb(const SSL *ssl, const char *line) {
-  char *keylogfile = getenv("SSLKEYLOGFILE");
-  if (keylogfile == NULL) {
-    return;
-  }
-  FILE *f = fopen(keylogfile, "a");
-  fprintf(f, "%s\n", line);
-  fflush(f);
-  fclose(f);
-}
-#endif
-
-void mg_tls_free(struct mg_connection *c) {
-  struct mg_tls *tls = (struct mg_tls *) c->tls;
-  if (tls == NULL) return;
-  SSL_free(tls->ssl);
-  SSL_CTX_free(tls->ctx);
-  BIO_meth_free(tls->bm);
-  free(tls);
-  c->tls = NULL;
-}
-
 void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
   struct mg_tls *tls = (struct mg_tls *) calloc(1, sizeof(*tls));
   const char *id = "mongoose";
   static unsigned char s_initialised = 0;
   BIO *bio = NULL;
   int rc;
-  c->tls = tls;
+
   if (tls == NULL) {
     mg_error(c, "TLS OOM");
     goto fail;
@@ -12628,15 +11142,8 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
     s_initialised++;
   }
   MG_DEBUG(("%lu Setting TLS", c->id));
-  tls->ctx = c->is_client ? SSL_CTX_new(TLS_client_method())
-                          : SSL_CTX_new(TLS_server_method());
-  if (tls->ctx == NULL) {
-    mg_error(c, "SSL_CTX_new");
-    goto fail;
-  }
-#ifdef MG_TLS_SSLKEYLOGFILE
-  SSL_CTX_set_keylog_callback(tls->ctx, ssl_keylog_cb);
-#endif
+  tls->ctx = c->is_client ? SSL_CTX_new(SSLv23_client_method())
+                          : SSL_CTX_new(SSLv23_server_method());
   if ((tls->ssl = SSL_new(tls->ctx)) == NULL) {
     mg_error(c, "SSL_new");
     goto fail;
@@ -12721,6 +11228,7 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
   BIO_set_data(bio, c);
   SSL_set_bio(tls->ssl, bio, bio);
 
+  c->tls = tls;
   c->is_tls = 1;
   c->is_tls_hs = 1;
   if (c->is_client && c->is_resolving == 0 && c->is_connecting == 0) {
@@ -12729,7 +11237,7 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
   MG_DEBUG(("%lu SSL %s OK", c->id, c->is_accepted ? "accept" : "client"));
   return;
 fail:
-  mg_tls_free(c);
+  free(tls);
 }
 
 void mg_tls_handshake(struct mg_connection *c) {
@@ -12745,6 +11253,16 @@ void mg_tls_handshake(struct mg_connection *c) {
   }
 }
 
+void mg_tls_free(struct mg_connection *c) {
+  struct mg_tls *tls = (struct mg_tls *) c->tls;
+  if (tls == NULL) return;
+  SSL_free(tls->ssl);
+  SSL_CTX_free(tls->ctx);
+  BIO_meth_free(tls->bm);
+  free(tls);
+  c->tls = NULL;
+}
+
 size_t mg_tls_pending(struct mg_connection *c) {
   struct mg_tls *tls = (struct mg_tls *) c->tls;
   return tls == NULL ? 0 : (size_t) SSL_pending(tls->ssl);
@@ -12798,8 +11316,8 @@ void mg_tls_ctx_free(struct mg_mgr *mgr) {
 #if (MG_UECC_PLATFORM == mg_uecc_avr) || (MG_UECC_PLATFORM == mg_uecc_arm) || \
     (MG_UECC_PLATFORM == mg_uecc_arm_thumb) ||                                \
     (MG_UECC_PLATFORM == mg_uecc_arm_thumb2)
-#define MG_UECC_CONCATX(a, ...) a##__VA_ARGS__
-#define MG_UECC_CONCAT(a, ...) MG_UECC_CONCATX(a, __VA_ARGS__)
+#define CONCATX(a, ...) a##__VA_ARGS__
+#define CONCAT(a, ...) CONCATX(a, __VA_ARGS__)
 
 #define STRX(a) #a
 #define STR(a) STRX(a)
@@ -12843,28 +11361,28 @@ void mg_tls_ctx_free(struct mg_mgr *mgr) {
 #define DEC_31 30
 #define DEC_32 31
 
-#define DEC(N) MG_UECC_CONCAT(DEC_, N)
+#define DEC(N) CONCAT(DEC_, N)
 
 #define SECOND_ARG(_, val, ...) val
 #define SOME_CHECK_0 ~, 0
 #define GET_SECOND_ARG(...) SECOND_ARG(__VA_ARGS__, SOME, )
-#define SOME_OR_0(N) GET_SECOND_ARG(MG_UECC_CONCAT(SOME_CHECK_, N))
+#define SOME_OR_0(N) GET_SECOND_ARG(CONCAT(SOME_CHECK_, N))
 
-#define MG_UECC_EMPTY(...)
-#define DEFER(...) __VA_ARGS__ MG_UECC_EMPTY()
+#define EMPTY(...)
+#define DEFER(...) __VA_ARGS__ EMPTY()
 
 #define REPEAT_NAME_0() REPEAT_0
 #define REPEAT_NAME_SOME() REPEAT_SOME
 #define REPEAT_0(...)
 #define REPEAT_SOME(N, stuff) \
-  DEFER(MG_UECC_CONCAT(REPEAT_NAME_, SOME_OR_0(DEC(N))))()(DEC(N), stuff) stuff
+  DEFER(CONCAT(REPEAT_NAME_, SOME_OR_0(DEC(N))))()(DEC(N), stuff) stuff
 #define REPEAT(N, stuff) EVAL(REPEAT_SOME(N, stuff))
 
 #define REPEATM_NAME_0() REPEATM_0
 #define REPEATM_NAME_SOME() REPEATM_SOME
 #define REPEATM_0(...)
 #define REPEATM_SOME(N, macro) \
-  macro(N) DEFER(MG_UECC_CONCAT(REPEATM_NAME_, SOME_OR_0(DEC(N))))()(DEC(N), macro)
+  macro(N) DEFER(CONCAT(REPEATM_NAME_, SOME_OR_0(DEC(N))))()(DEC(N), macro)
 #define REPEATM(N, macro) EVAL(REPEATM_SOME(N, macro))
 #endif
 
@@ -16359,7 +14877,6 @@ struct mg_str mg_url_pass(const char *url) {
 #endif
 
 
-
 // Not using memset for zeroing memory, cause it can be dropped by compiler
 // See https://github.com/cesanta/mongoose/pull/1265
 void mg_bzero(volatile unsigned char *buf, size_t len) {
@@ -16370,50 +14887,22 @@ void mg_bzero(volatile unsigned char *buf, size_t len) {
 
 #if MG_ENABLE_CUSTOM_RANDOM
 #else
-bool mg_random(void *buf, size_t len) {
-  bool success = false;
+void mg_random(void *buf, size_t len) {
+  bool done = false;
   unsigned char *p = (unsigned char *) buf;
 #if MG_ARCH == MG_ARCH_ESP32
   while (len--) *p++ = (unsigned char) (esp_random() & 255);
-  success = true;
+  done = true;
 #elif MG_ARCH == MG_ARCH_WIN32
-  static bool initialised = false;
-#if defined(_MSC_VER) && _MSC_VER < 1700
-  static HCRYPTPROV hProv;
-  // CryptGenRandom() implementation earlier than 2008 is weak, see
-  // https://en.wikipedia.org/wiki/CryptGenRandom
-  if (initialised == false) {
-    initialised = CryptAcquireContext(&hProv, NULL, NULL, PROV_RSA_FULL,
-                                      CRYPT_VERIFYCONTEXT);
-  }
-  if (initialised == true) {
-    success = CryptGenRandom(hProv, len, p);
-  }
-#else
-  // BCrypt is a "new generation" strong crypto API, so try it first
-  static BCRYPT_ALG_HANDLE hProv;
-  if (initialised == false &&
-      BCryptOpenAlgorithmProvider(&hProv, BCRYPT_RNG_ALGORITHM, NULL, 0) == 0) {
-    initialised = true;
-  }
-  if (initialised == true) {
-    success = BCryptGenRandom(hProv, p, (ULONG) len, 0) == 0;
-  }
-#endif
-
 #elif MG_ARCH == MG_ARCH_UNIX
   FILE *fp = fopen("/dev/urandom", "rb");
   if (fp != NULL) {
-    if (fread(buf, 1, len, fp) == len) success = true;
+    if (fread(buf, 1, len, fp) == len) done = true;
     fclose(fp);
   }
 #endif
   // If everything above did not work, fallback to a pseudo random generator
-  if (success == false) {
-    MG_ERROR(("Weak RNG: using rand()"));
-    while (len--) *p++ = (unsigned char) (rand() & 255);
-  }
-  return success;
+  while (!done && len--) *p++ = (unsigned char) (rand() & 255);
 }
 #endif
 
@@ -16693,9 +15182,9 @@ size_t mg_ws_send(struct mg_connection *c, const void *buf, size_t len,
                   int op) {
   uint8_t header[14];
   size_t header_len = mkhdr(len, op, c->is_client, header);
-  if (!mg_send(c, header, header_len)) return 0;
-  if (!mg_send(c, buf, len)) return header_len;
+  mg_send(c, header, header_len);
   MG_VERBOSE(("WS out: %d [%.*s]", (int) len, (int) len, buf));
+  mg_send(c, buf, len);
   mg_ws_mask(c, len);
   return header_len + len;
 }
@@ -16847,12 +15336,12 @@ size_t mg_ws_wrap(struct mg_connection *c, size_t len, int op) {
   size_t header_len = mkhdr(len, op, c->is_client, header);
 
   // NOTE: order of operations is important!
-  if (mg_iobuf_add(&c->send, c->send.len, NULL, header_len) != 0) {
-    p = &c->send.buf[c->send.len - len];         // p points to data
-    memmove(p, p - header_len, len);             // Shift data
-    memcpy(p - header_len, header, header_len);  // Prepend header
-    mg_ws_mask(c, len);                          // Mask data
-  }
+  mg_iobuf_add(&c->send, c->send.len, NULL, header_len);
+  p = &c->send.buf[c->send.len - len];         // p points to data
+  memmove(p, p - header_len, len);             // Shift data
+  memcpy(p - header_len, header, header_len);  // Prepend header
+  mg_ws_mask(c, len);                          // Mask data
+
   return c->send.len;
 }
 
@@ -17232,7 +15721,7 @@ void mg_phy_init(struct mg_phy *phy, uint8_t phy_addr, uint8_t config) {
   MG_INFO(("PHY ID: %#04x %#04x (%s)", id1, id2, mg_phy_id_to_str(id1, id2)));
 
   if (id1 == MG_PHY_DP83x && id2 == MG_PHY_DP83867) {
-    phy->write_reg(phy_addr, 0x0d, 0x1f);  // write 0x10d to IO_MUX_CFG (0x0170)
+    phy->write_reg(phy_addr, 0x0d, 0x1f);    // write 0x10d to IO_MUX_CFG (0x0170)
     phy->write_reg(phy_addr, 0x0e, 0x170);
     phy->write_reg(phy_addr, 0x0d, 0x401f);
     phy->write_reg(phy_addr, 0x0e, 0x10d);
@@ -17246,11 +15735,7 @@ void mg_phy_init(struct mg_phy *phy, uint8_t phy_addr, uint8_t config) {
     if (id1 == MG_PHY_DP83x && id2 != MG_PHY_DP83867) {
       phy->write_reg(phy_addr, MG_PHY_DP83x_REG_RCSR, MG_BIT(7) | MG_BIT(0));
     } else if (id1 == MG_PHY_KSZ8x) {
-      // Disable isolation (override hw, it doesn't make sense at this point)
-      phy->write_reg(  // #2848, some NXP boards set ISO, even though
-          phy_addr, MG_PHY_REG_BCR,  // docs say they don't
-          phy->read_reg(phy_addr, MG_PHY_REG_BCR) & (uint16_t) ~MG_BIT(10));
-      phy->write_reg(phy_addr, MG_PHY_KSZ8x_REG_PC2R,  // now do clock stuff
+      phy->write_reg(phy_addr, MG_PHY_KSZ8x_REG_PC2R,
                      MG_BIT(15) | MG_BIT(8) | MG_BIT(7));
     } else if (id1 == MG_PHY_LAN87x) {
       // nothing to do
@@ -18024,11 +16509,9 @@ struct mg_tcpip_driver mg_tcpip_driver_stm32f = {
 #endif
 
 
-#if MG_ENABLE_TCPIP && (MG_ENABLE_DRIVER_STM32H || MG_ENABLE_DRIVER_MCXN)
-// STM32H: vendor modded single-queue Synopsys v4.2
-// MCXNx4x: dual-queue Synopsys v5.2
-// RT1170 ENET_QOS: quad-queue Synopsys v5.1
-struct synopsys_enet_qos {
+#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_STM32H) && \
+    MG_ENABLE_DRIVER_STM32H
+struct stm32h_eth {
   volatile uint32_t MACCR, MACECR, MACPFR, MACWTR, MACHT0R, MACHT1R,
       RESERVED1[14], MACVTR, RESERVED2, MACVHTR, RESERVED3, MACVIR, MACIVIR,
       RESERVED4[2], MACTFCR, RESERVED5[7], MACRFCR, RESERVED6[7], MACISR,
@@ -18059,13 +16542,8 @@ struct synopsys_enet_qos {
       DMACMFCR;
 };
 #undef ETH
-#if MG_ENABLE_DRIVER_STM32H
-#define ETH                                                                \
-  ((struct synopsys_enet_qos *) (uintptr_t) (0x40000000UL + 0x00020000UL + \
-                                             0x8000UL))
-#elif MG_ENABLE_DRIVER_MCXN
-#define ETH ((struct synopsys_enet_qos *) (uintptr_t) 0x40100000UL)
-#endif
+#define ETH \
+  ((struct stm32h_eth *) (uintptr_t) (0x40000000UL + 0x00020000UL + 0x8000UL))
 
 #define ETH_PKT_SIZE 1540  // Max frame size
 #define ETH_DESC_CNT 4     // Descriptors count
@@ -18093,6 +16571,82 @@ static void eth_write_phy(uint8_t addr, uint8_t reg, uint16_t val) {
   while (ETH->MACMDIOAR & MG_BIT(0)) (void) 0;
 }
 
+static uint32_t get_hclk(void) {
+  struct rcc {
+    volatile uint32_t CR, HSICFGR, CRRCR, CSICFGR, CFGR, RESERVED1, D1CFGR,
+        D2CFGR, D3CFGR, RESERVED2, PLLCKSELR, PLLCFGR, PLL1DIVR, PLL1FRACR,
+        PLL2DIVR, PLL2FRACR, PLL3DIVR, PLL3FRACR, RESERVED3, D1CCIPR, D2CCIP1R,
+        D2CCIP2R, D3CCIPR, RESERVED4, CIER, CIFR, CICR, RESERVED5, BDCR, CSR,
+        RESERVED6, AHB3RSTR, AHB1RSTR, AHB2RSTR, AHB4RSTR, APB3RSTR, APB1LRSTR,
+        APB1HRSTR, APB2RSTR, APB4RSTR, GCR, RESERVED8, D3AMR, RESERVED11[9],
+        RSR, AHB3ENR, AHB1ENR, AHB2ENR, AHB4ENR, APB3ENR, APB1LENR, APB1HENR,
+        APB2ENR, APB4ENR, RESERVED12, AHB3LPENR, AHB1LPENR, AHB2LPENR,
+        AHB4LPENR, APB3LPENR, APB1LLPENR, APB1HLPENR, APB2LPENR, APB4LPENR,
+        RESERVED13[4];
+  } *rcc = ((struct rcc *) (0x40000000 + 0x18020000 + 0x4400));
+  uint32_t clk = 0, hsi = 64000000 /* 64 MHz */, hse = 8000000 /* 8MHz */,
+           csi = 4000000 /* 4MHz */;
+  unsigned int sel = (rcc->CFGR & (7 << 3)) >> 3;
+
+  if (sel == 1) {
+    clk = csi;
+  } else if (sel == 2) {
+    clk = hse;
+  } else if (sel == 3) {
+    uint32_t vco, m, n, p;
+    unsigned int src = (rcc->PLLCKSELR & (3 << 0)) >> 0;
+    m = ((rcc->PLLCKSELR & (0x3F << 4)) >> 4);
+    n = ((rcc->PLL1DIVR & (0x1FF << 0)) >> 0) + 1 +
+        ((rcc->PLLCFGR & MG_BIT(0)) ? 1 : 0);  // round-up in fractional mode
+    p = ((rcc->PLL1DIVR & (0x7F << 9)) >> 9) + 1;
+    if (src == 1) {
+      clk = csi;
+    } else if (src == 2) {
+      clk = hse;
+    } else {
+      clk = hsi;
+      clk >>= ((rcc->CR & 3) >> 3);
+    }
+    vco = (uint32_t) ((uint64_t) clk * n / m);
+    clk = vco / p;
+  } else {
+    clk = hsi;
+    clk >>= ((rcc->CR & 3) >> 3);
+  }
+  const uint8_t cptab[12] = {1, 2, 3, 4, 6, 7, 8, 9};  // log2(div)
+  uint32_t d1cpre = (rcc->D1CFGR & (0x0F << 8)) >> 8;
+  if (d1cpre >= 8) clk >>= cptab[d1cpre - 8];
+  MG_DEBUG(("D1 CLK: %u", clk));
+  uint32_t hpre = (rcc->D1CFGR & (0x0F << 0)) >> 0;
+  if (hpre < 8) return clk;
+  return ((uint32_t) clk) >> cptab[hpre - 8];
+}
+
+//  Guess CR from AHB1 clock. MDC clock is generated from the ETH peripheral
+//  clock (AHB1); as per 802.3, it must not exceed 2. As the AHB clock can
+//  be derived from HSI or CSI (internal RC) clocks, and those can go above
+//  specs, the datasheets specify a range of frequencies and activate one of a
+//  series of dividers to keep the MDC clock safely below 2.5MHz. We guess a
+//  divider setting based on HCLK with some drift. If the user uses a different
+//  clock from our defaults, needs to set the macros on top. Valid for
+//  STM32H74xxx/75xxx (58.11.4)(4.5% worst case drift)(CSI clock has a 7.5 %
+//  worst case drift @ max temp)
+static int guess_mdc_cr(void) {
+  const uint8_t crs[] = {2, 3, 0, 1, 4, 5};  // ETH->MACMDIOAR::CR values
+  const uint8_t div[] = {16, 26, 42, 62, 102, 124};  // Respective HCLK dividers
+  uint32_t hclk = get_hclk();                        // Guess system HCLK
+  int result = -1;                                   // Invalid CR value
+  for (int i = 0; i < 6; i++) {
+    if (hclk / div[i] <= 2375000UL /* 2.5MHz - 5% */) {
+      result = crs[i];
+      break;
+    }
+  }
+  if (result < 0) MG_ERROR(("HCLK too high"));
+  MG_DEBUG(("HCLK: %u, CR: %d", hclk, result));
+  return result;
+}
+
 static bool mg_tcpip_driver_stm32h_init(struct mg_tcpip_if *ifp) {
   struct mg_tcpip_driver_stm32h_data *d =
       (struct mg_tcpip_driver_stm32h_data *) ifp->driver_data;
@@ -18111,13 +16665,11 @@ static bool mg_tcpip_driver_stm32h_init(struct mg_tcpip_if *ifp) {
     s_txdesc[i][0] = (uint32_t) (uintptr_t) s_txbuf[i];  // Buf pointer
   }
 
-  ETH->DMAMR |= MG_BIT(0);  // Software reset
-  for (int i = 0; i < 4; i++)
-    (void) 0;  // wait at least 4 clocks before reading
+  ETH->DMAMR |= MG_BIT(0);                         // Software reset
   while ((ETH->DMAMR & MG_BIT(0)) != 0) (void) 0;  // Wait until done
 
-  // Set MDC clock divider. Get user value, else, assume max freq
-  int cr = (d == NULL || d->mdc_cr < 0) ? 7 : d->mdc_cr;
+  // Set MDC clock divider. If user told us the value, use it. Otherwise, guess
+  int cr = (d == NULL || d->mdc_cr < 0) ? guess_mdc_cr() : d->mdc_cr;
   ETH->MACMDIOAR = ((uint32_t) cr & 0xF) << 8;
 
   // NOTE(scaprile): We do not use timing facilities so the DMA engine does not
@@ -18141,23 +16693,13 @@ static bool mg_tcpip_driver_stm32h_init(struct mg_tcpip_if *ifp) {
   ETH->DMACTDTPR =
       (uint32_t) (uintptr_t) s_txdesc;  // first available descriptor address
   ETH->DMACCR = 0;  // DSL = 0 (contiguous descriptor table) (reset value)
-#if !MG_ENABLE_DRIVER_STM32H
-  MG_SET_BITS(ETH->DMACTCR, 0x3F << 16, MG_BIT(16));
-  MG_SET_BITS(ETH->DMACRCR, 0x3F << 16, MG_BIT(16));
-#endif
   ETH->DMACIER = MG_BIT(6) | MG_BIT(15);  // RIE, NIE
   ETH->MACCR = MG_BIT(0) | MG_BIT(1) | MG_BIT(13) | MG_BIT(14) |
-               MG_BIT(15);  // RE, TE, Duplex, Fast, Reserved
-#if MG_ENABLE_DRIVER_STM32H
+               MG_BIT(15);     // RE, TE, Duplex, Fast, Reserved
   ETH->MTLTQOMR |= MG_BIT(1);  // TSF
   ETH->MTLRQOMR |= MG_BIT(5);  // RSF
-#else
-  ETH->MTLTQOMR |= (7 << 16) | MG_BIT(3) | MG_BIT(1);  // 2KB Q0, TSF
-  ETH->MTLRQOMR |= (7 << 20) | MG_BIT(5);              // 2KB Q, RSF
-  MG_SET_BITS(ETH->RESERVED6[3], 3, 2);  // Enable RxQ0 (MAC_RXQ_CTRL0)
-#endif
-  ETH->DMACTCR |= MG_BIT(0);  // ST
-  ETH->DMACRCR |= MG_BIT(0);  // SR
+  ETH->DMACTCR |= MG_BIT(0);   // ST
+  ETH->DMACRCR |= MG_BIT(0);   // SR
 
   // MAC address filtering
   ETH->MACA0HR = ((uint32_t) ifp->mac[5] << 8U) | ifp->mac[4];
@@ -18214,14 +16756,9 @@ static bool mg_tcpip_driver_stm32h_up(struct mg_tcpip_if *ifp) {
   return up;
 }
 
-static uint32_t s_rxno;
-#if MG_ENABLE_DRIVER_MCXN
-void ETHERNET_IRQHandler(void);
-void ETHERNET_IRQHandler(void) {
-#else
 void ETH_IRQHandler(void);
+static uint32_t s_rxno;
 void ETH_IRQHandler(void) {
-#endif
   if (ETH->DMACSR & MG_BIT(6)) {           // Frame received, loop
     ETH->DMACSR = MG_BIT(15) | MG_BIT(6);  // Clear flag
     for (uint32_t i = 0; i < 10; i++) {  // read as they arrive but not forever
@@ -18893,15 +17430,12 @@ struct ETH_Type {
 #define ETH_DESC_CNT 4     // Descriptors count
 #define ETH_DS 2           // Descriptor size (words)
 
-// TODO(): handle these in a portable compiler-independent CMSIS-friendly way
-#define MG_8BYTE_ALIGNED __attribute__((aligned((8U))))
-
 static uint8_t s_rxbuf[ETH_DESC_CNT][ETH_PKT_SIZE];
 static uint8_t s_txbuf[ETH_DESC_CNT][ETH_PKT_SIZE];
-static uint32_t s_rxdesc[ETH_DESC_CNT][ETH_DS] MG_8BYTE_ALIGNED;
-static uint32_t s_txdesc[ETH_DESC_CNT][ETH_DS] MG_8BYTE_ALIGNED;
-static uint8_t s_txno MG_8BYTE_ALIGNED;     // Current TX descriptor
-static uint8_t s_rxno MG_8BYTE_ALIGNED;     // Current RX descriptor
+static uint32_t s_rxdesc[ETH_DESC_CNT][ETH_DS];  // RX descriptors
+static uint32_t s_txdesc[ETH_DESC_CNT][ETH_DS];  // TX descriptors
+static uint8_t s_txno;                           // Current TX descriptor
+static uint8_t s_rxno;                           // Current RX descriptor
 
 static struct mg_tcpip_if *s_ifp;  // MIP interface
 enum { MG_PHY_ADDR = 0, MG_PHYREG_BCR = 0, MG_PHYREG_BSR = 1 };
@@ -18932,14 +17466,14 @@ static bool mg_tcpip_driver_xmc7_init(struct mg_tcpip_if *ifp) {
   s_ifp = ifp;
 
   // enable controller, set RGMII mode
-  ETH0->CTL = MG_BIT(31) | (4 << 8) | 2;
+  ETH0->CTL = MG_BIT(31) | 2;
 
   uint32_t cr = get_clock_rate(d);
   // set NSP change, ignore RX FCS, data bus width, clock rate
   // frame length 1536, full duplex, speed
   ETH0->NETWORK_CONFIG = MG_BIT(29) | MG_BIT(26) | MG_BIT(21) |
-                         ((cr & 7) << 18) | MG_BIT(8) | MG_BIT(4) | MG_BIT(1) |
-                         MG_BIT(0);
+                         ((cr & 7) << 18) | MG_BIT(8) | MG_BIT(4) |
+                         MG_BIT(1) | MG_BIT(0);
 
   // config DMA settings: Force TX burst, Discard on Error, set RX buffer size
   // to 1536, TX_PBUF_SIZE, RX_PBUF_SIZE, AMBA_BURST_LENGTH
@@ -18968,8 +17502,8 @@ static bool mg_tcpip_driver_xmc7_init(struct mg_tcpip_if *ifp) {
   ETH0->RECEIVE_Q2_PTR = 1;
   ETH0->RECEIVE_Q1_PTR = 1;
 
-  // enable interrupts (RX complete)
-  ETH0->INT_ENABLE = MG_BIT(1);
+  // enable interrupts (TX and RX complete)
+  ETH0->INT_ENABLE = MG_BIT(7) | MG_BIT(1);
 
   // set MAC address
   ETH0->SPEC_ADD1_BOTTOM =
@@ -19023,30 +17557,15 @@ static bool mg_tcpip_driver_xmc7_up(struct mg_tcpip_if *ifp) {
   struct mg_phy phy = {eth_read_phy, eth_write_phy};
   up = mg_phy_up(&phy, d->phy_addr, &full_duplex, &speed);
   if ((ifp->state == MG_TCPIP_STATE_DOWN) && up) {  // link state just went up
-    // tmp = reg with flags set to the most likely situation: 100M full-duplex
-    // if(link is slow or half) set flags otherwise
-    // reg = tmp
-    uint32_t netconf = ETH0->NETWORK_CONFIG;
-    MG_SET_BITS(netconf, MG_BIT(10),
-                MG_BIT(1) | MG_BIT(0));  // 100M, Full-duplex
-    uint32_t ctl = ETH0->CTL;
-    MG_SET_BITS(ctl, 0xFF00, 4 << 8);  // /5 for 25M clock
     if (speed == MG_PHY_SPEED_1000M) {
-      netconf |= MG_BIT(10);        // 1000M
-      MG_SET_BITS(ctl, 0xFF00, 0);  // /1 for 125M clock TODO() IS THIS NEEDED ?
-    } else if (speed == MG_PHY_SPEED_10M) {
-      netconf &= ~MG_BIT(0);         // 10M
-      MG_SET_BITS(ctl, 0xFF00, 49);  // /50 for 2.5M clock
-    }
-    if (full_duplex == false) netconf &= ~MG_BIT(1);  // Half-duplex
-    ETH0->NETWORK_CONFIG = netconf;  // IRQ handler does not fiddle with these
-    ETH0->CTL = ctl;
+		  ETH0->NETWORK_CONFIG |= MG_BIT(10);
+	  }
     MG_DEBUG(("Link is %uM %s-duplex",
-              speed == MG_PHY_SPEED_10M
-                  ? 10
-                  : (speed == MG_PHY_SPEED_100M ? 100 : 1000),
+              speed == MG_PHY_SPEED_10M ? 10 : 
+              (speed == MG_PHY_SPEED_100M ? 100 : 1000),
               full_duplex ? "full" : "half"));
   }
+  (void) d;
   return up;
 }
 
@@ -19056,6 +17575,7 @@ void ETH_IRQHandler(void) {
     for (uint8_t i = 0; i < ETH_DESC_CNT; i++) {
       if (s_rxdesc[s_rxno][0] & MG_BIT(0)) {
         size_t len = s_rxdesc[s_rxno][1] & (MG_BIT(13) - 1);
+        //MG_INFO(("Receive complete: %ld bytes", len));
         mg_tcpip_qwrite(s_rxbuf[s_rxno], len, s_ifp);
         s_rxdesc[s_rxno][0] &= ~MG_BIT(0);  // OWN bit: handle control to DMA
         if (++s_rxno >= ETH_DESC_CNT) s_rxno = 0;
diff --git a/dist/mongoose/mongoose.h b/dist/mongoose/mongoose.h
index c6c0a2a7e..b41cb5b0c 100644
--- a/dist/mongoose/mongoose.h
+++ b/dist/mongoose/mongoose.h
@@ -20,7 +20,7 @@
 #ifndef MONGOOSE_H
 #define MONGOOSE_H
 
-#define MG_VERSION "7.15"
+#define MG_VERSION "7.14"
 
 #ifdef __cplusplus
 extern "C" {
@@ -42,7 +42,6 @@ extern "C" {
 #define MG_ARCH_ARMCC 12        // Keil MDK-Core with Configuration Wizard
 #define MG_ARCH_CMSIS_RTOS2 13  // CMSIS-RTOS API v2 (Keil RTX5, FreeRTOS)
 #define MG_ARCH_RTTHREAD 14     // RT-Thread RTOS
-#define MG_ARCH_ARMCGT 15       // Texas Semi ARM-CGT
 
 #if !defined(MG_ARCH)
 #if defined(__unix__) || defined(__APPLE__)
@@ -77,25 +76,6 @@ extern "C" {
 
 
 
-#if MG_ARCH == MG_ARCH_ARMCGT
-
-#include <ctype.h>
-#include <errno.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/types.h>
-#include <time.h>
-
-#define MG_PATH_MAX 100
-#define MG_ENABLE_SOCKET 0
-#define MG_ENABLE_DIRLIST 0
-
-#endif
-
-
 #if MG_ARCH == MG_ARCH_AZURERTOS
 
 #include <stdarg.h>
@@ -199,10 +179,14 @@ extern "C" {
 #include <FreeRTOS.h>
 #include <task.h>
 
+#ifndef MG_IO_SIZE
+#define MG_IO_SIZE 512
+#endif
+
 #define calloc(a, b) mg_calloc(a, b)
 #define free(a) vPortFree(a)
 #define malloc(a) pvPortMalloc(a)
-#define strdup(s) ((char *) mg_strdup(mg_str(s)).buf)
+#define strdup(s) mg_mprintf("%s", s)
 
 // Re-route calloc/free to the FreeRTOS's functions, don't use stdlib
 static inline void *mg_calloc(size_t cnt, size_t size) {
@@ -304,7 +288,7 @@ extern uint32_t rt_time_get(void);
 #include "cmsis_os2.h"  // keep this include
 #endif
 
-#define strdup(s) ((char *) mg_strdup(mg_str(s)).buf)
+#define strdup(s) mg_mprintf("%s", s)
 
 #if defined(__ARMCC_VERSION)
 #define mode_t size_t
@@ -402,14 +386,6 @@ static inline int mg_mkdir(const char *path, mode_t mode) {
 #define MG_PATH_MAX FILENAME_MAX
 #endif
 
-#ifndef MG_ENABLE_POSIX_FS
-#define MG_ENABLE_POSIX_FS 1
-#endif
-
-#ifndef MG_IO_SIZE
-#define MG_IO_SIZE 16384
-#endif
-
 #endif
 
 
@@ -463,20 +439,6 @@ typedef enum { false = 0, true = 1 } bool;
 #include <winerror.h>
 #include <winsock2.h>
 
-// For mg_random()
-#if defined(_MSC_VER) && _MSC_VER < 1700
-#ifndef _WIN32_WINNT
-#define _WIN32_WINNT 0x400  // Let vc98 pick up wincrypt.h
-#endif
-#include <wincrypt.h>
-#pragma comment(lib, "advapi32.lib")
-#else
-#include <bcrypt.h>
-#if defined(_MSC_VER) 
-#pragma comment(lib, "bcrypt.lib")
-#endif
-#endif
-
 // Protect from calls like std::snprintf in app code
 // See https://github.com/cesanta/mongoose/issues/1047
 #ifndef __cplusplus
@@ -521,12 +483,12 @@ typedef int socklen_t;
   (((errcode) < 0) && (WSAGetLastError() == WSAECONNRESET))
 
 #define realpath(a, b) _fullpath((b), (a), MG_PATH_MAX)
-#define sleep(x) Sleep((x) * 1000)
+#define sleep(x) Sleep((x) *1000)
 #define mkdir(a, b) _mkdir(a)
 #define timegm(x) _mkgmtime(x)
 
 #ifndef S_ISDIR
-#define S_ISDIR(x) (((x) & _S_IFMT) == _S_IFDIR)
+#define S_ISDIR(x) (((x) &_S_IFMT) == _S_IFDIR)
 #endif
 
 #ifndef MG_ENABLE_DIRLIST
@@ -537,14 +499,6 @@ typedef int socklen_t;
 #define SIGPIPE 0
 #endif
 
-#ifndef MG_ENABLE_POSIX_FS
-#define MG_ENABLE_POSIX_FS 1
-#endif
-
-#ifndef MG_IO_SIZE
-#define MG_IO_SIZE 16384
-#endif
-
 #endif
 
 
@@ -595,6 +549,7 @@ int sscanf(const char *, const char *, ...);
 
 #include <FreeRTOS_IP.h>
 #include <FreeRTOS_Sockets.h>
+#include <FreeRTOS_errno_TCP.h>  // contents to be moved and file removed, some day
 
 #define MG_SOCKET_TYPE Socket_t
 #define MG_INVALID_SOCKET FREERTOS_INVALID_SOCKET
@@ -626,9 +581,6 @@ int sscanf(const char *, const char *, ...);
 
 #define sockaddr_in freertos_sockaddr
 #define sockaddr freertos_sockaddr
-#if ipFR_TCP_VERSION_MAJOR >= 4
-#define sin_addr sin_address.ulIP_IPv4
-#endif
 #define accept(a, b, c) FreeRTOS_accept((a), (b), (c))
 #define connect(a, b, c) FreeRTOS_connect((a), (b), (c))
 #define bind(a, b, c) FreeRTOS_bind((a), (b), (c))
@@ -792,7 +744,7 @@ struct timeval {
 #endif
 
 #ifndef MG_IO_SIZE
-#define MG_IO_SIZE 256  // Granularity of the send/recv IO buffer growth
+#define MG_IO_SIZE 2048  // Granularity of the send/recv IO buffer growth
 #endif
 
 #ifndef MG_MAX_RECV_SIZE
@@ -828,8 +780,12 @@ struct timeval {
 #endif
 
 #ifndef MG_ENABLE_POSIX_FS
+#if defined(FOPEN_MAX)
+#define MG_ENABLE_POSIX_FS 1
+#else
 #define MG_ENABLE_POSIX_FS 0
 #endif
+#endif
 
 #ifndef MG_INVALID_SOCKET
 #define MG_INVALID_SOCKET (-1)
@@ -905,7 +861,6 @@ struct mg_str mg_str_n(const char *s, size_t n);
 int mg_casecmp(const char *s1, const char *s2);
 int mg_strcmp(const struct mg_str str1, const struct mg_str str2);
 int mg_strcasecmp(const struct mg_str str1, const struct mg_str str2);
-struct mg_str mg_strdup(const struct mg_str s);
 bool mg_match(struct mg_str str, struct mg_str pattern, struct mg_str *caps);
 bool mg_span(struct mg_str s, struct mg_str *a, struct mg_str *b, char delim);
 
@@ -1090,12 +1045,13 @@ struct mg_str mg_unpacked(const char *path);  // Packed file as mg_str
 #endif
 
 void mg_bzero(volatile unsigned char *buf, size_t len);
-bool mg_random(void *buf, size_t len);
+void mg_random(void *buf, size_t len);
 char *mg_random_str(char *buf, size_t len);
 uint16_t mg_ntohs(uint16_t net);
 uint32_t mg_ntohl(uint32_t net);
 uint32_t mg_crc32(uint32_t crc, const char *buf, size_t len);
 uint64_t mg_millis(void);  // Return milliseconds since boot
+uint64_t mg_now(void);     // Return milliseconds since Epoch
 bool mg_path_is_sane(const struct mg_str path);
 
 #define mg_htons(x) mg_ntohs(x)
@@ -1708,111 +1664,6 @@ int mg_uecc_verify(const uint8_t *public_key, const uint8_t *message_hash,
 
 /* Copyright 2015, Kenneth MacKay. Licensed under the BSD 2-clause license. */
 
-#ifndef _UECC_TYPES_H_
-#define _UECC_TYPES_H_
-
-#ifndef MG_UECC_PLATFORM
-#if defined(__AVR__) && __AVR__
-#define MG_UECC_PLATFORM mg_uecc_avr
-#elif defined(__thumb2__) || \
-    defined(_M_ARMT) /* I think MSVC only supports Thumb-2 targets */
-#define MG_UECC_PLATFORM mg_uecc_arm_thumb2
-#elif defined(__thumb__)
-#define MG_UECC_PLATFORM mg_uecc_arm_thumb
-#elif defined(__arm__) || defined(_M_ARM)
-#define MG_UECC_PLATFORM mg_uecc_arm
-#elif defined(__aarch64__)
-#define MG_UECC_PLATFORM mg_uecc_arm64
-#elif defined(__i386__) || defined(_M_IX86) || defined(_X86_) || \
-    defined(__I86__)
-#define MG_UECC_PLATFORM mg_uecc_x86
-#elif defined(__amd64__) || defined(_M_X64)
-#define MG_UECC_PLATFORM mg_uecc_x86_64
-#else
-#define MG_UECC_PLATFORM mg_uecc_arch_other
-#endif
-#endif
-
-#ifndef MG_UECC_ARM_USE_UMAAL
-#if (MG_UECC_PLATFORM == mg_uecc_arm) && (__ARM_ARCH >= 6)
-#define MG_UECC_ARM_USE_UMAAL 1
-#elif (MG_UECC_PLATFORM == mg_uecc_arm_thumb2) && (__ARM_ARCH >= 6) && \
-    (!defined(__ARM_ARCH_7M__) || !__ARM_ARCH_7M__)
-#define MG_UECC_ARM_USE_UMAAL 1
-#else
-#define MG_UECC_ARM_USE_UMAAL 0
-#endif
-#endif
-
-#ifndef MG_UECC_WORD_SIZE
-#if MG_UECC_PLATFORM == mg_uecc_avr
-#define MG_UECC_WORD_SIZE 1
-#elif (MG_UECC_PLATFORM == mg_uecc_x86_64 || MG_UECC_PLATFORM == mg_uecc_arm64)
-#define MG_UECC_WORD_SIZE 8
-#else
-#define MG_UECC_WORD_SIZE 4
-#endif
-#endif
-
-#if (MG_UECC_WORD_SIZE != 1) && (MG_UECC_WORD_SIZE != 4) && \
-    (MG_UECC_WORD_SIZE != 8)
-#error "Unsupported value for MG_UECC_WORD_SIZE"
-#endif
-
-#if ((MG_UECC_PLATFORM == mg_uecc_avr) && (MG_UECC_WORD_SIZE != 1))
-#pragma message("MG_UECC_WORD_SIZE must be 1 for AVR")
-#undef MG_UECC_WORD_SIZE
-#define MG_UECC_WORD_SIZE 1
-#endif
-
-#if ((MG_UECC_PLATFORM == mg_uecc_arm ||         \
-      MG_UECC_PLATFORM == mg_uecc_arm_thumb ||   \
-      MG_UECC_PLATFORM == mg_uecc_arm_thumb2) && \
-     (MG_UECC_WORD_SIZE != 4))
-#pragma message("MG_UECC_WORD_SIZE must be 4 for ARM")
-#undef MG_UECC_WORD_SIZE
-#define MG_UECC_WORD_SIZE 4
-#endif
-
-typedef int8_t wordcount_t;
-typedef int16_t bitcount_t;
-typedef int8_t cmpresult_t;
-
-#if (MG_UECC_WORD_SIZE == 1)
-
-typedef uint8_t mg_uecc_word_t;
-typedef uint16_t mg_uecc_dword_t;
-
-#define HIGH_BIT_SET 0x80
-#define MG_UECC_WORD_BITS 8
-#define MG_UECC_WORD_BITS_SHIFT 3
-#define MG_UECC_WORD_BITS_MASK 0x07
-
-#elif (MG_UECC_WORD_SIZE == 4)
-
-typedef uint32_t mg_uecc_word_t;
-typedef uint64_t mg_uecc_dword_t;
-
-#define HIGH_BIT_SET 0x80000000
-#define MG_UECC_WORD_BITS 32
-#define MG_UECC_WORD_BITS_SHIFT 5
-#define MG_UECC_WORD_BITS_MASK 0x01F
-
-#elif (MG_UECC_WORD_SIZE == 8)
-
-typedef uint64_t mg_uecc_word_t;
-
-#define HIGH_BIT_SET 0x8000000000000000U
-#define MG_UECC_WORD_BITS 64
-#define MG_UECC_WORD_BITS_SHIFT 6
-#define MG_UECC_WORD_BITS_MASK 0x03F
-
-#endif /* MG_UECC_WORD_SIZE */
-
-#endif /* _UECC_TYPES_H_ */
-
-/* Copyright 2015, Kenneth MacKay. Licensed under the BSD 2-clause license. */
-
 #ifndef _UECC_VLI_H_
 #define _UECC_VLI_H_
 
@@ -1979,117 +1830,111 @@ int mg_uecc_generate_random_int(mg_uecc_word_t *random,
 
 #endif /* _UECC_VLI_H_ */
 
-// End of uecc BSD-2
-// portable8439 v1.0.1
-// Source: https://github.com/DavyLandman/portable8439
-// Licensed under CC0-1.0
-// Contains poly1305-donna e6ad6e091d30d7f4ec2d4f978be1fcfcbce72781 (Public
-// Domain)
-
-
+/* Copyright 2015, Kenneth MacKay. Licensed under the BSD 2-clause license. */
 
+#ifndef _UECC_TYPES_H_
+#define _UECC_TYPES_H_
 
-#ifndef __PORTABLE_8439_H
-#define __PORTABLE_8439_H
-#if defined(__cplusplus)
-extern "C" {
+#ifndef MG_UECC_PLATFORM
+#if defined(__AVR__) && __AVR__
+#define MG_UECC_PLATFORM mg_uecc_avr
+#elif defined(__thumb2__) || \
+    defined(_M_ARMT) /* I think MSVC only supports Thumb-2 targets */
+#define MG_UECC_PLATFORM mg_uecc_arm_thumb2
+#elif defined(__thumb__)
+#define MG_UECC_PLATFORM mg_uecc_arm_thumb
+#elif defined(__arm__) || defined(_M_ARM)
+#define MG_UECC_PLATFORM mg_uecc_arm
+#elif defined(__aarch64__)
+#define MG_UECC_PLATFORM mg_uecc_arm64
+#elif defined(__i386__) || defined(_M_IX86) || defined(_X86_) || \
+    defined(__I86__)
+#define MG_UECC_PLATFORM mg_uecc_x86
+#elif defined(__amd64__) || defined(_M_X64)
+#define MG_UECC_PLATFORM mg_uecc_x86_64
+#else
+#define MG_UECC_PLATFORM mg_uecc_arch_other
+#endif
 #endif
 
-// provide your own decl specificier like -DPORTABLE_8439_DECL=ICACHE_RAM_ATTR
-#ifndef PORTABLE_8439_DECL
-#define PORTABLE_8439_DECL
+#ifndef MG_UECC_ARM_USE_UMAAL
+#if (MG_UECC_PLATFORM == mg_uecc_arm) && (__ARM_ARCH >= 6)
+#define MG_UECC_ARM_USE_UMAAL 1
+#elif (MG_UECC_PLATFORM == mg_uecc_arm_thumb2) && (__ARM_ARCH >= 6) && \
+    (!defined(__ARM_ARCH_7M__) || !__ARM_ARCH_7M__)
+#define MG_UECC_ARM_USE_UMAAL 1
+#else
+#define MG_UECC_ARM_USE_UMAAL 0
+#endif
 #endif
 
-/*
- This library implements RFC 8439 a.k.a. ChaCha20-Poly1305 AEAD
+#ifndef MG_UECC_WORD_SIZE
+#if MG_UECC_PLATFORM == mg_uecc_avr
+#define MG_UECC_WORD_SIZE 1
+#elif (MG_UECC_PLATFORM == mg_uecc_x86_64 || MG_UECC_PLATFORM == mg_uecc_arm64)
+#define MG_UECC_WORD_SIZE 8
+#else
+#define MG_UECC_WORD_SIZE 4
+#endif
+#endif
 
- You can use this library to avoid attackers mutating or reusing your
- encrypted messages. This does assume you never reuse a nonce+key pair and,
- if possible, carefully pick your associated data.
-*/
+#if (MG_UECC_WORD_SIZE != 1) && (MG_UECC_WORD_SIZE != 4) && \
+    (MG_UECC_WORD_SIZE != 8)
+#error "Unsupported value for MG_UECC_WORD_SIZE"
+#endif
 
-/* Make sure we are either nested in C++ or running in a C99+ compiler
-#if !defined(__cplusplus) && !defined(_MSC_VER) && \
-    (!defined(__STDC_VERSION__) || __STDC_VERSION__ < 199901L)
-#error "C99 or newer required"
-#endif */
-
-// #if CHAR_BIT > 8
-// #    error "Systems without native octals not suppoted"
-// #endif
-
-#if defined(_MSC_VER) || defined(__cplusplus)
-// add restrict support is possible
-#if (defined(_MSC_VER) && _MSC_VER >= 1900) || defined(__clang__) || \
-    defined(__GNUC__)
-#define restrict __restrict
-#else
-#define restrict
+#if ((MG_UECC_PLATFORM == mg_uecc_avr) && (MG_UECC_WORD_SIZE != 1))
+#pragma message("MG_UECC_WORD_SIZE must be 1 for AVR")
+#undef MG_UECC_WORD_SIZE
+#define MG_UECC_WORD_SIZE 1
 #endif
+
+#if ((MG_UECC_PLATFORM == mg_uecc_arm ||         \
+      MG_UECC_PLATFORM == mg_uecc_arm_thumb ||   \
+      MG_UECC_PLATFORM == mg_uecc_arm_thumb2) && \
+     (MG_UECC_WORD_SIZE != 4))
+#pragma message("MG_UECC_WORD_SIZE must be 4 for ARM")
+#undef MG_UECC_WORD_SIZE
+#define MG_UECC_WORD_SIZE 4
 #endif
 
-#define RFC_8439_TAG_SIZE (16)
-#define RFC_8439_KEY_SIZE (32)
-#define RFC_8439_NONCE_SIZE (12)
+typedef int8_t wordcount_t;
+typedef int16_t bitcount_t;
+typedef int8_t cmpresult_t;
+
+#if (MG_UECC_WORD_SIZE == 1)
+
+typedef uint8_t mg_uecc_word_t;
+typedef uint16_t mg_uecc_dword_t;
+
+#define HIGH_BIT_SET 0x80
+#define MG_UECC_WORD_BITS 8
+#define MG_UECC_WORD_BITS_SHIFT 3
+#define MG_UECC_WORD_BITS_MASK 0x07
 
-/*
-    Encrypt/Seal plain text bytes into a cipher text that can only be
-    decrypted by knowing the key, nonce and associated data.
+#elif (MG_UECC_WORD_SIZE == 4)
 
-    input:
-        - key: RFC_8439_KEY_SIZE bytes that all parties have agreed
-            upon beforehand
-        - nonce: RFC_8439_NONCE_SIZE bytes that should never be repeated
-            for the same key. A counter or a pseudo-random value are fine.
-        - ad: associated data to include with calculating the tag of the
-            cipher text. Can be null for empty.
-        - plain_text: data to be encrypted, pointer + size should not overlap
-            with cipher_text pointer
+typedef uint32_t mg_uecc_word_t;
+typedef uint64_t mg_uecc_dword_t;
 
-    output:
-        - cipher_text: encrypted plain_text with a tag appended. Make sure to
-            allocate at least plain_text_size + RFC_8439_TAG_SIZE
+#define HIGH_BIT_SET 0x80000000
+#define MG_UECC_WORD_BITS 32
+#define MG_UECC_WORD_BITS_SHIFT 5
+#define MG_UECC_WORD_BITS_MASK 0x01F
 
-    returns:
-        - size of bytes written to cipher_text, can be -1 if overlapping
-            pointers are passed for plain_text and cipher_text
-*/
-PORTABLE_8439_DECL size_t mg_chacha20_poly1305_encrypt(
-    uint8_t *restrict cipher_text, const uint8_t key[RFC_8439_KEY_SIZE],
-    const uint8_t nonce[RFC_8439_NONCE_SIZE], const uint8_t *restrict ad,
-    size_t ad_size, const uint8_t *restrict plain_text, size_t plain_text_size);
-
-/*
-    Decrypt/unseal cipher text given the right key, nonce, and additional data.
-
-    input:
-        - key: RFC_8439_KEY_SIZE bytes that all parties have agreed
-            upon beforehand
-        - nonce: RFC_8439_NONCE_SIZE bytes that should never be repeated for
-            the same key. A counter or a pseudo-random value are fine.
-        - ad: associated data to include with calculating the tag of the
-            cipher text. Can be null for empty.
-        - cipher_text: encrypted message.
-
-    output:
-        - plain_text: data to be encrypted, pointer + size should not overlap
-            with cipher_text pointer, leave at least enough room for
-            cipher_text_size - RFC_8439_TAG_SIZE
-
-    returns:
-        - size of bytes written to plain_text, -1 signals either:
-            - incorrect key/nonce/ad
-            - corrupted cipher_text
-            - overlapping pointers are passed for plain_text and cipher_text
-*/
-PORTABLE_8439_DECL size_t mg_chacha20_poly1305_decrypt(
-    uint8_t *restrict plain_text, const uint8_t key[RFC_8439_KEY_SIZE],
-    const uint8_t nonce[RFC_8439_NONCE_SIZE],
-    const uint8_t *restrict cipher_text, size_t cipher_text_size);
-#if defined(__cplusplus)
-}
-#endif
-#endif
+#elif (MG_UECC_WORD_SIZE == 8)
+
+typedef uint64_t mg_uecc_word_t;
+
+#define HIGH_BIT_SET 0x8000000000000000U
+#define MG_UECC_WORD_BITS 64
+#define MG_UECC_WORD_BITS_SHIFT 6
+#define MG_UECC_WORD_BITS_MASK 0x03F
+
+#endif /* MG_UECC_WORD_SIZE */
+
+#endif /* _UECC_TYPES_H_ */
+// End of uecc BSD-2
 
 
 struct mg_connection;
@@ -2201,7 +2046,6 @@ struct mg_connection {
   unsigned is_resp : 1;        // Response is still being generated
   unsigned is_readable : 1;    // Connection is ready to read
   unsigned is_writable : 1;    // Connection is ready to write
-  unsigned is_io_err : 1;      // Remember IO_ERR condition for later use
 };
 
 void mg_mgr_poll(struct mg_mgr *, int ms);
@@ -2419,8 +2263,6 @@ struct mg_connection *mg_sntp_connect(struct mg_mgr *mgr, const char *url,
 void mg_sntp_request(struct mg_connection *c);
 int64_t mg_sntp_parse(const unsigned char *buf, size_t len);
 
-uint64_t mg_now(void);     // Return milliseconds since Epoch
-
 
 
 
@@ -2719,7 +2561,6 @@ void mg_device_reset(void);  // Reboot device immediately
 
 #if defined(MG_ENABLE_TCPIP) && MG_ENABLE_TCPIP
 struct mg_tcpip_if;  // Mongoose TCP/IP network interface
-#define MG_TCPIP_IFACE(mgr_) ((struct mg_tcpip_if *) (mgr_)->priv)
 
 struct mg_tcpip_driver {
   bool (*init)(struct mg_tcpip_if *);                         // Init driver
@@ -2728,16 +2569,6 @@ struct mg_tcpip_driver {
   bool (*up)(struct mg_tcpip_if *);                           // Up/down status
 };
 
-typedef void (*mg_tcpip_event_handler_t)(struct mg_tcpip_if *ifp, int ev,
-                                         void *ev_data);
-
-enum {
-  MG_TCPIP_EV_ST_CHG,     // state change             uint8_t * (&ifp->state)
-  MG_TCPIP_EV_DHCP_DNS,   // DHCP DNS assignment      uint32_t *ipaddr
-  MG_TCPIP_EV_DHCP_SNTP,  // DHCP SNTP assignment     uint32_t *ipaddr
-  MG_TCPIP_EV_USER        // Starting ID for user events
-};
-
 // Network interface
 struct mg_tcpip_if {
   uint8_t mac[6];                  // MAC address. Must be set to a valid MAC
@@ -2746,13 +2577,10 @@ struct mg_tcpip_if {
   bool enable_dhcp_client;         // Enable DCHP client
   bool enable_dhcp_server;         // Enable DCHP server
   bool enable_get_gateway;         // DCHP server sets client as gateway
-  bool enable_req_dns;             // DCHP client requests DNS server
-  bool enable_req_sntp;            // DCHP client requests SNTP server
   bool enable_crc32_check;         // Do a CRC check on RX frames and strip it
   bool enable_mac_check;           // Do a MAC check on RX frames
   struct mg_tcpip_driver *driver;  // Low level driver
   void *driver_data;               // Driver-specific data
-  mg_tcpip_event_handler_t fn;     // User-specified event handler function
   struct mg_mgr *mgr;              // Mongoose event manager
   struct mg_queue recv_queue;      // Receive queue
   uint16_t mtu;                    // Interface MTU
@@ -2937,10 +2765,10 @@ struct mg_phy {
 
 // PHY configuration settings, bitmask
 enum {
-  // Set if PHY LEDs are connected to ground
-  MG_PHY_LEDS_ACTIVE_HIGH = (1 << 0),
-  // Set when PHY clocks MAC. Otherwise, MAC clocks PHY
-  MG_PHY_CLOCKS_MAC = (1 << 1),
+  MG_PHY_LEDS_ACTIVE_HIGH =
+      (1 << 0),  // Set if PHY LEDs are connected to ground
+  MG_PHY_CLOCKS_MAC =
+      (1 << 1)   // Set when PHY clocks MAC. Otherwise, MAC clocks PHY
 };
 
 enum { MG_PHY_SPEED_10M, MG_PHY_SPEED_100M, MG_PHY_SPEED_1000M };
@@ -3022,14 +2850,8 @@ struct mg_tcpip_driver_stm32f_data {
 #endif
 
 
-#if MG_ENABLE_TCPIP
-#if !defined(MG_ENABLE_DRIVER_STM32H)
-#define MG_ENABLE_DRIVER_STM32H 0
-#endif
-#if !defined(MG_ENABLE_DRIVER_MCXN)
-#define MG_ENABLE_DRIVER_MCXN 0
-#endif
-#if MG_ENABLE_DRIVER_STM32H || MG_ENABLE_DRIVER_MCXN
+#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_STM32H) && \
+    MG_ENABLE_DRIVER_STM32H
 
 struct mg_tcpip_driver_stm32h_data {
   // MDC clock divider. MDC clock is derived from HCLK, must not exceed 2.5MHz
@@ -3042,18 +2864,13 @@ struct mg_tcpip_driver_stm32h_data {
   //    35-60 MHz     HCLK/26        3
   //    150-250 MHz   HCLK/102       4  <-- value for max speed HSI
   //    250-300 MHz   HCLK/124       5  <-- value for Nucleo-H* on CSI
-  //    300-500 MHz   HCLK/204       6
-  //    500-800 MHz   HCLK/324       7
+  //    110, 111 Reserved
   int mdc_cr;  // Valid values: -1, 0, 1, 2, 3, 4, 5
 
   uint8_t phy_addr;  // PHY address
   uint8_t phy_conf;  // PHY config
 };
 
-#ifndef MG_TCPIP_PHY_CONF
-#define MG_TCPIP_PHY_CONF MG_PHY_CLOCKS_MAC
-#endif
-
 #ifndef MG_TCPIP_PHY_ADDR
 #define MG_TCPIP_PHY_ADDR 0
 #endif
@@ -3068,7 +2885,6 @@ struct mg_tcpip_driver_stm32h_data {
     static struct mg_tcpip_if mif_;                               \
     driver_data_.mdc_cr = MG_DRIVER_MDC_CR;                       \
     driver_data_.phy_addr = MG_TCPIP_PHY_ADDR;                    \
-    driver_data_.phy_conf = MG_TCPIP_PHY_CONF;                    \
     mif_.ip = MG_TCPIP_IP;                                        \
     mif_.mask = MG_TCPIP_MASK;                                    \
     mif_.gw = MG_TCPIP_GW;                                        \
@@ -3080,7 +2896,6 @@ struct mg_tcpip_driver_stm32h_data {
   } while (0)
 
 #endif
-#endif
 
 
 #if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_TM4C) && MG_ENABLE_DRIVER_TM4C
@@ -3102,40 +2917,20 @@ struct mg_tcpip_driver_tm4c_data {
 #define MG_DRIVER_MDC_CR 1
 #endif
 
-#define MG_TCPIP_DRIVER_INIT(mgr)                               \
-  do {                                                          \
-    static struct mg_tcpip_driver_tm4c_data driver_data_;       \
-    static struct mg_tcpip_if mif_;                             \
-    driver_data_.mdc_cr = MG_DRIVER_MDC_CR;                     \
-    mif_.ip = MG_TCPIP_IP;                                      \
-    mif_.mask = MG_TCPIP_MASK;                                  \
-    mif_.gw = MG_TCPIP_GW;                                      \
-    mif_.driver = &mg_tcpip_driver_tm4c;                        \
-    mif_.driver_data = &driver_data_;                           \
-    MG_SET_MAC_ADDRESS(mif_.mac);                               \
-    mg_tcpip_init(mgr, &mif_);                                  \
-    MG_INFO(("Driver: tm4c, MAC: %M", mg_print_mac, mif_.mac)); \
-  } while (0)
+#endif
+
+
+#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_W5500) && MG_ENABLE_DRIVER_W5500
+
+#undef MG_ENABLE_TCPIP_DRIVER_INIT
+#define MG_ENABLE_TCPIP_DRIVER_INIT 0
 
 #endif
 
 
-#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_XMC) && MG_ENABLE_DRIVER_XMC
+#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_XMC7) && MG_ENABLE_DRIVER_XMC7
 
-struct mg_tcpip_driver_xmc_data {
-  // 13.2.8.1 Station Management Functions
-  // MDC clock divider (). MDC clock is derived from ETH MAC clock
-  // It must not exceed 2.5MHz
-  // ETH Clock range  DIVIDER       mdc_cr VALUE
-  // --------------------------------------------
-  //                                     -1  <-- tell driver to guess the value
-  // 60-100 MHz       ETH Clock/42        0
-  // 100-150 MHz      ETH Clock/62        1
-  // 20-35 MHz        ETH Clock/16        2
-  // 35-60 MHz        ETH Clock/26        3
-  // 150-250 MHz      ETH Clock/102       4
-  // 250-300 MHz      ETH Clock/124       5
-  // 110, 111 Reserved
+struct mg_tcpip_driver_xmc7_data {
   int mdc_cr;  // Valid values: -1, 0, 1, 2, 3, 4, 5
   uint8_t phy_addr;
 };
@@ -3145,31 +2940,45 @@ struct mg_tcpip_driver_xmc_data {
 #endif
 
 #ifndef MG_DRIVER_MDC_CR
-#define MG_DRIVER_MDC_CR 4
+#define MG_DRIVER_MDC_CR 3
 #endif
 
 #define MG_TCPIP_DRIVER_INIT(mgr)                                 \
   do {                                                            \
-    static struct mg_tcpip_driver_xmc_data driver_data_;       \
+    static struct mg_tcpip_driver_xmc7_data driver_data_;       \
     static struct mg_tcpip_if mif_;                               \
     driver_data_.mdc_cr = MG_DRIVER_MDC_CR;                       \
     driver_data_.phy_addr = MG_TCPIP_PHY_ADDR;                    \
     mif_.ip = MG_TCPIP_IP;                                        \
     mif_.mask = MG_TCPIP_MASK;                                    \
     mif_.gw = MG_TCPIP_GW;                                        \
-    mif_.driver = &mg_tcpip_driver_xmc;                        \
+    mif_.driver = &mg_tcpip_driver_xmc7;                        \
     mif_.driver_data = &driver_data_;                             \
     MG_SET_MAC_ADDRESS(mif_.mac);                                 \
     mg_tcpip_init(mgr, &mif_);                                    \
-    MG_INFO(("Driver: xmc, MAC: %M", mg_print_mac, mif_.mac)); \
+    MG_INFO(("Driver: xmc7, MAC: %M", mg_print_mac, mif_.mac)); \
   } while (0)
 
 #endif
 
 
-#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_XMC7) && MG_ENABLE_DRIVER_XMC7
 
-struct mg_tcpip_driver_xmc7_data {
+#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_XMC) && MG_ENABLE_DRIVER_XMC
+
+struct mg_tcpip_driver_xmc_data {
+  // 13.2.8.1 Station Management Functions
+  // MDC clock divider (). MDC clock is derived from ETH MAC clock
+  // It must not exceed 2.5MHz
+  // ETH Clock range  DIVIDER       mdc_cr VALUE
+  // --------------------------------------------
+  //                                     -1  <-- tell driver to guess the value
+  // 60-100 MHz       ETH Clock/42        0
+  // 100-150 MHz      ETH Clock/62        1
+  // 20-35 MHz        ETH Clock/16        2
+  // 35-60 MHz        ETH Clock/26        3
+  // 150-250 MHz      ETH Clock/102       4
+  // 250-300 MHz      ETH Clock/124       5
+  // 110, 111 Reserved
   int mdc_cr;  // Valid values: -1, 0, 1, 2, 3, 4, 5
   uint8_t phy_addr;
 };
@@ -3179,28 +2988,27 @@ struct mg_tcpip_driver_xmc7_data {
 #endif
 
 #ifndef MG_DRIVER_MDC_CR
-#define MG_DRIVER_MDC_CR 3
+#define MG_DRIVER_MDC_CR 4
 #endif
 
 #define MG_TCPIP_DRIVER_INIT(mgr)                                 \
   do {                                                            \
-    static struct mg_tcpip_driver_xmc7_data driver_data_;       \
+    static struct mg_tcpip_driver_xmc_data driver_data_;       \
     static struct mg_tcpip_if mif_;                               \
     driver_data_.mdc_cr = MG_DRIVER_MDC_CR;                       \
     driver_data_.phy_addr = MG_TCPIP_PHY_ADDR;                    \
     mif_.ip = MG_TCPIP_IP;                                        \
     mif_.mask = MG_TCPIP_MASK;                                    \
     mif_.gw = MG_TCPIP_GW;                                        \
-    mif_.driver = &mg_tcpip_driver_xmc7;                        \
+    mif_.driver = &mg_tcpip_driver_xmc;                        \
     mif_.driver_data = &driver_data_;                             \
     MG_SET_MAC_ADDRESS(mif_.mac);                                 \
     mg_tcpip_init(mgr, &mif_);                                    \
-    MG_INFO(("Driver: xmc7, MAC: %M", mg_print_mac, mif_.mac)); \
+    MG_INFO(("Driver: xmc, MAC: %M", mg_print_mac, mif_.mac)); \
   } while (0)
 
 #endif
 
-
 #ifdef __cplusplus
 }
 #endif