diff --git a/ChangeLog b/ChangeLog
index 46ef674..fe1ce5c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,25 @@
 mbed TLS ChangeLog (Sorted per branch, date)
 
+= PolarSSL 2.0 branch
+
+Features
+  * Support for DTLS 1.0 and 1.2 (RFC 6347).
+
+API Changes
+   * Headers are now found in the 'mbedtls' directory (previously 'polarssl').
+   * Change SSL_DISABLE_RENEGOTIATION config.h flag to SSL_RENEGOTIATION
+     (support for renegotiation now needs explicit enabling in config.h).
+   * Remove compat-1.2.h (helper for migrating from 1.2 to 1.3).
+   * Remove openssl.h (very partial OpenSSL compatibility layer).
+   * net_connect() and net_bind() have a new 'proto' argument to choose
+     between TCP and UDP, using the macros NET_PROTO_TCP or NET_PROTO_UDP.
+   * ssl_set_bio() now requires that p_send == p_recv.
+   * ssl_set_bio() is deprecated in favor of ssl_set_bio_timeout().
+
+Changes
+   * Support for receiving SSLv2 ClientHello is now disabled by default at
+     compile time.
+
 = mbed TLS 1.3 branch
 
 Security
diff --git a/Makefile b/Makefile
index 808290d..e570271 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,6 @@
 
 DESTDIR=/usr/local
 PREFIX=mbedtls_
-OLDPREFIX=polarssl_
 
 .SILENT:
 
@@ -18,33 +17,30 @@
 	cd library  && $(MAKE) all && cd ..
 
 install:
-	mkdir -p $(DESTDIR)/include/polarssl
-	cp -r include/polarssl $(DESTDIR)/include
+	mkdir -p $(DESTDIR)/include/mbedtls
+	cp -r include/mbedtls $(DESTDIR)/include
 	
 	mkdir -p $(DESTDIR)/lib
-	cp library/libpolarssl.* library/libmbedtls.* $(DESTDIR)/lib
+	cp library/libmbedtls.* $(DESTDIR)/lib
 	
 	mkdir -p $(DESTDIR)/bin
 	for p in programs/*/* ; do              \
 	    if [ -x $$p ] && [ ! -d $$p ] ;     \
 	    then                                \
 	        f=$(PREFIX)`basename $$p` ;     \
-	        o=$(OLDPREFIX)`basename $$p` ;  \
 	        cp $$p $(DESTDIR)/bin/$$f ;     \
 	        ln -sf $$f $(DESTDIR)/bin/$$o ; \
 	    fi                                  \
 	done
 
 uninstall:
-	rm -rf $(DESTDIR)/include/polarssl
-	rm -f $(DESTDIR)/lib/libpolarssl.*
+	rm -rf $(DESTDIR)/include/mbedtls
 	rm -f $(DESTDIR)/lib/libmbedtls.*
 	
 	for p in programs/*/* ; do              \
 	    if [ -x $$p ] && [ ! -d $$p ] ;     \
 	    then                                \
 	        f=$(PREFIX)`basename $$p` ;     \
-	        o=$(OLDPREFIX)`basename $$p` ;  \
 	        rm -f $(DESTDIR)/bin/$$f ;      \
 	        rm -f $(DESTDIR)/bin/$$o ;      \
 	    fi                                  \
diff --git a/README.rst b/README.rst
index 03aec31..3ef1b0b 100644
--- a/README.rst
+++ b/README.rst
@@ -5,7 +5,7 @@
 Configuration
 =============
 
-mbed TLS should build out of the box on most systems. Some platform specific options are available in the fully-documented configuration file *include/polarssl/config.h*, which is also the place where features can be selected.
+mbed TLS should build out of the box on most systems. Some platform specific options are available in the fully-documented configuration file *include/mbedtls/config.h*, which is also the place where features can be selected.
 This file can be edited manually, or in a more programmatic way using the Perl
 script *scripts/config.pl* (use *--help* for usage instructions).
 
@@ -93,7 +93,7 @@
 
 The build files for Microsoft Visual Studio are generated for Visual Studio 6.0 and Visual Studio 2010.
 
-The workspace 'polarssl.dsw' contains all the basic projects needed to build the library and all the programs. The files in tests are not generated and compiled, as these need a perl environment as well.
+The workspace 'mbedtls.dsw' contains all the basic projects needed to build the library and all the programs. The files in tests are not generated and compiled, as these need a perl environment as well.
 
 Example programs
 ================
diff --git a/configs/README.txt b/configs/README.txt
index 4a0074c..6be64a2 100644
--- a/configs/README.txt
+++ b/configs/README.txt
@@ -7,9 +7,9 @@
 These files are complete replacements for the default config.h. To use one of
 them, you can pick one of the following methods:
 
-1. Replace the default file include/polarssl/config.h with the chosen one.
+1. Replace the default file include/mbedtls/config.h with the chosen one.
    (Depending on your compiler, you may need to ajust the line with
-   #include "polarssl/check_config.h" then.)
+   #include "mbedtls/check_config.h" then.)
 
 2. Define POLARSSL_CONFIG_FILE and adjust the include path accordingly.
    For example, using make:
diff --git a/configs/config-ccm-psk-tls1_2.h b/configs/config-ccm-psk-tls1_2.h
index 776179d..7a6e70d 100644
--- a/configs/config-ccm-psk-tls1_2.h
+++ b/configs/config-ccm-psk-tls1_2.h
@@ -19,7 +19,6 @@
 /* mbed TLS feature support */
 #define POLARSSL_KEY_EXCHANGE_PSK_ENABLED
 #define POLARSSL_SSL_PROTO_TLS1_2
-#define POLARSSL_SSL_DISABLE_RENEGOTIATION
 
 /* mbed TLS modules */
 #define POLARSSL_AES_C
@@ -57,7 +56,7 @@
 
 /*
  * Save RAM at the expense of interoperability: do this only if you control
- * both ends of the connection!  (See comments in "polarssl/ssl.h".)
+ * both ends of the connection!  (See comments in "mbedtls/ssl.h".)
  * The optimal size here depends on the typical size of records.
  */
 #define SSL_MAX_CONTENT_LEN             512
diff --git a/configs/config-mini-tls1_1.h b/configs/config-mini-tls1_1.h
index 3bd1b1f..dc9ee0f 100644
--- a/configs/config-mini-tls1_1.h
+++ b/configs/config-mini-tls1_1.h
@@ -18,7 +18,6 @@
 #define POLARSSL_PKCS1_V15
 #define POLARSSL_KEY_EXCHANGE_RSA_ENABLED
 #define POLARSSL_SSL_PROTO_TLS1_1
-#define POLARSSL_SSL_DISABLE_RENEGOTIATION
 
 /* mbed TLS modules */
 #define POLARSSL_AES_C
@@ -52,6 +51,6 @@
 /* For testing with compat.sh */
 #define POLARSSL_FS_IO
 
-#include "polarssl/check_config.h"
+#include "mbedtls/check_config.h"
 
 #endif /* POLARSSL_CONFIG_H */
diff --git a/configs/config-psk-rc4-tls1_0.h b/configs/config-psk-rc4-tls1_0.h
index b8113ea..b498ae4 100644
--- a/configs/config-psk-rc4-tls1_0.h
+++ b/configs/config-psk-rc4-tls1_0.h
@@ -19,7 +19,6 @@
 /* mbed TLS feature support */
 #define POLARSSL_KEY_EXCHANGE_PSK_ENABLED
 #define POLARSSL_SSL_PROTO_TLS1
-#define POLARSSL_SSL_DISABLE_RENEGOTIATION
 
 /* mbed TLS modules */
 #define POLARSSL_AES_C
@@ -36,6 +35,6 @@
 #define POLARSSL_SSL_SRV_C
 #define POLARSSL_SSL_TLS_C
 
-#include "polarssl/check_config.h"
+#include "mbedtls/check_config.h"
 
 #endif /* POLARSSL_CONFIG_H */
diff --git a/configs/config-suite-b.h b/configs/config-suite-b.h
index 3e8f153..b565653 100644
--- a/configs/config-suite-b.h
+++ b/configs/config-suite-b.h
@@ -25,7 +25,6 @@
 #define POLARSSL_ECP_DP_SECP384R1_ENABLED
 #define POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
 #define POLARSSL_SSL_PROTO_TLS1_2
-#define POLARSSL_SSL_DISABLE_RENEGOTIATION
 
 /* mbed TLS modules */
 #define POLARSSL_AES_C
@@ -85,12 +84,12 @@
 
 /*
  * Save RAM at the expense of interoperability: do this only if you control
- * both ends of the connection!  (See coments in "polarssl/ssl.h".)
+ * both ends of the connection!  (See coments in "mbedtls/ssl.h".)
  * The minimum size here depends on the certificate chain used as well as the
  * typical size of records.
  */
 #define SSL_MAX_CONTENT_LEN             1024
 
-#include "polarssl/check_config.h"
+#include "mbedtls/check_config.h"
 
 #endif /* POLARSSL_CONFIG_H */
diff --git a/doxygen/input/doc_mainpage.h b/doxygen/input/doc_mainpage.h
index b41e36e..578567b 100644
--- a/doxygen/input/doc_mainpage.h
+++ b/doxygen/input/doc_mainpage.h
@@ -4,7 +4,7 @@
  */
 
 /**
- * @mainpage mbed TLS v1.3.10 source code documentation
+ * @mainpage mbed TLS v1.4.0 source code documentation
  *
  * This documentation describes the internal structure of mbed TLS.  It was
  * automatically generated from specially formatted comment blocks in
diff --git a/doxygen/mbedtls.doxyfile b/doxygen/mbedtls.doxyfile
index 49c81c3..2d9f66f 100644
--- a/doxygen/mbedtls.doxyfile
+++ b/doxygen/mbedtls.doxyfile
@@ -28,7 +28,7 @@
 # identify the project. Note that if you do not use Doxywizard you need
 # to put quotes around the project name if it contains spaces.
 
-PROJECT_NAME           = "mbed TLS v1.3.10"
+PROJECT_NAME           = "mbed TLS v1.4.0"
 
 # The PROJECT_NUMBER tag can be used to enter a project or revision number.
 # This could be handy for archiving the generated documentation or
diff --git a/include/.gitignore b/include/.gitignore
index 53a36d4..bf67d02 100644
--- a/include/.gitignore
+++ b/include/.gitignore
@@ -1,4 +1,4 @@
 Makefile
 *.sln
 *.vcxproj
-polarssl/check_config
+mbedtls/check_config
diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
index 2c56858..ce0ed6b 100644
--- a/include/CMakeLists.txt
+++ b/include/CMakeLists.txt
@@ -2,10 +2,10 @@
 
 if(INSTALL_MBEDTLS_HEADERS)
 
-file(GLOB headers "polarssl/*.h")
+file(GLOB headers "mbedtls/*.h")
 
 install(FILES ${headers}
-        DESTINATION include/polarssl
+        DESTINATION include/mbedtls
         PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
 
 endif(INSTALL_MBEDTLS_HEADERS)
diff --git a/include/polarssl/aes.h b/include/mbedtls/aes.h
similarity index 100%
rename from include/polarssl/aes.h
rename to include/mbedtls/aes.h
diff --git a/include/polarssl/aesni.h b/include/mbedtls/aesni.h
similarity index 100%
rename from include/polarssl/aesni.h
rename to include/mbedtls/aesni.h
diff --git a/include/polarssl/arc4.h b/include/mbedtls/arc4.h
similarity index 100%
rename from include/polarssl/arc4.h
rename to include/mbedtls/arc4.h
diff --git a/include/polarssl/asn1.h b/include/mbedtls/asn1.h
similarity index 100%
rename from include/polarssl/asn1.h
rename to include/mbedtls/asn1.h
diff --git a/include/polarssl/asn1write.h b/include/mbedtls/asn1write.h
similarity index 100%
rename from include/polarssl/asn1write.h
rename to include/mbedtls/asn1write.h
diff --git a/include/polarssl/base64.h b/include/mbedtls/base64.h
similarity index 100%
rename from include/polarssl/base64.h
rename to include/mbedtls/base64.h
diff --git a/include/polarssl/bignum.h b/include/mbedtls/bignum.h
similarity index 100%
rename from include/polarssl/bignum.h
rename to include/mbedtls/bignum.h
diff --git a/include/polarssl/blowfish.h b/include/mbedtls/blowfish.h
similarity index 100%
rename from include/polarssl/blowfish.h
rename to include/mbedtls/blowfish.h
diff --git a/include/polarssl/bn_mul.h b/include/mbedtls/bn_mul.h
similarity index 100%
rename from include/polarssl/bn_mul.h
rename to include/mbedtls/bn_mul.h
diff --git a/include/polarssl/camellia.h b/include/mbedtls/camellia.h
similarity index 100%
rename from include/polarssl/camellia.h
rename to include/mbedtls/camellia.h
diff --git a/include/polarssl/ccm.h b/include/mbedtls/ccm.h
similarity index 99%
rename from include/polarssl/ccm.h
rename to include/mbedtls/ccm.h
index f1f24bd..070b39d 100644
--- a/include/polarssl/ccm.h
+++ b/include/mbedtls/ccm.h
@@ -128,4 +128,4 @@
 }
 #endif
 
-#endif /* POLARSSL_CGM_H */
+#endif /* POLARSSL_CCM_H */
diff --git a/include/polarssl/certs.h b/include/mbedtls/certs.h
similarity index 97%
rename from include/polarssl/certs.h
rename to include/mbedtls/certs.h
index d221660..7b00a8b 100644
--- a/include/polarssl/certs.h
+++ b/include/mbedtls/certs.h
@@ -33,7 +33,7 @@
 
 /*
  * Convenience for users who just want a certificate:
- * RSA by default, or ECDSA if RSA i not available
+ * RSA by default, or ECDSA if RSA is not available
  */
 extern const char *test_ca_crt;
 extern const char *test_ca_key;
diff --git a/include/polarssl/check_config.h b/include/mbedtls/check_config.h
similarity index 93%
rename from include/polarssl/check_config.h
rename to include/mbedtls/check_config.h
index 1062434..5369d88 100644
--- a/include/polarssl/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -103,7 +103,7 @@
 #error "POLARSSL_HAVEGE_C defined, but not all prerequisites"
 #endif
 
-#if defined(POLARSSL_HMAC_DRBG) && !defined(POLARSSL_MD_C)
+#if defined(POLARSSL_HMAC_DRBG_C) && !defined(POLARSSL_MD_C)
 #error "POLARSSL_HMAC_DRBG_C defined, but not all prerequisites"
 #endif
 
@@ -358,6 +358,13 @@
 #error "POLARSSL_SSL_PROTO_TLS1_2 defined, but not all prerequisites"
 #endif
 
+#if defined(POLARSSL_SSL_PROTO_DTLS) && (       \
+    ( !defined(POLARSSL_SSL_PROTO_TLS1_1) &&      \
+      !defined(POLARSSL_SSL_PROTO_TLS1_2) ) ||    \
+    !defined(POLARSSL_TIMING_C) )
+#error "POLARSSL_SSL_PROTO_DTLS defined, but not all prerequisites"
+#endif
+
 #if defined(POLARSSL_SSL_CLI_C) && !defined(POLARSSL_SSL_TLS_C)
 #error "POLARSSL_SSL_CLI_C defined, but not all prerequisites"
 #endif
@@ -393,6 +400,25 @@
 #error "Illegal protocol selection"
 #endif
 
+#if defined(POLARSSL_SSL_COOKIE_C) && !defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+#error "POLARSSL_SSL_COOKIE_C  defined, but not all prerequisites"
+#endif
+
+#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY) &&                              \
+    ( !defined(POLARSSL_SSL_SRV_C) || !defined(POLARSSL_SSL_PROTO_DTLS) )
+#error "POLARSSL_SSL_DTLS_HELLO_VERIFY  defined, but not all prerequisites"
+#endif
+
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY) &&                              \
+    ( !defined(POLARSSL_SSL_TLS_C) || !defined(POLARSSL_SSL_PROTO_DTLS) )
+#error "POLARSSL_SSL_DTLS_ANTI_REPLAY  defined, but not all prerequisites"
+#endif
+
+#if defined(POLARSSL_SSL_DTLS_BADMAC_LIMIT) &&                              \
+    ( !defined(POLARSSL_SSL_TLS_C) || !defined(POLARSSL_SSL_PROTO_DTLS) )
+#error "POLARSSL_SSL_DTLS_BADMAC_LIMIT  defined, but not all prerequisites"
+#endif
+
 #if defined(POLARSSL_SSL_ENCRYPT_THEN_MAC) &&   \
     !defined(POLARSSL_SSL_PROTO_TLS1)   &&      \
     !defined(POLARSSL_SSL_PROTO_TLS1_1) &&      \
@@ -410,7 +436,7 @@
 #if defined(POLARSSL_SSL_SESSION_TICKETS) && defined(POLARSSL_SSL_TLS_C) && \
     ( !defined(POLARSSL_AES_C) || !defined(POLARSSL_SHA256_C) ||            \
       !defined(POLARSSL_CIPHER_MODE_CBC) )
-#error "POLARSSL_SSL_SESSION_TICKETS_C defined, but not all prerequisites"
+#error "POLARSSL_SSL_SESSION_TICKETS defined, but not all prerequisites"
 #endif
 
 #if defined(POLARSSL_SSL_CBC_RECORD_SPLITTING) && \
diff --git a/include/polarssl/cipher.h b/include/mbedtls/cipher.h
similarity index 100%
rename from include/polarssl/cipher.h
rename to include/mbedtls/cipher.h
diff --git a/include/polarssl/cipher_wrap.h b/include/mbedtls/cipher_wrap.h
similarity index 100%
rename from include/polarssl/cipher_wrap.h
rename to include/mbedtls/cipher_wrap.h
diff --git a/include/polarssl/config.h b/include/mbedtls/config.h
similarity index 95%
rename from include/polarssl/config.h
rename to include/mbedtls/config.h
index 7f93140..dbb1218 100644
--- a/include/polarssl/config.h
+++ b/include/mbedtls/config.h
@@ -75,7 +75,7 @@
  * Used in:
  *      library/timing.c
  *      library/padlock.c
- *      include/polarssl/bn_mul.h
+ *      include/mbedtls/bn_mul.h
  *
  * Comment to disable the use of assembly code.
  */
@@ -817,7 +817,7 @@
  *
  * Enable sending of all alert messages
  */
-#define POLARSSL_SSL_ALERT_MESSAGES
+#define POLARSSL_SSL_ALL_ALERT_MESSAGES
 
 /**
  * \def POLARSSL_SSL_DEBUG_ALL
@@ -911,7 +911,7 @@
 #define POLARSSL_SSL_CBC_RECORD_SPLITTING
 
 /**
- * \def POLARSSL_SSL_DISABLE_RENEGOTIATION
+ * \def POLARSSL_SSL_RENEGOTIATION
  *
  * Disable support for TLS renegotiation.
  *
@@ -921,12 +921,9 @@
  * it has been associated with security issues in the past and is easy to
  * misuse/misunderstand.
  *
- * Warning: in the next stable branch, this switch will be replaced by
- * POLARSSL_SSL_RENEGOTIATION to enable support for renegotiation.
- *
- * Uncomment this to disable support for renegotiation.
+ * Comment this to disable support for renegotiation.
  */
-//#define POLARSSL_SSL_DISABLE_RENEGOTIATION
+#define POLARSSL_SSL_RENEGOTIATION
 
 /**
  * \def POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
@@ -934,9 +931,9 @@
  * Enable support for receiving and parsing SSLv2 Client Hello messages for the
  * SSL Server module (POLARSSL_SSL_SRV_C).
  *
- * Comment this macro to disable support for SSLv2 Client Hello messages.
+ * Uncomment this macro to enable support for SSLv2 Client Hello messages.
  */
-#define POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
+//#define POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
 
 /**
  * \def POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE
@@ -984,28 +981,48 @@
 /**
  * \def POLARSSL_SSL_PROTO_TLS1_1
  *
- * Enable support for TLS 1.1.
+ * Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled).
  *
  * Requires: POLARSSL_MD5_C
  *           POLARSSL_SHA1_C
  *
- * Comment this macro to disable support for TLS 1.1
+ * Comment this macro to disable support for TLS 1.1 / DTLS 1.0
  */
 #define POLARSSL_SSL_PROTO_TLS1_1
 
 /**
  * \def POLARSSL_SSL_PROTO_TLS1_2
  *
- * Enable support for TLS 1.2.
+ * Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled).
  *
  * Requires: POLARSSL_SHA1_C or POLARSSL_SHA256_C or POLARSSL_SHA512_C
  *           (Depends on ciphersuites)
  *
- * Comment this macro to disable support for TLS 1.2
+ * Comment this macro to disable support for TLS 1.2 / DTLS 1.2
  */
 #define POLARSSL_SSL_PROTO_TLS1_2
 
 /**
+ * \def POLARSSL_SSL_PROTO_DTLS
+ *
+ * Enable support for DTLS (all available versions).
+ *
+ * Enable this and POLARSSL_SSL_PROTO_TLS1_1 to enable DTLS 1.0,
+ * and/or this and POLARSSL_SSL_PROTO_TLS1_2 to enable DTLS 1.2.
+ *
+ * Requires: POLARSSL_SSL_PROTO_TLS1_1
+ *        or POLARSSL_SSL_PROTO_TLS1_2
+ *           POLARSSL_TIMING_C
+ *
+ * \note Dependency on TIMING_C may be replaced by something more flexible
+ * (callbacks or abstraction layer in the next major version). Please contact
+ * us if you're having issues with this dependency.
+ *
+ * Comment this macro to disable support for DTLS
+ */
+#define POLARSSL_SSL_PROTO_DTLS
+
+/**
  * \def POLARSSL_SSL_ALPN
  *
  * Enable support for RFC 7301 Application Layer Protocol Negotiation.
@@ -1015,6 +1032,51 @@
 #define POLARSSL_SSL_ALPN
 
 /**
+ * \def POLARSSL_SSL_DTLS_ANTI_REPLAY
+ *
+ * Enable support for the anti-replay mechanism in DTLS.
+ *
+ * Requires: POLARSSL_SSL_TLS_C
+ *           POLARSSL_SSL_PROTO_DTLS
+ *
+ * \warning Disabling this is often a security risk!
+ * See ssl_set_dtls_anti_replay() for details.
+ *
+ * Comment this to disable anti-replay in DTLS.
+ */
+#define POLARSSL_SSL_DTLS_ANTI_REPLAY
+
+/**
+ * \def POLARSSL_SSL_DTLS_HELLO_VERIFY
+ *
+ * Enable support for HelloVerifyRequest on DTLS servers.
+ *
+ * This feature is highly recommended to prevent DTLS servers being used as
+ * amplifiers in DoS attacks against other hosts. It should always be enabled
+ * unless you know for sure amplification cannot be a problem in the
+ * environment in which your server operates.
+ *
+ * \warning Disabling this can ba a security risk! (see above)
+ *
+ * Requires: POLARSSL_SSL_SRV_C
+ *           POLARSSL_SSL_PROTO_DTLS
+ *
+ * Comment this to disable support for HelloVerifyRequest.
+ */
+#define POLARSSL_SSL_DTLS_HELLO_VERIFY
+
+/**
+ * \def POLARSSL_SSL_DTLS_BADMAC_LIMIT
+ *
+ * Enable support for a limit of records with bad MAC.
+ *
+ * See ssl_set_dtls_badmac_limit().
+ *
+ * Requires: POLARSSL_SSL_PROTO_DTLS
+ */
+#define POLARSSL_SSL_DTLS_BADMAC_LIMIT
+
+/**
  * \def POLARSSL_SSL_SESSION_TICKETS
  *
  * Enable support for RFC 5077 session tickets in SSL.
@@ -1163,6 +1225,8 @@
  * CRIME attack. Before enabling this option, you should examine with care if
  * CRIME or similar exploits may be a applicable to your use case.
  *
+ * \note Currently compression can't bu used with DTLS.
+ *
  * Used in: library/ssl_tls.c
  *          library/ssl_cli.c
  *          library/ssl_srv.c
@@ -1967,7 +2031,6 @@
  * \def POLARSSL_SHA256_C
  *
  * Enable the SHA-224 and SHA-256 cryptographic hash algorithms.
- * (Used to be POLARSSL_SHA2_C)
  *
  * Module:  library/sha256.c
  * Caller:  library/entropy.c
@@ -1985,7 +2048,6 @@
  * \def POLARSSL_SHA512_C
  *
  * Enable the SHA-384 and SHA-512 cryptographic hash algorithms.
- * (Used to be POLARSSL_SHA4_C)
  *
  * Module:  library/sha512.c
  * Caller:  library/entropy.c
@@ -2010,6 +2072,18 @@
 #define POLARSSL_SSL_CACHE_C
 
 /**
+ * \def POLARSSL_SSL_COOKIE_C
+ *
+ * Enable basic implementation of DTLS cookies for hello verification.
+ *
+ * Module:  library/ssl_cookie.c
+ * Caller:
+ *
+ * Requires: POLARSSL_SSL_DTLS_HELLO_VERIFY
+ */
+#define POLARSSL_SSL_COOKIE_C
+
+/**
  * \def POLARSSL_SSL_CLI_C
  *
  * Enable the SSL/TLS client code.
@@ -2047,7 +2121,7 @@
  *          library/ssl_srv.c
  *
  * Requires: POLARSSL_CIPHER_C, POLARSSL_MD_C
- *           and at least one of the POLARSSL_SSL_PROTO_* defines
+ *           and at least one of the POLARSSL_SSL_PROTO_XXX defines
  *
  * This module is required for SSL/TLS.
  */
@@ -2178,7 +2252,7 @@
  *
  * Module:  library/x509_crt_write.c
  *
- * Requires: POLARSSL_CREATE_C
+ * Requires: POLARSSL_X509_CREATE_C
  *
  * This module is required for X.509 certificate creation.
  */
@@ -2191,7 +2265,7 @@
  *
  * Module:  library/x509_csr_write.c
  *
- * Requires: POLARSSL_CREATE_C
+ * Requires: POLARSSL_X509_CREATE_C
  *
  * This module is required for X.509 certificate request writing.
  */
@@ -2279,6 +2353,7 @@
 //#define SSL_MAX_CONTENT_LEN             16384 /**< Size of the input / output buffer */
 //#define SSL_DEFAULT_TICKET_LIFETIME     86400 /**< Lifetime of session tickets (if enabled) */
 //#define POLARSSL_PSK_MAX_LEN               32 /**< Max size of TLS pre-shared keys, in bytes (default 256 bits) */
+//#define POLARSSL_SSL_COOKIE_TIMEOUT        60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */
 
 /**
  * Complete list of ciphersuites to use, in order of preference.
diff --git a/include/polarssl/ctr_drbg.h b/include/mbedtls/ctr_drbg.h
similarity index 100%
rename from include/polarssl/ctr_drbg.h
rename to include/mbedtls/ctr_drbg.h
diff --git a/include/polarssl/debug.h b/include/mbedtls/debug.h
similarity index 100%
rename from include/polarssl/debug.h
rename to include/mbedtls/debug.h
diff --git a/include/polarssl/des.h b/include/mbedtls/des.h
similarity index 100%
rename from include/polarssl/des.h
rename to include/mbedtls/des.h
diff --git a/include/polarssl/dhm.h b/include/mbedtls/dhm.h
similarity index 100%
rename from include/polarssl/dhm.h
rename to include/mbedtls/dhm.h
diff --git a/include/polarssl/ecdh.h b/include/mbedtls/ecdh.h
similarity index 100%
rename from include/polarssl/ecdh.h
rename to include/mbedtls/ecdh.h
diff --git a/include/polarssl/ecdsa.h b/include/mbedtls/ecdsa.h
similarity index 100%
rename from include/polarssl/ecdsa.h
rename to include/mbedtls/ecdsa.h
diff --git a/include/polarssl/ecp.h b/include/mbedtls/ecp.h
similarity index 100%
rename from include/polarssl/ecp.h
rename to include/mbedtls/ecp.h
diff --git a/include/polarssl/entropy.h b/include/mbedtls/entropy.h
similarity index 100%
rename from include/polarssl/entropy.h
rename to include/mbedtls/entropy.h
diff --git a/include/polarssl/entropy_poll.h b/include/mbedtls/entropy_poll.h
similarity index 100%
rename from include/polarssl/entropy_poll.h
rename to include/mbedtls/entropy_poll.h
diff --git a/include/polarssl/error.h b/include/mbedtls/error.h
similarity index 97%
rename from include/polarssl/error.h
rename to include/mbedtls/error.h
index 3041155..56b4997 100644
--- a/include/polarssl/error.h
+++ b/include/mbedtls/error.h
@@ -62,7 +62,7 @@
  * DES       1  0x0032-0x0032
  * CTR_DBRG  4  0x0034-0x003A
  * ENTROPY   3  0x003C-0x0040
- * NET      11  0x0042-0x0056
+ * NET      12  0x0042-0x0056   0x0011-0x0011
  * ENTROPY   1  0x0058-0x0058
  * ASN1      7  0x0060-0x006C
  * MD2       1  0x0070-0x0070
@@ -88,7 +88,7 @@
  * ECP       4   8 (Started from top)
  * MD        5   4
  * CIPHER    6   6
- * SSL       6   11 (Started from top)
+ * SSL       6   13 (Started from top)
  * SSL       7   31
  *
  * Module dependent error code (5 bits 0x.00.-0x.F8.)
diff --git a/include/polarssl/gcm.h b/include/mbedtls/gcm.h
similarity index 100%
rename from include/polarssl/gcm.h
rename to include/mbedtls/gcm.h
diff --git a/include/polarssl/havege.h b/include/mbedtls/havege.h
similarity index 100%
rename from include/polarssl/havege.h
rename to include/mbedtls/havege.h
diff --git a/include/polarssl/hmac_drbg.h b/include/mbedtls/hmac_drbg.h
similarity index 100%
rename from include/polarssl/hmac_drbg.h
rename to include/mbedtls/hmac_drbg.h
diff --git a/include/polarssl/md.h b/include/mbedtls/md.h
similarity index 100%
rename from include/polarssl/md.h
rename to include/mbedtls/md.h
diff --git a/include/polarssl/md2.h b/include/mbedtls/md2.h
similarity index 100%
rename from include/polarssl/md2.h
rename to include/mbedtls/md2.h
diff --git a/include/polarssl/md4.h b/include/mbedtls/md4.h
similarity index 100%
rename from include/polarssl/md4.h
rename to include/mbedtls/md4.h
diff --git a/include/polarssl/md5.h b/include/mbedtls/md5.h
similarity index 100%
rename from include/polarssl/md5.h
rename to include/mbedtls/md5.h
diff --git a/include/polarssl/md_wrap.h b/include/mbedtls/md_wrap.h
similarity index 100%
rename from include/polarssl/md_wrap.h
rename to include/mbedtls/md_wrap.h
diff --git a/include/polarssl/memory.h b/include/mbedtls/memory.h
similarity index 100%
rename from include/polarssl/memory.h
rename to include/mbedtls/memory.h
diff --git a/include/polarssl/memory_buffer_alloc.h b/include/mbedtls/memory_buffer_alloc.h
similarity index 99%
rename from include/polarssl/memory_buffer_alloc.h
rename to include/mbedtls/memory_buffer_alloc.h
index 19abe55..128c6f3 100644
--- a/include/polarssl/memory_buffer_alloc.h
+++ b/include/mbedtls/memory_buffer_alloc.h
@@ -125,7 +125,7 @@
  *          and contain sane values. Helps debug buffer-overflow errors.
  *
  *          Prints out first failure if POLARSSL_MEMORY_DEBUG is defined.
- *          Prints out full header information if POLARSSL_MEMORY_DEBUG_HEADERS
+ *          Prints out full header information if POLARSSL_MEMORY_DEBUG
  *          is defined. (Includes stack trace information for each block if
  *          POLARSSL_MEMORY_BACKTRACE is defined as well).
  *
diff --git a/include/polarssl/net.h b/include/mbedtls/net.h
similarity index 67%
rename from include/polarssl/net.h
rename to include/mbedtls/net.h
index d70639d..088662e 100644
--- a/include/polarssl/net.h
+++ b/include/mbedtls/net.h
@@ -24,9 +24,23 @@
 #ifndef POLARSSL_NET_H
 #define POLARSSL_NET_H
 
+#if !defined(POLARSSL_CONFIG_FILE)
+#include "config.h"
+#else
+#include POLARSSL_CONFIG_FILE
+#endif
+
 #include <stddef.h>
 
-#define POLARSSL_ERR_NET_UNKNOWN_HOST                      -0x0056  /**< Failed to get an IP address for the given hostname. */
+#if defined(POLARSSL_HAVE_TIME)
+#if defined(_MSC_VER) && !defined(EFIX64) && !defined(EFI32)
+#include <basetsd.h>
+typedef UINT32 uint32_t;
+#else
+#include <inttypes.h>
+#endif
+#endif /* POLARSSL_HAVE_TIME */
+
 #define POLARSSL_ERR_NET_SOCKET_FAILED                     -0x0042  /**< Failed to open a socket. */
 #define POLARSSL_ERR_NET_CONNECT_FAILED                    -0x0044  /**< The connection to the given server / port failed. */
 #define POLARSSL_ERR_NET_BIND_FAILED                       -0x0046  /**< Binding of the socket failed. */
@@ -37,41 +51,53 @@
 #define POLARSSL_ERR_NET_CONN_RESET                        -0x0050  /**< Connection was reset by peer. */
 #define POLARSSL_ERR_NET_WANT_READ                         -0x0052  /**< Connection requires a read call. */
 #define POLARSSL_ERR_NET_WANT_WRITE                        -0x0054  /**< Connection requires a write call. */
+#define POLARSSL_ERR_NET_UNKNOWN_HOST                      -0x0056  /**< Failed to get an IP address for the given hostname. */
+#define POLARSSL_ERR_NET_TIMEOUT                           -0x0011  /**< The operation timed out. */
 
 #define POLARSSL_NET_LISTEN_BACKLOG         10 /**< The backlog that listen() should use. */
 
+#define NET_PROTO_TCP 0 /**< The TCP transport protocol */
+#define NET_PROTO_UDP 1 /**< The UDP transport protocol */
+
 #ifdef __cplusplus
 extern "C" {
 #endif
 
 /**
- * \brief          Initiate a TCP connection with host:port
+ * \brief          Initiate a connection with host:port in the given protocol
  *
  * \param fd       Socket to use
  * \param host     Host to connect to
  * \param port     Port to connect to
+ * \param proto    Protocol: NET_PROTO_TCP or NET_PROTO_UDP
  *
  * \return         0 if successful, or one of:
  *                      POLARSSL_ERR_NET_SOCKET_FAILED,
  *                      POLARSSL_ERR_NET_UNKNOWN_HOST,
  *                      POLARSSL_ERR_NET_CONNECT_FAILED
+ *
+ * \note           Sets the socket in connected mode even with UDP.
  */
-int net_connect( int *fd, const char *host, int port );
+int net_connect( int *fd, const char *host, int port, int proto );
 
 /**
- * \brief          Create a listening socket on bind_ip:port.
- *                 If bind_ip == NULL, all interfaces are binded.
+ * \brief          Create a receiving socket on bind_ip:port in the chosen
+ *                 protocol. If bind_ip == NULL, all interfaces are bound.
  *
  * \param fd       Socket to use
  * \param bind_ip  IP to bind to, can be NULL
  * \param port     Port number to use
+ * \param proto    Protocol: NET_PROTO_TCP or NET_PROTO_UDP
  *
  * \return         0 if successful, or one of:
  *                      POLARSSL_ERR_NET_SOCKET_FAILED,
  *                      POLARSSL_ERR_NET_BIND_FAILED,
  *                      POLARSSL_ERR_NET_LISTEN_FAILED
+ *
+ * \note           Regardless of the protocol, opens the sockets and binds it.
+ *                 In addition, make the socket listening if protocol is TCP.
  */
-int net_bind( int *fd, const char *bind_ip, int port );
+int net_bind( int *fd, const char *bind_ip, int port, int proto );
 
 /**
  * \brief           Accept a connection from a remote client
@@ -84,6 +110,10 @@
  * \return          0 if successful, POLARSSL_ERR_NET_ACCEPT_FAILED, or
  *                  POLARSSL_ERR_NET_WANT_READ is bind_fd was set to
  *                  non-blocking and accept() is blocking.
+ *
+ * \note            With UDP, connects the bind_fd to the client and just copy
+ *                  its descriptor to client_fd. New clients will not be able
+ *                  to connect until you close the socket and bind a new one.
  */
 int net_accept( int bind_fd, int *client_fd, void *client_ip );
 
@@ -105,6 +135,7 @@
  */
 int net_set_nonblock( int fd );
 
+#if defined(POLARSSL_HAVE_TIME)
 /**
  * \brief          Portable usleep helper
  *
@@ -114,6 +145,7 @@
  *                 select()'s timeout granularity (typically, 10ms).
  */
 void net_usleep( unsigned long usec );
+#endif
 
 /**
  * \brief          Read at most 'len' characters. If no error occurs,
@@ -143,6 +175,31 @@
  */
 int net_send( void *ctx, const unsigned char *buf, size_t len );
 
+#if defined(POLARSSL_HAVE_TIME)
+/**
+ * \brief          Read at most 'len' characters, blocking for at most
+ *                 'timeout' seconds. If no error occurs, the actual amount
+ *                 read is returned.
+ *
+ * \param ctx      Socket
+ * \param buf      The buffer to write to
+ * \param len      Maximum length of the buffer
+ * \param timeout  Maximum number of milliseconds to wait for data
+ *
+ * \return         This function returns the number of bytes received,
+ *                 or a non-zero error code:
+ *                 POLARSSL_ERR_NET_TIMEOUT if the operation timed out,
+ *                 POLARSSL_ERR_NET_WANT_READ if interrupted by a signal.
+ *
+ * \note           This function will block (until data becomes available or
+ *                 timeout is reached) even if the socket is set to
+ *                 non-blocking. Handling timeouts with non-blocking reads
+ *                 requires a different strategy.
+ */
+int net_recv_timeout( void *ctx, unsigned char *buf, size_t len,
+                      uint32_t timeout );
+#endif /* POLARSSL_HAVE_TIME */
+
 /**
  * \brief          Gracefully shutdown the connection
  *
diff --git a/include/polarssl/oid.h b/include/mbedtls/oid.h
similarity index 100%
rename from include/polarssl/oid.h
rename to include/mbedtls/oid.h
diff --git a/include/polarssl/padlock.h b/include/mbedtls/padlock.h
similarity index 100%
rename from include/polarssl/padlock.h
rename to include/mbedtls/padlock.h
diff --git a/include/polarssl/pbkdf2.h b/include/mbedtls/pbkdf2.h
similarity index 100%
rename from include/polarssl/pbkdf2.h
rename to include/mbedtls/pbkdf2.h
diff --git a/include/polarssl/pem.h b/include/mbedtls/pem.h
similarity index 100%
rename from include/polarssl/pem.h
rename to include/mbedtls/pem.h
diff --git a/include/polarssl/pk.h b/include/mbedtls/pk.h
similarity index 100%
rename from include/polarssl/pk.h
rename to include/mbedtls/pk.h
diff --git a/include/polarssl/pk_wrap.h b/include/mbedtls/pk_wrap.h
similarity index 100%
rename from include/polarssl/pk_wrap.h
rename to include/mbedtls/pk_wrap.h
diff --git a/include/polarssl/pkcs11.h b/include/mbedtls/pkcs11.h
similarity index 98%
rename from include/polarssl/pkcs11.h
rename to include/mbedtls/pkcs11.h
index 18c3370..1d64f0c 100644
--- a/include/polarssl/pkcs11.h
+++ b/include/mbedtls/pkcs11.h
@@ -117,7 +117,7 @@
  *
  * \param ctx      PKCS #11 context
  * \param mode     must be RSA_PRIVATE, for compatibility with rsa.c's signature
- * \param md_alg   a POLARSSL_MD_* (use POLARSSL_MD_NONE for signing raw data)
+ * \param md_alg   a POLARSSL_MD_XXX (use POLARSSL_MD_NONE for signing raw data)
  * \param hashlen  message digest length (for POLARSSL_MD_NONE only)
  * \param hash     buffer holding the message digest
  * \param sig      buffer that will hold the ciphertext
diff --git a/include/polarssl/pkcs12.h b/include/mbedtls/pkcs12.h
similarity index 100%
rename from include/polarssl/pkcs12.h
rename to include/mbedtls/pkcs12.h
diff --git a/include/polarssl/pkcs5.h b/include/mbedtls/pkcs5.h
similarity index 100%
rename from include/polarssl/pkcs5.h
rename to include/mbedtls/pkcs5.h
diff --git a/include/polarssl/platform.h b/include/mbedtls/platform.h
similarity index 100%
rename from include/polarssl/platform.h
rename to include/mbedtls/platform.h
diff --git a/include/polarssl/ripemd160.h b/include/mbedtls/ripemd160.h
similarity index 100%
rename from include/polarssl/ripemd160.h
rename to include/mbedtls/ripemd160.h
diff --git a/include/polarssl/rsa.h b/include/mbedtls/rsa.h
similarity index 97%
rename from include/polarssl/rsa.h
rename to include/mbedtls/rsa.h
index 21109ed..c1fc3cb 100644
--- a/include/polarssl/rsa.h
+++ b/include/mbedtls/rsa.h
@@ -408,7 +408,7 @@
  *                               RSA_PRIVATE)
  * \param p_rng    RNG parameter
  * \param mode     RSA_PUBLIC or RSA_PRIVATE
- * \param md_alg   a POLARSSL_MD_* (use POLARSSL_MD_NONE for signing raw data)
+ * \param md_alg   a POLARSSL_MD_XXX (use POLARSSL_MD_NONE for signing raw data)
  * \param hashlen  message digest length (for POLARSSL_MD_NONE only)
  * \param hash     buffer holding the message digest
  * \param sig      buffer that will hold the ciphertext
@@ -438,7 +438,7 @@
  * \param f_rng    RNG function (Only needed for RSA_PRIVATE)
  * \param p_rng    RNG parameter
  * \param mode     RSA_PUBLIC or RSA_PRIVATE
- * \param md_alg   a POLARSSL_MD_* (use POLARSSL_MD_NONE for signing raw data)
+ * \param md_alg   a POLARSSL_MD_XXX (use POLARSSL_MD_NONE for signing raw data)
  * \param hashlen  message digest length (for POLARSSL_MD_NONE only)
  * \param hash     buffer holding the message digest
  * \param sig      buffer that will hold the ciphertext
@@ -466,7 +466,7 @@
  *                               RSA_PRIVATE)
  * \param p_rng    RNG parameter
  * \param mode     RSA_PUBLIC or RSA_PRIVATE
- * \param md_alg   a POLARSSL_MD_* (use POLARSSL_MD_NONE for signing raw data)
+ * \param md_alg   a POLARSSL_MD_XXX (use POLARSSL_MD_NONE for signing raw data)
  * \param hashlen  message digest length (for POLARSSL_MD_NONE only)
  * \param hash     buffer holding the message digest
  * \param sig      buffer that will hold the ciphertext
@@ -500,7 +500,7 @@
  * \param f_rng    RNG function (Only needed for RSA_PRIVATE)
  * \param p_rng    RNG parameter
  * \param mode     RSA_PUBLIC or RSA_PRIVATE
- * \param md_alg   a POLARSSL_MD_* (use POLARSSL_MD_NONE for signing raw data)
+ * \param md_alg   a POLARSSL_MD_XXX (use POLARSSL_MD_NONE for signing raw data)
  * \param hashlen  message digest length (for POLARSSL_MD_NONE only)
  * \param hash     buffer holding the message digest
  * \param sig      buffer holding the ciphertext
@@ -530,7 +530,7 @@
  * \param f_rng    RNG function (Only needed for RSA_PRIVATE)
  * \param p_rng    RNG parameter
  * \param mode     RSA_PUBLIC or RSA_PRIVATE
- * \param md_alg   a POLARSSL_MD_* (use POLARSSL_MD_NONE for signing raw data)
+ * \param md_alg   a POLARSSL_MD_XXX (use POLARSSL_MD_NONE for signing raw data)
  * \param hashlen  message digest length (for POLARSSL_MD_NONE only)
  * \param hash     buffer holding the message digest
  * \param sig      buffer holding the ciphertext
@@ -558,7 +558,7 @@
  * \param f_rng    RNG function (Only needed for RSA_PRIVATE)
  * \param p_rng    RNG parameter
  * \param mode     RSA_PUBLIC or RSA_PRIVATE
- * \param md_alg   a POLARSSL_MD_* (use POLARSSL_MD_NONE for signing raw data)
+ * \param md_alg   a POLARSSL_MD_XXX (use POLARSSL_MD_NONE for signing raw data)
  * \param hashlen  message digest length (for POLARSSL_MD_NONE only)
  * \param hash     buffer holding the message digest
  * \param sig      buffer holding the ciphertext
@@ -592,7 +592,7 @@
  * \param f_rng    RNG function (Only needed for RSA_PRIVATE)
  * \param p_rng    RNG parameter
  * \param mode     RSA_PUBLIC or RSA_PRIVATE
- * \param md_alg   a POLARSSL_MD_* (use POLARSSL_MD_NONE for signing raw data)
+ * \param md_alg   a POLARSSL_MD_XXX (use POLARSSL_MD_NONE for signing raw data)
  * \param hashlen  message digest length (for POLARSSL_MD_NONE only)
  * \param hash     buffer holding the message digest
  * \param mgf1_hash_id message digest used for mask generation
diff --git a/include/polarssl/sha1.h b/include/mbedtls/sha1.h
similarity index 100%
rename from include/polarssl/sha1.h
rename to include/mbedtls/sha1.h
diff --git a/include/polarssl/sha256.h b/include/mbedtls/sha256.h
similarity index 100%
rename from include/polarssl/sha256.h
rename to include/mbedtls/sha256.h
diff --git a/include/polarssl/sha512.h b/include/mbedtls/sha512.h
similarity index 100%
rename from include/polarssl/sha512.h
rename to include/mbedtls/sha512.h
diff --git a/include/polarssl/ssl.h b/include/mbedtls/ssl.h
similarity index 80%
rename from include/polarssl/ssl.h
rename to include/mbedtls/ssl.h
index 921680e..569fdb5 100644
--- a/include/polarssl/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -30,11 +30,6 @@
 #include POLARSSL_CONFIG_FILE
 #endif
 
-/* Temporary compatibility trick for the current stable branch */
-#if !defined(POLARSSL_SSL_DISABLE_RENEGOTIATION)
-#define POLARSSL_SSL_RENEGOTIATION
-#endif
-
 #include "net.h"
 #include "bignum.h"
 #include "ecp.h"
@@ -79,6 +74,10 @@
 #include "zlib.h"
 #endif
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+#include "timing.h"
+#endif
+
 #if defined(POLARSSL_HAVE_TIME)
 #include <time.h>
 #endif
@@ -149,7 +148,9 @@
 #define POLARSSL_ERR_SSL_INTERNAL_ERROR                    -0x6C00  /**< Internal error (eg, unexpected failure in lower-level module) */
 #define POLARSSL_ERR_SSL_COUNTER_WRAPPING                  -0x6B80  /**< A counter would wrap (eg, too many messages exchanged). */
 #define POLARSSL_ERR_SSL_WAITING_SERVER_HELLO_RENEGO       -0x6B00  /**< Unexpected message at ServerHello in renegotiation. */
-#define POLARSSL_ERR_SSL_NO_USABLE_CIPHERSUITE             -0x6A80  /**< None of the common ciphersuites is usable (eg, no suitable certificate, see debug messages). */
+#define POLARSSL_ERR_SSL_HELLO_VERIFY_REQUIRED             -0x6A80  /**< DTLS client must retry for hello verification */
+#define POLARSSL_ERR_SSL_BUFFER_TOO_SMALL                  -0x6A00  /**< A buffer is too small to receive or write a message */
+#define POLARSSL_ERR_SSL_NO_USABLE_CIPHERSUITE             -0x6980  /**< None of the common ciphersuites is usable (eg, no suitable certificate, see debug messages). */
 
 /*
  * Various constants
@@ -160,6 +161,9 @@
 #define SSL_MINOR_VERSION_2             2   /*!< TLS v1.1 */
 #define SSL_MINOR_VERSION_3             3   /*!< TLS v1.2 */
 
+#define SSL_TRANSPORT_STREAM            0   /*!< TLS      */
+#define SSL_TRANSPORT_DATAGRAM          1   /*!< DTLS     */
+
 /* Determine minimum supported version */
 #define SSL_MIN_MAJOR_VERSION           SSL_MAJOR_VERSION_3
 
@@ -227,8 +231,8 @@
 #define SSL_VERIFY_REQUIRED             2
 
 #define SSL_INITIAL_HANDSHAKE           0
-#define SSL_RENEGOTIATION               1   /* In progress */
-#define SSL_RENEGOTIATION_DONE          2   /* Done */
+#define SSL_RENEGOTIATION_IN_PROGRESS   1   /* In progress */
+#define SSL_RENEGOTIATION_DONE          2   /* Done or aborted */
 #define SSL_RENEGOTIATION_PENDING       3   /* Requested (server only) */
 
 #define SSL_LEGACY_RENEGOTIATION        0
@@ -237,6 +241,9 @@
 #define SSL_RENEGOTIATION_DISABLED      0
 #define SSL_RENEGOTIATION_ENABLED       1
 
+#define SSL_ANTI_REPLAY_DISABLED        0
+#define SSL_ANTI_REPLAY_ENABLED         1
+
 #define SSL_RENEGOTIATION_NOT_ENFORCED  -1
 #define SSL_RENEGO_MAX_RECORDS_DEFAULT  16
 
@@ -257,6 +264,26 @@
 #define SSL_ARC4_ENABLED                0
 #define SSL_ARC4_DISABLED               1
 
+/*
+ * DTLS retransmission states, see RFC 6347 4.2.4
+ *
+ * The SENDING state is merged in PREPARING for initial sends,
+ * but is distinct for resends.
+ *
+ * Note: initial state is wrong for server, but is not used anyway.
+ */
+#define SSL_RETRANS_PREPARING       0
+#define SSL_RETRANS_SENDING         1
+#define SSL_RETRANS_WAITING         2
+#define SSL_RETRANS_FINISHED        3
+
+/*
+ * Default range for DTLS retransmission timer value, in milliseconds.
+ * RFC 6347 4.2.4.1 says from 1 second to 60 seconds.
+ */
+#define SSL_DTLS_TIMEOUT_DFL_MIN    1000
+#define SSL_DTLS_TIMEOUT_DFL_MAX   60000
+
 /**
  * \name SECTION: Module settings
  *
@@ -296,7 +323,7 @@
 #define SSL_COMPRESSION_ADD             0
 #endif
 
-#if defined(POLARSSL_RC4_C) || defined(POLARSSL_CIPHER_MODE_CBC)
+#if defined(POLARSSL_ARC4_C) || defined(POLARSSL_CIPHER_MODE_CBC)
 /* Ciphersuites using HMAC */
 #if defined(POLARSSL_SHA512_C)
 #define SSL_MAC_ADD                 48  /* SHA-384 used for HMAC */
@@ -336,7 +363,7 @@
  * Signaling ciphersuite values (SCSV)
  */
 #define SSL_EMPTY_RENEGOTIATION_INFO    0xFF   /**< renegotiation info ext */
-#define SSL_FALLBACK_SCSV               0x5600 /**< draft-ietf-tls-downgrade-scsv-00 */
+#define SSL_FALLBACK_SCSV_VALUE         0x5600 /**< draft-ietf-tls-downgrade-scsv-00 */
 
 /*
  * Supported Signature and Hash algorithms (For TLS 1.2)
@@ -405,6 +432,7 @@
 #define SSL_HS_HELLO_REQUEST            0
 #define SSL_HS_CLIENT_HELLO             1
 #define SSL_HS_SERVER_HELLO             2
+#define SSL_HS_HELLO_VERIFY_REQUEST     3
 #define SSL_HS_NEW_SESSION_TICKET       4
 #define SSL_HS_CERTIFICATE             11
 #define SSL_HS_SERVER_KEY_EXCHANGE     12
@@ -525,6 +553,7 @@
     SSL_HANDSHAKE_WRAPUP,
     SSL_HANDSHAKE_OVER,
     SSL_SERVER_NEW_SESSION_TICKET,
+    SSL_SERVER_HELLO_VERIFY_REQUEST_SENT,
 }
 ssl_states;
 
@@ -538,6 +567,9 @@
 #if defined(POLARSSL_X509_CRT_PARSE_C)
 typedef struct _ssl_key_cert ssl_key_cert;
 #endif
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+typedef struct _ssl_flight_item ssl_flight_item;
+#endif
 
 /*
  * This structure is used for storing current session data.
@@ -650,6 +682,28 @@
     ssl_key_cert *sni_key_cert;         /*!<  key/cert list from SNI  */
 #endif
 #endif /* POLARSSL_X509_CRT_PARSE_C */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    unsigned int out_msg_seq;           /*!<  Outgoing handshake sequence number */
+    unsigned int in_msg_seq;            /*!<  Incoming handshake sequence number */
+
+    unsigned char *verify_cookie;       /*!<  Cli: HelloVerifyRequest cookie
+                                              Srv: unused                    */
+    unsigned char verify_cookie_len;    /*!<  Cli: cookie length
+                                              Srv: flag for sending a cookie */
+
+    unsigned char *hs_msg;              /*!<  Reassembled handshake message  */
+
+    uint32_t retransmit_timeout;        /*!<  Current value of timeout       */
+    unsigned char retransmit_state;     /*!<  Retransmission state           */
+    ssl_flight_item *flight;            /*!<  Current outgoing flight        */
+    ssl_flight_item *cur_msg;           /*!<  Current message in flight      */
+    unsigned int in_flight_start_seq;   /*!<  Minimum message sequence in the
+                                              flight being received          */
+    ssl_transform *alt_transform_out;   /*!<  Alternative transform for
+                                              resending messages             */
+    unsigned char alt_out_ctr[8];       /*!<  Alternative record epoch/counter
+                                              for resending messages         */
+#endif
 
     /*
      * Checksum contexts
@@ -720,15 +774,31 @@
 };
 #endif /* POLARSSL_X509_CRT_PARSE_C */
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+/*
+ * List of handshake messages kept around for resending
+ */
+struct _ssl_flight_item
+{
+    unsigned char *p;       /*!< message, including handshake headers   */
+    size_t len;             /*!< length of p                            */
+    unsigned char type;     /*!< type of the message: handshake or CCS  */
+    ssl_flight_item *next;  /*!< next handshake message(s)              */
+};
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+
 struct _ssl_context
 {
     /*
      * Miscellaneous
      */
     int state;                  /*!< SSL handshake: current state     */
-    int renegotiation;          /*!< Initial or renegotiation         */
+    int transport;              /*!< Transport: stream or datagram    */
 #if defined(POLARSSL_SSL_RENEGOTIATION)
-    int renego_records_seen;    /*!< Records since renego request     */
+    int renegotiation;          /*!< Initial or renegotiation         */
+    int renego_records_seen;    /*!< Records since renego request, or with DTLS,
+                                  number of retransmissions of request if
+                                  renego_max_records is < 0           */
 #endif
 
     int major_ver;              /*!< equal to  SSL_MAJOR_VERSION_3    */
@@ -739,6 +809,13 @@
     int min_major_ver;          /*!< min. major version used          */
     int min_minor_ver;          /*!< min. minor version used          */
 
+    uint32_t read_timeout;      /*!< timeout for ssl_read in milliseconds */
+
+#if defined(POLARSSL_SSL_DTLS_BADMAC_LIMIT)
+    unsigned badmac_limit;      /*!< limit of records with a bad MAC    */
+    unsigned badmac_seen;       /*!< records with a bad MAC received    */
+#endif
+
 #if defined(POLARSSL_SSL_FALLBACK_SCSV) && defined(POLARSSL_SSL_CLI_C)
     char fallback;              /*!< flag for fallback connections    */
 #endif
@@ -755,15 +832,15 @@
      */
     int  (*f_rng)(void *, unsigned char *, size_t);
     void (*f_dbg)(void *, int, const char *);
-    int (*f_recv)(void *, unsigned char *, size_t);
     int (*f_send)(void *, const unsigned char *, size_t);
+    int (*f_recv)(void *, unsigned char *, size_t);
+    int (*f_recv_timeout)(void *, unsigned char *, size_t, uint32_t);
     int (*f_get_cache)(void *, ssl_session *);
     int (*f_set_cache)(void *, const ssl_session *);
 
     void *p_rng;                /*!< context for the RNG function     */
     void *p_dbg;                /*!< context for the debug function   */
-    void *p_recv;               /*!< context for reading operations   */
-    void *p_send;               /*!< context for writing operations   */
+    void *p_bio;                /*!< context for I/O operations   */
     void *p_get_cache;          /*!< context for cache retrieval      */
     void *p_set_cache;          /*!< context for cache store          */
     void *p_hw_data;            /*!< context for HW acceleration      */
@@ -803,28 +880,57 @@
     ssl_transform *transform_negotiate; /*!<  transform params in negotiation */
 
     /*
+     * Timers
+     */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    struct hr_time time_info;   /*!< timer context                      */
+    unsigned long time_limit;   /*!< limit for the running timer        */
+    uint32_t hs_timeout_min;    /*!< initial value of the handshake
+                                     retransmission timeout             */
+    uint32_t hs_timeout_max;    /*!< maximum value of the handshake
+                                     retransmission timeout             */
+#endif
+
+    /*
      * Record layer (incoming data)
      */
-    unsigned char *in_ctr;      /*!< 64-bit incoming message counter  */
-    unsigned char *in_hdr;      /*!< 5-byte record header (in_ctr+8)  */
-    unsigned char *in_iv;       /*!< ivlen-byte IV (in_hdr+5)         */
+    unsigned char *in_buf;      /*!< input buffer                     */
+    unsigned char *in_ctr;      /*!< 64-bit incoming message counter
+                                     TLS: maintained by us
+                                     DTLS: read from peer             */
+    unsigned char *in_hdr;      /*!< start of record header           */
+    unsigned char *in_len;      /*!< two-bytes message length field   */
+    unsigned char *in_iv;       /*!< ivlen-byte IV                    */
     unsigned char *in_msg;      /*!< message contents (in_iv+ivlen)   */
     unsigned char *in_offt;     /*!< read offset in application data  */
 
     int in_msgtype;             /*!< record header: message type      */
     size_t in_msglen;           /*!< record header: message length    */
     size_t in_left;             /*!< amount of data read so far       */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    uint16_t in_epoch;          /*!< DTLS epoch for incoming records  */
+    size_t next_record_offset;  /*!< offset of the next record in datagram
+                                     (equal to in_left if none)       */
+#endif
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+    uint64_t in_window_top;     /*!< last validated record seq_num    */
+    uint64_t in_window;         /*!< bitmask for replay detection     */
+    char anti_replay;           /*!< is anti-replay on?               */
+#endif
 
-    size_t in_hslen;            /*!< current handshake message length */
+    size_t in_hslen;            /*!< current handshake message length,
+                                     including the handshake header   */
     int nb_zero;                /*!< # of 0-length encrypted messages */
     int record_read;            /*!< record is already present        */
 
     /*
      * Record layer (outgoing data)
      */
+    unsigned char *out_buf;     /*!< output buffer                    */
     unsigned char *out_ctr;     /*!< 64-bit outgoing message counter  */
-    unsigned char *out_hdr;     /*!< 5-byte record header (out_ctr+8) */
-    unsigned char *out_iv;      /*!< ivlen-byte IV (out_hdr+5)        */
+    unsigned char *out_hdr;     /*!< start of record header           */
+    unsigned char *out_len;     /*!< two-bytes message length field   */
+    unsigned char *out_iv;      /*!< ivlen-byte IV                    */
     unsigned char *out_msg;     /*!< message contents (out_iv+ivlen)  */
 
     int out_msgtype;            /*!< record header: message type      */
@@ -873,6 +979,7 @@
     unsigned char renego_period[8];     /*!<  value of the record counters
                                               that triggers renegotiation    */
 #endif
+    /* needed for option break handshake with insecure peers */
     int allow_legacy_renegotiation;     /*!<  allow legacy renegotiation     */
     const int *ciphersuite_list[4];     /*!<  allowed ciphersuites / version */
 #if defined(POLARSSL_SSL_SET_CURVES)
@@ -918,8 +1025,22 @@
 #endif
 
     /*
+     * Information for DTLS hello verify
+     */
+#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+    unsigned char  *cli_id;         /*!<  transport-level ID of the client  */
+    size_t          cli_id_len;     /*!<  length of cli_id                  */
+    int (*f_cookie_write)( void *, unsigned char **, unsigned char *,
+                           const unsigned char *, size_t );
+    int (*f_cookie_check)( void *, const unsigned char *, size_t,
+                           const unsigned char *, size_t );
+    void *p_cookie;                 /*!<  context for the cookie callbacks  */
+#endif
+
+    /*
      * Secure renegotiation
      */
+    /* needed to know when to send extension on server */
     int secure_renegotiation;           /*!<  does peer support legacy or
                                               secure renegotiation           */
 #if defined(POLARSSL_SSL_RENEGOTIATION)
@@ -1011,6 +1132,25 @@
 void ssl_set_endpoint( ssl_context *ssl, int endpoint );
 
 /**
+ * \brief           Set the transport type (TLS or DTLS).
+ *                  Default: TLS
+ *
+ * \param ssl       SSL context
+ * \param transport transport type:
+ *                  SSL_TRANSPORT_STREAM for TLS,
+ *                  SSL_TRANSPORT_DATAGRAM for DTLS.
+ * \return          0 on success or POLARSSL_ERR_SSL_BAD_INPUT_DATA
+ *
+ * \note            If DTLS is selected and max and/or min version are less
+ *                  than TLS 1.1 (DTLS 1.0) they are upped to that value.
+ *
+ * \note            For DTLS, you must either provide a recv callback that
+ *                  doesn't block, or one that handles timeouts, see
+ *                  ssl_set_bio_timeout()
+ */
+int ssl_set_transport( ssl_context *ssl, int transport );
+
+/**
  * \brief          Set the certificate verification mode
  *
  * \param ssl      SSL context
@@ -1079,9 +1219,15 @@
  *
  * \param ssl      SSL context
  * \param f_recv   read callback
- * \param p_recv   read parameter
+ * \param p_recv   read parameter (must be equal to write parameter)
  * \param f_send   write callback
- * \param p_send   write parameter
+ * \param p_send   write parameter (must be equal to read parameter)
+ *
+ * \warning        It is required that p_recv == p_send. Otherwise, the first
+ *                 attempt at sending or receiving will result in a
+ *                 POLARSSL_ERR_SSL_BAD_INPUT_DATA error.
+ *
+ * \deprecated     Superseded by ssl_set_bio_timeout().
  */
 void ssl_set_bio( ssl_context *ssl,
         int (*f_recv)(void *, unsigned char *, size_t), void *p_recv,
@@ -1089,6 +1235,180 @@
 
 #if defined(POLARSSL_SSL_SRV_C)
 /**
+ * \brief          Set the underlying BIO callbacks for write, read and
+ *                 read-with-timeout.
+ *
+ * \param ssl      SSL context
+ * \param p_bio    parameter (context) shared by BIO callbacks
+ * \param f_send   write callback
+ * \param f_recv   read callback
+ * \param f_recv_timeout read callback with timeout.
+ *                 The last argument of the callback is the timeout in seconds
+ * \param timeout  value of the ssl_read() timeout in milliseconds
+ *
+ * \note           f_recv_timeout is required for DTLS, unless f_recv performs
+ *                 non-blocking reads.
+ *
+ * \note           TODO: timeout not supported with TLS yet
+ */
+void ssl_set_bio_timeout( ssl_context *ssl,
+        void *p_bio,
+        int (*f_send)(void *, const unsigned char *, size_t),
+        int (*f_recv)(void *, unsigned char *, size_t),
+        int (*f_recv_timeout)(void *, unsigned char *, size_t, uint32_t),
+        uint32_t timeout );
+
+#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+/**
+ * \brief          Set client's transport-level identification info.
+ *                 (Server only. DTLS only.)
+ *
+ *                 This is usually the IP address (and port), but could be
+ *                 anything identify the client depending on the underlying
+ *                 network stack. Used for HelloVerifyRequest with DTLS.
+ *                 This is *not* used to route the actual packets.
+ *
+ * \param ssl      SSL context
+ * \param info     Transport-level info identifying the client (eg IP + port)
+ * \param ilen     Length of info in bytes
+ *
+ * \note           An internal copy is made, so the info buffer can be reused.
+ *
+ * \return         0 on success,
+ *                 POLARSSL_ERR_SSL_BAD_INPUT_DATA if used on client,
+ *                 POLARSSL_ERR_SSL_MALLOC_FAILED if out of memory.
+ */
+int ssl_set_client_transport_id( ssl_context *ssl,
+                                 const unsigned char *info,
+                                 size_t ilen );
+
+/**
+ * \brief          Callback type: generate a cookie
+ *
+ * \param ctx      Context for the callback
+ * \param p        Buffer to write to,
+ *                 must be updated to point right after the cookie
+ * \param end      Pointer to one past the end of the output buffer
+ * \param info     Client ID info that was passed to
+ *                 \c ssl_set_client_transport_id()
+ * \param ilen     Length of info in bytes
+ *
+ * \return         The callback must return 0 on success,
+ *                 or a negative error code.
+ */
+typedef int ssl_cookie_write_t( void *ctx,
+                                unsigned char **p, unsigned char *end,
+                                const unsigned char *info, size_t ilen );
+
+/**
+ * \brief          Callback type: verify a cookie
+ *
+ * \param ctx      Context for the callback
+ * \param cookie   Cookie to verify
+ * \param clen     Length of cookie
+ * \param info     Client ID info that was passed to
+ *                 \c ssl_set_client_transport_id()
+ * \param ilen     Length of info in bytes
+ *
+ * \return         The callback must return 0 if cookie is valid,
+ *                 or a negative error code.
+ */
+typedef int ssl_cookie_check_t( void *ctx,
+                                const unsigned char *cookie, size_t clen,
+                                const unsigned char *info, size_t ilen );
+
+/**
+ * \brief           Register callbacks for DTLS cookies
+ *                  (Server only. DTLS only.)
+ *
+ *                  Default: dummy callbacks that fail, to force you to
+ *                  register working callbacks (and initialize their context).
+ *
+ *                  To disable HelloVerifyRequest, register NULL callbacks.
+ *
+ * \warning         Disabling hello verification allows your server to be used
+ *                  for amplification in DoS attacks against other hosts.
+ *                  Only disable if you known this can't happen in your
+ *                  particular environment.
+ *
+ * \param ssl               SSL context
+ * \param f_cookie_write    Cookie write callback
+ * \param f_cookie_check    Cookie check callback
+ * \param p_cookie          Context for both callbacks
+ */
+void ssl_set_dtls_cookies( ssl_context *ssl,
+                           ssl_cookie_write_t *f_cookie_write,
+                           ssl_cookie_check_t *f_cookie_check,
+                           void *p_cookie );
+#endif /* POLARSSL_SSL_DTLS_HELLO_VERIFY */
+
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+/**
+ * \brief          Enable or disable anti-replay protection for DTLS.
+ *                 (DTLS only, no effect on TLS.)
+ *                 Default: enabled.
+ *
+ * \param ssl      SSL context
+ * \param mode     SSL_ANTI_REPLAY_ENABLED or SSL_ANTI_REPLAY_DISABLED.
+ *
+ * \warning        Disabling this is a security risk unless the application
+ *                 protocol handles duplicated packets in a safe way. You
+ *                 should not disable this without careful consideration.
+ *                 However, if your application already detects duplicated
+ *                 packets and needs information about them to adjust its
+ *                 transmission strategy, then you'll want to disable this.
+ */
+void ssl_set_dtls_anti_replay( ssl_context *ssl, char mode );
+#endif /* POLARSSL_SSL_DTLS_ANTI_REPLAY */
+
+#if defined(POLARSSL_SSL_DTLS_BADMAC_LIMIT)
+/**
+ * \brief          Set a limit on the number of records with a bad MAC
+ *                 before terminating the connection.
+ *                 (DTLS only, no effect on TLS.)
+ *                 Default: 0 (disabled).
+ *
+ * \param ssl      SSL context
+ * \param limit    Limit, or 0 to disable.
+ *
+ * \note           If the limit is N, then the connection is terminated when
+ *                 the Nth non-authentic record is seen.
+ *
+ * \note           Records with an invalid header are not counted, only the
+ *                 ones going through the authentication-decryption phase.
+ *
+ * \note           This is a security trade-off related to the fact that it's
+ *                 often relatively easy for an active attacker ot inject UDP
+ *                 datagrams. On one hand, setting a low limit here makes it
+ *                 easier for such an attacker to forcibly terminated a
+ *                 connection. On the other hand, a high limit or no limit
+ *                 might make us waste resources checking authentication on
+ *                 many bogus packets.
+ */
+void ssl_set_dtls_badmac_limit( ssl_context *ssl, unsigned limit );
+#endif /* POLARSSL_SSL_DTLS_BADMAC_LIMIT */
+
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+/**
+ * \brief          Set retransmit timeout values for the DTLS handshale.
+ *                 (DTLS only, no effect on TLS.)
+ *
+ * \param ssl      SSL context
+ * \param min      Initial timeout value in milliseconds.
+ *                 Default: 1000 (1 second).
+ * \param max      Maximum timeout value in milliseconds.
+ *                 Default: 60000 (60 seconds).
+ *
+ * \note           Default values are from RFC 6347 section 4.2.4.1.
+ *
+ * \note           Higher values for initial timeout may increase average
+ *                 handshake latency. Lower values may increase the risk of
+ *                 network congestion by causing more retransmissions.
+ */
+void ssl_set_handshake_timeout( ssl_context *ssl, uint32_t min, uint32_t max );
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+
+/**
  * \brief          Set the session cache callbacks (server-side only)
  *                 If not set, no session resuming is done (except if session
  *                 tickets are enabled too).
@@ -1175,6 +1495,9 @@
  * \param minor         Minor version number (SSL_MINOR_VERSION_0,
  *                      SSL_MINOR_VERSION_1 and SSL_MINOR_VERSION_2,
  *                      SSL_MINOR_VERSION_3 supported)
+ *
+ * \note                With DTLS, use SSL_MINOR_VERSION_2 for DTLS 1.0
+ *                      and SSL_MINOR_VERSION_3 for DTLS 1.2
  */
 void ssl_set_ciphersuites_for_version( ssl_context *ssl,
                                        const int *ciphersuites,
@@ -1424,16 +1747,18 @@
  *                 (Default: SSL_MAX_MAJOR_VERSION, SSL_MAX_MINOR_VERSION)
  *
  *                 Note: This ignores ciphersuites from 'higher' versions.
- *                 Note: Input outside of the SSL_MAX_XXXXX_VERSION and
- *                       SSL_MIN_XXXXX_VERSION range is ignored.
  *
  * \param ssl      SSL context
  * \param major    Major version number (only SSL_MAJOR_VERSION_3 supported)
  * \param minor    Minor version number (SSL_MINOR_VERSION_0,
  *                 SSL_MINOR_VERSION_1 and SSL_MINOR_VERSION_2,
  *                 SSL_MINOR_VERSION_3 supported)
+ * \return         0 on success or POLARSSL_ERR_SSL_BAD_INPUT_DATA
+ *
+ * \note           With DTLS, use SSL_MINOR_VERSION_2 for DTLS 1.0 and
+ *                 SSL_MINOR_VERSION_3 for DTLS 1.2
  */
-void ssl_set_max_version( ssl_context *ssl, int major, int minor );
+int ssl_set_max_version( ssl_context *ssl, int major, int minor );
 
 /**
  * \brief          Set the minimum accepted SSL/TLS protocol version
@@ -1449,8 +1774,12 @@
  * \param minor    Minor version number (SSL_MINOR_VERSION_0,
  *                 SSL_MINOR_VERSION_1 and SSL_MINOR_VERSION_2,
  *                 SSL_MINOR_VERSION_3 supported)
+ * \return         0 on success or POLARSSL_ERR_SSL_BAD_INPUT_DATA
+ *
+ * \note           With DTLS, use SSL_MINOR_VERSION_2 for DTLS 1.0 and
+ *                 SSL_MINOR_VERSION_3 for DTLS 1.2
  */
-void ssl_set_min_version( ssl_context *ssl, int major, int minor );
+int ssl_set_min_version( ssl_context *ssl, int major, int minor );
 
 #if defined(POLARSSL_SSL_FALLBACK_SCSV) && defined(POLARSSL_SSL_CLI_C)
 /**
@@ -1646,7 +1975,7 @@
 
 #if defined(POLARSSL_SSL_RENEGOTIATION)
 /**
- * \brief          Enforce requested renegotiation.
+ * \brief          Enforce renegotiation requests.
  *                 (Default: enforced, max_records = 16)
  *
  *                 When we request a renegotiation, the peer can comply or
@@ -1662,6 +1991,15 @@
  *                 The optimal value is highly dependent on the specific usage
  *                 scenario.
  *
+ * \note           With DTLS and server-initiated renegotiation, the
+ *                 HelloRequest is retransmited every time ssl_read() times
+ *                 out or receives Application Data, until:
+ *                 - max_records records have beens seen, if it is >= 0, or
+ *                 - the number of retransmits that would happen during an
+ *                 actual handshake has been reached.
+ *                 Please remember the request might be lost a few times
+ *                 if you consider setting max_records to a really low value.
+ *
  * \warning        On client, the grace period can only happen during
  *                 ssl_read(), as opposed to ssl_write() and ssl_renegotiate()
  *                 which always behave as if max_record was 0. The reason is,
@@ -1736,6 +2074,18 @@
  */
 const char *ssl_get_version( const ssl_context *ssl );
 
+/**
+ * \brief          Return the (maximum) number of bytes added by the record
+ *                 layer: header + encryption/MAC overhead (inc. padding)
+ *
+ * \param ssl      SSL context
+ *
+ * \return         Current maximum record expansion in bytes, or
+ *                 POLARSSL_ERR_FEATURE_UNAVAILABLE if compression is enabled,
+ *                 which makes expansion much less predictable
+ */
+int ssl_get_record_expansion( const ssl_context *ssl );
+
 #if defined(POLARSSL_X509_CRT_PARSE_C)
 /**
  * \brief          Return the peer certificate from the current connection
@@ -1838,9 +2188,13 @@
  *                 it must be called later with the *same* arguments,
  *                 until it returns a positive value.
  *
- * \note           This function may write less than the number of bytes
- *                 requested if len is greater than the maximum record length.
- *                 For arbitrary-sized messages, it should be called in a loop.
+ * \note           If the requested length is greater than the maximum
+ *                 fragment length (either the built-in limit or the one set
+ *                 or negotiated with the peer), then:
+ *                 - with TLS, less bytes than requested are written. (In
+ *                 order to write larger messages, this function should be
+ *                 called in a loop.)
+ *                 - with DTLS, POLARSSL_ERR_SSL_BAD_INPUT_DATA is returned.
  */
 int ssl_write( ssl_context *ssl, const unsigned char *buf, size_t len );
 
@@ -1911,13 +2265,10 @@
 
 int ssl_send_fatal_handshake_failure( ssl_context *ssl );
 
+void ssl_reset_checksum( ssl_context *ssl );
 int ssl_derive_keys( ssl_context *ssl );
 
 int ssl_read_record( ssl_context *ssl );
-/**
- * \return         0 if successful, POLARSSL_ERR_SSL_CONN_EOF on EOF or
- *                 another negative error code.
- */
 int ssl_fetch_input( ssl_context *ssl, size_t nb_want );
 
 int ssl_write_record( ssl_context *ssl );
@@ -1977,6 +2328,45 @@
                           int cert_endpoint );
 #endif /* POLARSSL_X509_CRT_PARSE_C */
 
+void ssl_write_version( int major, int minor, int transport,
+                        unsigned char ver[2] );
+void ssl_read_version( int *major, int *minor, int transport,
+                       const unsigned char ver[2] );
+
+static inline size_t ssl_hdr_len( const ssl_context *ssl )
+{
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        return( 13 );
+#else
+    ((void) ssl);
+#endif
+    return( 5 );
+}
+
+static inline size_t ssl_hs_hdr_len( const ssl_context *ssl )
+{
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        return( 12 );
+#else
+    ((void) ssl);
+#endif
+    return( 4 );
+}
+
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+void ssl_send_flight_completed( ssl_context *ssl );
+void ssl_recv_flight_completed( ssl_context *ssl );
+int ssl_resend( ssl_context *ssl );
+#endif
+
+/* Visible for testing purposes only */
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+int ssl_dtls_replay_check( ssl_context *ssl );
+void ssl_dtls_replay_update( ssl_context *ssl );
+#endif
+
 /* constant-time buffer comparison */
 static inline int safer_memcmp( const void *a, const void *b, size_t n )
 {
diff --git a/include/polarssl/ssl_cache.h b/include/mbedtls/ssl_cache.h
similarity index 100%
rename from include/polarssl/ssl_cache.h
rename to include/mbedtls/ssl_cache.h
diff --git a/include/polarssl/ssl_ciphersuites.h b/include/mbedtls/ssl_ciphersuites.h
similarity index 99%
rename from include/polarssl/ssl_ciphersuites.h
rename to include/mbedtls/ssl_ciphersuites.h
index 1fcf4c7..bc8424c 100644
--- a/include/polarssl/ssl_ciphersuites.h
+++ b/include/mbedtls/ssl_ciphersuites.h
@@ -263,6 +263,7 @@
 #define POLARSSL_CIPHERSUITE_WEAK       0x01    /**< Weak ciphersuite flag  */
 #define POLARSSL_CIPHERSUITE_SHORT_TAG  0x02    /**< Short authentication tag,
                                                      eg for CCM_8 */
+#define POLARSSL_CIPHERSUITE_NODTLS     0x04    /**< Can't be used with DTLS */
 
 /**
  * \brief   This structure is used for storing ciphersuite information
diff --git a/include/mbedtls/ssl_cookie.h b/include/mbedtls/ssl_cookie.h
new file mode 100644
index 0000000..b00266c
--- /dev/null
+++ b/include/mbedtls/ssl_cookie.h
@@ -0,0 +1,102 @@
+/**
+ * \file ssl_cookie.h
+ *
+ * \brief DTLS cookie callbacks implementation
+ *
+ *  Copyright (C) 2014, Brainspark B.V.
+ *
+ *  This file is part of mbed TLS (https://tls.mbed.org)
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+#ifndef POLARSSL_SSL_COOKIE_H
+#define POLARSSL_SSL_COOKIE_H
+
+#include "ssl.h"
+
+/**
+ * \name SECTION: Module settings
+ *
+ * The configuration options you can set for this module are in this section.
+ * Either change them in config.h or define them on the compiler command line.
+ * \{
+ */
+#ifndef POLARSSL_SSL_COOKIE_TIMEOUT
+#define POLARSSL_SSL_COOKIE_TIMEOUT     60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */
+#endif
+
+/* \} name SECTION: Module settings */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * \brief          Context for the default cookie functions.
+ */
+typedef struct
+{
+    md_context_t    hmac_ctx;   /*!< context for the HMAC portion   */
+#if !defined(POLARSSL_HAVE_TIME)
+    unsigned long   serial;     /*!< serial number for expiration   */
+#endif
+    unsigned long   timeout;    /*!< timeout delay, in seconds if HAVE_TIME,
+                                     or in number of tickets issued */
+
+} ssl_cookie_ctx;
+
+/**
+ * \brief          Initialize cookie context
+ */
+void ssl_cookie_init( ssl_cookie_ctx *ctx );
+
+/**
+ * \brief          Setup cookie context (generate keys)
+ */
+int ssl_cookie_setup( ssl_cookie_ctx *ctx,
+                      int (*f_rng)(void *, unsigned char *, size_t),
+                      void *p_rng );
+
+/**
+ * \brief          Set expiration delay for cookies
+ *                 (Default POLARSSL_SSL_COOKIE_TIMEOUT)
+ *
+ * \param ctx      Cookie contex
+ * \param delay    Delay, in seconds if HAVE_TIME, or in number of cookies
+ *                 issued in the meantime.
+ *                 0 to disable expiration (NOT recommended)
+ */
+void ssl_cookie_set_timeout( ssl_cookie_ctx *ctx, unsigned long delay );
+
+/**
+ * \brief          Free cookie context
+ */
+void ssl_cookie_free( ssl_cookie_ctx *ctx );
+
+/**
+ * \brief          Generate cookie, see \c ssl_cookie_write_t
+ */
+ssl_cookie_write_t ssl_cookie_write;
+
+/**
+ * \brief          Verify cookie, see \c ssl_cookie_write_t
+ */
+ssl_cookie_check_t ssl_cookie_check;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* ssl_cookie.h */
diff --git a/include/polarssl/threading.h b/include/mbedtls/threading.h
similarity index 98%
rename from include/polarssl/threading.h
rename to include/mbedtls/threading.h
index 293da38..a60dc3d 100644
--- a/include/polarssl/threading.h
+++ b/include/mbedtls/threading.h
@@ -64,7 +64,7 @@
                        int (*mutex_free)( threading_mutex_t * ),
                        int (*mutex_lock)( threading_mutex_t * ),
                        int (*mutex_unlock)( threading_mutex_t * ) );
-#endif /* POLARSSL_THREADING_ALT_C */
+#endif /* POLARSSL_THREADING_ALT */
 
 /*
  * The function pointers for mutex_init, mutex_free, mutex_ and mutex_unlock
diff --git a/include/polarssl/timing.h b/include/mbedtls/timing.h
similarity index 100%
rename from include/polarssl/timing.h
rename to include/mbedtls/timing.h
diff --git a/include/polarssl/version.h b/include/mbedtls/version.h
similarity index 93%
rename from include/polarssl/version.h
rename to include/mbedtls/version.h
index 9ffba29..df2987b 100644
--- a/include/polarssl/version.h
+++ b/include/mbedtls/version.h
@@ -39,17 +39,17 @@
  * Major, Minor, Patchlevel
  */
 #define POLARSSL_VERSION_MAJOR  1
-#define POLARSSL_VERSION_MINOR  3
-#define POLARSSL_VERSION_PATCH  10
+#define POLARSSL_VERSION_MINOR  4
+#define POLARSSL_VERSION_PATCH  0
 
 /**
  * The single version number has the following structure:
  *    MMNNPP00
  *    Major version | Minor version | Patch version
  */
-#define POLARSSL_VERSION_NUMBER         0x01030A00
-#define POLARSSL_VERSION_STRING         "1.3.10"
-#define POLARSSL_VERSION_STRING_FULL    "mbed TLS 1.3.10"
+#define POLARSSL_VERSION_NUMBER         0x01040000
+#define POLARSSL_VERSION_STRING         "1.4.0"
+#define POLARSSL_VERSION_STRING_FULL    "mbed TLS 1.4.0"
 
 #if defined(POLARSSL_VERSION_C)
 
diff --git a/include/polarssl/x509.h b/include/mbedtls/x509.h
similarity index 99%
rename from include/polarssl/x509.h
rename to include/mbedtls/x509.h
index 268121d..ffbf976 100644
--- a/include/polarssl/x509.h
+++ b/include/mbedtls/x509.h
@@ -179,7 +179,7 @@
 
 /**
  * Container for ASN1 named information objects.
- * It allows for Relative Distinguished Names (e.g. cn=polarssl,ou=code,etc.).
+ * It allows for Relative Distinguished Names (e.g. cn=localhost,ou=code,etc.).
  */
 typedef asn1_named_data x509_name;
 
diff --git a/include/polarssl/x509_crl.h b/include/mbedtls/x509_crl.h
similarity index 100%
rename from include/polarssl/x509_crl.h
rename to include/mbedtls/x509_crl.h
diff --git a/include/polarssl/x509_crt.h b/include/mbedtls/x509_crt.h
similarity index 99%
rename from include/polarssl/x509_crt.h
rename to include/mbedtls/x509_crt.h
index fe27007..fe1d97f 100644
--- a/include/polarssl/x509_crt.h
+++ b/include/mbedtls/x509_crt.h
@@ -174,7 +174,7 @@
  *                 correctly, the first error is returned.
  *
  * \warning        This function is NOT thread-safe unless
- *                 POLARSSL_THREADING_PTHREADS is defined. If you're using an
+ *                 POLARSSL_THREADING_PTHREAD is defined. If you're using an
  *                 alternative threading implementation, you should either use
  *                 this function only in the main thread, or mutex it.
  *
diff --git a/include/polarssl/x509_csr.h b/include/mbedtls/x509_csr.h
similarity index 100%
rename from include/polarssl/x509_csr.h
rename to include/mbedtls/x509_csr.h
diff --git a/include/polarssl/xtea.h b/include/mbedtls/xtea.h
similarity index 100%
rename from include/polarssl/xtea.h
rename to include/mbedtls/xtea.h
diff --git a/include/polarssl/compat-1.2.h b/include/polarssl/compat-1.2.h
deleted file mode 100644
index f7f3d00..0000000
--- a/include/polarssl/compat-1.2.h
+++ /dev/null
@@ -1,386 +0,0 @@
-/**
- * \file compat-1.2.h
- *
- * \brief Backwards compatibility header for PolarSSL-1.2 from PolarSSL-1.3
- *
- *  Copyright (C) 2006-2013, ARM Limited, All Rights Reserved
- *
- *  This file is part of mbed TLS (https://tls.mbed.org)
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- */
-#ifndef POLARSSL_COMPAT_1_2_H
-#define POLARSSL_COMPAT_1_2_H
-
-#if !defined(POLARSSL_CONFIG_FILE)
-#include "config.h"
-#else
-#include POLARSSL_CONFIG_FILE
-#endif
-
-// Comment out to disable prototype change warnings
-#define SHOW_PROTOTYPE_CHANGE_WARNINGS
-
-#if defined(_MSC_VER) && !defined(inline)
-#define inline _inline
-#else
-#if defined(__ARMCC_VERSION) && !defined(inline)
-#define inline __inline
-#endif /* __ARMCC_VERSION */
-#endif /* _MSC_VER */
-
-#if defined(_MSC_VER)
-// MSVC does not support #warning
-#undef SHOW_PROTOTYPE_CHANGE_WARNINGS
-#endif
-
-#if defined(SHOW_PROTOTYPE_CHANGE_WARNINGS)
-#warning "You can disable these warnings by commenting SHOW_PROTOTYPE_CHANGE_WARNINGS in compat-1.2.h"
-#endif
-
-#if defined(POLARSSL_SHA256_C)
-#define POLARSSL_SHA2_C
-#include "sha256.h"
-
-/*
- * SHA-2 -> SHA-256
- */
-typedef sha256_context sha2_context;
-
-static inline void sha2_starts( sha256_context *ctx, int is224 ) {
-    sha256_starts( ctx, is224 );
-}
-static inline void sha2_update( sha256_context *ctx, const unsigned char *input,
-                         size_t ilen ) {
-    sha256_update( ctx, input, ilen );
-}
-static inline void sha2_finish( sha256_context *ctx, unsigned char output[32] ) {
-    sha256_finish( ctx, output );
-}
-static inline int sha2_file( const char *path, unsigned char output[32], int is224 ) {
-    return sha256_file( path, output, is224 );
-}
-static inline void sha2( const unsigned char *input, size_t ilen,
-                  unsigned char output[32], int is224 ) {
-    sha256( input, ilen, output, is224 );
-}
-static inline void sha2_hmac_starts( sha256_context *ctx, const unsigned char *key,
-                              size_t keylen, int is224 ) {
-    sha256_hmac_starts( ctx, key, keylen, is224 );
-}
-static inline void sha2_hmac_update( sha256_context *ctx, const unsigned char *input, size_t ilen ) {
-    sha256_hmac_update( ctx, input, ilen );
-}
-static inline void sha2_hmac_finish( sha256_context *ctx, unsigned char output[32] ) {
-    sha256_hmac_finish( ctx, output );
-}
-static inline void sha2_hmac_reset( sha256_context *ctx ) {
-    sha256_hmac_reset( ctx );
-}
-static inline void sha2_hmac( const unsigned char *key, size_t keylen,
-                       const unsigned char *input, size_t ilen,
-                       unsigned char output[32], int is224 ) {
-    sha256_hmac( key, keylen, input, ilen, output, is224 );
-}
-static inline int sha2_self_test( int verbose ) {
-    return sha256_self_test( verbose );
-}
-#endif /* POLARSSL_SHA256_C */
-
-#if defined(POLARSSL_SHA512_C)
-#define POLARSSL_SHA4_C
-#include "sha512.h"
-
-/*
- * SHA-4 -> SHA-512
- */
-typedef sha512_context sha4_context;
-
-static inline void sha4_starts( sha512_context *ctx, int is384 ) {
-    sha512_starts( ctx, is384 );
-}
-static inline void sha4_update( sha512_context *ctx, const unsigned char *input,
-                         size_t ilen ) {
-    sha512_update( ctx, input, ilen );
-}
-static inline void sha4_finish( sha512_context *ctx, unsigned char output[64] ) {
-    sha512_finish( ctx, output );
-}
-static inline int sha4_file( const char *path, unsigned char output[64], int is384 ) {
-    return sha512_file( path, output, is384 );
-}
-static inline void sha4( const unsigned char *input, size_t ilen,
-                  unsigned char output[32], int is384 ) {
-    sha512( input, ilen, output, is384 );
-}
-static inline void sha4_hmac_starts( sha512_context *ctx, const unsigned char *key,
-                              size_t keylen, int is384 ) {
-    sha512_hmac_starts( ctx, key, keylen, is384 );
-}
-static inline void sha4_hmac_update( sha512_context *ctx, const unsigned char *input, size_t ilen ) {
-    sha512_hmac_update( ctx, input, ilen );
-}
-static inline void sha4_hmac_finish( sha512_context *ctx, unsigned char output[64] ) {
-    sha512_hmac_finish( ctx, output );
-}
-static inline void sha4_hmac_reset( sha512_context *ctx ) {
-    sha512_hmac_reset( ctx );
-}
-static inline void sha4_hmac( const unsigned char *key, size_t keylen,
-                       const unsigned char *input, size_t ilen,
-                       unsigned char output[64], int is384 ) {
-    sha512_hmac( key, keylen, input, ilen, output, is384 );
-}
-static inline int sha4_self_test( int verbose ) {
-    return sha512_self_test( verbose );
-}
-#endif /* POLARSSL_SHA512_C */
-
-#if defined(POLARSSL_CIPHER_C)
-#if defined(SHOW_PROTOTYPE_CHANGE_WARNINGS)
-#warning "cipher_reset() prototype changed. Manual change required if used"
-#endif
-#endif
-
-#if defined(POLARSSL_RSA_C)
-#define SIG_RSA_RAW     POLARSSL_MD_NONE
-#define SIG_RSA_MD2     POLARSSL_MD_MD2
-#define SIG_RSA_MD4     POLARSSL_MD_MD4
-#define SIG_RSA_MD5     POLARSSL_MD_MD5
-#define SIG_RSA_SHA1    POLARSSL_MD_SHA1
-#define SIG_RSA_SHA224  POLARSSL_MD_SHA224
-#define SIG_RSA_SHA256  POLARSSL_MD_SHA256
-#define SIG_RSA_SHA384  POLARSSL_MD_SHA384
-#define SIG_RSA_SHA512  POLARSSL_MD_SHA512
-#if defined(SHOW_PROTOTYPE_CHANGE_WARNINGS)
-#warning "rsa_pkcs1_verify() prototype changed. Manual change required if used"
-#warning "rsa_pkcs1_decrypt() prototype changed. Manual change required if used"
-#endif
-#endif /* POLARSSL_RSA_C */
-
-#if defined(POLARSSL_DHM_C)
-#if defined(SHOW_PROTOTYPE_CHANGE_WARNINGS)
-#warning "dhm_calc_secret() prototype changed. Manual change required if used"
-#endif
-#endif
-
-#if defined(POLARSSL_GCM_C)
-#if defined(SHOW_PROTOTYPE_CHANGE_WARNINGS)
-#warning "gcm_init() prototype changed. Manual change required if used"
-#endif
-#endif
-
-#if defined(POLARSSL_SSL_CLI_C)
-#if defined(SHOW_PROTOTYPE_CHANGE_WARNINGS)
-#warning "ssl_set_own_cert() prototype changed. Change to ssl_set_own_cert_rsa(). Manual change required if used"
-#endif
-#endif
-
-#if defined(POLARSSL_X509_USE_C) || defined(POLARSSL_X509_CREATE_C)
-#include "x509.h"
-
-#define POLARSSL_ERR_X509_CERT_INVALID_FORMAT POLARSSL_ERR_X509_INVALID_FORMAT
-#define POLARSSL_ERR_X509_CERT_INVALID_VERSION POLARSSL_ERR_X509_INVALID_VERSION
-#define POLARSSL_ERR_X509_CERT_INVALID_ALG POLARSSL_ERR_X509_INVALID_ALG
-#define POLARSSL_ERR_X509_CERT_UNKNOWN_SIG_ALG POLARSSL_ERR_X509_UNKNOWN_SIG_ALG
-#define POLARSSL_ERR_X509_CERT_INVALID_NAME POLARSSL_ERR_X509_INVALID_NAME
-#define POLARSSL_ERR_X509_CERT_INVALID_DATE POLARSSL_ERR_X509_INVALID_DATE
-#define POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS POLARSSL_ERR_X509_INVALID_EXTENSIONS
-#define POLARSSL_ERR_X509_CERT_SIG_MISMATCH POLARSSL_ERR_X509_SIG_MISMATCH
-#define POLARSSL_ERR_X509_CERT_INVALID_SIGNATURE POLARSSL_ERR_X509_INVALID_SIGNATURE
-#define POLARSSL_ERR_X509_CERT_INVALID_SERIAL POLARSSL_ERR_X509_INVALID_SERIAL
-#define POLARSSL_ERR_X509_CERT_UNKNOWN_VERSION POLARSSL_ERR_X509_UNKNOWN_VERSION
-
-static inline int x509parse_serial_gets( char *buf, size_t size, const x509_buf *serial ) {
-    return x509_serial_gets( buf, size, serial );
-}
-static inline int x509parse_dn_gets( char *buf, size_t size, const x509_name *dn ) {
-    return x509_dn_gets( buf, size, dn );
-}
-static inline int x509parse_time_expired( const x509_time *time ) {
-    return x509_time_expired( time );
-}
-#endif /* POLARSSL_X509_USE_C || POLARSSL_X509_CREATE_C */
-
-#if defined(POLARSSL_X509_CRT_PARSE_C)
-#define POLARSSL_X509_PARSE_C
-#include "x509_crt.h"
-typedef x509_crt x509_cert;
-
-static inline int x509parse_crt_der( x509_cert *chain, const unsigned char *buf,
-                              size_t buflen ) {
-    return x509_crt_parse_der( chain, buf, buflen );
-}
-static inline int x509parse_crt( x509_cert *chain, const unsigned char *buf, size_t buflen ) {
-    return x509_crt_parse( chain, buf, buflen );
-}
-static inline int x509parse_crtfile( x509_cert *chain, const char *path ) {
-    return x509_crt_parse_file( chain, path );
-}
-static inline int x509parse_crtpath( x509_cert *chain, const char *path ) {
-    return x509_crt_parse_path( chain, path );
-}
-static inline int x509parse_cert_info( char *buf, size_t size, const char *prefix,
-                                const x509_cert *crt ) {
-    return x509_crt_info( buf, size, prefix, crt );
-}
-static inline int x509parse_verify( x509_cert *crt, x509_cert *trust_ca,
-                             x509_crl *ca_crl, const char *cn, int *flags,
-                             int (*f_vrfy)(void *, x509_cert *, int, int *),
-                             void *p_vrfy ) {
-    return x509_crt_verify( crt, trust_ca, ca_crl, cn, flags, f_vrfy, p_vrfy );
-}
-static inline int x509parse_revoked( const x509_cert *crt, const x509_crl *crl ) {
-    return x509_crt_revoked( crt, crl );
-}
-static inline void x509_free( x509_cert *crt ) {
-    x509_crt_free( crt );
-}
-#endif /* POLARSSL_X509_CRT_PARSE_C */
-
-#if defined(POLARSSL_X509_CRL_PARSE_C)
-#define POLARSSL_X509_PARSE_C
-#include "x509_crl.h"
-static inline int x509parse_crl( x509_crl *chain, const unsigned char *buf, size_t buflen ) {
-    return x509_crl_parse( chain, buf, buflen );
-}
-static inline int x509parse_crlfile( x509_crl *chain, const char *path ) {
-    return x509_crl_parse_file( chain, path );
-}
-static inline int x509parse_crl_info( char *buf, size_t size, const char *prefix,
-                               const x509_crl *crl ) {
-    return x509_crl_info( buf, size, prefix, crl );
-}
-#endif /* POLARSSL_X509_CRL_PARSE_C */
-
-#if defined(POLARSSL_X509_CSR_PARSE_C)
-#define POLARSSL_X509_PARSE_C
-#include "x509_csr.h"
-static inline int x509parse_csr( x509_csr *csr, const unsigned char *buf, size_t buflen ) {
-    return x509_csr_parse( csr, buf, buflen );
-}
-static inline int x509parse_csrfile( x509_csr *csr, const char *path ) {
-    return x509_csr_parse_file( csr, path );
-}
-static inline int x509parse_csr_info( char *buf, size_t size, const char *prefix,
-                               const x509_csr *csr ) {
-    return x509_csr_info( buf, size, prefix, csr );
-}
-#endif /* POLARSSL_X509_CSR_PARSE_C */
-
-#if defined(POLARSSL_SSL_TLS_C)
-#include "ssl_ciphersuites.h"
-
-#define ssl_default_ciphersuites ssl_list_ciphersuites()
-#endif
-
-#if defined(POLARSSL_PK_PARSE_C) && defined(POLARSSL_RSA_C)
-#include "rsa.h"
-#include "pk.h"
-
-#define POLARSSL_ERR_X509_PASSWORD_MISMATCH POLARSSL_ERR_PK_PASSWORD_MISMATCH
-#define POLARSSL_ERR_X509_KEY_INVALID_FORMAT POLARSSL_ERR_PK_KEY_INVALID_FORMAT
-#define POLARSSL_ERR_X509_UNKNOWN_PK_ALG POLARSSL_ERR_PK_UNKNOWN_PK_ALG
-#define POLARSSL_ERR_X509_CERT_INVALID_PUBKEY POLARSSL_ERR_PK_INVALID_PUBKEY
-
-#if defined(POLARSSL_FS_IO)
-static inline int x509parse_keyfile( rsa_context *rsa, const char *path,
-                              const char *pwd ) {
-    int ret;
-    pk_context pk;
-    pk_init( &pk );
-    ret = pk_parse_keyfile( &pk, path, pwd );
-    if( ret == 0 && ! pk_can_do( &pk, POLARSSL_PK_RSA ) )
-        ret = POLARSSL_ERR_PK_TYPE_MISMATCH;
-    if( ret == 0 )
-        rsa_copy( rsa, pk_rsa( pk ) );
-    else
-        rsa_free( rsa );
-    pk_free( &pk );
-    return( ret );
-}
-static inline int x509parse_public_keyfile( rsa_context *rsa, const char *path ) {
-    int ret;
-    pk_context pk;
-    pk_init( &pk );
-    ret = pk_parse_public_keyfile( &pk, path );
-    if( ret == 0 && ! pk_can_do( &pk, POLARSSL_PK_RSA ) )
-        ret = POLARSSL_ERR_PK_TYPE_MISMATCH;
-    if( ret == 0 )
-        rsa_copy( rsa, pk_rsa( pk ) );
-    else
-        rsa_free( rsa );
-    pk_free( &pk );
-    return( ret );
-}
-#endif /* POLARSSL_FS_IO */
-
-static inline int x509parse_key( rsa_context *rsa, const unsigned char *key,
-                          size_t keylen,
-                          const unsigned char *pwd, size_t pwdlen ) {
-    int ret;
-    pk_context pk;
-    pk_init( &pk );
-    ret = pk_parse_key( &pk, key, keylen, pwd, pwdlen );
-    if( ret == 0 && ! pk_can_do( &pk, POLARSSL_PK_RSA ) )
-        ret = POLARSSL_ERR_PK_TYPE_MISMATCH;
-    if( ret == 0 )
-        rsa_copy( rsa, pk_rsa( pk ) );
-    else
-        rsa_free( rsa );
-    pk_free( &pk );
-    return( ret );
-}
-
-static inline int x509parse_public_key( rsa_context *rsa,
-                                 const unsigned char *key, size_t keylen )
-{
-    int ret;
-    pk_context pk;
-    pk_init( &pk );
-    ret = pk_parse_public_key( &pk, key, keylen );
-    if( ret == 0 && ! pk_can_do( &pk, POLARSSL_PK_RSA ) )
-        ret = POLARSSL_ERR_PK_TYPE_MISMATCH;
-    if( ret == 0 )
-        rsa_copy( rsa, pk_rsa( pk ) );
-    else
-        rsa_free( rsa );
-    pk_free( &pk );
-    return( ret );
-}
-#endif /* POLARSSL_PK_PARSE_C && POLARSSL_RSA_C */
-
-#if defined(POLARSSL_PK_WRITE_C) && defined(POLARSSL_RSA_C)
-#include "pk.h"
-static inline int x509_write_pubkey_der( unsigned char *buf, size_t len, rsa_context *rsa ) {
-    int ret;
-    pk_context ctx;
-    if( ( ret = pk_init_ctx( &ctx, pk_info_from_type( POLARSSL_PK_RSA ) ) ) != 0 ) return( ret );
-    if( ( ret = rsa_copy( pk_rsa( ctx ), rsa ) ) != 0 ) return( ret );
-    ret = pk_write_pubkey_der( &ctx, buf, len );
-    pk_free( &ctx );
-    return( ret );
-}
-static inline int x509_write_key_der( unsigned char *buf, size_t len, rsa_context *rsa ) {
-    int ret;
-    pk_context ctx;
-    if( ( ret = pk_init_ctx( &ctx, pk_info_from_type( POLARSSL_PK_RSA ) ) ) != 0 ) return( ret );
-    if( ( ret = rsa_copy( pk_rsa( ctx ), rsa ) ) != 0 ) return( ret );
-    ret = pk_write_key_der( &ctx, buf, len );
-    pk_free( &ctx );
-    return( ret );
-}
-#endif /* POLARSSL_PK_WRITE_C && POLARSSL_RSA_C */
-#endif /* compat-1.2.h */
diff --git a/include/polarssl/openssl.h b/include/polarssl/openssl.h
deleted file mode 100644
index 63c16e5..0000000
--- a/include/polarssl/openssl.h
+++ /dev/null
@@ -1,137 +0,0 @@
-/**
- * \file openssl.h
- *
- * \brief OpenSSL wrapper (definitions, inline functions).
- *
- *  Copyright (C) 2006-2010, ARM Limited, All Rights Reserved
- *
- *  This file is part of mbed TLS (https://tls.mbed.org)
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- */
-/*
- * OpenSSL wrapper contributed by David Barett
- */
-#ifndef POLARSSL_OPENSSL_H
-#define POLARSSL_OPENSSL_H
-
-#include "aes.h"
-#include "md5.h"
-#include "rsa.h"
-#include "sha1.h"
-
-#define AES_SIZE                16
-#define AES_BLOCK_SIZE          16
-#define AES_KEY                 aes_context
-#define MD5_CTX                 md5_context
-#define SHA_CTX                 sha1_context
-
-#define SHA1_Init( CTX ) \
-        sha1_starts( (CTX) )
-#define SHA1_Update(  CTX, BUF, LEN ) \
-        sha1_update( (CTX), (unsigned char *)(BUF), (LEN) )
-#define SHA1_Final( OUT, CTX ) \
-        sha1_finish( (CTX), (OUT) )
-
-#define MD5_Init( CTX ) \
-        md5_starts( (CTX) )
-#define MD5_Update( CTX, BUF, LEN ) \
-        md5_update( (CTX), (unsigned char *)(BUF), (LEN) )
-#define MD5_Final( OUT, CTX ) \
-        md5_finish( (CTX), (OUT) )
-
-#define AES_set_encrypt_key( KEY, KEYSIZE, CTX ) \
-        aes_setkey_enc( (CTX), (KEY), (KEYSIZE) )
-#define AES_set_decrypt_key( KEY, KEYSIZE, CTX ) \
-        aes_setkey_dec( (CTX), (KEY), (KEYSIZE) )
-#define AES_cbc_encrypt( INPUT, OUTPUT, LEN, CTX, IV, MODE ) \
-        aes_crypt_cbc( (CTX), (MODE), (LEN), (IV), (INPUT), (OUTPUT) )
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/*
- * RSA stuff follows. TODO: needs cleanup
- */
-inline int __RSA_Passthrough( void *output, void *input, int size )
-{
-    memcpy( output, input, size );
-    return size;
-}
-
-inline rsa_context* d2i_RSA_PUBKEY( void *ignore, unsigned char **bufptr,
-                                    int len )
-{
-    unsigned char *buffer = *(unsigned char **) bufptr;
-    rsa_context *rsa;
-
-    /*
-     * Not a general-purpose parser: only parses public key from *exactly*
-     *   openssl genrsa -out privkey.pem 512 (or 1024)
-     *   openssl rsa -in privkey.pem -out privatekey.der -outform der
-     *   openssl rsa -in privkey.pem -out pubkey.der -outform der -pubout
-     *
-     * TODO: make a general-purpose parse
-     */
-    if( ignore != 0 || ( len != 94 && len != 162 ) )
-        return( 0 );
-
-    rsa = (rsa_context *) malloc( sizeof( rsa_rsa ) );
-    if( rsa == NULL )
-        return( 0 );
-
-    memset( rsa, 0, sizeof( rsa_context ) );
-
-    if( ( len ==  94 &&
-          mpi_read_binary( &rsa->N, &buffer[ 25],  64 ) == 0 &&
-          mpi_read_binary( &rsa->E, &buffer[ 91],   3 ) == 0 ) ||
-        ( len == 162 &&
-          mpi_read_binary( &rsa->N, &buffer[ 29], 128 ) == 0 ) &&
-          mpi_read_binary( &rsa->E, &buffer[159],   3 ) == 0 )
-    {
-        /*
-         * key read successfully
-         */
-        rsa->len = ( mpi_msb( &rsa->N ) + 7 ) >> 3;
-        return( rsa );
-    }
-    else
-    {
-        memset( rsa, 0, sizeof( rsa_context ) );
-        free( rsa );
-        return( 0 );
-    }
-}
-
-#define RSA                     rsa_context
-#define RSA_PKCS1_PADDING       1 /* ignored; always encrypt with this */
-#define RSA_size( CTX )         (CTX)->len
-#define RSA_free( CTX )         rsa_free( CTX )
-#define ERR_get_error( )        "ERR_get_error() not supported"
-#define RSA_blinding_off( IGNORE )
-
-#define d2i_RSAPrivateKey( a, b, c ) new rsa_context /* TODO: C++ bleh */
-
-inline int RSA_public_decrypt ( int size, unsigned char* input, unsigned char* output, RSA* key, int ignore ) { int outsize=size; if( !rsa_pkcs1_decrypt( key, RSA_PUBLIC,  &outsize, input, output ) ) return outsize; else return -1; }
-inline int RSA_private_decrypt( int size, unsigned char* input, unsigned char* output, RSA* key, int ignore ) { int outsize=size; if( !rsa_pkcs1_decrypt( key, RSA_PRIVATE, &outsize, input, output ) ) return outsize; else return -1; }
-inline int RSA_public_encrypt ( int size, unsigned char* input, unsigned char* output, RSA* key, int ignore ) { if( !rsa_pkcs1_encrypt( key, RSA_PUBLIC,  size, input, output ) ) return RSA_size(key); else return -1; }
-inline int RSA_private_encrypt( int size, unsigned char* input, unsigned char* output, RSA* key, int ignore ) { if( !rsa_pkcs1_encrypt( key, RSA_PRIVATE, size, input, output ) ) return RSA_size(key); else return -1; }
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* openssl.h */
diff --git a/library/.gitignore b/library/.gitignore
index 09d13d2..54e4276 100644
--- a/library/.gitignore
+++ b/library/.gitignore
@@ -1,5 +1,4 @@
 *.o
-libpolarssl.*
 libmbedtls.*
 *.sln
 *.vcxproj
diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt
index 1116a58..b67fb2c 100644
--- a/library/CMakeLists.txt
+++ b/library/CMakeLists.txt
@@ -55,6 +55,7 @@
      sha256.c
      sha512.c
      ssl_cache.c
+     ssl_cookie.c
      ssl_ciphersuites.c
      ssl_cli.c
      ssl_srv.c
@@ -82,7 +83,7 @@
 endif(CMAKE_COMPILER_IS_GNUCC)
 
 if(CMAKE_COMPILER_IS_CLANG)
-  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wmissing-declarations -Wmissing-prototypes -Wdocumentation -Wunreachable-code")
+  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wmissing-declarations -Wmissing-prototypes -Wdocumentation -Wno-documentation-deprecated-sync -Wunreachable-code")
 endif(CMAKE_COMPILER_IS_CLANG)
 
 if (NOT USE_STATIC_MBEDTLS_LIBRARY AND NOT USE_SHARED_MBEDTLS_LIBRARY)
@@ -117,7 +118,7 @@
 
 if(USE_SHARED_MBEDTLS_LIBRARY)
 	add_library(mbedtls SHARED ${src})
-	set_target_properties(mbedtls PROPERTIES VERSION 1.3.10 SOVERSION 8)
+	set_target_properties(mbedtls PROPERTIES VERSION 1.4.0 SOVERSION 8)
 
 	target_link_libraries(mbedtls ${libs})
 
@@ -133,24 +134,3 @@
 			DESTINATION ${LIB_INSTALL_DIR}
 			PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
 endif(USE_SHARED_MBEDTLS_LIBRARY)
-
-if(UNIX)
-    add_custom_target(polarssl
-        DEPENDS mbedtls # TODO: and mbedtls_static is shared is defined
-        COMMAND ${CMAKE_SOURCE_DIR}/scripts/polarssl_symlinks.sh ${CMAKE_BINARY_DIR}/library
-        )
-
-    if(USE_STATIC_MBEDTLS_LIBRARY AND USE_SHARED_MBEDTLS_LIBRARY)
-        add_dependencies(polarssl mbedtls_static)
-    endif()
-
-    add_custom_target(polarssl-clean
-        COMMAND make clean
-        COMMAND rm -f ${CMAKE_BINARY_DIR}/library/libpolarssl.*
-        )
-
-    add_custom_target(polarssl-install
-        COMMAND make install
-        COMMAND ${CMAKE_SOURCE_DIR}/scripts/polarssl_symlinks.sh ${DESTDIR}/${CMAKE_INSTALL_PREFIX}/${LIB_INSTALL_DIR}
-        )
-endif(UNIX)
diff --git a/library/Makefile b/library/Makefile
index de00f75..81a164c 100644
--- a/library/Makefile
+++ b/library/Makefile
@@ -1,5 +1,5 @@
 
-# Also see "include/polarssl/config.h"
+# Also see "include/mbedtls/config.h"
 
 # To compile on MinGW: add "-lws2_32" to LDFLAGS or define WINDOWS in your
 # environment
@@ -63,6 +63,7 @@
 		pkwrite.o	platform.o	ripemd160.o		\
 		rsa.o		sha1.o		sha256.o		\
 		sha512.o	ssl_cache.o	ssl_cli.o		\
+		ssl_cookie.o							\
 		ssl_srv.o   ssl_ciphersuites.o			\
 		ssl_tls.o	threading.o	timing.o		\
 		version.o	version_features.o			\
@@ -79,17 +80,9 @@
 all: shared static
 endif
 
-static: libpolarssl.a
+static: libmbedtls.a
 
-shared: libpolarssl.$(DLEXT)
-
-libpolarssl.a: libmbedtls.a
-	echo "  LN    $@ -> $?"
-ifndef WINDOWS
-	ln -sf $? $@
-else
-	copy /y /b $? $@
-endif
+shared: libmbedtls.$(DLEXT)
 
 libmbedtls.a: $(OBJS)
 	echo "  AR    $@"
@@ -97,21 +90,6 @@
 	echo "  RL    $@"
 	$(AR) s $@
 
-libpolarssl.$(DLEXT): libmbedtls.$(DLEXT)
-	echo "  LN    $@ -> $?"
-ifndef WINDOWS
-	ln -sf $? $@
-else
-	copy /y /b $? $@
-endif
-ifdef WINDOWS_BUILD
-ifndef WINDOWS
-	ln -sf $?.a $@.a
-else
-	copy /y /b $?.a $@.a
-endif
-endif
-
 libmbedtls.$(SOEXT): $(OBJS)
 	echo "  LD    $@"
 	$(CC) ${LDFLAGS} -shared -Wl,-soname,$@ -o $@ $(OBJS)
@@ -134,8 +112,8 @@
 
 clean:
 ifndef WINDOWS
-	rm -f *.o libpolarssl.* libmbedtls.*
+	rm -f *.o libmbedtls.*
 endif
 ifdef WINDOWS
-	del /Q /F *.o libpolarssl.* libmbedtls.*
+	del /Q /F *.o libmbedtls.*
 endif
diff --git a/library/aes.c b/library/aes.c
index 9d96064..4567534 100644
--- a/library/aes.c
+++ b/library/aes.c
@@ -27,7 +27,7 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
@@ -36,17 +36,17 @@
 
 #include <string.h>
 
-#include "polarssl/aes.h"
+#include "mbedtls/aes.h"
 #if defined(POLARSSL_PADLOCK_C)
-#include "polarssl/padlock.h"
+#include "mbedtls/padlock.h"
 #endif
 #if defined(POLARSSL_AESNI_C)
-#include "polarssl/aesni.h"
+#include "mbedtls/aesni.h"
 #endif
 
 #if defined(POLARSSL_SELF_TEST)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/aesni.c b/library/aesni.c
index 5315aba..a6897b2 100644
--- a/library/aesni.c
+++ b/library/aesni.c
@@ -26,14 +26,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_AESNI_C)
 
-#include "polarssl/aesni.h"
+#include "mbedtls/aesni.h"
 
 #include <string.h>
 
diff --git a/library/arc4.c b/library/arc4.c
index 309d16a..e790579 100644
--- a/library/arc4.c
+++ b/library/arc4.c
@@ -26,20 +26,20 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_ARC4_C)
 
-#include "polarssl/arc4.h"
+#include "mbedtls/arc4.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_SELF_TEST)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/asn1parse.c b/library/asn1parse.c
index e4f46eb..202a6ce 100644
--- a/library/asn1parse.c
+++ b/library/asn1parse.c
@@ -21,23 +21,23 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_ASN1_PARSE_C)
 
-#include "polarssl/asn1.h"
+#include "mbedtls/asn1.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_BIGNUM_C)
-#include "polarssl/bignum.h"
+#include "mbedtls/bignum.h"
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #define polarssl_malloc     malloc
diff --git a/library/asn1write.c b/library/asn1write.c
index df9442e..7803867 100644
--- a/library/asn1write.c
+++ b/library/asn1write.c
@@ -21,19 +21,19 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_ASN1_WRITE_C)
 
-#include "polarssl/asn1write.h"
+#include "mbedtls/asn1write.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #define polarssl_malloc     malloc
diff --git a/library/base64.c b/library/base64.c
index ac922a4..5af79df 100644
--- a/library/base64.c
+++ b/library/base64.c
@@ -21,14 +21,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_BASE64_C)
 
-#include "polarssl/base64.h"
+#include "mbedtls/base64.h"
 
 #if defined(_MSC_VER) && !defined(EFIX64) && !defined(EFI32)
 #include <basetsd.h>
@@ -40,7 +40,7 @@
 #if defined(POLARSSL_SELF_TEST)
 #include <string.h>
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/bignum.c b/library/bignum.c
index da70ae0..86376a4 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -28,20 +28,20 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_BIGNUM_C)
 
-#include "polarssl/bignum.h"
-#include "polarssl/bn_mul.h"
+#include "mbedtls/bignum.h"
+#include "mbedtls/bn_mul.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/library/blowfish.c b/library/blowfish.c
index 77191e7..76ceb86 100644
--- a/library/blowfish.c
+++ b/library/blowfish.c
@@ -27,14 +27,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_BLOWFISH_C)
 
-#include "polarssl/blowfish.h"
+#include "mbedtls/blowfish.h"
 
 #include <string.h>
 
diff --git a/library/camellia.c b/library/camellia.c
index d80f51f..1aa6516 100644
--- a/library/camellia.c
+++ b/library/camellia.c
@@ -27,19 +27,20 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_CAMELLIA_C)
 
-#include "polarssl/camellia.h"
+#include "mbedtls/camellia.h"
+
+#include <string.h>
 
 #if defined(POLARSSL_SELF_TEST)
-#include <string.h>
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/ccm.c b/library/ccm.c
index 87f1886..6f3db01 100644
--- a/library/ccm.c
+++ b/library/ccm.c
@@ -30,20 +30,20 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_CCM_C)
 
-#include "polarssl/ccm.h"
+#include "mbedtls/ccm.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_SELF_TEST) && defined(POLARSSL_AES_C)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/certs.c b/library/certs.c
index 95fc8cc..bf12f77 100644
--- a/library/certs.c
+++ b/library/certs.c
@@ -21,7 +21,7 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
diff --git a/library/cipher.c b/library/cipher.c
index 8c7452b..5334851 100644
--- a/library/cipher.c
+++ b/library/cipher.c
@@ -25,25 +25,25 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_CIPHER_C)
 
-#include "polarssl/cipher.h"
-#include "polarssl/cipher_wrap.h"
+#include "mbedtls/cipher.h"
+#include "mbedtls/cipher_wrap.h"
 
 #include <stdlib.h>
 #include <string.h>
 
 #if defined(POLARSSL_GCM_C)
-#include "polarssl/gcm.h"
+#include "mbedtls/gcm.h"
 #endif
 
 #if defined(POLARSSL_CCM_C)
-#include "polarssl/ccm.h"
+#include "mbedtls/ccm.h"
 #endif
 
 #if defined(POLARSSL_ARC4_C) || defined(POLARSSL_CIPHER_NULL_CIPHER)
diff --git a/library/cipher_wrap.c b/library/cipher_wrap.c
index 4c170bc..4478cc8 100644
--- a/library/cipher_wrap.c
+++ b/library/cipher_wrap.c
@@ -25,41 +25,41 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_CIPHER_C)
 
-#include "polarssl/cipher_wrap.h"
+#include "mbedtls/cipher_wrap.h"
 
 #if defined(POLARSSL_AES_C)
-#include "polarssl/aes.h"
+#include "mbedtls/aes.h"
 #endif
 
 #if defined(POLARSSL_ARC4_C)
-#include "polarssl/arc4.h"
+#include "mbedtls/arc4.h"
 #endif
 
 #if defined(POLARSSL_CAMELLIA_C)
-#include "polarssl/camellia.h"
+#include "mbedtls/camellia.h"
 #endif
 
 #if defined(POLARSSL_DES_C)
-#include "polarssl/des.h"
+#include "mbedtls/des.h"
 #endif
 
 #if defined(POLARSSL_BLOWFISH_C)
-#include "polarssl/blowfish.h"
+#include "mbedtls/blowfish.h"
 #endif
 
 #if defined(POLARSSL_GCM_C)
-#include "polarssl/gcm.h"
+#include "mbedtls/gcm.h"
 #endif
 
 #if defined(POLARSSL_CCM_C)
-#include "polarssl/ccm.h"
+#include "mbedtls/ccm.h"
 #endif
 
 #if defined(POLARSSL_CIPHER_NULL_CIPHER)
@@ -67,7 +67,7 @@
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #define polarssl_malloc     malloc
diff --git a/library/ctr_drbg.c b/library/ctr_drbg.c
index 24adff0..c3f4b38 100644
--- a/library/ctr_drbg.c
+++ b/library/ctr_drbg.c
@@ -26,14 +26,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_CTR_DRBG_C)
 
-#include "polarssl/ctr_drbg.h"
+#include "mbedtls/ctr_drbg.h"
 
 #include <string.h>
 
@@ -43,7 +43,7 @@
 
 #if defined(POLARSSL_SELF_TEST)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/debug.c b/library/debug.c
index 825cc94..bb497b8 100644
--- a/library/debug.c
+++ b/library/debug.c
@@ -21,14 +21,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_DEBUG_C)
 
-#include "polarssl/debug.h"
+#include "mbedtls/debug.h"
 
 #include <stdarg.h>
 #include <stdio.h>
@@ -45,7 +45,7 @@
 #endif /* _MSC_VER */
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #define polarssl_snprintf snprintf
 #endif
diff --git a/library/des.c b/library/des.c
index 080e113..be7348b 100644
--- a/library/des.c
+++ b/library/des.c
@@ -27,20 +27,20 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_DES_C)
 
-#include "polarssl/des.h"
+#include "mbedtls/des.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_SELF_TEST)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/dhm.c b/library/dhm.c
index 9fb7a21..b72c7f0 100644
--- a/library/dhm.c
+++ b/library/dhm.c
@@ -26,27 +26,27 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_DHM_C)
 
-#include "polarssl/dhm.h"
+#include "mbedtls/dhm.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_PEM_PARSE_C)
-#include "polarssl/pem.h"
+#include "mbedtls/pem.h"
 #endif
 
 #if defined(POLARSSL_ASN1_PARSE_C)
-#include "polarssl/asn1.h"
+#include "mbedtls/asn1.h"
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #include <stdio.h>
@@ -552,7 +552,7 @@
 
 #if defined(POLARSSL_SELF_TEST)
 
-#include "polarssl/certs.h"
+#include "mbedtls/certs.h"
 
 /*
  * Checkup routine
diff --git a/library/ecdh.c b/library/ecdh.c
index 82fff27..5866c44 100644
--- a/library/ecdh.c
+++ b/library/ecdh.c
@@ -28,14 +28,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_ECDH_C)
 
-#include "polarssl/ecdh.h"
+#include "mbedtls/ecdh.h"
 
 #include <string.h>
 
diff --git a/library/ecdsa.c b/library/ecdsa.c
index 3f72d85..11cf18a 100644
--- a/library/ecdsa.c
+++ b/library/ecdsa.c
@@ -27,20 +27,20 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_ECDSA_C)
 
-#include "polarssl/ecdsa.h"
-#include "polarssl/asn1write.h"
+#include "mbedtls/ecdsa.h"
+#include "mbedtls/asn1write.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_ECDSA_DETERMINISTIC)
-#include "polarssl/hmac_drbg.h"
+#include "mbedtls/hmac_drbg.h"
 #endif
 
 #if defined(POLARSSL_ECDSA_DETERMINISTIC)
diff --git a/library/ecp.c b/library/ecp.c
index be6b0d5..63557ba 100644
--- a/library/ecp.c
+++ b/library/ecp.c
@@ -42,19 +42,19 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_ECP_C)
 
-#include "polarssl/ecp.h"
+#include "mbedtls/ecp.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #include <stdio.h>
diff --git a/library/ecp_curves.c b/library/ecp_curves.c
index 3786356..893bfa9 100644
--- a/library/ecp_curves.c
+++ b/library/ecp_curves.c
@@ -21,14 +21,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_ECP_C)
 
-#include "polarssl/ecp.h"
+#include "mbedtls/ecp.h"
 
 #include <string.h>
 
diff --git a/library/entropy.c b/library/entropy.c
index c90c7e4..fe271d3 100644
--- a/library/entropy.c
+++ b/library/entropy.c
@@ -21,15 +21,15 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_ENTROPY_C)
 
-#include "polarssl/entropy.h"
-#include "polarssl/entropy_poll.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/entropy_poll.h"
 
 #include <string.h>
 
@@ -39,7 +39,7 @@
 
 #if defined(POLARSSL_SELF_TEST)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -47,7 +47,7 @@
 #endif /* POLARSSL_SELF_TEST */
 
 #if defined(POLARSSL_HAVEGE_C)
-#include "polarssl/havege.h"
+#include "mbedtls/havege.h"
 #endif
 
 /* Implementation that should never be optimized out by the compiler */
diff --git a/library/entropy_poll.c b/library/entropy_poll.c
index 61eb3e7..e0eff16 100644
--- a/library/entropy_poll.c
+++ b/library/entropy_poll.c
@@ -21,22 +21,22 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_ENTROPY_C)
 
-#include "polarssl/entropy.h"
-#include "polarssl/entropy_poll.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/entropy_poll.h"
 
 #if defined(POLARSSL_TIMING_C)
 #include <string.h>
-#include "polarssl/timing.h"
+#include "mbedtls/timing.h"
 #endif
 #if defined(POLARSSL_HAVEGE_C)
-#include "polarssl/havege.h"
+#include "mbedtls/havege.h"
 #endif
 
 #if !defined(POLARSSL_NO_PLATFORM_ENTROPY)
diff --git a/library/error.c b/library/error.c
index 4d7b81c..38be879 100644
--- a/library/error.c
+++ b/library/error.c
@@ -21,18 +21,18 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_ERROR_C) || defined(POLARSSL_ERROR_STRERROR_DUMMY)
-#include "polarssl/error.h"
+#include "mbedtls/error.h"
 #include <string.h>
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #define polarssl_snprintf snprintf
 #endif
@@ -42,143 +42,143 @@
 #include <stdio.h>
 
 #if defined(POLARSSL_AES_C)
-#include "polarssl/aes.h"
+#include "mbedtls/aes.h"
 #endif
 
 #if defined(POLARSSL_BASE64_C)
-#include "polarssl/base64.h"
+#include "mbedtls/base64.h"
 #endif
 
 #if defined(POLARSSL_BIGNUM_C)
-#include "polarssl/bignum.h"
+#include "mbedtls/bignum.h"
 #endif
 
 #if defined(POLARSSL_BLOWFISH_C)
-#include "polarssl/blowfish.h"
+#include "mbedtls/blowfish.h"
 #endif
 
 #if defined(POLARSSL_CAMELLIA_C)
-#include "polarssl/camellia.h"
+#include "mbedtls/camellia.h"
 #endif
 
 #if defined(POLARSSL_CCM_C)
-#include "polarssl/ccm.h"
+#include "mbedtls/ccm.h"
 #endif
 
 #if defined(POLARSSL_CIPHER_C)
-#include "polarssl/cipher.h"
+#include "mbedtls/cipher.h"
 #endif
 
 #if defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/ctr_drbg.h"
+#include "mbedtls/ctr_drbg.h"
 #endif
 
 #if defined(POLARSSL_DES_C)
-#include "polarssl/des.h"
+#include "mbedtls/des.h"
 #endif
 
 #if defined(POLARSSL_DHM_C)
-#include "polarssl/dhm.h"
+#include "mbedtls/dhm.h"
 #endif
 
 #if defined(POLARSSL_ECP_C)
-#include "polarssl/ecp.h"
+#include "mbedtls/ecp.h"
 #endif
 
 #if defined(POLARSSL_ENTROPY_C)
-#include "polarssl/entropy.h"
+#include "mbedtls/entropy.h"
 #endif
 
 #if defined(POLARSSL_GCM_C)
-#include "polarssl/gcm.h"
+#include "mbedtls/gcm.h"
 #endif
 
 #if defined(POLARSSL_HMAC_DRBG_C)
-#include "polarssl/hmac_drbg.h"
+#include "mbedtls/hmac_drbg.h"
 #endif
 
 #if defined(POLARSSL_MD_C)
-#include "polarssl/md.h"
+#include "mbedtls/md.h"
 #endif
 
 #if defined(POLARSSL_MD2_C)
-#include "polarssl/md2.h"
+#include "mbedtls/md2.h"
 #endif
 
 #if defined(POLARSSL_MD4_C)
-#include "polarssl/md4.h"
+#include "mbedtls/md4.h"
 #endif
 
 #if defined(POLARSSL_MD5_C)
-#include "polarssl/md5.h"
+#include "mbedtls/md5.h"
 #endif
 
 #if defined(POLARSSL_NET_C)
-#include "polarssl/net.h"
+#include "mbedtls/net.h"
 #endif
 
 #if defined(POLARSSL_OID_C)
-#include "polarssl/oid.h"
+#include "mbedtls/oid.h"
 #endif
 
 #if defined(POLARSSL_PADLOCK_C)
-#include "polarssl/padlock.h"
+#include "mbedtls/padlock.h"
 #endif
 
 #if defined(POLARSSL_PBKDF2_C)
-#include "polarssl/pbkdf2.h"
+#include "mbedtls/pbkdf2.h"
 #endif
 
 #if defined(POLARSSL_PEM_PARSE_C) || defined(POLARSSL_PEM_WRITE_C)
-#include "polarssl/pem.h"
+#include "mbedtls/pem.h"
 #endif
 
 #if defined(POLARSSL_PK_C)
-#include "polarssl/pk.h"
+#include "mbedtls/pk.h"
 #endif
 
 #if defined(POLARSSL_PKCS12_C)
-#include "polarssl/pkcs12.h"
+#include "mbedtls/pkcs12.h"
 #endif
 
 #if defined(POLARSSL_PKCS5_C)
-#include "polarssl/pkcs5.h"
+#include "mbedtls/pkcs5.h"
 #endif
 
 #if defined(POLARSSL_RIPEMD160_C)
-#include "polarssl/ripemd160.h"
+#include "mbedtls/ripemd160.h"
 #endif
 
 #if defined(POLARSSL_RSA_C)
-#include "polarssl/rsa.h"
+#include "mbedtls/rsa.h"
 #endif
 
 #if defined(POLARSSL_SHA1_C)
-#include "polarssl/sha1.h"
+#include "mbedtls/sha1.h"
 #endif
 
 #if defined(POLARSSL_SHA256_C)
-#include "polarssl/sha256.h"
+#include "mbedtls/sha256.h"
 #endif
 
 #if defined(POLARSSL_SHA512_C)
-#include "polarssl/sha512.h"
+#include "mbedtls/sha512.h"
 #endif
 
 #if defined(POLARSSL_SSL_TLS_C)
-#include "polarssl/ssl.h"
+#include "mbedtls/ssl.h"
 #endif
 
 #if defined(POLARSSL_THREADING_C)
-#include "polarssl/threading.h"
+#include "mbedtls/threading.h"
 #endif
 
 #if defined(POLARSSL_X509_USE_C) || defined(POLARSSL_X509_CREATE_C)
-#include "polarssl/x509.h"
+#include "mbedtls/x509.h"
 #endif
 
 #if defined(POLARSSL_XTEA_C)
-#include "polarssl/xtea.h"
+#include "mbedtls/xtea.h"
 #endif
 
 #if defined(_MSC_VER) && !defined  snprintf && !defined(EFIX64) && \
@@ -455,6 +455,10 @@
             polarssl_snprintf( buf, buflen, "SSL - A counter would wrap (eg, too many messages exchanged)" );
         if( use_ret == -(POLARSSL_ERR_SSL_WAITING_SERVER_HELLO_RENEGO) )
             polarssl_snprintf( buf, buflen, "SSL - Unexpected message at ServerHello in renegotiation" );
+        if( use_ret == -(POLARSSL_ERR_SSL_HELLO_VERIFY_REQUIRED) )
+            polarssl_snprintf( buf, buflen, "SSL - DTLS client must retry for hello verification" );
+        if( use_ret == -(POLARSSL_ERR_SSL_BUFFER_TOO_SMALL) )
+            polarssl_snprintf( buf, buflen, "SSL - A buffer is too small to receive or write a message" );
         if( use_ret == -(POLARSSL_ERR_SSL_NO_USABLE_CIPHERSUITE) )
             polarssl_snprintf( buf, buflen, "SSL - None of the common ciphersuites is usable (eg, no suitable certificate, see debug messages)" );
 #endif /* POLARSSL_SSL_TLS_C */
@@ -659,8 +663,6 @@
 #endif /* POLARSSL_MD5_C */
 
 #if defined(POLARSSL_NET_C)
-    if( use_ret == -(POLARSSL_ERR_NET_UNKNOWN_HOST) )
-        polarssl_snprintf( buf, buflen, "NET - Failed to get an IP address for the given hostname" );
     if( use_ret == -(POLARSSL_ERR_NET_SOCKET_FAILED) )
         polarssl_snprintf( buf, buflen, "NET - Failed to open a socket" );
     if( use_ret == -(POLARSSL_ERR_NET_CONNECT_FAILED) )
@@ -681,6 +683,10 @@
         polarssl_snprintf( buf, buflen, "NET - Connection requires a read call" );
     if( use_ret == -(POLARSSL_ERR_NET_WANT_WRITE) )
         polarssl_snprintf( buf, buflen, "NET - Connection requires a write call" );
+    if( use_ret == -(POLARSSL_ERR_NET_UNKNOWN_HOST) )
+        polarssl_snprintf( buf, buflen, "NET - Failed to get an IP address for the given hostname" );
+    if( use_ret == -(POLARSSL_ERR_NET_TIMEOUT) )
+        polarssl_snprintf( buf, buflen, "NET - The operation timed out" );
 #endif /* POLARSSL_NET_C */
 
 #if defined(POLARSSL_OID_C)
diff --git a/library/gcm.c b/library/gcm.c
index f4f735b..d46f97d 100644
--- a/library/gcm.c
+++ b/library/gcm.c
@@ -31,24 +31,24 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_GCM_C)
 
-#include "polarssl/gcm.h"
+#include "mbedtls/gcm.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_AESNI_C)
-#include "polarssl/aesni.h"
+#include "mbedtls/aesni.h"
 #endif
 
 #if defined(POLARSSL_SELF_TEST) && defined(POLARSSL_AES_C)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/havege.c b/library/havege.c
index fe65699..d07a334 100644
--- a/library/havege.c
+++ b/library/havege.c
@@ -28,15 +28,15 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_HAVEGE_C)
 
-#include "polarssl/havege.h"
-#include "polarssl/timing.h"
+#include "mbedtls/havege.h"
+#include "mbedtls/timing.h"
 
 #include <string.h>
 
diff --git a/library/hmac_drbg.c b/library/hmac_drbg.c
index fed297f..8b73dfd 100644
--- a/library/hmac_drbg.c
+++ b/library/hmac_drbg.c
@@ -27,14 +27,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_HMAC_DRBG_C)
 
-#include "polarssl/hmac_drbg.h"
+#include "mbedtls/hmac_drbg.h"
 
 #include <string.h>
 
@@ -44,7 +44,7 @@
 
 #if defined(POLARSSL_SELF_TEST)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/md.c b/library/md.c
index fbdab91..4710d75 100644
--- a/library/md.c
+++ b/library/md.c
@@ -25,15 +25,15 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_MD_C)
 
-#include "polarssl/md.h"
-#include "polarssl/md_wrap.h"
+#include "mbedtls/md.h"
+#include "mbedtls/md_wrap.h"
 
 #include <stdlib.h>
 #include <string.h>
diff --git a/library/md2.c b/library/md2.c
index 17569c0..a8b67f3 100644
--- a/library/md2.c
+++ b/library/md2.c
@@ -27,14 +27,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_MD2_C)
 
-#include "polarssl/md2.h"
+#include "mbedtls/md2.h"
 
 #include <string.h>
 
@@ -44,7 +44,7 @@
 
 #if defined(POLARSSL_SELF_TEST)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/md4.c b/library/md4.c
index d33cc52..e62a92d 100644
--- a/library/md4.c
+++ b/library/md4.c
@@ -27,14 +27,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_MD4_C)
 
-#include "polarssl/md4.h"
+#include "mbedtls/md4.h"
 
 #include <string.h>
 
@@ -44,7 +44,7 @@
 
 #if defined(POLARSSL_SELF_TEST)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/md5.c b/library/md5.c
index 49f0674..05651cb 100644
--- a/library/md5.c
+++ b/library/md5.c
@@ -26,14 +26,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_MD5_C)
 
-#include "polarssl/md5.h"
+#include "mbedtls/md5.h"
 
 #include <string.h>
 
@@ -43,7 +43,7 @@
 
 #if defined(POLARSSL_SELF_TEST)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/md_wrap.c b/library/md_wrap.c
index f554333..fcc3102 100644
--- a/library/md_wrap.c
+++ b/library/md_wrap.c
@@ -25,45 +25,45 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_MD_C)
 
-#include "polarssl/md_wrap.h"
+#include "mbedtls/md_wrap.h"
 
 #if defined(POLARSSL_MD2_C)
-#include "polarssl/md2.h"
+#include "mbedtls/md2.h"
 #endif
 
 #if defined(POLARSSL_MD4_C)
-#include "polarssl/md4.h"
+#include "mbedtls/md4.h"
 #endif
 
 #if defined(POLARSSL_MD5_C)
-#include "polarssl/md5.h"
+#include "mbedtls/md5.h"
 #endif
 
 #if defined(POLARSSL_RIPEMD160_C)
-#include "polarssl/ripemd160.h"
+#include "mbedtls/ripemd160.h"
 #endif
 
 #if defined(POLARSSL_SHA1_C)
-#include "polarssl/sha1.h"
+#include "mbedtls/sha1.h"
 #endif
 
 #if defined(POLARSSL_SHA256_C)
-#include "polarssl/sha256.h"
+#include "mbedtls/sha256.h"
 #endif
 
 #if defined(POLARSSL_SHA512_C)
-#include "polarssl/sha512.h"
+#include "mbedtls/sha512.h"
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #define polarssl_malloc     malloc
diff --git a/library/memory_buffer_alloc.c b/library/memory_buffer_alloc.c
index 5eb8ab1..1d7750a 100644
--- a/library/memory_buffer_alloc.c
+++ b/library/memory_buffer_alloc.c
@@ -21,17 +21,17 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C)
-#include "polarssl/memory_buffer_alloc.h"
+#include "mbedtls/memory_buffer_alloc.h"
 
 /* No need for the header guard as POLARSSL_MEMORY_BUFFER_ALLOC_C
    is dependent upon POLARSSL_PLATFORM_C */
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 
 #include <string.h>
 
@@ -40,7 +40,7 @@
 #endif
 
 #if defined(POLARSSL_THREADING_C)
-#include "polarssl/threading.h"
+#include "mbedtls/threading.h"
 #endif
 
 /* Implementation that should never be optimized out by the compiler */
diff --git a/library/net.c b/library/net.c
index 1fb6884..2d49463 100644
--- a/library/net.c
+++ b/library/net.c
@@ -1,5 +1,5 @@
 /*
- *  TCP networking functions
+ *  TCP/IP or UDP/IP networking functions
  *
  *  Copyright (C) 2006-2014, ARM Limited, All Rights Reserved
  *
@@ -21,14 +21,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_NET_C)
 
-#include "polarssl/net.h"
+#include "mbedtls/net.h"
 
 #include <string.h>
 
@@ -130,7 +130,7 @@
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #define polarssl_snprintf snprintf
 #endif
@@ -165,9 +165,9 @@
 }
 
 /*
- * Initiate a TCP connection with host:port
+ * Initiate a TCP connection with host:port and the given protocol
  */
-int net_connect( int *fd, const char *host, int port )
+int net_connect( int *fd, const char *host, int port, int proto )
 {
 #if defined(POLARSSL_HAVE_IPV6)
     int ret;
@@ -181,11 +181,11 @@
     memset( port_str, 0, sizeof( port_str ) );
     polarssl_snprintf( port_str, sizeof( port_str ), "%d", port );
 
-    /* Do name resolution with both IPv6 and IPv4, but only TCP */
+    /* Do name resolution with both IPv6 and IPv4 */
     memset( &hints, 0, sizeof( hints ) );
     hints.ai_family = AF_UNSPEC;
-    hints.ai_socktype = SOCK_STREAM;
-    hints.ai_protocol = IPPROTO_TCP;
+    hints.ai_socktype = proto == NET_PROTO_UDP ? SOCK_DGRAM : SOCK_STREAM;
+    hints.ai_protocol = proto == NET_PROTO_UDP ? IPPROTO_UDP : IPPROTO_TCP;
 
     if( getaddrinfo( host, port_str, &hints, &addr_list ) != 0 )
         return( POLARSSL_ERR_NET_UNKNOWN_HOST );
@@ -229,7 +229,9 @@
     if( ( server_host = gethostbyname( host ) ) == NULL )
         return( POLARSSL_ERR_NET_UNKNOWN_HOST );
 
-    if( ( *fd = (int) socket( AF_INET, SOCK_STREAM, IPPROTO_IP ) ) < 0 )
+    if( ( *fd = (int) socket( AF_INET,
+                    proto == NET_PROTO_UDP ? SOCK_DGRAM : SOCK_STREAM,
+                    proto == NET_PROTO_UDP ? IPPROTO_UDP : IPPROTO_TCP ) ) < 0 )
         return( POLARSSL_ERR_NET_SOCKET_FAILED );
 
     memcpy( (void *) &server_addr.sin_addr,
@@ -253,7 +255,7 @@
 /*
  * Create a listening socket on bind_ip:port
  */
-int net_bind( int *fd, const char *bind_ip, int port )
+int net_bind( int *fd, const char *bind_ip, int port, int proto )
 {
 #if defined(POLARSSL_HAVE_IPV6)
     int n, ret;
@@ -270,8 +272,8 @@
     /* Bind to IPv6 and/or IPv4, but only in TCP */
     memset( &hints, 0, sizeof( hints ) );
     hints.ai_family = AF_UNSPEC;
-    hints.ai_socktype = SOCK_STREAM;
-    hints.ai_protocol = IPPROTO_TCP;
+    hints.ai_socktype = proto == NET_PROTO_UDP ? SOCK_DGRAM : SOCK_STREAM;
+    hints.ai_protocol = proto == NET_PROTO_UDP ? IPPROTO_UDP : IPPROTO_TCP;
     if( bind_ip == NULL )
         hints.ai_flags = AI_PASSIVE;
 
@@ -306,11 +308,15 @@
             continue;
         }
 
-        if( listen( *fd, POLARSSL_NET_LISTEN_BACKLOG ) != 0 )
+        /* Listen only makes sense for TCP */
+        if( proto == NET_PROTO_TCP )
         {
-            close( *fd );
-            ret = POLARSSL_ERR_NET_LISTEN_FAILED;
-            continue;
+            if( listen( *fd, POLARSSL_NET_LISTEN_BACKLOG ) != 0 )
+            {
+                close( *fd );
+                ret = POLARSSL_ERR_NET_LISTEN_FAILED;
+                continue;
+            }
         }
 
         /* I we ever get there, it's a success */
@@ -331,7 +337,9 @@
     if( ( ret = net_prepare() ) != 0 )
         return( ret );
 
-    if( ( *fd = (int) socket( AF_INET, SOCK_STREAM, IPPROTO_IP ) ) < 0 )
+    if( ( *fd = (int) socket( AF_INET,
+                    proto == NET_PROTO_UDP ? SOCK_DGRAM : SOCK_STREAM,
+                    proto == NET_PROTO_UDP ? IPPROTO_UDP : IPPROTO_TCP ) ) < 0 )
         return( POLARSSL_ERR_NET_SOCKET_FAILED );
 
     n = 1;
@@ -366,10 +374,14 @@
         return( POLARSSL_ERR_NET_BIND_FAILED );
     }
 
-    if( listen( *fd, POLARSSL_NET_LISTEN_BACKLOG ) != 0 )
+    /* Listen only makes sense for TCP */
+    if( proto == NET_PROTO_TCP )
     {
-        close( *fd );
-        return( POLARSSL_ERR_NET_LISTEN_FAILED );
+        if( listen( *fd, POLARSSL_NET_LISTEN_BACKLOG ) != 0 )
+        {
+            close( *fd );
+            return( POLARSSL_ERR_NET_LISTEN_FAILED );
+        }
     }
 
     return( 0 );
@@ -421,6 +433,9 @@
  */
 int net_accept( int bind_fd, int *client_fd, void *client_ip )
 {
+    int ret;
+    int type;
+
 #if defined(POLARSSL_HAVE_IPV6)
     struct sockaddr_storage client_addr;
 #else
@@ -430,14 +445,35 @@
 #if defined(__socklen_t_defined) || defined(_SOCKLEN_T) ||  \
     defined(_SOCKLEN_T_DECLARED)
     socklen_t n = (socklen_t) sizeof( client_addr );
+    socklen_t type_len = (socklen_t) sizeof( type );
 #else
     int n = (int) sizeof( client_addr );
+    int type_len = (int) sizeof( type );
 #endif
 
-    *client_fd = (int) accept( bind_fd, (struct sockaddr *)
-                               &client_addr, &n );
+    /* Is this a TCP or UDP socket? */
+    if( getsockopt( bind_fd, SOL_SOCKET, SO_TYPE, &type, &type_len ) != 0 ||
+        ( type != SOCK_STREAM && type != SOCK_DGRAM ) )
+    {
+        return( POLARSSL_ERR_NET_ACCEPT_FAILED );
+    }
 
-    if( *client_fd < 0 )
+    if( type == SOCK_STREAM )
+    {
+        /* TCP: actual accept() */
+        ret = *client_fd = (int) accept( bind_fd,
+                                         (struct sockaddr *) &client_addr, &n );
+    }
+    else
+    {
+        /* UDP: wait for a message, but keep it in the queue */
+        char buf[1] = { 0 };
+
+        ret = recvfrom( bind_fd, buf, sizeof( buf ), MSG_PEEK,
+                        (struct sockaddr *) &client_addr, &n );
+    }
+
+    if( ret < 0 )
     {
         if( net_would_block( bind_fd ) != 0 )
             return( POLARSSL_ERR_NET_WANT_READ );
@@ -445,6 +481,15 @@
         return( POLARSSL_ERR_NET_ACCEPT_FAILED );
     }
 
+    /* UDP: hijack the listening socket for communicating with the client */
+    if( type != SOCK_STREAM )
+    {
+        if( connect( bind_fd, (struct sockaddr *) &client_addr, n ) != 0 )
+            return( POLARSSL_ERR_NET_ACCEPT_FAILED );
+
+        *client_fd = bind_fd;
+    }
+
     if( client_ip != NULL )
     {
 #if defined(POLARSSL_HAVE_IPV6)
@@ -543,6 +588,49 @@
     return( ret );
 }
 
+#if defined(POLARSSL_HAVE_TIME)
+/*
+ * Read at most 'len' characters, blocking for at most 'timeout' ms
+ */
+int net_recv_timeout( void *ctx, unsigned char *buf, size_t len,
+                      uint32_t timeout )
+{
+    int ret;
+    struct timeval tv;
+    fd_set read_fds;
+    int fd = *((int *) ctx);
+
+    FD_ZERO( &read_fds );
+    FD_SET( fd, &read_fds );
+
+    tv.tv_sec  = timeout / 1000;
+    tv.tv_usec = ( timeout % 1000 ) * 1000;
+
+    ret = select( fd + 1, &read_fds, NULL, NULL, &tv );
+
+    /* Zero fds ready means we timed out */
+    if( ret == 0 )
+        return( POLARSSL_ERR_NET_TIMEOUT );
+
+    if( ret < 0 )
+    {
+#if ( defined(_WIN32) || defined(_WIN32_WCE) ) && !defined(EFIX64) && \
+    !defined(EFI32)
+        if( WSAGetLastError() == WSAEINTR )
+            return( POLARSSL_ERR_NET_WANT_READ );
+#else
+        if( errno == EINTR )
+            return( POLARSSL_ERR_NET_WANT_READ );
+#endif
+
+        return( POLARSSL_ERR_NET_RECV_FAILED );
+    }
+
+    /* This call will not block */
+    return( net_recv( ctx, buf, len ) );
+}
+#endif /* POLARSSL_HAVE_TIME */
+
 /*
  * Write at most 'len' characters
  */
diff --git a/library/oid.c b/library/oid.c
index ad45a3d..2979d6a 100644
--- a/library/oid.c
+++ b/library/oid.c
@@ -23,27 +23,27 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_OID_C)
 
-#include "polarssl/oid.h"
-#include "polarssl/rsa.h"
+#include "mbedtls/oid.h"
+#include "mbedtls/rsa.h"
 
 #include <stdio.h>
 #include <string.h>
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #define polarssl_snprintf snprintf
 #endif
 
 #if defined(POLARSSL_X509_USE_C) || defined(POLARSSL_X509_CREATE_C)
-#include "polarssl/x509.h"
+#include "mbedtls/x509.h"
 #endif
 
 /*
diff --git a/library/padlock.c b/library/padlock.c
index f4d95fd..eff5365 100644
--- a/library/padlock.c
+++ b/library/padlock.c
@@ -27,14 +27,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PADLOCK_C)
 
-#include "polarssl/padlock.h"
+#include "mbedtls/padlock.h"
 
 #include <string.h>
 
diff --git a/library/pbkdf2.c b/library/pbkdf2.c
index 54494ab..863d016 100644
--- a/library/pbkdf2.c
+++ b/library/pbkdf2.c
@@ -32,15 +32,15 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PBKDF2_C)
 
-#include "polarssl/pbkdf2.h"
-#include "polarssl/pkcs5.h"
+#include "mbedtls/pbkdf2.h"
+#include "mbedtls/pkcs5.h"
 
 int pbkdf2_hmac( md_context_t *ctx, const unsigned char *password, size_t plen,
                  const unsigned char *salt, size_t slen,
diff --git a/library/pem.c b/library/pem.c
index 68be8fd..c722282 100644
--- a/library/pem.c
+++ b/library/pem.c
@@ -21,24 +21,24 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PEM_PARSE_C) || defined(POLARSSL_PEM_WRITE_C)
 
-#include "polarssl/pem.h"
-#include "polarssl/base64.h"
-#include "polarssl/des.h"
-#include "polarssl/aes.h"
-#include "polarssl/md5.h"
-#include "polarssl/cipher.h"
+#include "mbedtls/pem.h"
+#include "mbedtls/base64.h"
+#include "mbedtls/des.h"
+#include "mbedtls/aes.h"
+#include "mbedtls/md5.h"
+#include "mbedtls/cipher.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #define polarssl_malloc     malloc
diff --git a/library/pk.c b/library/pk.c
index 4d78b57..7652510 100644
--- a/library/pk.c
+++ b/library/pk.c
@@ -21,23 +21,23 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PK_C)
-#include "polarssl/pk.h"
-#include "polarssl/pk_wrap.h"
+#include "mbedtls/pk.h"
+#include "mbedtls/pk_wrap.h"
 
 #if defined(POLARSSL_RSA_C)
-#include "polarssl/rsa.h"
+#include "mbedtls/rsa.h"
 #endif
 #if defined(POLARSSL_ECP_C)
-#include "polarssl/ecp.h"
+#include "mbedtls/ecp.h"
 #endif
 #if defined(POLARSSL_ECDSA_C)
-#include "polarssl/ecdsa.h"
+#include "mbedtls/ecdsa.h"
 #endif
 
 /* Implementation that should never be optimized out by the compiler */
diff --git a/library/pk_wrap.c b/library/pk_wrap.c
index 6068605..66afa7c 100644
--- a/library/pk_wrap.c
+++ b/library/pk_wrap.c
@@ -21,29 +21,29 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PK_C)
-#include "polarssl/pk_wrap.h"
+#include "mbedtls/pk_wrap.h"
 
 /* Even if RSA not activated, for the sake of RSA-alt */
-#include "polarssl/rsa.h"
+#include "mbedtls/rsa.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_ECP_C)
-#include "polarssl/ecp.h"
+#include "mbedtls/ecp.h"
 #endif
 
 #if defined(POLARSSL_ECDSA_C)
-#include "polarssl/ecdsa.h"
+#include "mbedtls/ecdsa.h"
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #define polarssl_malloc     malloc
diff --git a/library/pkcs11.c b/library/pkcs11.c
index 14cde31..3943541 100644
--- a/library/pkcs11.c
+++ b/library/pkcs11.c
@@ -24,16 +24,16 @@
  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
-#include "polarssl/pkcs11.h"
+#include "mbedtls/pkcs11.h"
 
 #if defined(POLARSSL_PKCS11_C)
 
-#include "polarssl/md.h"
-#include "polarssl/oid.h"
-#include "polarssl/x509_crt.h"
+#include "mbedtls/md.h"
+#include "mbedtls/oid.h"
+#include "mbedtls/x509_crt.h"
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #define polarssl_malloc     malloc
diff --git a/library/pkcs12.c b/library/pkcs12.c
index f84fd52..66b29c1 100644
--- a/library/pkcs12.c
+++ b/library/pkcs12.c
@@ -27,25 +27,25 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PKCS12_C)
 
-#include "polarssl/pkcs12.h"
-#include "polarssl/asn1.h"
-#include "polarssl/cipher.h"
+#include "mbedtls/pkcs12.h"
+#include "mbedtls/asn1.h"
+#include "mbedtls/cipher.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_ARC4_C)
-#include "polarssl/arc4.h"
+#include "mbedtls/arc4.h"
 #endif
 
 #if defined(POLARSSL_DES_C)
-#include "polarssl/des.h"
+#include "mbedtls/des.h"
 #endif
 
 /* Implementation that should never be optimized out by the compiler */
diff --git a/library/pkcs5.c b/library/pkcs5.c
index c1bab70..12ec5ea 100644
--- a/library/pkcs5.c
+++ b/library/pkcs5.c
@@ -31,22 +31,22 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PKCS5_C)
 
-#include "polarssl/pkcs5.h"
-#include "polarssl/asn1.h"
-#include "polarssl/cipher.h"
-#include "polarssl/oid.h"
+#include "mbedtls/pkcs5.h"
+#include "mbedtls/asn1.h"
+#include "mbedtls/cipher.h"
+#include "mbedtls/oid.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/pkparse.c b/library/pkparse.c
index 06fb292..1529a93 100644
--- a/library/pkparse.c
+++ b/library/pkparse.c
@@ -21,40 +21,40 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PK_PARSE_C)
 
-#include "polarssl/pk.h"
-#include "polarssl/asn1.h"
-#include "polarssl/oid.h"
+#include "mbedtls/pk.h"
+#include "mbedtls/asn1.h"
+#include "mbedtls/oid.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_RSA_C)
-#include "polarssl/rsa.h"
+#include "mbedtls/rsa.h"
 #endif
 #if defined(POLARSSL_ECP_C)
-#include "polarssl/ecp.h"
+#include "mbedtls/ecp.h"
 #endif
 #if defined(POLARSSL_ECDSA_C)
-#include "polarssl/ecdsa.h"
+#include "mbedtls/ecdsa.h"
 #endif
 #if defined(POLARSSL_PEM_PARSE_C)
-#include "polarssl/pem.h"
+#include "mbedtls/pem.h"
 #endif
 #if defined(POLARSSL_PKCS5_C)
-#include "polarssl/pkcs5.h"
+#include "mbedtls/pkcs5.h"
 #endif
 #if defined(POLARSSL_PKCS12_C)
-#include "polarssl/pkcs12.h"
+#include "mbedtls/pkcs12.h"
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #define polarssl_malloc     malloc
diff --git a/library/pkwrite.c b/library/pkwrite.c
index 35dbd0b..2c08b92 100644
--- a/library/pkwrite.c
+++ b/library/pkwrite.c
@@ -21,34 +21,34 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PK_WRITE_C)
 
-#include "polarssl/pk.h"
-#include "polarssl/asn1write.h"
-#include "polarssl/oid.h"
+#include "mbedtls/pk.h"
+#include "mbedtls/asn1write.h"
+#include "mbedtls/oid.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_RSA_C)
-#include "polarssl/rsa.h"
+#include "mbedtls/rsa.h"
 #endif
 #if defined(POLARSSL_ECP_C)
-#include "polarssl/ecp.h"
+#include "mbedtls/ecp.h"
 #endif
 #if defined(POLARSSL_ECDSA_C)
-#include "polarssl/ecdsa.h"
+#include "mbedtls/ecdsa.h"
 #endif
 #if defined(POLARSSL_PEM_WRITE_C)
-#include "polarssl/pem.h"
+#include "mbedtls/pem.h"
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #define polarssl_malloc     malloc
diff --git a/library/platform.c b/library/platform.c
index a161bc3..fb6805f 100644
--- a/library/platform.c
+++ b/library/platform.c
@@ -21,14 +21,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
 
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 
 #if defined(POLARSSL_PLATFORM_MEMORY)
 #if !defined(POLARSSL_PLATFORM_STD_MALLOC)
diff --git a/library/ripemd160.c b/library/ripemd160.c
index 2c196f4..0ca354c 100644
--- a/library/ripemd160.c
+++ b/library/ripemd160.c
@@ -27,14 +27,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_RIPEMD160_C)
 
-#include "polarssl/ripemd160.h"
+#include "mbedtls/ripemd160.h"
 
 #include <string.h>
 
@@ -44,7 +44,7 @@
 
 #if defined(POLARSSL_SELF_TEST)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/rsa.c b/library/rsa.c
index 0d71ad0..e915e4f 100644
--- a/library/rsa.c
+++ b/library/rsa.c
@@ -27,20 +27,20 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_RSA_C)
 
-#include "polarssl/rsa.h"
-#include "polarssl/oid.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/oid.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_PKCS1_V21)
-#include "polarssl/md.h"
+#include "mbedtls/md.h"
 #endif
 
 #if defined(POLARSSL_PKCS1_V15) && !defined(__OpenBSD__)
@@ -48,7 +48,7 @@
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
@@ -1471,7 +1471,7 @@
 
 #if defined(POLARSSL_SELF_TEST)
 
-#include "polarssl/sha1.h"
+#include "mbedtls/sha1.h"
 
 /*
  * Example RSA-1024 keypair, for test purposes
diff --git a/library/sha1.c b/library/sha1.c
index fca6109..db9f2c1 100644
--- a/library/sha1.c
+++ b/library/sha1.c
@@ -26,14 +26,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_SHA1_C)
 
-#include "polarssl/sha1.h"
+#include "mbedtls/sha1.h"
 
 #include <string.h>
 
@@ -43,7 +43,7 @@
 
 #if defined(POLARSSL_SELF_TEST)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/sha256.c b/library/sha256.c
index 2b4b7e1..3f7add6 100644
--- a/library/sha256.c
+++ b/library/sha256.c
@@ -26,14 +26,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_SHA256_C)
 
-#include "polarssl/sha256.h"
+#include "mbedtls/sha256.h"
 
 #include <string.h>
 
@@ -43,7 +43,7 @@
 
 #if defined(POLARSSL_SELF_TEST)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/sha512.c b/library/sha512.c
index 4074d33..560a83d 100644
--- a/library/sha512.c
+++ b/library/sha512.c
@@ -26,14 +26,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_SHA512_C)
 
-#include "polarssl/sha512.h"
+#include "mbedtls/sha512.h"
 
 #if defined(_MSC_VER) || defined(__WATCOMC__)
   #define UL64(x) x##ui64
@@ -49,7 +49,7 @@
 
 #if defined(POLARSSL_SELF_TEST)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/library/ssl_cache.c b/library/ssl_cache.c
index 0c2df29..eaf67e8 100644
--- a/library/ssl_cache.c
+++ b/library/ssl_cache.c
@@ -25,19 +25,19 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_SSL_CACHE_C)
 
-#include "polarssl/ssl_cache.h"
+#include "mbedtls/ssl_cache.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #define polarssl_malloc     malloc
diff --git a/library/ssl_ciphersuites.c b/library/ssl_ciphersuites.c
index 0fee1e6..11c46a5 100644
--- a/library/ssl_ciphersuites.c
+++ b/library/ssl_ciphersuites.c
@@ -23,15 +23,15 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_SSL_TLS_C)
 
-#include "polarssl/ssl_ciphersuites.h"
-#include "polarssl/ssl.h"
+#include "mbedtls/ssl_ciphersuites.h"
+#include "mbedtls/ssl.h"
 
 // #include <stdlib.h>
 #include <string.h>
@@ -390,7 +390,7 @@
       POLARSSL_CIPHER_ARC4_128, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3,
-      0 },
+      POLARSSL_CIPHERSUITE_NODTLS },
 #endif /* POLARSSL_SHA1_C */
 #endif /* POLARSSL_ARC4_C */
 
@@ -509,7 +509,7 @@
       POLARSSL_CIPHER_ARC4_128, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_ECDHE_RSA,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3,
-      0 },
+      POLARSSL_CIPHERSUITE_NODTLS },
 #endif /* POLARSSL_SHA1_C */
 #endif /* POLARSSL_ARC4_C */
 
@@ -800,7 +800,7 @@
       POLARSSL_CIPHER_ARC4_128, POLARSSL_MD_MD5, POLARSSL_KEY_EXCHANGE_RSA,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3,
-      0 },
+      POLARSSL_CIPHERSUITE_NODTLS },
 #endif
 
 #if defined(POLARSSL_SHA1_C)
@@ -808,7 +808,7 @@
       POLARSSL_CIPHER_ARC4_128, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_RSA,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3,
-      0 },
+      POLARSSL_CIPHERSUITE_NODTLS },
 #endif
 #endif /* POLARSSL_ARC4_C */
 #endif /* POLARSSL_KEY_EXCHANGE_RSA_ENABLED */
@@ -917,7 +917,7 @@
       POLARSSL_CIPHER_ARC4_128, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_ECDH_RSA,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3,
-      0 },
+      POLARSSL_CIPHERSUITE_NODTLS },
 #endif /* POLARSSL_SHA1_C */
 #endif /* POLARSSL_ARC4_C */
 
@@ -1036,7 +1036,7 @@
       POLARSSL_CIPHER_ARC4_128, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_ECDH_ECDSA,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3,
-      0 },
+      POLARSSL_CIPHERSUITE_NODTLS },
 #endif /* POLARSSL_SHA1_C */
 #endif /* POLARSSL_ARC4_C */
 
@@ -1182,7 +1182,7 @@
       POLARSSL_CIPHER_ARC4_128, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_PSK,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3,
-      0 },
+      POLARSSL_CIPHERSUITE_NODTLS },
 #endif /* POLARSSL_SHA1_C */
 #endif /* POLARSSL_ARC4_C */
 #endif /* POLARSSL_KEY_EXCHANGE_PSK_ENABLED */
@@ -1318,7 +1318,7 @@
       POLARSSL_CIPHER_ARC4_128, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_DHE_PSK,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3,
-      0 },
+      POLARSSL_CIPHERSUITE_NODTLS },
 #endif /* POLARSSL_SHA1_C */
 #endif /* POLARSSL_ARC4_C */
 #endif /* POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED */
@@ -1397,7 +1397,7 @@
       POLARSSL_CIPHER_ARC4_128, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_ECDHE_PSK,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3,
-      0 },
+      POLARSSL_CIPHERSUITE_NODTLS },
 #endif /* POLARSSL_SHA1_C */
 #endif /* POLARSSL_ARC4_C */
 #endif /* POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
@@ -1511,7 +1511,7 @@
       POLARSSL_CIPHER_ARC4_128, POLARSSL_MD_SHA1, POLARSSL_KEY_EXCHANGE_RSA_PSK,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1,
       SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3,
-      0 },
+      POLARSSL_CIPHERSUITE_NODTLS },
 #endif /* POLARSSL_SHA1_C */
 #endif /* POLARSSL_ARC4_C */
 #endif /* POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED */
diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 37853bc..db4bf69 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -21,20 +21,20 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_SSL_CLI_C)
 
-#include "polarssl/debug.h"
-#include "polarssl/ssl.h"
+#include "mbedtls/debug.h"
+#include "mbedtls/ssl.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #define polarssl_malloc     malloc
@@ -120,7 +120,7 @@
 
     *olen = 0;
 
-    if( ssl->renegotiation != SSL_RENEGOTIATION )
+    if( ssl->renegotiation != SSL_RENEGOTIATION_IN_PROGRESS )
         return;
 
     SSL_DEBUG_MSG( 3, ( "client hello, adding renegotiation extension" ) );
@@ -500,15 +500,56 @@
 }
 #endif /* POLARSSL_SSL_ALPN */
 
+/*
+ * Generate random bytes for ClientHello
+ */
+static int ssl_generate_random( ssl_context *ssl )
+{
+    int ret;
+    unsigned char *p = ssl->handshake->randbytes;
+#if defined(POLARSSL_HAVE_TIME)
+    time_t t;
+#endif
+
+    /*
+     * When responding to a verify request, MUST reuse random (RFC 6347 4.2.1)
+     */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+        ssl->handshake->verify_cookie != NULL )
+    {
+        return( 0 );
+    }
+#endif
+
+#if defined(POLARSSL_HAVE_TIME)
+    t = time( NULL );
+    *p++ = (unsigned char)( t >> 24 );
+    *p++ = (unsigned char)( t >> 16 );
+    *p++ = (unsigned char)( t >>  8 );
+    *p++ = (unsigned char)( t       );
+
+    SSL_DEBUG_MSG( 3, ( "client hello, current time: %lu", t ) );
+#else
+    if( ( ret = ssl->f_rng( ssl->p_rng, p, 4 ) ) != 0 )
+        return( ret );
+
+    p += 4;
+#endif /* POLARSSL_HAVE_TIME */
+
+    if( ( ret = ssl->f_rng( ssl->p_rng, p, 28 ) ) != 0 )
+        return( ret );
+
+    return( 0 );
+}
+
 static int ssl_write_client_hello( ssl_context *ssl )
 {
     int ret;
     size_t i, n, olen, ext_len = 0;
     unsigned char *buf;
     unsigned char *p, *q;
-#if defined(POLARSSL_HAVE_TIME)
-    time_t t;
-#endif
+    unsigned char offer_compress;
     const int *ciphersuites;
     const ssl_ciphersuite_t *ciphersuite_info;
 
@@ -544,44 +585,33 @@
     buf = ssl->out_msg;
     p = buf + 4;
 
-    *p++ = (unsigned char) ssl->max_major_ver;
-    *p++ = (unsigned char) ssl->max_minor_ver;
+    ssl_write_version( ssl->max_major_ver, ssl->max_minor_ver,
+                       ssl->transport, p );
+    p += 2;
 
     SSL_DEBUG_MSG( 3, ( "client hello, max version: [%d:%d]",
                    buf[4], buf[5] ) );
 
-#if defined(POLARSSL_HAVE_TIME)
-    t = time( NULL );
-    *p++ = (unsigned char)( t >> 24 );
-    *p++ = (unsigned char)( t >> 16 );
-    *p++ = (unsigned char)( t >>  8 );
-    *p++ = (unsigned char)( t       );
-
-    SSL_DEBUG_MSG( 3, ( "client hello, current time: %lu", t ) );
-#else
-    if( ( ret = ssl->f_rng( ssl->p_rng, p, 4 ) ) != 0 )
+    if( ( ret = ssl_generate_random( ssl ) ) != 0 )
+    {
+        SSL_DEBUG_RET( 1, "ssl_generate_random", ret );
         return( ret );
+    }
 
-    p += 4;
-#endif /* POLARSSL_HAVE_TIME */
-
-    if( ( ret = ssl->f_rng( ssl->p_rng, p, 28 ) ) != 0 )
-        return( ret );
-
-    p += 28;
-
-    memcpy( ssl->handshake->randbytes, buf + 6, 32 );
-
-    SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 6, 32 );
+    memcpy( p, ssl->handshake->randbytes, 32 );
+    SSL_DEBUG_BUF( 3, "client hello, random bytes", p, 32 );
+    p += 32;
 
     /*
      *    38  .  38   session id length
      *    39  . 39+n  session id
-     *   40+n . 41+n  ciphersuitelist length
-     *   42+n . ..    ciphersuitelist
-     *   ..   . ..    compression methods length
+     *   39+n . 39+n  DTLS only: cookie length (1 byte)
+     *   40+n .  ..   DTSL only: cookie
+     *   ..   . ..    ciphersuitelist length (2 bytes)
+     *   ..   . ..    ciphersuitelist
+     *   ..   . ..    compression methods length (1 byte)
      *   ..   . ..    compression methods
-     *   ..   . ..    extensions length
+     *   ..   . ..    extensions length (2 bytes)
      *   ..   . ..    extensions
      */
     n = ssl->session_negotiate->length;
@@ -625,11 +655,39 @@
     SSL_DEBUG_MSG( 3, ( "client hello, session id len.: %d", n ) );
     SSL_DEBUG_BUF( 3,   "client hello, session id", buf + 39, n );
 
+    /*
+     * DTLS cookie
+     */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+    {
+        if( ssl->handshake->verify_cookie == NULL )
+        {
+            SSL_DEBUG_MSG( 3, ( "no verify cookie to send" ) );
+            *p++ = 0;
+        }
+        else
+        {
+            SSL_DEBUG_BUF( 3, "client hello, cookie",
+                              ssl->handshake->verify_cookie,
+                              ssl->handshake->verify_cookie_len );
+
+            *p++ = ssl->handshake->verify_cookie_len;
+            memcpy( p, ssl->handshake->verify_cookie,
+                       ssl->handshake->verify_cookie_len );
+            p += ssl->handshake->verify_cookie_len;
+        }
+    }
+#endif
+
+    /*
+     * Ciphersuite list
+     */
     ciphersuites = ssl->ciphersuite_list[ssl->minor_ver];
+
+    /* Skip writing ciphersuite length for now */
     n = 0;
     q = p;
-
-    // Skip writing ciphersuite length for now
     p += 2;
 
     for( i = 0; ciphersuites[i] != 0; i++ )
@@ -643,6 +701,12 @@
             ciphersuite_info->max_minor_ver < ssl->min_minor_ver )
             continue;
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+        if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+            ( ciphersuite_info->flags & POLARSSL_CIPHERSUITE_NODTLS ) )
+            continue;
+#endif
+
         if( ssl->arc4_disabled == SSL_ARC4_DISABLED &&
             ciphersuite_info->cipher == POLARSSL_CIPHER_ARC4_128 )
             continue;
@@ -672,8 +736,8 @@
     if( ssl->fallback == SSL_IS_FALLBACK )
     {
         SSL_DEBUG_MSG( 3, ( "adding FALLBACK_SCSV" ) );
-        *p++ = (unsigned char)( SSL_FALLBACK_SCSV >> 8 );
-        *p++ = (unsigned char)( SSL_FALLBACK_SCSV      );
+        *p++ = (unsigned char)( SSL_FALLBACK_SCSV_VALUE >> 8 );
+        *p++ = (unsigned char)( SSL_FALLBACK_SCSV_VALUE      );
         n++;
     }
 #endif
@@ -683,22 +747,42 @@
 
     SSL_DEBUG_MSG( 3, ( "client hello, got %d ciphersuites", n ) );
 
-
 #if defined(POLARSSL_ZLIB_SUPPORT)
-    SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 2 ) );
-    SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d %d",
-                        SSL_COMPRESS_DEFLATE, SSL_COMPRESS_NULL ) );
-
-    *p++ = 2;
-    *p++ = SSL_COMPRESS_DEFLATE;
-    *p++ = SSL_COMPRESS_NULL;
+    offer_compress = 1;
 #else
-    SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 1 ) );
-    SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d", SSL_COMPRESS_NULL ) );
+    offer_compress = 0;
+#endif
 
-    *p++ = 1;
-    *p++ = SSL_COMPRESS_NULL;
-#endif /* POLARSSL_ZLIB_SUPPORT */
+    /*
+     * We don't support compression with DTLS right now: is many records come
+     * in the same datagram, uncompressing one could overwrite the next one.
+     * We don't want to add complexity for handling that case unless there is
+     * an actual need for it.
+     */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        offer_compress = 0;
+#endif
+
+    if( offer_compress )
+    {
+        SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 2 ) );
+        SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d %d",
+                            SSL_COMPRESS_DEFLATE, SSL_COMPRESS_NULL ) );
+
+        *p++ = 2;
+        *p++ = SSL_COMPRESS_DEFLATE;
+        *p++ = SSL_COMPRESS_NULL;
+    }
+    else
+    {
+        SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 1 ) );
+        SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d",
+                            SSL_COMPRESS_NULL ) );
+
+        *p++ = 1;
+        *p++ = SSL_COMPRESS_NULL;
+    }
 
     // First write extensions, then the total length
     //
@@ -775,6 +859,11 @@
 
     ssl->state++;
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        ssl_send_flight_completed( ssl );
+#endif
+
     if( ( ret = ssl_write_record( ssl ) ) != 0 )
     {
         SSL_DEBUG_RET( 1, "ssl_write_record", ret );
@@ -1011,12 +1100,79 @@
 }
 #endif /* POLARSSL_SSL_ALPN */
 
+/*
+ * Parse HelloVerifyRequest.  Only called after verifying the HS type.
+ */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+static int ssl_parse_hello_verify_request( ssl_context *ssl )
+{
+    const unsigned char *p = ssl->in_msg + ssl_hs_hdr_len( ssl );
+    int major_ver, minor_ver;
+    unsigned char cookie_len;
+
+    SSL_DEBUG_MSG( 2, ( "=> parse hello verify request" ) );
+
+    /*
+     * struct {
+     *   ProtocolVersion server_version;
+     *   opaque cookie<0..2^8-1>;
+     * } HelloVerifyRequest;
+     */
+    SSL_DEBUG_BUF( 3, "server version", (unsigned char *) p, 2 );
+    ssl_read_version( &major_ver, &minor_ver, ssl->transport, p );
+    p += 2;
+
+    /*
+     * Since the RFC is not clear on this point, accept DTLS 1.0 (TLS 1.1)
+     * even is lower than our min version.
+     */
+    if( major_ver < SSL_MAJOR_VERSION_3 ||
+        minor_ver < SSL_MINOR_VERSION_2 ||
+        major_ver > ssl->max_major_ver  ||
+        minor_ver > ssl->max_minor_ver  )
+    {
+        SSL_DEBUG_MSG( 1, ( "bad server version" ) );
+
+        ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
+                                     SSL_ALERT_MSG_PROTOCOL_VERSION );
+
+        return( POLARSSL_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
+    }
+
+    cookie_len = *p++;
+    SSL_DEBUG_BUF( 3, "cookie", (unsigned char *) p, cookie_len );
+
+    polarssl_free( ssl->handshake->verify_cookie );
+
+    ssl->handshake->verify_cookie = polarssl_malloc( cookie_len );
+    if( ssl->handshake->verify_cookie  == NULL )
+    {
+        SSL_DEBUG_MSG( 1, ( "malloc failed (%d bytes)", cookie_len ) );
+        return( POLARSSL_ERR_SSL_MALLOC_FAILED );
+    }
+
+    memcpy( ssl->handshake->verify_cookie, p, cookie_len );
+    ssl->handshake->verify_cookie_len = cookie_len;
+
+    /* Start over at ClientHello */
+    ssl->state = SSL_CLIENT_HELLO;
+    ssl_reset_checksum( ssl );
+
+    ssl_recv_flight_completed( ssl );
+
+    SSL_DEBUG_MSG( 2, ( "<= parse hello verify request" ) );
+
+    return( 0 );
+}
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+
 static int ssl_parse_server_hello( ssl_context *ssl )
 {
-    int ret, i, comp;
+    int ret, i;
     size_t n;
     size_t ext_len;
     unsigned char *buf, *ext;
+    unsigned char comp, accept_comp;
 #if defined(POLARSSL_SSL_RENEGOTIATION)
     int renegotiation_info_seen = 0;
 #endif
@@ -1028,13 +1184,6 @@
 
     SSL_DEBUG_MSG( 2, ( "=> parse server hello" ) );
 
-    /*
-     *     0  .   0   handshake type
-     *     1  .   3   handshake length
-     *     4  .   5   protocol version
-     *     6  .   9   UNIX time()
-     *    10  .  37   random bytes
-     */
     buf = ssl->in_msg;
 
     if( ( ret = ssl_read_record( ssl ) ) != 0 )
@@ -1046,7 +1195,7 @@
     if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
     {
 #if defined(POLARSSL_SSL_RENEGOTIATION)
-        if( ssl->renegotiation == SSL_RENEGOTIATION )
+        if( ssl->renegotiation == SSL_RENEGOTIATION_IN_PROGRESS )
         {
             ssl->renego_records_seen++;
 
@@ -1067,30 +1216,59 @@
         return( POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE );
     }
 
-    SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
-                   buf[4], buf[5] ) );
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+    {
+        if( buf[0] == SSL_HS_HELLO_VERIFY_REQUEST )
+        {
+            SSL_DEBUG_MSG( 2, ( "received hello verify request" ) );
+            SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
+            return( ssl_parse_hello_verify_request( ssl ) );
+        }
+        else
+        {
+            /* We made it through the verification process */
+            polarssl_free( ssl->handshake->verify_cookie );
+            ssl->handshake->verify_cookie = NULL;
+            ssl->handshake->verify_cookie_len = 0;
+        }
+    }
+#endif /* POLARSSL_SSL_PROTO_DTLS */
 
-    if( ssl->in_hslen < 42 ||
-        buf[0] != SSL_HS_SERVER_HELLO ||
-        buf[4] != SSL_MAJOR_VERSION_3 )
+    if( ssl->in_hslen < 38 + ssl_hs_hdr_len( ssl ) ||
+        buf[0] != SSL_HS_SERVER_HELLO )
     {
         SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
         return( POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO );
     }
 
-    if( buf[5] > ssl->max_minor_ver )
-    {
-        SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO );
-    }
+    /*
+     *  0   .  1    server_version
+     *  2   . 33    random (maybe including 4 bytes of Unix time)
+     * 34   . 34    session_id length = n
+     * 35   . 34+n  session_id
+     * 35+n . 36+n  cipher_suite
+     * 37+n . 37+n  compression_method
+     *
+     * 38+n . 39+n  extensions length (optional)
+     * 40+n .  ..   extensions
+     */
+    buf += ssl_hs_hdr_len( ssl );
 
-    ssl->minor_ver = buf[5];
+    SSL_DEBUG_BUF( 3, "server hello, version", buf + 0, 2 );
+    ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
+                      ssl->transport, buf + 0 );
 
-    if( ssl->minor_ver < ssl->min_minor_ver )
+    if( ssl->major_ver < ssl->min_major_ver ||
+        ssl->minor_ver < ssl->min_minor_ver ||
+        ssl->major_ver > ssl->max_major_ver ||
+        ssl->minor_ver > ssl->max_minor_ver )
     {
-        SSL_DEBUG_MSG( 1, ( "server only supports ssl smaller than minimum"
-                            " [%d:%d] < [%d:%d]", ssl->major_ver,
-                            ssl->minor_ver, buf[4], buf[5] ) );
+        SSL_DEBUG_MSG( 1, ( "server version out of bounds - "
+                            " min: [%d:%d], server: [%d:%d], max: [%d:%d]",
+                            ssl->min_major_ver, ssl->min_minor_ver,
+                            ssl->major_ver, ssl->minor_ver,
+                            ssl->max_major_ver, ssl->max_minor_ver ) );
 
         ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
                                      SSL_ALERT_MSG_PROTOCOL_VERSION );
@@ -1099,18 +1277,18 @@
     }
 
 #if defined(POLARSSL_DEBUG_C)
-    t = ( (uint32_t) buf[6] << 24 )
-      | ( (uint32_t) buf[7] << 16 )
-      | ( (uint32_t) buf[8] <<  8 )
-      | ( (uint32_t) buf[9]       );
+    t = ( (uint32_t) buf[2] << 24 )
+      | ( (uint32_t) buf[3] << 16 )
+      | ( (uint32_t) buf[4] <<  8 )
+      | ( (uint32_t) buf[5]       );
     SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
 #endif
 
-    memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
+    memcpy( ssl->handshake->randbytes + 32, buf + 2, 32 );
 
-    n = buf[38];
+    n = buf[34];
 
-    SSL_DEBUG_BUF( 3,   "server hello, random bytes", buf + 6, 32 );
+    SSL_DEBUG_BUF( 3,   "server hello, random bytes", buf + 2, 32 );
 
     if( n > 32 )
     {
@@ -1118,27 +1296,19 @@
         return( POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO );
     }
 
-    /*
-     *    38  .  38   session id length
-     *    39  . 38+n  session id
-     *   39+n . 40+n  chosen ciphersuite
-     *   41+n . 41+n  chosen compression alg.
-     *   42+n . 43+n  extensions length
-     *   44+n . 44+n+m extensions
-     */
-    if( ssl->in_hslen > 43 + n )
+    if( ssl->in_hslen > 39 + n )
     {
-        ext_len = ( ( buf[42 + n] <<  8 )
-                  | ( buf[43 + n]       ) );
+        ext_len = ( ( buf[38 + n] <<  8 )
+                  | ( buf[39 + n]       ) );
 
         if( ( ext_len > 0 && ext_len < 4 ) ||
-            ssl->in_hslen != 44 + n + ext_len )
+            ssl->in_hslen != ssl_hs_hdr_len( ssl ) + 40 + n + ext_len )
         {
             SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
             return( POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO );
         }
     }
-    else if( ssl->in_hslen == 42 + n )
+    else if( ssl->in_hslen == 38 + n )
     {
         ext_len = 0;
     }
@@ -1148,8 +1318,32 @@
         return( POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO );
     }
 
-    i = ( buf[39 + n] << 8 ) | buf[40 + n];
-    comp = buf[41 + n];
+    /* ciphersuite (used later) */
+    i = ( buf[35 + n] << 8 ) | buf[36 + n];
+
+    /*
+     * Read and check compression
+     */
+    comp = buf[37 + n];
+
+#if defined(POLARSSL_ZLIB_SUPPORT)
+    accept_comp = 1;
+#else
+    accept_comp = 0;
+#endif
+
+    /* See comments in ssl_write_client_hello() */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        accept_comp = 0;
+#endif
+
+    if( ( accept_comp == 0 && comp != SSL_COMPRESS_NULL ) ||
+        ( comp != SSL_COMPRESS_NULL && comp != SSL_COMPRESS_DEFLATE ) )
+    {
+        SSL_DEBUG_MSG( 1, ( "server hello, bad compression: %d", comp ) );
+        return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
+    }
 
     /*
      * Initialize update checksum functions
@@ -1165,7 +1359,7 @@
     ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
 
     SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
-    SSL_DEBUG_BUF( 3,   "server hello, session id", buf + 39, n );
+    SSL_DEBUG_BUF( 3,   "server hello, session id", buf + 35, n );
 
     /*
      * Check if the session can be resumed
@@ -1177,7 +1371,7 @@
         ssl->session_negotiate->ciphersuite != i ||
         ssl->session_negotiate->compression != comp ||
         ssl->session_negotiate->length != n ||
-        memcmp( ssl->session_negotiate->id, buf + 39, n ) != 0 )
+        memcmp( ssl->session_negotiate->id, buf + 35, n ) != 0 )
     {
         ssl->state++;
         ssl->handshake->resume = 0;
@@ -1187,7 +1381,7 @@
         ssl->session_negotiate->ciphersuite = i;
         ssl->session_negotiate->compression = comp;
         ssl->session_negotiate->length = n;
-        memcpy( ssl->session_negotiate->id, buf + 39, n );
+        memcpy( ssl->session_negotiate->id, buf + 35, n );
     }
     else
     {
@@ -1204,7 +1398,7 @@
                    ssl->handshake->resume ? "a" : "no" ) );
 
     SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %d", i ) );
-    SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: %d", buf[41 + n] ) );
+    SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: %d", buf[37 + n] ) );
 
     suite_info = ssl_ciphersuite_from_id( ssl->session_negotiate->ciphersuite );
     if( suite_info == NULL ||
@@ -1243,7 +1437,7 @@
     }
     ssl->session_negotiate->compression = comp;
 
-    ext = buf + 44 + n;
+    ext = buf + 40 + n;
 
     SSL_DEBUG_MSG( 2, ( "server hello, total extension length: %d", ext_len ) );
 
@@ -1387,21 +1581,21 @@
         handshake_failure = 1;
     }
 #if defined(POLARSSL_SSL_RENEGOTIATION)
-    else if( ssl->renegotiation == SSL_RENEGOTIATION &&
+    else if( ssl->renegotiation == SSL_RENEGOTIATION_IN_PROGRESS &&
              ssl->secure_renegotiation == SSL_SECURE_RENEGOTIATION &&
              renegotiation_info_seen == 0 )
     {
         SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
         handshake_failure = 1;
     }
-    else if( ssl->renegotiation == SSL_RENEGOTIATION &&
+    else if( ssl->renegotiation == SSL_RENEGOTIATION_IN_PROGRESS &&
              ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
              ssl->allow_legacy_renegotiation == SSL_LEGACY_NO_RENEGOTIATION )
     {
         SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
         handshake_failure = 1;
     }
-    else if( ssl->renegotiation == SSL_RENEGOTIATION &&
+    else if( ssl->renegotiation == SSL_RENEGOTIATION_IN_PROGRESS &&
              ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
              renegotiation_info_seen == 1 )
     {
@@ -1585,8 +1779,8 @@
      *      opaque random[46];
      *  } PreMasterSecret;
      */
-    p[0] = (unsigned char) ssl->max_major_ver;
-    p[1] = (unsigned char) ssl->max_minor_ver;
+    ssl_write_version( ssl->max_major_ver, ssl->max_minor_ver,
+                       ssl->transport, p );
 
     if( ( ret = ssl->f_rng( ssl->p_rng, p + 2, 46 ) ) != 0 )
     {
@@ -1725,15 +1919,6 @@
     int ret;
     const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
     unsigned char *p, *end;
-#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) ||                       \
-    defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) ||                     \
-    defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
-    size_t sig_len, params_len;
-    unsigned char hash[64];
-    md_type_t md_alg = POLARSSL_MD_NONE;
-    size_t hashlen;
-    pk_type_t pk_alg = POLARSSL_PK_NONE;
-#endif
 
     SSL_DEBUG_MSG( 2, ( "=> parse server key exchange" ) );
 
@@ -1797,9 +1982,9 @@
         return( POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE );
     }
 
-    p   = ssl->in_msg + 4;
+    p   = ssl->in_msg + ssl_hs_hdr_len( ssl );
     end = ssl->in_msg + ssl->in_hslen;
-    SSL_DEBUG_BUF( 3,   "server key exchange", p, ssl->in_hslen - 4 );
+    SSL_DEBUG_BUF( 3,   "server key exchange", p, end - p );
 
 #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED)
     if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
@@ -1866,7 +2051,12 @@
         ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_RSA ||
         ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA )
     {
-        params_len = p - ( ssl->in_msg + 4 );
+        size_t sig_len, hashlen;
+        unsigned char hash[64];
+        md_type_t md_alg = POLARSSL_MD_NONE;
+        pk_type_t pk_alg = POLARSSL_PK_NONE;
+        unsigned char *params = ssl->in_msg + ssl_hs_hdr_len( ssl );
+        size_t params_len = p - params;
 
         /*
          * Handle the digitally-signed structure
@@ -1950,12 +2140,12 @@
              */
             md5_starts( &md5 );
             md5_update( &md5, ssl->handshake->randbytes, 64 );
-            md5_update( &md5, ssl->in_msg + 4, params_len );
+            md5_update( &md5, params, params_len );
             md5_finish( &md5, hash );
 
             sha1_starts( &sha1 );
             sha1_update( &sha1, ssl->handshake->randbytes, 64 );
-            sha1_update( &sha1, ssl->in_msg + 4, params_len );
+            sha1_update( &sha1, params, params_len );
             sha1_finish( &sha1, hash + 16 );
 
             md5_free(  &md5  );
@@ -1991,7 +2181,7 @@
 
             md_starts( &ctx );
             md_update( &ctx, ssl->handshake->randbytes, 64 );
-            md_update( &ctx, ssl->in_msg + 4, params_len );
+            md_update( &ctx, params, params_len );
             md_finish( &ctx, hash );
             md_free( &ctx );
         }
@@ -2078,18 +2268,6 @@
         return( 0 );
     }
 
-    /*
-     *     0  .   0   handshake type
-     *     1  .   3   handshake length
-     *     4  .   4   cert type count
-     *     5  .. m-1  cert types
-     *     m  .. m+1  sig alg length (TLS 1.2 only)
-     *    m+1 .. n-1  SignatureAndHashAlgorithms (TLS 1.2 only)
-     *     n  .. n+1  length of all DNs
-     *    n+2 .. n+3  length of DN 1
-     *    n+4 .. ...  Distinguished Name #1
-     *    ... .. ...  length of DN 2, etc.
-     */
     if( ssl->record_read == 0 )
     {
         if( ( ret = ssl_read_record( ssl ) ) != 0 )
@@ -2124,20 +2302,28 @@
     // TODO: handshake_failure alert for an anonymous server to request
     // client authentication
 
+    /*
+     *  struct {
+     *      ClientCertificateType certificate_types<1..2^8-1>;
+     *      SignatureAndHashAlgorithm
+     *        supported_signature_algorithms<2^16-1>; -- TLS 1.2 only
+     *      DistinguishedName certificate_authorities<0..2^16-1>;
+     *  } CertificateRequest;
+     */
     buf = ssl->in_msg;
 
     // Retrieve cert types
     //
-    cert_type_len = buf[4];
+    cert_type_len = buf[ssl_hs_hdr_len( ssl )];
     n = cert_type_len;
 
-    if( ssl->in_hslen < 6 + n )
+    if( ssl->in_hslen < ssl_hs_hdr_len( ssl ) + 2 + n )
     {
         SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
         return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
     }
 
-    p = buf + 5;
+    p = buf + ssl_hs_hdr_len( ssl ) + 1;
     while( cert_type_len > 0 )
     {
 #if defined(POLARSSL_RSA_C)
@@ -2171,14 +2357,14 @@
     {
         /* Ignored, see comments about hash in write_certificate_verify */
         // TODO: should check the signature part against our pk_key though
-        size_t sig_alg_len = ( ( buf[5 + n] <<  8 )
-                             | ( buf[6 + n]       ) );
+        size_t sig_alg_len = ( ( buf[ssl_hs_hdr_len( ssl ) + 1 + n] <<  8 )
+                             | ( buf[ssl_hs_hdr_len( ssl ) + 2 + n]       ) );
 
-        p = buf + 7 + n;
+        p = buf + ssl_hs_hdr_len( ssl ) + 3 + n;
         m += 2;
         n += sig_alg_len;
 
-        if( ssl->in_hslen < 6 + n )
+        if( ssl->in_hslen < ssl_hs_hdr_len( ssl ) + 2 + n )
         {
             SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
             return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
@@ -2188,11 +2374,11 @@
 
     /* Ignore certificate_authorities, we only have one cert anyway */
     // TODO: should not send cert if no CA matches
-    dn_len = ( ( buf[5 + m + n] <<  8 )
-             | ( buf[6 + m + n]       ) );
+    dn_len = ( ( buf[ssl_hs_hdr_len( ssl ) + 1 + m + n] <<  8 )
+             | ( buf[ssl_hs_hdr_len( ssl ) + 2 + m + n]       ) );
 
     n += dn_len;
-    if( ssl->in_hslen != 7 + m + n )
+    if( ssl->in_hslen != ssl_hs_hdr_len( ssl ) + 3 + m + n )
     {
         SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
         return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
@@ -2230,7 +2416,7 @@
     }
     ssl->record_read = 0;
 
-    if( ssl->in_hslen  != 4 ||
+    if( ssl->in_hslen  != ssl_hs_hdr_len( ssl ) ||
         ssl->in_msg[0] != SSL_HS_SERVER_HELLO_DONE )
     {
         SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
@@ -2239,6 +2425,11 @@
 
     ssl->state++;
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        ssl_recv_flight_completed( ssl );
+#endif
+
     SSL_DEBUG_MSG( 2, ( "<= parse server hello done" ) );
 
     return( 0 );
@@ -2646,6 +2837,7 @@
     uint32_t lifetime;
     size_t ticket_len;
     unsigned char *ticket;
+    const unsigned char *msg;
 
     SSL_DEBUG_MSG( 2, ( "=> parse new session ticket" ) );
 
@@ -2667,25 +2859,25 @@
      *     opaque ticket<0..2^16-1>;
      * } NewSessionTicket;
      *
-     * 0  .  0   handshake message type
-     * 1  .  3   handshake message length
-     * 4  .  7   ticket_lifetime_hint
-     * 8  .  9   ticket_len (n)
-     * 10 .  9+n ticket content
+     * 0  .  3   ticket_lifetime_hint
+     * 4  .  5   ticket_len (n)
+     * 6  .  5+n ticket content
      */
     if( ssl->in_msg[0] != SSL_HS_NEW_SESSION_TICKET ||
-        ssl->in_hslen < 10 )
+        ssl->in_hslen < 6 + ssl_hs_hdr_len( ssl ) )
     {
         SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
         return( POLARSSL_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
     }
 
-    lifetime = ( ssl->in_msg[4] << 24 ) | ( ssl->in_msg[5] << 16 ) |
-               ( ssl->in_msg[6] <<  8 ) | ( ssl->in_msg[7]       );
+    msg = ssl->in_msg + ssl_hs_hdr_len( ssl );
 
-    ticket_len = ( ssl->in_msg[8] << 8 ) | ( ssl->in_msg[9] );
+    lifetime = ( msg[0] << 24 ) | ( msg[1] << 16 ) |
+               ( msg[2] <<  8 ) | ( msg[3]       );
 
-    if( ticket_len + 10 != ssl->in_hslen )
+    ticket_len = ( msg[4] << 8 ) | ( msg[5] );
+
+    if( ticket_len + 6 + ssl_hs_hdr_len( ssl ) != ssl->in_hslen )
     {
         SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
         return( POLARSSL_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
@@ -2695,6 +2887,7 @@
 
     /* We're not waiting for a NewSessionTicket message any more */
     ssl->handshake->new_session_ticket = 0;
+    ssl->state = SSL_SERVER_CHANGE_CIPHER_SPEC;
 
     /*
      * Zero-length ticket means the server changed his mind and doesn't want
@@ -2715,7 +2908,7 @@
         return( POLARSSL_ERR_SSL_MALLOC_FAILED );
     }
 
-    memcpy( ticket, ssl->in_msg + 10, ticket_len );
+    memcpy( ticket, msg + 6, ticket_len );
 
     ssl->session_negotiate->ticket = ticket;
     ssl->session_negotiate->ticket_len = ticket_len;
@@ -2750,6 +2943,26 @@
     if( ( ret = ssl_flush_output( ssl ) ) != 0 )
         return( ret );
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+        ssl->handshake != NULL &&
+        ssl->handshake->retransmit_state == SSL_RETRANS_SENDING )
+    {
+        if( ( ret = ssl_resend( ssl ) ) != 0 )
+            return( ret );
+    }
+#endif
+
+    /* Change state now, so that it is right in ssl_read_record(), used
+     * by DTLS for dropping out-of-sequence ChangeCipherSpec records */
+#if defined(POLARSSL_SSL_SESSION_TICKETS)
+    if( ssl->state == SSL_SERVER_CHANGE_CIPHER_SPEC &&
+        ssl->handshake->new_session_ticket != 0 )
+    {
+        ssl->state = SSL_SERVER_NEW_SESSION_TICKET;
+    }
+#endif
+
     switch( ssl->state )
     {
         case SSL_HELLO_REQUEST:
@@ -2822,13 +3035,14 @@
         *        ChangeCipherSpec
         *        Finished
         */
-       case SSL_SERVER_CHANGE_CIPHER_SPEC:
 #if defined(POLARSSL_SSL_SESSION_TICKETS)
-           if( ssl->handshake->new_session_ticket != 0 )
-               ret = ssl_parse_new_session_ticket( ssl );
-           else
+       case SSL_SERVER_NEW_SESSION_TICKET:
+           ret = ssl_parse_new_session_ticket( ssl );
+           break;
 #endif
-               ret = ssl_parse_change_cipher_spec( ssl );
+
+       case SSL_SERVER_CHANGE_CIPHER_SPEC:
+           ret = ssl_parse_change_cipher_spec( ssl );
            break;
 
        case SSL_SERVER_FINISHED:
diff --git a/library/ssl_cookie.c b/library/ssl_cookie.c
new file mode 100644
index 0000000..c2fde82
--- /dev/null
+++ b/library/ssl_cookie.c
@@ -0,0 +1,222 @@
+/*
+ *  DTLS cookie callbacks implementation
+ *
+ *  Copyright (C) 2014, Brainspark B.V.
+ *
+ *  This file is part of mbed TLS (https://tls.mbed.org)
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+/*
+ * These session callbacks use a simple chained list
+ * to store and retrieve the session information.
+ */
+
+#if !defined(POLARSSL_CONFIG_FILE)
+#include "mbedtls/config.h"
+#else
+#include POLARSSL_CONFIG_FILE
+#endif
+
+#if defined(POLARSSL_SSL_COOKIE_C)
+
+#include "mbedtls/ssl_cookie.h"
+
+#if defined(POLARSSL_PLATFORM_C)
+#include "mbedtls/platform.h"
+#else
+#define polarssl_malloc     malloc
+#define polarssl_free       free
+#endif
+
+#include <string.h>
+
+/* Implementation that should never be optimized out by the compiler */
+static void polarssl_zeroize( void *v, size_t n ) {
+    volatile unsigned char *p = v; while( n-- ) *p++ = 0;
+}
+
+/*
+ * If DTLS is in use, then at least one of SHA-1, SHA-256, SHA-512 is
+ * available. Try SHA-256 first, 512 wastes resources since we need to stay
+ * with max 32 bytes of cookie for DTLS 1.0
+ */
+#if defined(POLARSSL_SHA256_C)
+#define COOKIE_MD           POLARSSL_MD_SHA224
+#define COOKIE_MD_OUTLEN    32
+#define COOKIE_HMAC_LEN     28
+#elif defined(POLARSSL_SHA512_C)
+#define COOKIE_MD           POLARSSL_MD_SHA384
+#define COOKIE_MD_OUTLEN    48
+#define COOKIE_HMAC_LEN     28
+#elif defined(POLARSSL_SHA1_C)
+#define COOKIE_MD           POLARSSL_MD_SHA1
+#define COOKIE_MD_OUTLEN    20
+#define COOKIE_HMAC_LEN     20
+#else
+#error "DTLS hello verify needs SHA-1 or SHA-2"
+#endif
+
+/*
+ * Cookies are formed of a 4-bytes timestamp (or serial number) and
+ * an HMAC of timestemp and client ID.
+ */
+#define COOKIE_LEN      ( 4 + COOKIE_HMAC_LEN )
+
+void ssl_cookie_init( ssl_cookie_ctx *ctx )
+{
+    md_init( &ctx->hmac_ctx );
+#if !defined(POLARSSL_HAVE_TIME)
+    ctx->serial = 0;
+#endif
+    ctx->timeout = POLARSSL_SSL_COOKIE_TIMEOUT;
+}
+
+void ssl_cookie_set_timeout( ssl_cookie_ctx *ctx, unsigned long delay )
+{
+    ctx->timeout = delay;
+}
+
+void ssl_cookie_free( ssl_cookie_ctx *ctx )
+{
+    md_free( &ctx->hmac_ctx );
+}
+
+int ssl_cookie_setup( ssl_cookie_ctx *ctx,
+                      int (*f_rng)(void *, unsigned char *, size_t),
+                      void *p_rng )
+{
+    int ret;
+    unsigned char key[COOKIE_MD_OUTLEN];
+
+    if( ( ret = f_rng( p_rng, key, sizeof( key ) ) ) != 0 )
+        return( ret );
+
+    ret = md_init_ctx( &ctx->hmac_ctx, md_info_from_type( COOKIE_MD ) );
+    if( ret != 0 )
+        return( ret );
+
+    ret = md_hmac_starts( &ctx->hmac_ctx, key, sizeof( key ) );
+    if( ret != 0 )
+        return( ret );
+
+    polarssl_zeroize( key, sizeof( key ) );
+
+    return( 0 );
+}
+
+/*
+ * Generate the HMAC part of a cookie
+ */
+static int ssl_cookie_hmac( md_context_t *hmac_ctx,
+                            const unsigned char time[4],
+                            unsigned char **p, unsigned char *end,
+                            const unsigned char *cli_id, size_t cli_id_len )
+{
+    int ret;
+    unsigned char hmac_out[COOKIE_MD_OUTLEN];
+
+    if( (size_t)( end - *p ) < COOKIE_HMAC_LEN )
+        return( POLARSSL_ERR_SSL_BUFFER_TOO_SMALL );
+
+    if( ( ret = md_hmac_reset(  hmac_ctx ) ) != 0 ||
+        ( ret = md_hmac_update( hmac_ctx, time, 4 ) ) != 0 ||
+        ( ret = md_hmac_update( hmac_ctx, cli_id, cli_id_len ) ) != 0 ||
+        ( ret = md_hmac_finish( hmac_ctx, hmac_out ) ) != 0 )
+    {
+        return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
+    }
+
+    memcpy( *p, hmac_out, COOKIE_HMAC_LEN );
+    *p += COOKIE_HMAC_LEN;
+
+    return( 0 );
+}
+
+/*
+ * Generate cookie for DTLS ClientHello verification
+ */
+int ssl_cookie_write( void *p_ctx,
+                      unsigned char **p, unsigned char *end,
+                      const unsigned char *cli_id, size_t cli_id_len )
+{
+    ssl_cookie_ctx *ctx = (ssl_cookie_ctx *) p_ctx;
+    unsigned long t;
+
+    if( ctx == NULL || cli_id == NULL )
+        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+
+    if( (size_t)( end - *p ) < COOKIE_LEN )
+        return( POLARSSL_ERR_SSL_BUFFER_TOO_SMALL );
+
+#if defined(POLARSSL_HAVE_TIME)
+    t = (unsigned long) time( NULL );
+#else
+    t = ctx->serial++;
+#endif
+
+    (*p)[0] = (unsigned char)( t >> 24 );
+    (*p)[1] = (unsigned char)( t >> 16 );
+    (*p)[2] = (unsigned char)( t >>  8 );
+    (*p)[3] = (unsigned char)( t       );
+    *p += 4;
+
+    return( ssl_cookie_hmac( &ctx->hmac_ctx, *p - 4,
+                             p, end, cli_id, cli_id_len ) );
+}
+
+/*
+ * Check a cookie
+ */
+int ssl_cookie_check( void *p_ctx,
+                      const unsigned char *cookie, size_t cookie_len,
+                      const unsigned char *cli_id, size_t cli_id_len )
+{
+    unsigned char ref_hmac[COOKIE_HMAC_LEN];
+    unsigned char *p = ref_hmac;
+    ssl_cookie_ctx *ctx = (ssl_cookie_ctx *) p_ctx;
+    unsigned long cur_time, cookie_time;
+
+    if( ctx == NULL || cli_id == NULL )
+        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+
+    if( cookie_len != COOKIE_LEN )
+        return( -1 );
+
+    if( ssl_cookie_hmac( &ctx->hmac_ctx, cookie,
+                         &p, p + sizeof( ref_hmac ),
+                         cli_id, cli_id_len ) != 0 )
+        return( -1 );
+
+    if( safer_memcmp( cookie + 4, ref_hmac, sizeof( ref_hmac ) ) != 0 )
+        return( -1 );
+
+#if defined(POLARSSL_HAVE_TIME)
+    cur_time = (unsigned long) time( NULL );
+#else
+    cur_time = ctx->serial;
+#endif
+
+    cookie_time = ( (unsigned long) cookie[0] << 24 ) |
+                  ( (unsigned long) cookie[1] << 16 ) |
+                  ( (unsigned long) cookie[2] <<  8 ) |
+                  ( (unsigned long) cookie[3]       );
+
+    if( ctx->timeout != 0 && cur_time - cookie_time > ctx->timeout )
+        return( -1 );
+
+    return( 0 );
+}
+#endif /* POLARSSL_SSL_COOKIE_C */
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 2ac0902..ec80646 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -21,24 +21,24 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_SSL_SRV_C)
 
-#include "polarssl/debug.h"
-#include "polarssl/ssl.h"
+#include "mbedtls/debug.h"
+#include "mbedtls/ssl.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_ECP_C)
-#include "polarssl/ecp.h"
+#include "mbedtls/ecp.h"
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #define polarssl_malloc     malloc
@@ -210,7 +210,7 @@
      */
     state = p + 2;
     if( ssl_save_session( ssl->session_negotiate, state,
-                          SSL_MAX_CONTENT_LEN - ( state - ssl->out_ctr ) - 48,
+                          SSL_MAX_CONTENT_LEN - ( state - ssl->out_msg ) - 48,
                           &clear_len ) != 0 )
     {
         return( POLARSSL_ERR_SSL_CERTIFICATE_TOO_LARGE );
@@ -349,10 +349,40 @@
 }
 #endif /* POLARSSL_SSL_SESSION_TICKETS */
 
+#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+int ssl_set_client_transport_id( ssl_context *ssl,
+                                 const unsigned char *info,
+                                 size_t ilen )
+{
+    if( ssl->endpoint != SSL_IS_SERVER )
+        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+
+    polarssl_free( ssl->cli_id );
+
+    if( ( ssl->cli_id = polarssl_malloc( ilen ) ) == NULL )
+        return( POLARSSL_ERR_SSL_MALLOC_FAILED );
+
+    memcpy( ssl->cli_id, info, ilen );
+    ssl->cli_id_len = ilen;
+
+    return( 0 );
+}
+
+void ssl_set_dtls_cookies( ssl_context *ssl,
+                           ssl_cookie_write_t *f_cookie_write,
+                           ssl_cookie_check_t *f_cookie_check,
+                           void *p_cookie )
+{
+    ssl->f_cookie_write = f_cookie_write;
+    ssl->f_cookie_check = f_cookie_check;
+    ssl->p_cookie       = p_cookie;
+}
+#endif /* POLARSSL_SSL_DTLS_HELLO_VERIFY */
+
 #if defined(POLARSSL_SSL_SERVER_NAME_INDICATION)
 /*
  * Wrapper around f_sni, allowing use of ssl_set_own_cert() but
- * making it act on ssl->hanshake->sni_key_cert instead.
+ * making it act on ssl->handshake->sni_key_cert instead.
  */
 static int ssl_sni_wrapper( ssl_context *ssl,
                             const unsigned char* name, size_t len )
@@ -941,6 +971,12 @@
         return( 0 );
     }
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+        ( suite_info->flags & POLARSSL_CIPHERSUITE_NODTLS ) )
+        return( 0 );
+#endif
+
     if( ssl->arc4_disabled == SSL_ARC4_DISABLED &&
             suite_info->cipher == POLARSSL_CIPHER_ARC4_128 )
     {
@@ -1153,7 +1189,7 @@
         {
             SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
 #if defined(POLARSSL_SSL_RENEGOTIATION)
-            if( ssl->renegotiation == SSL_RENEGOTIATION )
+            if( ssl->renegotiation == SSL_RENEGOTIATION_IN_PROGRESS )
             {
                 SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
                                     "during renegotiation" ) );
@@ -1173,8 +1209,8 @@
     for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
     {
         if( p[0] == 0 &&
-            p[1] == (unsigned char)( ( SSL_FALLBACK_SCSV >> 8 ) & 0xff ) &&
-            p[2] == (unsigned char)( ( SSL_FALLBACK_SCSV      ) & 0xff ) )
+            p[1] == (unsigned char)( ( SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
+            p[2] == (unsigned char)( ( SSL_FALLBACK_SCSV_VALUE      ) & 0xff ) )
         {
             SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) );
 
@@ -1268,10 +1304,11 @@
 {
     int ret, got_common_suite;
     unsigned int i, j;
-    size_t n;
-    unsigned int ciph_len, sess_len;
-    unsigned int comp_len;
-    unsigned int ext_len = 0;
+    unsigned int ciph_offset, comp_offset, ext_offset;
+    unsigned int msg_len, ciph_len, sess_len, comp_len, ext_len;
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    unsigned int cookie_offset, cookie_len;
+#endif
     unsigned char *buf, *p, *ext;
 #if defined(POLARSSL_SSL_RENEGOTIATION)
     int renegotiation_info_seen = 0;
@@ -1279,9 +1316,18 @@
     int handshake_failure = 0;
     const int *ciphersuites;
     const ssl_ciphersuite_t *ciphersuite_info;
+    int major, minor;
 
     SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
 
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+read_record_header:
+#endif
+    /*
+     * If renegotiating, then the input was read with ssl_read_record(),
+     * otherwise read it ourselves manually in order to support SSLv2
+     * ClientHello, which doesn't use the same record layer format.
+     */
 #if defined(POLARSSL_SSL_RENEGOTIATION)
     if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE )
 #endif
@@ -1296,18 +1342,14 @@
     buf = ssl->in_hdr;
 
 #if defined(POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
-    if( ( buf[0] & 0x80 ) != 0 )
-        return ssl_parse_client_hello_v2( ssl );
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_STREAM )
+#endif
+        if( ( buf[0] & 0x80 ) != 0 )
+            return ssl_parse_client_hello_v2( ssl );
 #endif
 
-    SSL_DEBUG_BUF( 4, "record header", buf, 5 );
-
-    SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
-                   buf[0] ) );
-    SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
-                   ( buf[3] << 8 ) | buf[4] ) );
-    SSL_DEBUG_MSG( 3, ( "client hello v3, protocol ver: [%d:%d]",
-                   buf[1], buf[2] ) );
+    SSL_DEBUG_BUF( 4, "record header", buf, ssl_hdr_len( ssl ) );
 
     /*
      * SSLv3/TLS Client Hello
@@ -1315,84 +1357,223 @@
      * Record layer:
      *     0  .   0   message type
      *     1  .   2   protocol version
+     *     3  .   11  DTLS: epoch + record sequence number
      *     3  .   4   message length
      */
+    SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
+                   buf[0] ) );
+
+    if( buf[0] != SSL_MSG_HANDSHAKE )
+    {
+        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+    }
+
+    SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
+                   ( ssl->in_len[0] << 8 ) | ssl->in_len[1] ) );
+
+    SSL_DEBUG_MSG( 3, ( "client hello v3, protocol version: [%d:%d]",
+                   buf[1], buf[2] ) );
+
+    ssl_read_version( &major, &minor, ssl->transport, buf + 1 );
 
     /* According to RFC 5246 Appendix E.1, the version here is typically
      * "{03,00}, the lowest version number supported by the client, [or] the
      * value of ClientHello.client_version", so the only meaningful check here
      * is the major version shouldn't be less than 3 */
-    if( buf[0] != SSL_MSG_HANDSHAKE ||
-        buf[1] < SSL_MAJOR_VERSION_3 )
+    if( major < SSL_MAJOR_VERSION_3 )
     {
         SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
-    n = ( buf[3] << 8 ) | buf[4];
-
-    if( n < 45 || n > SSL_MAX_CONTENT_LEN )
+    /* For DTLS if this is the initial handshake, remember the client sequence
+     * number to use it in our next message (RFC 6347 4.2.1) */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM 
+#if defined(POLARSSL_SSL_RENEGOTIATION)
+        && ssl->renegotiation == SSL_INITIAL_HANDSHAKE
+#endif
+        )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        /* Epoch should be 0 for initial handshakes */
+        if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 )
+        {
+            SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        }
+
+        memcpy( ssl->out_ctr + 2, ssl->in_ctr + 2, 6 );
+
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+        if( ssl_dtls_replay_check( ssl ) != 0 )
+        {
+            SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) );
+            ssl->next_record_offset = 0;
+            ssl->in_left = 0;
+            goto read_record_header;
+        }
+
+        /* No MAC to check yet, so we can update right now */
+        ssl_dtls_replay_update( ssl );
+#endif
     }
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+
+    msg_len = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
 
 #if defined(POLARSSL_SSL_RENEGOTIATION)
-    if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE )
+    if( ssl->renegotiation != SSL_INITIAL_HANDSHAKE )
+    {
+        /* Set by ssl_read_record() */
+        msg_len = ssl->in_hslen;
+    }
+    else
 #endif
     {
-        if( ( ret = ssl_fetch_input( ssl, 5 + n ) ) != 0 )
+        if( msg_len > SSL_MAX_CONTENT_LEN )
+        {
+            SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        }
+
+        if( ( ret = ssl_fetch_input( ssl, ssl_hdr_len( ssl ) + msg_len ) ) != 0 )
         {
             SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
             return( ret );
         }
+
+    /* Done reading this record, get ready for the next one */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+        if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+            ssl->next_record_offset = msg_len + ssl_hdr_len( ssl );
+        else
+#endif
+            ssl->in_left = 0;
     }
 
     buf = ssl->in_msg;
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-    if( ssl->renegotiation != SSL_INITIAL_HANDSHAKE )
-        n = ssl->in_msglen;
-    else
-#endif
-        n = ssl->in_left - 5;
 
-    ssl->handshake->update_checksum( ssl, buf, n );
+    SSL_DEBUG_BUF( 4, "record contents", buf, msg_len );
+
+    ssl->handshake->update_checksum( ssl, buf, msg_len );
 
     /*
-     * SSL layer:
+     * Handshake layer:
      *     0  .   0   handshake type
      *     1  .   3   handshake length
-     *     4  .   5   protocol version
-     *     6  .   9   UNIX time()
-     *    10  .  37   random bytes
-     *    38  .  38   session id length
-     *    39  . 38+x  session id
-     *   39+x . 40+x  ciphersuitelist length
-     *   41+x . 40+y  ciphersuitelist
-     *   41+y . 41+y  compression alg length
-     *   42+y . 41+z  compression algs
-     *    ..  .  ..   extensions
+     *     4  .   5   DTLS only: message seqence number
+     *     6  .   8   DTLS only: fragment offset
+     *     9  .  11   DTLS only: fragment length
      */
-    SSL_DEBUG_BUF( 4, "record contents", buf, n );
+    if( msg_len < ssl_hs_hdr_len( ssl ) )
+    {
+        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+    }
 
-    SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d",
-                   buf[0] ) );
-    SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
-                   ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) );
-    SSL_DEBUG_MSG( 3, ( "client hello v3, max. version: [%d:%d]",
-                   buf[4], buf[5] ) );
+    SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) );
 
-    /*
-     * Check the handshake type and protocol version
-     */
     if( buf[0] != SSL_HS_CLIENT_HELLO )
     {
         SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
-    ssl->major_ver = buf[4];
-    ssl->minor_ver = buf[5];
+    SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
+                   ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) );
+
+    /* We don't support fragmentation of ClientHello (yet?) */
+    if( buf[1] != 0 ||
+        msg_len != ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) | buf[3] ) )
+    {
+        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+    }
+
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+    {
+        /*
+         * Copy the client's handshake message_seq on initial handshakes,
+         * check sequence number on renego.
+         */
+#if defined(POLARSSL_SSL_RENEGOTIATION)
+        if( ssl->renegotiation == SSL_RENEGOTIATION_IN_PROGRESS )
+        {
+            /* This couldn't be done in ssl_prepare_handshake_record() */
+            unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
+                                         ssl->in_msg[5];
+
+            if( cli_msg_seq != ssl->handshake->in_msg_seq )
+            {
+                SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: "
+                                    "%d (expected %d)", cli_msg_seq,
+                                    ssl->handshake->in_msg_seq ) );
+                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+            }
+
+            ssl->handshake->in_msg_seq++;
+        }
+        else
+#endif
+        {
+            unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
+                                         ssl->in_msg[5];
+            ssl->handshake->out_msg_seq = cli_msg_seq;
+            ssl->handshake->in_msg_seq  = cli_msg_seq + 1;
+        }
+
+        /*
+         * For now we don't support fragmentation, so make sure
+         * fragment_offset == 0 and fragment_length == length
+         */
+        if( ssl->in_msg[6] != 0 || ssl->in_msg[7] != 0 || ssl->in_msg[8] != 0 ||
+            memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 )
+        {
+            SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) );
+            return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
+        }
+    }
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+
+    buf += ssl_hs_hdr_len( ssl );
+    msg_len -= ssl_hs_hdr_len( ssl );
+
+    /*
+     * ClientHello layer:
+     *     0  .   1   protocol version
+     *     2  .  33   random bytes (starting with 4 bytes of Unix time)
+     *    34  .  35   session id length (1 byte)
+     *    35  . 34+x  session id
+     *   35+x . 35+x  DTLS only: cookie length (1 byte)
+     *   36+x .  ..   DTLS only: cookie
+     *    ..  .  ..   ciphersuite list length (2 bytes)
+     *    ..  .  ..   ciphersuite list
+     *    ..  .  ..   compression alg. list length (1 byte)
+     *    ..  .  ..   compression alg. list
+     *    ..  .  ..   extensions length (2 bytes, optional)
+     *    ..  .  ..   extensions (optional)
+     */
+
+    /*
+     * Minimal length (with everything empty and extensions ommitted) is
+     * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
+     * read at least up to session id length without worrying.
+     */
+    if( msg_len < 38 )
+    {
+        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+    }
+
+    /*
+     * Check and save the protocol version
+     */
+    SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 );
+
+    ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
+                      ssl->transport, buf );
 
     ssl->handshake->max_major_ver = ssl->major_ver;
     ssl->handshake->max_minor_ver = ssl->minor_ver;
@@ -1419,80 +1600,133 @@
     else if( ssl->minor_ver > ssl->max_minor_ver )
         ssl->minor_ver = ssl->max_minor_ver;
 
-    memcpy( ssl->handshake->randbytes, buf + 6, 32 );
+    /*
+     * Save client random (inc. Unix time)
+     */
+    SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 );
+
+    memcpy( ssl->handshake->randbytes, buf + 2, 32 );
 
     /*
-     * Check the handshake message length
+     * Check the session ID length and save session ID
      */
-    if( buf[1] != 0 || n != (unsigned int) 4 + ( ( buf[2] << 8 ) | buf[3] ) )
+    sess_len = buf[34];
+
+    if( sess_len > sizeof( ssl->session_negotiate->id ) ||
+        sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */
     {
         SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
-    /*
-     * Check the session length
-     */
-    sess_len = buf[38];
-
-    if( sess_len > 32 || sess_len > n - 42 )
-    {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
-    }
+    SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len );
 
     ssl->session_negotiate->length = sess_len;
     memset( ssl->session_negotiate->id, 0,
             sizeof( ssl->session_negotiate->id ) );
-    memcpy( ssl->session_negotiate->id, buf + 39,
+    memcpy( ssl->session_negotiate->id, buf + 35,
             ssl->session_negotiate->length );
 
     /*
-     * Check the ciphersuitelist length
+     * Check the cookie length and content
      */
-    ciph_len = ( buf[39 + sess_len] << 8 )
-             | ( buf[40 + sess_len]      );
-
-    if( ciph_len < 2 || ( ciph_len % 2 ) != 0 || ciph_len > n - 42 - sess_len )
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
-    }
+        cookie_offset = 35 + sess_len;
+        cookie_len = buf[cookie_offset];
 
-    /*
-     * Check the compression algorithms length
-     */
-    comp_len = buf[41 + sess_len + ciph_len];
-
-    if( comp_len < 1 || comp_len > 16 ||
-        comp_len > n - 42 - sess_len - ciph_len )
-    {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
-    }
-
-    /*
-     * Check the extension length
-     */
-    if( n > 42 + sess_len + ciph_len + comp_len )
-    {
-        ext_len = ( buf[42 + sess_len + ciph_len + comp_len] << 8 )
-                | ( buf[43 + sess_len + ciph_len + comp_len]      );
-
-        if( ( ext_len > 0 && ext_len < 4 ) ||
-            n != 44 + sess_len + ciph_len + comp_len + ext_len )
+        if( cookie_offset + 1 + cookie_len + 2 > msg_len )
         {
             SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-            SSL_DEBUG_BUF( 3, "Ext", buf + 44 + sess_len + ciph_len + comp_len, ext_len);
             return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
         }
+
+        SSL_DEBUG_BUF( 3, "client hello, cookie",
+                       buf + cookie_offset + 1, cookie_len );
+
+#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+        if( ssl->f_cookie_check != NULL
+#if defined(POLARSSL_SSL_RENEGOTIATION)
+            && ssl->renegotiation == SSL_INITIAL_HANDSHAKE
+#endif
+            )
+        {
+            if( ssl->f_cookie_check( ssl->p_cookie,
+                                     buf + cookie_offset + 1, cookie_len,
+                                     ssl->cli_id, ssl->cli_id_len ) != 0 )
+            {
+                SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
+                ssl->handshake->verify_cookie_len = 1;
+            }
+            else
+            {
+                SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
+                ssl->handshake->verify_cookie_len = 0;
+            }
+        }
+        else
+#endif /* POLARSSL_SSL_DTLS_HELLO_VERIFY */
+        {
+            /* We know we didn't send a cookie, so it should be empty */
+            if( cookie_len != 0 )
+            {
+                SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+            }
+
+            SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
+        }
     }
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+
+    /*
+     * Check the ciphersuitelist length (will be parsed later)
+     */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        ciph_offset = cookie_offset + 1 + cookie_len;
+    else
+#endif
+        ciph_offset = 35 + sess_len;
+
+    ciph_len = ( buf[ciph_offset + 0] << 8 )
+             | ( buf[ciph_offset + 1]      );
+
+    if( ciph_len < 2 ||
+        ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */
+        ( ciph_len % 2 ) != 0 )
+    {
+        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+    }
+
+    SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
+                   buf + ciph_offset + 2,  ciph_len );
+
+    /*
+     * Check the compression algorithms length and pick one
+     */
+    comp_offset = ciph_offset + 2 + ciph_len;
+
+    comp_len = buf[comp_offset];
+
+    if( comp_len < 1 ||
+        comp_len > 16 ||
+        comp_len + comp_offset + 1 > msg_len )
+    {
+        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+    }
+
+    SSL_DEBUG_BUF( 3, "client hello, compression",
+                      buf + comp_offset + 1, comp_len );
 
     ssl->session_negotiate->compression = SSL_COMPRESS_NULL;
 #if defined(POLARSSL_ZLIB_SUPPORT)
     for( i = 0; i < comp_len; ++i )
     {
-        if( buf[42 + sess_len + ciph_len + i] == SSL_COMPRESS_DEFLATE )
+        if( buf[comp_offset + 1 + i] == SSL_COMPRESS_DEFLATE )
         {
             ssl->session_negotiate->compression = SSL_COMPRESS_DEFLATE;
             break;
@@ -1500,66 +1734,42 @@
     }
 #endif
 
-    SSL_DEBUG_BUF( 3, "client hello, random bytes",
-                   buf +  6,  32 );
-    SSL_DEBUG_BUF( 3, "client hello, session id",
-                   buf + 38,  sess_len );
-    SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
-                   buf + 41 + sess_len,  ciph_len );
-    SSL_DEBUG_BUF( 3, "client hello, compression",
-                   buf + 42 + sess_len + ciph_len, comp_len );
+    /* See comments in ssl_write_client_hello() */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        ssl->session_negotiate->compression = SSL_COMPRESS_NULL;
+#endif
 
     /*
-     * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
+     * Check the extension length
      */
-    for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 )
+    ext_offset = comp_offset + 1 + comp_len;
+    if( msg_len > ext_offset )
     {
-        if( p[0] == 0 && p[1] == SSL_EMPTY_RENEGOTIATION_INFO )
+        if( msg_len < ext_offset + 2 )
         {
-            SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-            if( ssl->renegotiation == SSL_RENEGOTIATION )
-            {
-                SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
+            SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        }
 
-                if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
-                    return( ret );
+        ext_len = ( buf[ext_offset + 0] << 8 )
+                | ( buf[ext_offset + 1]      );
 
-                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
-            }
-            renegotiation_info_seen = 1;
-#endif /* POLARSSL_SSL_RENEGOTIATION */
-            ssl->secure_renegotiation = SSL_SECURE_RENEGOTIATION;
-            break;
+        if( ( ext_len > 0 && ext_len < 4 ) ||
+            msg_len != ext_offset + 2 + ext_len )
+        {
+            SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+            SSL_DEBUG_BUF( 3, "client hello extensions",
+                              buf + ext_offset + 2, ext_len );
+            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
         }
     }
+    else
+        ext_len = 0;
 
-#if defined(POLARSSL_SSL_FALLBACK_SCSV)
-    for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 )
-    {
-        if( p[0] == (unsigned char)( ( SSL_FALLBACK_SCSV >> 8 ) & 0xff ) &&
-            p[1] == (unsigned char)( ( SSL_FALLBACK_SCSV      ) & 0xff ) )
-        {
-            SSL_DEBUG_MSG( 0, ( "received FALLBACK_SCSV" ) );
+    ext = buf + ext_offset + 2;
 
-            if( ssl->minor_ver < ssl->max_minor_ver )
-            {
-                SSL_DEBUG_MSG( 0, ( "inapropriate fallback" ) );
-
-                ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
-                                        SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
-
-                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
-            }
-
-            break;
-        }
-    }
-#endif /* POLARSSL_SSL_FALLBACK_SCSV */
-
-    ext = buf + 44 + sess_len + ciph_len + comp_len;
-
-    while( ext_len )
+    while( ext_len != 0 )
     {
         unsigned int ext_id   = ( ( ext[0] <<  8 )
                                 | ( ext[1]       ) );
@@ -1601,7 +1811,7 @@
         case TLS_EXT_SIG_ALG:
             SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
 #if defined(POLARSSL_SSL_RENEGOTIATION)
-            if( ssl->renegotiation == SSL_RENEGOTIATION )
+            if( ssl->renegotiation == SSL_RENEGOTIATION_IN_PROGRESS )
                 break;
 #endif
 
@@ -1706,6 +1916,53 @@
         }
     }
 
+#if defined(POLARSSL_SSL_FALLBACK_SCSV)
+    for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 )
+    {
+        if( p[0] == (unsigned char)( ( SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
+            p[1] == (unsigned char)( ( SSL_FALLBACK_SCSV_VALUE      ) & 0xff ) )
+        {
+            SSL_DEBUG_MSG( 0, ( "received FALLBACK_SCSV" ) );
+
+            if( ssl->minor_ver < ssl->max_minor_ver )
+            {
+                SSL_DEBUG_MSG( 0, ( "inapropriate fallback" ) );
+
+                ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
+                                        SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
+
+                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+            }
+
+            break;
+        }
+    }
+#endif /* POLARSSL_SSL_FALLBACK_SCSV */
+
+    /*
+     * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
+     */
+    for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
+    {
+        if( p[0] == 0 && p[1] == SSL_EMPTY_RENEGOTIATION_INFO )
+        {
+            SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
+#if defined(POLARSSL_SSL_RENEGOTIATION)
+            if( ssl->renegotiation == SSL_RENEGOTIATION_IN_PROGRESS )
+            {
+                SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
+
+                if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
+                    return( ret );
+
+                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+            }
+#endif
+            ssl->secure_renegotiation = SSL_SECURE_RENEGOTIATION;
+            break;
+        }
+    }
+
     /*
      * Renegotiation security checks
      */
@@ -1716,21 +1973,21 @@
         handshake_failure = 1;
     }
 #if defined(POLARSSL_SSL_RENEGOTIATION)
-    else if( ssl->renegotiation == SSL_RENEGOTIATION &&
+    else if( ssl->renegotiation == SSL_RENEGOTIATION_IN_PROGRESS &&
              ssl->secure_renegotiation == SSL_SECURE_RENEGOTIATION &&
              renegotiation_info_seen == 0 )
     {
         SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
         handshake_failure = 1;
     }
-    else if( ssl->renegotiation == SSL_RENEGOTIATION &&
+    else if( ssl->renegotiation == SSL_RENEGOTIATION_IN_PROGRESS &&
              ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
              ssl->allow_legacy_renegotiation == SSL_LEGACY_NO_RENEGOTIATION )
     {
         SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
         handshake_failure = 1;
     }
-    else if( ssl->renegotiation == SSL_RENEGOTIATION &&
+    else if( ssl->renegotiation == SSL_RENEGOTIATION_IN_PROGRESS &&
              ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
              renegotiation_info_seen == 1 )
     {
@@ -1756,13 +2013,13 @@
     ciphersuites = ssl->ciphersuite_list[ssl->minor_ver];
     ciphersuite_info = NULL;
 #if defined(POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
-    for( j = 0, p = buf + 41 + sess_len; j < ciph_len; j += 2, p += 2 )
+    for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
     {
         for( i = 0; ciphersuites[i] != 0; i++ )
 #else
     for( i = 0; ciphersuites[i] != 0; i++ )
     {
-        for( j = 0, p = buf + 41 + sess_len; j < ciph_len; j += 2, p += 2 )
+        for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
 #endif
         {
             if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
@@ -1801,9 +2058,13 @@
     ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
     ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
 
-    ssl->in_left = 0;
     ssl->state++;
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        ssl_recv_flight_completed( ssl );
+#endif
+
     SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
 
     return( 0 );
@@ -2064,6 +2325,69 @@
 }
 #endif /* POLARSSL_ECDH_C || POLARSSL_ECDSA_C */
 
+#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+static int ssl_write_hello_verify_request( ssl_context *ssl )
+{
+    int ret;
+    unsigned char *p = ssl->out_msg + 4;
+    unsigned char *cookie_len_byte;
+
+    SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) );
+
+    /*
+     * struct {
+     *   ProtocolVersion server_version;
+     *   opaque cookie<0..2^8-1>;
+     * } HelloVerifyRequest;
+     */
+
+    /* The RFC is not clear on this point, but sending the actual negotiated
+     * version looks like the most interoperable thing to do. */
+    ssl_write_version( ssl->major_ver, ssl->minor_ver,
+                       ssl->transport, p );
+    SSL_DEBUG_BUF( 3, "server version", (unsigned char *) p, 2 );
+    p += 2;
+
+    /* If we get here, f_cookie_check is not null */
+    if( ssl->f_cookie_write == NULL )
+    {
+        SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
+        return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
+    }
+
+    /* Skip length byte until we know the length */
+    cookie_len_byte = p++;
+
+    if( ( ret = ssl->f_cookie_write( ssl->p_cookie,
+                                     &p, ssl->out_buf + SSL_BUFFER_LEN,
+                                     ssl->cli_id, ssl->cli_id_len ) ) != 0 )
+    {
+        SSL_DEBUG_RET( 1, "f_cookie_write", ret );
+        return( ret );
+    }
+
+    *cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) );
+
+    SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte );
+
+    ssl->out_msglen  = p - ssl->out_msg;
+    ssl->out_msgtype = SSL_MSG_HANDSHAKE;
+    ssl->out_msg[0]  = SSL_HS_HELLO_VERIFY_REQUEST;
+
+    ssl->state = SSL_SERVER_HELLO_VERIFY_REQUEST_SENT;
+
+    if( ( ret = ssl_write_record( ssl ) ) != 0 )
+    {
+        SSL_DEBUG_RET( 1, "ssl_write_record", ret );
+        return( ret );
+    }
+
+    SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) );
+
+    return( 0 );
+}
+#endif /* POLARSSL_SSL_DTLS_HELLO_VERIFY */
+
 static int ssl_write_server_hello( ssl_context *ssl )
 {
 #if defined(POLARSSL_HAVE_TIME)
@@ -2075,6 +2399,17 @@
 
     SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
 
+#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+        ssl->handshake->verify_cookie_len != 0 )
+    {
+        SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) );
+        SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
+
+        return( ssl_write_hello_verify_request( ssl ) );
+    }
+#endif /* POLARSSL_SSL_DTLS_HELLO_VERIFY */
+
     if( ssl->f_rng == NULL )
     {
         SSL_DEBUG_MSG( 1, ( "no RNG provided") );
@@ -2091,11 +2426,12 @@
     buf = ssl->out_msg;
     p = buf + 4;
 
-    *p++ = (unsigned char) ssl->major_ver;
-    *p++ = (unsigned char) ssl->minor_ver;
+    ssl_write_version( ssl->major_ver, ssl->minor_ver,
+                       ssl->transport, p );
+    p += 2;
 
     SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
-                   buf[4], buf[5] ) );
+                        buf[4], buf[5] ) );
 
 #if defined(POLARSSL_HAVE_TIME)
     t = time( NULL );
@@ -2823,6 +3159,11 @@
 
     ssl->state++;
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        ssl_send_flight_completed( ssl );
+#endif
+
     if( ( ret = ssl_write_record( ssl ) ) != 0 )
     {
         SSL_DEBUG_RET( 1, "ssl_write_record", ret );
@@ -2885,6 +3226,7 @@
     int ret;
     size_t len = pk_get_len( ssl_own_key( ssl ) );
     unsigned char *pms = ssl->handshake->premaster + pms_offset;
+    unsigned char ver[2];
     unsigned char fake_pms[48], peer_pms[48];
     unsigned char mask;
     size_t i;
@@ -2917,6 +3259,9 @@
         return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
     }
 
+    ssl_write_version( ssl->handshake->max_major_ver,
+                       ssl->handshake->max_minor_ver,
+                       ssl->transport, ver );
     /*
      * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
      * must not cause the connection to end immediately; instead, send a
@@ -2934,8 +3279,8 @@
                       ssl->f_rng, ssl->p_rng );
 
     ret |= ssl->handshake->pmslen - 48;
-    ret |= peer_pms[0] - ssl->handshake->max_major_ver;
-    ret |= peer_pms[1] - ssl->handshake->max_minor_ver;
+    ret |= peer_pms[0] - ver[0];
+    ret |= peer_pms[1] - ver[1];
 
 #if defined(POLARSSL_SSL_DEBUG_ALL)
     if( ret != 0 )
@@ -3031,6 +3376,7 @@
 {
     int ret;
     const ssl_ciphersuite_t *ciphersuite_info;
+    unsigned char *p, *end;
 
     ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
 
@@ -3042,6 +3388,9 @@
         return( ret );
     }
 
+    p = ssl->in_msg + ssl_hs_hdr_len( ssl );
+    end = ssl->in_msg + ssl->in_hslen;
+
     if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
     {
         SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
@@ -3057,9 +3406,6 @@
 #if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED)
     if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_RSA )
     {
-        unsigned char *p = ssl->in_msg + 4;
-        unsigned char *end = ssl->in_msg + ssl->in_hslen;
-
         if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
         {
             SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
@@ -3097,7 +3443,7 @@
         ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDH_ECDSA )
     {
         if( ( ret = ecdh_read_public( &ssl->handshake->ecdh_ctx,
-                        ssl->in_msg + 4, ssl->in_hslen - 4 ) ) != 0 )
+                                      p, end - p) ) != 0 )
         {
             SSL_DEBUG_RET( 1, "ecdh_read_public", ret );
             return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
@@ -3125,9 +3471,6 @@
 #if defined(POLARSSL_KEY_EXCHANGE_PSK_ENABLED)
     if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK )
     {
-        unsigned char *p = ssl->in_msg + 4;
-        unsigned char *end = ssl->in_msg + ssl->in_hslen;
-
         if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
         {
             SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
@@ -3152,9 +3495,6 @@
 #if defined(POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED)
     if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK )
     {
-        unsigned char *p = ssl->in_msg + 4;
-        unsigned char *end = ssl->in_msg + ssl->in_hslen;
-
         if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
         {
             SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
@@ -3179,9 +3519,6 @@
 #if defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED)
     if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
     {
-        unsigned char *p = ssl->in_msg + 4;
-        unsigned char *end = ssl->in_msg + ssl->in_hslen;
-
         if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
         {
             SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
@@ -3211,9 +3548,6 @@
 #if defined(POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
     if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
     {
-        unsigned char *p = ssl->in_msg + 4;
-        unsigned char *end = ssl->in_msg + ssl->in_hslen;
-
         if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
         {
             SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
@@ -3241,10 +3575,7 @@
 #if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED)
     if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA )
     {
-        if( ( ret = ssl_parse_encrypted_pms( ssl,
-                                             ssl->in_msg + 4,
-                                             ssl->in_msg + ssl->in_hslen,
-                                             0 ) ) != 0 )
+        if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 )
         {
             SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
             return( ret );
@@ -3297,7 +3628,7 @@
 static int ssl_parse_certificate_verify( ssl_context *ssl )
 {
     int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
-    size_t sa_len, sig_len;
+    size_t i, sig_len;
     unsigned char hash[48];
     unsigned char *hash_start = hash;
     size_t hashlen;
@@ -3312,20 +3643,15 @@
     if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
         ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
         ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
+        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK ||
+        ssl->session_negotiate->peer_cert == NULL )
     {
         SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
         ssl->state++;
         return( 0 );
     }
 
-    if( ssl->session_negotiate->peer_cert == NULL )
-    {
-        SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
-        ssl->state++;
-        return( 0 );
-    }
-
+    /* Needs to be done before read_record() to exclude current message */
     ssl->handshake->calc_verify( ssl, hash );
 
     if( ( ret = ssl_read_record( ssl ) ) != 0 )
@@ -3336,32 +3662,25 @@
 
     ssl->state++;
 
-    if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
+    if( ssl->in_msgtype != SSL_MSG_HANDSHAKE ||
+        ssl->in_msg[0] != SSL_HS_CERTIFICATE_VERIFY )
     {
         SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
         return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
     }
 
-    if( ssl->in_msg[0] != SSL_HS_CERTIFICATE_VERIFY )
-    {
-        SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
-    }
+    i = ssl_hs_hdr_len( ssl );
 
     /*
-     *     0  .   0   handshake type
-     *     1  .   3   handshake length
-     *     4  .   5   sig alg (TLS 1.2 only)
-     *    4+n .  5+n  signature length (n = sa_len)
-     *    6+n . 6+n+m signature (m = sig_len)
+     *  struct {
+     *     SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only
+     *     opaque signature<0..2^16-1>;
+     *  } DigitallySigned;
      */
-
 #if defined(POLARSSL_SSL_PROTO_SSL3) || defined(POLARSSL_SSL_PROTO_TLS1) || \
     defined(POLARSSL_SSL_PROTO_TLS1_1)
     if( ssl->minor_ver != SSL_MINOR_VERSION_3 )
     {
-        sa_len = 0;
-
         md_alg = POLARSSL_MD_NONE;
         hashlen = 36;
 
@@ -3380,12 +3699,16 @@
 #if defined(POLARSSL_SSL_PROTO_TLS1_2)
     if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
     {
-        sa_len = 2;
+        if( i + 2 > ssl->in_hslen )
+        {
+            SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
+            return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
+        }
 
         /*
          * Hash
          */
-        if( ssl->in_msg[4] != ssl->handshake->verify_sig_alg )
+        if( ssl->in_msg[i] != ssl->handshake->verify_sig_alg )
         {
             SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
                                 " for verify message" ) );
@@ -3397,10 +3720,12 @@
         /* Info from md_alg will be used instead */
         hashlen = 0;
 
+        i++;
+
         /*
          * Signature
          */
-        if( ( pk_alg = ssl_pk_alg_from_sig( ssl->in_msg[5] ) )
+        if( ( pk_alg = ssl_pk_alg_from_sig( ssl->in_msg[i] ) )
                         == POLARSSL_PK_NONE )
         {
             SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
@@ -3416,6 +3741,8 @@
             SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
             return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
         }
+
+        i++;
     }
     else
 #endif /* POLARSSL_SSL_PROTO_TLS1_2 */
@@ -3424,9 +3751,16 @@
         return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
     }
 
-    sig_len = ( ssl->in_msg[4 + sa_len] << 8 ) | ssl->in_msg[5 + sa_len];
+    if( i + 2 > ssl->in_hslen )
+    {
+        SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
+        return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
+    }
 
-    if( sa_len + sig_len + 6 != ssl->in_hslen )
+    sig_len = ( ssl->in_msg[i] << 8 ) | ssl->in_msg[i+1];
+    i += 2;
+
+    if( i + sig_len != ssl->in_hslen )
     {
         SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
         return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
@@ -3434,7 +3768,7 @@
 
     if( ( ret = pk_verify( &ssl->session_negotiate->peer_cert->pk,
                            md_alg, hash_start, hashlen,
-                           ssl->in_msg + 6 + sa_len, sig_len ) ) != 0 )
+                           ssl->in_msg + i, sig_len ) ) != 0 )
     {
         SSL_DEBUG_RET( 1, "pk_verify", ret );
         return( ret );
@@ -3520,6 +3854,16 @@
     if( ( ret = ssl_flush_output( ssl ) ) != 0 )
         return( ret );
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+        ssl->handshake != NULL &&
+        ssl->handshake->retransmit_state == SSL_RETRANS_SENDING )
+    {
+        if( ( ret = ssl_resend( ssl ) ) != 0 )
+            return( ret );
+    }
+#endif
+
     switch( ssl->state )
     {
         case SSL_HELLO_REQUEST:
@@ -3533,6 +3877,11 @@
             ret = ssl_parse_client_hello( ssl );
             break;
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+        case SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
+            return( POLARSSL_ERR_SSL_HELLO_VERIFY_REQUIRED );
+#endif
+
         /*
          *  ==>   ServerHello
          *        Certificate
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 77bb9ad..25d7d25 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -29,25 +29,25 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_SSL_TLS_C)
 
-#include "polarssl/debug.h"
-#include "polarssl/ssl.h"
+#include "mbedtls/debug.h"
+#include "mbedtls/ssl.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_X509_CRT_PARSE_C) && \
     defined(POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE)
-#include "polarssl/oid.h"
+#include "mbedtls/oid.h"
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #define polarssl_malloc     malloc
@@ -64,6 +64,80 @@
     volatile unsigned char *p = v; while( n-- ) *p++ = 0;
 }
 
+/* Length of the "epoch" field in the record header */
+static inline size_t ssl_ep_len( const ssl_context *ssl )
+{
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        return( 2 );
+#else
+    ((void) ssl);
+#endif
+    return( 0 );
+}
+
+
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+/*
+ * Start a timer.
+ * Passing millisecs = 0 cancels a running timer.
+ * The timer is already running iff time_limit != 0.
+ */
+static void ssl_set_timer( ssl_context *ssl, uint32_t millisecs )
+{
+    ssl->time_limit = millisecs;
+    get_timer( &ssl->time_info, 1 );
+}
+
+/*
+ * Return -1 is timer is expired, 0 if it isn't.
+ */
+static int ssl_check_timer( ssl_context *ssl )
+{
+    if( ssl->time_limit != 0 &&
+        get_timer( &ssl->time_info, 0 ) > ssl->time_limit )
+    {
+        return( -1 );
+    }
+
+    return( 0 );
+}
+
+/*
+ * Double the retransmit timeout value, within the allowed range,
+ * returning -1 if the maximum value has already been reached.
+ */
+static int ssl_double_retransmit_timeout( ssl_context *ssl )
+{
+    uint32_t new_timeout;
+
+    if( ssl->handshake->retransmit_timeout >= ssl->hs_timeout_max )
+        return( -1 );
+
+    new_timeout = 2 * ssl->handshake->retransmit_timeout;
+
+    /* Avoid arithmetic overflow and range overflow */
+    if( new_timeout < ssl->handshake->retransmit_timeout ||
+        new_timeout > ssl->hs_timeout_max )
+    {
+        new_timeout = ssl->hs_timeout_max;
+    }
+
+    ssl->handshake->retransmit_timeout = new_timeout;
+    SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
+                        ssl->handshake->retransmit_timeout ) );
+
+    return( 0 );
+}
+
+static void ssl_reset_retransmit_timeout( ssl_context *ssl )
+{
+    ssl->handshake->retransmit_timeout = ssl->hs_timeout_min;
+    SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
+                        ssl->handshake->retransmit_timeout ) );
+}
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+
 #if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
 /*
  * Convert max_fragment_length codes to length.
@@ -1090,7 +1164,6 @@
  */
 static int ssl_encrypt_buf( ssl_context *ssl )
 {
-    size_t i;
     cipher_mode_t mode;
     int auth_done = 0;
 
@@ -1132,7 +1205,9 @@
         defined(POLARSSL_SSL_PROTO_TLS1_2)
         if( ssl->minor_ver >= SSL_MINOR_VERSION_1 )
         {
-            md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_ctr, 13 );
+            md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_ctr, 8 );
+            md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_hdr, 3 );
+            md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_len, 2 );
             md_hmac_update( &ssl->transform_out->md_ctx_enc,
                              ssl->out_msg, ssl->out_msglen );
             md_hmac_finish( &ssl->transform_out->md_ctx_enc,
@@ -1199,8 +1274,8 @@
 
         memcpy( add_data, ssl->out_ctr, 8 );
         add_data[8]  = ssl->out_msgtype;
-        add_data[9]  = ssl->major_ver;
-        add_data[10] = ssl->minor_ver;
+        ssl_write_version( ssl->major_ver, ssl->minor_ver,
+                           ssl->transport, add_data + 9 );
         add_data[11] = ( ssl->out_msglen >> 8 ) & 0xFF;
         add_data[12] = ssl->out_msglen & 0xFF;
 
@@ -1282,7 +1357,7 @@
     {
         int ret;
         unsigned char *enc_msg;
-        size_t enc_msglen, padlen, olen = 0;
+        size_t enc_msglen, padlen, olen = 0, i;
 
         padlen = ssl->transform_out->ivlen - ( ssl->out_msglen + 1 ) %
                  ssl->transform_out->ivlen;
@@ -1406,17 +1481,6 @@
         return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
     }
 
-    for( i = 8; i > 0; i-- )
-        if( ++ssl->out_ctr[i - 1] != 0 )
-            break;
-
-    /* The loops goes to its end iff the counter is wrapping */
-    if( i == 0 )
-    {
-        SSL_DEBUG_MSG( 1, ( "outgoing message counter would wrap" ) );
-        return( POLARSSL_ERR_SSL_COUNTER_WRAPPING );
-    }
-
     SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) );
 
     return( 0 );
@@ -1505,8 +1569,8 @@
 
         memcpy( add_data, ssl->in_ctr, 8 );
         add_data[8]  = ssl->in_msgtype;
-        add_data[9]  = ssl->major_ver;
-        add_data[10] = ssl->minor_ver;
+        ssl_write_version( ssl->major_ver, ssl->minor_ver,
+                           ssl->transport, add_data + 9 );
         add_data[11] = ( ssl->in_msglen >> 8 ) & 0xFF;
         add_data[12] = ssl->in_msglen & 0xFF;
 
@@ -1782,8 +1846,8 @@
 
         ssl->in_msglen -= ssl->transform_in->maclen;
 
-        ssl->in_hdr[3] = (unsigned char)( ssl->in_msglen >> 8 );
-        ssl->in_hdr[4] = (unsigned char)( ssl->in_msglen      );
+        ssl->in_len[0] = (unsigned char)( ssl->in_msglen >> 8 );
+        ssl->in_len[1] = (unsigned char)( ssl->in_msglen      );
 
         memcpy( tmp, ssl->in_msg + ssl->in_msglen, ssl->transform_in->maclen );
 
@@ -1820,7 +1884,9 @@
 
             extra_run &= correct * 0xFF;
 
-            md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_ctr, 13 );
+            md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_ctr, 8 );
+            md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_hdr, 3 );
+            md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_len, 2 );
             md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_msg,
                              ssl->in_msglen );
             md_hmac_finish( &ssl->transform_in->md_ctx_dec,
@@ -1885,15 +1951,24 @@
     else
         ssl->nb_zero = 0;
 
-    for( i = 8; i > 0; i-- )
-        if( ++ssl->in_ctr[i - 1] != 0 )
-            break;
-
-    /* The loops goes to its end iff the counter is wrapping */
-    if( i == 0 )
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
     {
-        SSL_DEBUG_MSG( 1, ( "incoming message counter would wrap" ) );
-        return( POLARSSL_ERR_SSL_COUNTER_WRAPPING );
+        ; /* in_ctr read from peer, not maintained internally */
+    }
+    else
+#endif
+    {
+        for( i = 8; i > ssl_ep_len( ssl ); i-- )
+            if( ++ssl->in_ctr[i - 1] != 0 )
+                break;
+
+        /* The loop goes to its end iff the counter is wrapping */
+        if( i == ssl_ep_len( ssl ) )
+        {
+            SSL_DEBUG_MSG( 1, ( "incoming message counter would wrap" ) );
+            return( POLARSSL_ERR_SSL_COUNTER_WRAPPING );
+        }
     }
 
     SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) );
@@ -2002,8 +2077,51 @@
 }
 #endif /* POLARSSL_ZLIB_SUPPORT */
 
+#if defined(POLARSSL_SSL_SRV_C) && defined(POLARSSL_SSL_RENEGOTIATION)
+static int ssl_write_hello_request( ssl_context *ssl );
+
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+static int ssl_resend_hello_request( ssl_context *ssl )
+{
+    /* If renegotiation is not enforced, retransmit until we would reach max
+     * timeout if we were using the usual handshake doubling scheme */
+    if( ssl->renego_max_records < 0 )
+    {
+        uint32_t ratio = ssl->hs_timeout_max / ssl->hs_timeout_min + 1;
+        unsigned char doublings = 1;
+
+        while( ratio != 0 )
+        {
+            ++doublings;
+            ratio >>= 1;
+        }
+
+        if( ++ssl->renego_records_seen > doublings )
+        {
+            SSL_DEBUG_MSG( 0, ( "no longer retransmitting hello request" ) );
+            return( 0 );
+        }
+    }
+
+    return( ssl_write_hello_request( ssl ) );
+}
+#endif
+#endif /* POLARSSL_SSL_SRV_C && POLARSSL_SSL_RENEGOTIATION */
+
 /*
- * Fill the input message buffer
+ * Fill the input message buffer by appending data to it.
+ * The amount of data already fetched is in ssl->in_left.
+ *
+ * If we return 0, is it guaranteed that (at least) nb_want bytes are
+ * available (from this read and/or a previous one). Otherwise, an error code
+ * is returned (possibly EOF or WANT_READ).
+ *
+ * With stream transport (TLS) on success ssl->in_left == nb_want, but
+ * with datagram transport (DTLS) on success ssl->in_left >= nb_want,
+ * since we always read a whole datagram at once.
+ *
+ * For DTLS, it is up to the caller to set ssl->next_record_offset when
+ * they're done reading a record.
  */
 int ssl_fetch_input( ssl_context *ssl, size_t nb_want )
 {
@@ -2012,28 +2130,175 @@
 
     SSL_DEBUG_MSG( 2, ( "=> fetch input" ) );
 
-    if( nb_want > SSL_BUFFER_LEN - 8 )
+    if( ssl->f_recv == NULL && ssl->f_recv_timeout == NULL )
+    {
+        SSL_DEBUG_MSG( 1, ( "Bad usage of ssl_set_bio() "
+                            "or ssl_set_bio_timeout()" ) );
+        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+    }
+
+    if( nb_want > SSL_BUFFER_LEN - (size_t)( ssl->in_hdr - ssl->in_buf ) )
     {
         SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) );
         return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
     }
 
-    while( ssl->in_left < nb_want )
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
     {
-        len = nb_want - ssl->in_left;
-        ret = ssl->f_recv( ssl->p_recv, ssl->in_hdr + ssl->in_left, len );
+        uint32_t timeout;
+
+        /*
+         * The point is, we need to always read a full datagram at once, so we
+         * sometimes read more then requested, and handle the additional data.
+         * It could be the rest of the current record (while fetching the
+         * header) and/or some other records in the same datagram.
+         */
+
+        /*
+         * Move to the next record in the already read datagram if applicable
+         */
+        if( ssl->next_record_offset != 0 )
+        {
+            if( ssl->in_left < ssl->next_record_offset )
+            {
+                SSL_DEBUG_MSG( 1, ( "should never happen" ) );
+                return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
+            }
+
+            ssl->in_left -= ssl->next_record_offset;
+
+            if( ssl->in_left != 0 )
+            {
+                SSL_DEBUG_MSG( 2, ( "next record in same datagram, offset: %d",
+                                    ssl->next_record_offset ) );
+                memmove( ssl->in_hdr,
+                         ssl->in_hdr + ssl->next_record_offset,
+                         ssl->in_left );
+            }
+
+            ssl->next_record_offset = 0;
+        }
 
         SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
                        ssl->in_left, nb_want ) );
-        SSL_DEBUG_RET( 2, "ssl->f_recv", ret );
 
-        if( ret == 0 )
-            return( POLARSSL_ERR_SSL_CONN_EOF );
+        /*
+         * Done if we already have enough data.
+         */
+        if( nb_want <= ssl->in_left)
+        {
+            SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
+            return( 0 );
+        }
+
+        /*
+         * A record can't be split accross datagrams. If we need to read but
+         * are not at the beginning of a new record, the caller did something
+         * wrong.
+         */
+        if( ssl->in_left != 0 )
+        {
+            SSL_DEBUG_MSG( 1, ( "should never happen" ) );
+            return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
+        }
+
+        SSL_DEBUG_MSG( 3, ( "current timer: %u", ssl->time_limit ) );
+
+        /*
+         * Don't even try to read if time's out already.
+         * This avoids by-passing the timer when repeatedly receiving messages
+         * that will end up being dropped.
+         */
+        if( ssl_check_timer( ssl ) != 0 )
+            ret = POLARSSL_ERR_NET_TIMEOUT;
+        else
+        {
+            len = SSL_BUFFER_LEN - ( ssl->in_hdr - ssl->in_buf );
+
+            if( ssl->state != SSL_HANDSHAKE_OVER )
+                timeout = ssl->handshake->retransmit_timeout;
+            else
+                timeout = ssl->read_timeout;
+
+            SSL_DEBUG_MSG( 3, ( "f_recv_timeout: %u ms", timeout ) );
+
+            if( ssl->f_recv_timeout != NULL && timeout != 0 )
+                ret = ssl->f_recv_timeout( ssl->p_bio, ssl->in_hdr, len,
+                                                                    timeout );
+            else
+                ret = ssl->f_recv( ssl->p_bio, ssl->in_hdr, len );
+
+            SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
+
+            if( ret == 0 )
+                return( POLARSSL_ERR_SSL_CONN_EOF );
+        }
+
+        if( ret == POLARSSL_ERR_NET_TIMEOUT )
+        {
+            SSL_DEBUG_MSG( 2, ( "timeout" ) );
+            ssl_set_timer( ssl, 0 );
+
+            if( ssl->state != SSL_HANDSHAKE_OVER )
+            {
+                if( ssl_double_retransmit_timeout( ssl ) != 0 )
+                {
+                    SSL_DEBUG_MSG( 1, ( "handshake timeout" ) );
+                    return( POLARSSL_ERR_NET_TIMEOUT );
+                }
+
+                if( ( ret = ssl_resend( ssl ) ) != 0 )
+                {
+                    SSL_DEBUG_RET( 1, "ssl_resend", ret );
+                    return( ret );
+                }
+
+                return( POLARSSL_ERR_NET_WANT_READ );
+            }
+#if defined(POLARSSL_SSL_SRV_C) && defined(POLARSSL_SSL_RENEGOTIATION)
+            else if( ssl->endpoint == SSL_IS_SERVER &&
+                     ssl->renegotiation == SSL_RENEGOTIATION_PENDING )
+            {
+                if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
+                {
+                    SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
+                    return( ret );
+                }
+
+                return( POLARSSL_ERR_NET_WANT_READ );
+            }
+#endif /* POLARSSL_SSL_SRV_C && POLARSSL_SSL_RENEGOTIATION */
+        }
 
         if( ret < 0 )
             return( ret );
 
-        ssl->in_left += ret;
+        ssl->in_left = ret;
+    }
+    else
+#endif
+    {
+        SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
+                       ssl->in_left, nb_want ) );
+
+        while( ssl->in_left < nb_want )
+        {
+            len = nb_want - ssl->in_left;
+            ret = ssl->f_recv( ssl->p_bio, ssl->in_hdr + ssl->in_left, len );
+
+            SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
+                           ssl->in_left, nb_want ) );
+            SSL_DEBUG_RET( 2, "ssl->f_recv", ret );
+
+            if( ret == 0 )
+                return( POLARSSL_ERR_SSL_CONN_EOF );
+
+            if( ret < 0 )
+                return( ret );
+
+            ssl->in_left += ret;
+        }
     }
 
     SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
@@ -2047,17 +2312,32 @@
 int ssl_flush_output( ssl_context *ssl )
 {
     int ret;
-    unsigned char *buf;
+    unsigned char *buf, i;
 
     SSL_DEBUG_MSG( 2, ( "=> flush output" ) );
 
+    if( ssl->f_send == NULL )
+    {
+        SSL_DEBUG_MSG( 1, ( "Bad usage of ssl_set_bio() "
+                            "or ssl_set_bio_timeout()" ) );
+        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+    }
+
+    /* Avoid incrementing counter if data is flushed */
+    if( ssl->out_left == 0 )
+    {
+        SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
+        return( 0 );
+    }
+
     while( ssl->out_left > 0 )
     {
         SSL_DEBUG_MSG( 2, ( "message length: %d, out_left: %d",
-                       5 + ssl->out_msglen, ssl->out_left ) );
+                       ssl_hdr_len( ssl ) + ssl->out_msglen, ssl->out_left ) );
 
-        buf = ssl->out_hdr + 5 + ssl->out_msglen - ssl->out_left;
-        ret = ssl->f_send( ssl->p_send, buf, ssl->out_left );
+        buf = ssl->out_hdr + ssl_hdr_len( ssl ) +
+              ssl->out_msglen - ssl->out_left;
+        ret = ssl->f_send( ssl->p_bio, buf, ssl->out_left );
 
         SSL_DEBUG_RET( 2, "ssl->f_send", ret );
 
@@ -2067,14 +2347,253 @@
         ssl->out_left -= ret;
     }
 
+    for( i = 8; i > ssl_ep_len( ssl ); i-- )
+        if( ++ssl->out_ctr[i - 1] != 0 )
+            break;
+
+    /* The loop goes to its end iff the counter is wrapping */
+    if( i == ssl_ep_len( ssl ) )
+    {
+        SSL_DEBUG_MSG( 1, ( "outgoing message counter would wrap" ) );
+        return( POLARSSL_ERR_SSL_COUNTER_WRAPPING );
+    }
+
     SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
 
     return( 0 );
 }
 
 /*
+ * Functions to handle the DTLS retransmission state machine
+ */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+/*
+ * Append current handshake message to current outgoing flight
+ */
+static int ssl_flight_append( ssl_context *ssl )
+{
+    ssl_flight_item *msg;
+
+    /* Allocate space for current message */
+    if( ( msg = polarssl_malloc( sizeof(  ssl_flight_item ) ) ) == NULL )
+    {
+        SSL_DEBUG_MSG( 1, ( "malloc %d bytes failed",
+                            sizeof( ssl_flight_item ) ) );
+        return( POLARSSL_ERR_SSL_MALLOC_FAILED );
+    }
+
+    if( ( msg->p = polarssl_malloc( ssl->out_msglen ) ) == NULL )
+    {
+        SSL_DEBUG_MSG( 1, ( "malloc %d bytes failed", ssl->out_msglen ) );
+        polarssl_free( msg );
+        return( POLARSSL_ERR_SSL_MALLOC_FAILED );
+    }
+
+    /* Copy current handshake message with headers */
+    memcpy( msg->p, ssl->out_msg, ssl->out_msglen );
+    msg->len = ssl->out_msglen;
+    msg->type = ssl->out_msgtype;
+    msg->next = NULL;
+
+    /* Append to the current flight */
+    if( ssl->handshake->flight == NULL )
+        ssl->handshake->flight = msg;
+    else
+    {
+        ssl_flight_item *cur = ssl->handshake->flight;
+        while( cur->next != NULL )
+            cur = cur->next;
+        cur->next = msg;
+    }
+
+    return( 0 );
+}
+
+/*
+ * Free the current flight of handshake messages
+ */
+static void ssl_flight_free( ssl_flight_item *flight )
+{
+    ssl_flight_item *cur = flight;
+    ssl_flight_item *next;
+
+    while( cur != NULL )
+    {
+        next = cur->next;
+
+        polarssl_free( cur->p );
+        polarssl_free( cur );
+
+        cur = next;
+    }
+}
+
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+static void ssl_dtls_replay_reset( ssl_context *ssl );
+#endif
+
+/*
+ * Swap transform_out and out_ctr with the alternative ones
+ */
+static void ssl_swap_epochs( ssl_context *ssl )
+{
+    ssl_transform *tmp_transform;
+    unsigned char tmp_out_ctr[8];
+
+    if( ssl->transform_out == ssl->handshake->alt_transform_out )
+    {
+        SSL_DEBUG_MSG( 3, ( "skip swap epochs" ) );
+        return;
+    }
+
+    SSL_DEBUG_MSG( 3, ( "swap epochs" ) );
+
+    /* Swap transforms */
+    tmp_transform                     = ssl->transform_out;
+    ssl->transform_out                = ssl->handshake->alt_transform_out;
+    ssl->handshake->alt_transform_out = tmp_transform;
+
+    /* Swap epoch + sequence_number */
+    memcpy( tmp_out_ctr,                 ssl->out_ctr,                8 );
+    memcpy( ssl->out_ctr,                ssl->handshake->alt_out_ctr, 8 );
+    memcpy( ssl->handshake->alt_out_ctr, tmp_out_ctr,                 8 );
+
+    /* Adjust to the newly activated transform */
+    if( ssl->transform_out != NULL &&
+        ssl->minor_ver >= SSL_MINOR_VERSION_2 )
+    {
+        ssl->out_msg = ssl->out_iv + ssl->transform_out->ivlen -
+                                     ssl->transform_out->fixed_ivlen;
+    }
+    else
+        ssl->out_msg = ssl->out_iv;
+
+#if defined(POLARSSL_SSL_HW_RECORD_ACCEL)
+    if( ssl_hw_record_activate != NULL )
+    {
+        if( ( ret = ssl_hw_record_activate( ssl, SSL_CHANNEL_OUTBOUND ) ) != 0 )
+        {
+            SSL_DEBUG_RET( 1, "ssl_hw_record_activate", ret );
+            return( POLARSSL_ERR_SSL_HW_ACCEL_FAILED );
+        }
+    }
+#endif
+}
+
+/*
+ * Retransmit the current flight of messages.
+ *
+ * Need to remember the current message in case flush_output returns
+ * WANT_WRITE, causing us to exit this function and come back later.
+ * This function must be called until state is no longer SENDING.
+ */
+int ssl_resend( ssl_context *ssl )
+{
+    SSL_DEBUG_MSG( 2, ( "=> ssl_resend" ) );
+
+    if( ssl->handshake->retransmit_state != SSL_RETRANS_SENDING )
+    {
+        SSL_DEBUG_MSG( 2, ( "initialise resending" ) );
+
+        ssl->handshake->cur_msg = ssl->handshake->flight;
+        ssl_swap_epochs( ssl );
+
+        ssl->handshake->retransmit_state = SSL_RETRANS_SENDING;
+    }
+
+    while( ssl->handshake->cur_msg != NULL )
+    {
+        int ret;
+        ssl_flight_item *cur = ssl->handshake->cur_msg;
+
+        /* Swap epochs before sending Finished: we can't do it after
+         * sending ChangeCipherSpec, in case write returns WANT_READ.
+         * Must be done before copying, may change out_msg pointer */
+        if( cur->type == SSL_MSG_HANDSHAKE &&
+            cur->p[0] == SSL_HS_FINISHED )
+        {
+            ssl_swap_epochs( ssl );
+        }
+
+        memcpy( ssl->out_msg, cur->p, cur->len );
+        ssl->out_msglen = cur->len;
+        ssl->out_msgtype = cur->type;
+
+        ssl->handshake->cur_msg = cur->next;
+
+        SSL_DEBUG_BUF( 3, "resent handshake message header", ssl->out_msg, 12 );
+
+        if( ( ret = ssl_write_record( ssl ) ) != 0 )
+        {
+            SSL_DEBUG_RET( 1, "ssl_write_record", ret );
+            return( ret );
+        }
+    }
+
+    if( ssl->state == SSL_HANDSHAKE_OVER )
+        ssl->handshake->retransmit_state = SSL_RETRANS_FINISHED;
+    else
+    {
+        ssl->handshake->retransmit_state = SSL_RETRANS_WAITING;
+        ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
+    }
+
+    SSL_DEBUG_MSG( 2, ( "<= ssl_resend" ) );
+
+    return( 0 );
+}
+
+/*
+ * To be called when the last message of an incoming flight is received.
+ */
+void ssl_recv_flight_completed( ssl_context *ssl )
+{
+    /* We won't need to resend that one any more */
+    ssl_flight_free( ssl->handshake->flight );
+    ssl->handshake->flight = NULL;
+    ssl->handshake->cur_msg = NULL;
+
+    /* The next incoming flight will start with this msg_seq */
+    ssl->handshake->in_flight_start_seq = ssl->handshake->in_msg_seq;
+
+    /* Cancel timer */
+    ssl_set_timer( ssl, 0 );
+
+    if( ssl->in_msgtype == SSL_MSG_HANDSHAKE &&
+        ssl->in_msg[0] == SSL_HS_FINISHED )
+    {
+        ssl->handshake->retransmit_state = SSL_RETRANS_FINISHED;
+    }
+    else
+        ssl->handshake->retransmit_state = SSL_RETRANS_PREPARING;
+}
+
+/*
+ * To be called when the last message of an outgoing flight is send.
+ */
+void ssl_send_flight_completed( ssl_context *ssl )
+{
+    ssl_reset_retransmit_timeout( ssl );
+    ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
+
+    if( ssl->in_msgtype == SSL_MSG_HANDSHAKE &&
+        ssl->in_msg[0] == SSL_HS_FINISHED )
+    {
+        ssl->handshake->retransmit_state = SSL_RETRANS_FINISHED;
+    }
+    else
+        ssl->handshake->retransmit_state = SSL_RETRANS_WAITING;
+}
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+
+/*
  * Record layer functions
  */
+
+/*
+ * Write current record.
+ * Uses ssl->out_msgtype, ssl->out_msglen and bytes at ssl->out_msg.
+ */
 int ssl_write_record( ssl_context *ssl )
 {
     int ret, done = 0;
@@ -2082,16 +2601,75 @@
 
     SSL_DEBUG_MSG( 2, ( "=> write record" ) );
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+        ssl->handshake != NULL &&
+        ssl->handshake->retransmit_state == SSL_RETRANS_SENDING )
+    {
+        ; /* Skip special handshake treatment when resending */
+    }
+    else
+#endif
     if( ssl->out_msgtype == SSL_MSG_HANDSHAKE )
     {
         ssl->out_msg[1] = (unsigned char)( ( len - 4 ) >> 16 );
         ssl->out_msg[2] = (unsigned char)( ( len - 4 ) >>  8 );
         ssl->out_msg[3] = (unsigned char)( ( len - 4 )       );
 
+        /*
+         * DTLS has additional fields in the Handshake layer,
+         * between the length field and the actual payload:
+         *      uint16 message_seq;
+         *      uint24 fragment_offset;
+         *      uint24 fragment_length;
+         */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+        if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        {
+            /* Make room for the additional DTLS fields */
+            memmove( ssl->out_msg + 12, ssl->out_msg + 4, len - 4 );
+            ssl->out_msglen += 8;
+            len += 8;
+
+            /* Write message_seq and update it, except for HelloRequest */
+            if( ssl->out_msg[0] != SSL_HS_HELLO_REQUEST )
+            {
+                ssl->out_msg[4] = ( ssl->handshake->out_msg_seq >> 8 ) & 0xFF;
+                ssl->out_msg[5] = ( ssl->handshake->out_msg_seq      ) & 0xFF;
+                ++( ssl->handshake->out_msg_seq );
+            }
+            else
+            {
+                ssl->out_msg[4] = 0;
+                ssl->out_msg[5] = 0;
+            }
+
+            /* We don't fragment, so frag_offset = 0 and frag_len = len */
+            memset( ssl->out_msg + 6, 0x00, 3 );
+            memcpy( ssl->out_msg + 9, ssl->out_msg + 1, 3 );
+        }
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+
         if( ssl->out_msg[0] != SSL_HS_HELLO_REQUEST )
             ssl->handshake->update_checksum( ssl, ssl->out_msg, len );
     }
 
+    /* Save handshake and CCS messages for resending */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+        ssl->handshake != NULL &&
+        ssl->handshake->retransmit_state != SSL_RETRANS_SENDING &&
+        ( ssl->out_msgtype == SSL_MSG_CHANGE_CIPHER_SPEC ||
+          ssl->out_msgtype == SSL_MSG_HANDSHAKE ) )
+    {
+        if( ( ret = ssl_flight_append( ssl ) ) != 0 )
+        {
+            SSL_DEBUG_RET( 1, "ssl_flight_append", ret );
+            return( ret );
+        }
+    }
+#endif
+
 #if defined(POLARSSL_ZLIB_SUPPORT)
     if( ssl->transform_out != NULL &&
         ssl->session_out->compression == SSL_COMPRESS_DEFLATE )
@@ -2125,10 +2703,11 @@
     if( !done )
     {
         ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype;
-        ssl->out_hdr[1] = (unsigned char) ssl->major_ver;
-        ssl->out_hdr[2] = (unsigned char) ssl->minor_ver;
-        ssl->out_hdr[3] = (unsigned char)( len >> 8 );
-        ssl->out_hdr[4] = (unsigned char)( len      );
+        ssl_write_version( ssl->major_ver, ssl->minor_ver,
+                           ssl->transport, ssl->out_hdr + 1 );
+
+        ssl->out_len[0] = (unsigned char)( len >> 8 );
+        ssl->out_len[1] = (unsigned char)( len      );
 
         if( ssl->transform_out != NULL )
         {
@@ -2139,19 +2718,19 @@
             }
 
             len = ssl->out_msglen;
-            ssl->out_hdr[3] = (unsigned char)( len >> 8 );
-            ssl->out_hdr[4] = (unsigned char)( len      );
+            ssl->out_len[0] = (unsigned char)( len >> 8 );
+            ssl->out_len[1] = (unsigned char)( len      );
         }
 
-        ssl->out_left = 5 + ssl->out_msglen;
+        ssl->out_left = ssl_hdr_len( ssl ) + ssl->out_msglen;
 
         SSL_DEBUG_MSG( 3, ( "output record: msgtype = %d, "
                             "version = [%d:%d], msglen = %d",
                        ssl->out_hdr[0], ssl->out_hdr[1], ssl->out_hdr[2],
-                     ( ssl->out_hdr[3] << 8 ) | ssl->out_hdr[4] ) );
+                     ( ssl->out_len[0] << 8 ) | ssl->out_len[1] ) );
 
         SSL_DEBUG_BUF( 4, "output record sent to network",
-                       ssl->out_hdr, 5 + ssl->out_msglen );
+                       ssl->out_hdr, ssl_hdr_len( ssl ) + ssl->out_msglen );
     }
 
     if( ( ret = ssl_flush_output( ssl ) ) != 0 )
@@ -2165,93 +2744,530 @@
     return( 0 );
 }
 
-int ssl_read_record( ssl_context *ssl )
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+/*
+ * Mark bits in bitmask (used for DTLS HS reassembly)
+ */
+static void ssl_bitmask_set( unsigned char *mask, size_t offset, size_t len )
 {
-    int ret, done = 0;
+    unsigned int start_bits, end_bits;
 
-    SSL_DEBUG_MSG( 2, ( "=> read record" ) );
-
-    if( ssl->in_hslen != 0 &&
-        ssl->in_hslen < ssl->in_msglen )
+    start_bits = 8 - ( offset % 8 );
+    if( start_bits != 8 )
     {
-        /*
-         * Get next Handshake message in the current record
-         */
-        ssl->in_msglen -= ssl->in_hslen;
+        size_t first_byte_idx = offset / 8;
 
-        memmove( ssl->in_msg, ssl->in_msg + ssl->in_hslen,
-                 ssl->in_msglen );
-
-        ssl->in_hslen  = 4;
-        ssl->in_hslen += ( ssl->in_msg[2] << 8 ) | ssl->in_msg[3];
-
-        SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
-                            " %d, type = %d, hslen = %d",
-                       ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
-
-        if( ssl->in_msglen < 4 || ssl->in_msg[1] != 0 )
+        /* Special case */
+        if( len <= start_bits )
         {
-            SSL_DEBUG_MSG( 1, ( "bad handshake length" ) );
-            return( POLARSSL_ERR_SSL_INVALID_RECORD );
+            for( ; len != 0; len-- )
+                mask[first_byte_idx] |= 1 << ( start_bits - len );
+
+            /* Avoid potential issues with offset or len becoming invalid */
+            return;
         }
 
-        if( ssl->in_msglen < ssl->in_hslen )
-        {
-            SSL_DEBUG_MSG( 1, ( "bad handshake length" ) );
-            return( POLARSSL_ERR_SSL_INVALID_RECORD );
-        }
+        offset += start_bits; /* Now offset % 8 == 0 */
+        len -= start_bits;
 
-        if( ssl->state != SSL_HANDSHAKE_OVER )
-            ssl->handshake->update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
-
-        return( 0 );
+        for( ; start_bits != 0; start_bits-- )
+            mask[first_byte_idx] |= 1 << ( start_bits - 1 );
     }
 
-    ssl->in_hslen = 0;
+    end_bits = len % 8;
+    if( end_bits != 0 )
+    {
+        size_t last_byte_idx = ( offset + len ) / 8;
+
+        len -= end_bits; /* Now len % 8 == 0 */
+
+        for( ; end_bits != 0; end_bits-- )
+            mask[last_byte_idx] |= 1 << ( 8 - end_bits );
+    }
+
+    memset( mask + offset / 8, 0xFF, len / 8 );
+}
+
+/*
+ * Check that bitmask is full
+ */
+static int ssl_bitmask_check( unsigned char *mask, size_t len )
+{
+    size_t i;
+
+    for( i = 0; i < len / 8; i++ )
+        if( mask[i] != 0xFF )
+            return( -1 );
+
+    for( i = 0; i < len % 8; i++ )
+        if( ( mask[len / 8] & ( 1 << ( 7 - i ) ) ) == 0 )
+            return( -1 );
+
+    return( 0 );
+}
+
+/*
+ * Reassemble fragmented DTLS handshake messages.
+ *
+ * Use a temporary buffer for reassembly, divided in two parts:
+ * - the first holds the reassembled message (including handshake header),
+ * - the second holds a bitmask indicating which parts of the message
+ *   (excluding headers) have been received so far.
+ */
+static int ssl_reassemble_dtls_handshake( ssl_context *ssl )
+{
+    unsigned char *msg, *bitmask;
+    size_t frag_len, frag_off;
+    size_t msg_len = ssl->in_hslen - 12; /* Without headers */
+
+    if( ssl->handshake == NULL )
+    {
+        SSL_DEBUG_MSG( 1, ( "not supported outside handshake (for now)" ) );
+        return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
+    }
 
     /*
-     * Read the record header and validate it
+     * For first fragment, check size and allocate buffer
      */
-    if( ( ret = ssl_fetch_input( ssl, 5 ) ) != 0 )
+    if( ssl->handshake->hs_msg == NULL )
     {
-        SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
-        return( ret );
+        size_t alloc_len;
+
+        SSL_DEBUG_MSG( 2, ( "initialize reassembly, total length = %d",
+                            msg_len ) );
+
+        if( ssl->in_hslen > SSL_MAX_CONTENT_LEN )
+        {
+            SSL_DEBUG_MSG( 1, ( "handshake message too large" ) );
+            return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
+        }
+
+        /* The bitmask needs one bit per byte of message excluding header */
+        alloc_len = 12 + msg_len + msg_len / 8 + ( msg_len % 8 != 0 );
+
+        ssl->handshake->hs_msg = polarssl_malloc( alloc_len );
+        if( ssl->handshake->hs_msg == NULL )
+        {
+            SSL_DEBUG_MSG( 1, ( "malloc failed (%d bytes)", alloc_len ) );
+            return( POLARSSL_ERR_SSL_MALLOC_FAILED );
+        }
+
+        memset( ssl->handshake->hs_msg, 0, alloc_len );
+
+        /* Prepare final header: copy msg_type, length and message_seq,
+         * then add standardised fragment_offset and fragment_length */
+        memcpy( ssl->handshake->hs_msg, ssl->in_msg, 6 );
+        memset( ssl->handshake->hs_msg + 6, 0, 3 );
+        memcpy( ssl->handshake->hs_msg + 9,
+                ssl->handshake->hs_msg + 1, 3 );
+    }
+    else
+    {
+        /* Make sure msg_type and length are consistent */
+        if( memcmp( ssl->handshake->hs_msg, ssl->in_msg, 4 ) != 0 )
+        {
+            SSL_DEBUG_MSG( 1, ( "fragment header mismatch" ) );
+            return( POLARSSL_ERR_SSL_INVALID_RECORD );
+        }
     }
 
+    msg = ssl->handshake->hs_msg + 12;
+    bitmask = msg + msg_len;
+
+    /*
+     * Check and copy current fragment
+     */
+    frag_off = ( ssl->in_msg[6]  << 16 ) |
+               ( ssl->in_msg[7]  << 8  ) |
+                 ssl->in_msg[8];
+    frag_len = ( ssl->in_msg[9]  << 16 ) |
+               ( ssl->in_msg[10] << 8  ) |
+                 ssl->in_msg[11];
+
+    if( frag_off + frag_len > msg_len )
+    {
+        SSL_DEBUG_MSG( 1, ( "invalid fragment offset/len: %d + %d > %d",
+                          frag_off, frag_len, msg_len ) );
+        return( POLARSSL_ERR_SSL_INVALID_RECORD );
+    }
+
+    if( frag_len + 12 > ssl->in_msglen )
+    {
+        SSL_DEBUG_MSG( 1, ( "invalid fragment length: %d + 12 > %d",
+                          frag_len, ssl->in_msglen ) );
+        return( POLARSSL_ERR_SSL_INVALID_RECORD );
+    }
+
+    SSL_DEBUG_MSG( 2, ( "adding fragment, offset = %d, length = %d",
+                        frag_off, frag_len ) );
+
+    memcpy( msg + frag_off, ssl->in_msg + 12, frag_len );
+    ssl_bitmask_set( bitmask, frag_off, frag_len );
+
+    /*
+     * Do we have the complete message by now?
+     * If yes, finalize it, else ask to read the next record.
+     */
+    if( ssl_bitmask_check( bitmask, msg_len ) != 0 )
+    {
+        SSL_DEBUG_MSG( 2, ( "message is not complete yet" ) );
+        return( POLARSSL_ERR_NET_WANT_READ );
+    }
+
+    SSL_DEBUG_MSG( 2, ( "handshake message completed" ) );
+
+    if( frag_len + 12 < ssl->in_msglen )
+    {
+        /*
+         * We'got more handshake messages in the same record.
+         * This case is not handled now because no know implementation does
+         * that and it's hard to test, so we prefer to fail cleanly for now.
+         */
+        SSL_DEBUG_MSG( 1, ( "last fragment not alone in its record" ) );
+        return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
+    }
+
+    if( ssl->in_left > ssl->next_record_offset )
+    {
+        /*
+         * We've got more data in the buffer after the current record,
+         * that we don't want to overwrite. Move it before writing the
+         * reassembled message, and adjust in_left and next_record_offset.
+         */
+        unsigned char *cur_remain = ssl->in_hdr + ssl->next_record_offset;
+        unsigned char *new_remain = ssl->in_msg + ssl->in_hslen;
+        size_t remain_len = ssl->in_left - ssl->next_record_offset;
+
+        /* First compute and check new lengths */
+        ssl->next_record_offset = new_remain - ssl->in_hdr;
+        ssl->in_left = ssl->next_record_offset + remain_len;
+
+        if( ssl->in_left > SSL_BUFFER_LEN -
+                           (size_t)( ssl->in_hdr - ssl->in_buf ) )
+        {
+            SSL_DEBUG_MSG( 1, ( "reassembled message too large for buffer" ) );
+            return( POLARSSL_ERR_SSL_BUFFER_TOO_SMALL );
+        }
+
+        memmove( new_remain, cur_remain, remain_len );
+    }
+
+    memcpy( ssl->in_msg, ssl->handshake->hs_msg, ssl->in_hslen );
+
+    polarssl_free( ssl->handshake->hs_msg );
+    ssl->handshake->hs_msg = NULL;
+
+    SSL_DEBUG_BUF( 3, "reassembled handshake message",
+                   ssl->in_msg, ssl->in_hslen );
+
+    return( 0 );
+}
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+
+static int ssl_prepare_handshake_record( ssl_context *ssl )
+{
+    if( ssl->in_msglen < ssl_hs_hdr_len( ssl ) )
+    {
+        SSL_DEBUG_MSG( 1, ( "handshake message too short: %d",
+                            ssl->in_msglen ) );
+        return( POLARSSL_ERR_SSL_INVALID_RECORD );
+    }
+
+    ssl->in_hslen = ssl_hs_hdr_len( ssl ) + (
+                    ( ssl->in_msg[1] << 16 ) |
+                    ( ssl->in_msg[2] << 8  ) |
+                      ssl->in_msg[3] );
+
+    SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
+                        " %d, type = %d, hslen = %d",
+                        ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
+
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+    {
+        int ret;
+        unsigned int recv_msg_seq = ( ssl->in_msg[4] << 8 ) | ssl->in_msg[5];
+
+        /* ssl->handshake is NULL when receiving ClientHello for renego */
+        if( ssl->handshake != NULL &&
+            recv_msg_seq != ssl->handshake->in_msg_seq )
+        {
+            /* Retransmit only on last message from previous flight, to avoid
+             * too many retransmissions.
+             * Besides, No sane server ever retransmits HelloVerifyRequest */
+            if( recv_msg_seq == ssl->handshake->in_flight_start_seq - 1 &&
+                ssl->in_msg[0] != SSL_HS_HELLO_VERIFY_REQUEST )
+            {
+                SSL_DEBUG_MSG( 2, ( "received message from last flight, "
+                                    "message_seq = %d, start_of_flight = %d",
+                                    recv_msg_seq,
+                                    ssl->handshake->in_flight_start_seq ) );
+
+                if( ( ret = ssl_resend( ssl ) ) != 0 )
+                {
+                    SSL_DEBUG_RET( 1, "ssl_resend", ret );
+                    return( ret );
+                }
+            }
+            else
+            {
+                SSL_DEBUG_MSG( 2, ( "dropping out-of-sequence message: "
+                                    "message_seq = %d, expected = %d",
+                                    recv_msg_seq,
+                                    ssl->handshake->in_msg_seq ) );
+            }
+
+            return( POLARSSL_ERR_NET_WANT_READ );
+        }
+        /* Wait until message completion to increment in_msg_seq */
+
+        /* Reassemble if current message is fragmented or reassembly is
+         * already in progress */
+        if( ssl->in_msglen < ssl->in_hslen ||
+            memcmp( ssl->in_msg + 6, "\0\0\0",        3 ) != 0 ||
+            memcmp( ssl->in_msg + 9, ssl->in_msg + 1, 3 ) != 0 ||
+            ( ssl->handshake != NULL && ssl->handshake->hs_msg != NULL ) )
+        {
+            SSL_DEBUG_MSG( 2, ( "found fragmented DTLS handshake message" ) );
+
+            if( ( ret = ssl_reassemble_dtls_handshake( ssl ) ) != 0 )
+            {
+                SSL_DEBUG_RET( 1, "ssl_reassemble_dtls_handshake", ret );
+                return( ret );
+            }
+        }
+    }
+    else
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+    /* With TLS we don't handle fragmentation (for now) */
+    if( ssl->in_msglen < ssl->in_hslen )
+    {
+        SSL_DEBUG_MSG( 1, ( "TLS handshake fragmentation not supported" ) );
+        return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
+    }
+
+    if( ssl->state != SSL_HANDSHAKE_OVER )
+        ssl->handshake->update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
+
+    /* Handshake message is complete, increment counter */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+        ssl->handshake != NULL )
+    {
+        ssl->handshake->in_msg_seq++;
+    }
+#endif
+
+    return( 0 );
+}
+
+/*
+ * DTLS anti-replay: RFC 6347 4.1.2.6
+ *
+ * in_window is a field of bits numbered from 0 (lsb) to 63 (msb).
+ * Bit n is set iff record number in_window_top - n has been seen.
+ *
+ * Usually, in_window_top is the last record number seen and the lsb of
+ * in_window is set. The only exception is the initial state (record number 0
+ * not seen yet).
+ */
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+static void ssl_dtls_replay_reset( ssl_context *ssl )
+{
+    ssl->in_window_top = 0;
+    ssl->in_window = 0;
+}
+
+static inline uint64_t ssl_load_six_bytes( unsigned char *buf )
+{
+    return( ( (uint64_t) buf[0] << 40 ) |
+            ( (uint64_t) buf[1] << 32 ) |
+            ( (uint64_t) buf[2] << 24 ) |
+            ( (uint64_t) buf[3] << 16 ) |
+            ( (uint64_t) buf[4] <<  8 ) |
+            ( (uint64_t) buf[5]       ) );
+}
+
+/*
+ * Return 0 if sequence number is acceptable, -1 otherwise
+ */
+int ssl_dtls_replay_check( ssl_context *ssl )
+{
+    uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
+    uint64_t bit;
+
+    if( ssl->anti_replay == SSL_ANTI_REPLAY_DISABLED )
+        return( 0 );
+
+    if( rec_seqnum > ssl->in_window_top )
+        return( 0 );
+
+    bit = ssl->in_window_top - rec_seqnum;
+
+    if( bit >= 64 )
+        return( -1 );
+
+    if( ( ssl->in_window & ( (uint64_t) 1 << bit ) ) != 0 )
+        return( -1 );
+
+    return( 0 );
+}
+
+/*
+ * Update replay window on new validated record
+ */
+void ssl_dtls_replay_update( ssl_context *ssl )
+{
+    uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
+
+    if( ssl->anti_replay == SSL_ANTI_REPLAY_DISABLED )
+        return;
+
+    if( rec_seqnum > ssl->in_window_top )
+    {
+        /* Update window_top and the contents of the window */
+        uint64_t shift = rec_seqnum - ssl->in_window_top;
+
+        if( shift >= 64 )
+            ssl->in_window = 1;
+        else
+        {
+            ssl->in_window <<= shift;
+            ssl->in_window |= 1;
+        }
+
+        ssl->in_window_top = rec_seqnum;
+    }
+    else
+    {
+        /* Mark that number as seen in the current window */
+        uint64_t bit = ssl->in_window_top - rec_seqnum;
+
+        if( bit < 64 ) /* Always true, but be extra sure */
+            ssl->in_window |= (uint64_t) 1 << bit;
+    }
+}
+#endif /* POLARSSL_SSL_DTLS_ANTI_REPLAY */
+
+/*
+ * ContentType type;
+ * ProtocolVersion version;
+ * uint16 epoch;            // DTLS only
+ * uint48 sequence_number;  // DTLS only
+ * uint16 length;
+ */
+static int ssl_parse_record_header( ssl_context *ssl )
+{
+    int ret;
+    int major_ver, minor_ver;
+
+    SSL_DEBUG_BUF( 4, "input record header", ssl->in_hdr, ssl_hdr_len( ssl ) );
+
     ssl->in_msgtype =  ssl->in_hdr[0];
-    ssl->in_msglen = ( ssl->in_hdr[3] << 8 ) | ssl->in_hdr[4];
+    ssl->in_msglen = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
+    ssl_read_version( &major_ver, &minor_ver, ssl->transport, ssl->in_hdr + 1 );
 
     SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, "
                         "version = [%d:%d], msglen = %d",
-                     ssl->in_hdr[0], ssl->in_hdr[1], ssl->in_hdr[2],
-                   ( ssl->in_hdr[3] << 8 ) | ssl->in_hdr[4] ) );
+                        ssl->in_msgtype,
+                        major_ver, minor_ver, ssl->in_msglen ) );
 
-    if( ssl->in_hdr[1] != ssl->major_ver )
+    /* Check record type */
+    if( ssl->in_msgtype != SSL_MSG_HANDSHAKE &&
+        ssl->in_msgtype != SSL_MSG_ALERT &&
+        ssl->in_msgtype != SSL_MSG_CHANGE_CIPHER_SPEC &&
+        ssl->in_msgtype != SSL_MSG_APPLICATION_DATA )
+    {
+        SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
+
+        if( ( ret = ssl_send_alert_message( ssl,
+                        SSL_ALERT_LEVEL_FATAL,
+                        SSL_ALERT_MSG_UNEXPECTED_MESSAGE ) ) != 0 )
+        {
+            return( ret );
+        }
+
+        return( POLARSSL_ERR_SSL_INVALID_RECORD );
+    }
+
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+    {
+        /* Drop unexpected ChangeCipherSpec messages */
+        if( ssl->in_msgtype == SSL_MSG_CHANGE_CIPHER_SPEC &&
+            ssl->state != SSL_CLIENT_CHANGE_CIPHER_SPEC &&
+            ssl->state != SSL_SERVER_CHANGE_CIPHER_SPEC )
+        {
+            SSL_DEBUG_MSG( 1, ( "dropping unexpected ChangeCipherSpec" ) );
+            return( POLARSSL_ERR_SSL_INVALID_RECORD );
+        }
+
+        /* Drop unexpected ApplicationData records,
+         * except at the beginning of renegotiations */
+        if( ssl->in_msgtype == SSL_MSG_APPLICATION_DATA &&
+            ssl->state != SSL_HANDSHAKE_OVER
+#if defined(POLARSSL_SSL_RENEGOTIATION)
+            && ! ( ssl->renegotiation == SSL_RENEGOTIATION_IN_PROGRESS &&
+                   ssl->state == SSL_SERVER_HELLO )
+#endif
+            )
+        {
+            SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) );
+            return( POLARSSL_ERR_SSL_INVALID_RECORD );
+        }
+    }
+#endif
+
+    /* Check version */
+    if( major_ver != ssl->major_ver )
     {
         SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
         return( POLARSSL_ERR_SSL_INVALID_RECORD );
     }
 
-    if( ssl->in_hdr[2] > ssl->max_minor_ver )
+    if( minor_ver > ssl->max_minor_ver )
     {
         SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
         return( POLARSSL_ERR_SSL_INVALID_RECORD );
     }
 
-    /* Sanity check (outer boundaries) */
-    if( ssl->in_msglen < 1 || ssl->in_msglen > SSL_BUFFER_LEN - 13 )
+    /* Check epoch (and sequence number) with DTLS */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+    {
+        unsigned int rec_epoch = ( ssl->in_ctr[0] << 8 ) | ssl->in_ctr[1];
+
+        if( rec_epoch != ssl->in_epoch )
+        {
+            SSL_DEBUG_MSG( 1, ( "record from another epoch: "
+                                "expected %d, received %d",
+                                 ssl->in_epoch, rec_epoch ) );
+            return( POLARSSL_ERR_SSL_INVALID_RECORD );
+        }
+
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+        if( ssl_dtls_replay_check( ssl ) != 0 )
+        {
+            SSL_DEBUG_MSG( 1, ( "replayed record" ) );
+            return( POLARSSL_ERR_SSL_INVALID_RECORD );
+        }
+#endif
+    }
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+
+    /* Check length against the size of our buffer */
+    if( ssl->in_msglen > SSL_BUFFER_LEN
+                         - (size_t)( ssl->in_msg - ssl->in_buf ) )
     {
         SSL_DEBUG_MSG( 1, ( "bad message length" ) );
         return( POLARSSL_ERR_SSL_INVALID_RECORD );
     }
 
-    /*
-     * Make sure the message length is acceptable for the current transform
-     * and protocol version.
-     */
+    /* Check length against bounds of the current transform and version */
     if( ssl->transform_in == NULL )
     {
-        if( ssl->in_msglen > SSL_MAX_CONTENT_LEN )
+        if( ssl->in_msglen < 1 ||
+            ssl->in_msglen > SSL_MAX_CONTENT_LEN )
         {
             SSL_DEBUG_MSG( 1, ( "bad message length" ) );
             return( POLARSSL_ERR_SSL_INVALID_RECORD );
@@ -2273,7 +3289,6 @@
             return( POLARSSL_ERR_SSL_INVALID_RECORD );
         }
 #endif
-
 #if defined(POLARSSL_SSL_PROTO_TLS1) || defined(POLARSSL_SSL_PROTO_TLS1_1) || \
     defined(POLARSSL_SSL_PROTO_TLS1_2)
         /*
@@ -2289,17 +3304,18 @@
 #endif
     }
 
-    /*
-     * Read and optionally decrypt the message contents
-     */
-    if( ( ret = ssl_fetch_input( ssl, 5 + ssl->in_msglen ) ) != 0 )
-    {
-        SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
-        return( ret );
-    }
+    return( 0 );
+}
+
+/*
+ * If applicable, decrypt (and decompress) record content
+ */
+static int ssl_prepare_record_content( ssl_context *ssl )
+{
+    int ret, done = 0;
 
     SSL_DEBUG_BUF( 4, "input record from network",
-                   ssl->in_hdr, 5 + ssl->in_msglen );
+                   ssl->in_hdr, ssl_hdr_len( ssl ) + ssl->in_msglen );
 
 #if defined(POLARSSL_SSL_HW_RECORD_ACCEL)
     if( ssl_hw_record_read != NULL )
@@ -2321,14 +3337,6 @@
     {
         if( ( ret = ssl_decrypt_buf( ssl ) ) != 0 )
         {
-#if defined(POLARSSL_SSL_ALERT_MESSAGES)
-            if( ret == POLARSSL_ERR_SSL_INVALID_MAC )
-            {
-                ssl_send_alert_message( ssl,
-                                        SSL_ALERT_LEVEL_FATAL,
-                                        SSL_ALERT_MSG_BAD_RECORD_MAC );
-            }
-#endif
             SSL_DEBUG_RET( 1, "ssl_decrypt_buf", ret );
             return( ret );
         }
@@ -2353,54 +3361,192 @@
             return( ret );
         }
 
-        ssl->in_hdr[3] = (unsigned char)( ssl->in_msglen >> 8 );
-        ssl->in_hdr[4] = (unsigned char)( ssl->in_msglen      );
+        // TODO: what's the purpose of these lines? is in_len used?
+        ssl->in_len[0] = (unsigned char)( ssl->in_msglen >> 8 );
+        ssl->in_len[1] = (unsigned char)( ssl->in_msglen      );
     }
 #endif /* POLARSSL_ZLIB_SUPPORT */
 
-    if( ssl->in_msgtype != SSL_MSG_HANDSHAKE &&
-        ssl->in_msgtype != SSL_MSG_ALERT &&
-        ssl->in_msgtype != SSL_MSG_CHANGE_CIPHER_SPEC &&
-        ssl->in_msgtype != SSL_MSG_APPLICATION_DATA )
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
     {
-        SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
+        ssl_dtls_replay_update( ssl );
+    }
+#endif
 
-        if( ( ret = ssl_send_alert_message( ssl,
-                        SSL_ALERT_LEVEL_FATAL,
-                        SSL_ALERT_MSG_UNEXPECTED_MESSAGE ) ) != 0 )
-        {
+    return( 0 );
+}
+
+static void ssl_handshake_wrapup_free_hs_transform( ssl_context *ssl );
+
+/*
+ * Read a record.
+ *
+ * For DTLS, silently ignore invalid records (RFC 4.1.2.7.)
+ * and continue reading until a valid record is found.
+ */
+int ssl_read_record( ssl_context *ssl )
+{
+    int ret;
+
+    SSL_DEBUG_MSG( 2, ( "=> read record" ) );
+
+    if( ssl->in_hslen != 0 && ssl->in_hslen < ssl->in_msglen )
+    {
+        /*
+         * Get next Handshake message in the current record
+         */
+        ssl->in_msglen -= ssl->in_hslen;
+
+        memmove( ssl->in_msg, ssl->in_msg + ssl->in_hslen,
+                 ssl->in_msglen );
+
+        SSL_DEBUG_BUF( 4, "remaining content in record",
+                           ssl->in_msg, ssl->in_msglen );
+
+        if( ( ret = ssl_prepare_handshake_record( ssl ) ) != 0 )
             return( ret );
-        }
 
-        return( POLARSSL_ERR_SSL_INVALID_RECORD );
+        return( 0 );
     }
 
+    ssl->in_hslen = 0;
+
+    /*
+     * Read the record header and parse it
+     */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+read_record_header:
+#endif
+    if( ( ret = ssl_fetch_input( ssl, ssl_hdr_len( ssl ) ) ) != 0 )
+    {
+        SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
+        return( ret );
+    }
+
+    if( ( ret = ssl_parse_record_header( ssl ) ) != 0 )
+    {
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+        if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        {
+            /* Ignore bad record and get next one; drop the whole datagram
+             * since current header cannot be trusted to find the next record
+             * in current datagram */
+            ssl->next_record_offset = 0;
+            ssl->in_left = 0;
+
+            SSL_DEBUG_MSG( 1, ( "discarding invalid record (header)" ) );
+            goto read_record_header;
+        }
+#endif
+        return( ret );
+    }
+
+    /*
+     * Read and optionally decrypt the message contents
+     */
+    if( ( ret = ssl_fetch_input( ssl,
+                                 ssl_hdr_len( ssl ) + ssl->in_msglen ) ) != 0 )
+    {
+        SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
+        return( ret );
+    }
+
+    /* Done reading this record, get ready for the next one */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        ssl->next_record_offset = ssl->in_msglen + ssl_hdr_len( ssl );
+    else
+#endif
+        ssl->in_left = 0;
+
+    if( ( ret = ssl_prepare_record_content( ssl ) ) != 0 )
+    {
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+        if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        {
+            /* Silently discard invalid records */
+            if( ret == POLARSSL_ERR_SSL_INVALID_RECORD ||
+                ret == POLARSSL_ERR_SSL_INVALID_MAC )
+            {
+#if defined(POLARSSL_SSL_DTLS_BADMAC_LIMIT)
+                if( ssl->badmac_limit != 0 &&
+                    ++ssl->badmac_seen >= ssl->badmac_limit )
+                {
+                    SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
+                    return( POLARSSL_ERR_SSL_INVALID_MAC );
+                }
+#endif
+
+                SSL_DEBUG_MSG( 1, ( "discarding invalid record (mac)" ) );
+                goto read_record_header;
+            }
+
+            return( ret );
+        }
+        else
+#endif
+        {
+            /* Error out (and send alert) on invalid records */
+#if defined(POLARSSL_SSL_ALL_ALERT_MESSAGES)
+            if( ret == POLARSSL_ERR_SSL_INVALID_MAC )
+            {
+                ssl_send_alert_message( ssl,
+                        SSL_ALERT_LEVEL_FATAL,
+                        SSL_ALERT_MSG_BAD_RECORD_MAC );
+            }
+#endif
+            return( ret );
+        }
+    }
+
+    /*
+     * When we sent the last flight of the handshake, we MUST respond to a
+     * retransmit of the peer's previous flight with a retransmit. (In
+     * practice, only the Finished message will make it, other messages
+     * including CCS use the old transform so they're dropped as invalid.)
+     *
+     * If the record we received is not a handshake message, however, it
+     * means the peer received our last flight so we can clean up
+     * handshake info.
+     *
+     * This check needs to be done before prepare_handshake() due to an edge
+     * case: if the client immediately requests renegotiation, this
+     * finishes the current handshake first, avoiding the new ClientHello
+     * being mistaken for an ancient message in the current handshake.
+     */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+        ssl->handshake != NULL &&
+        ssl->state == SSL_HANDSHAKE_OVER )
+    {
+        if( ssl->in_msgtype == SSL_MSG_HANDSHAKE &&
+                ssl->in_msg[0] == SSL_HS_FINISHED )
+        {
+            SSL_DEBUG_MSG( 2, ( "received retransmit of last flight" ) );
+
+            if( ( ret = ssl_resend( ssl ) ) != 0 )
+            {
+                SSL_DEBUG_RET( 1, "ssl_resend", ret );
+                return( ret );
+            }
+
+            return( POLARSSL_ERR_NET_WANT_READ );
+        }
+        else
+        {
+            ssl_handshake_wrapup_free_hs_transform( ssl );
+        }
+    }
+#endif
+
+    /*
+     * Handle particular types of records
+     */
     if( ssl->in_msgtype == SSL_MSG_HANDSHAKE )
     {
-        ssl->in_hslen  = 4;
-        ssl->in_hslen += ( ssl->in_msg[2] << 8 ) | ssl->in_msg[3];
-
-        SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
-                            " %d, type = %d, hslen = %d",
-                       ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
-
-        /*
-         * Additional checks to validate the handshake header
-         */
-        if( ssl->in_msglen < 4 || ssl->in_msg[1] != 0 )
-        {
-            SSL_DEBUG_MSG( 1, ( "bad handshake length" ) );
-            return( POLARSSL_ERR_SSL_INVALID_RECORD );
-        }
-
-        if( ssl->in_msglen < ssl->in_hslen )
-        {
-            SSL_DEBUG_MSG( 1, ( "bad handshake length" ) );
-            return( POLARSSL_ERR_SSL_INVALID_RECORD );
-        }
-
-        if( ssl->state != SSL_HANDSHAKE_OVER )
-            ssl->handshake->update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
+        if( ( ret = ssl_prepare_handshake_record( ssl ) ) != 0 )
+            return( ret );
     }
 
     if( ssl->in_msgtype == SSL_MSG_ALERT )
@@ -2426,8 +3572,6 @@
         }
     }
 
-    ssl->in_left = 0;
-
     SSL_DEBUG_MSG( 2, ( "<= read record" ) );
 
     return( 0 );
@@ -2700,10 +3844,10 @@
     if( ssl->endpoint  == SSL_IS_SERVER &&
         ssl->minor_ver != SSL_MINOR_VERSION_0 )
     {
-        if( ssl->in_hslen   == 7                    &&
+        if( ssl->in_hslen   == 3 + ssl_hs_hdr_len( ssl ) &&
             ssl->in_msgtype == SSL_MSG_HANDSHAKE    &&
             ssl->in_msg[0]  == SSL_HS_CERTIFICATE   &&
-            memcmp( ssl->in_msg + 4, "\0\0\0", 3 ) == 0 )
+            memcmp( ssl->in_msg + ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
         {
             SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
 
@@ -2724,18 +3868,22 @@
         return( POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE );
     }
 
-    if( ssl->in_msg[0] != SSL_HS_CERTIFICATE || ssl->in_hslen < 10 )
+    if( ssl->in_msg[0] != SSL_HS_CERTIFICATE ||
+        ssl->in_hslen < ssl_hs_hdr_len( ssl ) + 3 + 3 )
     {
         SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
         return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE );
     }
 
+    i = ssl_hs_hdr_len( ssl );
+
     /*
      * Same message structure as in ssl_write_certificate()
      */
-    n = ( ssl->in_msg[5] << 8 ) | ssl->in_msg[6];
+    n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
 
-    if( ssl->in_msg[4] != 0 || ssl->in_hslen != 7 + n )
+    if( ssl->in_msg[i] != 0 ||
+        ssl->in_hslen != n + 3 + ssl_hs_hdr_len( ssl ) )
     {
         SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
         return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE );
@@ -2758,7 +3906,7 @@
 
     x509_crt_init( ssl->session_negotiate->peer_cert );
 
-    i = 7;
+    i += 3;
 
     while( i < ssl->in_hslen )
     {
@@ -2797,7 +3945,7 @@
      */
 #if defined(POLARSSL_SSL_RENEGOTIATION) && defined(POLARSSL_SSL_CLI_C)
     if( ssl->endpoint == SSL_IS_CLIENT &&
-        ssl->renegotiation == SSL_RENEGOTIATION )
+        ssl->renegotiation == SSL_RENEGOTIATION_IN_PROGRESS )
     {
         if( ssl->session->peer_cert == NULL )
         {
@@ -2929,6 +4077,54 @@
         return( POLARSSL_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC );
     }
 
+    /*
+     * Switch to our negotiated transform and session parameters for inbound
+     * data.
+     */
+    SSL_DEBUG_MSG( 3, ( "switching to new transform spec for inbound data" ) );
+    ssl->transform_in = ssl->transform_negotiate;
+    ssl->session_in = ssl->session_negotiate;
+
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+    {
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+        ssl_dtls_replay_reset( ssl );
+#endif
+
+        /* Increment epoch */
+        if( ++ssl->in_epoch == 0 )
+        {
+            SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
+            return( POLARSSL_ERR_SSL_COUNTER_WRAPPING );
+        }
+    }
+    else
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+    memset( ssl->in_ctr, 0, 8 );
+
+    /*
+     * Set the in_msg pointer to the correct location based on IV length
+     */
+    if( ssl->minor_ver >= SSL_MINOR_VERSION_2 )
+    {
+        ssl->in_msg = ssl->in_iv + ssl->transform_negotiate->ivlen -
+                      ssl->transform_negotiate->fixed_ivlen;
+    }
+    else
+        ssl->in_msg = ssl->in_iv;
+
+#if defined(POLARSSL_SSL_HW_RECORD_ACCEL)
+    if( ssl_hw_record_activate != NULL )
+    {
+        if( ( ret = ssl_hw_record_activate( ssl, SSL_CHANNEL_INBOUND ) ) != 0 )
+        {
+            SSL_DEBUG_RET( 1, "ssl_hw_record_activate", ret );
+            return( POLARSSL_ERR_SSL_HW_ACCEL_FAILED );
+        }
+    }
+#endif
+
     ssl->state++;
 
     SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) );
@@ -2965,6 +4161,23 @@
     }
 }
 
+void ssl_reset_checksum( ssl_context *ssl )
+{
+#if defined(POLARSSL_SSL_PROTO_SSL3) || defined(POLARSSL_SSL_PROTO_TLS1) || \
+    defined(POLARSSL_SSL_PROTO_TLS1_1)
+     md5_starts( &ssl->handshake->fin_md5  );
+    sha1_starts( &ssl->handshake->fin_sha1 );
+#endif
+#if defined(POLARSSL_SSL_PROTO_TLS1_2)
+#if defined(POLARSSL_SHA256_C)
+    sha256_starts( &ssl->handshake->fin_sha256, 0 );
+#endif
+#if defined(POLARSSL_SHA512_C)
+    sha512_starts( &ssl->handshake->fin_sha512, 1 );
+#endif
+#endif /* POLARSSL_SSL_PROTO_TLS1_2 */
+}
+
 static void ssl_update_checksum_start( ssl_context *ssl,
                                        const unsigned char *buf, size_t len )
 {
@@ -3245,11 +4458,9 @@
 #endif /* POLARSSL_SHA512_C */
 #endif /* POLARSSL_SSL_PROTO_TLS1_2 */
 
-void ssl_handshake_wrapup( ssl_context *ssl )
+static void ssl_handshake_wrapup_free_hs_transform( ssl_context *ssl )
 {
-    int resume = ssl->handshake->resume;
-
-    SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
+    SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
 
     /*
      * Free our handshake params
@@ -3258,16 +4469,8 @@
     polarssl_free( ssl->handshake );
     ssl->handshake = NULL;
 
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-    if( ssl->renegotiation == SSL_RENEGOTIATION )
-    {
-        ssl->renegotiation =  SSL_RENEGOTIATION_DONE;
-        ssl->renego_records_seen = 0;
-    }
-#endif
-
     /*
-     * Switch in our now active transform context
+     * Free the previous transform and swith in the current one
      */
     if( ssl->transform )
     {
@@ -3277,6 +4480,26 @@
     ssl->transform = ssl->transform_negotiate;
     ssl->transform_negotiate = NULL;
 
+    SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
+}
+
+void ssl_handshake_wrapup( ssl_context *ssl )
+{
+    int resume = ssl->handshake->resume;
+
+    SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
+
+#if defined(POLARSSL_SSL_RENEGOTIATION)
+    if( ssl->renegotiation == SSL_RENEGOTIATION_IN_PROGRESS )
+    {
+        ssl->renegotiation =  SSL_RENEGOTIATION_DONE;
+        ssl->renego_records_seen = 0;
+    }
+#endif
+
+    /*
+     * Free the previous session and switch in the current one
+     */
     if( ssl->session )
     {
 #if defined(POLARSSL_SSL_ENCRYPT_THEN_MAC)
@@ -3302,6 +4525,21 @@
             SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
     }
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+        ssl->handshake->flight != NULL )
+    {
+        /* Cancel handshake timer */
+        ssl_set_timer( ssl, 0 );
+
+        /* Keep last flight around in case we need to resend it:
+         * we need the handshake and transform structures for that */
+        SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
+    }
+    else
+#endif
+        ssl_handshake_wrapup_free_hs_transform( ssl );
+
     ssl->state++;
 
     SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
@@ -3361,9 +4599,37 @@
      * data.
      */
     SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
+
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+    {
+        unsigned char i;
+
+        /* Remember current epoch settings for resending */
+        ssl->handshake->alt_transform_out = ssl->transform_out;
+        memcpy( ssl->handshake->alt_out_ctr, ssl->out_ctr, 8 );
+
+        /* Set sequence_number to zero */
+        memset( ssl->out_ctr + 2, 0, 6 );
+
+        /* Increment epoch */
+        for( i = 2; i > 0; i-- )
+            if( ++ssl->out_ctr[i - 1] != 0 )
+                break;
+
+        /* The loop goes to its end iff the counter is wrapping */
+        if( i == 0 )
+        {
+            SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
+            return( POLARSSL_ERR_SSL_COUNTER_WRAPPING );
+        }
+    }
+    else
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+    memset( ssl->out_ctr, 0, 8 );
+
     ssl->transform_out = ssl->transform_negotiate;
     ssl->session_out = ssl->session_negotiate;
-    memset( ssl->out_ctr, 0, 8 );
 
 #if defined(POLARSSL_SSL_HW_RECORD_ACCEL)
     if( ssl_hw_record_activate != NULL )
@@ -3376,6 +4642,11 @@
     }
 #endif
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        ssl_send_flight_completed( ssl );
+#endif
+
     if( ( ret = ssl_write_record( ssl ) ) != 0 )
     {
         SSL_DEBUG_RET( 1, "ssl_write_record", ret );
@@ -3387,47 +4658,22 @@
     return( 0 );
 }
 
+#if defined(POLARSSL_SSL_PROTO_SSL3)
+#define SSL_MAX_HASH_LEN 36
+#else
+#define SSL_MAX_HASH_LEN 12
+#endif
+
 int ssl_parse_finished( ssl_context *ssl )
 {
     int ret;
     unsigned int hash_len;
-    unsigned char buf[36];
+    unsigned char buf[SSL_MAX_HASH_LEN];
 
     SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
 
     ssl->handshake->calc_finished( ssl, buf, ssl->endpoint ^ 1 );
 
-    /*
-     * Switch to our negotiated transform and session parameters for inbound
-     * data.
-     */
-    SSL_DEBUG_MSG( 3, ( "switching to new transform spec for inbound data" ) );
-    ssl->transform_in = ssl->transform_negotiate;
-    ssl->session_in = ssl->session_negotiate;
-    memset( ssl->in_ctr, 0, 8 );
-
-    /*
-     * Set the in_msg pointer to the correct location based on IV length
-     */
-    if( ssl->minor_ver >= SSL_MINOR_VERSION_2 )
-    {
-        ssl->in_msg = ssl->in_iv + ssl->transform_negotiate->ivlen -
-                      ssl->transform_negotiate->fixed_ivlen;
-    }
-    else
-        ssl->in_msg = ssl->in_iv;
-
-#if defined(POLARSSL_SSL_HW_RECORD_ACCEL)
-    if( ssl_hw_record_activate != NULL )
-    {
-        if( ( ret = ssl_hw_record_activate( ssl, SSL_CHANNEL_INBOUND ) ) != 0 )
-        {
-            SSL_DEBUG_RET( 1, "ssl_hw_record_activate", ret );
-            return( POLARSSL_ERR_SSL_HW_ACCEL_FAILED );
-        }
-    }
-#endif
-
     if( ( ret = ssl_read_record( ssl ) ) != 0 )
     {
         SSL_DEBUG_RET( 1, "ssl_read_record", ret );
@@ -3440,17 +4686,23 @@
         return( POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE );
     }
 
-    // TODO TLS/1.2 Hash length is determined by cipher suite (Page 63)
-    hash_len = ( ssl->minor_ver == SSL_MINOR_VERSION_0 ) ? 36 : 12;
+    /* There is currently no ciphersuite using another length with TLS 1.2 */
+#if defined(POLARSSL_SSL_PROTO_SSL3)
+    if( ssl->minor_ver == SSL_MINOR_VERSION_0 )
+        hash_len = 36;
+    else
+#endif
+        hash_len = 12;
 
     if( ssl->in_msg[0] != SSL_HS_FINISHED ||
-        ssl->in_hslen  != 4 + hash_len )
+        ssl->in_hslen  != ssl_hs_hdr_len( ssl ) + hash_len )
     {
         SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
         return( POLARSSL_ERR_SSL_BAD_HS_FINISHED );
     }
 
-    if( safer_memcmp( ssl->in_msg + 4, buf, hash_len ) != 0 )
+    if( safer_memcmp( ssl->in_msg + ssl_hs_hdr_len( ssl ),
+                      buf, hash_len ) != 0 )
     {
         SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
         return( POLARSSL_ERR_SSL_BAD_HS_FINISHED );
@@ -3475,6 +4727,11 @@
     else
         ssl->state++;
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        ssl_recv_flight_completed( ssl );
+#endif
+
     SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
 
     return( 0 );
@@ -3585,9 +4842,52 @@
     ssl->handshake->key_cert = ssl->key_cert;
 #endif
 
+    /*
+     * We may not know yet if we're using DTLS,
+     * so always initiliase DTLS-specific fields.
+     */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    ssl->handshake->alt_transform_out = ssl->transform_out;
+
+    // TODO: not the right place, we may not know endpoint yet
+    if( ssl->endpoint == SSL_IS_CLIENT )
+        ssl->handshake->retransmit_state = SSL_RETRANS_PREPARING;
+    else
+        ssl->handshake->retransmit_state = SSL_RETRANS_WAITING;
+#endif
+
     return( 0 );
 }
 
+#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+/* Dummy cookie callbacks for defaults */
+static int ssl_cookie_write_dummy( void *ctx,
+                      unsigned char **p, unsigned char *end,
+                      const unsigned char *cli_id, size_t cli_id_len )
+{
+    ((void) ctx);
+    ((void) p);
+    ((void) end);
+    ((void) cli_id);
+    ((void) cli_id_len);
+
+    return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
+}
+
+static int ssl_cookie_check_dummy( void *ctx,
+                      const unsigned char *cookie, size_t cookie_len,
+                      const unsigned char *cli_id, size_t cli_id_len )
+{
+    ((void) ctx);
+    ((void) cookie);
+    ((void) cookie_len);
+    ((void) cli_id);
+    ((void) cli_id_len);
+
+    return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
+}
+#endif /* POLARSSL_SSL_DTLS_HELLO_VERIFY */
+
 /*
  * Initialize an SSL context
  */
@@ -3628,25 +4928,20 @@
     /*
      * Prepare base structures
      */
-    if( ( ssl->in_ctr = polarssl_malloc( len ) ) == NULL ||
-        ( ssl->out_ctr = polarssl_malloc( len ) ) == NULL )
+    if( ( ssl->in_buf = polarssl_malloc( len ) ) == NULL ||
+        ( ssl->out_buf = polarssl_malloc( len ) ) == NULL )
     {
         SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed", len ) );
-        polarssl_free( ssl->in_ctr );
-        ssl->in_ctr = NULL;
+        polarssl_free( ssl->in_buf );
+        ssl->in_buf = NULL;
         return( POLARSSL_ERR_SSL_MALLOC_FAILED );
     }
 
-    memset( ssl-> in_ctr, 0, SSL_BUFFER_LEN );
-    memset( ssl->out_ctr, 0, SSL_BUFFER_LEN );
+    memset( ssl-> in_buf, 0, SSL_BUFFER_LEN );
+    memset( ssl->out_buf, 0, SSL_BUFFER_LEN );
 
-    ssl->in_hdr = ssl->in_ctr +  8;
-    ssl->in_iv  = ssl->in_ctr + 13;
-    ssl->in_msg = ssl->in_ctr + 13;
-
-    ssl->out_hdr = ssl->out_ctr +  8;
-    ssl->out_iv  = ssl->out_ctr + 13;
-    ssl->out_msg = ssl->out_ctr + 13;
+    /* No error is possible, SSL_TRANSPORT_STREAM always valid */
+    (void) ssl_set_transport( ssl, SSL_TRANSPORT_STREAM );
 
 #if defined(POLARSSL_SSL_ENCRYPT_THEN_MAC)
     ssl->encrypt_then_mac = SSL_ETM_ENABLED;
@@ -3664,6 +4959,20 @@
     ssl->curve_list = ecp_grp_id_list( );
 #endif
 
+#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+    ssl->f_cookie_write = ssl_cookie_write_dummy;
+    ssl->f_cookie_check = ssl_cookie_check_dummy;
+#endif
+
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+    ssl->anti_replay = SSL_ANTI_REPLAY_ENABLED;
+#endif
+
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    ssl->hs_timeout_min = SSL_DTLS_TIMEOUT_DFL_MIN;
+    ssl->hs_timeout_max = SSL_DTLS_TIMEOUT_DFL_MAX;
+#endif
+
     if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
         return( ret );
 
@@ -3692,16 +5001,23 @@
 
     ssl->in_offt = NULL;
 
-    ssl->in_msg = ssl->in_ctr + 13;
+    ssl->in_msg = ssl->in_buf + 13;
     ssl->in_msgtype = 0;
     ssl->in_msglen = 0;
     ssl->in_left = 0;
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    ssl->next_record_offset = 0;
+    ssl->in_epoch = 0;
+#endif
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+    ssl_dtls_replay_reset( ssl );
+#endif
 
     ssl->in_hslen = 0;
     ssl->nb_zero = 0;
     ssl->record_read = 0;
 
-    ssl->out_msg = ssl->out_ctr + 13;
+    ssl->out_msg = ssl->out_buf + 13;
     ssl->out_msgtype = 0;
     ssl->out_msglen = 0;
     ssl->out_left = 0;
@@ -3713,8 +5029,8 @@
     ssl->transform_in = NULL;
     ssl->transform_out = NULL;
 
-    memset( ssl->out_ctr, 0, SSL_BUFFER_LEN );
-    memset( ssl->in_ctr, 0, SSL_BUFFER_LEN );
+    memset( ssl->out_buf, 0, SSL_BUFFER_LEN );
+    memset( ssl->in_buf, 0, SSL_BUFFER_LEN );
 
 #if defined(POLARSSL_SSL_HW_RECORD_ACCEL)
     if( ssl_hw_record_reset != NULL )
@@ -3746,6 +5062,12 @@
     ssl->alpn_chosen = NULL;
 #endif
 
+#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+    polarssl_free( ssl->cli_id );
+    ssl->cli_id = NULL;
+    ssl->cli_id_len = 0;
+#endif
+
     if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
         return( ret );
 
@@ -3828,6 +5150,80 @@
 #endif
 }
 
+int ssl_set_transport( ssl_context *ssl, int transport )
+{
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( transport == SSL_TRANSPORT_DATAGRAM )
+    {
+        ssl->transport = transport;
+
+        ssl->out_hdr = ssl->out_buf;
+        ssl->out_ctr = ssl->out_buf +  3;
+        ssl->out_len = ssl->out_buf + 11;
+        ssl->out_iv  = ssl->out_buf + 13;
+        ssl->out_msg = ssl->out_buf + 13;
+
+        ssl->in_hdr = ssl->in_buf;
+        ssl->in_ctr = ssl->in_buf +  3;
+        ssl->in_len = ssl->in_buf + 11;
+        ssl->in_iv  = ssl->in_buf + 13;
+        ssl->in_msg = ssl->in_buf + 13;
+
+        /* DTLS starts with TLS1.1 */
+        if( ssl->min_minor_ver < SSL_MINOR_VERSION_2 )
+            ssl->min_minor_ver = SSL_MINOR_VERSION_2;
+
+        if( ssl->max_minor_ver < SSL_MINOR_VERSION_2 )
+            ssl->max_minor_ver = SSL_MINOR_VERSION_2;
+
+        return( 0 );
+    }
+#endif
+
+    if( transport == SSL_TRANSPORT_STREAM )
+    {
+        ssl->transport = transport;
+
+        ssl->out_ctr = ssl->out_buf;
+        ssl->out_hdr = ssl->out_buf +  8;
+        ssl->out_len = ssl->out_buf + 11;
+        ssl->out_iv  = ssl->out_buf + 13;
+        ssl->out_msg = ssl->out_buf + 13;
+
+        ssl->in_ctr = ssl->in_buf;
+        ssl->in_hdr = ssl->in_buf +  8;
+        ssl->in_len = ssl->in_buf + 11;
+        ssl->in_iv  = ssl->in_buf + 13;
+        ssl->in_msg = ssl->in_buf + 13;
+
+        return( 0 );
+    }
+
+    return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+}
+
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+void ssl_set_dtls_anti_replay( ssl_context *ssl, char mode )
+{
+    ssl->anti_replay = mode;
+}
+#endif
+
+#if defined(POLARSSL_SSL_DTLS_BADMAC_LIMIT)
+void ssl_set_dtls_badmac_limit( ssl_context *ssl, unsigned limit )
+{
+    ssl->badmac_limit = limit;
+}
+#endif
+
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+void ssl_set_handshake_timeout( ssl_context *ssl, uint32_t min, uint32_t max )
+{
+    ssl->hs_timeout_min = min;
+    ssl->hs_timeout_max = max;
+}
+#endif
+
 void ssl_set_authmode( ssl_context *ssl, int authmode )
 {
     ssl->authmode   = authmode;
@@ -3863,10 +5259,31 @@
             int (*f_recv)(void *, unsigned char *, size_t), void *p_recv,
             int (*f_send)(void *, const unsigned char *, size_t), void *p_send )
 {
+    if( p_recv != p_send )
+    {
+        ssl->f_recv = NULL;
+        ssl->f_send = NULL;
+        ssl->p_bio  = NULL;
+        return;
+    }
+
     ssl->f_recv     = f_recv;
     ssl->f_send     = f_send;
-    ssl->p_recv     = p_recv;
-    ssl->p_send     = p_send;
+    ssl->p_bio      = p_send;
+}
+
+void ssl_set_bio_timeout( ssl_context *ssl,
+        void *p_bio,
+        int (*f_send)(void *, const unsigned char *, size_t),
+        int (*f_recv)(void *, unsigned char *, size_t),
+        int (*f_recv_timeout)(void *, unsigned char *, size_t, uint32_t),
+        uint32_t timeout )
+{
+    ssl->p_bio          = p_bio;
+    ssl->f_send         = f_send;
+    ssl->f_recv         = f_recv;
+    ssl->f_recv_timeout = f_recv_timeout;
+    ssl->read_timeout   = timeout;
 }
 
 #if defined(POLARSSL_SSL_SRV_C)
@@ -4193,24 +5610,47 @@
 }
 #endif /* POLARSSL_SSL_ALPN */
 
-void ssl_set_max_version( ssl_context *ssl, int major, int minor )
+static int ssl_check_version( const ssl_context *ssl, int major, int minor )
 {
-    if( major >= SSL_MIN_MAJOR_VERSION && major <= SSL_MAX_MAJOR_VERSION &&
-        minor >= SSL_MIN_MINOR_VERSION && minor <= SSL_MAX_MINOR_VERSION )
+    if( major < SSL_MIN_MAJOR_VERSION || major > SSL_MAX_MAJOR_VERSION ||
+        minor < SSL_MIN_MINOR_VERSION || minor > SSL_MAX_MINOR_VERSION )
     {
-        ssl->max_major_ver = major;
-        ssl->max_minor_ver = minor;
+        return( -1 );
     }
+
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+        minor < SSL_MINOR_VERSION_2 )
+    {
+        return( -1 );
+    }
+#else
+    ((void) ssl);
+#endif
+
+    return( 0 );
 }
 
-void ssl_set_min_version( ssl_context *ssl, int major, int minor )
+int ssl_set_max_version( ssl_context *ssl, int major, int minor )
 {
-    if( major >= SSL_MIN_MAJOR_VERSION && major <= SSL_MAX_MAJOR_VERSION &&
-        minor >= SSL_MIN_MINOR_VERSION && minor <= SSL_MAX_MINOR_VERSION )
-    {
-        ssl->min_major_ver = major;
-        ssl->min_minor_ver = minor;
-    }
+    if( ssl_check_version( ssl, major, minor ) != 0 )
+        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+
+    ssl->max_major_ver = major;
+    ssl->max_minor_ver = minor;
+
+    return( 0 );
+}
+
+int ssl_set_min_version( ssl_context *ssl, int major, int minor )
+{
+    if( ssl_check_version( ssl, major, minor ) != 0 )
+        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+
+    ssl->min_major_ver = major;
+    ssl->min_minor_ver = minor;
+
+    return( 0 );
 }
 
 #if defined(POLARSSL_SSL_FALLBACK_SCSV) && defined(POLARSSL_SSL_CLI_C)
@@ -4347,6 +5787,23 @@
 
 const char *ssl_get_version( const ssl_context *ssl )
 {
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+    {
+        switch( ssl->minor_ver )
+        {
+            case SSL_MINOR_VERSION_2:
+                return( "DTLSv1.0" );
+
+            case SSL_MINOR_VERSION_3:
+                return( "DTLSv1.2" );
+
+            default:
+                return( "unknown (DTLS)" );
+        }
+    }
+#endif
+
     switch( ssl->minor_ver )
     {
         case SSL_MINOR_VERSION_0:
@@ -4362,9 +5819,42 @@
             return( "TLSv1.2" );
 
         default:
-            break;
+            return( "unknown" );
     }
-    return( "unknown" );
+}
+
+int ssl_get_record_expansion( const ssl_context *ssl )
+{
+    int transform_expansion;
+    const ssl_transform *transform = ssl->transform_out;
+
+#if defined(POLARSSL_ZLIB_SUPPORT)
+    if( ssl->session_out->compression != SSL_COMPRESS_NULL )
+        return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
+#endif
+
+    if( transform == NULL )
+        return( ssl_hdr_len( ssl ) );
+
+    switch( cipher_get_cipher_mode( &transform->cipher_ctx_enc ) )
+    {
+        case POLARSSL_MODE_GCM:
+        case POLARSSL_MODE_CCM:
+        case POLARSSL_MODE_STREAM:
+            transform_expansion = transform->minlen;
+            break;
+
+        case POLARSSL_MODE_CBC:
+            transform_expansion = transform->maclen
+                      + cipher_get_block_size( &transform->cipher_ctx_enc );
+            break;
+
+        default:
+            SSL_DEBUG_MSG( 0, ( "should never happen" ) );
+            return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
+    }
+
+    return( ssl_hdr_len( ssl ) + transform_expansion );
 }
 
 #if defined(POLARSSL_X509_CRT_PARSE_C)
@@ -4478,8 +5968,21 @@
     if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
         return( ret );
 
+    /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
+     * the ServerHello will have message_seq = 1" */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+        ssl->renegotiation == SSL_RENEGOTIATION_PENDING )
+    {
+        if( ssl->endpoint == SSL_IS_SERVER )
+            ssl->handshake->out_msg_seq = 1;
+        else
+            ssl->handshake->in_msg_seq = 1;
+    }
+#endif
+
     ssl->state = SSL_HELLO_REQUEST;
-    ssl->renegotiation = SSL_RENEGOTIATION;
+    ssl->renegotiation = SSL_RENEGOTIATION_IN_PROGRESS;
 
     if( ( ret = ssl_handshake( ssl ) ) != 0 )
     {
@@ -4522,7 +6025,7 @@
      * On client, either start the renegotiation process or,
      * if already in progress, continue the handshake
      */
-    if( ssl->renegotiation != SSL_RENEGOTIATION )
+    if( ssl->renegotiation != SSL_RENEGOTIATION_IN_PROGRESS )
     {
         if( ssl->state != SSL_HANDSHAKE_OVER )
             return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
@@ -4580,6 +6083,21 @@
 
     SSL_DEBUG_MSG( 2, ( "=> read" ) );
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+    {
+        if( ( ret = ssl_flush_output( ssl ) ) != 0 )
+            return( ret );
+
+        if( ssl->handshake != NULL &&
+            ssl->handshake->retransmit_state == SSL_RETRANS_SENDING )
+        {
+            if( ( ret = ssl_resend( ssl ) ) != 0 )
+                return( ret );
+        }
+    }
+#endif
+
 #if defined(POLARSSL_SSL_RENEGOTIATION)
     if( ( ret = ssl_check_ctr_renegotiate( ssl ) ) != 0 )
     {
@@ -4604,6 +6122,12 @@
 
     if( ssl->in_offt == NULL )
     {
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+        /* Start timer if not already running */
+        if( ssl->time_limit == 0 )
+            ssl_set_timer( ssl, ssl->read_timeout );
+#endif
+
         if( ! record_read )
         {
             if( ( ret = ssl_read_record( ssl ) ) != 0 )
@@ -4640,9 +6164,28 @@
 #if defined(POLARSSL_SSL_CLI_C)
             if( ssl->endpoint == SSL_IS_CLIENT &&
                 ( ssl->in_msg[0] != SSL_HS_HELLO_REQUEST ||
-                  ssl->in_hslen != 4 ) )
+                  ssl->in_hslen != ssl_hs_hdr_len( ssl ) ) )
             {
                 SSL_DEBUG_MSG( 1, ( "handshake received (not HelloRequest)" ) );
+
+                /* With DTLS, drop the packet (probably from last handshake) */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+                if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+                    return( POLARSSL_ERR_NET_WANT_READ );
+#endif
+                return( POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE );
+            }
+
+            if( ssl->endpoint == SSL_IS_SERVER &&
+                ssl->in_msg[0] != SSL_HS_CLIENT_HELLO )
+            {
+                SSL_DEBUG_MSG( 1, ( "handshake received (not ClientHello)" ) );
+
+                /* With DTLS, drop the packet (probably from last handshake) */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+                if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+                    return( POLARSSL_ERR_NET_WANT_READ );
+#endif
                 return( POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE );
             }
 #endif
@@ -4652,7 +6195,7 @@
                   ssl->allow_legacy_renegotiation ==
                                                 SSL_LEGACY_NO_RENEGOTIATION ) )
             {
-                SSL_DEBUG_MSG( 3, ( "ignoring renegotiation, sending alert" ) );
+                SSL_DEBUG_MSG( 3, ( "refusing renegotiation, sending alert" ) );
 
 #if defined(POLARSSL_SSL_PROTO_SSL3)
                 if( ssl->minor_ver == SSL_MINOR_VERSION_0 )
@@ -4686,6 +6229,14 @@
             }
             else
             {
+                /* DTLS clients need to know renego is server-initiated */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+                if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+                    ssl->endpoint == SSL_IS_CLIENT )
+                {
+                    ssl->renegotiation = SSL_RENEGOTIATION_PENDING;
+                }
+#endif
                 ret = ssl_start_renegotiation( ssl );
                 if( ret == POLARSSL_ERR_SSL_WAITING_SERVER_HELLO_RENEGO )
                 {
@@ -4705,14 +6256,15 @@
         }
         else if( ssl->renegotiation == SSL_RENEGOTIATION_PENDING )
         {
-            ssl->renego_records_seen++;
 
-            if( ssl->renego_max_records >= 0 &&
-                ssl->renego_records_seen > ssl->renego_max_records )
+            if( ssl->renego_max_records >= 0 )
             {
-                SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
-                                    "but not honored by client" ) );
-                return( POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE );
+                if( ++ssl->renego_records_seen > ssl->renego_max_records )
+                {
+                    SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
+                                        "but not honored by client" ) );
+                    return( POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE );
+                }
             }
         }
 #endif /* POLARSSL_SSL_RENEGOTIATION */
@@ -4731,6 +6283,28 @@
         }
 
         ssl->in_offt = ssl->in_msg;
+
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+        /* We're going to return something now, cancel timer,
+         * except if handshake (renegotiation) is in progress */
+        if( ssl->state == SSL_HANDSHAKE_OVER )
+            ssl_set_timer( ssl, 0 );
+
+        /* If we requested renego but received AppData, resend HelloRequest.
+         * Do it now, after setting in_offt, to avoid taking this branch
+         * again if ssl_write_hello_request() returns WANT_WRITE */
+#if defined(POLARSSL_SSL_SRV_C) && defined(POLARSSL_SSL_RENEGOTIATION)
+        if( ssl->endpoint == SSL_IS_SERVER &&
+            ssl->renegotiation == SSL_RENEGOTIATION_PENDING )
+        {
+            if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
+            {
+                SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
+                return( ret );
+            }
+        }
+#endif /* POLARSSL_SSL_SRV_C && POLARSSL_SSL_RENEGOTIATION */
+#endif
     }
 
     n = ( len < ssl->in_msglen )
@@ -4761,8 +6335,9 @@
 #endif
 {
     int ret;
-    size_t n;
-    unsigned int max_len = SSL_MAX_CONTENT_LEN;
+#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
+    unsigned int max_len;
+#endif
 
     SSL_DEBUG_MSG( 2, ( "=> write" ) );
 
@@ -4797,9 +6372,22 @@
     {
         max_len = mfl_code_to_length[ssl->session_out->mfl_code];
     }
-#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
 
-    n = ( len < max_len) ? len : max_len;
+    if( len > max_len )
+    {
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+        if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+        {
+            SSL_DEBUG_MSG( 1, ( "fragment larger than the (negotiated) "
+                                "maximum fragment length: %d > %d",
+                                len, max_len ) );
+            return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+        }
+        else
+#endif
+            len = max_len;
+    }
+#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
 
     if( ssl->out_left != 0 )
     {
@@ -4811,9 +6399,9 @@
     }
     else
     {
-        ssl->out_msglen  = n;
+        ssl->out_msglen  = len;
         ssl->out_msgtype = SSL_MSG_APPLICATION_DATA;
-        memcpy( ssl->out_msg, buf, n );
+        memcpy( ssl->out_msg, buf, len );
 
         if( ( ret = ssl_write_record( ssl ) ) != 0 )
         {
@@ -4824,7 +6412,7 @@
 
     SSL_DEBUG_MSG( 2, ( "<= write" ) );
 
-    return( (int) n );
+    return( (int) len );
 }
 
 /*
@@ -4967,6 +6555,12 @@
     }
 #endif /* POLARSSL_X509_CRT_PARSE_C && POLARSSL_SSL_SERVER_NAME_INDICATION */
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    polarssl_free( handshake->verify_cookie );
+    polarssl_free( handshake->hs_msg );
+    ssl_flight_free( handshake->flight );
+#endif
+
     polarssl_zeroize( handshake, sizeof( ssl_handshake_params ) );
 }
 
@@ -5000,16 +6594,16 @@
 
     SSL_DEBUG_MSG( 2, ( "=> free" ) );
 
-    if( ssl->out_ctr != NULL )
+    if( ssl->out_buf != NULL )
     {
-        polarssl_zeroize( ssl->out_ctr, SSL_BUFFER_LEN );
-        polarssl_free( ssl->out_ctr );
+        polarssl_zeroize( ssl->out_buf, SSL_BUFFER_LEN );
+        polarssl_free( ssl->out_buf );
     }
 
-    if( ssl->in_ctr != NULL )
+    if( ssl->in_buf != NULL )
     {
-        polarssl_zeroize( ssl->in_ctr, SSL_BUFFER_LEN );
-        polarssl_free( ssl->in_ctr );
+        polarssl_zeroize( ssl->in_buf, SSL_BUFFER_LEN );
+        polarssl_free( ssl->in_buf );
     }
 
 #if defined(POLARSSL_ZLIB_SUPPORT)
@@ -5089,6 +6683,10 @@
     }
 #endif
 
+#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+    polarssl_free( ssl->cli_id );
+#endif
+
     SSL_DEBUG_MSG( 2, ( "<= free" ) );
 
     /* Actually clear after last debug message */
@@ -5260,4 +6858,57 @@
 }
 #endif /* POLARSSL_X509_CRT_PARSE_C */
 
+/*
+ * Convert version numbers to/from wire format
+ * and, for DTLS, to/from TLS equivalent.
+ *
+ * For TLS this is the identity.
+ * For DTLS, use one complement (v -> 255 - v, and then map as follows:
+ * 1.0 <-> 3.2      (DTLS 1.0 is based on TLS 1.1)
+ * 1.x <-> 3.x+1    for x != 0 (DTLS 1.2 based on TLS 1.2)
+ */
+void ssl_write_version( int major, int minor, int transport,
+                        unsigned char ver[2] )
+{
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( transport == SSL_TRANSPORT_DATAGRAM )
+    {
+        if( minor == SSL_MINOR_VERSION_2 )
+            --minor; /* DTLS 1.0 stored as TLS 1.1 internally */
+
+        ver[0] = (unsigned char)( 255 - ( major - 2 ) );
+        ver[1] = (unsigned char)( 255 - ( minor - 1 ) );
+    }
+    else
+#else
+    ((void) transport);
+#endif
+    {
+        ver[0] = (unsigned char) major;
+        ver[1] = (unsigned char) minor;
+    }
+}
+
+void ssl_read_version( int *major, int *minor, int transport,
+                       const unsigned char ver[2] )
+{
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( transport == SSL_TRANSPORT_DATAGRAM )
+    {
+        *major = 255 - ver[0] + 2;
+        *minor = 255 - ver[1] + 1;
+
+        if( *minor == SSL_MINOR_VERSION_1 )
+            ++*minor; /* DTLS 1.0 stored as TLS 1.1 internally */
+    }
+    else
+#else
+    ((void) transport);
+#endif
+    {
+        *major = ver[0];
+        *minor = ver[1];
+    }
+}
+
 #endif /* POLARSSL_SSL_TLS_C */
diff --git a/library/threading.c b/library/threading.c
index fa745af..b383efe 100644
--- a/library/threading.c
+++ b/library/threading.c
@@ -21,14 +21,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_THREADING_C)
 
-#include "polarssl/threading.h"
+#include "mbedtls/threading.h"
 
 #if defined(POLARSSL_THREADING_PTHREAD)
 static int threading_mutex_init_pthread( threading_mutex_t *mutex )
@@ -105,6 +105,6 @@
 
     return( 0 );
 }
-#endif /* POLARSSL_THREADING_ALT_C */
+#endif /* POLARSSL_THREADING_ALT */
 
 #endif /* POLARSSL_THREADING_C */
diff --git a/library/timing.c b/library/timing.c
index 5d58f52..751b0b4 100644
--- a/library/timing.c
+++ b/library/timing.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_SELF_TEST) && defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -35,7 +35,7 @@
 
 #if defined(POLARSSL_TIMING_C) && !defined(POLARSSL_TIMING_ALT)
 
-#include "polarssl/timing.h"
+#include "mbedtls/timing.h"
 
 #if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
 
@@ -337,7 +337,7 @@
 
 /* To test net_usleep against our functions */
 #if defined(POLARSSL_NET_C) && defined(POLARSSL_HAVE_TIME)
-#include "polarssl/net.h"
+#include "mbedtls/net.h"
 #endif
 
 /*
diff --git a/library/version.c b/library/version.c
index 2856d6c..c3af429 100644
--- a/library/version.c
+++ b/library/version.c
@@ -21,14 +21,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_VERSION_C)
 
-#include "polarssl/version.h"
+#include "mbedtls/version.h"
 #include <string.h>
 
 unsigned int version_get_number()
diff --git a/library/version_features.c b/library/version_features.c
index 4ec1e87..4fe6e46 100644
--- a/library/version_features.c
+++ b/library/version_features.c
@@ -21,14 +21,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_VERSION_C)
 
-#include "polarssl/version.h"
+#include "mbedtls/version.h"
 
 #include <string.h>
 
@@ -279,9 +279,9 @@
 #if defined(POLARSSL_SSL_AEAD_RANDOM_IV)
     "POLARSSL_SSL_AEAD_RANDOM_IV",
 #endif /* POLARSSL_SSL_AEAD_RANDOM_IV */
-#if defined(POLARSSL_SSL_ALERT_MESSAGES)
-    "POLARSSL_SSL_ALERT_MESSAGES",
-#endif /* POLARSSL_SSL_ALERT_MESSAGES */
+#if defined(POLARSSL_SSL_ALL_ALERT_MESSAGES)
+    "POLARSSL_SSL_ALL_ALERT_MESSAGES",
+#endif /* POLARSSL_SSL_ALL_ALERT_MESSAGES */
 #if defined(POLARSSL_SSL_DEBUG_ALL)
     "POLARSSL_SSL_DEBUG_ALL",
 #endif /* POLARSSL_SSL_DEBUG_ALL */
@@ -300,9 +300,9 @@
 #if defined(POLARSSL_SSL_CBC_RECORD_SPLITTING)
     "POLARSSL_SSL_CBC_RECORD_SPLITTING",
 #endif /* POLARSSL_SSL_CBC_RECORD_SPLITTING */
-#if defined(POLARSSL_SSL_DISABLE_RENEGOTIATION)
-    "POLARSSL_SSL_DISABLE_RENEGOTIATION",
-#endif /* POLARSSL_SSL_DISABLE_RENEGOTIATION */
+#if defined(POLARSSL_SSL_RENEGOTIATION)
+    "POLARSSL_SSL_RENEGOTIATION",
+#endif /* POLARSSL_SSL_RENEGOTIATION */
 #if defined(POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
     "POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO",
 #endif /* POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
@@ -324,9 +324,21 @@
 #if defined(POLARSSL_SSL_PROTO_TLS1_2)
     "POLARSSL_SSL_PROTO_TLS1_2",
 #endif /* POLARSSL_SSL_PROTO_TLS1_2 */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    "POLARSSL_SSL_PROTO_DTLS",
+#endif /* POLARSSL_SSL_PROTO_DTLS */
 #if defined(POLARSSL_SSL_ALPN)
     "POLARSSL_SSL_ALPN",
 #endif /* POLARSSL_SSL_ALPN */
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+    "POLARSSL_SSL_DTLS_ANTI_REPLAY",
+#endif /* POLARSSL_SSL_DTLS_ANTI_REPLAY */
+#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+    "POLARSSL_SSL_DTLS_HELLO_VERIFY",
+#endif /* POLARSSL_SSL_DTLS_HELLO_VERIFY */
+#if defined(POLARSSL_SSL_DTLS_BADMAC_LIMIT)
+    "POLARSSL_SSL_DTLS_BADMAC_LIMIT",
+#endif /* POLARSSL_SSL_DTLS_BADMAC_LIMIT */
 #if defined(POLARSSL_SSL_SESSION_TICKETS)
     "POLARSSL_SSL_SESSION_TICKETS",
 #endif /* POLARSSL_SSL_SESSION_TICKETS */
@@ -513,6 +525,9 @@
 #if defined(POLARSSL_SSL_CACHE_C)
     "POLARSSL_SSL_CACHE_C",
 #endif /* POLARSSL_SSL_CACHE_C */
+#if defined(POLARSSL_SSL_COOKIE_C)
+    "POLARSSL_SSL_COOKIE_C",
+#endif /* POLARSSL_SSL_COOKIE_C */
 #if defined(POLARSSL_SSL_CLI_C)
     "POLARSSL_SSL_CLI_C",
 #endif /* POLARSSL_SSL_CLI_C */
diff --git a/library/x509.c b/library/x509.c
index b35663d..c1fd8ad 100644
--- a/library/x509.c
+++ b/library/x509.c
@@ -31,26 +31,26 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_X509_USE_C)
 
-#include "polarssl/x509.h"
-#include "polarssl/asn1.h"
-#include "polarssl/oid.h"
+#include "mbedtls/x509.h"
+#include "mbedtls/asn1.h"
+#include "mbedtls/oid.h"
 
 #include <stdio.h>
 #include <string.h>
 
 #if defined(POLARSSL_PEM_PARSE_C)
-#include "polarssl/pem.h"
+#include "mbedtls/pem.h"
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #include <stdlib.h>
@@ -1009,8 +1009,8 @@
 
 #if defined(POLARSSL_SELF_TEST)
 
-#include "polarssl/x509_crt.h"
-#include "polarssl/certs.h"
+#include "mbedtls/x509_crt.h"
+#include "mbedtls/certs.h"
 
 /*
  * Checkup routine
diff --git a/library/x509_create.c b/library/x509_create.c
index f505bab..5318cd3 100644
--- a/library/x509_create.c
+++ b/library/x509_create.c
@@ -21,16 +21,16 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_X509_CREATE_C)
 
-#include "polarssl/x509.h"
-#include "polarssl/asn1write.h"
-#include "polarssl/oid.h"
+#include "mbedtls/x509.h"
+#include "mbedtls/asn1write.h"
+#include "mbedtls/oid.h"
 
 #include <string.h>
 
diff --git a/library/x509_crl.c b/library/x509_crl.c
index e2076a6..afba7b2 100644
--- a/library/x509_crl.c
+++ b/library/x509_crl.c
@@ -31,24 +31,24 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_X509_CRL_PARSE_C)
 
-#include "polarssl/x509_crl.h"
-#include "polarssl/oid.h"
+#include "mbedtls/x509_crl.h"
+#include "mbedtls/oid.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_PEM_PARSE_C)
-#include "polarssl/pem.h"
+#include "mbedtls/pem.h"
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #include <stdio.h>
diff --git a/library/x509_crt.c b/library/x509_crt.c
index 77008ed..84e4415 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -31,25 +31,25 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_X509_CRT_PARSE_C)
 
-#include "polarssl/x509_crt.h"
-#include "polarssl/oid.h"
+#include "mbedtls/x509_crt.h"
+#include "mbedtls/oid.h"
 
 #include <stdio.h>
 #include <string.h>
 
 #if defined(POLARSSL_PEM_PARSE_C)
-#include "polarssl/pem.h"
+#include "mbedtls/pem.h"
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #define polarssl_free       free
@@ -58,7 +58,7 @@
 #endif
 
 #if defined(POLARSSL_THREADING_C)
-#include "polarssl/threading.h"
+#include "mbedtls/threading.h"
 #endif
 
 #if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
diff --git a/library/x509_csr.c b/library/x509_csr.c
index 558b078..e62417e 100644
--- a/library/x509_csr.c
+++ b/library/x509_csr.c
@@ -31,24 +31,24 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_X509_CSR_PARSE_C)
 
-#include "polarssl/x509_csr.h"
-#include "polarssl/oid.h"
+#include "mbedtls/x509_csr.h"
+#include "mbedtls/oid.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_PEM_PARSE_C)
-#include "polarssl/pem.h"
+#include "mbedtls/pem.h"
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
 #include <stdio.h>
diff --git a/library/x509write_crt.c b/library/x509write_crt.c
index 80913ec..89a2988 100644
--- a/library/x509write_crt.c
+++ b/library/x509write_crt.c
@@ -27,22 +27,22 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_X509_CRT_WRITE_C)
 
-#include "polarssl/x509_crt.h"
-#include "polarssl/oid.h"
-#include "polarssl/asn1write.h"
-#include "polarssl/sha1.h"
+#include "mbedtls/x509_crt.h"
+#include "mbedtls/oid.h"
+#include "mbedtls/asn1write.h"
+#include "mbedtls/sha1.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_PEM_WRITE_C)
-#include "polarssl/pem.h"
+#include "mbedtls/pem.h"
 #endif /* POLARSSL_PEM_WRITE_C */
 
 /* Implementation that should never be optimized out by the compiler */
diff --git a/library/x509write_csr.c b/library/x509write_csr.c
index c5a5875..6c112e6 100644
--- a/library/x509write_csr.c
+++ b/library/x509write_csr.c
@@ -26,22 +26,22 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_X509_CSR_WRITE_C)
 
-#include "polarssl/x509_csr.h"
-#include "polarssl/oid.h"
-#include "polarssl/asn1write.h"
+#include "mbedtls/x509_csr.h"
+#include "mbedtls/oid.h"
+#include "mbedtls/asn1write.h"
 
 #include <string.h>
 #include <stdlib.h>
 
 #if defined(POLARSSL_PEM_WRITE_C)
-#include "polarssl/pem.h"
+#include "mbedtls/pem.h"
 #endif
 
 /* Implementation that should never be optimized out by the compiler */
diff --git a/library/xtea.c b/library/xtea.c
index 0558b93..8fac8c1 100644
--- a/library/xtea.c
+++ b/library/xtea.c
@@ -21,20 +21,20 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_XTEA_C)
 
-#include "polarssl/xtea.h"
+#include "mbedtls/xtea.h"
 
 #include <string.h>
 
 #if defined(POLARSSL_SELF_TEST)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
diff --git a/programs/.gitignore b/programs/.gitignore
index 80d7559..0f1fd27 100644
--- a/programs/.gitignore
+++ b/programs/.gitignore
@@ -31,6 +31,8 @@
 random/gen_entropy
 random/gen_random_ctr_drbg
 random/gen_random_havege
+ssl/dtls_client
+ssl/dtls_server
 ssl/ssl_client1
 ssl/ssl_client2
 ssl/ssl_fork_server
@@ -41,10 +43,9 @@
 ssl/mini_client
 test/benchmark
 test/ecp-bench
-test/o_p_test
 test/selftest
 test/ssl_cert_test
-test/ssl_test
+test/udp_proxy
 util/pem2der
 util/strerror
 x509/cert_app
diff --git a/programs/Makefile b/programs/Makefile
index c7aec12..bda349d 100644
--- a/programs/Makefile
+++ b/programs/Makefile
@@ -46,6 +46,7 @@
 	pkey/rsa_decrypt$(EXEXT)	pkey/rsa_encrypt$(EXEXT)	\
 	pkey/rsa_sign$(EXEXT)		pkey/rsa_verify$(EXEXT)		\
 	pkey/rsa_sign_pss$(EXEXT)	pkey/rsa_verify_pss$(EXEXT)	\
+	ssl/dtls_client$(EXEXT)		ssl/dtls_server$(EXEXT)		\
 	ssl/ssl_client1$(EXEXT)		ssl/ssl_client2$(EXEXT)		\
 	ssl/ssl_server$(EXEXT)		ssl/ssl_server2$(EXEXT)		\
 	ssl/ssl_fork_server$(EXEXT)	ssl/mini_client$(EXEXT)		\
@@ -53,15 +54,11 @@
 	random/gen_random_havege$(EXEXT)				\
 	random/gen_random_ctr_drbg$(EXEXT)				\
 	test/ssl_cert_test$(EXEXT)	test/benchmark$(EXEXT)		\
-	test/selftest$(EXEXT)		test/ssl_test$(EXEXT)		\
+	test/selftest$(EXEXT)		test/udp_proxy$(EXEXT)		\
 	util/pem2der$(EXEXT)		util/strerror$(EXEXT)		\
 	x509/cert_app$(EXEXT)		x509/crl_app$(EXEXT)		\
 	x509/cert_req$(EXEXT)
 
-ifdef OPENSSL
-APPS +=	test/o_p_test
-endif
-
 ifdef PTHREAD
 APPS +=	ssl/ssl_pthread_server
 endif
@@ -186,6 +183,14 @@
 	echo   "  CC    random/gen_random_ctr_drbg.c"
 	$(CC) $(CFLAGS) $(OFLAGS) random/gen_random_ctr_drbg.c $(LDFLAGS) -o $@
 
+ssl/dtls_client$(EXEXT): ssl/dtls_client.c ../library/libmbedtls.a
+	echo   "  CC    ssl/dtls_client.c"
+	$(CC) $(CFLAGS) $(OFLAGS) ssl/dtls_client.c  $(LDFLAGS) -o $@
+
+ssl/dtls_server$(EXEXT): ssl/dtls_server.c ../library/libmbedtls.a
+	echo   "  CC    ssl/dtls_server.c"
+	$(CC) $(CFLAGS) $(OFLAGS) ssl/dtls_server.c  $(LDFLAGS) -o $@
+
 ssl/ssl_client1$(EXEXT): ssl/ssl_client1.c ../library/libmbedtls.a
 	echo   "  CC    ssl/ssl_client1.c"
 	$(CC) $(CFLAGS) $(OFLAGS) ssl/ssl_client1.c  $(LDFLAGS) -o $@
@@ -230,13 +235,9 @@
 	echo   "  CC    test/selftest.c"
 	$(CC) $(CFLAGS) $(OFLAGS) test/selftest.c    $(LDFLAGS) -o $@
 
-test/ssl_test$(EXEXT): test/ssl_test.c ../library/libmbedtls.a
-	echo   "  CC    test/ssl_test.c"
-	$(CC) $(CFLAGS) $(OFLAGS) test/ssl_test.c    $(LDFLAGS) -o $@
-
-test/o_p_test$(EXEXT): test/o_p_test.c ../library/libmbedtls.a
-	echo   "  CC    test/o_p_test.c"
-	$(CC) $(CFLAGS) $(OFLAGS) test/o_p_test.c    $(LDFLAGS) -o $@ -lssl -lcrypto
+test/udp_proxy$(EXEXT): test/udp_proxy.c ../library/libmbedtls.a
+	echo   "  CC    test/udp_proxy.c"
+	$(CC) $(CFLAGS) $(OFLAGS) test/udp_proxy.c    $(LDFLAGS) -o $@
 
 util/pem2der$(EXEXT): util/pem2der.c ../library/libmbedtls.a
 	echo   "  CC    util/pem2der.c"
diff --git a/programs/aes/aescrypt2.c b/programs/aes/aescrypt2.c
index 2582b96..5d733b4 100644
--- a/programs/aes/aescrypt2.c
+++ b/programs/aes/aescrypt2.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -36,8 +36,8 @@
 
 #if defined(POLARSSL_AES_C) && defined(POLARSSL_SHA256_C) && \
  defined(POLARSSL_FS_IO)
-#include "polarssl/aes.h"
-#include "polarssl/sha256.h"
+#include "mbedtls/aes.h"
+#include "mbedtls/sha256.h"
 
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/programs/aes/crypt_and_hash.c b/programs/aes/crypt_and_hash.c
index 1f14d3f..b002934 100644
--- a/programs/aes/crypt_and_hash.c
+++ b/programs/aes/crypt_and_hash.c
@@ -22,13 +22,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -37,8 +37,8 @@
 
 #if defined(POLARSSL_CIPHER_C) && defined(POLARSSL_MD_C) && \
  defined(POLARSSL_FS_IO)
-#include "polarssl/cipher.h"
-#include "polarssl/md.h"
+#include "mbedtls/cipher.h"
+#include "mbedtls/md.h"
 
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/programs/hash/generic_sum.c b/programs/hash/generic_sum.c
index 08f175d..888f0f9 100644
--- a/programs/hash/generic_sum.c
+++ b/programs/hash/generic_sum.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -35,7 +35,7 @@
 #endif
 
 #if defined(POLARSSL_MD_C) && defined(POLARSSL_FS_IO)
-#include "polarssl/md.h"
+#include "mbedtls/md.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/hash/hello.c b/programs/hash/hello.c
index 77ae7f9..be81d56 100644
--- a/programs/hash/hello.c
+++ b/programs/hash/hello.c
@@ -21,20 +21,20 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
 #endif
 
 #if defined(POLARSSL_MD5_C)
-#include "polarssl/md5.h"
+#include "mbedtls/md5.h"
 #endif
 
 #if !defined(POLARSSL_MD5_C)
diff --git a/programs/hash/md5sum.c b/programs/hash/md5sum.c
index f8e32f7..0ac0b0c 100644
--- a/programs/hash/md5sum.c
+++ b/programs/hash/md5sum.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -35,7 +35,7 @@
 #endif
 
 #if defined(POLARSSL_MD5_C) && defined(POLARSSL_FS_IO)
-#include "polarssl/md5.h"
+#include "mbedtls/md5.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/hash/sha1sum.c b/programs/hash/sha1sum.c
index dbdce3e..a6f9673 100644
--- a/programs/hash/sha1sum.c
+++ b/programs/hash/sha1sum.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -35,7 +35,7 @@
 #endif
 
 #if defined(POLARSSL_SHA1_C) && defined(POLARSSL_FS_IO)
-#include "polarssl/sha1.h"
+#include "mbedtls/sha1.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/hash/sha2sum.c b/programs/hash/sha2sum.c
index 2ed92fc..453ea5d 100644
--- a/programs/hash/sha2sum.c
+++ b/programs/hash/sha2sum.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -35,7 +35,7 @@
 #endif
 
 #if defined(POLARSSL_SHA256_C) && defined(POLARSSL_FS_IO)
-#include "polarssl/sha256.h"
+#include "mbedtls/sha256.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/pkey/dh_client.c b/programs/pkey/dh_client.c
index a5a137a..8ff4e5c 100644
--- a/programs/pkey/dh_client.c
+++ b/programs/pkey/dh_client.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -37,13 +37,13 @@
     defined(POLARSSL_ENTROPY_C) && defined(POLARSSL_NET_C) && \
     defined(POLARSSL_RSA_C) && defined(POLARSSL_SHA256_C) && \
     defined(POLARSSL_FS_IO) && defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/net.h"
-#include "polarssl/aes.h"
-#include "polarssl/dhm.h"
-#include "polarssl/rsa.h"
-#include "polarssl/sha1.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
+#include "mbedtls/net.h"
+#include "mbedtls/aes.h"
+#include "mbedtls/dhm.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/sha1.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
 
 #include <stdio.h>
 #include <string.h>
@@ -138,7 +138,7 @@
     fflush( stdout );
 
     if( ( ret = net_connect( &server_fd, SERVER_NAME,
-                                         SERVER_PORT ) ) != 0 )
+                                         SERVER_PORT, NET_PROTO_TCP ) ) != 0 )
     {
         polarssl_printf( " failed\n  ! net_connect returned %d\n\n", ret );
         goto exit;
diff --git a/programs/pkey/dh_genprime.c b/programs/pkey/dh_genprime.c
index b5f9018..c2f5b6c 100644
--- a/programs/pkey/dh_genprime.c
+++ b/programs/pkey/dh_genprime.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -36,9 +36,9 @@
 #if defined(POLARSSL_BIGNUM_C) && defined(POLARSSL_ENTROPY_C) && \
     defined(POLARSSL_FS_IO) && defined(POLARSSL_CTR_DRBG_C) && \
     defined(POLARSSL_GENPRIME)
-#include "polarssl/bignum.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
+#include "mbedtls/bignum.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/pkey/dh_server.c b/programs/pkey/dh_server.c
index 0ac91a4..524e8d6 100644
--- a/programs/pkey/dh_server.c
+++ b/programs/pkey/dh_server.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -37,13 +37,13 @@
     defined(POLARSSL_ENTROPY_C) && defined(POLARSSL_NET_C) && \
     defined(POLARSSL_RSA_C) && defined(POLARSSL_SHA256_C) && \
     defined(POLARSSL_FS_IO) && defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/net.h"
-#include "polarssl/aes.h"
-#include "polarssl/dhm.h"
-#include "polarssl/rsa.h"
-#include "polarssl/sha1.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
+#include "mbedtls/net.h"
+#include "mbedtls/aes.h"
+#include "mbedtls/dhm.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/sha1.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
 
 #include <stdio.h>
 #include <string.h>
@@ -166,7 +166,7 @@
     polarssl_printf( "\n  . Waiting for a remote connection" );
     fflush( stdout );
 
-    if( ( ret = net_bind( &listen_fd, NULL, SERVER_PORT ) ) != 0 )
+    if( ( ret = net_bind( &listen_fd, NULL, SERVER_PORT, NET_PROTO_TCP ) ) != 0 )
     {
         polarssl_printf( " failed\n  ! net_bind returned %d\n\n", ret );
         goto exit;
diff --git a/programs/pkey/ecdsa.c b/programs/pkey/ecdsa.c
index aa8eafb..3d74978 100644
--- a/programs/pkey/ecdsa.c
+++ b/programs/pkey/ecdsa.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -35,9 +35,9 @@
 
 #if defined(POLARSSL_ECDSA_C) && \
     defined(POLARSSL_ENTROPY_C) && defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/ecdsa.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/ecdsa.h"
 
 #include <string.h>
 #endif
diff --git a/programs/pkey/gen_key.c b/programs/pkey/gen_key.c
index fca35e5..6b93111 100644
--- a/programs/pkey/gen_key.c
+++ b/programs/pkey/gen_key.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -35,13 +35,13 @@
 
 #if defined(POLARSSL_PK_WRITE_C) && defined(POLARSSL_FS_IO) && \
     defined(POLARSSL_ENTROPY_C) && defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/error.h"
-#include "polarssl/pk.h"
-#include "polarssl/ecdsa.h"
-#include "polarssl/rsa.h"
-#include "polarssl/error.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
+#include "mbedtls/error.h"
+#include "mbedtls/pk.h"
+#include "mbedtls/ecdsa.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/error.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
 
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/programs/pkey/key_app.c b/programs/pkey/key_app.c
index f8a2d2d..c72f17d 100644
--- a/programs/pkey/key_app.c
+++ b/programs/pkey/key_app.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -35,9 +35,9 @@
 
 #if defined(POLARSSL_BIGNUM_C) && \
     defined(POLARSSL_PK_PARSE_C) && defined(POLARSSL_FS_IO)
-#include "polarssl/error.h"
-#include "polarssl/rsa.h"
-#include "polarssl/x509.h"
+#include "mbedtls/error.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/x509.h"
 
 #include <string.h>
 #endif
diff --git a/programs/pkey/key_app_writer.c b/programs/pkey/key_app_writer.c
index 3be1ce0..1be0dd3 100644
--- a/programs/pkey/key_app_writer.c
+++ b/programs/pkey/key_app_writer.c
@@ -21,22 +21,22 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
 #endif
 
 #if defined(POLARSSL_PK_WRITE_C) && defined(POLARSSL_FS_IO)
-#include "polarssl/error.h"
-#include "polarssl/pk.h"
-#include "polarssl/error.h"
+#include "mbedtls/error.h"
+#include "mbedtls/pk.h"
+#include "mbedtls/error.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/pkey/mpi_demo.c b/programs/pkey/mpi_demo.c
index c94fb97..9f013a1 100644
--- a/programs/pkey/mpi_demo.c
+++ b/programs/pkey/mpi_demo.c
@@ -21,20 +21,20 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
 #endif
 
 #if defined(POLARSSL_BIGNUM_C) && defined(POLARSSL_FS_IO)
-#include "polarssl/bignum.h"
+#include "mbedtls/bignum.h"
 
 #include <stdio.h>
 #endif
diff --git a/programs/pkey/pk_decrypt.c b/programs/pkey/pk_decrypt.c
index bafa4a9..a212351 100644
--- a/programs/pkey/pk_decrypt.c
+++ b/programs/pkey/pk_decrypt.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -36,10 +36,10 @@
 #if defined(POLARSSL_BIGNUM_C) && defined(POLARSSL_PK_PARSE_C) && \
     defined(POLARSSL_FS_IO) && defined(POLARSSL_ENTROPY_C) && \
     defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/error.h"
-#include "polarssl/pk.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
+#include "mbedtls/error.h"
+#include "mbedtls/pk.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/pkey/pk_encrypt.c b/programs/pkey/pk_encrypt.c
index ad94159..13fa484 100644
--- a/programs/pkey/pk_encrypt.c
+++ b/programs/pkey/pk_encrypt.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -37,10 +37,10 @@
 #if defined(POLARSSL_BIGNUM_C) && defined(POLARSSL_PK_PARSE_C) && \
     defined(POLARSSL_ENTROPY_C) && defined(POLARSSL_FS_IO) && \
     defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/error.h"
-#include "polarssl/pk.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
+#include "mbedtls/error.h"
+#include "mbedtls/pk.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/pkey/pk_sign.c b/programs/pkey/pk_sign.c
index 7ccc70b..4b2a568 100644
--- a/programs/pkey/pk_sign.c
+++ b/programs/pkey/pk_sign.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_snprintf   snprintf
@@ -39,12 +39,12 @@
     defined(POLARSSL_SHA256_C) && \
     defined(POLARSSL_PK_PARSE_C) && defined(POLARSSL_FS_IO) && \
     defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/error.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/md.h"
-#include "polarssl/pk.h"
-#include "polarssl/sha1.h"
+#include "mbedtls/error.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/md.h"
+#include "mbedtls/pk.h"
+#include "mbedtls/sha1.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/pkey/pk_verify.c b/programs/pkey/pk_verify.c
index 3afa34a..a9c6645 100644
--- a/programs/pkey/pk_verify.c
+++ b/programs/pkey/pk_verify.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_snprintf   snprintf
@@ -38,10 +38,10 @@
 #if defined(POLARSSL_BIGNUM_C) && \
     defined(POLARSSL_SHA256_C) && defined(POLARSSL_PK_PARSE_C) && \
     defined(POLARSSL_FS_IO)
-#include "polarssl/error.h"
-#include "polarssl/md.h"
-#include "polarssl/pk.h"
-#include "polarssl/sha1.h"
+#include "mbedtls/error.h"
+#include "mbedtls/md.h"
+#include "mbedtls/pk.h"
+#include "mbedtls/sha1.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/pkey/rsa_decrypt.c b/programs/pkey/rsa_decrypt.c
index dfa475c..215c3bc 100644
--- a/programs/pkey/rsa_decrypt.c
+++ b/programs/pkey/rsa_decrypt.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -36,9 +36,9 @@
 #if defined(POLARSSL_BIGNUM_C) && defined(POLARSSL_RSA_C) && \
     defined(POLARSSL_FS_IO) && defined(POLARSSL_ENTROPY_C) && \
     defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/rsa.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/pkey/rsa_encrypt.c b/programs/pkey/rsa_encrypt.c
index 6831833..b3d23bb 100644
--- a/programs/pkey/rsa_encrypt.c
+++ b/programs/pkey/rsa_encrypt.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -37,9 +37,9 @@
 #if defined(POLARSSL_BIGNUM_C) && defined(POLARSSL_RSA_C) && \
     defined(POLARSSL_ENTROPY_C) && defined(POLARSSL_FS_IO) && \
     defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/rsa.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/pkey/rsa_genkey.c b/programs/pkey/rsa_genkey.c
index 0270b53..d5f1cf5 100644
--- a/programs/pkey/rsa_genkey.c
+++ b/programs/pkey/rsa_genkey.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -36,11 +36,11 @@
 #if defined(POLARSSL_BIGNUM_C) && defined(POLARSSL_ENTROPY_C) && \
     defined(POLARSSL_RSA_C) && defined(POLARSSL_GENPRIME) && \
     defined(POLARSSL_FS_IO) && defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/bignum.h"
-#include "polarssl/x509.h"
-#include "polarssl/rsa.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/bignum.h"
+#include "mbedtls/x509.h"
+#include "mbedtls/rsa.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/pkey/rsa_sign.c b/programs/pkey/rsa_sign.c
index d9a9a6e..69c7374 100644
--- a/programs/pkey/rsa_sign.c
+++ b/programs/pkey/rsa_sign.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -36,8 +36,8 @@
 
 #if defined(POLARSSL_BIGNUM_C) && defined(POLARSSL_RSA_C) && \
     defined(POLARSSL_SHA256_C) && defined(POLARSSL_FS_IO)
-#include "polarssl/rsa.h"
-#include "polarssl/sha1.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/sha1.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/pkey/rsa_sign_pss.c b/programs/pkey/rsa_sign_pss.c
index 7c0c7ca..0750975 100644
--- a/programs/pkey/rsa_sign_pss.c
+++ b/programs/pkey/rsa_sign_pss.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_snprintf   snprintf
@@ -39,12 +39,12 @@
     defined(POLARSSL_RSA_C) && defined(POLARSSL_SHA256_C) && \
     defined(POLARSSL_PK_PARSE_C) && defined(POLARSSL_FS_IO) && \
     defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/md.h"
-#include "polarssl/rsa.h"
-#include "polarssl/sha1.h"
-#include "polarssl/x509.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/md.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/sha1.h"
+#include "mbedtls/x509.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/pkey/rsa_verify.c b/programs/pkey/rsa_verify.c
index 374a5f1..5121afe 100644
--- a/programs/pkey/rsa_verify.c
+++ b/programs/pkey/rsa_verify.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -35,8 +35,8 @@
 
 #if defined(POLARSSL_BIGNUM_C) && defined(POLARSSL_RSA_C) && \
     defined(POLARSSL_SHA256_C) && defined(POLARSSL_FS_IO)
-#include "polarssl/rsa.h"
-#include "polarssl/sha1.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/sha1.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/pkey/rsa_verify_pss.c b/programs/pkey/rsa_verify_pss.c
index 217b713..50a0c06 100644
--- a/programs/pkey/rsa_verify_pss.c
+++ b/programs/pkey/rsa_verify_pss.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_snprintf   snprintf
@@ -38,11 +38,11 @@
 #if defined(POLARSSL_BIGNUM_C) && defined(POLARSSL_RSA_C) && \
     defined(POLARSSL_SHA256_C) && defined(POLARSSL_PK_PARSE_C) && \
     defined(POLARSSL_FS_IO)
-#include "polarssl/md.h"
-#include "polarssl/pem.h"
-#include "polarssl/pk.h"
-#include "polarssl/sha1.h"
-#include "polarssl/x509.h"
+#include "mbedtls/md.h"
+#include "mbedtls/pem.h"
+#include "mbedtls/pk.h"
+#include "mbedtls/sha1.h"
+#include "mbedtls/x509.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/random/gen_entropy.c b/programs/random/gen_entropy.c
index 573a13b..b2a04d9 100644
--- a/programs/random/gen_entropy.c
+++ b/programs/random/gen_entropy.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -35,7 +35,7 @@
 #endif
 
 #if defined(POLARSSL_ENTROPY_C) && defined(POLARSSL_FS_IO)
-#include "polarssl/entropy.h"
+#include "mbedtls/entropy.h"
 
 #include <stdio.h>
 #endif
diff --git a/programs/random/gen_random_ctr_drbg.c b/programs/random/gen_random_ctr_drbg.c
index e96e37b..31b93bd 100644
--- a/programs/random/gen_random_ctr_drbg.c
+++ b/programs/random/gen_random_ctr_drbg.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -36,8 +36,8 @@
 
 #if defined(POLARSSL_CTR_DRBG_C) && defined(POLARSSL_ENTROPY_C) && \
  defined(POLARSSL_FS_IO)
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
 
 #include <stdio.h>
 #endif
diff --git a/programs/random/gen_random_havege.c b/programs/random/gen_random_havege.c
index e5a5356..20588ce 100644
--- a/programs/random/gen_random_havege.c
+++ b/programs/random/gen_random_havege.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -35,7 +35,7 @@
 #endif
 
 #if defined(POLARSSL_HAVEGE_C) && defined(POLARSSL_FS_IO)
-#include "polarssl/havege.h"
+#include "mbedtls/havege.h"
 
 #include <stdio.h>
 #include <time.h>
diff --git a/programs/ssl/CMakeLists.txt b/programs/ssl/CMakeLists.txt
index b1b9fa8..a2f5dc2 100644
--- a/programs/ssl/CMakeLists.txt
+++ b/programs/ssl/CMakeLists.txt
@@ -6,6 +6,8 @@
 )
 
 set(targets
+     dtls_client
+     dtls_server
      ssl_client1
      ssl_client2
      ssl_server
@@ -22,6 +24,12 @@
     set(libs ${libs} ${ZLIB_LIBRARIES})
 endif(ENABLE_ZLIB_SUPPORT)
 
+add_executable(dtls_client dtls_client.c)
+target_link_libraries(dtls_client ${libs})
+
+add_executable(dtls_server dtls_server.c)
+target_link_libraries(dtls_server ${libs})
+
 add_executable(ssl_client1 ssl_client1.c)
 target_link_libraries(ssl_client1 ${libs})
 
diff --git a/programs/ssl/dtls_client.c b/programs/ssl/dtls_client.c
new file mode 100644
index 0000000..4a19618
--- /dev/null
+++ b/programs/ssl/dtls_client.c
@@ -0,0 +1,347 @@
+/*
+ *  Simple DTLS client demonstration program
+ *
+ *  Copyright (C) 2014, Brainspark B.V.
+ *
+ *  This file is part of mbed TLS (https://tls.mbed.org)
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#if !defined(POLARSSL_CONFIG_FILE)
+#include "mbedtls/config.h"
+#else
+#include POLARSSL_CONFIG_FILE
+#endif
+
+#if defined(POLARSSL_PLATFORM_C)
+#include "mbedtls/platform.h"
+#else
+#define polarssl_printf     printf
+#define polarssl_fprintf    fprintf
+#endif
+
+#if !defined(POLARSSL_SSL_CLI_C) || !defined(POLARSSL_SSL_PROTO_DTLS) ||    \
+    !defined(POLARSSL_NET_C) ||                                             \
+    !defined(POLARSSL_ENTROPY_C) || !defined(POLARSSL_CTR_DRBG_C) ||        \
+    !defined(POLARSSL_X509_CRT_PARSE_C) || !defined(POLARSSL_RSA_C) ||      \
+    !defined(POLARSSL_CERTS_C)
+
+#include <stdio.h>
+int main( int argc, char *argv[] )
+{
+    ((void) argc);
+    ((void) argv);
+
+    polarssl_printf( "POLARSSL_SSL_CLI_C and/or POLARSSL_SSL_PROTO_DTLS and/or "
+            "POLARSSL_NET_C and/or "
+            "POLARSSL_ENTROPY_C and/or POLARSSL_CTR_DRBG_C and/or "
+            "POLARSSL_X509_CRT_PARSE_C and/or POLARSSL_RSA_C and/or "
+            "POLARSSL_CERTS_C not defined.\n" );
+    return( 0 );
+}
+#else
+
+#include <string.h>
+#include <stdio.h>
+
+#include "mbedtls/net.h"
+#include "mbedtls/debug.h"
+#include "mbedtls/ssl.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/error.h"
+#include "mbedtls/certs.h"
+
+#define SERVER_PORT 4433
+#define SERVER_NAME "localhost"
+#define SERVER_ADDR "127.0.0.1" /* forces IPv4 */
+#define MESSAGE     "Echo this"
+
+#define READ_TIMEOUT_MS 1000
+#define MAX_RETRY       5
+
+#define DEBUG_LEVEL 0
+
+static void my_debug( void *ctx, int level, const char *str )
+{
+    ((void) level);
+
+    polarssl_fprintf( (FILE *) ctx, "%s", str );
+    fflush(  (FILE *) ctx  );
+}
+
+int main( int argc, char *argv[] )
+{
+    int ret, len, server_fd = -1;
+    unsigned char buf[1024];
+    const char *pers = "dtls_client";
+    int retry_left = MAX_RETRY;
+
+    entropy_context entropy;
+    ctr_drbg_context ctr_drbg;
+    ssl_context ssl;
+    x509_crt cacert;
+
+    ((void) argc);
+    ((void) argv);
+
+#if defined(POLARSSL_DEBUG_C)
+    debug_set_threshold( DEBUG_LEVEL );
+#endif
+
+    /*
+     * 0. Initialize the RNG and the session data
+     */
+    memset( &ssl, 0, sizeof( ssl_context ) );
+    x509_crt_init( &cacert );
+
+    polarssl_printf( "\n  . Seeding the random number generator..." );
+    fflush( stdout );
+
+    entropy_init( &entropy );
+    if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
+                               (const unsigned char *) pers,
+                               strlen( pers ) ) ) != 0 )
+    {
+        polarssl_printf( " failed\n  ! ctr_drbg_init returned %d\n", ret );
+        goto exit;
+    }
+
+    polarssl_printf( " ok\n" );
+
+    /*
+     * 0. Initialize certificates
+     */
+    polarssl_printf( "  . Loading the CA root certificate ..." );
+    fflush( stdout );
+
+#if defined(POLARSSL_CERTS_C)
+    ret = x509_crt_parse( &cacert, (const unsigned char *) test_ca_list,
+                          strlen( test_ca_list ) );
+#else
+    ret = 1;
+    polarssl_printf("POLARSSL_CERTS_C not defined.");
+#endif
+
+    if( ret < 0 )
+    {
+        polarssl_printf( " failed\n  !  x509_crt_parse returned -0x%x\n\n", -ret );
+        goto exit;
+    }
+
+    polarssl_printf( " ok (%d skipped)\n", ret );
+
+    /*
+     * 1. Start the connection
+     */
+    polarssl_printf( "  . Connecting to udp/%s/%4d...", SERVER_NAME,
+                                               SERVER_PORT );
+    fflush( stdout );
+
+    if( ( ret = net_connect( &server_fd, SERVER_ADDR,
+                                         SERVER_PORT, NET_PROTO_UDP ) ) != 0 )
+    {
+        polarssl_printf( " failed\n  ! net_connect returned %d\n\n", ret );
+        goto exit;
+    }
+
+    polarssl_printf( " ok\n" );
+
+    /*
+     * 2. Setup stuff
+     */
+    polarssl_printf( "  . Setting up the DTLS structure..." );
+    fflush( stdout );
+
+    if( ( ret = ssl_init( &ssl ) ) != 0 )
+    {
+        polarssl_printf( " failed\n  ! ssl_init returned %d\n\n", ret );
+        goto exit;
+    }
+
+    polarssl_printf( " ok\n" );
+
+    ssl_set_endpoint( &ssl, SSL_IS_CLIENT );
+    ssl_set_transport( &ssl, SSL_TRANSPORT_DATAGRAM );
+
+    /* OPTIONAL is usually a bad choice for security, but makes interop easier
+     * in this simplified example, in which the ca chain is hardcoded.
+     * Production code should set a proper ca chain and use REQUIRED. */
+    ssl_set_authmode( &ssl, SSL_VERIFY_OPTIONAL );
+    ssl_set_ca_chain( &ssl, &cacert, NULL, SERVER_NAME );
+
+    ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg );
+    ssl_set_dbg( &ssl, my_debug, stdout );
+
+    ssl_set_bio_timeout( &ssl, &server_fd,
+                         net_send, net_recv, net_recv_timeout,
+                         READ_TIMEOUT_MS );
+
+    /*
+     * 4. Handshake
+     */
+    polarssl_printf( "  . Performing the SSL/TLS handshake..." );
+    fflush( stdout );
+
+    do ret = ssl_handshake( &ssl );
+    while( ret == POLARSSL_ERR_NET_WANT_READ ||
+           ret == POLARSSL_ERR_NET_WANT_WRITE );
+
+    if( ret != 0 )
+    {
+        polarssl_printf( " failed\n  ! ssl_handshake returned -0x%x\n\n", -ret );
+        goto exit;
+    }
+
+    polarssl_printf( " ok\n" );
+
+    /*
+     * 5. Verify the server certificate
+     */
+    polarssl_printf( "  . Verifying peer X.509 certificate..." );
+
+    /* In real life, we would have used SSL_VERIFY_REQUIRED so that the
+     * handshake would not succeed if the peer's cert is bad.  Even if we used
+     * SSL_VERIFY_OPTIONAL, we would bail out here if ret != 0 */
+    if( ( ret = ssl_get_verify_result( &ssl ) ) != 0 )
+    {
+        polarssl_printf( " failed\n" );
+
+        if( ( ret & BADCERT_EXPIRED ) != 0 )
+            polarssl_printf( "  ! server certificate has expired\n" );
+
+        if( ( ret & BADCERT_REVOKED ) != 0 )
+            polarssl_printf( "  ! server certificate has been revoked\n" );
+
+        if( ( ret & BADCERT_CN_MISMATCH ) != 0 )
+            polarssl_printf( "  ! CN mismatch (expected CN=%s)\n", SERVER_NAME );
+
+        if( ( ret & BADCERT_NOT_TRUSTED ) != 0 )
+            polarssl_printf( "  ! self-signed or not signed by a trusted CA\n" );
+
+        polarssl_printf( "\n" );
+    }
+    else
+        polarssl_printf( " ok\n" );
+
+    /*
+     * 6. Write the echo request
+     */
+send_request:
+    polarssl_printf( "  > Write to server:" );
+    fflush( stdout );
+
+    len = sizeof( MESSAGE ) - 1;
+
+    do ret = ssl_write( &ssl, (unsigned char *) MESSAGE, len );
+    while( ret == POLARSSL_ERR_NET_WANT_READ ||
+           ret == POLARSSL_ERR_NET_WANT_WRITE );
+
+    if( ret < 0 )
+    {
+        polarssl_printf( " failed\n  ! ssl_write returned %d\n\n", ret );
+        goto exit;
+    }
+
+    len = ret;
+    polarssl_printf( " %d bytes written\n\n%s\n\n", len, MESSAGE );
+
+    /*
+     * 7. Read the echo response
+     */
+    polarssl_printf( "  < Read from server:" );
+    fflush( stdout );
+
+    len = sizeof( buf ) - 1;
+    memset( buf, 0, sizeof( buf ) );
+
+    do ret = ssl_read( &ssl, buf, len );
+    while( ret == POLARSSL_ERR_NET_WANT_READ ||
+           ret == POLARSSL_ERR_NET_WANT_WRITE );
+
+    if( ret <= 0 )
+    {
+        switch( ret )
+        {
+            case POLARSSL_ERR_NET_TIMEOUT:
+                polarssl_printf( " timeout\n\n" );
+                if( retry_left-- > 0 )
+                    goto send_request;
+                goto exit;
+
+            case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY:
+                polarssl_printf( " connection was closed gracefully\n" );
+                ret = 0;
+                goto close_notify;
+
+            default:
+                polarssl_printf( " ssl_read returned -0x%x\n\n", -ret );
+                goto exit;
+        }
+    }
+
+    len = ret;
+    polarssl_printf( " %d bytes read\n\n%s\n\n", len, buf );
+
+    /*
+     * 8. Done, cleanly close the connection
+     */
+close_notify:
+    polarssl_printf( "  . Closing the connection..." );
+
+    /* No error checking, the connection might be closed already */
+    do ret = ssl_close_notify( &ssl );
+    while( ret == POLARSSL_ERR_NET_WANT_WRITE );
+    ret = 0;
+
+    polarssl_printf( " done\n" );
+
+    /*
+     * 9. Final clean-ups and exit
+     */
+exit:
+
+#ifdef POLARSSL_ERROR_C
+    if( ret != 0 )
+    {
+        char error_buf[100];
+        polarssl_strerror( ret, error_buf, 100 );
+        polarssl_printf( "Last error was: %d - %s\n\n", ret, error_buf );
+    }
+#endif
+
+    if( server_fd != -1 )
+        net_close( server_fd );
+
+    x509_crt_free( &cacert );
+    ssl_free( &ssl );
+    ctr_drbg_free( &ctr_drbg );
+    entropy_free( &entropy );
+
+#if defined(_WIN32)
+    polarssl_printf( "  + Press Enter to exit this program.\n" );
+    fflush( stdout ); getchar();
+#endif
+
+    /* Shell can not handle large exit numbers -> 1 for errors */
+    if( ret < 0 )
+        ret = 1;
+
+    return( ret );
+}
+#endif /* POLARSSL_SSL_CLI_C && POLARSSL_SSL_PROTO_DTLS && POLARSSL_NET_C &&
+          POLARSSL_ENTROPY_C && POLARSSL_CTR_DRBG_C &&
+          POLARSSL_X509_CRT_PARSE_C && POLARSSL_RSA_C && POLARSSL_CERTS_C */
diff --git a/programs/ssl/dtls_server.c b/programs/ssl/dtls_server.c
new file mode 100644
index 0000000..46c2a33
--- /dev/null
+++ b/programs/ssl/dtls_server.c
@@ -0,0 +1,414 @@
+/*
+ *  Simple DTLS server demonstration program
+ *
+ *  Copyright (C) 2014, Brainspark B.V.
+ *
+ *  This file is part of mbed TLS (https://tls.mbed.org)
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#if !defined(POLARSSL_CONFIG_FILE)
+#include "mbedtls/config.h"
+#else
+#include POLARSSL_CONFIG_FILE
+#endif
+
+#if defined(POLARSSL_PLATFORM_C)
+#include "mbedtls/platform.h"
+#else
+#define polarssl_printf     printf
+#define polarssl_fprintf    fprintf
+#endif
+
+#if !defined(POLARSSL_SSL_SRV_C) || !defined(POLARSSL_SSL_PROTO_DTLS) ||    \
+    !defined(POLARSSL_SSL_COOKIE_C) || !defined(POLARSSL_NET_C) ||          \
+    !defined(POLARSSL_ENTROPY_C) || !defined(POLARSSL_CTR_DRBG_C) ||        \
+    !defined(POLARSSL_X509_CRT_PARSE_C) || !defined(POLARSSL_RSA_C) ||      \
+    !defined(POLARSSL_CERTS_C)
+
+#include <stdio.h>
+int main( void )
+{
+    printf( "POLARSSL_SSL_SRV_C and/or POLARSSL_SSL_PROTO_DTLS and/or "
+            "POLARSSL_SSL_COOKIE_C and/or POLARSSL_NET_C and/or "
+            "POLARSSL_ENTROPY_C and/or POLARSSL_CTR_DRBG_C and/or "
+            "POLARSSL_X509_CRT_PARSE_C and/or POLARSSL_RSA_C and/or "
+            "POLARSSL_CERTS_C not defined.\n" );
+    return( 0 );
+}
+#else
+
+#if defined(_WIN32)
+#include <windows.h>
+#endif
+
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/certs.h"
+#include "mbedtls/x509.h"
+#include "mbedtls/ssl.h"
+#include "mbedtls/ssl_cookie.h"
+#include "mbedtls/net.h"
+#include "mbedtls/error.h"
+#include "mbedtls/debug.h"
+
+#if defined(POLARSSL_SSL_CACHE_C)
+#include "mbedtls/ssl_cache.h"
+#endif
+
+#define READ_TIMEOUT_MS 10000   /* 5 seconds */
+#define DEBUG_LEVEL 0
+
+static void my_debug( void *ctx, int level, const char *str )
+{
+    ((void) level);
+
+    polarssl_fprintf( (FILE *) ctx, "%s", str );
+    fflush(  (FILE *) ctx  );
+}
+
+int main( void )
+{
+    int ret, len;
+    int listen_fd;
+    int client_fd = -1;
+    unsigned char buf[1024];
+    const char *pers = "dtls_server";
+    unsigned char client_ip[16] = { 0 };
+    ssl_cookie_ctx cookie_ctx;
+
+    entropy_context entropy;
+    ctr_drbg_context ctr_drbg;
+    ssl_context ssl;
+    x509_crt srvcert;
+    pk_context pkey;
+#if defined(POLARSSL_SSL_CACHE_C)
+    ssl_cache_context cache;
+#endif
+
+    memset( &ssl, 0, sizeof(ssl_context) );
+    ssl_cookie_init( &cookie_ctx );
+#if defined(POLARSSL_SSL_CACHE_C)
+    ssl_cache_init( &cache );
+#endif
+    x509_crt_init( &srvcert );
+    pk_init( &pkey );
+    entropy_init( &entropy );
+
+#if defined(POLARSSL_DEBUG_C)
+    debug_set_threshold( DEBUG_LEVEL );
+#endif
+
+    /*
+     * 1. Load the certificates and private RSA key
+     */
+    printf( "\n  . Loading the server cert. and key..." );
+    fflush( stdout );
+
+    /*
+     * This demonstration program uses embedded test certificates.
+     * Instead, you may want to use x509_crt_parse_file() to read the
+     * server and CA certificates, as well as pk_parse_keyfile().
+     */
+    ret = x509_crt_parse( &srvcert, (const unsigned char *) test_srv_crt,
+                          strlen( test_srv_crt ) );
+    if( ret != 0 )
+    {
+        printf( " failed\n  !  x509_crt_parse returned %d\n\n", ret );
+        goto exit;
+    }
+
+    ret = x509_crt_parse( &srvcert, (const unsigned char *) test_ca_list,
+                          strlen( test_ca_list ) );
+    if( ret != 0 )
+    {
+        printf( " failed\n  !  x509_crt_parse returned %d\n\n", ret );
+        goto exit;
+    }
+
+    ret =  pk_parse_key( &pkey, (const unsigned char *) test_srv_key,
+                         strlen( test_srv_key ), NULL, 0 );
+    if( ret != 0 )
+    {
+        printf( " failed\n  !  pk_parse_key returned %d\n\n", ret );
+        goto exit;
+    }
+
+    printf( " ok\n" );
+
+    /*
+     * 2. Setup the "listening" UDP socket
+     */
+    printf( "  . Bind on udp/*/4433 ..." );
+    fflush( stdout );
+
+    if( ( ret = net_bind( &listen_fd, NULL, 4433, NET_PROTO_UDP ) ) != 0 )
+    {
+        printf( " failed\n  ! net_bind returned %d\n\n", ret );
+        goto exit;
+    }
+
+    printf( " ok\n" );
+
+    /*
+     * 3. Seed the RNG
+     */
+    printf( "  . Seeding the random number generator..." );
+    fflush( stdout );
+
+    if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
+                               (const unsigned char *) pers,
+                               strlen( pers ) ) ) != 0 )
+    {
+        printf( " failed\n  ! ctr_drbg_init returned %d\n", ret );
+        goto exit;
+    }
+
+    printf( " ok\n" );
+
+    /*
+     * 4. Setup stuff
+     */
+    printf( "  . Setting up the DTLS data..." );
+    fflush( stdout );
+
+    if( ( ret = ssl_init( &ssl ) ) != 0 )
+    {
+        printf( " failed\n  ! ssl_init returned %d\n\n", ret );
+        goto exit;
+    }
+
+    ssl_set_endpoint( &ssl, SSL_IS_SERVER );
+    ssl_set_transport( &ssl, SSL_TRANSPORT_DATAGRAM );
+    ssl_set_authmode( &ssl, SSL_VERIFY_NONE );
+
+    ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg );
+    ssl_set_dbg( &ssl, my_debug, stdout );
+
+#if defined(POLARSSL_SSL_CACHE_C)
+    ssl_set_session_cache( &ssl, ssl_cache_get, &cache,
+                                 ssl_cache_set, &cache );
+#endif
+
+    ssl_set_ca_chain( &ssl, srvcert.next, NULL, NULL );
+    if( ( ret = ssl_set_own_cert( &ssl, &srvcert, &pkey ) ) != 0 )
+    {
+        printf( " failed\n  ! ssl_set_own_cert returned %d\n\n", ret );
+        goto exit;
+    }
+
+    if( ( ret = ssl_cookie_setup( &cookie_ctx,
+                                  ctr_drbg_random, &ctr_drbg ) ) != 0 )
+    {
+        printf( " failed\n  ! ssl_cookie_setup returned %d\n\n", ret );
+        goto exit;
+    }
+
+    ssl_set_dtls_cookies( &ssl, ssl_cookie_write, ssl_cookie_check,
+                               &cookie_ctx );
+
+    printf( " ok\n" );
+
+reset:
+#ifdef POLARSSL_ERROR_C
+    if( ret != 0 )
+    {
+        char error_buf[100];
+        polarssl_strerror( ret, error_buf, 100 );
+        printf("Last error was: %d - %s\n\n", ret, error_buf );
+    }
+#endif
+
+    if( client_fd != -1 )
+        net_close( client_fd );
+
+    ssl_session_reset( &ssl );
+
+    /*
+     * 3. Wait until a client connects
+     */
+    client_fd = -1;
+
+    printf( "  . Waiting for a remote connection ..." );
+    fflush( stdout );
+
+    if( ( ret = net_accept( listen_fd, &client_fd, client_ip ) ) != 0 )
+    {
+        printf( " failed\n  ! net_accept returned %d\n\n", ret );
+        goto exit;
+    }
+
+    /* With UDP, bind_fd is hijacked by client_fd, so bind a new one */
+    if( ( ret = net_bind( &listen_fd, NULL, 4433, NET_PROTO_UDP ) ) != 0 )
+    {
+        printf( " failed\n  ! net_bind returned -0x%x\n\n", -ret );
+        goto exit;
+    }
+
+    /* For HelloVerifyRequest cookies */
+    if( ( ret = ssl_set_client_transport_id( &ssl, client_ip,
+                                           sizeof( client_ip ) ) ) != 0 )
+    {
+        printf( " failed\n  ! "
+                "ssl_set_client_tranport_id() returned -0x%x\n\n", -ret );
+        goto exit;
+    }
+
+    ssl_set_bio_timeout( &ssl, &client_fd,
+                         net_send, net_recv, net_recv_timeout,
+                         READ_TIMEOUT_MS );
+
+    printf( " ok\n" );
+
+    /*
+     * 5. Handshake
+     */
+    printf( "  . Performing the DTLS handshake..." );
+    fflush( stdout );
+
+    do ret = ssl_handshake( &ssl );
+    while( ret == POLARSSL_ERR_NET_WANT_READ ||
+           ret == POLARSSL_ERR_NET_WANT_WRITE );
+
+    if( ret == POLARSSL_ERR_SSL_HELLO_VERIFY_REQUIRED )
+    {
+        printf( " hello verification requested\n" );
+        ret = 0;
+        goto reset;
+    }
+    else if( ret != 0 )
+    {
+        printf( " failed\n  ! ssl_handshake returned -0x%x\n\n", -ret );
+        goto reset;
+    }
+
+    printf( " ok\n" );
+
+    /*
+     * 6. Read the echo Request
+     */
+    printf( "  < Read from client:" );
+    fflush( stdout );
+
+    len = sizeof( buf ) - 1;
+    memset( buf, 0, sizeof( buf ) );
+
+    do ret = ssl_read( &ssl, buf, len );
+    while( ret == POLARSSL_ERR_NET_WANT_READ ||
+           ret == POLARSSL_ERR_NET_WANT_WRITE );
+
+    if( ret <= 0 )
+    {
+        switch( ret )
+        {
+            case POLARSSL_ERR_NET_TIMEOUT:
+                printf( " timeout\n\n" );
+                goto reset;
+
+            case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY:
+                printf( " connection was closed gracefully\n" );
+                ret = 0;
+                goto close_notify;
+
+            default:
+                printf( " ssl_read returned -0x%x\n\n", -ret );
+                goto reset;
+        }
+    }
+
+    len = ret;
+    printf( " %d bytes read\n\n%s\n\n", len, buf );
+
+    /*
+     * 7. Write the 200 Response
+     */
+    printf( "  > Write to client:" );
+    fflush( stdout );
+
+    do ret = ssl_write( &ssl, buf, len );
+    while( ret == POLARSSL_ERR_NET_WANT_READ ||
+           ret == POLARSSL_ERR_NET_WANT_WRITE );
+
+    if( ret < 0 )
+    {
+        printf( " failed\n  ! ssl_write returned %d\n\n", ret );
+        goto exit;
+    }
+
+    len = ret;
+    printf( " %d bytes written\n\n%s\n\n", len, buf );
+
+    /*
+     * 8. Done, cleanly close the connection
+     */
+close_notify:
+    printf( "  . Closing the connection..." );
+
+    /* No error checking, the connection might be closed already */
+    do ret = ssl_close_notify( &ssl );
+    while( ret == POLARSSL_ERR_NET_WANT_WRITE );
+    ret = 0;
+
+    printf( " done\n" );
+
+    goto reset;
+
+    /*
+     * Final clean-ups and exit
+     */
+exit:
+
+#ifdef POLARSSL_ERROR_C
+    if( ret != 0 )
+    {
+        char error_buf[100];
+        polarssl_strerror( ret, error_buf, 100 );
+        printf( "Last error was: %d - %s\n\n", ret, error_buf );
+    }
+#endif
+
+    if( client_fd != -1 )
+        net_close( client_fd );
+
+    x509_crt_free( &srvcert );
+    pk_free( &pkey );
+    ssl_free( &ssl );
+    ssl_cookie_free( &cookie_ctx );
+#if defined(POLARSSL_SSL_CACHE_C)
+    ssl_cache_free( &cache );
+#endif
+    ctr_drbg_free( &ctr_drbg );
+    entropy_free( &entropy );
+
+#if defined(_WIN32)
+    printf( "  Press Enter to exit this program.\n" );
+    fflush( stdout ); getchar();
+#endif
+
+    /* Shell can not handle large exit numbers -> 1 for errors */
+    if( ret < 0 )
+        ret = 1;
+
+    return( ret );
+}
+#endif /* POLARSSL_SSL_SRV_C && POLARSSL_SSL_PROTO_DTLS &&
+          POLARSSL_SSL_COOKIE_C && POLARSSL_NET_C && POLARSSL_ENTROPY_C &&
+          POLARSSL_CTR_DRBG_C && POLARSSL_X509_CRT_PARSE_C && POLARSSL_RSA_C
+          && POLARSSL_CERTS_C */
diff --git a/programs/ssl/mini_client.c b/programs/ssl/mini_client.c
index c48969b..de4fb32 100644
--- a/programs/ssl/mini_client.c
+++ b/programs/ssl/mini_client.c
@@ -22,7 +22,7 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
@@ -41,7 +41,7 @@
     !defined(POLARSSL_NET_C) || !defined(POLARSSL_SSL_CLI_C) || \
     !defined(UNIX)
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf printf
@@ -57,10 +57,10 @@
 
 #include <string.h>
 
-#include "polarssl/net.h"
-#include "polarssl/ssl.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
+#include "mbedtls/net.h"
+#include "mbedtls/ssl.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
 
 #include <sys/socket.h>
 #include <netinet/in.h>
diff --git a/programs/ssl/ssl_client1.c b/programs/ssl/ssl_client1.c
index 57104ca..838321a 100644
--- a/programs/ssl/ssl_client1.c
+++ b/programs/ssl/ssl_client1.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -38,13 +38,13 @@
     defined(POLARSSL_SSL_TLS_C) && defined(POLARSSL_SSL_CLI_C) && \
     defined(POLARSSL_NET_C) && defined(POLARSSL_RSA_C) && \
     defined(POLARSSL_CTR_DRBG_C) && defined(POLARSSL_X509_CRT_PARSE_C)
-#include "polarssl/net.h"
-#include "polarssl/debug.h"
-#include "polarssl/ssl.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/error.h"
-#include "polarssl/certs.h"
+#include "mbedtls/net.h"
+#include "mbedtls/debug.h"
+#include "mbedtls/ssl.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/error.h"
+#include "mbedtls/certs.h"
 
 #include <stdio.h>
 #include <string.h>
@@ -143,7 +143,7 @@
     fflush( stdout );
 
     if( ( ret = net_connect( &server_fd, SERVER_NAME,
-                                         SERVER_PORT ) ) != 0 )
+                                         SERVER_PORT, NET_PROTO_TCP ) ) != 0 )
     {
         polarssl_printf( " failed\n  ! net_connect returned %d\n\n", ret );
         goto exit;
@@ -169,7 +169,7 @@
     /* OPTIONAL is not optimal for security,
      * but makes interop easier in this simplified example */
     ssl_set_authmode( &ssl, SSL_VERIFY_OPTIONAL );
-    ssl_set_ca_chain( &ssl, &cacert, NULL, "PolarSSL Server 1" );
+    ssl_set_ca_chain( &ssl, &cacert, NULL, "mbed TLS Server 1" );
 
     /* SSLv3 is deprecated, set minimum to TLS 1.0 */
     ssl_set_min_version( &ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1 );
diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c
index da3dba7..46389ae 100644
--- a/programs/ssl/ssl_client2.c
+++ b/programs/ssl/ssl_client2.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -39,14 +39,14 @@
 #if defined(POLARSSL_ENTROPY_C) && defined(POLARSSL_FS_IO) && \
     defined(POLARSSL_SSL_TLS_C) && defined(POLARSSL_SSL_CLI_C) && \
     defined(POLARSSL_NET_C) && defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/net.h"
-#include "polarssl/ssl.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/certs.h"
-#include "polarssl/x509.h"
-#include "polarssl/error.h"
-#include "polarssl/debug.h"
+#include "mbedtls/net.h"
+#include "mbedtls/ssl.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/certs.h"
+#include "mbedtls/x509.h"
+#include "mbedtls/error.h"
+#include "mbedtls/debug.h"
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -54,7 +54,7 @@
 #endif
 
 #if defined(POLARSSL_TIMING_C)
-#include "polarssl/timing.h"
+#include "mbedtls/timing.h"
 #endif
 
 #if defined(_MSC_VER) && !defined(EFIX64) && !defined(EFI32)
@@ -70,6 +70,8 @@
 #define DFL_REQUEST_SIZE        -1
 #define DFL_DEBUG_LEVEL         0
 #define DFL_NBIO                0
+#define DFL_READ_TIMEOUT        0
+#define DFL_MAX_RESEND          0
 #define DFL_CA_FILE             ""
 #define DFL_CA_PATH             ""
 #define DFL_CRT_FILE            ""
@@ -92,6 +94,9 @@
 #define DFL_RECO_DELAY          0
 #define DFL_TICKETS             SSL_SESSION_TICKETS_ENABLED
 #define DFL_ALPN_STRING         NULL
+#define DFL_TRANSPORT           SSL_TRANSPORT_STREAM
+#define DFL_HS_TO_MIN           0
+#define DFL_HS_TO_MAX           0
 #define DFL_FALLBACK            -1
 #define DFL_EXTENDED_MS         -1
 #define DFL_ETM                 -1
@@ -169,6 +174,15 @@
 #define USAGE_ALPN ""
 #endif /* POLARSSL_SSL_ALPN */
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+#define USAGE_DTLS \
+    "    dtls=%%d             default: 0 (TLS)\n"                           \
+    "    hs_timeout=%%d-%%d    default: (library default: 1000-60000)\n"    \
+    "                        range of DTLS handshake timeouts in millisecs\n"
+#else
+#define USAGE_DTLS ""
+#endif
+
 #if defined(POLARSSL_SSL_FALLBACK_SCSV)
 #define USAGE_FALLBACK \
     "    fallback=0/1        default: (library default: off)\n"
@@ -210,6 +224,10 @@
     "    debug_level=%%d      default: 0 (disabled)\n"      \
     "    nbio=%%d             default: 0 (blocking I/O)\n"  \
     "                        options: 1 (non-blocking), 2 (added delays)\n" \
+    "    read_timeout=%%d     default: 0 (no timeout)\n"    \
+    "    max_resend=%%d       default: 0 (no resend on timeout)\n" \
+    "\n"                                                    \
+    USAGE_DTLS                                              \
     "\n"                                                    \
     "    auth_mode=%%s        default: \"required\"\n"      \
     "                        options: none, optional, required\n" \
@@ -235,7 +253,7 @@
     "    max_version=%%s      default: \"\" (tls1_2)\n"     \
     "    arc4=%%d             default: 0 (disabled)\n"      \
     "    force_version=%%s    default: \"\" (none)\n"       \
-    "                        options: ssl3, tls1, tls1_1, tls1_2\n" \
+    "                        options: ssl3, tls1, tls1_1, tls1_2, dtls1, dtls1_2\n" \
     "\n"                                                    \
     "    force_ciphersuite=<name>    default: all enabled\n"\
     " acceptable ciphersuite names:\n"
@@ -261,6 +279,8 @@
     int server_port;            /* port on which the ssl service runs       */
     int debug_level;            /* level of debugging                       */
     int nbio;                   /* should I/O be blocking?                  */
+    uint32_t read_timeout;      /* timeout on ssl_read() in milliseconds    */
+    int max_resend;             /* DTLS times to resend on read timeout     */
     const char *request_page;   /* page on server to request                */
     int request_size;           /* pad request with header to requested size */
     const char *ca_file;        /* the file with the CA certificate(s)      */
@@ -286,6 +306,9 @@
     int reco_delay;             /* delay in seconds before resuming session */
     int tickets;                /* enable / disable session tickets         */
     const char *alpn_string;    /* ALPN supported protocols                 */
+    int transport;              /* TLS or DTLS?                             */
+    uint32_t hs_to_min;         /* Initial value of DTLS handshake timer    */
+    uint32_t hs_to_max;         /* Max value of DTLS handshake timer        */
     int fallback;               /* is this a fallback connection?           */
     int extended_ms;            /* negotiate extended master secret?        */
     int etm;                    /* negotiate encrypt then mac?              */
@@ -380,7 +403,7 @@
 
 int main( int argc, char *argv[] )
 {
-    int ret = 0, len, tail_len, server_fd, i, written, frags;
+    int ret = 0, len, tail_len, server_fd, i, written, frags, retry_left;
     unsigned char buf[SSL_MAX_CONTENT_LEN + 1];
 #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED)
     unsigned char psk[POLARSSL_PSK_MAX_LEN];
@@ -445,6 +468,8 @@
     opt.server_port         = DFL_SERVER_PORT;
     opt.debug_level         = DFL_DEBUG_LEVEL;
     opt.nbio                = DFL_NBIO;
+    opt.read_timeout        = DFL_READ_TIMEOUT;
+    opt.max_resend          = DFL_MAX_RESEND;
     opt.request_page        = DFL_REQUEST_PAGE;
     opt.request_size        = DFL_REQUEST_SIZE;
     opt.ca_file             = DFL_CA_FILE;
@@ -469,6 +494,9 @@
     opt.reco_delay          = DFL_RECO_DELAY;
     opt.tickets             = DFL_TICKETS;
     opt.alpn_string         = DFL_ALPN_STRING;
+    opt.transport           = DFL_TRANSPORT;
+    opt.hs_to_min           = DFL_HS_TO_MIN;
+    opt.hs_to_max           = DFL_HS_TO_MAX;
     opt.fallback            = DFL_FALLBACK;
     opt.extended_ms         = DFL_EXTENDED_MS;
     opt.etm                 = DFL_ETM;
@@ -490,6 +518,16 @@
             if( opt.server_port < 1 || opt.server_port > 65535 )
                 goto usage;
         }
+        else if( strcmp( p, "dtls" ) == 0 )
+        {
+            int t = atoi( q );
+            if( t == 0 )
+                opt.transport = SSL_TRANSPORT_STREAM;
+            else if( t == 1 )
+                opt.transport = SSL_TRANSPORT_DATAGRAM;
+            else
+                goto usage;
+        }
         else if( strcmp( p, "debug_level" ) == 0 )
         {
             opt.debug_level = atoi( q );
@@ -502,6 +540,14 @@
             if( opt.nbio < 0 || opt.nbio > 2 )
                 goto usage;
         }
+        else if( strcmp( p, "read_timeout" ) == 0 )
+            opt.read_timeout = atoi( q );
+        else if( strcmp( p, "max_resend" ) == 0 )
+        {
+            opt.max_resend = atoi( q );
+            if( opt.max_resend < 0 )
+                goto usage;
+        }
         else if( strcmp( p, "request_page" ) == 0 )
             opt.request_page = q;
         else if( strcmp( p, "request_size" ) == 0 )
@@ -615,9 +661,11 @@
                 opt.min_version = SSL_MINOR_VERSION_0;
             else if( strcmp( q, "tls1" ) == 0 )
                 opt.min_version = SSL_MINOR_VERSION_1;
-            else if( strcmp( q, "tls1_1" ) == 0 )
+            else if( strcmp( q, "tls1_1" ) == 0 ||
+                     strcmp( q, "dtls1" ) == 0 )
                 opt.min_version = SSL_MINOR_VERSION_2;
-            else if( strcmp( q, "tls1_2" ) == 0 )
+            else if( strcmp( q, "tls1_2" ) == 0 ||
+                     strcmp( q, "dtls1_2" ) == 0 )
                 opt.min_version = SSL_MINOR_VERSION_3;
             else
                 goto usage;
@@ -628,9 +676,11 @@
                 opt.max_version = SSL_MINOR_VERSION_0;
             else if( strcmp( q, "tls1" ) == 0 )
                 opt.max_version = SSL_MINOR_VERSION_1;
-            else if( strcmp( q, "tls1_1" ) == 0 )
+            else if( strcmp( q, "tls1_1" ) == 0 ||
+                     strcmp( q, "dtls1" ) == 0 )
                 opt.max_version = SSL_MINOR_VERSION_2;
-            else if( strcmp( q, "tls1_2" ) == 0 )
+            else if( strcmp( q, "tls1_2" ) == 0 ||
+                     strcmp( q, "dtls1_2" ) == 0 )
                 opt.max_version = SSL_MINOR_VERSION_3;
             else
                 goto usage;
@@ -666,6 +716,18 @@
                 opt.min_version = SSL_MINOR_VERSION_3;
                 opt.max_version = SSL_MINOR_VERSION_3;
             }
+            else if( strcmp( q, "dtls1" ) == 0 )
+            {
+                opt.min_version = SSL_MINOR_VERSION_2;
+                opt.max_version = SSL_MINOR_VERSION_2;
+                opt.transport = SSL_TRANSPORT_DATAGRAM;
+            }
+            else if( strcmp( q, "dtls1_2" ) == 0 )
+            {
+                opt.min_version = SSL_MINOR_VERSION_3;
+                opt.max_version = SSL_MINOR_VERSION_3;
+                opt.transport = SSL_TRANSPORT_DATAGRAM;
+            }
             else
                 goto usage;
         }
@@ -702,6 +764,16 @@
                 default: goto usage;
             }
         }
+        else if( strcmp( p, "hs_timeout" ) == 0 )
+        {
+            if( ( p = strchr( q, '-' ) ) == NULL )
+                goto usage;
+            *p++ = '\0';
+            opt.hs_to_min = atoi( q );
+            opt.hs_to_max = atoi( p );
+            if( opt.hs_to_min == 0 || opt.hs_to_max < opt.hs_to_min )
+                goto usage;
+        }
         else if( strcmp( p, "recsplit" ) == 0 )
         {
             opt.recsplit = atoi( q );
@@ -735,10 +807,22 @@
             ret = 2;
             goto usage;
         }
-        if( opt.max_version > ciphersuite_info->max_minor_ver )
+
+        /* If the server selects a version that's not supported by
+         * this suite, then there will be no common ciphersuite... */
+        if( opt.max_version == -1 ||
+            opt.max_version > ciphersuite_info->max_minor_ver )
+        {
             opt.max_version = ciphersuite_info->max_minor_ver;
+        }
         if( opt.min_version < ciphersuite_info->min_minor_ver )
+        {
             opt.min_version = ciphersuite_info->min_minor_ver;
+            /* DTLS starts with TLS 1.1 */
+            if( opt.transport == SSL_TRANSPORT_DATAGRAM &&
+                opt.min_version < SSL_MINOR_VERSION_2 )
+                opt.min_version = SSL_MINOR_VERSION_2;
+        }
     }
 
 #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED)
@@ -928,12 +1012,14 @@
     if( opt.server_addr == NULL)
         opt.server_addr = opt.server_name;
 
-    polarssl_printf( "  . Connecting to tcp/%s/%-4d...", opt.server_addr,
-                                                opt.server_port );
+    polarssl_printf( "  . Connecting to %s/%s/%-4d...",
+            opt.transport == SSL_TRANSPORT_STREAM ? "tcp" : "udp",
+            opt.server_addr, opt.server_port );
     fflush( stdout );
 
-    if( ( ret = net_connect( &server_fd, opt.server_addr,
-                                         opt.server_port ) ) != 0 )
+    if( ( ret = net_connect( &server_fd, opt.server_addr, opt.server_port,
+                             opt.transport == SSL_TRANSPORT_STREAM ?
+                             NET_PROTO_TCP : NET_PROTO_UDP ) ) != 0 )
     {
         polarssl_printf( " failed\n  ! net_connect returned -0x%x\n\n", -ret );
         goto exit;
@@ -963,8 +1049,6 @@
         goto exit;
     }
 
-    polarssl_printf( " ok\n" );
-
 #if defined(POLARSSL_X509_CRT_PARSE_C)
     if( opt.debug_level > 0 )
         ssl_set_verify( &ssl, my_verify, NULL );
@@ -973,6 +1057,17 @@
     ssl_set_endpoint( &ssl, SSL_IS_CLIENT );
     ssl_set_authmode( &ssl, opt.auth_mode );
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ( ret = ssl_set_transport( &ssl, opt.transport ) ) != 0 )
+    {
+        polarssl_printf( " failed\n  ! selected transport is not available\n" );
+        goto exit;
+    }
+
+    if( opt.hs_to_min != DFL_HS_TO_MIN || opt.hs_to_max != DFL_HS_TO_MAX )
+        ssl_set_handshake_timeout( &ssl, opt.hs_to_min, opt.hs_to_max );
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+
 #if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
     if( ( ret = ssl_set_max_frag_len( &ssl, opt.mfl_code ) ) != 0 )
     {
@@ -1016,9 +1111,16 @@
     ssl_set_dbg( &ssl, my_debug, stdout );
 
     if( opt.nbio == 2 )
-        ssl_set_bio( &ssl, my_recv, &server_fd, my_send, &server_fd );
+        ssl_set_bio_timeout( &ssl, &server_fd, my_send, my_recv, NULL,
+                             opt.read_timeout );
     else
-        ssl_set_bio( &ssl, net_recv, &server_fd, net_send, &server_fd );
+        ssl_set_bio_timeout( &ssl, &server_fd, net_send, net_recv,
+#if defined(POLARSSL_HAVE_TIME)
+                             opt.nbio == 0 ? net_recv_timeout : NULL,
+#else
+                             NULL,
+#endif
+                             opt.read_timeout );
 
 #if defined(POLARSSL_SSL_SESSION_TICKETS)
     if( ( ret = ssl_set_session_tickets( &ssl, opt.tickets ) ) != 0 )
@@ -1076,14 +1178,32 @@
 #endif
 
     if( opt.min_version != -1 )
-        ssl_set_min_version( &ssl, SSL_MAJOR_VERSION_3, opt.min_version );
+    {
+        ret = ssl_set_min_version( &ssl, SSL_MAJOR_VERSION_3, opt.min_version );
+        if( ret != 0 && opt.min_version != DFL_MIN_VERSION )
+        {
+            polarssl_printf( " failed\n  ! selected min_version is not available\n" );
+            goto exit;
+        }
+    }
+
     if( opt.max_version != -1 )
-        ssl_set_max_version( &ssl, SSL_MAJOR_VERSION_3, opt.max_version );
+    {
+        ret = ssl_set_max_version( &ssl, SSL_MAJOR_VERSION_3, opt.max_version );
+        if( ret != 0 )
+        {
+            polarssl_printf( " failed\n  ! selected max_version is not available\n" );
+            goto exit;
+        }
+    }
+
 #if defined(POLARSSL_SSL_FALLBACK_SCSV)
     if( opt.fallback != DFL_FALLBACK )
         ssl_set_fallback( &ssl, opt.fallback );
 #endif
 
+    polarssl_printf( " ok\n" );
+
     /*
      * 4. Handshake
      */
@@ -1111,6 +1231,11 @@
     polarssl_printf( " ok\n    [ Protocol is %s ]\n    [ Ciphersuite is %s ]\n",
             ssl_get_version( &ssl ), ssl_get_ciphersuite( &ssl ) );
 
+    if( ( ret = ssl_get_record_expansion( &ssl ) ) >= 0 )
+        polarssl_printf( "    [ Record expansion is %d ]\n", ret );
+    else
+        polarssl_printf( "    [ Record expansion is unknown (compression) ]\n" );
+
 #if defined(POLARSSL_SSL_ALPN)
     if( opt.alpn_string != NULL )
     {
@@ -1195,6 +1320,7 @@
     /*
      * 6. Write the GET request
      */
+    retry_left = opt.max_resend;
 send_request:
     polarssl_printf( "  > Write to server:" );
     fflush( stdout );
@@ -1225,17 +1351,37 @@
         if( len >= 1 ) buf[len - 1] = '\n';
     }
 
-    for( written = 0, frags = 0; written < len; written += ret, frags++ )
+    if( opt.transport == SSL_TRANSPORT_STREAM )
     {
-        while( ( ret = ssl_write( &ssl, buf + written, len - written ) ) <= 0 )
+        for( written = 0, frags = 0; written < len; written += ret, frags++ )
         {
-            if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE )
+            while( ( ret = ssl_write( &ssl, buf + written, len - written ) )
+                           <= 0 )
             {
-                polarssl_printf( " failed\n  ! ssl_write returned -0x%x\n\n", -ret );
-                goto exit;
+                if( ret != POLARSSL_ERR_NET_WANT_READ &&
+                    ret != POLARSSL_ERR_NET_WANT_WRITE )
+                {
+                    polarssl_printf( " failed\n  ! ssl_write returned -0x%x\n\n", -ret );
+                    goto exit;
+                }
             }
         }
     }
+    else /* Not stream, so datagram */
+    {
+        do ret = ssl_write( &ssl, buf, len );
+        while( ret == POLARSSL_ERR_NET_WANT_READ ||
+               ret == POLARSSL_ERR_NET_WANT_WRITE );
+
+        if( ret < 0 )
+        {
+            polarssl_printf( " failed\n  ! ssl_write returned %d\n\n", ret );
+            goto exit;
+        }
+
+        frags = 1;
+        written = ret;
+    }
 
     buf[written] = '\0';
     polarssl_printf( " %d bytes written in %d fragments\n\n%s\n", written, frags, (char *) buf );
@@ -1246,31 +1392,80 @@
     polarssl_printf( "  < Read from server:" );
     fflush( stdout );
 
-    do
+    /*
+     * TLS and DTLS need different reading styles (stream vs datagram)
+     */
+    if( opt.transport == SSL_TRANSPORT_STREAM )
+    {
+        do
+        {
+            len = sizeof( buf ) - 1;
+            memset( buf, 0, sizeof( buf ) );
+            ret = ssl_read( &ssl, buf, len );
+
+            if( ret == POLARSSL_ERR_NET_WANT_READ ||
+                ret == POLARSSL_ERR_NET_WANT_WRITE )
+                continue;
+
+            if( ret <= 0 )
+            {
+                switch( ret )
+                {
+                    case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY:
+                        polarssl_printf( " connection was closed gracefully\n" );
+                        ret = 0;
+                        goto close_notify;
+
+                    case 0:
+                    case POLARSSL_ERR_NET_CONN_RESET:
+                        polarssl_printf( " connection was reset by peer\n" );
+                        ret = 0;
+                        goto reconnect;
+
+                    default:
+                        polarssl_printf( " ssl_read returned -0x%x\n", -ret );
+                        goto exit;
+                }
+            }
+
+            len = ret;
+            buf[len] = '\0';
+            polarssl_printf( " %d bytes read\n\n%s", len, (char *) buf );
+
+            /* End of message should be detected according to the syntax of the
+             * application protocol (eg HTTP), just use a dummy test here. */
+            if( ret > 0 && buf[len-1] == '\n' )
+            {
+                ret = 0;
+                break;
+            }
+        }
+        while( 1 );
+    }
+    else /* Not stream, so datagram */
     {
         len = sizeof( buf ) - 1;
         memset( buf, 0, sizeof( buf ) );
-        ret = ssl_read( &ssl, buf, len );
 
-        if( ret == POLARSSL_ERR_NET_WANT_READ ||
-            ret == POLARSSL_ERR_NET_WANT_WRITE )
-            continue;
+        do ret = ssl_read( &ssl, buf, len );
+        while( ret == POLARSSL_ERR_NET_WANT_READ ||
+               ret == POLARSSL_ERR_NET_WANT_WRITE );
 
         if( ret <= 0 )
         {
             switch( ret )
             {
+                case POLARSSL_ERR_NET_TIMEOUT:
+                    polarssl_printf( " timeout\n" );
+                    if( retry_left-- > 0 )
+                        goto send_request;
+                    goto exit;
+
                 case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY:
                     polarssl_printf( " connection was closed gracefully\n" );
                     ret = 0;
                     goto close_notify;
 
-                case 0:
-                case POLARSSL_ERR_NET_CONN_RESET:
-                    polarssl_printf( " connection was reset by peer\n" );
-                    ret = 0;
-                    goto reconnect;
-
                 default:
                     polarssl_printf( " ssl_read returned -0x%x\n", -ret );
                     goto exit;
@@ -1280,16 +1475,8 @@
         len = ret;
         buf[len] = '\0';
         polarssl_printf( " %d bytes read\n\n%s", len, (char *) buf );
-
-        /* End of message should be detected according to the syntax of the
-         * application protocol (eg HTTP), just use a dummy test here. */
-        if( ret > 0 && buf[len-1] == '\n' )
-        {
-            ret = 0;
-            break;
-        }
+        ret = 0;
     }
-    while( 1 );
 
     /*
      * 7b. Continue doing data exchanges?
@@ -1340,13 +1527,25 @@
             goto exit;
         }
 
-        if( ( ret = net_connect( &server_fd, opt.server_addr,
-                                             opt.server_port ) ) != 0 )
+        if( ( ret = net_connect( &server_fd, opt.server_addr, opt.server_port,
+                                 opt.transport == SSL_TRANSPORT_STREAM ?
+                                 NET_PROTO_TCP : NET_PROTO_UDP ) ) != 0 )
         {
             polarssl_printf( " failed\n  ! net_connect returned -0x%x\n\n", -ret );
             goto exit;
         }
 
+        if( opt.nbio > 0 )
+            ret = net_set_nonblock( server_fd );
+        else
+            ret = net_set_block( server_fd );
+        if( ret != 0 )
+        {
+            polarssl_printf( " failed\n  ! net_set_(non)block() returned -0x%x\n\n",
+                    -ret );
+            goto exit;
+        }
+
         while( ( ret = ssl_handshake( &ssl ) ) != 0 )
         {
             if( ret != POLARSSL_ERR_NET_WANT_READ &&
diff --git a/programs/ssl/ssl_fork_server.c b/programs/ssl/ssl_fork_server.c
index 654dbc9..b58d8d2 100644
--- a/programs/ssl/ssl_fork_server.c
+++ b/programs/ssl/ssl_fork_server.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -44,13 +44,13 @@
     defined(POLARSSL_RSA_C) && defined(POLARSSL_CTR_DRBG_C) && \
     defined(POLARSSL_X509_CRT_PARSE_C) && defined(POLARSSL_TIMING_C) && \
     defined(POLARSSL_FS_IO)
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/certs.h"
-#include "polarssl/x509.h"
-#include "polarssl/ssl.h"
-#include "polarssl/net.h"
-#include "polarssl/timing.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/certs.h"
+#include "mbedtls/x509.h"
+#include "mbedtls/ssl.h"
+#include "mbedtls/net.h"
+#include "mbedtls/timing.h"
 
 #include <string.h>
 #include <stdio.h>
@@ -185,7 +185,7 @@
     polarssl_printf( "  . Bind on https://localhost:4433/ ..." );
     fflush( stdout );
 
-    if( ( ret = net_bind( &listen_fd, NULL, 4433 ) ) != 0 )
+    if( ( ret = net_bind( &listen_fd, NULL, 4433, NET_PROTO_TCP ) ) != 0 )
     {
         polarssl_printf( " failed\n  ! net_bind returned %d\n\n", ret );
         goto exit;
diff --git a/programs/ssl/ssl_mail_client.c b/programs/ssl/ssl_mail_client.c
index 2b2d493..41e0777 100644
--- a/programs/ssl/ssl_mail_client.c
+++ b/programs/ssl/ssl_mail_client.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -39,14 +39,14 @@
     defined(POLARSSL_NET_C) && defined(POLARSSL_RSA_C) && \
     defined(POLARSSL_CTR_DRBG_C) && defined(POLARSSL_X509_CRT_PARSE_C) && \
     defined(POLARSSL_FS_IO)
-#include "polarssl/base64.h"
-#include "polarssl/error.h"
-#include "polarssl/net.h"
-#include "polarssl/ssl.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/certs.h"
-#include "polarssl/x509.h"
+#include "mbedtls/base64.h"
+#include "mbedtls/error.h"
+#include "mbedtls/net.h"
+#include "mbedtls/ssl.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/certs.h"
+#include "mbedtls/x509.h"
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -581,7 +581,7 @@
     fflush( stdout );
 
     if( ( ret = net_connect( &server_fd, opt.server_name,
-                                         opt.server_port ) ) != 0 )
+                             opt.server_port, NET_PROTO_TCP ) ) != 0 )
     {
         polarssl_printf( " failed\n  ! net_connect returned %d\n\n", ret );
         goto exit;
diff --git a/programs/ssl/ssl_pthread_server.c b/programs/ssl/ssl_pthread_server.c
index 75071b8..5222435 100644
--- a/programs/ssl/ssl_pthread_server.c
+++ b/programs/ssl/ssl_pthread_server.c
@@ -22,13 +22,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -46,13 +46,13 @@
     defined(POLARSSL_RSA_C) && defined(POLARSSL_CTR_DRBG_C) && \
     defined(POLARSSL_X509_CRT_PARSE_C) && defined(POLARSSL_FS_IO) && \
     defined(POLARSSL_THREADING_C) && defined(POLARSSL_THREADING_PTHREAD)
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/certs.h"
-#include "polarssl/x509.h"
-#include "polarssl/ssl.h"
-#include "polarssl/net.h"
-#include "polarssl/error.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/certs.h"
+#include "mbedtls/x509.h"
+#include "mbedtls/ssl.h"
+#include "mbedtls/net.h"
+#include "mbedtls/error.h"
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -60,11 +60,11 @@
 #endif
 
 #if defined(POLARSSL_SSL_CACHE_C)
-#include "polarssl/ssl_cache.h"
+#include "mbedtls/ssl_cache.h"
 #endif
 
 #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C)
-#include "polarssl/memory_buffer_alloc.h"
+#include "mbedtls/memory_buffer_alloc.h"
 #endif
 
 #define HTTP_RESPONSE \
@@ -456,7 +456,7 @@
     polarssl_printf( "  . Bind on https://localhost:4433/ ..." );
     fflush( stdout );
 
-    if( ( ret = net_bind( &listen_fd, NULL, 4433 ) ) != 0 )
+    if( ( ret = net_bind( &listen_fd, NULL, 4433, NET_PROTO_TCP ) ) != 0 )
     {
         polarssl_printf( " failed\n  ! net_bind returned %d\n\n", ret );
         goto exit;
diff --git a/programs/ssl/ssl_server.c b/programs/ssl/ssl_server.c
index 185e788..9c45e14 100644
--- a/programs/ssl/ssl_server.c
+++ b/programs/ssl/ssl_server.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -43,14 +43,14 @@
     defined(POLARSSL_SSL_SRV_C) && defined(POLARSSL_NET_C) && \
     defined(POLARSSL_RSA_C) && defined(POLARSSL_CTR_DRBG_C) && \
     defined(POLARSSL_X509_CRT_PARSE_C) && defined(POLARSSL_FS_IO)
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/certs.h"
-#include "polarssl/x509.h"
-#include "polarssl/ssl.h"
-#include "polarssl/net.h"
-#include "polarssl/error.h"
-#include "polarssl/debug.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/certs.h"
+#include "mbedtls/x509.h"
+#include "mbedtls/ssl.h"
+#include "mbedtls/net.h"
+#include "mbedtls/error.h"
+#include "mbedtls/debug.h"
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -58,7 +58,7 @@
 #endif
 
 #if defined(POLARSSL_SSL_CACHE_C)
-#include "polarssl/ssl_cache.h"
+#include "mbedtls/ssl_cache.h"
 #endif
 
 #define HTTP_RESPONSE \
@@ -163,7 +163,7 @@
     polarssl_printf( "  . Bind on https://localhost:4433/ ..." );
     fflush( stdout );
 
-    if( ( ret = net_bind( &listen_fd, NULL, 4433 ) ) != 0 )
+    if( ( ret = net_bind( &listen_fd, NULL, 4433, NET_PROTO_TCP ) ) != 0 )
     {
         polarssl_printf( " failed\n  ! net_bind returned %d\n\n", ret );
         goto exit;
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index d1bc36e..c935165 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_free       free
@@ -47,14 +47,14 @@
 #if defined(POLARSSL_ENTROPY_C) && \
     defined(POLARSSL_SSL_TLS_C) && defined(POLARSSL_SSL_SRV_C) && \
     defined(POLARSSL_NET_C) && defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/net.h"
-#include "polarssl/ssl.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/certs.h"
-#include "polarssl/x509.h"
-#include "polarssl/error.h"
-#include "polarssl/debug.h"
+#include "mbedtls/net.h"
+#include "mbedtls/ssl.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/certs.h"
+#include "mbedtls/x509.h"
+#include "mbedtls/error.h"
+#include "mbedtls/debug.h"
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -66,17 +66,22 @@
 #endif
 
 #if defined(POLARSSL_SSL_CACHE_C)
-#include "polarssl/ssl_cache.h"
+#include "mbedtls/ssl_cache.h"
+#endif
+
+#if defined(POLARSSL_SSL_COOKIE_C)
+#include "mbedtls/ssl_cookie.h"
 #endif
 
 #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C)
-#include "polarssl/memory_buffer_alloc.h"
+#include "mbedtls/memory_buffer_alloc.h"
 #endif
 
 #define DFL_SERVER_ADDR         NULL
 #define DFL_SERVER_PORT         4433
 #define DFL_DEBUG_LEVEL         0
 #define DFL_NBIO                0
+#define DFL_READ_TIMEOUT        0
 #define DFL_CA_FILE             ""
 #define DFL_CA_PATH             ""
 #define DFL_CRT_FILE            ""
@@ -107,6 +112,12 @@
 #define DFL_SNI                 NULL
 #define DFL_ALPN_STRING         NULL
 #define DFL_DHM_FILE            NULL
+#define DFL_TRANSPORT           SSL_TRANSPORT_STREAM
+#define DFL_COOKIES             1
+#define DFL_ANTI_REPLAY         -1
+#define DFL_HS_TO_MIN           0
+#define DFL_HS_TO_MAX           0
+#define DFL_BADMAC_LIMIT        -1
 #define DFL_EXTENDED_MS         -1
 #define DFL_ETM                 -1
 
@@ -215,6 +226,37 @@
 #define USAGE_ALPN ""
 #endif /* POLARSSL_SSL_ALPN */
 
+#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+#define USAGE_COOKIES \
+    "    cookies=0/1/-1      default: 1 (enabled)\n"        \
+    "                        0: disabled, -1: library default (broken)\n"
+#else
+#define USAGE_COOKIES ""
+#endif
+
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+#define USAGE_ANTI_REPLAY \
+    "    anti_replay=0/1     default: (library default: enabled)\n"
+#else
+#define USAGE_ANTI_REPLAY ""
+#endif
+
+#if defined(POLARSSL_SSL_DTLS_BADMAC_LIMIT)
+#define USAGE_BADMAC_LIMIT \
+    "    badmac_limit=%%d     default: (library default: disabled)\n"
+#else
+#define USAGE_BADMAC_LIMIT ""
+#endif
+
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+#define USAGE_DTLS \
+    "    dtls=%%d             default: 0 (TLS)\n"                           \
+    "    hs_timeout=%%d-%%d    default: (library default: 1000-60000)\n"    \
+    "                        range of DTLS handshake timeouts in millisecs\n"
+#else
+#define USAGE_DTLS ""
+#endif
+
 #if defined(POLARSSL_SSL_EXTENDED_MASTER_SECRET)
 #define USAGE_EMS \
     "    extended_ms=0/1     default: (library default: on)\n"
@@ -247,6 +289,12 @@
     "    debug_level=%%d      default: 0 (disabled)\n"      \
     "    nbio=%%d             default: 0 (blocking I/O)\n"  \
     "                        options: 1 (non-blocking), 2 (added delays)\n" \
+    "    read_timeout=%%d     default: 0 (no timeout)\n"    \
+    "\n"                                                    \
+    USAGE_DTLS                                              \
+    USAGE_COOKIES                                           \
+    USAGE_ANTI_REPLAY                                       \
+    USAGE_BADMAC_LIMIT                                      \
     "\n"                                                    \
     "    auth_mode=%%s        default: \"optional\"\n"      \
     "                        options: none, optional, required\n" \
@@ -258,6 +306,7 @@
     "    allow_legacy=%%d     default: (library default: no)\n"      \
     USAGE_RENEGO                                            \
     "    exchanges=%%d        default: 1\n"                 \
+    "\n"                                                    \
     USAGE_TICKETS                                           \
     USAGE_CACHE                                             \
     USAGE_MAX_FRAG_LEN                                      \
@@ -270,7 +319,7 @@
     "    max_version=%%s      default: \"tls1_2\"\n"        \
     "    arc4=%%d             default: 0 (disabled)\n"      \
     "    force_version=%%s    default: \"\" (none)\n"       \
-    "                        options: ssl3, tls1, tls1_1, tls1_2\n"     \
+    "                        options: ssl3, tls1, tls1_1, tls1_2, dtls1, dtls1_2\n" \
     "\n"                                                                \
     "    version_suites=a,b,c,d      per-version ciphersuites\n"        \
     "                                in order from ssl3 to tls1_2\n"    \
@@ -299,6 +348,7 @@
     int server_port;            /* port on which the ssl service runs       */
     int debug_level;            /* level of debugging                       */
     int nbio;                   /* should I/O be blocking?                  */
+    uint32_t read_timeout;      /* timeout on ssl_read() in milliseconds    */
     const char *ca_file;        /* the file with the CA certificate(s)      */
     const char *ca_path;        /* the path with the CA certificate(s) reside */
     const char *crt_file;       /* the file with the server certificate     */
@@ -331,6 +381,12 @@
     const char *dhm_file;       /* the file with the DH parameters          */
     int extended_ms;            /* allow negotiation of extended MS?        */
     int etm;                    /* allow negotiation of encrypt-then-MAC?   */
+    int transport;              /* TLS or DTLS?                             */
+    int cookies;                /* Use cookies for DTLS? -1 to break them   */
+    int anti_replay;            /* Use anti-replay for DTLS? -1 for default */
+    uint32_t hs_to_min;         /* Initial value of DTLS handshake timer    */
+    uint32_t hs_to_max;         /* Max value of DTLS handshake timer        */
+    int badmac_limit;           /* Limit of records with bad MAC            */
 } opt;
 
 static void my_debug( void *ctx, int level, const char *str )
@@ -658,6 +714,10 @@
     psk_entry *psk_info = NULL;
 #endif
     const char *pers = "ssl_server2";
+    unsigned char client_ip[16] = { 0 };
+#if defined(POLARSSL_SSL_COOKIE_C)
+    ssl_cookie_ctx cookie_ctx;
+#endif
 
     entropy_context entropy;
     ctr_drbg_context ctr_drbg;
@@ -718,6 +778,9 @@
 #if defined(POLARSSL_SSL_ALPN)
     memset( (void *) alpn_list, 0, sizeof( alpn_list ) );
 #endif
+#if defined(POLARSSL_SSL_COOKIE_C)
+    ssl_cookie_init( &cookie_ctx );
+#endif
 
 #if !defined(_WIN32)
     /* Abort cleanly on SIGTERM and SIGINT */
@@ -751,6 +814,7 @@
     opt.server_port         = DFL_SERVER_PORT;
     opt.debug_level         = DFL_DEBUG_LEVEL;
     opt.nbio                = DFL_NBIO;
+    opt.read_timeout        = DFL_READ_TIMEOUT;
     opt.ca_file             = DFL_CA_FILE;
     opt.ca_path             = DFL_CA_PATH;
     opt.crt_file            = DFL_CRT_FILE;
@@ -781,6 +845,12 @@
     opt.sni                 = DFL_SNI;
     opt.alpn_string         = DFL_ALPN_STRING;
     opt.dhm_file            = DFL_DHM_FILE;
+    opt.transport           = DFL_TRANSPORT;
+    opt.cookies             = DFL_COOKIES;
+    opt.anti_replay         = DFL_ANTI_REPLAY;
+    opt.hs_to_min           = DFL_HS_TO_MIN;
+    opt.hs_to_max           = DFL_HS_TO_MAX;
+    opt.badmac_limit        = DFL_BADMAC_LIMIT;
     opt.extended_ms         = DFL_EXTENDED_MS;
     opt.etm                 = DFL_ETM;
 
@@ -799,6 +869,16 @@
         }
         else if( strcmp( p, "server_addr" ) == 0 )
             opt.server_addr = q;
+        else if( strcmp( p, "dtls" ) == 0 )
+        {
+            int t = atoi( q );
+            if( t == 0 )
+                opt.transport = SSL_TRANSPORT_STREAM;
+            else if( t == 1 )
+                opt.transport = SSL_TRANSPORT_DATAGRAM;
+            else
+                goto usage;
+        }
         else if( strcmp( p, "debug_level" ) == 0 )
         {
             opt.debug_level = atoi( q );
@@ -811,6 +891,8 @@
             if( opt.nbio < 0 || opt.nbio > 2 )
                 goto usage;
         }
+        else if( strcmp( p, "read_timeout" ) == 0 )
+            opt.read_timeout = atoi( q );
         else if( strcmp( p, "ca_file" ) == 0 )
             opt.ca_file = q;
         else if( strcmp( p, "ca_path" ) == 0 )
@@ -878,7 +960,7 @@
         else if( strcmp( p, "exchanges" ) == 0 )
         {
             opt.exchanges = atoi( q );
-            if( opt.exchanges < 1 )
+            if( opt.exchanges < 0 )
                 goto usage;
         }
         else if( strcmp( p, "min_version" ) == 0 )
@@ -887,9 +969,11 @@
                 opt.min_version = SSL_MINOR_VERSION_0;
             else if( strcmp( q, "tls1" ) == 0 )
                 opt.min_version = SSL_MINOR_VERSION_1;
-            else if( strcmp( q, "tls1_1" ) == 0 )
+            else if( strcmp( q, "tls1_1" ) == 0 ||
+                     strcmp( q, "dtls1" ) == 0 )
                 opt.min_version = SSL_MINOR_VERSION_2;
-            else if( strcmp( q, "tls1_2" ) == 0 )
+            else if( strcmp( q, "tls1_2" ) == 0 ||
+                     strcmp( q, "dtls1_2" ) == 0 )
                 opt.min_version = SSL_MINOR_VERSION_3;
             else
                 goto usage;
@@ -900,9 +984,11 @@
                 opt.max_version = SSL_MINOR_VERSION_0;
             else if( strcmp( q, "tls1" ) == 0 )
                 opt.max_version = SSL_MINOR_VERSION_1;
-            else if( strcmp( q, "tls1_1" ) == 0 )
+            else if( strcmp( q, "tls1_1" ) == 0 ||
+                     strcmp( q, "dtls1" ) == 0 )
                 opt.max_version = SSL_MINOR_VERSION_2;
-            else if( strcmp( q, "tls1_2" ) == 0 )
+            else if( strcmp( q, "tls1_2" ) == 0 ||
+                     strcmp( q, "dtls1_2" ) == 0 )
                 opt.max_version = SSL_MINOR_VERSION_3;
             else
                 goto usage;
@@ -938,6 +1024,18 @@
                 opt.min_version = SSL_MINOR_VERSION_3;
                 opt.max_version = SSL_MINOR_VERSION_3;
             }
+            else if( strcmp( q, "dtls1" ) == 0 )
+            {
+                opt.min_version = SSL_MINOR_VERSION_2;
+                opt.max_version = SSL_MINOR_VERSION_2;
+                opt.transport = SSL_TRANSPORT_DATAGRAM;
+            }
+            else if( strcmp( q, "dtls1_2" ) == 0 )
+            {
+                opt.min_version = SSL_MINOR_VERSION_3;
+                opt.max_version = SSL_MINOR_VERSION_3;
+                opt.transport = SSL_TRANSPORT_DATAGRAM;
+            }
             else
                 goto usage;
         }
@@ -1020,6 +1118,34 @@
             if( opt.cache_timeout < 0 )
                 goto usage;
         }
+        else if( strcmp( p, "cookies" ) == 0 )
+        {
+            opt.cookies = atoi( q );
+            if( opt.cookies < -1 || opt.cookies > 1)
+                goto usage;
+        }
+        else if( strcmp( p, "anti_replay" ) == 0 )
+        {
+            opt.anti_replay = atoi( q );
+            if( opt.anti_replay < 0 || opt.anti_replay > 1)
+                goto usage;
+        }
+        else if( strcmp( p, "badmac_limit" ) == 0 )
+        {
+            opt.badmac_limit = atoi( q );
+            if( opt.badmac_limit < 0 )
+                goto usage;
+        }
+        else if( strcmp( p, "hs_timeout" ) == 0 )
+        {
+            if( ( p = strchr( q, '-' ) ) == NULL )
+                goto usage;
+            *p++ = '\0';
+            opt.hs_to_min = atoi( q );
+            opt.hs_to_max = atoi( p );
+            if( opt.hs_to_min == 0 || opt.hs_to_max < opt.hs_to_min )
+                goto usage;
+        }
         else if( strcmp( p, "sni" ) == 0 )
         {
             opt.sni = q;
@@ -1051,10 +1177,22 @@
             ret = 2;
             goto usage;
         }
-        if( opt.max_version > ciphersuite_info->max_minor_ver )
+
+        /* If we select a version that's not supported by
+         * this suite, then there will be no common ciphersuite... */
+        if( opt.max_version == -1 ||
+            opt.max_version > ciphersuite_info->max_minor_ver )
+        {
             opt.max_version = ciphersuite_info->max_minor_ver;
+        }
         if( opt.min_version < ciphersuite_info->min_minor_ver )
+        {
             opt.min_version = ciphersuite_info->min_minor_ver;
+            /* DTLS starts with TLS 1.1 */
+            if( opt.transport == SSL_TRANSPORT_DATAGRAM &&
+                opt.min_version < SSL_MINOR_VERSION_2 )
+                opt.min_version = SSL_MINOR_VERSION_2;
+        }
     }
 
     if( opt.version_suites != NULL )
@@ -1338,11 +1476,15 @@
     /*
      * 2. Setup the listening TCP socket
      */
-    polarssl_printf( "  . Bind on tcp://localhost:%-4d/ ...", opt.server_port );
+    polarssl_printf( "  . Bind on %s://%s:%-4d/ ...",
+            opt.transport == SSL_TRANSPORT_STREAM ? "tcp" : "udp",
+            opt.server_addr ? opt.server_addr : "*",
+            opt.server_port );
     fflush( stdout );
 
-    if( ( ret = net_bind( &listen_fd, opt.server_addr,
-                                      opt.server_port ) ) != 0 )
+    if( ( ret = net_bind( &listen_fd, opt.server_addr, opt.server_port,
+                          opt.transport == SSL_TRANSPORT_STREAM ?
+                          NET_PROTO_TCP : NET_PROTO_UDP ) ) != 0 )
     {
         polarssl_printf( " failed\n  ! net_bind returned -0x%x\n\n", -ret );
         goto exit;
@@ -1365,6 +1507,17 @@
     ssl_set_endpoint( &ssl, SSL_IS_SERVER );
     ssl_set_authmode( &ssl, opt.auth_mode );
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( ( ret = ssl_set_transport( &ssl, opt.transport ) ) != 0 )
+    {
+        polarssl_printf( " failed\n  ! selected transport is not available\n" );
+        goto exit;
+    }
+
+    if( opt.hs_to_min != DFL_HS_TO_MIN || opt.hs_to_max != DFL_HS_TO_MAX )
+        ssl_set_handshake_timeout( &ssl, opt.hs_to_min, opt.hs_to_max );
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+
 #if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
     if( ( ret = ssl_set_max_frag_len( &ssl, opt.mfl_code ) ) != 0 )
     {
@@ -1422,6 +1575,47 @@
         ssl_set_session_ticket_lifetime( &ssl, opt.ticket_timeout );
 #endif
 
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( opt.transport == SSL_TRANSPORT_DATAGRAM )
+    {
+#if defined(POLARSSL_SSL_COOKIE_C)
+        if( opt.cookies > 0 )
+        {
+            if( ( ret = ssl_cookie_setup( &cookie_ctx,
+                                          ctr_drbg_random, &ctr_drbg ) ) != 0 )
+            {
+                polarssl_printf( " failed\n  ! ssl_cookie_setup returned %d\n\n", ret );
+                goto exit;
+            }
+
+            ssl_set_dtls_cookies( &ssl, ssl_cookie_write, ssl_cookie_check,
+                                       &cookie_ctx );
+        }
+        else
+#endif /* POLARSSL_SSL_COOKIE_C */
+#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+        if( opt.cookies == 0 )
+        {
+            ssl_set_dtls_cookies( &ssl, NULL, NULL, NULL );
+        }
+        else
+#endif /* POLARSSL_SSL_DTLS_HELLO_VERIFY */
+        {
+            ; /* Nothing to do */
+        }
+
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+        if( opt.anti_replay != DFL_ANTI_REPLAY )
+            ssl_set_dtls_anti_replay( &ssl, opt.anti_replay );
+#endif
+
+#if defined(POLARSSL_SSL_DTLS_BADMAC_LIMIT)
+        if( opt.badmac_limit != DFL_BADMAC_LIMIT )
+            ssl_set_dtls_badmac_limit( &ssl, opt.badmac_limit );
+#endif
+    }
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+
     if( opt.force_ciphersuite[0] != DFL_FORCE_CIPHER )
         ssl_set_ciphersuites( &ssl, opt.force_ciphersuite );
     else
@@ -1520,10 +1714,24 @@
 #endif
 
     if( opt.min_version != -1 )
-        ssl_set_min_version( &ssl, SSL_MAJOR_VERSION_3, opt.min_version );
+    {
+        ret = ssl_set_min_version( &ssl, SSL_MAJOR_VERSION_3, opt.min_version );
+        if( ret != 0 && opt.min_version != DFL_MIN_VERSION )
+        {
+            polarssl_printf( " failed\n  ! selected min_version is not available\n" );
+            goto exit;
+        }
+    }
 
     if( opt.max_version != -1 )
-        ssl_set_max_version( &ssl, SSL_MAJOR_VERSION_3, opt.max_version );
+    {
+        ret = ssl_set_max_version( &ssl, SSL_MAJOR_VERSION_3, opt.max_version );
+        if( ret != 0 )
+        {
+            polarssl_printf( " failed\n  ! selected max_version is not available\n" );
+            goto exit;
+        }
+    }
 
     polarssl_printf( " ok\n" );
 
@@ -1559,7 +1767,7 @@
     polarssl_printf( "  . Waiting for a remote connection ..." );
     fflush( stdout );
 
-    if( ( ret = net_accept( listen_fd, &client_fd, NULL ) ) != 0 )
+    if( ( ret = net_accept( listen_fd, &client_fd, client_ip ) ) != 0 )
     {
 #if !defined(_WIN32)
         if( received_sigterm )
@@ -1585,29 +1793,84 @@
     }
 
     if( opt.nbio == 2 )
-        ssl_set_bio( &ssl, my_recv, &client_fd, my_send, &client_fd );
+        ssl_set_bio_timeout( &ssl, &client_fd, my_send, my_recv, NULL, 0 );
     else
-        ssl_set_bio( &ssl, net_recv, &client_fd, net_send, &client_fd );
+        ssl_set_bio_timeout( &ssl, &client_fd, net_send, net_recv,
+#if defined(POLARSSL_HAVE_TIME)
+                             opt.nbio == 0 ? net_recv_timeout : NULL,
+#else
+                             NULL,
+#endif
+                             opt.read_timeout );
+
+#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+    if( opt.transport == SSL_TRANSPORT_DATAGRAM )
+    {
+        if( ( ret = ssl_set_client_transport_id( &ssl, client_ip,
+                                               sizeof( client_ip ) ) ) != 0 )
+        {
+            polarssl_printf( " failed\n  ! "
+                    "ssl_set_client_tranport_id() returned -0x%x\n\n", -ret );
+            goto exit;
+        }
+    }
+#endif /* POLARSSL_SSL_DTLS_HELLO_VERIFY */
 
     polarssl_printf( " ok\n" );
 
     /*
+     * With UDP, bind_fd is hijacked by client_fd, so bind a new one
+     */
+#if defined(POLARSSL_SSL_PROTO_DTLS)
+    if( opt.transport == SSL_TRANSPORT_DATAGRAM )
+    {
+        polarssl_printf( "  . Re-bind on udp://%s:%-4d/ ...",
+                opt.server_addr ? opt.server_addr : "*",
+                opt.server_port );
+        fflush( stdout );
+
+        if( ( ret = net_bind( &listen_fd, opt.server_addr,
+                              opt.server_port, NET_PROTO_UDP ) ) != 0 )
+        {
+            polarssl_printf( " failed\n  ! net_bind returned -0x%x\n\n", -ret );
+            goto exit;
+        }
+
+        polarssl_printf( " ok\n" );
+    }
+#endif /* POLARSSL_SSL_PROTO_DTLS */
+
+    /*
      * 4. Handshake
      */
     polarssl_printf( "  . Performing the SSL/TLS handshake..." );
     fflush( stdout );
 
-    while( ( ret = ssl_handshake( &ssl ) ) != 0 )
+    do ret = ssl_handshake( &ssl );
+    while( ret == POLARSSL_ERR_NET_WANT_READ ||
+           ret == POLARSSL_ERR_NET_WANT_WRITE );
+
+    if( ret == POLARSSL_ERR_SSL_HELLO_VERIFY_REQUIRED )
     {
-        if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE )
-        {
-            polarssl_printf( " failed\n  ! ssl_handshake returned -0x%x\n\n", -ret );
-            goto reset;
-        }
+        polarssl_printf( " hello verification requested\n" );
+        ret = 0;
+        goto reset;
+    }
+    else if( ret != 0 )
+    {
+        polarssl_printf( " failed\n  ! ssl_handshake returned -0x%x\n\n", -ret );
+        goto reset;
+    }
+    else /* ret == 0 */
+    {
+        polarssl_printf( " ok\n    [ Protocol is %s ]\n    [ Ciphersuite is %s ]\n",
+                ssl_get_version( &ssl ), ssl_get_ciphersuite( &ssl ) );
     }
 
-    polarssl_printf( " ok\n    [ Protocol is %s ]\n    [ Ciphersuite is %s ]\n",
-            ssl_get_version( &ssl ), ssl_get_ciphersuite( &ssl ) );
+    if( ( ret = ssl_get_record_expansion( &ssl ) ) >= 0 )
+        polarssl_printf( "    [ Record expansion is %d ]\n", ret );
+    else
+        polarssl_printf( "    [ Record expansion is unknown (compression) ]\n" );
 
 #if defined(POLARSSL_SSL_ALPN)
     if( opt.alpn_string != NULL )
@@ -1654,6 +1917,9 @@
     }
 #endif /* POLARSSL_X509_CRT_PARSE_C */
 
+    if( opt.exchanges == 0 )
+        goto close_notify;
+
     exchanges_left = opt.exchanges;
 data_exchange:
     /*
@@ -1662,16 +1928,111 @@
     polarssl_printf( "  < Read from client:" );
     fflush( stdout );
 
-    do
+    /*
+     * TLS and DTLS need different reading styles (stream vs datagram)
+     */
+    if( opt.transport == SSL_TRANSPORT_STREAM )
     {
-        int terminated = 0;
+        do
+        {
+            int terminated = 0;
+            len = sizeof( buf ) - 1;
+            memset( buf, 0, sizeof( buf ) );
+            ret = ssl_read( &ssl, buf, len );
+
+            if( ret == POLARSSL_ERR_NET_WANT_READ ||
+                ret == POLARSSL_ERR_NET_WANT_WRITE )
+                continue;
+
+            if( ret <= 0 )
+            {
+                switch( ret )
+                {
+                    case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY:
+                        polarssl_printf( " connection was closed gracefully\n" );
+                        goto close_notify;
+
+                    case 0:
+                    case POLARSSL_ERR_NET_CONN_RESET:
+                        polarssl_printf( " connection was reset by peer\n" );
+                        ret = POLARSSL_ERR_NET_CONN_RESET;
+                        goto reset;
+
+                    default:
+                        polarssl_printf( " ssl_read returned -0x%x\n", -ret );
+                        goto reset;
+                }
+            }
+
+            if( ssl_get_bytes_avail( &ssl ) == 0 )
+            {
+                len = ret;
+                buf[len] = '\0';
+                polarssl_printf( " %d bytes read\n\n%s\n", len, (char *) buf );
+
+                /* End of message should be detected according to the syntax of the
+                 * application protocol (eg HTTP), just use a dummy test here. */
+                if( buf[len - 1] == '\n' )
+                    terminated = 1;
+            }
+            else
+            {
+                int extra_len, ori_len;
+                unsigned char *larger_buf;
+
+                ori_len = ret;
+                extra_len = ssl_get_bytes_avail( &ssl );
+
+                larger_buf = polarssl_malloc( ori_len + extra_len + 1 );
+                if( larger_buf == NULL )
+                {
+                    polarssl_printf( "  ! memory allocation failed\n" );
+                    ret = 1;
+                    goto reset;
+                }
+
+                memset( larger_buf, 0, ori_len + extra_len );
+                memcpy( larger_buf, buf, ori_len );
+
+                /* This read should never fail and get the whole cached data */
+                ret = ssl_read( &ssl, larger_buf + ori_len, extra_len );
+                if( ret != extra_len ||
+                    ssl_get_bytes_avail( &ssl ) != 0 )
+                {
+                    polarssl_printf( "  ! ssl_read failed on cached data\n" );
+                    ret = 1;
+                    goto reset;
+                }
+
+                larger_buf[ori_len + extra_len] = '\0';
+                polarssl_printf( " %u bytes read (%u + %u)\n\n%s\n",
+                        ori_len + extra_len, ori_len, extra_len,
+                        (char *) larger_buf );
+
+                /* End of message should be detected according to the syntax of the
+                 * application protocol (eg HTTP), just use a dummy test here. */
+                if( larger_buf[ori_len + extra_len - 1] == '\n' )
+                    terminated = 1;
+
+                polarssl_free( larger_buf );
+            }
+
+            if( terminated )
+            {
+                ret = 0;
+                break;
+            }
+        }
+        while( 1 );
+    }
+    else /* Not stream, so datagram */
+    {
         len = sizeof( buf ) - 1;
         memset( buf, 0, sizeof( buf ) );
-        ret = ssl_read( &ssl, buf, len );
 
-        if( ret == POLARSSL_ERR_NET_WANT_READ ||
-            ret == POLARSSL_ERR_NET_WANT_WRITE )
-            continue;
+        do ret = ssl_read( &ssl, buf, len );
+        while( ret == POLARSSL_ERR_NET_WANT_READ ||
+               ret == POLARSSL_ERR_NET_WANT_WRITE );
 
         if( ret <= 0 )
         {
@@ -1679,87 +2040,27 @@
             {
                 case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY:
                     polarssl_printf( " connection was closed gracefully\n" );
+                    ret = 0;
                     goto close_notify;
 
-                case 0:
-                case POLARSSL_ERR_NET_CONN_RESET:
-                    polarssl_printf( " connection was reset by peer\n" );
-                    ret = POLARSSL_ERR_NET_CONN_RESET;
-                    goto reset;
-
                 default:
                     polarssl_printf( " ssl_read returned -0x%x\n", -ret );
                     goto reset;
             }
         }
 
-        if( ssl_get_bytes_avail( &ssl ) == 0 )
-        {
-            len = ret;
-            buf[len] = '\0';
-            polarssl_printf( " %d bytes read\n\n%s\n", len, (char *) buf );
-
-            /* End of message should be detected according to the syntax of the
-             * application protocol (eg HTTP), just use a dummy test here. */
-            if( buf[len - 1] == '\n' )
-                terminated = 1;
-        }
-        else
-        {
-            int extra_len, ori_len;
-            unsigned char *larger_buf;
-
-            ori_len = ret;
-            extra_len = ssl_get_bytes_avail( &ssl );
-
-            larger_buf = polarssl_malloc( ori_len + extra_len + 1 );
-            if( larger_buf == NULL )
-            {
-                polarssl_printf( "  ! memory allocation failed\n" );
-                ret = 1;
-                goto reset;
-            }
-
-            memset( larger_buf, 0, ori_len + extra_len );
-            memcpy( larger_buf, buf, ori_len );
-
-            /* This read should never fail and get the whole cached data */
-            ret = ssl_read( &ssl, larger_buf + ori_len, extra_len );
-            if( ret != extra_len ||
-                ssl_get_bytes_avail( &ssl ) != 0 )
-            {
-                polarssl_printf( "  ! ssl_read failed on cached data\n" );
-                ret = 1;
-                goto reset;
-            }
-
-            larger_buf[ori_len + extra_len] = '\0';
-            polarssl_printf( " %u bytes read (%u + %u)\n\n%s\n",
-                    ori_len + extra_len, ori_len, extra_len,
-                    (char *) larger_buf );
-
-            /* End of message should be detected according to the syntax of the
-             * application protocol (eg HTTP), just use a dummy test here. */
-            if( larger_buf[ori_len + extra_len - 1] == '\n' )
-                terminated = 1;
-
-            polarssl_free( larger_buf );
-        }
-
-        if( terminated )
-        {
-            ret = 0;
-            break;
-        }
+        len = ret;
+        buf[len] = '\0';
+        polarssl_printf( " %d bytes read\n\n%s", len, (char *) buf );
+        ret = 0;
     }
-    while( 1 );
 
     /*
      * 7a. Request renegotiation while client is waiting for input from us.
-     * (only if we're going to exhange more data afterwards)
+     * (only on the first exchange, to be able to test retransmission)
      */
 #if defined(POLARSSL_SSL_RENEGOTIATION)
-    if( opt.renegotiate && exchanges_left > 1 )
+    if( opt.renegotiate && exchanges_left == opt.exchanges )
     {
         polarssl_printf( "  . Requestion renegotiation..." );
         fflush( stdout );
@@ -1787,23 +2088,43 @@
     len = sprintf( (char *) buf, HTTP_RESPONSE,
                    ssl_get_ciphersuite( &ssl ) );
 
-    for( written = 0, frags = 0; written < len; written += ret, frags++ )
+    if( opt.transport == SSL_TRANSPORT_STREAM )
     {
-        while( ( ret = ssl_write( &ssl, buf + written, len - written ) ) <= 0 )
+        for( written = 0, frags = 0; written < len; written += ret, frags++ )
         {
-            if( ret == POLARSSL_ERR_NET_CONN_RESET )
+            while( ( ret = ssl_write( &ssl, buf + written, len - written ) )
+                           <= 0 )
             {
-                polarssl_printf( " failed\n  ! peer closed the connection\n\n" );
-                goto reset;
-            }
+                if( ret == POLARSSL_ERR_NET_CONN_RESET )
+                {
+                    polarssl_printf( " failed\n  ! peer closed the connection\n\n" );
+                    goto reset;
+                }
 
-            if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE )
-            {
-                polarssl_printf( " failed\n  ! ssl_write returned %d\n\n", ret );
-                goto reset;
+                if( ret != POLARSSL_ERR_NET_WANT_READ &&
+                    ret != POLARSSL_ERR_NET_WANT_WRITE )
+                {
+                    polarssl_printf( " failed\n  ! ssl_write returned %d\n\n", ret );
+                    goto reset;
+                }
             }
         }
     }
+    else /* Not stream, so datagram */
+    {
+        do ret = ssl_write( &ssl, buf, len );
+        while( ret == POLARSSL_ERR_NET_WANT_READ ||
+               ret == POLARSSL_ERR_NET_WANT_WRITE );
+
+        if( ret < 0 )
+        {
+            polarssl_printf( " failed\n  ! ssl_write returned %d\n\n", ret );
+            goto reset;
+        }
+
+        frags = 1;
+        written = ret;
+    }
 
     buf[written] = '\0';
     polarssl_printf( " %d bytes written in %d fragments\n\n%s\n", written, frags, (char *) buf );
@@ -1876,6 +2197,9 @@
 #if defined(POLARSSL_SSL_CACHE_C)
     ssl_cache_free( &cache );
 #endif
+#if defined(POLARSSL_SSL_COOKIE_C)
+    ssl_cookie_free( &cookie_ctx );
+#endif
 
 #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C)
 #if defined(POLARSSL_MEMORY_DEBUG)
diff --git a/programs/test/CMakeLists.txt b/programs/test/CMakeLists.txt
index da3376e..d0116c5 100644
--- a/programs/test/CMakeLists.txt
+++ b/programs/test/CMakeLists.txt
@@ -1,5 +1,3 @@
-FIND_PACKAGE(OpenSSL)
-
 set(libs
      mbedtls
 )
@@ -18,23 +16,12 @@
 add_executable(benchmark benchmark.c)
 target_link_libraries(benchmark ${libs})
 
-add_executable(ssl_test ssl_test.c)
-target_link_libraries(ssl_test ${libs})
-
 add_executable(ssl_cert_test ssl_cert_test.c)
 target_link_libraries(ssl_cert_test ${libs})
 
-install(TARGETS selftest benchmark ssl_test ssl_cert_test
+add_executable(udp_proxy udp_proxy.c)
+target_link_libraries(udp_proxy ${libs})
+
+install(TARGETS selftest benchmark ssl_cert_test udp_proxy
         DESTINATION "bin"
         PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
-
-if(OPENSSL_FOUND)
-    add_executable(o_p_test o_p_test.c)
-    include_directories(${OPENSSL_INCLUDE_DIR})
-    target_link_libraries(o_p_test ${libs} ${OPENSSL_LIBRARIES})
-
-    install(TARGETS o_p_test
-        DESTINATION "bin"
-        PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
-endif(OPENSSL_FOUND)
-
diff --git a/programs/test/benchmark.c b/programs/test/benchmark.c
index 1a308be..59239e1 100644
--- a/programs/test/benchmark.c
+++ b/programs/test/benchmark.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_exit       exit
@@ -46,32 +46,32 @@
 
 #include <string.h>
 
-#include "polarssl/timing.h"
+#include "mbedtls/timing.h"
 
-#include "polarssl/md4.h"
-#include "polarssl/md5.h"
-#include "polarssl/ripemd160.h"
-#include "polarssl/sha1.h"
-#include "polarssl/sha256.h"
-#include "polarssl/sha512.h"
-#include "polarssl/arc4.h"
-#include "polarssl/des.h"
-#include "polarssl/aes.h"
-#include "polarssl/blowfish.h"
-#include "polarssl/camellia.h"
-#include "polarssl/gcm.h"
-#include "polarssl/ccm.h"
-#include "polarssl/havege.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/hmac_drbg.h"
-#include "polarssl/rsa.h"
-#include "polarssl/dhm.h"
-#include "polarssl/ecdsa.h"
-#include "polarssl/ecdh.h"
-#include "polarssl/error.h"
+#include "mbedtls/md4.h"
+#include "mbedtls/md5.h"
+#include "mbedtls/ripemd160.h"
+#include "mbedtls/sha1.h"
+#include "mbedtls/sha256.h"
+#include "mbedtls/sha512.h"
+#include "mbedtls/arc4.h"
+#include "mbedtls/des.h"
+#include "mbedtls/aes.h"
+#include "mbedtls/blowfish.h"
+#include "mbedtls/camellia.h"
+#include "mbedtls/gcm.h"
+#include "mbedtls/ccm.h"
+#include "mbedtls/havege.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/hmac_drbg.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/dhm.h"
+#include "mbedtls/ecdsa.h"
+#include "mbedtls/ecdh.h"
+#include "mbedtls/error.h"
 
 #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C)
-#include "polarssl/memory_buffer_alloc.h"
+#include "mbedtls/memory_buffer_alloc.h"
 #endif
 
 #if defined _MSC_VER && !defined snprintf
diff --git a/programs/test/o_p_test.c b/programs/test/o_p_test.c
deleted file mode 100644
index d949d51..0000000
--- a/programs/test/o_p_test.c
+++ /dev/null
@@ -1,278 +0,0 @@
-/*
- *  Test application that shows some mbed TLS and OpenSSL compatibility
- *
- *  Copyright (C) 2011-2012 ARM Limited, All Rights Reserved
- *
- *  This file is part of mbed TLS (https://tls.mbed.org)
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- */
-
-#if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
-#else
-#include POLARSSL_CONFIG_FILE
-#endif
-
-#if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
-#else
-#include <stdio.h>
-#define polarssl_printf     printf
-#endif
-
-#if defined(POLARSSL_BIGNUM_C) && defined(POLARSSL_RSA_C) && \
-    defined(POLARSSL_PK_PARSE_C) && defined(POLARSSL_FS_IO)
-#include <openssl/rsa.h>
-
-#ifndef OPENSSL_NO_ENGINE
-#include <openssl/engine.h>
-#endif
-
-#include <openssl/pem.h>
-#include <openssl/bio.h>
-
-#include "polarssl/pk.h"
-#include "polarssl/x509.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/stat.h>
-#include <unistd.h>
-#endif
-
-#if !defined(POLARSSL_BIGNUM_C) || !defined(POLARSSL_RSA_C) ||         \
-    !defined(POLARSSL_PK_PARSE_C) || !defined(POLARSSL_FS_IO)
-int main( void )
-{
-    polarssl_printf("POLARSSL_BIGNUM_C and/or POLARSSL_RSA_C and/or "
-           "POLARSSL_PK_PARSE_C and/or POLARSSL_FS_IO not defined.\n");
-    return( 0 );
-}
-#else
-int main( int argc, char *argv[] )
-{
-    int ret;
-    FILE *key_file;
-    size_t olen;
-    pk_context p_pk;
-    rsa_context *p_rsa;
-    RSA *o_rsa;
-    entropy_context entropy;
-    ctr_drbg_context ctr_drbg;
-    unsigned char input[1024];
-    unsigned char p_pub_encrypted[512];
-    unsigned char o_pub_encrypted[512];
-    unsigned char p_pub_decrypted[512];
-    unsigned char o_pub_decrypted[512];
-    unsigned char p_priv_encrypted[512];
-    unsigned char o_priv_encrypted[512];
-    unsigned char p_priv_decrypted[512];
-    unsigned char o_priv_decrypted[512];
-    const char *pers = "o_p_test_example";
-
-    entropy_init( &entropy );
-    if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                    (const unsigned char *) pers,
-                    strlen( pers ) ) ) != 0 )
-    {
-        polarssl_printf( " failed\n  ! ctr_drbg_init returned %d\n", ret );
-        goto exit;
-    }
-    ERR_load_crypto_strings();
-
-    ret = 1;
-
-    if( argc != 3 )
-    {
-        polarssl_printf( "usage: o_p_test <keyfile with private_key> <string of max 100 characters>\n" );
-
-#ifdef WIN32
-        polarssl_printf( "\n" );
-#endif
-
-        goto exit;
-    }
-
-    polarssl_printf( "  . Reading private key from %s into mbed TLS ...", argv[1] );
-    fflush( stdout );
-
-    pk_init( &p_pk );
-    if( pk_parse_keyfile( &p_pk, argv[1], NULL ) != 0 )
-    {
-        ret = 1;
-        polarssl_printf( " failed\n  ! Could not load key.\n\n" );
-        goto exit;
-    }
-
-    if( !pk_can_do( &p_pk, POLARSSL_PK_RSA ) )
-    {
-        ret = 1;
-        polarssl_printf( " failed\n  ! Key is not an RSA key\n" );
-        goto exit;
-    }
-
-    p_rsa = pk_rsa( p_pk );
-
-    polarssl_printf( " passed\n");
-
-    polarssl_printf( "  . Reading private key from %s into OpenSSL  ...", argv[1] );
-    fflush( stdout );
-
-    key_file = fopen( argv[1], "r" );
-    o_rsa = PEM_read_RSAPrivateKey(key_file, 0, 0, 0);
-    fclose(key_file);
-    if( o_rsa == NULL )
-    {
-        ret = 1;
-        polarssl_printf( " failed\n  ! Could not load key.\n\n" );
-        goto exit;
-    }
-
-    polarssl_printf( " passed\n");
-    polarssl_printf( "\n" );
-
-    if( strlen( argv[1] ) > 100 )
-    {
-        polarssl_printf( " Input data larger than 100 characters.\n\n" );
-        goto exit;
-    }
-
-    memcpy( input, argv[2], strlen( argv[2] ) );
-
-    /*
-     * Calculate the RSA encryption with public key.
-     */
-    polarssl_printf( "  . Generating the RSA encrypted value with mbed TLS (RSA_PUBLIC)  ..." );
-    fflush( stdout );
-
-    if( ( ret = rsa_pkcs1_encrypt( p_rsa, ctr_drbg_random, &ctr_drbg, RSA_PUBLIC, strlen( argv[2] ), input, p_pub_encrypted ) ) != 0 )
-    {
-        polarssl_printf( " failed\n  ! rsa_pkcs1_encrypt returned %d\n\n", ret );
-        goto exit;
-    }
-    else
-        polarssl_printf( " passed\n");
-
-    polarssl_printf( "  . Generating the RSA encrypted value with OpenSSL (PUBLIC)       ..." );
-    fflush( stdout );
-
-    if( ( ret = RSA_public_encrypt( strlen( argv[2] ), input, o_pub_encrypted, o_rsa, RSA_PKCS1_PADDING ) ) == -1 )
-    {
-        unsigned long code = ERR_get_error();
-        polarssl_printf( " failed\n  ! RSA_public_encrypt returned %d %s\n\n", ret, ERR_error_string( code, NULL ) );
-        goto exit;
-    }
-    else
-        polarssl_printf( " passed\n");
-
-    /*
-     * Calculate the RSA encryption with private key.
-     */
-    polarssl_printf( "  . Generating the RSA encrypted value with mbed TLS (RSA_PRIVATE) ..." );
-    fflush( stdout );
-
-    if( ( ret = rsa_pkcs1_encrypt( p_rsa, ctr_drbg_random, &ctr_drbg, RSA_PRIVATE, strlen( argv[2] ), input, p_priv_encrypted ) ) != 0 )
-    {
-        polarssl_printf( " failed\n  ! rsa_pkcs1_encrypt returned %d\n\n", ret );
-        goto exit;
-    }
-    else
-        polarssl_printf( " passed\n");
-
-    polarssl_printf( "  . Generating the RSA encrypted value with OpenSSL (PRIVATE)      ..." );
-    fflush( stdout );
-
-    if( ( ret = RSA_private_encrypt( strlen( argv[2] ), input, o_priv_encrypted, o_rsa, RSA_PKCS1_PADDING ) ) == -1 )
-    {
-        unsigned long code = ERR_get_error();
-        polarssl_printf( " failed\n  ! RSA_private_encrypt returned %d %s\n\n", ret, ERR_error_string( code, NULL ) );
-        goto exit;
-    }
-    else
-        polarssl_printf( " passed\n");
-
-    polarssl_printf( "\n" );
-
-    /*
-     * Calculate the RSA decryption with private key.
-     */
-    polarssl_printf( "  . Generating the RSA decrypted value for OpenSSL (PUBLIC) with mbed TLS (PRIVATE) ..." );
-    fflush( stdout );
-
-    if( ( ret = rsa_pkcs1_decrypt( p_rsa, ctr_drbg_random, &ctr_drbg, RSA_PRIVATE, &olen, o_pub_encrypted, p_pub_decrypted, 1024 ) ) != 0 )
-    {
-        polarssl_printf( " failed\n  ! rsa_pkcs1_decrypt returned %d\n\n", ret );
-    }
-    else
-        polarssl_printf( " passed\n");
-
-    polarssl_printf( "  . Generating the RSA decrypted value for mbed TLS (PUBLIC) with OpenSSL (PRIVATE) ..." );
-    fflush( stdout );
-
-    if( ( ret = RSA_private_decrypt( p_rsa->len, p_pub_encrypted, o_pub_decrypted, o_rsa, RSA_PKCS1_PADDING ) ) == -1 )
-    {
-        unsigned long code = ERR_get_error();
-        polarssl_printf( " failed\n  ! RSA_private_decrypt returned %d %s\n\n", ret, ERR_error_string( code, NULL ) );
-    }
-    else
-        polarssl_printf( " passed\n");
-
-    /*
-     * Calculate the RSA decryption with public key.
-     */
-    polarssl_printf( "  . Generating the RSA decrypted value for OpenSSL (PRIVATE) with mbed TLS (PUBLIC) ..." );
-    fflush( stdout );
-
-    if( ( ret = rsa_pkcs1_decrypt( p_rsa, NULL, NULL, RSA_PUBLIC, &olen, o_priv_encrypted, p_priv_decrypted, 1024 ) ) != 0 )
-    {
-        polarssl_printf( " failed\n  ! rsa_pkcs1_decrypt returned %d\n\n", ret );
-    }
-    else
-        polarssl_printf( " passed\n");
-
-    polarssl_printf( "  . Generating the RSA decrypted value for mbed TLS (PRIVATE) with OpenSSL (PUBLIC) ..." );
-    fflush( stdout );
-
-    if( ( ret = RSA_public_decrypt( p_rsa->len, p_priv_encrypted, o_priv_decrypted, o_rsa, RSA_PKCS1_PADDING ) ) == -1 )
-    {
-        unsigned long code = ERR_get_error();
-        polarssl_printf( " failed\n  ! RSA_public_decrypt returned %d %s\n\n", ret, ERR_error_string( code, NULL ) );
-    }
-    else
-        polarssl_printf( " passed\n");
-
-    polarssl_printf( "\n" );
-    polarssl_printf( "String value (OpenSSL Public Encrypt, mbed TLS Private Decrypt): '%s'\n", p_pub_decrypted );
-    polarssl_printf( "String value (mbed TLS Public Encrypt, OpenSSL Private Decrypt): '%s'\n", o_pub_decrypted );
-    polarssl_printf( "String value (OpenSSL Private Encrypt, mbed TLS Public Decrypt): '%s'\n", p_priv_decrypted );
-    polarssl_printf( "String value (mbed TLS Private Encrypt, OpenSSL Public Decrypt): '%s'\n", o_priv_decrypted );
-
-exit:
-    ctr_drbg_free( &ctr_drbg );
-    entropy_free( &entropy );
-
-#ifdef WIN32
-    polarssl_printf( "  + Press Enter to exit this program.\n" );
-    fflush( stdout ); getchar();
-#endif
-
-    return( ret );
-}
-#endif /* POLARSSL_BIGNUM_C && POLARSSL_RSA_C &&
-          POLARSSL_PK_PARSE_C && POLARSSL_FS_IO */
diff --git a/programs/test/selftest.c b/programs/test/selftest.c
index 280e3b7..0e1a8be 100644
--- a/programs/test/selftest.c
+++ b/programs/test/selftest.c
@@ -21,50 +21,50 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
-#include "polarssl/entropy.h"
-#include "polarssl/hmac_drbg.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/dhm.h"
-#include "polarssl/gcm.h"
-#include "polarssl/ccm.h"
-#include "polarssl/md2.h"
-#include "polarssl/md4.h"
-#include "polarssl/md5.h"
-#include "polarssl/ripemd160.h"
-#include "polarssl/sha1.h"
-#include "polarssl/sha256.h"
-#include "polarssl/sha512.h"
-#include "polarssl/arc4.h"
-#include "polarssl/des.h"
-#include "polarssl/aes.h"
-#include "polarssl/camellia.h"
-#include "polarssl/base64.h"
-#include "polarssl/bignum.h"
-#include "polarssl/rsa.h"
-#include "polarssl/x509.h"
-#include "polarssl/xtea.h"
-#include "polarssl/pkcs5.h"
-#include "polarssl/pbkdf2.h"
-#include "polarssl/ecp.h"
-#include "polarssl/timing.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/hmac_drbg.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/dhm.h"
+#include "mbedtls/gcm.h"
+#include "mbedtls/ccm.h"
+#include "mbedtls/md2.h"
+#include "mbedtls/md4.h"
+#include "mbedtls/md5.h"
+#include "mbedtls/ripemd160.h"
+#include "mbedtls/sha1.h"
+#include "mbedtls/sha256.h"
+#include "mbedtls/sha512.h"
+#include "mbedtls/arc4.h"
+#include "mbedtls/des.h"
+#include "mbedtls/aes.h"
+#include "mbedtls/camellia.h"
+#include "mbedtls/base64.h"
+#include "mbedtls/bignum.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/x509.h"
+#include "mbedtls/xtea.h"
+#include "mbedtls/pkcs5.h"
+#include "mbedtls/pbkdf2.h"
+#include "mbedtls/ecp.h"
+#include "mbedtls/timing.h"
 
 #include <stdio.h>
 #include <string.h>
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
 #endif
 
 #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C)
-#include "polarssl/memory_buffer_alloc.h"
+#include "mbedtls/memory_buffer_alloc.h"
 #endif
 
 int main( int argc, char *argv[] )
diff --git a/programs/test/ssl_cert_test.c b/programs/test/ssl_cert_test.c
index d823964..d9960d2 100644
--- a/programs/test/ssl_cert_test.c
+++ b/programs/test/ssl_cert_test.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_snprintf   snprintf
@@ -37,8 +37,8 @@
 
 #if defined(POLARSSL_RSA_C) && defined(POLARSSL_X509_CRT_PARSE_C) && \
     defined(POLARSSL_FS_IO) && defined(POLARSSL_X509_CRL_PARSE_C)
-#include "polarssl/certs.h"
-#include "polarssl/x509_crt.h"
+#include "mbedtls/certs.h"
+#include "mbedtls/x509_crt.h"
 
 #include <stdio.h>
 #include <string.h>
diff --git a/programs/test/ssl_test.c b/programs/test/ssl_test.c
deleted file mode 100644
index d8d8196..0000000
--- a/programs/test/ssl_test.c
+++ /dev/null
@@ -1,635 +0,0 @@
-/*
- *  SSL/TLS stress testing program
- *
- *  Copyright (C) 2006-2013, ARM Limited, All Rights Reserved
- *
- *  This file is part of mbed TLS (https://tls.mbed.org)
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- */
-
-#if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
-#else
-#include POLARSSL_CONFIG_FILE
-#endif
-
-#if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
-#else
-#include <stdio.h>
-#define polarssl_free       free
-#define polarssl_malloc     malloc
-#define polarssl_fprintf    fprintf
-#define polarssl_printf     printf
-#endif
-
-#if defined(POLARSSL_BIGNUM_C) && defined(POLARSSL_ENTROPY_C) && \
-    defined(POLARSSL_SSL_TLS_C) && defined(POLARSSL_SSL_SRV_C) && \
-    defined(POLARSSL_SSL_CLI_C) && defined(POLARSSL_NET_C) && \
-    defined(POLARSSL_RSA_C) && defined(POLARSSL_CTR_DRBG_C) && \
-    defined(POLARSSL_X509_CRT_PARSE_C)
-#include "polarssl/net.h"
-#include "polarssl/ssl.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/certs.h"
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#endif
-
-#if defined(POLARSSL_TIMING_C)
-#include "polarssl/timing.h"
-#endif
-
-#define OPMODE_NONE             0
-#define OPMODE_CLIENT           1
-#define OPMODE_SERVER           2
-
-#define IOMODE_BLOCK            0
-#define IOMODE_NONBLOCK         1
-
-#define COMMAND_READ            1
-#define COMMAND_WRITE           2
-#define COMMAND_BOTH            3
-
-#define DFL_OPMODE              OPMODE_NONE
-#define DFL_IOMODE              IOMODE_BLOCK
-#define DFL_SERVER_NAME         "localhost"
-#define DFL_SERVER_PORT         4433
-#define DFL_COMMAND             COMMAND_READ
-#define DFL_BUFFER_SIZE         1024
-#define DFL_MAX_BYTES           0
-#define DFL_DEBUG_LEVEL         0
-#define DFL_CONN_TIMEOUT        0
-#define DFL_MAX_CONNECTIONS     0
-#define DFL_SESSION_REUSE       1
-#define DFL_SESSION_LIFETIME    86400
-#define DFL_FORCE_CIPHER        0
-
-#if !defined(POLARSSL_BIGNUM_C) || !defined(POLARSSL_ENTROPY_C) ||  \
-    !defined(POLARSSL_SSL_TLS_C) || !defined(POLARSSL_SSL_SRV_C) || \
-    !defined(POLARSSL_SSL_CLI_C) || !defined(POLARSSL_NET_C) ||     \
-    !defined(POLARSSL_RSA_C) || !defined(POLARSSL_CTR_DRBG_C) ||    \
-    !defined(POLARSSL_X509_CRT_PARSE_C)
-int main( void )
-{
-    polarssl_printf("POLARSSL_BIGNUM_C and/or POLARSSL_ENTROPY_C and/or "
-           "POLARSSL_SSL_TLS_C and/or POLARSSL_SSL_SRV_C and/or "
-           "POLARSSL_SSL_CLI_C and/or POLARSSL_NET_C and/or "
-           "POLARSSL_RSA_C and/or POLARSSL_CTR_DRBG_C and/or "
-           "POLARSSL_X509_CRT_PARSE_C not defined.\n");
-    return( 0 );
-}
-#else
-int server_fd = -1;
-
-/*
- * global options
- */
-struct options
-{
-    int opmode;                 /* operation mode (client or server)    */
-    int iomode;                 /* I/O mode (blocking or non-blocking)  */
-    const char *server_name;    /* hostname of the server (client only) */
-    int server_port;            /* port on which the ssl service runs   */
-    int command;                /* what to do: read or write operation  */
-    int buffer_size;            /* size of the send/receive buffer      */
-    int max_bytes;              /* max. # of bytes before a reconnect   */
-    int debug_level;            /* level of debugging                   */
-#if defined(POLARSSL_TIMING_C)
-    int conn_timeout;           /* max. delay before a reconnect        */
-#endif
-    int max_connections;        /* max. number of reconnections         */
-    int session_reuse;          /* flag to reuse the keying material    */
-    int session_lifetime;       /* if reached, session data is expired  */
-    int force_ciphersuite[2];   /* protocol/ciphersuite to use, or all  */
-};
-
-/*
- * Although this PRNG has good statistical properties (eg. passes
- * DIEHARD), it is not cryptographically secure.
- */
-static unsigned long int lcppm5( unsigned long int *state )
-{
-    unsigned long int u, v;
-
-    u = v = state[4] ^ 1;
-    state[u & 3] ^= u;
-    u ^= (v << 12) ^ (v >> 12);
-    u ^= v * state[0]; v >>= 8;
-    u ^= v * state[1]; v >>= 8;
-    u ^= v * state[2]; v >>= 8;
-    u ^= v * state[3];
-    u &= 0xFFFFFFFF;
-    state[4] = u;
-
-    return( u );
-}
-
-static void my_debug( void *ctx, int level, const char *str )
-{
-    if( level < ((struct options *) ctx)->debug_level )
-        polarssl_fprintf( stderr, "%s", str );
-}
-
-/*
- * perform a single SSL connection
- */
-static int ssl_test( struct options *opt )
-{
-    int ret = 1, i;
-    int client_fd = -1;
-    int bytes_to_read;
-    int bytes_to_write;
-    int offset_to_read = 0;
-    int offset_to_write = 0;
-
-    long int nb_read;
-    long int nb_written;
-
-    unsigned long read_state[5];
-    unsigned long write_state[5];
-
-    unsigned char *read_buf = NULL;
-    unsigned char *write_buf = NULL;
-
-    const char *pers = "ssl_test";
-
-#if defined(POLARSSL_TIMING_C)
-    struct hr_time t;
-#endif
-    entropy_context entropy;
-    ctr_drbg_context ctr_drbg;
-    ssl_context ssl;
-    x509_crt srvcert;
-    pk_context pkey;
-
-    memset( &ssl, 0, sizeof(ssl_context) );
-    entropy_init( &entropy );
-    x509_crt_init( &srvcert );
-    pk_init( &pkey );
-
-    if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                               (const unsigned char *) pers,
-                               strlen( pers ) ) ) != 0 )
-    {
-        polarssl_printf( "  ! ctr_drbg_init returned %d\n", ret );
-        goto exit;
-    }
-
-#if defined(POLARSSL_TIMING_C)
-    get_timer( &t, 1 );
-#endif
-
-    memset( read_state, 0, sizeof( read_state ) );
-    memset( write_state, 0, sizeof( write_state ) );
-
-
-    if( opt->opmode == OPMODE_CLIENT )
-    {
-        if( ( ret = net_connect( &client_fd, opt->server_name,
-                                             opt->server_port ) ) != 0 )
-        {
-            polarssl_printf( "  ! net_connect returned %d\n\n", ret );
-            return( ret );
-        }
-
-        if( ( ret = ssl_init( &ssl ) ) != 0 )
-        {
-            polarssl_printf( "  ! ssl_init returned %d\n\n", ret );
-            goto exit;
-        }
-
-        ssl_set_endpoint( &ssl, SSL_IS_CLIENT );
-    }
-
-    if( opt->opmode == OPMODE_SERVER )
-    {
-#if !defined(POLARSSL_CERTS_C)
-        polarssl_printf("POLARSSL_CERTS_C not defined.\n");
-        goto exit;
-#else
-        ret =  x509_crt_parse( &srvcert, (const unsigned char *) test_srv_crt,
-                               strlen( test_srv_crt ) );
-        if( ret != 0 )
-        {
-            polarssl_printf( "  !  x509_crt_parse returned %d\n\n", ret );
-            goto exit;
-        }
-
-        ret =  x509_crt_parse( &srvcert, (const unsigned char *) test_ca_list,
-                               strlen( test_ca_list ) );
-        if( ret != 0 )
-        {
-            polarssl_printf( "  !  x509_crt_parse returned %d\n\n", ret );
-            goto exit;
-        }
-
-        ret =  pk_parse_key( &pkey, (const unsigned char *) test_srv_key,
-                             strlen( test_srv_key ), NULL, 0 );
-        if( ret != 0 )
-        {
-            polarssl_printf( "  !  pk_parse_key returned %d\n\n", ret );
-            goto exit;
-        }
-#endif
-
-        if( server_fd < 0 )
-        {
-            if( ( ret = net_bind( &server_fd, NULL,
-                                   opt->server_port ) ) != 0 )
-            {
-                polarssl_printf( "  ! net_bind returned %d\n\n", ret );
-                return( ret );
-            }
-        }
-
-        if( ( ret = net_accept( server_fd, &client_fd, NULL ) ) != 0 )
-        {
-            polarssl_printf( "  ! net_accept returned %d\n\n", ret );
-            return( ret );
-        }
-
-        if( ( ret = ssl_init( &ssl ) ) != 0 )
-        {
-            polarssl_printf( "  ! ssl_init returned %d\n\n", ret );
-            return( ret );
-        }
-
-        ssl_set_endpoint( &ssl, SSL_IS_SERVER );
-        ssl_set_ca_chain( &ssl, srvcert.next, NULL, NULL );
-        if( ( ret = ssl_set_own_cert( &ssl, &srvcert, &pkey ) ) != 0 )
-        {
-            polarssl_printf( " failed\n  ! ssl_set_own_cert returned %d\n\n", ret );
-            goto exit;
-        }
-    }
-
-    ssl_set_authmode( &ssl, SSL_VERIFY_NONE );
-
-    ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg );
-    ssl_set_dbg( &ssl, my_debug, opt );
-    ssl_set_bio( &ssl, net_recv, &client_fd,
-                       net_send, &client_fd );
-
-    if( opt->force_ciphersuite[0] != DFL_FORCE_CIPHER )
-        ssl_set_ciphersuites( &ssl, opt->force_ciphersuite );
-
-    if( opt->iomode == IOMODE_NONBLOCK )
-    {
-        if( ( ret = net_set_nonblock( client_fd ) ) != 0 )
-        {
-            polarssl_printf( "  ! net_set_nonblock returned %d\n\n", ret );
-            return( ret );
-        }
-    }
-
-     read_buf = polarssl_malloc( opt->buffer_size );
-    write_buf = polarssl_malloc( opt->buffer_size );
-
-    if( read_buf == NULL || write_buf == NULL )
-    {
-        polarssl_printf( "  ! polarssl_malloc(%d bytes) failed\n\n", opt->buffer_size );
-        goto exit;
-    }
-
-    nb_read = bytes_to_read = 0;
-    nb_written = bytes_to_write = 0;
-
-    while( 1 )
-    {
-        if( opt->command & COMMAND_WRITE )
-        {
-            if( bytes_to_write == 0 )
-            {
-                while( bytes_to_write == 0 )
-                    bytes_to_write = rand() % opt->buffer_size;
-
-                for( i = 0; i < bytes_to_write; i++ )
-                    write_buf[i] = (unsigned char) lcppm5( write_state );
-
-                offset_to_write = 0;
-            }
-
-            ret = ssl_write( &ssl, write_buf + offset_to_write,
-                             bytes_to_write );
-
-            if( ret >= 0 )
-            {
-                nb_written += ret;
-                bytes_to_write  -= ret;
-                offset_to_write += ret;
-            }
-
-            if( ret == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY ||
-                ret == POLARSSL_ERR_NET_CONN_RESET )
-            {
-                ret = 0;
-                goto exit;
-            }
-
-            if( ret < 0 && ret != POLARSSL_ERR_NET_WANT_READ &&
-                ret != POLARSSL_ERR_NET_WANT_WRITE )
-            {
-                polarssl_printf( "  ! ssl_write returned %d\n\n", ret );
-                break;
-            }
-        }
-
-        if( opt->command & COMMAND_READ )
-        {
-            while( bytes_to_read == 0 )
-            {
-                bytes_to_read = rand() % opt->buffer_size;
-                offset_to_read = 0;
-            }
-
-            ret = ssl_read( &ssl, read_buf + offset_to_read,
-                            bytes_to_read );
-
-            if( ret > 0 )
-            {
-                for( i = 0; i < ret; i++ )
-                {
-                    if( read_buf[offset_to_read + i] !=
-                        (unsigned char) lcppm5( read_state ) )
-                    {
-                        ret = 1;
-                        polarssl_printf( "  ! plaintext mismatch\n\n" );
-                        goto exit;
-                    }
-                }
-
-                nb_read += ret;
-                bytes_to_read -= ret;
-                offset_to_read += ret;
-            }
-
-            if( ret == 0 ||
-                ret == POLARSSL_ERR_SSL_CONN_EOF ||
-                ret == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY ||
-                ret == POLARSSL_ERR_NET_CONN_RESET )
-            {
-                ret = 0;
-                goto exit;
-            }
-
-            if( ret < 0 && ret != POLARSSL_ERR_NET_WANT_READ &&
-                ret != POLARSSL_ERR_NET_WANT_WRITE )
-            {
-                polarssl_printf( "  ! ssl_read returned %d\n\n", ret );
-                break;
-            }
-        }
-
-        ret = 0;
-
-        if( opt->max_bytes != 0 &&
-            ( opt->max_bytes <= nb_read ||
-              opt->max_bytes <= nb_written ) )
-            break;
-
-#if defined(POLARSSL_TIMING_C)
-        if( opt->conn_timeout != 0 &&
-            opt->conn_timeout <= (int) get_timer( &t, 0 ) )
-            break;
-#endif
-    }
-
-exit:
-
-    fflush( stdout );
-
-    if( read_buf != NULL )
-        free( read_buf );
-
-    if( write_buf != NULL )
-        free( write_buf );
-
-    ssl_close_notify( &ssl );
-    x509_crt_free( &srvcert );
-    pk_free( &pkey );
-    ssl_free( &ssl );
-    ctr_drbg_free( &ctr_drbg );
-    entropy_free( &entropy );
-
-    if( client_fd != -1 )
-        net_close( client_fd );
-
-    return( ret );
-}
-
-#if defined(POLARSSL_TIMING_C)
-#define USAGE_TIMING                                             \
-    "    conn_timeout=%%d (ms)        default: 0 (no timeout)\n"
-#else
-#define USAGE_TIMING ""
-#endif
-
-#define USAGE \
-    "\n usage: ssl_test opmode=<> command=<>...\n"               \
-    "\n acceptable parameters:\n"                                \
-    "    opmode=client/server        default: <none>\n"          \
-    "    iomode=block/nonblock       default: block\n"           \
-    "    server_name=%%s              default: localhost\n"      \
-    "    server_port=%%d              default: 4433\n"           \
-    "    command=read/write/both     default: read\n"            \
-    "    buffer_size=%%d (bytes)      default: 1024\n"           \
-    "    max_bytes=%%d (bytes)        default: 0 (no limit)\n"   \
-    "    debug_level=%%d              default: 0 (disabled)\n"   \
-    USAGE_TIMING                                                 \
-    "    max_connections=%%d          default: 0 (no limit)\n"   \
-    "    session_reuse=on/off        default: on (enabled)\n"    \
-    "    session_lifetime=%%d (s)     default: 86400\n"          \
-    "    force_ciphersuite=<name>    default: all enabled\n"     \
-    " acceptable ciphersuite names:\n"
-
-int main( int argc, char *argv[] )
-{
-    int i;
-    const int *list;
-    int ret = 1;
-    int nb_conn;
-    char *p, *q;
-    struct options opt;
-
-    if( argc == 1 )
-    {
-    usage:
-        polarssl_printf( USAGE );
-
-        list = ssl_list_ciphersuites();
-        while( *list )
-        {
-            polarssl_printf("    %s\n", ssl_get_ciphersuite_name( *list ) );
-            list++;
-        }
-        polarssl_printf("\n");
-        goto exit;
-    }
-
-    opt.opmode                  = DFL_OPMODE;
-    opt.iomode                  = DFL_IOMODE;
-    opt.server_name             = DFL_SERVER_NAME;
-    opt.server_port             = DFL_SERVER_PORT;
-    opt.command                 = DFL_COMMAND;
-    opt.buffer_size             = DFL_BUFFER_SIZE;
-    opt.max_bytes               = DFL_MAX_BYTES;
-    opt.debug_level             = DFL_DEBUG_LEVEL;
-#if defined(POLARSSL_TIMING_C)
-    opt.conn_timeout            = DFL_CONN_TIMEOUT;
-#endif
-    opt.max_connections         = DFL_MAX_CONNECTIONS;
-    opt.session_reuse           = DFL_SESSION_REUSE;
-    opt.session_lifetime        = DFL_SESSION_LIFETIME;
-    opt.force_ciphersuite[0]    = DFL_FORCE_CIPHER;
-
-    for( i = 1; i < argc; i++ )
-    {
-        p = argv[i];
-        if( ( q = strchr( p, '=' ) ) == NULL )
-            continue;
-        *q++ = '\0';
-
-        if( strcmp( p, "opmode" ) == 0 )
-        {
-            if( strcmp( q, "client" ) == 0 )
-                opt.opmode = OPMODE_CLIENT;
-            else
-            if( strcmp( q, "server" ) == 0 )
-                opt.opmode = OPMODE_SERVER;
-            else goto usage;
-        }
-
-        if( strcmp( p, "iomode" ) == 0 )
-        {
-            if( strcmp( q, "block" ) == 0 )
-                opt.iomode = IOMODE_BLOCK;
-            else
-            if( strcmp( q, "nonblock" ) == 0 )
-                opt.iomode = IOMODE_NONBLOCK;
-            else goto usage;
-        }
-
-        if( strcmp( p, "server_name" ) == 0 )
-            opt.server_name = q;
-
-        if( strcmp( p, "server_port" ) == 0 )
-        {
-            opt.server_port = atoi( q );
-            if( opt.server_port < 1 || opt.server_port > 65535 )
-                goto usage;
-        }
-
-        if( strcmp( p, "command" ) == 0 )
-        {
-            if( strcmp( q, "read" ) == 0 )
-                opt.command = COMMAND_READ;
-            else
-            if( strcmp( q, "write" ) == 0 )
-                opt.command = COMMAND_WRITE;
-            else
-            if( strcmp( q, "both" ) == 0 )
-            {
-                opt.iomode  = IOMODE_NONBLOCK;
-                opt.command = COMMAND_BOTH;
-            }
-            else goto usage;
-        }
-
-        if( strcmp( p, "buffer_size" ) == 0 )
-        {
-            opt.buffer_size = atoi( q );
-            if( opt.buffer_size < 1 || opt.buffer_size > 1048576 )
-                goto usage;
-        }
-
-        if( strcmp( p, "max_bytes" ) == 0 )
-            opt.max_bytes = atoi( q );
-
-        if( strcmp( p, "debug_level" ) == 0 )
-            opt.debug_level = atoi( q );
-#if defined(POLARSSL_TIMING_C)
-        if( strcmp( p, "conn_timeout" ) == 0 )
-            opt.conn_timeout = atoi( q );
-#endif
-        if( strcmp( p, "max_connections" ) == 0 )
-            opt.max_connections = atoi( q );
-
-        if( strcmp( p, "session_reuse" ) == 0 )
-        {
-            if( strcmp( q, "on" ) == 0 )
-                opt.session_reuse = 1;
-            else
-            if( strcmp( q, "off" ) == 0 )
-                opt.session_reuse = 0;
-            else
-                goto usage;
-        }
-
-        if( strcmp( p, "session_lifetime" ) == 0 )
-            opt.session_lifetime = atoi( q );
-
-        if( strcmp( p, "force_ciphersuite" ) == 0 )
-        {
-            opt.force_ciphersuite[0] = -1;
-
-            opt.force_ciphersuite[0] = ssl_get_ciphersuite_id( q );
-
-            if( opt.force_ciphersuite[0] <= 0 )
-                goto usage;
-
-            opt.force_ciphersuite[1] = 0;
-        }
-    }
-
-    switch( opt.opmode )
-    {
-        case OPMODE_CLIENT:
-            break;
-
-        case OPMODE_SERVER:
-            break;
-
-        default:
-            goto usage;
-    }
-
-    nb_conn = 0;
-
-    do {
-        nb_conn++;
-        ret = ssl_test( &opt );
-        if( opt.max_connections != 0 &&
-            opt.max_connections <= nb_conn )
-            break;
-    }
-    while( ret == 0 );
-
-exit:
-
-#if defined(_WIN32)
-    polarssl_printf( "  Press Enter to exit this program.\n" );
-    fflush( stdout ); getchar();
-#endif
-
-    return( ret );
-}
-#endif /* POLARSSL_BIGNUM_C && POLARSSL_ENTROPY_C && POLARSSL_SSL_TLS_C &&
-          POLARSSL_SSL_SRV_C && POLARSSL_SSL_CLI_C && POLARSSL_NET_C &&
-          POLARSSL_RSA_C && POLARSSL_CTR_DRBG_C */
diff --git a/programs/test/udp_proxy.c b/programs/test/udp_proxy.c
new file mode 100644
index 0000000..f5faa29
--- /dev/null
+++ b/programs/test/udp_proxy.c
@@ -0,0 +1,629 @@
+/*
+ *  UDP proxy: emulate an unreliable UDP connexion for DTLS testing
+ *
+ *  Copyright (C) 2006-2014, Brainspark B.V.
+ *
+ *  This file is part of mbed TLS (https://tls.mbed.org)
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#if !defined(POLARSSL_CONFIG_FILE)
+#include "mbedtls/config.h"
+#else
+#include POLARSSL_CONFIG_FILE
+#endif
+
+#if defined(POLARSSL_PLATFORM_C)
+#include "mbedtls/platform.h"
+#else
+#define polarssl_printf     printf
+#endif
+
+#if !defined(POLARSSL_NET_C)
+#include <stdio.h>
+int main( void )
+{
+    polarssl_printf( "POLARSSL_NET_C not defined.\n" );
+    return( 0 );
+}
+#else
+
+#include "mbedtls/net.h"
+#include "mbedtls/error.h"
+#include "mbedtls/ssl.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+/* For select() */
+#if (defined(_WIN32) || defined(_WIN32_WCE)) && !defined(EFIX64) && \
+    !defined(EFI32)
+#include <winsock2.h>
+#include <windows.h>
+#if defined(_MSC_VER)
+#if defined(_WIN32_WCE)
+#pragma comment( lib, "ws2.lib" )
+#else
+#pragma comment( lib, "ws2_32.lib" )
+#endif
+#endif /* _MSC_VER */
+#else /* ( _WIN32 || _WIN32_WCE ) && !EFIX64 && !EFI32 */
+#include <sys/time.h>
+#include <sys/types.h>
+#include <unistd.h>
+#endif /* ( _WIN32 || _WIN32_WCE ) && !EFIX64 && !EFI32 */
+
+/* For gettimeofday() */
+#if !defined(_WIN32)
+#include <sys/time.h>
+#endif
+
+#define MAX_MSG_SIZE            16384 + 2048 /* max record/datagram size */
+
+#define DFL_SERVER_ADDR         "localhost"
+#define DFL_SERVER_PORT         4433
+#define DFL_LISTEN_ADDR         "localhost"
+#define DFL_LISTEN_PORT         5556
+
+#define USAGE                                                               \
+    "\n usage: udp_proxy param=<>...\n"                                     \
+    "\n acceptable parameters:\n"                                           \
+    "    server_addr=%%s      default: localhost\n"                         \
+    "    server_port=%%d      default: 4433\n"                              \
+    "    listen_addr=%%s      default: localhost\n"                         \
+    "    listen_port=%%d      default: 4433\n"                              \
+    "\n"                                                                    \
+    "    duplicate=%%d        default: 0 (no duplication)\n"                \
+    "                        duplicate about 1:N packets randomly\n"        \
+    "    delay=%%d            default: 0 (no delayed packets)\n"            \
+    "                        delay about 1:N packets randomly\n"            \
+    "    delay_ccs=0/1       default: 0 (don't delay ChangeCipherSpec)\n"   \
+    "    drop=%%d             default: 0 (no dropped packets)\n"            \
+    "                        drop about 1:N packets randomly\n"             \
+    "    mtu=%%d              default: 0 (unlimited)\n"                     \
+    "                        drop packets larger than N bytes\n"            \
+    "    bad_ad=0/1          default: 0 (don't add bad ApplicationData)\n"  \
+    "    protect_hvr=0/1     default: 0 (don't protect HelloVerifyRequest)\n" \
+    "    protect_len=%%d     default: (don't protect packets of this size)\n" \
+    "\n"                                                                    \
+    "    seed=%%d             default: (use current time)\n"                \
+    "\n"
+
+/*
+ * global options
+ */
+static struct options
+{
+    const char *server_addr;    /* address to forward packets to            */
+    int server_port;            /* port to forward packets to               */
+    const char *listen_addr;    /* address for accepting client connections */
+    int listen_port;            /* port for accepting client connections    */
+
+    int duplicate;              /* duplicate 1 in N packets (none if 0)     */
+    int delay;                  /* delay 1 packet in N (none if 0)          */
+    int delay_ccs;              /* delay ChangeCipherSpec                   */
+    int drop;                   /* drop 1 packet in N (none if 0)           */
+    int mtu;                    /* drop packets larger than this            */
+    int bad_ad;                 /* inject corrupted ApplicationData record  */
+    int protect_hvr;            /* never drop or delay HelloVerifyRequest   */
+    int protect_len;            /* never drop/delay packet of the given size*/
+
+    unsigned int seed;          /* seed for "random" events                 */
+} opt;
+
+static void exit_usage( const char *name, const char *value )
+{
+    if( value == NULL )
+        polarssl_printf( " unknown option or missing value: %s\n", name );
+    else
+        polarssl_printf( " option %s: illegal value: %s\n", name, value );
+
+    polarssl_printf( USAGE );
+    exit( 1 );
+}
+
+static void get_options( int argc, char *argv[] )
+{
+    int i;
+    char *p, *q;
+
+    opt.server_addr    = DFL_SERVER_ADDR;
+    opt.server_port    = DFL_SERVER_PORT;
+    opt.listen_addr    = DFL_LISTEN_ADDR;
+    opt.listen_port    = DFL_LISTEN_PORT;
+    /* Other members default to 0 */
+
+    for( i = 1; i < argc; i++ )
+    {
+        p = argv[i];
+        if( ( q = strchr( p, '=' ) ) == NULL )
+            exit_usage( p, NULL );
+        *q++ = '\0';
+
+        if( strcmp( p, "server_addr" ) == 0 )
+            opt.server_addr = q;
+        else if( strcmp( p, "server_port" ) == 0 )
+        {
+            opt.server_port = atoi( q );
+            if( opt.server_port < 1 || opt.server_port > 65535 )
+                exit_usage( p, q );
+        }
+        else if( strcmp( p, "listen_addr" ) == 0 )
+            opt.listen_addr = q;
+        else if( strcmp( p, "listen_port" ) == 0 )
+        {
+            opt.listen_port = atoi( q );
+            if( opt.listen_port < 1 || opt.listen_port > 65535 )
+                exit_usage( p, q );
+        }
+        else if( strcmp( p, "duplicate" ) == 0 )
+        {
+            opt.duplicate = atoi( q );
+            if( opt.duplicate < 0 || opt.duplicate > 20 )
+                exit_usage( p, q );
+        }
+        else if( strcmp( p, "delay" ) == 0 )
+        {
+            opt.delay = atoi( q );
+            if( opt.delay < 0 || opt.delay > 20 || opt.delay == 1 )
+                exit_usage( p, q );
+        }
+        else if( strcmp( p, "delay_ccs" ) == 0 )
+        {
+            opt.delay_ccs = atoi( q );
+            if( opt.delay_ccs < 0 || opt.delay_ccs > 1 )
+                exit_usage( p, q );
+        }
+        else if( strcmp( p, "drop" ) == 0 )
+        {
+            opt.drop = atoi( q );
+            if( opt.drop < 0 || opt.drop > 20 || opt.drop == 1 )
+                exit_usage( p, q );
+        }
+        else if( strcmp( p, "mtu" ) == 0 )
+        {
+            opt.mtu = atoi( q );
+            if( opt.mtu < 0 || opt.mtu > MAX_MSG_SIZE )
+                exit_usage( p, q );
+        }
+        else if( strcmp( p, "bad_ad" ) == 0 )
+        {
+            opt.bad_ad = atoi( q );
+            if( opt.bad_ad < 0 || opt.bad_ad > 1 )
+                exit_usage( p, q );
+        }
+        else if( strcmp( p, "protect_hvr" ) == 0 )
+        {
+            opt.protect_hvr = atoi( q );
+            if( opt.protect_hvr < 0 || opt.protect_hvr > 1 )
+                exit_usage( p, q );
+        }
+        else if( strcmp( p, "protect_len" ) == 0 )
+        {
+            opt.protect_len = atoi( q );
+            if( opt.protect_len < 0 )
+                exit_usage( p, q );
+        }
+        else if( strcmp( p, "seed" ) == 0 )
+        {
+            opt.seed = atoi( q );
+            if( opt.seed == 0 )
+                exit_usage( p, q );
+        }
+        else
+            exit_usage( p, NULL );
+    }
+}
+
+static const char *msg_type( unsigned char *msg, size_t len )
+{
+    if( len < 1 )                           return( "Invalid" );
+    switch( msg[0] )
+    {
+        case SSL_MSG_CHANGE_CIPHER_SPEC:    return( "ChangeCipherSpec" );
+        case SSL_MSG_ALERT:                 return( "Alert" );
+        case SSL_MSG_APPLICATION_DATA:      return( "ApplicationData" );
+        case SSL_MSG_HANDSHAKE:             break; /* See below */
+        default:                            return( "Unknown" );
+    }
+
+    if( len < 13 + 12 )                     return( "Invalid handshake" );
+
+    /*
+     * Our handshake message are less than 2^16 bytes long, so they should
+     * have 0 as the first byte of length, frag_offset and frag_length.
+     * Otherwise, assume they are encrypted.
+     */
+    if( msg[14] || msg[19] || msg[22] )     return( "Encrypted handshake" );
+
+    switch( msg[13] )
+    {
+        case SSL_HS_HELLO_REQUEST:          return( "HelloRequest" );
+        case SSL_HS_CLIENT_HELLO:           return( "ClientHello" );
+        case SSL_HS_SERVER_HELLO:           return( "ServerHello" );
+        case SSL_HS_HELLO_VERIFY_REQUEST:   return( "HelloVerifyRequest" );
+        case SSL_HS_NEW_SESSION_TICKET:     return( "NewSessionTicket" );
+        case SSL_HS_CERTIFICATE:            return( "Certificate" );
+        case SSL_HS_SERVER_KEY_EXCHANGE:    return( "ServerKeyExchange" );
+        case SSL_HS_CERTIFICATE_REQUEST:    return( "CertificateRequest" );
+        case SSL_HS_SERVER_HELLO_DONE:      return( "ServerHelloDone" );
+        case SSL_HS_CERTIFICATE_VERIFY:     return( "CertificateVerify" );
+        case SSL_HS_CLIENT_KEY_EXCHANGE:    return( "ClientKeyExchange" );
+        case SSL_HS_FINISHED:               return( "Finished" );
+        default:                            return( "Unknown handshake" );
+    }
+}
+
+/* Return elapsed time in milliseconds since the first call */
+static unsigned long ellapsed_time( void )
+{
+#if defined(_WIN32)
+    return( 0 );
+#else
+    static struct timeval ref = { 0, 0 };
+    struct timeval now;
+
+    if( ref.tv_sec == 0 && ref.tv_usec == 0 )
+    {
+        gettimeofday( &ref, NULL );
+        return( 0 );
+    }
+
+    gettimeofday( &now, NULL );
+    return( 1000 * ( now.tv_sec  - ref.tv_sec )
+                 + ( now.tv_usec - ref.tv_usec ) / 1000 );
+#endif
+}
+
+typedef struct
+{
+    int dst;
+    const char *way;
+    const char *type;
+    unsigned len;
+    unsigned char buf[MAX_MSG_SIZE];
+} packet;
+
+/* Print packet. Outgoing packets come with a reason (forward, dupl, etc.) */
+void print_packet( const packet *p, const char *why )
+{
+    if( why == NULL )
+        polarssl_printf( "  %05lu %s %s (%u bytes)\n",
+                ellapsed_time(), p->way, p->type, p->len );
+    else
+        polarssl_printf( "        %s %s (%u bytes): %s\n",
+                p->way, p->type, p->len, why );
+    fflush( stdout );
+}
+
+int send_packet( const packet *p, const char *why )
+{
+    int ret;
+    int dst = p->dst;
+
+    /* insert corrupted ApplicationData record? */
+    if( opt.bad_ad &&
+        strcmp( p->type, "ApplicationData" ) == 0 )
+    {
+        unsigned char buf[MAX_MSG_SIZE];
+        memcpy( buf, p->buf, p->len );
+        ++buf[p->len - 1];
+
+        print_packet( p, "corrupted" );
+        if( ( ret = net_send( &dst, buf, p->len ) ) <= 0 )
+        {
+            polarssl_printf( "  ! net_send returned %d\n", ret );
+            return( ret );
+        }
+    }
+
+    print_packet( p, why );
+    if( ( ret = net_send( &dst, p->buf, p->len ) ) <= 0 )
+    {
+        polarssl_printf( "  ! net_send returned %d\n", ret );
+        return( ret );
+    }
+
+    /* Don't duplicate Application Data, only handshake covered */
+    if( opt.duplicate != 0 &&
+        strcmp( p->type, "ApplicationData" ) != 0 &&
+        rand() % opt.duplicate == 0 )
+    {
+        print_packet( p, "duplicated" );
+
+        if( ( ret = net_send( &dst, p->buf, p->len ) ) <= 0 )
+        {
+            polarssl_printf( "  ! net_send returned %d\n", ret );
+            return( ret );
+        }
+    }
+
+    return( 0 );
+}
+
+static packet prev;
+
+void clear_pending( void )
+{
+    memset( &prev, 0, sizeof( packet ) );
+}
+
+/*
+ * Avoid dropping or delaying a packet that was already dropped twice: this
+ * only results in uninteresting timeouts. We can't rely on type to identify
+ * packets, since during renegotiation they're all encrypted.  So, rely on
+ * size mod 2048 (which is usually just size).
+ */
+static unsigned char dropped[2048] = { 0 };
+#define DROP_MAX 2
+
+/*
+ * OpenSSL groups packets in a datagram the first time it sends them, but not
+ * when it resends them. Count every record as seen the first time.
+ */
+void update_dropped( const packet *p )
+{
+    size_t id = p->len % sizeof( dropped );
+    const unsigned char *end = p->buf + p->len;
+    const unsigned char *cur = p->buf;
+    size_t len = ( ( cur[11] << 8 ) | cur[12] ) + 13;
+
+    ++dropped[id];
+
+    /* Avoid counting single record twice */
+    if( len == p->len )
+        return;
+
+    while( cur < end )
+    {
+        size_t len = ( ( cur[11] << 8 ) | cur[12] ) + 13;
+
+        id = len % sizeof( dropped );
+        ++dropped[id];
+
+        cur += len;
+    }
+}
+
+int handle_message( const char *way, int dst, int src )
+{
+    int ret;
+    packet cur;
+    size_t id;
+
+    /* receive packet */
+    if( ( ret = net_recv( &src, cur.buf, sizeof( cur.buf ) ) ) <= 0 )
+    {
+        polarssl_printf( "  ! net_recv returned %d\n", ret );
+        return( ret );
+    }
+
+    cur.len  = ret;
+    cur.type = msg_type( cur.buf, cur.len );
+    cur.way  = way;
+    cur.dst  = dst;
+    print_packet( &cur, NULL );
+
+    id = cur.len % sizeof( dropped );
+
+    /* do we want to drop, delay, or forward it? */
+    if( ( opt.mtu != 0 &&
+          cur.len > (unsigned) opt.mtu ) ||
+        ( opt.drop != 0 &&
+          strcmp( cur.type, "ApplicationData" ) != 0 &&
+          ! ( opt.protect_hvr &&
+              strcmp( cur.type, "HelloVerifyRequest" ) == 0 ) &&
+          cur.len != (size_t) opt.protect_len &&
+          dropped[id] < DROP_MAX &&
+          rand() % opt.drop == 0 ) )
+    {
+        update_dropped( &cur );
+    }
+    else if( ( opt.delay_ccs == 1 &&
+               strcmp( cur.type, "ChangeCipherSpec" ) == 0 ) ||
+             ( opt.delay != 0 &&
+               strcmp( cur.type, "ApplicationData" ) != 0 &&
+               ! ( opt.protect_hvr &&
+                   strcmp( cur.type, "HelloVerifyRequest" ) == 0 ) &&
+               prev.dst == 0 &&
+               cur.len != (size_t) opt.protect_len &&
+               dropped[id] < DROP_MAX &&
+               rand() % opt.delay == 0 ) )
+    {
+        memcpy( &prev, &cur, sizeof( packet ) );
+    }
+    else
+    {
+        /* forward and possibly duplicate */
+        if( ( ret = send_packet( &cur, "forwarded" ) ) != 0 )
+            return( ret );
+
+        /* send previously delayed message if any */
+        if( prev.dst != 0 )
+        {
+            ret = send_packet( &prev, "delayed" );
+            memset( &prev, 0, sizeof( packet ) );
+            if( ret != 0 )
+                return( ret );
+        }
+    }
+
+    return( 0 );
+}
+
+int main( int argc, char *argv[] )
+{
+    int ret;
+
+    int listen_fd = -1;
+    int client_fd = -1;
+    int server_fd = -1;
+
+    int nb_fds;
+    fd_set read_fds;
+
+    get_options( argc, argv );
+
+    /*
+     * Decisions to drop/delay/duplicate packets are pseudo-random: dropping
+     * exactly 1 in N packets would lead to problems when a flight has exactly
+     * N packets: the same packet would be dropped on every resend.
+     *
+     * In order to be able to reproduce problems reliably, the seed may be
+     * specified explicitly.
+     */
+    if( opt.seed == 0 )
+    {
+        opt.seed = time( NULL );
+        polarssl_printf( "  . Pseudo-random seed: %u\n", opt.seed );
+    }
+
+    srand( opt.seed );
+
+    /*
+     * 0. "Connect" to the server
+     */
+    polarssl_printf( "  . Connect to server on UDP/%s/%d ...",
+            opt.server_addr, opt.server_port );
+    fflush( stdout );
+
+    if( ( ret = net_connect( &server_fd, opt.server_addr, opt.server_port,
+                             NET_PROTO_UDP ) ) != 0 )
+    {
+        polarssl_printf( " failed\n  ! net_connect returned %d\n\n", ret );
+        goto exit;
+    }
+
+    polarssl_printf( " ok\n" );
+
+    /*
+     * 1. Setup the "listening" UDP socket
+     */
+    polarssl_printf( "  . Bind on UDP/%s/%d ...",
+            opt.listen_addr, opt.listen_port );
+    fflush( stdout );
+
+    if( ( ret = net_bind( &listen_fd, opt.listen_addr, opt.listen_port,
+                          NET_PROTO_UDP ) ) != 0 )
+    {
+        polarssl_printf( " failed\n  ! net_bind returned %d\n\n", ret );
+        goto exit;
+    }
+
+    polarssl_printf( " ok\n" );
+
+    /*
+     * 2. Wait until a client connects
+     */
+accept:
+    polarssl_printf( "  . Waiting for a remote connection ..." );
+    fflush( stdout );
+
+    if( ( ret = net_accept( listen_fd, &client_fd, NULL ) ) != 0 )
+    {
+        polarssl_printf( " failed\n  ! net_accept returned %d\n\n", ret );
+        goto exit;
+    }
+
+    polarssl_printf( " ok\n" );
+    fflush( stdout );
+
+    polarssl_printf( "  . Re-bind on UDP/%s/%d ...",
+            opt.listen_addr, opt.listen_port );
+    fflush( stdout );
+
+    if( ( ret = net_bind( &listen_fd, opt.listen_addr, opt.listen_port,
+                          NET_PROTO_UDP ) ) != 0 )
+    {
+        polarssl_printf( " failed\n  ! net_bind returned %d\n\n", ret );
+        goto exit;
+    }
+
+    polarssl_printf( " ok\n" );
+
+    /*
+     * 3. Forward packets forever (kill the process to terminate it)
+     */
+    clear_pending();
+    memset( dropped, 0, sizeof( dropped ) );
+
+    nb_fds = client_fd;
+    if( nb_fds < server_fd )
+        nb_fds = server_fd;
+    if( nb_fds < listen_fd )
+        nb_fds = listen_fd;
+    ++nb_fds;
+
+    while( 1 )
+    {
+        FD_ZERO( &read_fds );
+        FD_SET( server_fd, &read_fds );
+        FD_SET( client_fd, &read_fds );
+        FD_SET( listen_fd, &read_fds );
+
+        if( ( ret = select( nb_fds, &read_fds, NULL, NULL, NULL ) ) <= 0 )
+        {
+            perror( "select" );
+            goto exit;
+        }
+
+        if( FD_ISSET( listen_fd, &read_fds ) )
+            goto accept;
+
+        if( FD_ISSET( client_fd, &read_fds ) )
+        {
+            if( ( ret = handle_message( "S <- C",
+                                        server_fd, client_fd ) ) != 0 )
+                goto accept;
+        }
+
+        if( FD_ISSET( server_fd, &read_fds ) )
+        {
+            if( ( ret = handle_message( "S -> C",
+                                        client_fd, server_fd ) ) != 0 )
+                goto accept;
+        }
+    }
+
+exit:
+
+#ifdef POLARSSL_ERROR_C
+    if( ret != 0 )
+    {
+        char error_buf[100];
+        polarssl_strerror( ret, error_buf, 100 );
+        polarssl_printf( "Last error was: -0x%04X - %s\n\n", - ret, error_buf );
+        fflush( stdout );
+    }
+#endif
+
+    if( client_fd != -1 )
+        net_close( client_fd );
+
+    if( listen_fd != -1 )
+        net_close( listen_fd );
+
+#if defined(_WIN32)
+    polarssl_printf( "  Press Enter to exit this program.\n" );
+    fflush( stdout ); getchar();
+#endif
+
+    return( ret != 0 );
+}
+
+#endif /* POLARSSL_NET_C */
diff --git a/programs/util/pem2der.c b/programs/util/pem2der.c
index 8ef3e4b..857cbb6 100644
--- a/programs/util/pem2der.c
+++ b/programs/util/pem2der.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_free       free
@@ -36,8 +36,8 @@
 #endif
 
 #if defined(POLARSSL_BASE64_C) && defined(POLARSSL_FS_IO)
-#include "polarssl/error.h"
-#include "polarssl/base64.h"
+#include "mbedtls/error.h"
+#include "mbedtls/base64.h"
 
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/programs/util/strerror.c b/programs/util/strerror.c
index 715bd3f..9145e74 100644
--- a/programs/util/strerror.c
+++ b/programs/util/strerror.c
@@ -21,20 +21,20 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
 #endif
 
 #if defined(POLARSSL_ERROR_C) || defined(POLARSSL_ERROR_STRERROR_DUMMY)
-#include "polarssl/error.h"
+#include "mbedtls/error.h"
 
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/programs/x509/cert_app.c b/programs/x509/cert_app.c
index 139a9a2..9d8588c 100644
--- a/programs/x509/cert_app.c
+++ b/programs/x509/cert_app.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_fprintf    fprintf
@@ -39,11 +39,11 @@
     defined(POLARSSL_NET_C) && defined(POLARSSL_RSA_C) && \
     defined(POLARSSL_X509_CRT_PARSE_C) && defined(POLARSSL_FS_IO) && \
     defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/net.h"
-#include "polarssl/ssl.h"
-#include "polarssl/x509.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/net.h"
+#include "mbedtls/ssl.h"
+#include "mbedtls/x509.h"
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -412,7 +412,7 @@
         fflush( stdout );
 
         if( ( ret = net_connect( &server_fd, opt.server_name,
-                                             opt.server_port ) ) != 0 )
+                                 opt.server_port, NET_PROTO_TCP ) ) != 0 )
         {
             polarssl_printf( " failed\n  ! net_connect returned %d\n\n", ret );
             goto exit;
diff --git a/programs/x509/cert_req.c b/programs/x509/cert_req.c
index 83766ea..e78f87c 100644
--- a/programs/x509/cert_req.c
+++ b/programs/x509/cert_req.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -36,10 +36,10 @@
 #if defined(POLARSSL_X509_CSR_WRITE_C) && defined(POLARSSL_FS_IO) && \
     defined(POLARSSL_PK_PARSE_C) && \
     defined(POLARSSL_ENTROPY_C) && defined(POLARSSL_CTR_DRBG_C)
-#include "polarssl/x509_csr.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/error.h"
+#include "mbedtls/x509_csr.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/error.h"
 
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/programs/x509/cert_write.c b/programs/x509/cert_write.c
index 5653da2..8436b92 100644
--- a/programs/x509/cert_write.c
+++ b/programs/x509/cert_write.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -37,11 +37,11 @@
     defined(POLARSSL_X509_CRT_PARSE_C) && defined(POLARSSL_FS_IO) && \
     defined(POLARSSL_ENTROPY_C) && defined(POLARSSL_CTR_DRBG_C) && \
     defined(POLARSSL_ERROR_C)
-#include "polarssl/x509_crt.h"
-#include "polarssl/x509_csr.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
-#include "polarssl/error.h"
+#include "mbedtls/x509_crt.h"
+#include "mbedtls/x509_csr.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/error.h"
 
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/programs/x509/crl_app.c b/programs/x509/crl_app.c
index ff80a3d..64eeb83 100644
--- a/programs/x509/crl_app.c
+++ b/programs/x509/crl_app.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -35,7 +35,7 @@
 
 #if defined(POLARSSL_BIGNUM_C) && defined(POLARSSL_RSA_C) && \
     defined(POLARSSL_X509_CRL_PARSE_C) && defined(POLARSSL_FS_IO)
-#include "polarssl/x509_crl.h"
+#include "mbedtls/x509_crl.h"
 
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/programs/x509/req_app.c b/programs/x509/req_app.c
index 1164fd6..644b8ef 100644
--- a/programs/x509/req_app.c
+++ b/programs/x509/req_app.c
@@ -21,13 +21,13 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
@@ -35,7 +35,7 @@
 
 #if defined(POLARSSL_BIGNUM_C) && defined(POLARSSL_RSA_C) && \
     defined(POLARSSL_X509_CSR_PARSE_C) && defined(POLARSSL_FS_IO)
-#include "polarssl/x509_csr.h"
+#include "mbedtls/x509_csr.h"
 
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/scripts/bump_version.sh b/scripts/bump_version.sh
index 64af2dc..a487982 100755
--- a/scripts/bump_version.sh
+++ b/scripts/bump_version.sh
@@ -60,10 +60,10 @@
   mv tmp library/Makefile
 fi
 
-[ $VERBOSE ] && echo "Bumping VERSION in include/polarssl/version.h"
+[ $VERBOSE ] && echo "Bumping VERSION in include/mbedtls/version.h"
 read MAJOR MINOR PATCH <<<$(IFS="."; echo $VERSION)
 VERSION_NR="$( printf "0x%02X%02X%02X00" $MAJOR $MINOR $PATCH )"
-cat include/polarssl/version.h |                                    \
+cat include/mbedtls/version.h |                                    \
     sed -e "s/_VERSION_MAJOR .\+/_VERSION_MAJOR  $MAJOR/" |    \
     sed -e "s/_VERSION_MINOR .\+/_VERSION_MINOR  $MINOR/" |    \
     sed -e "s/_VERSION_PATCH .\+/_VERSION_PATCH  $PATCH/" |    \
@@ -71,7 +71,7 @@
     sed -e "s/_VERSION_STRING .\+/_VERSION_STRING         \"$VERSION\"/" |    \
     sed -e "s/_VERSION_STRING_FULL .\+/_VERSION_STRING_FULL    \"mbed TLS $VERSION\"/" \
     > tmp
-mv tmp include/polarssl/version.h
+mv tmp include/mbedtls/version.h
 
 [ $VERBOSE ] && echo "Bumping version in tests/suites/test_suite_version.data"
 sed -e "s/version:\".\+/version:\"$VERSION\"/g" < tests/suites/test_suite_version.data > tmp
diff --git a/scripts/check_doxy_blocks.pl b/scripts/check_doxy_blocks.pl
index 2601d88..e62d4da 100755
--- a/scripts/check_doxy_blocks.pl
+++ b/scripts/check_doxy_blocks.pl
@@ -13,7 +13,7 @@
 use File::Basename;
 
 # header files in the following directories will be checked
-my @directories = qw(include/polarssl library doxygen/input);
+my @directories = qw(include/mbedtls library doxygen/input);
 
 # very naive pattern to find directives:
 # everything with a backslach except '\0' and backslash at EOL
diff --git a/scripts/config.pl b/scripts/config.pl
index c105a23..ace5459 100755
--- a/scripts/config.pl
+++ b/scripts/config.pl
@@ -36,7 +36,7 @@
 _ALT\s*$
 );
 
-my $config_file = "include/polarssl/config.h";
+my $config_file = "include/mbedtls/config.h";
 
 # get -f option
 if (@ARGV >= 2 && $ARGV[0] eq "-f") {
diff --git a/scripts/data_files/error.fmt b/scripts/data_files/error.fmt
index 7449d85..98799a1 100644
--- a/scripts/data_files/error.fmt
+++ b/scripts/data_files/error.fmt
@@ -21,18 +21,18 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_ERROR_C) || defined(POLARSSL_ERROR_STRERROR_DUMMY)
-#include "polarssl/error.h"
+#include "mbedtls/error.h"
 #include <string.h>
 #endif
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #define polarssl_snprintf snprintf
 #endif
diff --git a/scripts/data_files/version_features.fmt b/scripts/data_files/version_features.fmt
index 500e026..59b70a1 100644
--- a/scripts/data_files/version_features.fmt
+++ b/scripts/data_files/version_features.fmt
@@ -21,14 +21,14 @@
  */
 
 #if !defined(POLARSSL_CONFIG_FILE)
-#include "polarssl/config.h"
+#include "mbedtls/config.h"
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
 
 #if defined(POLARSSL_VERSION_C)
 
-#include "polarssl/version.h"
+#include "mbedtls/version.h"
 
 #include <string.h>
 
diff --git a/scripts/ecc-heap.sh b/scripts/ecc-heap.sh
index 4f88a44..dcec84b 100755
--- a/scripts/ecc-heap.sh
+++ b/scripts/ecc-heap.sh
@@ -9,7 +9,7 @@
 
 set -eu
 
-CONFIG_H='include/polarssl/config.h'
+CONFIG_H='include/mbedtls/config.h'
 
 if [ -r $CONFIG_H ]; then :; else
     echo "$CONFIG_H not found" >&2
diff --git a/scripts/generate_errors.pl b/scripts/generate_errors.pl
index c0d9685..02b2aaf 100755
--- a/scripts/generate_errors.pl
+++ b/scripts/generate_errors.pl
@@ -16,7 +16,7 @@
     -d $include_dir or die "No such directory: $include_dir\n";
     -d $data_dir or die "No such directory: $data_dir\n";
 } else {
-    $include_dir = 'include/polarssl';
+    $include_dir = 'include/mbedtls';
     $data_dir = 'scripts/data_files';
     $error_file = 'library/error.c';
 
@@ -143,7 +143,7 @@
                                                     ($include_name ne "");
         }
         ${$code_check} .= "\n";
-        $headers .= "\n#include \"polarssl/${include_name}.h\"\n".
+        $headers .= "\n#include \"mbedtls/${include_name}.h\"\n".
                     "#endif\n\n" if ($include_name ne "");
         ${$old_define} = $define_name;
     }
diff --git a/scripts/generate_features.pl b/scripts/generate_features.pl
index ee94e35..2aa695c 100755
--- a/scripts/generate_features.pl
+++ b/scripts/generate_features.pl
@@ -12,7 +12,7 @@
     -d $include_dir or die "No such directory: $include_dir\n";
     -d $data_dir or die "No such directory: $data_dir\n";
 } else {
-    $include_dir = 'include/polarssl';
+    $include_dir = 'include/mbedtls';
     $data_dir = 'scripts/data_files';
     $feature_file = 'library/version_features.c';
 
diff --git a/scripts/generate_visualc_files.pl b/scripts/generate_visualc_files.pl
index d6f7104..fd69237 100755
--- a/scripts/generate_visualc_files.pl
+++ b/scripts/generate_visualc_files.pl
@@ -28,7 +28,7 @@
 my $vsx_sln_file = "$vsx_dir/mbedTLS.sln";
 
 my $programs_dir = 'programs';
-my $header_dir = 'include/polarssl';
+my $header_dir = 'include/mbedtls';
 my $source_dir = 'library';
 
 # Need windows line endings!
diff --git a/scripts/memory.sh b/scripts/memory.sh
index eefe102..36626b8 100755
--- a/scripts/memory.sh
+++ b/scripts/memory.sh
@@ -8,7 +8,7 @@
 
 set -eu
 
-CONFIG_H='include/polarssl/config.h'
+CONFIG_H='include/mbedtls/config.h'
 
 CLIENT='mini_client'
 
diff --git a/scripts/polarssl_symlinks.sh b/scripts/polarssl_symlinks.sh
deleted file mode 100755
index a14ff32..0000000
--- a/scripts/polarssl_symlinks.sh
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/bin/sh
-
-# Create libpolarssl.* symlinks in the given directory
-
-if [ $# -ne 1 ]; then
-    echo "Usage: $0 <target-directory>" >&2
-    exit 1
-fi
-
-if [ -d "$1" ]; then :; else
-    echo "$0: target directory must exist" >&2
-    exit 1
-fi
-
-if cd "$1"; then :; else
-    echo "$0: cd '$1' failed" >&2
-    exit 1
-fi
-
-if ls | grep 'libmbedtls\.' >/dev/null; then :; else
-    echo "$0: libmbedtls not found in target directory" >&2
-    exit 1
-fi
-
-for f in libmbedtls.*; do
-    ln -sf $f libpolarssl${f#libmbedtls}
-done
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 68e6707..2cfbc18 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -83,6 +83,7 @@
 add_test_suite(pkparse)
 add_test_suite(pkwrite)
 add_test_suite(shax)
+add_test_suite(ssl)
 add_test_suite(rsa)
 add_test_suite(version)
 add_test_suite(xtea)
diff --git a/tests/Makefile b/tests/Makefile
index f83d186..408e953 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -80,6 +80,7 @@
 	test_suite_pkparse$(EXEXT)	test_suite_pkwrite$(EXEXT)	\
 	test_suite_pk$(EXEXT)						\
 	test_suite_rsa$(EXEXT)		test_suite_shax$(EXEXT)		\
+	test_suite_ssl$(EXEXT)						\
 	test_suite_x509parse$(EXEXT)	test_suite_x509write$(EXEXT)	\
 	test_suite_xtea$(EXEXT)		test_suite_version$(EXEXT)
 
@@ -395,6 +396,10 @@
 	echo   "  CC    	$<"
 	$(CC) $(CFLAGS) $(OFLAGS) $<	$(LDFLAGS) -o $@
 
+test_suite_ssl$(EXEXT): test_suite_ssl.c $(DEP)
+	echo   "  CC    	$<"
+	$(CC) $(CFLAGS) $(OFLAGS) $<	$(LDFLAGS) -o $@
+
 test_suite_x509parse$(EXEXT): test_suite_x509parse.c $(DEP)
 	echo   "  CC    	$<"
 	$(CC) $(CFLAGS) $(OFLAGS) $<	$(LDFLAGS) -o $@
diff --git a/tests/compat.sh b/tests/compat.sh
index 554adef..6186662 100755
--- a/tests/compat.sh
+++ b/tests/compat.sh
@@ -45,7 +45,7 @@
 fi
 
 # default values for options
-MODES="ssl3 tls1 tls1_1 tls1_2"
+MODES="ssl3 tls1 tls1_1 tls1_2 dtls1 dtls1_2"
 VERIFIES="NO YES"
 TYPES="ECDSA RSA PSK"
 FILTER=""
@@ -115,24 +115,71 @@
 
 log() {
   if [ "X" != "X$VERBOSE" ]; then
+    echo ""
     echo "$@"
   fi
 }
 
+# is_dtls <mode>
+is_dtls()
+{
+    test "$1" = "dtls1" -o "$1" = "dtls1_2"
+}
+
+# minor_ver <mode>
+minor_ver()
+{
+    case "$1" in
+        ssl3)
+            echo 0
+            ;;
+        tls1)
+            echo 1
+            ;;
+        tls1_1|dtls1)
+            echo 2
+            ;;
+        tls1_2|dtls1_2)
+            echo 3
+            ;;
+        *)
+            echo "error: invalid mode: $MODE" >&2
+            # exiting is no good here, typically called in a subshell
+            echo -1
+    esac
+}
+
 filter()
 {
   LIST="$1"
   NEW_LIST=""
 
+  if is_dtls "$MODE"; then
+      EXCLMODE="$EXCLUDE"'\|RC4\|ARCFOUR'
+  else
+      EXCLMODE="$EXCLUDE"
+  fi
+
   for i in $LIST;
   do
-    NEW_LIST="$NEW_LIST $( echo "$i" | grep "$FILTER" | grep -v "$EXCLUDE" )"
+    NEW_LIST="$NEW_LIST $( echo "$i" | grep "$FILTER" | grep -v "$EXCLMODE" )"
   done
 
   # normalize whitespace
   echo "$NEW_LIST" | sed -e 's/[[:space:]][[:space:]]*/ /g' -e 's/^ //' -e 's/ $//'
 }
 
+# OpenSSL 1.0.1h with -Verify wants a ClientCertificate message even for
+# PSK ciphersuites with DTLS, which is incorrect, so disable them for now
+check_openssl_server_bug()
+{
+    if test "X$VERIFY" = "XYES" && is_dtls "$MODE" && \
+        echo "$1" | grep "^TLS-PSK" >/dev/null;
+    then
+        SKIP_NEXT="YES"
+    fi
+}
+
 filter_ciphersuites()
 {
     if [ "X" != "X$FILTER" -o "X" != "X$EXCLUDE" ];
@@ -141,6 +188,22 @@
         O_CIPHERS=$( filter "$O_CIPHERS" )
         G_CIPHERS=$( filter "$G_CIPHERS" )
     fi
+
+    # OpenSSL 1.0.1h doesn't support DTLS 1.2
+    if [ `minor_ver "$MODE"` -ge 3 ] && is_dtls "$MODE"; then
+        O_CIPHERS=""
+        case "$PEER" in
+            [Oo]pen*)
+                P_CIPHERS=""
+                ;;
+        esac
+    fi
+
+    # For GnuTLS client -> mbed TLS server,
+    # we need to force IPv4 by connecting to 127.0.0.1 but then auth fails
+    if [ "X$VERIFY" = "XYES" ] && is_dtls "$MODE"; then
+        G_CIPHERS=""
+    fi
 }
 
 reset_ciphersuites()
@@ -155,7 +218,7 @@
     case $TYPE in
 
         "ECDSA")
-            if [ "$MODE" != "ssl3" ];
+            if [ `minor_ver "$MODE"` -gt 0 ]
             then
                 P_CIPHERS="$P_CIPHERS                       \
                     TLS-ECDHE-ECDSA-WITH-NULL-SHA           \
@@ -179,7 +242,7 @@
                     ECDHE-ECDSA-AES256-SHA          \
                     "
             fi
-            if [ "$MODE" = "tls1_2" ];
+            if [ `minor_ver "$MODE"` -ge 3 ]
             then
                 P_CIPHERS="$P_CIPHERS                               \
                     TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256         \
@@ -251,7 +314,7 @@
                 NULL-MD5                        \
                 NULL-SHA                        \
                 "
-            if [ "$MODE" != "ssl3" ];
+            if [ `minor_ver "$MODE"` -gt 0 ]
             then
                 P_CIPHERS="$P_CIPHERS                       \
                     TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA      \
@@ -275,7 +338,7 @@
                     ECDHE-RSA-NULL-SHA              \
                     "
             fi
-            if [ "$MODE" = "tls1_2" ];
+            if [ `minor_ver "$MODE"` -ge 3 ]
             then
                 P_CIPHERS="$P_CIPHERS                       \
                     TLS-RSA-WITH-AES-128-CBC-SHA256         \
@@ -351,7 +414,7 @@
     case $TYPE in
 
         "ECDSA")
-            if [ "$MODE" != "ssl3" ];
+            if [ `minor_ver "$MODE"` -gt 0 ]
             then
                 P_CIPHERS="$P_CIPHERS                       \
                     TLS-ECDH-ECDSA-WITH-NULL-SHA            \
@@ -368,7 +431,7 @@
                     ECDH-ECDSA-AES256-SHA           \
                     "
             fi
-            if [ "$MODE" = "tls1_2" ];
+            if [ `minor_ver "$MODE"` -ge 3 ]
             then
                 P_CIPHERS="$P_CIPHERS                               \
                     TLS-ECDH-ECDSA-WITH-AES-128-CBC-SHA256          \
@@ -406,7 +469,7 @@
     case $TYPE in
 
         "ECDSA")
-            if [ "$MODE" = "tls1_2" ];
+            if [ `minor_ver "$MODE"` -ge 3 ]
             then
                 P_CIPHERS="$P_CIPHERS                               \
                     TLS-ECDHE-ECDSA-WITH-CAMELLIA-128-CBC-SHA256    \
@@ -424,7 +487,7 @@
             ;;
 
         "RSA")
-            if [ "$MODE" != "ssl3" ];
+            if [ `minor_ver "$MODE"` -gt 0 ]
             then
                 P_CIPHERS="$P_CIPHERS                           \
                     TLS-RSA-WITH-NULL-SHA256                    \
@@ -433,7 +496,7 @@
                     +RSA:+NULL:+SHA256                          \
                     "
             fi
-            if [ "$MODE" = "tls1_2" ];
+            if [ `minor_ver "$MODE"` -ge 3 ]
             then
                 P_CIPHERS="$P_CIPHERS                           \
                     TLS-ECDHE-RSA-WITH-CAMELLIA-128-CBC-SHA256  \
@@ -479,7 +542,7 @@
                 +DHE-PSK:+AES-256-CBC:+SHA1                     \
                 +DHE-PSK:+ARCFOUR-128:+SHA1                     \
                 "
-            if [ "$MODE" != "ssl3" ];
+            if [ `minor_ver "$MODE"` -gt 0 ]
             then
                 P_CIPHERS="$P_CIPHERS                           \
                     TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA          \
@@ -502,7 +565,7 @@
                     +RSA-PSK:+ARCFOUR-128:+SHA1                 \
                     "
             fi
-            if [ "$MODE" = "tls1_2" ];
+            if [ `minor_ver "$MODE"` -ge 3 ]
             then
                 P_CIPHERS="$P_CIPHERS                           \
                     TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384       \
@@ -590,14 +653,14 @@
     case $TYPE in
 
         "ECDSA")
-            if [ "$MODE" != "ssl3" ];
+            if [ `minor_ver "$MODE"` -gt 0 ]
             then
                 P_CIPHERS="$P_CIPHERS                               \
                     TLS-ECDH-ECDSA-WITH-CAMELLIA-128-CBC-SHA256     \
                     TLS-ECDH-ECDSA-WITH-CAMELLIA-256-CBC-SHA384     \
                     "
             fi
-            if [ "$MODE" = "tls1_2" ];
+            if [ `minor_ver "$MODE"` -ge 3 ]
             then
                 P_CIPHERS="$P_CIPHERS                               \
                     TLS-ECDH-ECDSA-WITH-CAMELLIA-128-GCM-SHA256     \
@@ -632,7 +695,7 @@
                 TLS-PSK-WITH-NULL-SHA                    \
                 TLS-DHE-PSK-WITH-NULL-SHA                \
                 "
-            if [ "$MODE" != "ssl3" ];
+            if [ `minor_ver "$MODE"` -gt 0 ]
             then
                 P_CIPHERS="$P_CIPHERS                    \
                     TLS-ECDHE-PSK-WITH-NULL-SHA          \
@@ -658,7 +721,8 @@
 
 setup_arguments()
 {
-    case $MODE in
+    G_MODE=""
+    case "$MODE" in
         "ssl3")
             G_PRIO_MODE="+VERS-SSL3.0"
             ;;
@@ -671,19 +735,34 @@
         "tls1_2")
             G_PRIO_MODE="+VERS-TLS1.2"
             ;;
+        "dtls1")
+            G_PRIO_MODE="+VERS-DTLS1.0"
+            G_MODE="-u"
+            ;;
+        "dtls1_2")
+            G_PRIO_MODE="+VERS-DTLS1.2"
+            G_MODE="-u"
+            ;;
         *)
             echo "error: invalid mode: $MODE" >&2
             exit 1;
     esac
 
     P_SERVER_ARGS="server_port=$PORT server_addr=0.0.0.0 force_version=$MODE arc4=1"
-    O_SERVER_ARGS="-accept $PORT -www -cipher NULL,ALL -$MODE"
-    G_SERVER_ARGS="-p $PORT --http"
+    O_SERVER_ARGS="-accept $PORT -cipher NULL,ALL -$MODE"
+    G_SERVER_ARGS="-p $PORT --http $G_MODE"
     G_SERVER_PRIO="EXPORT:+NULL:+MD5:+PSK:+DHE-PSK:+ECDHE-PSK:+RSA-PSK:-VERS-TLS-ALL:$G_PRIO_MODE"
 
-    P_CLIENT_ARGS="server_port=$PORT force_version=$MODE"
+    # with OpenSSL 1.0.1h, -www, -WWW and -HTTP break DTLS handshakes
+    if is_dtls "$MODE"; then
+        O_SERVER_ARGS="$O_SERVER_ARGS"
+    else
+        O_SERVER_ARGS="$O_SERVER_ARGS -www"
+    fi
+
+    P_CLIENT_ARGS="server_port=$PORT server_addr=127.0.0.1 force_version=$MODE"
     O_CLIENT_ARGS="-connect localhost:$PORT -$MODE"
-    G_CLIENT_ARGS="-p $PORT --debug 3"
+    G_CLIENT_ARGS="-p $PORT --debug 3 $G_MODE"
     G_CLIENT_PRIO="NONE:$G_PRIO_MODE:+COMP-NULL:+CURVE-ALL:+SIGN-ALL"
 
     if [ "X$VERIFY" = "XYES" ];
@@ -789,7 +868,8 @@
 
     log "$SERVER_CMD"
     echo "$SERVER_CMD" > $SRV_OUT
-    $SERVER_CMD >> $SRV_OUT 2>&1 &
+    # for servers without -www or equivalent
+    while :; do echo bla; sleep 1; done | $SERVER_CMD >> $SRV_OUT 2>&1 &
     PROCESS_ID=$!
 
     sleep 1
@@ -847,6 +927,14 @@
     LEN=$(( 72 - `echo "$TITLE" | wc -c` ))
     for i in `seq 1 $LEN`; do printf '.'; done; printf ' '
 
+    # should we skip?
+    if [ "X$SKIP_NEXT" = "XYES" ]; then
+        SKIP_NEXT="NO"
+        echo "SKIP"
+        SKIPPED=$(( $SKIPPED + 1 ))
+        return
+    fi
+
     # run the command and interpret result
     case $1 in
         [Oo]pen*)
@@ -868,7 +956,13 @@
             ;;
 
         [Gg]nu*)
-            CLIENT_CMD="$GNUTLS_CLI $G_CLIENT_ARGS --priority $G_PRIO_MODE:$2 localhost"
+            # need to force IPv4 with UDP, but keep localhost for auth
+            if is_dtls "$MODE"; then
+                G_HOST="127.0.0.1"
+            else
+                G_HOST="localhost"
+            fi
+            CLIENT_CMD="$GNUTLS_CLI $G_CLIENT_ARGS --priority $G_PRIO_MODE:$2 $G_HOST"
             log "$CLIENT_CMD"
             echo "$CLIENT_CMD" > $CLI_OUT
             ( echo -e 'GET HTTP/1.0'; echo; ) | $CLIENT_CMD >> $CLI_OUT 2>&1 &
@@ -1013,6 +1107,8 @@
     DOG_DELAY=10
 fi
 
+SKIP_NEXT="NO"
+
 trap cleanup INT TERM HUP
 
 for VERIFY in $VERIFIES; do
@@ -1034,6 +1130,7 @@
                     if [ "X" != "X$P_CIPHERS" ]; then
                         start_server "OpenSSL"
                         for i in $P_CIPHERS; do
+                            check_openssl_server_bug $i
                             run_client mbedTLS $i
                         done
                         stop_server
diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh
index 83e3caf..47abfb9 100755
--- a/tests/scripts/all.sh
+++ b/tests/scripts/all.sh
@@ -17,7 +17,7 @@
     exit 1
 fi
 
-CONFIG_H='include/polarssl/config.h'
+CONFIG_H='include/mbedtls/config.h'
 CONFIG_BAK="$CONFIG_H.bak"
 
 MEMORY=0
@@ -42,7 +42,7 @@
     make clean
 
     find . -iname '*cmake*' -not -name CMakeLists.txt -exec rm -rf {} \+
-    rm -f include/Makefile include/polarssl/Makefile programs/*/Makefile
+    rm -f include/Makefile include/mbedtls/Makefile programs/*/Makefile
     git update-index --no-skip-worktree Makefile library/Makefile programs/Makefile tests/Makefile
     git checkout -- Makefile library/Makefile programs/Makefile tests/Makefile
 
@@ -160,6 +160,12 @@
 scripts/config.pl unset POLARSSL_NET_C
 scripts/config.pl unset POLARSSL_TIMING_C
 scripts/config.pl unset POLARSSL_FS_IO
+scripts/config.pl unset POLARSSL_SSL_PROTO_DTLS # timing.c
+scripts/config.pl unset POLARSSL_SSL_DTLS_ANTI_REPLAY
+scripts/config.pl unset POLARSSL_SSL_DTLS_ANTI_REPLAY
+scripts/config.pl unset POLARSSL_SSL_DTLS_HELLO_VERIFY
+scripts/config.pl unset POLARSSL_SSL_DTLS_BADMAC_LIMIT
+scripts/config.pl unset POLARSSL_SSL_COOKIE_C
 # following things are not in the default config
 scripts/config.pl unset POLARSSL_HAVEGE_C # depends on timing.c
 scripts/config.pl unset POLARSSL_THREADING_PTHREAD
@@ -178,6 +184,12 @@
 scripts/config.pl unset POLARSSL_TIMING_C
 scripts/config.pl unset POLARSSL_FS_IO
 scripts/config.pl unset POLARSSL_HAVE_TIME
+scripts/config.pl unset POLARSSL_SSL_PROTO_DTLS # timing.c
+scripts/config.pl unset POLARSSL_SSL_DTLS_ANTI_REPLAY
+scripts/config.pl unset POLARSSL_SSL_DTLS_ANTI_REPLAY
+scripts/config.pl unset POLARSSL_SSL_DTLS_HELLO_VERIFY
+scripts/config.pl unset POLARSSL_SSL_DTLS_BADMAC_LIMIT
+scripts/config.pl unset POLARSSL_SSL_COOKIE_C
 # following things are not in the default config
 scripts/config.pl unset POLARSSL_HAVEGE_C # depends on timing.c
 scripts/config.pl unset POLARSSL_THREADING_PTHREAD
diff --git a/tests/scripts/curves.pl b/tests/scripts/curves.pl
index 1f489a3..4e338b5 100755
--- a/tests/scripts/curves.pl
+++ b/tests/scripts/curves.pl
@@ -12,7 +12,7 @@
 -d 'library' && -d 'include' && -d 'tests' or die "Must be run from root\n";
 
 my $sed_cmd = 's/^#define \(POLARSSL_ECP_DP.*_ENABLED\)/\1/p';
-my $config_h = 'include/polarssl/config.h';
+my $config_h = 'include/mbedtls/config.h';
 my @curves = split( /\s+/, `sed -n -e '$sed_cmd' $config_h` );
 
 my $test = system( "grep -i cmake Makefile >/dev/null" ) ? 'check' : 'test';
@@ -34,7 +34,7 @@
     system( "scripts/config.pl unset $curve" )
         and abort "Failed to disable $curve\n";
 
-    system( "make polarssl" ) and abort "Failed to build lib: $curve\n";
+    system( "make mbedtls" ) and abort "Failed to build lib: $curve\n";
     system( "cd tests && make" ) and abort "Failed to build tests: $curve\n";
     system( "make $test" ) and abort "Failed test suite: $curve\n";
 
diff --git a/tests/scripts/generate_code.pl b/tests/scripts/generate_code.pl
index ba74738..6d5d005 100755
--- a/tests/scripts/generate_code.pl
+++ b/tests/scripts/generate_code.pl
@@ -60,7 +60,7 @@
 open(TEST_FILE, ">$test_file") or die "Opening destination file '$test_file': $!";
 print TEST_FILE << "END";
 #if !defined(POLARSSL_CONFIG_FILE)
-#include <polarssl/config.h>
+#include <mbedtls/config.h>
 #else
 #include POLARSSL_CONFIG_FILE
 #endif
diff --git a/tests/scripts/test-ref-configs.pl b/tests/scripts/test-ref-configs.pl
index 057b8be..e4fc874 100755
--- a/tests/scripts/test-ref-configs.pl
+++ b/tests/scripts/test-ref-configs.pl
@@ -42,7 +42,7 @@
 
 my $test = system( "grep -i cmake Makefile >/dev/null" ) ? 'check' : 'test';
 
-my $config_h = 'include/polarssl/config.h';
+my $config_h = 'include/mbedtls/config.h';
 
 system( "cp $config_h $config_h.bak" ) and die;
 sub abort {
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 63c0a23..2c0c9ff 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -6,13 +6,14 @@
 # rather specific options (max fragment length, truncated hmac, etc)
 # or procedures (session resumption from cache or ticket, renego, etc).
 #
-# Assumes all options are compiled in.
+# Assumes a build with default options.
 
 set -u
 
 # default values, can be overriden by the environment
 : ${P_SRV:=../programs/ssl/ssl_server2}
 : ${P_CLI:=../programs/ssl/ssl_client2}
+: ${P_PXY:=../programs/test/udp_proxy}
 : ${OPENSSL_CMD:=openssl} # OPENSSL would conflict with the build system
 : ${GNUTLS_CLI:=gnutls-cli}
 : ${GNUTLS_SERV:=gnutls-serv}
@@ -26,7 +27,7 @@
 FAILS=0
 SKIPS=0
 
-CONFIG_H='../include/polarssl/config.h'
+CONFIG_H='../include/mbedtls/config.h'
 
 MEMCHECK=0
 FILTER='.*'
@@ -75,6 +76,7 @@
             OPENSSL_HAS_SSL2="NO"
         fi
     fi
+
     if [ "$OPENSSL_HAS_SSL2" = "NO" ]; then
         SKIP_NEXT="YES"
     fi
@@ -109,6 +111,38 @@
     fi
 }
 
+# skip next test if IPv6 isn't available on this host
+requires_ipv6() {
+    if [ -z "${HAS_IPV6:-}" ]; then
+        $P_SRV server_addr='::1' > $SRV_OUT 2>&1 &
+        SRV_PID=$!
+        sleep 1
+        kill $SRV_PID >/dev/null 2>&1
+        if grep "NET - Binding of the socket failed" $SRV_OUT >/dev/null; then
+            HAS_IPV6="NO"
+        else
+            HAS_IPV6="YES"
+        fi
+        rm -r $SRV_OUT
+    fi
+
+    if [ "$HAS_IPV6" = "NO" ]; then
+        SKIP_NEXT="YES"
+    fi
+}
+
+# skip the next test if valgrind is in use
+not_with_valgrind() {
+    if [ "$MEMCHECK" -gt 0 ]; then
+        SKIP_NEXT="YES"
+    fi
+}
+
+# multiply the client timeout delay by the given factor for the next test
+needs_more_time() {
+    CLI_DELAY_FACTOR=$1
+}
+
 # print_name <name>
 print_name() {
     printf "$1 "
@@ -126,14 +160,23 @@
 
     mv $SRV_OUT o-srv-${TESTS}.log
     mv $CLI_OUT o-cli-${TESTS}.log
-    echo "  ! outputs saved to o-srv-${TESTS}.log and o-cli-${TESTS}.log"
+    if [ -n "$PXY_CMD" ]; then
+        mv $PXY_OUT o-pxy-${TESTS}.log
+    fi
+    echo "  ! outputs saved to o-XXX-${TESTS}.log"
 
     if [ "X${USER:-}" = Xbuildbot -o "X${LOGNAME:-}" = Xbuildbot ]; then
         echo "  ! server output:"
         cat o-srv-${TESTS}.log
-        echo "  ! ============================================================"
+        echo "  ! ========================================================"
         echo "  ! client output:"
         cat o-cli-${TESTS}.log
+        if [ -n "$PXY_CMD" ]; then
+            echo "  ! ========================================================"
+            echo "  ! proxy output:"
+            cat o-pxy-${TESTS}.log
+        fi
+        echo ""
     fi
 
     FAILS=$(( $FAILS + 1 ))
@@ -144,6 +187,28 @@
     echo "$1" | grep 'ssl_server2\|ssl_client2' > /dev/null
 }
 
+# openssl s_server doesn't have -www with DTLS
+check_osrv_dtls() {
+    if echo "$SRV_CMD" | grep 's_server.*-dtls' >/dev/null; then
+        NEEDS_INPUT=1
+        SRV_CMD="$( echo $SRV_CMD | sed s/-www// )"
+    else
+        NEEDS_INPUT=0
+    fi
+}
+
+# provide input to commands that need it
+provide_input() {
+    if [ $NEEDS_INPUT -eq 0 ]; then
+        return
+    fi
+
+    while true; do
+        echo "HTTP/1.0 200 OK"
+        sleep 1
+    done
+}
+
 # has_mem_err <log_file_name>
 has_mem_err() {
     if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" &&
@@ -160,14 +225,19 @@
     if which lsof >/dev/null; then
         # make sure we don't loop forever
         ( sleep "$DOG_DELAY"; echo "SERVERSTART TIMEOUT"; kill $MAIN_PID ) &
-        WATCHDOG_PID=$!
+        DOG_PID=$!
 
         # make a tight loop, server usually takes less than 1 sec to start
-        until lsof -nbi TCP:"$PORT" 2>/dev/null | grep LISTEN >/dev/null; 
-        do :; done
+        if [ "$DTLS" -eq 1 ]; then
+            until lsof -nbi UDP:"$SRV_PORT" 2>/dev/null | grep UDP >/dev/null;
+            do :; done
+        else
+            until lsof -nbi TCP:"$SRV_PORT" 2>/dev/null | grep LISTEN >/dev/null;
+            do :; done
+        fi
 
-        kill $WATCHDOG_PID
-        wait $WATCHDOG_PID
+        kill $DOG_PID >/dev/null 2>&1
+        wait $DOG_PID
     else
         sleep "$START_DELAY"
     fi
@@ -178,32 +248,42 @@
 wait_client_done() {
     CLI_PID=$!
 
-    ( sleep "$DOG_DELAY"; echo "TIMEOUT" >> $CLI_OUT; kill $CLI_PID ) &
-    WATCHDOG_PID=$!
+    CLI_DELAY=$(( $DOG_DELAY * $CLI_DELAY_FACTOR ))
+    CLI_DELAY_FACTOR=1
+
+    ( sleep $CLI_DELAY; echo "TIMEOUT" >> $CLI_OUT; kill $CLI_PID ) &
+    DOG_PID=$!
 
     wait $CLI_PID
     CLI_EXIT=$?
 
-    kill $WATCHDOG_PID
-    wait $WATCHDOG_PID
+    kill $DOG_PID >/dev/null 2>&1
+    wait $DOG_PID
 
     echo "EXIT: $CLI_EXIT" >> $CLI_OUT
 }
 
-# Usage: run_test name srv_cmd cli_cmd cli_exit [option [...]]
+# check if the given command uses dtls and sets global variable DTLS
+detect_dtls() {
+    if echo "$1" | grep 'dtls=1\|-dtls1\|-u' >/dev/null; then
+        DTLS=1
+    else
+        DTLS=0
+    fi
+}
+
+# Usage: run_test name [-p proxy_cmd] srv_cmd cli_cmd cli_exit [option [...]]
 # Options:  -s pattern  pattern that must be present in server output
 #           -c pattern  pattern that must be present in client output
 #           -S pattern  pattern that must be absent in server output
 #           -C pattern  pattern that must be absent in client output
 run_test() {
     NAME="$1"
-    SRV_CMD="$2"
-    CLI_CMD="$3"
-    CLI_EXPECT="$4"
-    shift 4
+    shift 1
 
     if echo "$NAME" | grep "$FILTER" | grep -v "$EXCLUDE" >/dev/null; then :
     else
+        SKIP_NEXT="NO"
         return
     fi
 
@@ -217,6 +297,30 @@
         return
     fi
 
+    # does this test use a proxy?
+    if [ "X$1" = "X-p" ]; then
+        PXY_CMD="$2"
+        shift 2
+    else
+        PXY_CMD=""
+    fi
+
+    # get commands and client output
+    SRV_CMD="$1"
+    CLI_CMD="$2"
+    CLI_EXPECT="$3"
+    shift 3
+
+    # fix client port
+    if [ -n "$PXY_CMD" ]; then
+        CLI_CMD=$( echo "$CLI_CMD" | sed s/+SRV_PORT/$PXY_PORT/g )
+    else
+        CLI_CMD=$( echo "$CLI_CMD" | sed s/+SRV_PORT/$SRV_PORT/g )
+    fi
+
+    # update DTLS variable
+    detect_dtls "$SRV_CMD"
+
     # prepend valgrind to our commands if active
     if [ "$MEMCHECK" -gt 0 ]; then
         if is_polar "$SRV_CMD"; then
@@ -228,8 +332,16 @@
     fi
 
     # run the commands
+    if [ -n "$PXY_CMD" ]; then
+        echo "$PXY_CMD" > $PXY_OUT
+        $PXY_CMD >> $PXY_OUT 2>&1 &
+        PXY_PID=$!
+        # assume proxy starts faster than server
+    fi
+
+    check_osrv_dtls
     echo "$SRV_CMD" > $SRV_OUT
-    $SRV_CMD >> $SRV_OUT 2>&1 &
+    provide_input | $SRV_CMD >> $SRV_OUT 2>&1 &
     SRV_PID=$!
     wait_server_start
 
@@ -237,9 +349,13 @@
     eval "$CLI_CMD" >> $CLI_OUT 2>&1 &
     wait_client_done
 
-    # kill the server
+    # terminate the server (and the proxy)
     kill $SRV_PID
     wait $SRV_PID
+    if [ -n "$PXY_CMD" ]; then
+        kill $PXY_PID >/dev/null 2>&1
+        wait $PXY_PID
+    fi
 
     # check if the client and server went at least to the handshake stage
     # (useful to avoid tests with only negative assertions and non-zero
@@ -270,7 +386,7 @@
     if [ \( "$CLI_EXPECT" = 0 -a "$CLI_EXIT" != 0 \) -o \
          \( "$CLI_EXPECT" != 0 -a "$CLI_EXIT" = 0 \) ]
     then
-        fail "bad client exit code"
+        fail "bad client exit code (expected $CLI_EXPECT, got $CLI_EXIT)"
         return
     fi
 
@@ -328,13 +444,15 @@
 
     # if we're here, everything is ok
     echo "PASS"
-    rm -f $SRV_OUT $CLI_OUT
+    rm -f $SRV_OUT $CLI_OUT $PXY_OUT
 }
 
 cleanup() {
-    rm -f $CLI_OUT $SRV_OUT $SESSION
-    kill $SRV_PID >/dev/null 2>&1
-    kill $WATCHDOG_PID >/dev/null 2>&1
+    rm -f $CLI_OUT $SRV_OUT $PXY_OUT $SESSION
+    test -n "${SRV_PID:-}" && kill $SRV_PID >/dev/null 2>&1
+    test -n "${PXY_PID:-}" && kill $PXY_PID >/dev/null 2>&1
+    test -n "${CLI_PID:-}" && kill $CLI_PID >/dev/null 2>&1
+    test -n "${DOG_PID:-}" && kill $DOG_PID >/dev/null 2>&1
     exit 1
 }
 
@@ -358,6 +476,10 @@
     echo "Command '$P_CLI' is not an executable file"
     exit 1
 fi
+if [ ! -x "$P_PXY" ]; then
+    echo "Command '$P_PXY' is not an executable file"
+    exit 1
+fi
 if which $OPENSSL_CMD >/dev/null 2>&1; then :; else
     echo "Command '$OPENSSL_CMD' not found"
     exit 1
@@ -374,22 +496,29 @@
     START_DELAY=1
     DOG_DELAY=10
 fi
+CLI_DELAY_FACTOR=1
 
-# Pick a "unique" port in the range 10000-19999.
-PORT="0000$$"
-PORT="1$( printf $PORT | tail -c 4 )"
+# Pick a "unique" server port in the range 10000-19999, and a proxy port
+PORT_BASE="0000$$"
+PORT_BASE="$( printf $PORT_BASE | tail -c 4 )"
+SRV_PORT="1$PORT_BASE"
+PXY_PORT="2$PORT_BASE"
+unset PORT_BASE
 
-# fix commands to use this port
-P_SRV="$P_SRV server_port=$PORT"
-P_CLI="$P_CLI server_port=$PORT"
-O_SRV="$O_SRV -accept $PORT"
-O_CLI="$O_CLI -connect localhost:$PORT"
-G_SRV="$G_SRV -p $PORT"
-G_CLI="$G_CLI -p $PORT localhost"
+# fix commands to use this port, force IPv4 while at it
+# +SRV_PORT will be replaced by either $SRV_PORT or $PXY_PORT later
+P_SRV="$P_SRV server_addr=127.0.0.1 server_port=$SRV_PORT"
+P_CLI="$P_CLI server_addr=127.0.0.1 server_port=+SRV_PORT"
+P_PXY="$P_PXY server_addr=127.0.0.1 server_port=$SRV_PORT listen_addr=127.0.0.1 listen_port=$PXY_PORT"
+O_SRV="$O_SRV -accept $SRV_PORT"
+O_CLI="$O_CLI -connect localhost:+SRV_PORT"
+G_SRV="$G_SRV -p $SRV_PORT"
+G_CLI="$G_CLI -p +SRV_PORT localhost"
 
 # Also pick a unique name for intermediate files
 SRV_OUT="srv_out.$$"
 CLI_OUT="cli_out.$$"
+PXY_OUT="pxy_out.$$"
 SESSION="session.$$"
 
 SKIP_NEXT="NO"
@@ -413,6 +542,13 @@
             -S "error" \
             -C "error"
 
+run_test    "Default, DTLS" \
+            "$P_SRV dtls=1" \
+            "$P_CLI dtls=1" \
+            0 \
+            -s "Protocol is DTLSv1.2" \
+            -s "Ciphersuite is TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384"
+
 # Tests for rc4 option
 
 run_test    "RC4: server disabled, client enabled" \
@@ -977,6 +1113,39 @@
             -c "client hello, adding max_fragment_length extension" \
             -c "found max_fragment_length extension"
 
+run_test    "Max fragment length: client, message just fits" \
+            "$P_SRV debug_level=3" \
+            "$P_CLI debug_level=3 max_frag_len=2048 request_size=2048" \
+            0 \
+            -c "client hello, adding max_fragment_length extension" \
+            -s "found max fragment length extension" \
+            -s "server hello, max_fragment_length extension" \
+            -c "found max_fragment_length extension" \
+            -c "2048 bytes written in 1 fragments" \
+            -s "2048 bytes read"
+
+run_test    "Max fragment length: client, larger message" \
+            "$P_SRV debug_level=3" \
+            "$P_CLI debug_level=3 max_frag_len=2048 request_size=2345" \
+            0 \
+            -c "client hello, adding max_fragment_length extension" \
+            -s "found max fragment length extension" \
+            -s "server hello, max_fragment_length extension" \
+            -c "found max_fragment_length extension" \
+            -c "2345 bytes written in 2 fragments" \
+            -s "2048 bytes read" \
+            -s "297 bytes read"
+
+run_test    "Max fragment length: DTLS client, larger message" \
+            "$P_SRV debug_level=3 dtls=1" \
+            "$P_CLI debug_level=3 dtls=1 max_frag_len=2048 request_size=2345" \
+            1 \
+            -c "client hello, adding max_fragment_length extension" \
+            -s "found max fragment length extension" \
+            -s "server hello, max_fragment_length extension" \
+            -c "found max_fragment_length extension" \
+            -c "fragment larger than.*maximum"
+
 # Tests for renegotiation
 
 run_test    "Renegotiation: none, for reference" \
@@ -1217,7 +1386,7 @@
             -s "write hello request"
 
 run_test    "Renegotiation: openssl server, client-initiated" \
-            "$O_SRV" \
+            "$O_SRV -www" \
             "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \
             0 \
             -c "client hello, adding renegotiation extension" \
@@ -1277,6 +1446,45 @@
             -C "error" \
             -c "HTTP/1.0 200 [Oo][Kk]"
 
+run_test    "Renegotiation: DTLS, client-initiated" \
+            "$P_SRV debug_level=3 dtls=1 exchanges=2 renegotiation=1" \
+            "$P_CLI debug_level=3 dtls=1 exchanges=2 renegotiation=1 renegotiate=1" \
+            0 \
+            -c "client hello, adding renegotiation extension" \
+            -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
+            -s "found renegotiation extension" \
+            -s "server hello, secure renegotiation extension" \
+            -c "found renegotiation extension" \
+            -c "=> renegotiate" \
+            -s "=> renegotiate" \
+            -S "write hello request"
+
+run_test    "Renegotiation: DTLS, server-initiated" \
+            "$P_SRV debug_level=3 dtls=1 exchanges=2 renegotiation=1 renegotiate=1" \
+            "$P_CLI debug_level=3 dtls=1 exchanges=2 renegotiation=1 \
+             read_timeout=1000 max_resend=2" \
+            0 \
+            -c "client hello, adding renegotiation extension" \
+            -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
+            -s "found renegotiation extension" \
+            -s "server hello, secure renegotiation extension" \
+            -c "found renegotiation extension" \
+            -c "=> renegotiate" \
+            -s "=> renegotiate" \
+            -s "write hello request"
+
+requires_gnutls
+run_test    "Renegotiation: DTLS, gnutls server, client-initiated" \
+            "$G_SRV -u --mtu 4096" \
+            "$P_CLI debug_level=3 dtls=1 exchanges=1 renegotiation=1 renegotiate=1" \
+            0 \
+            -c "client hello, adding renegotiation extension" \
+            -c "found renegotiation extension" \
+            -c "=> renegotiate" \
+            -C "ssl_handshake returned" \
+            -C "error" \
+            -s "Extra-header:"
+
 # Test for the "secure renegotation" extension only (no actual renegotiation)
 
 requires_gnutls
@@ -1524,43 +1732,39 @@
 # tests for SNI
 
 run_test    "SNI: no SNI callback" \
-            "$P_SRV debug_level=3 server_addr=127.0.0.1 \
+            "$P_SRV debug_level=3 \
              crt_file=data_files/server5.crt key_file=data_files/server5.key" \
-            "$P_CLI debug_level=0 server_addr=127.0.0.1 \
-             server_name=localhost" \
+            "$P_CLI server_name=localhost" \
              0 \
              -S "parse ServerName extension" \
              -c "issuer name *: C=NL, O=PolarSSL, CN=Polarssl Test EC CA" \
              -c "subject name *: C=NL, O=PolarSSL, CN=localhost"
 
 run_test    "SNI: matching cert 1" \
-            "$P_SRV debug_level=3 server_addr=127.0.0.1 \
+            "$P_SRV debug_level=3 \
              crt_file=data_files/server5.crt key_file=data_files/server5.key \
              sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \
-            "$P_CLI debug_level=0 server_addr=127.0.0.1 \
-             server_name=localhost" \
+            "$P_CLI server_name=localhost" \
              0 \
              -s "parse ServerName extension" \
              -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \
              -c "subject name *: C=NL, O=PolarSSL, CN=localhost"
 
 run_test    "SNI: matching cert 2" \
-            "$P_SRV debug_level=3 server_addr=127.0.0.1 \
+            "$P_SRV debug_level=3 \
              crt_file=data_files/server5.crt key_file=data_files/server5.key \
              sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \
-            "$P_CLI debug_level=0 server_addr=127.0.0.1 \
-             server_name=polarssl.example" \
+            "$P_CLI server_name=polarssl.example" \
              0 \
              -s "parse ServerName extension" \
              -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \
              -c "subject name *: C=NL, O=PolarSSL, CN=polarssl.example"
 
 run_test    "SNI: no matching cert" \
-            "$P_SRV debug_level=3 server_addr=127.0.0.1 \
+            "$P_SRV debug_level=3 \
              crt_file=data_files/server5.crt key_file=data_files/server5.key \
              sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \
-            "$P_CLI debug_level=0 server_addr=127.0.0.1 \
-             server_name=nonesuch.example" \
+            "$P_CLI server_name=nonesuch.example" \
              1 \
              -s "parse ServerName extension" \
              -s "ssl_sni_wrapper() returned" \
@@ -2432,6 +2636,492 @@
             0 \
             -s "Read from client: 16384 bytes read"
 
+# Tests for DTLS HelloVerifyRequest
+
+run_test    "DTLS cookie: enabled" \
+            "$P_SRV dtls=1 debug_level=2" \
+            "$P_CLI dtls=1 debug_level=2" \
+            0 \
+            -s "cookie verification failed" \
+            -s "cookie verification passed" \
+            -S "cookie verification skipped" \
+            -c "received hello verify request" \
+            -s "hello verification requested" \
+            -S "SSL - The requested feature is not available"
+
+run_test    "DTLS cookie: disabled" \
+            "$P_SRV dtls=1 debug_level=2 cookies=0" \
+            "$P_CLI dtls=1 debug_level=2" \
+            0 \
+            -S "cookie verification failed" \
+            -S "cookie verification passed" \
+            -s "cookie verification skipped" \
+            -C "received hello verify request" \
+            -S "hello verification requested" \
+            -S "SSL - The requested feature is not available"
+
+run_test    "DTLS cookie: default (failing)" \
+            "$P_SRV dtls=1 debug_level=2 cookies=-1" \
+            "$P_CLI dtls=1 debug_level=2 hs_timeout=100-400" \
+            1 \
+            -s "cookie verification failed" \
+            -S "cookie verification passed" \
+            -S "cookie verification skipped" \
+            -C "received hello verify request" \
+            -S "hello verification requested" \
+            -s "SSL - The requested feature is not available"
+
+requires_ipv6
+run_test    "DTLS cookie: enabled, IPv6" \
+            "$P_SRV dtls=1 debug_level=2 server_addr=::1" \
+            "$P_CLI dtls=1 debug_level=2 server_addr=::1" \
+            0 \
+            -s "cookie verification failed" \
+            -s "cookie verification passed" \
+            -S "cookie verification skipped" \
+            -c "received hello verify request" \
+            -s "hello verification requested" \
+            -S "SSL - The requested feature is not available"
+
+run_test    "DTLS cookie: enabled, nbio" \
+            "$P_SRV dtls=1 nbio=2 debug_level=2" \
+            "$P_CLI dtls=1 nbio=2 debug_level=2" \
+            0 \
+            -s "cookie verification failed" \
+            -s "cookie verification passed" \
+            -S "cookie verification skipped" \
+            -c "received hello verify request" \
+            -s "hello verification requested" \
+            -S "SSL - The requested feature is not available"
+
+# Tests for various cases of client authentication with DTLS
+# (focused on handshake flows and message parsing)
+
+run_test    "DTLS client auth: required" \
+            "$P_SRV dtls=1 auth_mode=required" \
+            "$P_CLI dtls=1" \
+            0 \
+            -s "Verifying peer X.509 certificate... ok"
+
+run_test    "DTLS client auth: optional, client has no cert" \
+            "$P_SRV dtls=1 auth_mode=optional" \
+            "$P_CLI dtls=1 crt_file=none key_file=none" \
+            0 \
+            -s "! no client certificate sent"
+
+run_test    "DTLS client auth: optional, client has no cert" \
+            "$P_SRV dtls=1 auth_mode=none" \
+            "$P_CLI dtls=1 crt_file=none key_file=none debug_level=2" \
+            0 \
+            -c "skip write certificate$" \
+            -s "! no client certificate sent"
+
+# Tests for receiving fragmented handshake messages with DTLS
+
+requires_gnutls
+run_test    "DTLS reassembly: no fragmentation (gnutls server)" \
+            "$G_SRV -u --mtu 2048 -a" \
+            "$P_CLI dtls=1 debug_level=2" \
+            0 \
+            -C "found fragmented DTLS handshake message" \
+            -C "error"
+
+requires_gnutls
+run_test    "DTLS reassembly: some fragmentation (gnutls server)" \
+            "$G_SRV -u --mtu 512" \
+            "$P_CLI dtls=1 debug_level=2" \
+            0 \
+            -c "found fragmented DTLS handshake message" \
+            -C "error"
+
+requires_gnutls
+run_test    "DTLS reassembly: more fragmentation (gnutls server)" \
+            "$G_SRV -u --mtu 128" \
+            "$P_CLI dtls=1 debug_level=2" \
+            0 \
+            -c "found fragmented DTLS handshake message" \
+            -C "error"
+
+requires_gnutls
+run_test    "DTLS reassembly: more fragmentation, nbio (gnutls server)" \
+            "$G_SRV -u --mtu 128" \
+            "$P_CLI dtls=1 nbio=2 debug_level=2" \
+            0 \
+            -c "found fragmented DTLS handshake message" \
+            -C "error"
+
+requires_gnutls
+run_test    "DTLS reassembly: fragmentation, renego (gnutls server)" \
+            "$G_SRV -u --mtu 256" \
+            "$P_CLI debug_level=3 dtls=1 renegotiation=1 renegotiate=1" \
+            0 \
+            -c "found fragmented DTLS handshake message" \
+            -c "client hello, adding renegotiation extension" \
+            -c "found renegotiation extension" \
+            -c "=> renegotiate" \
+            -C "ssl_handshake returned" \
+            -C "error" \
+            -s "Extra-header:"
+
+requires_gnutls
+run_test    "DTLS reassembly: fragmentation, nbio, renego (gnutls server)" \
+            "$G_SRV -u --mtu 256" \
+            "$P_CLI debug_level=3 nbio=2 dtls=1 renegotiation=1 renegotiate=1" \
+            0 \
+            -c "found fragmented DTLS handshake message" \
+            -c "client hello, adding renegotiation extension" \
+            -c "found renegotiation extension" \
+            -c "=> renegotiate" \
+            -C "ssl_handshake returned" \
+            -C "error" \
+            -s "Extra-header:"
+
+run_test    "DTLS reassembly: no fragmentation (openssl server)" \
+            "$O_SRV -dtls1 -mtu 2048" \
+            "$P_CLI dtls=1 debug_level=2" \
+            0 \
+            -C "found fragmented DTLS handshake message" \
+            -C "error"
+
+run_test    "DTLS reassembly: some fragmentation (openssl server)" \
+            "$O_SRV -dtls1 -mtu 768" \
+            "$P_CLI dtls=1 debug_level=2" \
+            0 \
+            -c "found fragmented DTLS handshake message" \
+            -C "error"
+
+run_test    "DTLS reassembly: more fragmentation (openssl server)" \
+            "$O_SRV -dtls1 -mtu 256" \
+            "$P_CLI dtls=1 debug_level=2" \
+            0 \
+            -c "found fragmented DTLS handshake message" \
+            -C "error"
+
+run_test    "DTLS reassembly: fragmentation, nbio (openssl server)" \
+            "$O_SRV -dtls1 -mtu 256" \
+            "$P_CLI dtls=1 nbio=2 debug_level=2" \
+            0 \
+            -c "found fragmented DTLS handshake message" \
+            -C "error"
+
+# Tests for specific things with "unreliable" UDP connection
+
+not_with_valgrind # spurious resend due to timeout
+run_test    "DTLS proxy: reference" \
+            -p "$P_PXY" \
+            "$P_SRV dtls=1 debug_level=2" \
+            "$P_CLI dtls=1 debug_level=2" \
+            0 \
+            -C "replayed record" \
+            -S "replayed record" \
+            -C "record from another epoch" \
+            -S "record from another epoch" \
+            -C "discarding invalid record" \
+            -S "discarding invalid record" \
+            -S "resend" \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+not_with_valgrind # spurious resend due to timeout
+run_test    "DTLS proxy: duplicate every packet" \
+            -p "$P_PXY duplicate=1" \
+            "$P_SRV dtls=1 debug_level=2" \
+            "$P_CLI dtls=1 debug_level=2" \
+            0 \
+            -c "replayed record" \
+            -s "replayed record" \
+            -c "discarding invalid record" \
+            -s "discarding invalid record" \
+            -S "resend" \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+run_test    "DTLS proxy: duplicate every packet, server anti-replay off" \
+            -p "$P_PXY duplicate=1" \
+            "$P_SRV dtls=1 debug_level=2 anti_replay=0" \
+            "$P_CLI dtls=1 debug_level=2" \
+            0 \
+            -c "replayed record" \
+            -S "replayed record" \
+            -c "discarding invalid record" \
+            -s "discarding invalid record" \
+            -c "resend" \
+            -s "resend" \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+run_test    "DTLS proxy: inject invalid AD record, default badmac_limit" \
+            -p "$P_PXY bad_ad=1" \
+            "$P_SRV dtls=1 debug_level=1" \
+            "$P_CLI dtls=1 debug_level=1 read_timeout=100" \
+            0 \
+            -c "discarding invalid record (mac)" \
+            -s "discarding invalid record (mac)" \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK" \
+            -S "too many records with bad MAC" \
+            -S "Verification of the message MAC failed"
+
+run_test    "DTLS proxy: inject invalid AD record, badmac_limit 1" \
+            -p "$P_PXY bad_ad=1" \
+            "$P_SRV dtls=1 debug_level=1 badmac_limit=1" \
+            "$P_CLI dtls=1 debug_level=1 read_timeout=100" \
+            1 \
+            -C "discarding invalid record (mac)" \
+            -S "discarding invalid record (mac)" \
+            -S "Extra-header:" \
+            -C "HTTP/1.0 200 OK" \
+            -s "too many records with bad MAC" \
+            -s "Verification of the message MAC failed"
+
+run_test    "DTLS proxy: inject invalid AD record, badmac_limit 2" \
+            -p "$P_PXY bad_ad=1" \
+            "$P_SRV dtls=1 debug_level=1 badmac_limit=2" \
+            "$P_CLI dtls=1 debug_level=1 read_timeout=100" \
+            0 \
+            -c "discarding invalid record (mac)" \
+            -s "discarding invalid record (mac)" \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK" \
+            -S "too many records with bad MAC" \
+            -S "Verification of the message MAC failed"
+
+run_test    "DTLS proxy: inject invalid AD record, badmac_limit 2, exchanges 2"\
+            -p "$P_PXY bad_ad=1" \
+            "$P_SRV dtls=1 debug_level=1 badmac_limit=2 exchanges=2" \
+            "$P_CLI dtls=1 debug_level=1 read_timeout=100 exchanges=2" \
+            1 \
+            -c "discarding invalid record (mac)" \
+            -s "discarding invalid record (mac)" \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK" \
+            -s "too many records with bad MAC" \
+            -s "Verification of the message MAC failed"
+
+run_test    "DTLS proxy: delay ChangeCipherSpec" \
+            -p "$P_PXY delay_ccs=1" \
+            "$P_SRV dtls=1 debug_level=1" \
+            "$P_CLI dtls=1 debug_level=1" \
+            0 \
+            -c "record from another epoch" \
+            -s "record from another epoch" \
+            -c "discarding invalid record" \
+            -s "discarding invalid record" \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+# Tests for "randomly unreliable connection": try a variety of flows and peers
+
+needs_more_time 2
+run_test    "DTLS proxy: 3d (drop, delay, duplicate), \"short\" PSK handshake" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \
+             psk=abc123" \
+            "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \
+             force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \
+            0 \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+needs_more_time 2
+run_test    "DTLS proxy: 3d, \"short\" RSA handshake" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none" \
+            "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 \
+             force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
+            0 \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+needs_more_time 2
+run_test    "DTLS proxy: 3d, \"short\" (no ticket, no cli_auth) FS handshake" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none" \
+            "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0" \
+            0 \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+needs_more_time 2
+run_test    "DTLS proxy: 3d, FS, client auth" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=required" \
+            "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0" \
+            0 \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+needs_more_time 2
+run_test    "DTLS proxy: 3d, FS, ticket" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$P_SRV dtls=1 hs_timeout=250-10000 tickets=1 auth_mode=none" \
+            "$P_CLI dtls=1 hs_timeout=250-10000 tickets=1" \
+            0 \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+needs_more_time 2
+run_test    "DTLS proxy: 3d, max handshake (FS, ticket + client auth)" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$P_SRV dtls=1 hs_timeout=250-10000 tickets=1 auth_mode=required" \
+            "$P_CLI dtls=1 hs_timeout=250-10000 tickets=1" \
+            0 \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+needs_more_time 2
+run_test    "DTLS proxy: 3d, max handshake, nbio" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$P_SRV dtls=1 hs_timeout=250-10000 nbio=2 tickets=1 \
+             auth_mode=required" \
+            "$P_CLI dtls=1 hs_timeout=250-10000 nbio=2 tickets=1" \
+            0 \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+needs_more_time 4
+run_test    "DTLS proxy: 3d, min handshake, resumption" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \
+             psk=abc123 debug_level=3" \
+            "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \
+             debug_level=3 reconnect=1 read_timeout=1000 max_resend=10 \
+             force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \
+            0 \
+            -s "a session has been resumed" \
+            -c "a session has been resumed" \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+needs_more_time 4
+run_test    "DTLS proxy: 3d, min handshake, resumption, nbio" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \
+             psk=abc123 debug_level=3 nbio=2" \
+            "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \
+             debug_level=3 reconnect=1 read_timeout=1000 max_resend=10 \
+             force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8 nbio=2" \
+            0 \
+            -s "a session has been resumed" \
+            -c "a session has been resumed" \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+needs_more_time 4
+run_test    "DTLS proxy: 3d, min handshake, client-initiated renego" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \
+             psk=abc123 renegotiation=1 debug_level=2" \
+            "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \
+             renegotiate=1 debug_level=2 \
+             force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \
+            0 \
+            -c "=> renegotiate" \
+            -s "=> renegotiate" \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+needs_more_time 4
+run_test    "DTLS proxy: 3d, min handshake, client-initiated renego, nbio" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \
+             psk=abc123 renegotiation=1 debug_level=2" \
+            "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \
+             renegotiate=1 debug_level=2 \
+             force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \
+            0 \
+            -c "=> renegotiate" \
+            -s "=> renegotiate" \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+needs_more_time 4
+run_test    "DTLS proxy: 3d, min handshake, server-initiated renego" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \
+             psk=abc123 renegotiate=1 renegotiation=1 exchanges=4 \
+             debug_level=2" \
+            "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \
+             renegotiation=1 exchanges=4 debug_level=2 \
+             force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \
+            0 \
+            -c "=> renegotiate" \
+            -s "=> renegotiate" \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+needs_more_time 4
+run_test    "DTLS proxy: 3d, min handshake, server-initiated renego, nbio" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \
+             psk=abc123 renegotiate=1 renegotiation=1 exchanges=4 \
+             debug_level=2 nbio=2" \
+            "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \
+             renegotiation=1 exchanges=4 debug_level=2 nbio=2 \
+             force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \
+            0 \
+            -c "=> renegotiate" \
+            -s "=> renegotiate" \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+needs_more_time 6
+run_test    "DTLS proxy: 3d, openssl server" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \
+            "$O_SRV -dtls1 -mtu 2048" \
+            "$P_CLI dtls=1 hs_timeout=250-60000 tickets=0" \
+            0 \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+needs_more_time 6
+run_test    "DTLS proxy: 3d, openssl server, fragmentation" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \
+            "$O_SRV -dtls1 -mtu 768" \
+            "$P_CLI dtls=1 hs_timeout=250-60000 tickets=0" \
+            0 \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+needs_more_time 6
+run_test    "DTLS proxy: 3d, openssl server, fragmentation, nbio" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \
+            "$O_SRV -dtls1 -mtu 768" \
+            "$P_CLI dtls=1 hs_timeout=250-60000 nbio=2 tickets=0" \
+            0 \
+            -s "Extra-header:" \
+            -c "HTTP/1.0 200 OK"
+
+requires_gnutls
+needs_more_time 6
+run_test    "DTLS proxy: 3d, gnutls server" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$G_SRV -u --mtu 2048 -a" \
+            "$P_CLI dtls=1 hs_timeout=250-60000" \
+            0 \
+            -s "Extra-header:" \
+            -c "Extra-header:"
+
+requires_gnutls
+needs_more_time 6
+run_test    "DTLS proxy: 3d, gnutls server, fragmentation" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$G_SRV -u --mtu 512" \
+            "$P_CLI dtls=1 hs_timeout=250-60000" \
+            0 \
+            -s "Extra-header:" \
+            -c "Extra-header:"
+
+requires_gnutls
+needs_more_time 6
+run_test    "DTLS proxy: 3d, gnutls server, fragmentation, nbio" \
+            -p "$P_PXY drop=5 delay=5 duplicate=5" \
+            "$G_SRV -u --mtu 512" \
+            "$P_CLI dtls=1 hs_timeout=250-60000 nbio=2" \
+            0 \
+            -s "Extra-header:" \
+            -c "Extra-header:"
+
 # Final report
 
 echo "------------------------------------------------------------------------"
diff --git a/tests/suites/helpers.function b/tests/suites/helpers.function
index 0f07485..54786af 100644
--- a/tests/suites/helpers.function
+++ b/tests/suites/helpers.function
@@ -1,5 +1,5 @@
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_printf     printf
diff --git a/tests/suites/main_test.function b/tests/suites/main_test.function
index d67d875..5342fb3 100644
--- a/tests/suites/main_test.function
+++ b/tests/suites/main_test.function
@@ -1,7 +1,7 @@
 #include <string.h>
 
 #if defined(POLARSSL_PLATFORM_C)
-#include "polarssl/platform.h"
+#include "mbedtls/platform.h"
 #else
 #include <stdio.h>
 #define polarssl_exit       exit
@@ -12,7 +12,7 @@
 #endif
 
 #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C)
-#include "polarssl/memory_buffer_alloc.h"
+#include "mbedtls/memory_buffer_alloc.h"
 #endif
 
 static int test_errors = 0;
diff --git a/tests/suites/test_suite_aes.function b/tests/suites/test_suite_aes.function
index 7027247..8cc16e5 100644
--- a/tests/suites/test_suite_aes.function
+++ b/tests/suites/test_suite_aes.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/aes.h"
+#include "mbedtls/aes.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_arc4.function b/tests/suites/test_suite_arc4.function
index dc7b24b..6bc5d1f 100644
--- a/tests/suites/test_suite_arc4.function
+++ b/tests/suites/test_suite_arc4.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/arc4.h"
+#include "mbedtls/arc4.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_asn1write.function b/tests/suites/test_suite_asn1write.function
index 49b073a..62a1b99 100644
--- a/tests/suites/test_suite_asn1write.function
+++ b/tests/suites/test_suite_asn1write.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/asn1write.h"
+#include "mbedtls/asn1write.h"
 
 #define GUARD_LEN 4
 #define GUARD_VAL 0x2a
diff --git a/tests/suites/test_suite_base64.function b/tests/suites/test_suite_base64.function
index a8348d2..57c2989 100644
--- a/tests/suites/test_suite_base64.function
+++ b/tests/suites/test_suite_base64.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/base64.h"
+#include "mbedtls/base64.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_blowfish.function b/tests/suites/test_suite_blowfish.function
index b058698..5a2a712 100644
--- a/tests/suites/test_suite_blowfish.function
+++ b/tests/suites/test_suite_blowfish.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/blowfish.h"
+#include "mbedtls/blowfish.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_camellia.function b/tests/suites/test_suite_camellia.function
index e73aa86..ef6a72b 100644
--- a/tests/suites/test_suite_camellia.function
+++ b/tests/suites/test_suite_camellia.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/camellia.h"
+#include "mbedtls/camellia.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_ccm.function b/tests/suites/test_suite_ccm.function
index d8ca4f5..2022fc6 100644
--- a/tests/suites/test_suite_ccm.function
+++ b/tests/suites/test_suite_ccm.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/ccm.h"
+#include "mbedtls/ccm.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_cipher.function b/tests/suites/test_suite_cipher.function
index 448bfcc..471bcef 100644
--- a/tests/suites/test_suite_cipher.function
+++ b/tests/suites/test_suite_cipher.function
@@ -1,8 +1,8 @@
 /* BEGIN_HEADER */
-#include "polarssl/cipher.h"
+#include "mbedtls/cipher.h"
 
 #if defined(POLARSSL_GCM_C)
-#include "polarssl/gcm.h"
+#include "mbedtls/gcm.h"
 #endif
 /* END_HEADER */
 
diff --git a/tests/suites/test_suite_ctr_drbg.function b/tests/suites/test_suite_ctr_drbg.function
index 644eb46..6b3028a 100644
--- a/tests/suites/test_suite_ctr_drbg.function
+++ b/tests/suites/test_suite_ctr_drbg.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/ctr_drbg.h"
+#include "mbedtls/ctr_drbg.h"
 
 int test_offset_idx;
 int entropy_func( void *data, unsigned char *buf, size_t len )
diff --git a/tests/suites/test_suite_debug.function b/tests/suites/test_suite_debug.function
index 7db04e5..a76ba9f 100644
--- a/tests/suites/test_suite_debug.function
+++ b/tests/suites/test_suite_debug.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/debug.h"
+#include "mbedtls/debug.h"
 
 struct buffer_data
 {
diff --git a/tests/suites/test_suite_des.function b/tests/suites/test_suite_des.function
index dfa168f..bb21a58 100644
--- a/tests/suites/test_suite_des.function
+++ b/tests/suites/test_suite_des.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/des.h"
+#include "mbedtls/des.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_dhm.function b/tests/suites/test_suite_dhm.function
index d7cabf4..4e8ad33 100644
--- a/tests/suites/test_suite_dhm.function
+++ b/tests/suites/test_suite_dhm.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/dhm.h"
+#include "mbedtls/dhm.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_ecdh.function b/tests/suites/test_suite_ecdh.function
index 27be969..795b409 100644
--- a/tests/suites/test_suite_ecdh.function
+++ b/tests/suites/test_suite_ecdh.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/ecdh.h"
+#include "mbedtls/ecdh.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_ecdsa.function b/tests/suites/test_suite_ecdsa.function
index ee379dc..98d834a 100644
--- a/tests/suites/test_suite_ecdsa.function
+++ b/tests/suites/test_suite_ecdsa.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/ecdsa.h"
+#include "mbedtls/ecdsa.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_ecp.function b/tests/suites/test_suite_ecp.function
index 696c597..1114920 100644
--- a/tests/suites/test_suite_ecp.function
+++ b/tests/suites/test_suite_ecp.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/ecp.h"
+#include "mbedtls/ecp.h"
 
 #define POLARSSL_ECP_PF_UNKNOWN     -1
 /* END_HEADER */
diff --git a/tests/suites/test_suite_entropy.function b/tests/suites/test_suite_entropy.function
index c46246c..41a115c 100644
--- a/tests/suites/test_suite_entropy.function
+++ b/tests/suites/test_suite_entropy.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/entropy.h"
+#include "mbedtls/entropy.h"
 
 /*
  * Number of calls made to entropy_dummy_source()
diff --git a/tests/suites/test_suite_error.function b/tests/suites/test_suite_error.function
index 87287b7..8ed3b61 100644
--- a/tests/suites/test_suite_error.function
+++ b/tests/suites/test_suite_error.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/error.h"
+#include "mbedtls/error.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_gcm.function b/tests/suites/test_suite_gcm.function
index 2ac7628..a3b112e 100644
--- a/tests/suites/test_suite_gcm.function
+++ b/tests/suites/test_suite_gcm.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/gcm.h"
+#include "mbedtls/gcm.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_hmac_drbg.function b/tests/suites/test_suite_hmac_drbg.function
index 56267e0..2e4e83c 100644
--- a/tests/suites/test_suite_hmac_drbg.function
+++ b/tests/suites/test_suite_hmac_drbg.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/hmac_drbg.h"
+#include "mbedtls/hmac_drbg.h"
 
 typedef struct
 {
diff --git a/tests/suites/test_suite_hmac_shax.function b/tests/suites/test_suite_hmac_shax.function
index b31d772..761c281 100644
--- a/tests/suites/test_suite_hmac_shax.function
+++ b/tests/suites/test_suite_hmac_shax.function
@@ -1,7 +1,7 @@
 /* BEGIN_HEADER */
-#include "polarssl/sha1.h"
-#include "polarssl/sha256.h"
-#include "polarssl/sha512.h"
+#include "mbedtls/sha1.h"
+#include "mbedtls/sha256.h"
+#include "mbedtls/sha512.h"
 /* END_HEADER */
 
 /* BEGIN_CASE depends_on:POLARSSL_SHA1_C */
diff --git a/tests/suites/test_suite_md.function b/tests/suites/test_suite_md.function
index 40eb717..98dac47 100644
--- a/tests/suites/test_suite_md.function
+++ b/tests/suites/test_suite_md.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/md.h"
+#include "mbedtls/md.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_mdx.function b/tests/suites/test_suite_mdx.function
index 6e4c6d8..4615271 100644
--- a/tests/suites/test_suite_mdx.function
+++ b/tests/suites/test_suite_mdx.function
@@ -1,8 +1,8 @@
 /* BEGIN_HEADER */
-#include "polarssl/md2.h"
-#include "polarssl/md4.h"
-#include "polarssl/md5.h"
-#include "polarssl/ripemd160.h"
+#include "mbedtls/md2.h"
+#include "mbedtls/md4.h"
+#include "mbedtls/md5.h"
+#include "mbedtls/ripemd160.h"
 /* END_HEADER */
 
 /* BEGIN_CASE depends_on:POLARSSL_MD2_C */
diff --git a/tests/suites/test_suite_memory_buffer_alloc.function b/tests/suites/test_suite_memory_buffer_alloc.function
index e9cd021..704279c 100644
--- a/tests/suites/test_suite_memory_buffer_alloc.function
+++ b/tests/suites/test_suite_memory_buffer_alloc.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/memory_buffer_alloc.h"
+#include "mbedtls/memory_buffer_alloc.h"
 #define TEST_SUITE_MEMORY_BUFFER_ALLOC
 /* END_HEADER */
 
diff --git a/tests/suites/test_suite_mpi.function b/tests/suites/test_suite_mpi.function
index ce1a072..75c8d30 100644
--- a/tests/suites/test_suite_mpi.function
+++ b/tests/suites/test_suite_mpi.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/bignum.h"
+#include "mbedtls/bignum.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_pbkdf2.function b/tests/suites/test_suite_pbkdf2.function
index f99cb6d..6b8b278 100644
--- a/tests/suites/test_suite_pbkdf2.function
+++ b/tests/suites/test_suite_pbkdf2.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/pbkdf2.h"
+#include "mbedtls/pbkdf2.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_pem.function b/tests/suites/test_suite_pem.function
index f8aab47..9318d1d 100644
--- a/tests/suites/test_suite_pem.function
+++ b/tests/suites/test_suite_pem.function
@@ -1,6 +1,6 @@
 /* BEGIN_HEADER */
-#include "polarssl/base64.h"
-#include "polarssl/pem.h"
+#include "mbedtls/base64.h"
+#include "mbedtls/pem.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_pk.function b/tests/suites/test_suite_pk.function
index cc378c4..bedf75c 100644
--- a/tests/suites/test_suite_pk.function
+++ b/tests/suites/test_suite_pk.function
@@ -1,9 +1,9 @@
 /* BEGIN_HEADER */
-#include "polarssl/pk.h"
+#include "mbedtls/pk.h"
 
 /* For error codes */
-#include "polarssl/ecp.h"
-#include "polarssl/rsa.h"
+#include "mbedtls/ecp.h"
+#include "mbedtls/rsa.h"
 
 static int rnd_std_rand( void *rng_state, unsigned char *output, size_t len );
 
diff --git a/tests/suites/test_suite_pkcs1_v21.function b/tests/suites/test_suite_pkcs1_v21.function
index 6fbe2e1..ab87a70 100644
--- a/tests/suites/test_suite_pkcs1_v21.function
+++ b/tests/suites/test_suite_pkcs1_v21.function
@@ -1,6 +1,6 @@
 /* BEGIN_HEADER */
-#include "polarssl/rsa.h"
-#include "polarssl/md.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/md.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_pkcs5.function b/tests/suites/test_suite_pkcs5.function
index f7165f6..6074e04 100644
--- a/tests/suites/test_suite_pkcs5.function
+++ b/tests/suites/test_suite_pkcs5.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/pkcs5.h"
+#include "mbedtls/pkcs5.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_pkparse.function b/tests/suites/test_suite_pkparse.function
index 9479cd9..8927397 100644
--- a/tests/suites/test_suite_pkparse.function
+++ b/tests/suites/test_suite_pkparse.function
@@ -1,7 +1,7 @@
 /* BEGIN_HEADER */
-#include "polarssl/pk.h"
-#include "polarssl/pem.h"
-#include "polarssl/oid.h"
+#include "mbedtls/pk.h"
+#include "mbedtls/pem.h"
+#include "mbedtls/oid.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_pkwrite.function b/tests/suites/test_suite_pkwrite.function
index 8b5fafb..be0ab60 100644
--- a/tests/suites/test_suite_pkwrite.function
+++ b/tests/suites/test_suite_pkwrite.function
@@ -1,7 +1,7 @@
 /* BEGIN_HEADER */
-#include "polarssl/pk.h"
-#include "polarssl/pem.h"
-#include "polarssl/oid.h"
+#include "mbedtls/pk.h"
+#include "mbedtls/pem.h"
+#include "mbedtls/oid.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_rsa.function b/tests/suites/test_suite_rsa.function
index 45d5723..3c61f51 100644
--- a/tests/suites/test_suite_rsa.function
+++ b/tests/suites/test_suite_rsa.function
@@ -1,13 +1,13 @@
 /* BEGIN_HEADER */
-#include "polarssl/rsa.h"
-#include "polarssl/md2.h"
-#include "polarssl/md4.h"
-#include "polarssl/md5.h"
-#include "polarssl/sha1.h"
-#include "polarssl/sha256.h"
-#include "polarssl/sha512.h"
-#include "polarssl/entropy.h"
-#include "polarssl/ctr_drbg.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/md2.h"
+#include "mbedtls/md4.h"
+#include "mbedtls/md5.h"
+#include "mbedtls/sha1.h"
+#include "mbedtls/sha256.h"
+#include "mbedtls/sha512.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_shax.function b/tests/suites/test_suite_shax.function
index 51c3301..29ede71 100644
--- a/tests/suites/test_suite_shax.function
+++ b/tests/suites/test_suite_shax.function
@@ -1,7 +1,7 @@
 /* BEGIN_HEADER */
-#include "polarssl/sha1.h"
-#include "polarssl/sha256.h"
-#include "polarssl/sha512.h"
+#include "mbedtls/sha1.h"
+#include "mbedtls/sha256.h"
+#include "mbedtls/sha512.h"
 /* END_HEADER */
 
 /* BEGIN_CASE depends_on:POLARSSL_SHA1_C */
diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data
new file mode 100644
index 0000000..a39f6f0
--- /dev/null
+++ b/tests/suites/test_suite_ssl.data
@@ -0,0 +1,56 @@
+SSL DTLS replay: initial state, seqnum 0
+ssl_dtls_replay:"":"000000000000":0
+
+SSL DTLS replay: 0 seen, 1 arriving
+ssl_dtls_replay:"000000000000":"000000000001":0
+
+SSL DTLS replay: 0 seen, 0 replayed
+ssl_dtls_replay:"000000000000":"000000000000":-1
+
+SSL DTLS replay: 0-1 seen, 2 arriving
+ssl_dtls_replay:"000000000000,000000000001":"000000000002":0
+
+SSL DTLS replay: 0-1 seen, 1 replayed
+ssl_dtls_replay:"000000000000,000000000001":"000000000001":-1
+
+SSL DTLS replay: 0-1 seen, 0 replayed
+ssl_dtls_replay:"000000000000,000000000001":"000000000000":-1
+
+SSL DTLS replay: new
+ssl_dtls_replay:"abcd12340000,abcd12340001,abcd12340003":"abcd12340004":0
+
+SSL DTLS replay: way new
+ssl_dtls_replay:"abcd12340000,abcd12340001,abcd12340003":"abcd12350000":0
+
+SSL DTLS replay: delayed
+ssl_dtls_replay:"abcd12340000,abcd12340001,abcd12340003":"abcd12340002":0
+
+SSL DTLS replay: lastest replayed
+ssl_dtls_replay:"abcd12340000,abcd12340001,abcd12340003":"abcd12340003":-1
+
+SSL DTLS replay: older replayed
+ssl_dtls_replay:"abcd12340000,abcd12340001,abcd12340003":"abcd12340001":-1
+
+SSL DTLS replay: most recent in window, replayed
+ssl_dtls_replay:"abcd12340000,abcd12340002,abcd12340003":"abcd12340002":-1
+
+SSL DTLS replay: oldest in window, replayed
+ssl_dtls_replay:"abcd12340000,abcd12340001,abcd1234003f":"abcd12340000":-1
+
+SSL DTLS replay: oldest in window, not replayed
+ssl_dtls_replay:"abcd12340001,abcd12340002,abcd1234003f":"abcd12340000":0
+
+SSL DTLS replay: just out of the window
+ssl_dtls_replay:"abcd12340001,abcd12340002,abcd1234003f":"abcd1233ffff":-1
+
+SSL DTLS replay: way out of the window
+ssl_dtls_replay:"abcd12340001,abcd12340002,abcd1234003f":"abcd12330000":-1
+
+SSL DTLS replay: big jump then replay
+ssl_dtls_replay:"abcd12340000,abcd12340100":"abcd12340100":-1
+
+SSL DTLS replay: big jump then new
+ssl_dtls_replay:"abcd12340000,abcd12340100":"abcd12340101":0
+
+SSL DTLS replay: big jump then just delayed
+ssl_dtls_replay:"abcd12340000,abcd12340100":"abcd123400ff":0
diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function
new file mode 100644
index 0000000..4de888f
--- /dev/null
+++ b/tests/suites/test_suite_ssl.function
@@ -0,0 +1,33 @@
+/* BEGIN_HEADER */
+#include <mbedtls/ssl.h>
+/* END_HEADER */
+
+/* BEGIN_DEPENDENCIES
+ * depends_on:POLARSSL_SSL_TLS_C
+ * END_DEPENDENCIES
+ */
+
+/* BEGIN_CASE depends_on:POLARSSL_SSL_DTLS_ANTI_REPLAY */
+void ssl_dtls_replay( char *prevs, char *new, int ret )
+{
+    ssl_context ssl;
+    char *end_prevs = prevs + strlen( prevs ) + 1;
+
+    TEST_ASSERT( ssl_init( &ssl ) == 0 );
+    TEST_ASSERT( ssl_set_transport( &ssl, SSL_TRANSPORT_DATAGRAM ) == 0 );
+
+    /* Read previous record numbers */
+    for( ; end_prevs - prevs >= 13; prevs += 13 )
+    {
+        prevs[12] = '\0';
+        unhexify( ssl.in_ctr + 2, prevs );
+        ssl_dtls_replay_update( &ssl );
+    }
+
+    /* Check new number */
+    unhexify( ssl.in_ctr + 2, new );
+    TEST_ASSERT( ssl_dtls_replay_check( &ssl ) == ret );
+
+    ssl_free( &ssl );
+}
+/* END_CASE */
diff --git a/tests/suites/test_suite_version.data b/tests/suites/test_suite_version.data
index bdce6e5..be9c59e 100644
--- a/tests/suites/test_suite_version.data
+++ b/tests/suites/test_suite_version.data
@@ -1,8 +1,8 @@
 Check compiletime library version
-check_compiletime_version:"1.3.10"
+check_compiletime_version:"1.4.0"
 
 Check runtime library version
-check_runtime_version:"1.3.10"
+check_runtime_version:"1.4.0"
 
 Check for POLARSSL_VERSION_C
 check_feature:"POLARSSL_VERSION_C":0
diff --git a/tests/suites/test_suite_version.function b/tests/suites/test_suite_version.function
index fd12032..bfa52ff 100644
--- a/tests/suites/test_suite_version.function
+++ b/tests/suites/test_suite_version.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/version.h"
+#include "mbedtls/version.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_x509parse.function b/tests/suites/test_suite_x509parse.function
index 50de457..7440859 100644
--- a/tests/suites/test_suite_x509parse.function
+++ b/tests/suites/test_suite_x509parse.function
@@ -1,10 +1,10 @@
 /* BEGIN_HEADER */
-#include "polarssl/x509_crt.h"
-#include "polarssl/x509_crl.h"
-#include "polarssl/x509_csr.h"
-#include "polarssl/pem.h"
-#include "polarssl/oid.h"
-#include "polarssl/base64.h"
+#include "mbedtls/x509_crt.h"
+#include "mbedtls/x509_crl.h"
+#include "mbedtls/x509_csr.h"
+#include "mbedtls/pem.h"
+#include "mbedtls/oid.h"
+#include "mbedtls/base64.h"
 
 int verify_none( void *data, x509_crt *crt, int certificate_depth, int *flags )
 {
diff --git a/tests/suites/test_suite_x509write.function b/tests/suites/test_suite_x509write.function
index 63f35a6..fe4b9a6 100644
--- a/tests/suites/test_suite_x509write.function
+++ b/tests/suites/test_suite_x509write.function
@@ -1,8 +1,8 @@
 /* BEGIN_HEADER */
-#include "polarssl/x509_crt.h"
-#include "polarssl/x509_csr.h"
-#include "polarssl/pem.h"
-#include "polarssl/oid.h"
+#include "mbedtls/x509_crt.h"
+#include "mbedtls/x509_csr.h"
+#include "mbedtls/pem.h"
+#include "mbedtls/oid.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/tests/suites/test_suite_xtea.function b/tests/suites/test_suite_xtea.function
index d22c7fd..e7c1135 100644
--- a/tests/suites/test_suite_xtea.function
+++ b/tests/suites/test_suite_xtea.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "polarssl/xtea.h"
+#include "mbedtls/xtea.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
diff --git a/visualc/VS2010/ssl_test.vcxproj b/visualc/VS2010/dtls_client.vcxproj
similarity index 97%
copy from visualc/VS2010/ssl_test.vcxproj
copy to visualc/VS2010/dtls_client.vcxproj
index 33200ab..0f51e04 100644
--- a/visualc/VS2010/ssl_test.vcxproj
+++ b/visualc/VS2010/dtls_client.vcxproj
@@ -19,7 +19,7 @@
     </ProjectConfiguration>
   </ItemGroup>
   <ItemGroup>
-    <ClCompile Include="..\..\programs\test\ssl_test.c" />
+    <ClCompile Include="..\..\programs\ssl\dtls_client.c" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="mbedTLS.vcxproj">
@@ -27,9 +27,9 @@
     </ProjectReference>
   </ItemGroup>
   <PropertyGroup Label="Globals">
-    <ProjectGuid>{DDD0BF0A-779A-DEFD-6A1C-FA2164AE9A34}</ProjectGuid>
+    <ProjectGuid>{FE7AB78F-DBF1-0721-3522-0D7C3011D2E5}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
-    <RootNamespace>ssl_test</RootNamespace>
+    <RootNamespace>dtls_client</RootNamespace>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
diff --git a/visualc/VS2010/ssl_test.vcxproj b/visualc/VS2010/dtls_server.vcxproj
similarity index 97%
copy from visualc/VS2010/ssl_test.vcxproj
copy to visualc/VS2010/dtls_server.vcxproj
index 33200ab..e643d92 100644
--- a/visualc/VS2010/ssl_test.vcxproj
+++ b/visualc/VS2010/dtls_server.vcxproj
@@ -19,7 +19,7 @@
     </ProjectConfiguration>
   </ItemGroup>
   <ItemGroup>
-    <ClCompile Include="..\..\programs\test\ssl_test.c" />
+    <ClCompile Include="..\..\programs\ssl\dtls_server.c" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="mbedTLS.vcxproj">
@@ -27,9 +27,9 @@
     </ProjectReference>
   </ItemGroup>
   <PropertyGroup Label="Globals">
-    <ProjectGuid>{DDD0BF0A-779A-DEFD-6A1C-FA2164AE9A34}</ProjectGuid>
+    <ProjectGuid>{BFE89EAA-D98B-34E1-C5A4-4080F6FFE317}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
-    <RootNamespace>ssl_test</RootNamespace>
+    <RootNamespace>dtls_server</RootNamespace>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
diff --git a/visualc/VS2010/mbedTLS.sln b/visualc/VS2010/mbedTLS.sln
index 72e0818..bf309c5 100644
--- a/visualc/VS2010/mbedTLS.sln
+++ b/visualc/VS2010/mbedTLS.sln
@@ -128,6 +128,16 @@
 		{46CF2D25-6A36-4189-B59C-E4815388E554} = {46CF2D25-6A36-4189-B59C-E4815388E554}
 	EndProjectSection
 EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "dtls_client", "dtls_client.vcxproj", "{FE7AB78F-DBF1-0721-3522-0D7C3011D2E5}"
+	ProjectSection(ProjectDependencies) = postProject
+		{46CF2D25-6A36-4189-B59C-E4815388E554} = {46CF2D25-6A36-4189-B59C-E4815388E554}
+	EndProjectSection
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "dtls_server", "dtls_server.vcxproj", "{BFE89EAA-D98B-34E1-C5A4-4080F6FFE317}"
+	ProjectSection(ProjectDependencies) = postProject
+		{46CF2D25-6A36-4189-B59C-E4815388E554} = {46CF2D25-6A36-4189-B59C-E4815388E554}
+	EndProjectSection
+EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ssl_client1", "ssl_client1.vcxproj", "{487A2F80-3CA3-678D-88D5-82194872CF08}"
 	ProjectSection(ProjectDependencies) = postProject
 		{46CF2D25-6A36-4189-B59C-E4815388E554} = {46CF2D25-6A36-4189-B59C-E4815388E554}
@@ -193,7 +203,7 @@
 		{46CF2D25-6A36-4189-B59C-E4815388E554} = {46CF2D25-6A36-4189-B59C-E4815388E554}
 	EndProjectSection
 EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ssl_test", "ssl_test.vcxproj", "{DDD0BF0A-779A-DEFD-6A1C-FA2164AE9A34}"
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "udp_proxy", "udp_proxy.vcxproj", "{7E2C80FE-3CC3-82B4-0CAD-65DC233DE13A}"
 	ProjectSection(ProjectDependencies) = postProject
 		{46CF2D25-6A36-4189-B59C-E4815388E554} = {46CF2D25-6A36-4189-B59C-E4815388E554}
 	EndProjectSection
@@ -439,6 +449,22 @@
 		{95C50864-854C-2A11-4C91-BCE654E344FB}.Release|Win32.Build.0 = Release|Win32
 		{95C50864-854C-2A11-4C91-BCE654E344FB}.Release|x64.ActiveCfg = Release|x64
 		{95C50864-854C-2A11-4C91-BCE654E344FB}.Release|x64.Build.0 = Release|x64
+		{FE7AB78F-DBF1-0721-3522-0D7C3011D2E5}.Debug|Win32.ActiveCfg = Debug|Win32
+		{FE7AB78F-DBF1-0721-3522-0D7C3011D2E5}.Debug|Win32.Build.0 = Debug|Win32
+		{FE7AB78F-DBF1-0721-3522-0D7C3011D2E5}.Debug|x64.ActiveCfg = Debug|x64
+		{FE7AB78F-DBF1-0721-3522-0D7C3011D2E5}.Debug|x64.Build.0 = Debug|x64
+		{FE7AB78F-DBF1-0721-3522-0D7C3011D2E5}.Release|Win32.ActiveCfg = Release|Win32
+		{FE7AB78F-DBF1-0721-3522-0D7C3011D2E5}.Release|Win32.Build.0 = Release|Win32
+		{FE7AB78F-DBF1-0721-3522-0D7C3011D2E5}.Release|x64.ActiveCfg = Release|x64
+		{FE7AB78F-DBF1-0721-3522-0D7C3011D2E5}.Release|x64.Build.0 = Release|x64
+		{BFE89EAA-D98B-34E1-C5A4-4080F6FFE317}.Debug|Win32.ActiveCfg = Debug|Win32
+		{BFE89EAA-D98B-34E1-C5A4-4080F6FFE317}.Debug|Win32.Build.0 = Debug|Win32
+		{BFE89EAA-D98B-34E1-C5A4-4080F6FFE317}.Debug|x64.ActiveCfg = Debug|x64
+		{BFE89EAA-D98B-34E1-C5A4-4080F6FFE317}.Debug|x64.Build.0 = Debug|x64
+		{BFE89EAA-D98B-34E1-C5A4-4080F6FFE317}.Release|Win32.ActiveCfg = Release|Win32
+		{BFE89EAA-D98B-34E1-C5A4-4080F6FFE317}.Release|Win32.Build.0 = Release|Win32
+		{BFE89EAA-D98B-34E1-C5A4-4080F6FFE317}.Release|x64.ActiveCfg = Release|x64
+		{BFE89EAA-D98B-34E1-C5A4-4080F6FFE317}.Release|x64.Build.0 = Release|x64
 		{487A2F80-3CA3-678D-88D5-82194872CF08}.Debug|Win32.ActiveCfg = Debug|Win32
 		{487A2F80-3CA3-678D-88D5-82194872CF08}.Debug|Win32.Build.0 = Debug|Win32
 		{487A2F80-3CA3-678D-88D5-82194872CF08}.Debug|x64.ActiveCfg = Debug|x64
@@ -543,14 +569,14 @@
 		{7DBC5F77-3DA1-5F73-8421-E693D95FC66A}.Release|Win32.Build.0 = Release|Win32
 		{7DBC5F77-3DA1-5F73-8421-E693D95FC66A}.Release|x64.ActiveCfg = Release|x64
 		{7DBC5F77-3DA1-5F73-8421-E693D95FC66A}.Release|x64.Build.0 = Release|x64
-		{DDD0BF0A-779A-DEFD-6A1C-FA2164AE9A34}.Debug|Win32.ActiveCfg = Debug|Win32
-		{DDD0BF0A-779A-DEFD-6A1C-FA2164AE9A34}.Debug|Win32.Build.0 = Debug|Win32
-		{DDD0BF0A-779A-DEFD-6A1C-FA2164AE9A34}.Debug|x64.ActiveCfg = Debug|x64
-		{DDD0BF0A-779A-DEFD-6A1C-FA2164AE9A34}.Debug|x64.Build.0 = Debug|x64
-		{DDD0BF0A-779A-DEFD-6A1C-FA2164AE9A34}.Release|Win32.ActiveCfg = Release|Win32
-		{DDD0BF0A-779A-DEFD-6A1C-FA2164AE9A34}.Release|Win32.Build.0 = Release|Win32
-		{DDD0BF0A-779A-DEFD-6A1C-FA2164AE9A34}.Release|x64.ActiveCfg = Release|x64
-		{DDD0BF0A-779A-DEFD-6A1C-FA2164AE9A34}.Release|x64.Build.0 = Release|x64
+		{7E2C80FE-3CC3-82B4-0CAD-65DC233DE13A}.Debug|Win32.ActiveCfg = Debug|Win32
+		{7E2C80FE-3CC3-82B4-0CAD-65DC233DE13A}.Debug|Win32.Build.0 = Debug|Win32
+		{7E2C80FE-3CC3-82B4-0CAD-65DC233DE13A}.Debug|x64.ActiveCfg = Debug|x64
+		{7E2C80FE-3CC3-82B4-0CAD-65DC233DE13A}.Debug|x64.Build.0 = Debug|x64
+		{7E2C80FE-3CC3-82B4-0CAD-65DC233DE13A}.Release|Win32.ActiveCfg = Release|Win32
+		{7E2C80FE-3CC3-82B4-0CAD-65DC233DE13A}.Release|Win32.Build.0 = Release|Win32
+		{7E2C80FE-3CC3-82B4-0CAD-65DC233DE13A}.Release|x64.ActiveCfg = Release|x64
+		{7E2C80FE-3CC3-82B4-0CAD-65DC233DE13A}.Release|x64.Build.0 = Release|x64
 		{D3C6FBD6-D78E-7180-8345-5E09B492DBEC}.Debug|Win32.ActiveCfg = Debug|Win32
 		{D3C6FBD6-D78E-7180-8345-5E09B492DBEC}.Debug|Win32.Build.0 = Debug|Win32
 		{D3C6FBD6-D78E-7180-8345-5E09B492DBEC}.Debug|x64.ActiveCfg = Debug|x64
diff --git a/visualc/VS2010/mbedTLS.vcxproj b/visualc/VS2010/mbedTLS.vcxproj
index 0ee568a..907f108 100644
--- a/visualc/VS2010/mbedTLS.vcxproj
+++ b/visualc/VS2010/mbedTLS.vcxproj
@@ -142,71 +142,70 @@
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
-    <ClInclude Include="..\..\include\polarssl\aes.h" />
-    <ClInclude Include="..\..\include\polarssl\aesni.h" />
-    <ClInclude Include="..\..\include\polarssl\arc4.h" />
-    <ClInclude Include="..\..\include\polarssl\asn1.h" />
-    <ClInclude Include="..\..\include\polarssl\asn1write.h" />
-    <ClInclude Include="..\..\include\polarssl\base64.h" />
-    <ClInclude Include="..\..\include\polarssl\bignum.h" />
-    <ClInclude Include="..\..\include\polarssl\blowfish.h" />
-    <ClInclude Include="..\..\include\polarssl\bn_mul.h" />
-    <ClInclude Include="..\..\include\polarssl\camellia.h" />
-    <ClInclude Include="..\..\include\polarssl\ccm.h" />
-    <ClInclude Include="..\..\include\polarssl\certs.h" />
-    <ClInclude Include="..\..\include\polarssl\check_config.h" />
-    <ClInclude Include="..\..\include\polarssl\cipher.h" />
-    <ClInclude Include="..\..\include\polarssl\cipher_wrap.h" />
-    <ClInclude Include="..\..\include\polarssl\compat-1.2.h" />
-    <ClInclude Include="..\..\include\polarssl\config.h" />
-    <ClInclude Include="..\..\include\polarssl\ctr_drbg.h" />
-    <ClInclude Include="..\..\include\polarssl\debug.h" />
-    <ClInclude Include="..\..\include\polarssl\des.h" />
-    <ClInclude Include="..\..\include\polarssl\dhm.h" />
-    <ClInclude Include="..\..\include\polarssl\ecdh.h" />
-    <ClInclude Include="..\..\include\polarssl\ecdsa.h" />
-    <ClInclude Include="..\..\include\polarssl\ecp.h" />
-    <ClInclude Include="..\..\include\polarssl\entropy.h" />
-    <ClInclude Include="..\..\include\polarssl\entropy_poll.h" />
-    <ClInclude Include="..\..\include\polarssl\error.h" />
-    <ClInclude Include="..\..\include\polarssl\gcm.h" />
-    <ClInclude Include="..\..\include\polarssl\havege.h" />
-    <ClInclude Include="..\..\include\polarssl\hmac_drbg.h" />
-    <ClInclude Include="..\..\include\polarssl\md.h" />
-    <ClInclude Include="..\..\include\polarssl\md2.h" />
-    <ClInclude Include="..\..\include\polarssl\md4.h" />
-    <ClInclude Include="..\..\include\polarssl\md5.h" />
-    <ClInclude Include="..\..\include\polarssl\md_wrap.h" />
-    <ClInclude Include="..\..\include\polarssl\memory.h" />
-    <ClInclude Include="..\..\include\polarssl\memory_buffer_alloc.h" />
-    <ClInclude Include="..\..\include\polarssl\net.h" />
-    <ClInclude Include="..\..\include\polarssl\oid.h" />
-    <ClInclude Include="..\..\include\polarssl\openssl.h" />
-    <ClInclude Include="..\..\include\polarssl\padlock.h" />
-    <ClInclude Include="..\..\include\polarssl\pbkdf2.h" />
-    <ClInclude Include="..\..\include\polarssl\pem.h" />
-    <ClInclude Include="..\..\include\polarssl\pk.h" />
-    <ClInclude Include="..\..\include\polarssl\pk_wrap.h" />
-    <ClInclude Include="..\..\include\polarssl\pkcs11.h" />
-    <ClInclude Include="..\..\include\polarssl\pkcs12.h" />
-    <ClInclude Include="..\..\include\polarssl\pkcs5.h" />
-    <ClInclude Include="..\..\include\polarssl\platform.h" />
-    <ClInclude Include="..\..\include\polarssl\ripemd160.h" />
-    <ClInclude Include="..\..\include\polarssl\rsa.h" />
-    <ClInclude Include="..\..\include\polarssl\sha1.h" />
-    <ClInclude Include="..\..\include\polarssl\sha256.h" />
-    <ClInclude Include="..\..\include\polarssl\sha512.h" />
-    <ClInclude Include="..\..\include\polarssl\ssl.h" />
-    <ClInclude Include="..\..\include\polarssl\ssl_cache.h" />
-    <ClInclude Include="..\..\include\polarssl\ssl_ciphersuites.h" />
-    <ClInclude Include="..\..\include\polarssl\threading.h" />
-    <ClInclude Include="..\..\include\polarssl\timing.h" />
-    <ClInclude Include="..\..\include\polarssl\version.h" />
-    <ClInclude Include="..\..\include\polarssl\x509.h" />
-    <ClInclude Include="..\..\include\polarssl\x509_crl.h" />
-    <ClInclude Include="..\..\include\polarssl\x509_crt.h" />
-    <ClInclude Include="..\..\include\polarssl\x509_csr.h" />
-    <ClInclude Include="..\..\include\polarssl\xtea.h" />
+    <ClInclude Include="..\..\include\mbedtls\aes.h" />
+    <ClInclude Include="..\..\include\mbedtls\aesni.h" />
+    <ClInclude Include="..\..\include\mbedtls\arc4.h" />
+    <ClInclude Include="..\..\include\mbedtls\asn1.h" />
+    <ClInclude Include="..\..\include\mbedtls\asn1write.h" />
+    <ClInclude Include="..\..\include\mbedtls\base64.h" />
+    <ClInclude Include="..\..\include\mbedtls\bignum.h" />
+    <ClInclude Include="..\..\include\mbedtls\blowfish.h" />
+    <ClInclude Include="..\..\include\mbedtls\bn_mul.h" />
+    <ClInclude Include="..\..\include\mbedtls\camellia.h" />
+    <ClInclude Include="..\..\include\mbedtls\ccm.h" />
+    <ClInclude Include="..\..\include\mbedtls\certs.h" />
+    <ClInclude Include="..\..\include\mbedtls\check_config.h" />
+    <ClInclude Include="..\..\include\mbedtls\cipher.h" />
+    <ClInclude Include="..\..\include\mbedtls\cipher_wrap.h" />
+    <ClInclude Include="..\..\include\mbedtls\config.h" />
+    <ClInclude Include="..\..\include\mbedtls\ctr_drbg.h" />
+    <ClInclude Include="..\..\include\mbedtls\debug.h" />
+    <ClInclude Include="..\..\include\mbedtls\des.h" />
+    <ClInclude Include="..\..\include\mbedtls\dhm.h" />
+    <ClInclude Include="..\..\include\mbedtls\ecdh.h" />
+    <ClInclude Include="..\..\include\mbedtls\ecdsa.h" />
+    <ClInclude Include="..\..\include\mbedtls\ecp.h" />
+    <ClInclude Include="..\..\include\mbedtls\entropy.h" />
+    <ClInclude Include="..\..\include\mbedtls\entropy_poll.h" />
+    <ClInclude Include="..\..\include\mbedtls\error.h" />
+    <ClInclude Include="..\..\include\mbedtls\gcm.h" />
+    <ClInclude Include="..\..\include\mbedtls\havege.h" />
+    <ClInclude Include="..\..\include\mbedtls\hmac_drbg.h" />
+    <ClInclude Include="..\..\include\mbedtls\md.h" />
+    <ClInclude Include="..\..\include\mbedtls\md2.h" />
+    <ClInclude Include="..\..\include\mbedtls\md4.h" />
+    <ClInclude Include="..\..\include\mbedtls\md5.h" />
+    <ClInclude Include="..\..\include\mbedtls\md_wrap.h" />
+    <ClInclude Include="..\..\include\mbedtls\memory.h" />
+    <ClInclude Include="..\..\include\mbedtls\memory_buffer_alloc.h" />
+    <ClInclude Include="..\..\include\mbedtls\net.h" />
+    <ClInclude Include="..\..\include\mbedtls\oid.h" />
+    <ClInclude Include="..\..\include\mbedtls\padlock.h" />
+    <ClInclude Include="..\..\include\mbedtls\pbkdf2.h" />
+    <ClInclude Include="..\..\include\mbedtls\pem.h" />
+    <ClInclude Include="..\..\include\mbedtls\pk.h" />
+    <ClInclude Include="..\..\include\mbedtls\pk_wrap.h" />
+    <ClInclude Include="..\..\include\mbedtls\pkcs11.h" />
+    <ClInclude Include="..\..\include\mbedtls\pkcs12.h" />
+    <ClInclude Include="..\..\include\mbedtls\pkcs5.h" />
+    <ClInclude Include="..\..\include\mbedtls\platform.h" />
+    <ClInclude Include="..\..\include\mbedtls\ripemd160.h" />
+    <ClInclude Include="..\..\include\mbedtls\rsa.h" />
+    <ClInclude Include="..\..\include\mbedtls\sha1.h" />
+    <ClInclude Include="..\..\include\mbedtls\sha256.h" />
+    <ClInclude Include="..\..\include\mbedtls\sha512.h" />
+    <ClInclude Include="..\..\include\mbedtls\ssl.h" />
+    <ClInclude Include="..\..\include\mbedtls\ssl_cache.h" />
+    <ClInclude Include="..\..\include\mbedtls\ssl_ciphersuites.h" />
+    <ClInclude Include="..\..\include\mbedtls\ssl_cookie.h" />
+    <ClInclude Include="..\..\include\mbedtls\threading.h" />
+    <ClInclude Include="..\..\include\mbedtls\timing.h" />
+    <ClInclude Include="..\..\include\mbedtls\version.h" />
+    <ClInclude Include="..\..\include\mbedtls\x509.h" />
+    <ClInclude Include="..\..\include\mbedtls\x509_crl.h" />
+    <ClInclude Include="..\..\include\mbedtls\x509_crt.h" />
+    <ClInclude Include="..\..\include\mbedtls\x509_csr.h" />
+    <ClInclude Include="..\..\include\mbedtls\xtea.h" />
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="..\..\library\aes.c" />
@@ -263,6 +262,7 @@
     <ClCompile Include="..\..\library\ssl_cache.c" />
     <ClCompile Include="..\..\library\ssl_ciphersuites.c" />
     <ClCompile Include="..\..\library\ssl_cli.c" />
+    <ClCompile Include="..\..\library\ssl_cookie.c" />
     <ClCompile Include="..\..\library\ssl_srv.c" />
     <ClCompile Include="..\..\library\ssl_tls.c" />
     <ClCompile Include="..\..\library\threading.c" />
diff --git a/visualc/VS2010/ssl_test.vcxproj b/visualc/VS2010/udp_proxy.vcxproj
similarity index 97%
rename from visualc/VS2010/ssl_test.vcxproj
rename to visualc/VS2010/udp_proxy.vcxproj
index 33200ab..1ca3e6a 100644
--- a/visualc/VS2010/ssl_test.vcxproj
+++ b/visualc/VS2010/udp_proxy.vcxproj
@@ -19,7 +19,7 @@
     </ProjectConfiguration>
   </ItemGroup>
   <ItemGroup>
-    <ClCompile Include="..\..\programs\test\ssl_test.c" />
+    <ClCompile Include="..\..\programs\test\udp_proxy.c" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="mbedTLS.vcxproj">
@@ -27,9 +27,9 @@
     </ProjectReference>
   </ItemGroup>
   <PropertyGroup Label="Globals">
-    <ProjectGuid>{DDD0BF0A-779A-DEFD-6A1C-FA2164AE9A34}</ProjectGuid>
+    <ProjectGuid>{7E2C80FE-3CC3-82B4-0CAD-65DC233DE13A}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
-    <RootNamespace>ssl_test</RootNamespace>
+    <RootNamespace>udp_proxy</RootNamespace>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
diff --git a/visualc/VS6/ssl_test.dsp b/visualc/VS6/dtls_client.dsp
similarity index 85%
copy from visualc/VS6/ssl_test.dsp
copy to visualc/VS6/dtls_client.dsp
index fffab2b..80d7fe5 100644
--- a/visualc/VS6/ssl_test.dsp
+++ b/visualc/VS6/dtls_client.dsp
@@ -1,24 +1,24 @@
-# Microsoft Developer Studio Project File - Name="ssl_test" - Package Owner=<4>
+# Microsoft Developer Studio Project File - Name="dtls_client" - Package Owner=<4>
 # Microsoft Developer Studio Generated Build File, Format Version 6.00
 # ** DO NOT EDIT **
 
 # TARGTYPE "Win32 (x86) Console Application" 0x0103
 
-CFG=ssl_test - Win32 Debug
+CFG=dtls_client - Win32 Debug
 !MESSAGE This is not a valid makefile. To build this project using NMAKE,
 !MESSAGE use the Export Makefile command and run
 !MESSAGE 
-!MESSAGE NMAKE /f "ssl_test.mak".
+!MESSAGE NMAKE /f "dtls_client.mak".
 !MESSAGE 
 !MESSAGE You can specify a configuration when running NMAKE
 !MESSAGE by defining the macro CFG on the command line. For example:
 !MESSAGE 
-!MESSAGE NMAKE /f "ssl_test.mak" CFG="ssl_test - Win32 Debug"
+!MESSAGE NMAKE /f "dtls_client.mak" CFG="dtls_client - Win32 Debug"
 !MESSAGE 
 !MESSAGE Possible choices for configuration are:
 !MESSAGE 
-!MESSAGE "ssl_test - Win32 Release" (based on "Win32 (x86) Console Application")
-!MESSAGE "ssl_test - Win32 Debug" (based on "Win32 (x86) Console Application")
+!MESSAGE "dtls_client - Win32 Release" (based on "Win32 (x86) Console Application")
+!MESSAGE "dtls_client - Win32 Debug" (based on "Win32 (x86) Console Application")
 !MESSAGE 
 
 # Begin Project
@@ -28,7 +28,7 @@
 CPP=cl.exe
 RSC=rc.exe
 
-!IF  "$(CFG)" == "ssl_test - Win32 Release"
+!IF  "$(CFG)" == "dtls_client - Win32 Release"
 
 # PROP BASE Use_MFC 0
 # PROP BASE Use_Debug_Libraries 0
@@ -51,7 +51,7 @@
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib  kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
 # ADD LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib  kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
 
-!ELSEIF  "$(CFG)" == "ssl_test - Win32 Debug"
+!ELSEIF  "$(CFG)" == "dtls_client - Win32 Debug"
 
 # PROP BASE Use_MFC 0
 # PROP BASE Use_Debug_Libraries 1
@@ -78,14 +78,14 @@
 
 # Begin Target
 
-# Name "ssl_test - Win32 Release"
-# Name "ssl_test - Win32 Debug"
+# Name "dtls_client - Win32 Release"
+# Name "dtls_client - Win32 Debug"
 # Begin Group "Source Files"
 
 # PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
 # Begin Source File
 
-SOURCE=..\..\programs\test\ssl_test.c
+SOURCE=..\..\programs\ssl\dtls_client.c
 # ADD CPP /I "../../include"
 # End Source File
 # End Group
diff --git a/visualc/VS6/ssl_test.dsp b/visualc/VS6/dtls_server.dsp
similarity index 85%
copy from visualc/VS6/ssl_test.dsp
copy to visualc/VS6/dtls_server.dsp
index fffab2b..42a4d5b 100644
--- a/visualc/VS6/ssl_test.dsp
+++ b/visualc/VS6/dtls_server.dsp
@@ -1,24 +1,24 @@
-# Microsoft Developer Studio Project File - Name="ssl_test" - Package Owner=<4>
+# Microsoft Developer Studio Project File - Name="dtls_server" - Package Owner=<4>
 # Microsoft Developer Studio Generated Build File, Format Version 6.00
 # ** DO NOT EDIT **
 
 # TARGTYPE "Win32 (x86) Console Application" 0x0103
 
-CFG=ssl_test - Win32 Debug
+CFG=dtls_server - Win32 Debug
 !MESSAGE This is not a valid makefile. To build this project using NMAKE,
 !MESSAGE use the Export Makefile command and run
 !MESSAGE 
-!MESSAGE NMAKE /f "ssl_test.mak".
+!MESSAGE NMAKE /f "dtls_server.mak".
 !MESSAGE 
 !MESSAGE You can specify a configuration when running NMAKE
 !MESSAGE by defining the macro CFG on the command line. For example:
 !MESSAGE 
-!MESSAGE NMAKE /f "ssl_test.mak" CFG="ssl_test - Win32 Debug"
+!MESSAGE NMAKE /f "dtls_server.mak" CFG="dtls_server - Win32 Debug"
 !MESSAGE 
 !MESSAGE Possible choices for configuration are:
 !MESSAGE 
-!MESSAGE "ssl_test - Win32 Release" (based on "Win32 (x86) Console Application")
-!MESSAGE "ssl_test - Win32 Debug" (based on "Win32 (x86) Console Application")
+!MESSAGE "dtls_server - Win32 Release" (based on "Win32 (x86) Console Application")
+!MESSAGE "dtls_server - Win32 Debug" (based on "Win32 (x86) Console Application")
 !MESSAGE 
 
 # Begin Project
@@ -28,7 +28,7 @@
 CPP=cl.exe
 RSC=rc.exe
 
-!IF  "$(CFG)" == "ssl_test - Win32 Release"
+!IF  "$(CFG)" == "dtls_server - Win32 Release"
 
 # PROP BASE Use_MFC 0
 # PROP BASE Use_Debug_Libraries 0
@@ -51,7 +51,7 @@
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib  kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
 # ADD LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib  kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
 
-!ELSEIF  "$(CFG)" == "ssl_test - Win32 Debug"
+!ELSEIF  "$(CFG)" == "dtls_server - Win32 Debug"
 
 # PROP BASE Use_MFC 0
 # PROP BASE Use_Debug_Libraries 1
@@ -78,14 +78,14 @@
 
 # Begin Target
 
-# Name "ssl_test - Win32 Release"
-# Name "ssl_test - Win32 Debug"
+# Name "dtls_server - Win32 Release"
+# Name "dtls_server - Win32 Debug"
 # Begin Group "Source Files"
 
 # PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
 # Begin Source File
 
-SOURCE=..\..\programs\test\ssl_test.c
+SOURCE=..\..\programs\ssl\dtls_server.c
 # ADD CPP /I "../../include"
 # End Source File
 # End Group
diff --git a/visualc/VS6/mbedtls.dsp b/visualc/VS6/mbedtls.dsp
index 134cf7b..59108ec 100644
--- a/visualc/VS6/mbedtls.dsp
+++ b/visualc/VS6/mbedtls.dsp
@@ -301,6 +301,10 @@
 # End Source File
 # Begin Source File
 
+SOURCE=..\..\library\ssl_cookie.c
+# End Source File
+# Begin Source File
+
 SOURCE=..\..\library\ssl_srv.c
 # End Source File
 # Begin Source File
@@ -361,263 +365,259 @@
 # PROP Default_Filter "h;hpp;hxx;hm;inl"
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\aes.h
+SOURCE=..\..\include\mbedtls\aes.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\aesni.h
+SOURCE=..\..\include\mbedtls\aesni.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\arc4.h
+SOURCE=..\..\include\mbedtls\arc4.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\asn1.h
+SOURCE=..\..\include\mbedtls\asn1.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\asn1write.h
+SOURCE=..\..\include\mbedtls\asn1write.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\base64.h
+SOURCE=..\..\include\mbedtls\base64.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\bignum.h
+SOURCE=..\..\include\mbedtls\bignum.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\blowfish.h
+SOURCE=..\..\include\mbedtls\blowfish.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\bn_mul.h
+SOURCE=..\..\include\mbedtls\bn_mul.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\camellia.h
+SOURCE=..\..\include\mbedtls\camellia.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\ccm.h
+SOURCE=..\..\include\mbedtls\ccm.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\certs.h
+SOURCE=..\..\include\mbedtls\certs.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\check_config.h
+SOURCE=..\..\include\mbedtls\check_config.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\cipher.h
+SOURCE=..\..\include\mbedtls\cipher.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\cipher_wrap.h
+SOURCE=..\..\include\mbedtls\cipher_wrap.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\compat-1.2.h
+SOURCE=..\..\include\mbedtls\config.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\config.h
+SOURCE=..\..\include\mbedtls\ctr_drbg.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\ctr_drbg.h
+SOURCE=..\..\include\mbedtls\debug.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\debug.h
+SOURCE=..\..\include\mbedtls\des.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\des.h
+SOURCE=..\..\include\mbedtls\dhm.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\dhm.h
+SOURCE=..\..\include\mbedtls\ecdh.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\ecdh.h
+SOURCE=..\..\include\mbedtls\ecdsa.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\ecdsa.h
+SOURCE=..\..\include\mbedtls\ecp.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\ecp.h
+SOURCE=..\..\include\mbedtls\entropy.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\entropy.h
+SOURCE=..\..\include\mbedtls\entropy_poll.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\entropy_poll.h
+SOURCE=..\..\include\mbedtls\error.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\error.h
+SOURCE=..\..\include\mbedtls\gcm.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\gcm.h
+SOURCE=..\..\include\mbedtls\havege.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\havege.h
+SOURCE=..\..\include\mbedtls\hmac_drbg.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\hmac_drbg.h
+SOURCE=..\..\include\mbedtls\md.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\md.h
+SOURCE=..\..\include\mbedtls\md2.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\md2.h
+SOURCE=..\..\include\mbedtls\md4.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\md4.h
+SOURCE=..\..\include\mbedtls\md5.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\md5.h
+SOURCE=..\..\include\mbedtls\md_wrap.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\md_wrap.h
+SOURCE=..\..\include\mbedtls\memory.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\memory.h
+SOURCE=..\..\include\mbedtls\memory_buffer_alloc.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\memory_buffer_alloc.h
+SOURCE=..\..\include\mbedtls\net.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\net.h
+SOURCE=..\..\include\mbedtls\oid.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\oid.h
+SOURCE=..\..\include\mbedtls\padlock.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\openssl.h
+SOURCE=..\..\include\mbedtls\pbkdf2.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\padlock.h
+SOURCE=..\..\include\mbedtls\pem.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\pbkdf2.h
+SOURCE=..\..\include\mbedtls\pk.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\pem.h
+SOURCE=..\..\include\mbedtls\pk_wrap.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\pk.h
+SOURCE=..\..\include\mbedtls\pkcs11.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\pk_wrap.h
+SOURCE=..\..\include\mbedtls\pkcs12.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\pkcs11.h
+SOURCE=..\..\include\mbedtls\pkcs5.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\pkcs12.h
+SOURCE=..\..\include\mbedtls\platform.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\pkcs5.h
+SOURCE=..\..\include\mbedtls\ripemd160.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\platform.h
+SOURCE=..\..\include\mbedtls\rsa.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\ripemd160.h
+SOURCE=..\..\include\mbedtls\sha1.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\rsa.h
+SOURCE=..\..\include\mbedtls\sha256.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\sha1.h
+SOURCE=..\..\include\mbedtls\sha512.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\sha256.h
+SOURCE=..\..\include\mbedtls\ssl.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\sha512.h
+SOURCE=..\..\include\mbedtls\ssl_cache.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\ssl.h
+SOURCE=..\..\include\mbedtls\ssl_ciphersuites.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\ssl_cache.h
+SOURCE=..\..\include\mbedtls\ssl_cookie.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\ssl_ciphersuites.h
+SOURCE=..\..\include\mbedtls\threading.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\threading.h
+SOURCE=..\..\include\mbedtls\timing.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\timing.h
+SOURCE=..\..\include\mbedtls\version.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\version.h
+SOURCE=..\..\include\mbedtls\x509.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\x509.h
+SOURCE=..\..\include\mbedtls\x509_crl.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\x509_crl.h
+SOURCE=..\..\include\mbedtls\x509_crt.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\x509_crt.h
+SOURCE=..\..\include\mbedtls\x509_csr.h
 # End Source File
 # Begin Source File
 
-SOURCE=..\..\include\polarssl\x509_csr.h
-# End Source File
-# Begin Source File
-
-SOURCE=..\..\include\polarssl\xtea.h
+SOURCE=..\..\include\mbedtls\xtea.h
 # End Source File
 # End Group
 # End Target
diff --git a/visualc/VS6/mbedtls.dsw b/visualc/VS6/mbedtls.dsw
index c9cd7fd..176f2c1 100644
--- a/visualc/VS6/mbedtls.dsw
+++ b/visualc/VS6/mbedtls.dsw
@@ -378,6 +378,36 @@
 
 ###############################################################################
 
+Project: "dtls_client"=.\dtls_client.dsp - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+    Begin Project Dependency
+    Project_Dep_Name mbedtls
+    End Project Dependency
+}}}
+
+###############################################################################
+
+Project: "dtls_server"=.\dtls_server.dsp - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+    Begin Project Dependency
+    Project_Dep_Name mbedtls
+    End Project Dependency
+}}}
+
+###############################################################################
+
 Project: "ssl_client1"=.\ssl_client1.dsp - Package Owner=<4>
 
 Package=<5>
@@ -573,7 +603,7 @@
 
 ###############################################################################
 
-Project: "ssl_test"=.\ssl_test.dsp - Package Owner=<4>
+Project: "udp_proxy"=.\udp_proxy.dsp - Package Owner=<4>
 
 Package=<5>
 {{{
diff --git a/visualc/VS6/ssl_test.dsp b/visualc/VS6/udp_proxy.dsp
similarity index 86%
rename from visualc/VS6/ssl_test.dsp
rename to visualc/VS6/udp_proxy.dsp
index fffab2b..708bb66 100644
--- a/visualc/VS6/ssl_test.dsp
+++ b/visualc/VS6/udp_proxy.dsp
@@ -1,24 +1,24 @@
-# Microsoft Developer Studio Project File - Name="ssl_test" - Package Owner=<4>
+# Microsoft Developer Studio Project File - Name="udp_proxy" - Package Owner=<4>
 # Microsoft Developer Studio Generated Build File, Format Version 6.00
 # ** DO NOT EDIT **
 
 # TARGTYPE "Win32 (x86) Console Application" 0x0103
 
-CFG=ssl_test - Win32 Debug
+CFG=udp_proxy - Win32 Debug
 !MESSAGE This is not a valid makefile. To build this project using NMAKE,
 !MESSAGE use the Export Makefile command and run
 !MESSAGE 
-!MESSAGE NMAKE /f "ssl_test.mak".
+!MESSAGE NMAKE /f "udp_proxy.mak".
 !MESSAGE 
 !MESSAGE You can specify a configuration when running NMAKE
 !MESSAGE by defining the macro CFG on the command line. For example:
 !MESSAGE 
-!MESSAGE NMAKE /f "ssl_test.mak" CFG="ssl_test - Win32 Debug"
+!MESSAGE NMAKE /f "udp_proxy.mak" CFG="udp_proxy - Win32 Debug"
 !MESSAGE 
 !MESSAGE Possible choices for configuration are:
 !MESSAGE 
-!MESSAGE "ssl_test - Win32 Release" (based on "Win32 (x86) Console Application")
-!MESSAGE "ssl_test - Win32 Debug" (based on "Win32 (x86) Console Application")
+!MESSAGE "udp_proxy - Win32 Release" (based on "Win32 (x86) Console Application")
+!MESSAGE "udp_proxy - Win32 Debug" (based on "Win32 (x86) Console Application")
 !MESSAGE 
 
 # Begin Project
@@ -28,7 +28,7 @@
 CPP=cl.exe
 RSC=rc.exe
 
-!IF  "$(CFG)" == "ssl_test - Win32 Release"
+!IF  "$(CFG)" == "udp_proxy - Win32 Release"
 
 # PROP BASE Use_MFC 0
 # PROP BASE Use_Debug_Libraries 0
@@ -51,7 +51,7 @@
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib  kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
 # ADD LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib  kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
 
-!ELSEIF  "$(CFG)" == "ssl_test - Win32 Debug"
+!ELSEIF  "$(CFG)" == "udp_proxy - Win32 Debug"
 
 # PROP BASE Use_MFC 0
 # PROP BASE Use_Debug_Libraries 1
@@ -78,14 +78,14 @@
 
 # Begin Target
 
-# Name "ssl_test - Win32 Release"
-# Name "ssl_test - Win32 Debug"
+# Name "udp_proxy - Win32 Release"
+# Name "udp_proxy - Win32 Debug"
 # Begin Group "Source Files"
 
 # PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
 # Begin Source File
 
-SOURCE=..\..\programs\test\ssl_test.c
+SOURCE=..\..\programs\test\udp_proxy.c
 # ADD CPP /I "../../include"
 # End Source File
 # End Group