diff --git a/library/ssl_client.c b/library/ssl_client.c
index 925d0c2..ab897c4 100644
--- a/library/ssl_client.c
+++ b/library/ssl_client.c
@@ -37,26 +37,27 @@
 
 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
 MBEDTLS_CHECK_RETURN_CRITICAL
-static int ssl_write_hostname_ext( mbedtls_ssl_context *ssl,
-                                   unsigned char *buf,
-                                   const unsigned char *end,
-                                   size_t *olen )
+static int ssl_write_hostname_ext(mbedtls_ssl_context *ssl,
+                                  unsigned char *buf,
+                                  const unsigned char *end,
+                                  size_t *olen)
 {
     unsigned char *p = buf;
     size_t hostname_len;
 
     *olen = 0;
 
-    if( ssl->hostname == NULL )
-        return( 0 );
+    if (ssl->hostname == NULL) {
+        return 0;
+    }
 
-    MBEDTLS_SSL_DEBUG_MSG( 3,
-        ( "client hello, adding server name extension: %s",
-          ssl->hostname ) );
+    MBEDTLS_SSL_DEBUG_MSG(3,
+                          ("client hello, adding server name extension: %s",
+                           ssl->hostname));
 
-    hostname_len = strlen( ssl->hostname );
+    hostname_len = strlen(ssl->hostname);
 
-    MBEDTLS_SSL_CHK_BUF_PTR( p, end, hostname_len + 9 );
+    MBEDTLS_SSL_CHK_BUF_PTR(p, end, hostname_len + 9);
 
     /*
      * Sect. 3, RFC 6066 (TLS Extensions Definitions)
@@ -84,28 +85,28 @@
      * } ServerNameList;
      *
      */
-    MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SERVERNAME, p, 0 );
+    MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SERVERNAME, p, 0);
     p += 2;
 
-    MBEDTLS_PUT_UINT16_BE( hostname_len + 5, p, 0 );
+    MBEDTLS_PUT_UINT16_BE(hostname_len + 5, p, 0);
     p += 2;
 
-    MBEDTLS_PUT_UINT16_BE( hostname_len + 3, p, 0 );
+    MBEDTLS_PUT_UINT16_BE(hostname_len + 3, p, 0);
     p += 2;
 
-    *p++ = MBEDTLS_BYTE_0( MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME );
+    *p++ = MBEDTLS_BYTE_0(MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME);
 
-    MBEDTLS_PUT_UINT16_BE( hostname_len, p, 0 );
+    MBEDTLS_PUT_UINT16_BE(hostname_len, p, 0);
     p += 2;
 
-    memcpy( p, ssl->hostname, hostname_len );
+    memcpy(p, ssl->hostname, hostname_len);
 
     *olen = hostname_len + 9;
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
-    mbedtls_ssl_tls13_set_hs_sent_ext_mask( ssl, MBEDTLS_TLS_EXT_SERVERNAME );
+    mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_SERVERNAME);
 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
-    return( 0 );
+    return 0;
 }
 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
 
@@ -124,26 +125,27 @@
  *
  */
 MBEDTLS_CHECK_RETURN_CRITICAL
-static int ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
-                               unsigned char *buf,
-                               const unsigned char *end,
-                               size_t *out_len )
+static int ssl_write_alpn_ext(mbedtls_ssl_context *ssl,
+                              unsigned char *buf,
+                              const unsigned char *end,
+                              size_t *out_len)
 {
     unsigned char *p = buf;
 
     *out_len = 0;
 
-    if( ssl->conf->alpn_list == NULL )
-        return( 0 );
+    if (ssl->conf->alpn_list == NULL) {
+        return 0;
+    }
 
-    MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding alpn extension" ) );
+    MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, adding alpn extension"));
 
 
     /* Check we have enough space for the extension type (2 bytes), the
      * extension length (2 bytes) and the protocol_name_list length (2 bytes).
      */
-    MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
-    MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_ALPN, p, 0 );
+    MBEDTLS_SSL_CHK_BUF_PTR(p, end, 6);
+    MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ALPN, p, 0);
     /* Skip writing extension and list length for now */
     p += 6;
 
@@ -154,32 +156,31 @@
      *     ProtocolName protocol_name_list<2..2^16-1>
      * } ProtocolNameList;
      */
-    for( const char **cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
-    {
+    for (const char **cur = ssl->conf->alpn_list; *cur != NULL; cur++) {
         /*
          * mbedtls_ssl_conf_set_alpn_protocols() checked that the length of
          * protocol names is less than 255.
          */
-        size_t protocol_name_len = strlen( *cur );
+        size_t protocol_name_len = strlen(*cur);
 
-        MBEDTLS_SSL_CHK_BUF_PTR( p, end, 1 + protocol_name_len );
-        *p++ = (unsigned char)protocol_name_len;
-        memcpy( p, *cur, protocol_name_len );
+        MBEDTLS_SSL_CHK_BUF_PTR(p, end, 1 + protocol_name_len);
+        *p++ = (unsigned char) protocol_name_len;
+        memcpy(p, *cur, protocol_name_len);
         p += protocol_name_len;
     }
 
     *out_len = p - buf;
 
     /* List length = *out_len - 2 (ext_type) - 2 (ext_len) - 2 (list_len) */
-    MBEDTLS_PUT_UINT16_BE( *out_len - 6, buf, 4 );
+    MBEDTLS_PUT_UINT16_BE(*out_len - 6, buf, 4);
 
     /* Extension length = *out_len - 2 (ext_type) - 2 (ext_len) */
-    MBEDTLS_PUT_UINT16_BE( *out_len - 4, buf, 2 );
+    MBEDTLS_PUT_UINT16_BE(*out_len - 4, buf, 2);
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
-    mbedtls_ssl_tls13_set_hs_sent_ext_mask( ssl, MBEDTLS_TLS_EXT_ALPN );
+    mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_ALPN);
 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
-    return( 0 );
+    return 0;
 }
 #endif /* MBEDTLS_SSL_ALPN */
 
@@ -225,54 +226,52 @@
  * DHE groups are not supported yet.
  */
 MBEDTLS_CHECK_RETURN_CRITICAL
-static int ssl_write_supported_groups_ext( mbedtls_ssl_context *ssl,
-                                           unsigned char *buf,
-                                           const unsigned char *end,
-                                           size_t *out_len )
+static int ssl_write_supported_groups_ext(mbedtls_ssl_context *ssl,
+                                          unsigned char *buf,
+                                          const unsigned char *end,
+                                          size_t *out_len)
 {
-    unsigned char *p = buf ;
+    unsigned char *p = buf;
     unsigned char *named_group_list; /* Start of named_group_list */
     size_t named_group_list_len;     /* Length of named_group_list */
-    const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
+    const uint16_t *group_list = mbedtls_ssl_get_groups(ssl);
 
     *out_len = 0;
 
-    MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_groups extension" ) );
+    MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, adding supported_groups extension"));
 
     /* Check if we have space for header and length fields:
      * - extension_type            (2 bytes)
      * - extension_data_length     (2 bytes)
      * - named_group_list_length   (2 bytes)
      */
-    MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
+    MBEDTLS_SSL_CHK_BUF_PTR(p, end, 6);
     p += 6;
 
     named_group_list = p;
 
-    if( group_list == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_CONFIG );
+    if (group_list == NULL) {
+        return MBEDTLS_ERR_SSL_BAD_CONFIG;
+    }
 
-    for( ; *group_list != 0; group_list++ )
-    {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "got supported group(%04x)", *group_list ) );
+    for (; *group_list != 0; group_list++) {
+        MBEDTLS_SSL_DEBUG_MSG(1, ("got supported group(%04x)", *group_list));
 
 #if defined(MBEDTLS_ECP_C)
-        if( ( mbedtls_ssl_conf_is_tls13_enabled( ssl->conf ) &&
-              mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) ) ||
-            ( mbedtls_ssl_conf_is_tls12_enabled( ssl->conf ) &&
-              mbedtls_ssl_tls12_named_group_is_ecdhe( *group_list ) ) )
-        {
-            if( mbedtls_ssl_get_ecp_group_id_from_tls_id( *group_list ) ==
-                MBEDTLS_ECP_DP_NONE )
-            {
+        if ((mbedtls_ssl_conf_is_tls13_enabled(ssl->conf) &&
+             mbedtls_ssl_tls13_named_group_is_ecdhe(*group_list)) ||
+            (mbedtls_ssl_conf_is_tls12_enabled(ssl->conf) &&
+             mbedtls_ssl_tls12_named_group_is_ecdhe(*group_list))) {
+            if (mbedtls_ssl_get_ecp_group_id_from_tls_id(*group_list) ==
+                MBEDTLS_ECP_DP_NONE) {
                 continue;
             }
-            MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
-            MBEDTLS_PUT_UINT16_BE( *group_list, p, 0 );
+            MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
+            MBEDTLS_PUT_UINT16_BE(*group_list, p, 0);
             p += 2;
-            MBEDTLS_SSL_DEBUG_MSG( 3, ( "NamedGroup: %s ( %x )",
-                        mbedtls_ssl_get_curve_name_from_tls_id( *group_list ),
-                        *group_list ) );
+            MBEDTLS_SSL_DEBUG_MSG(3, ("NamedGroup: %s ( %x )",
+                                      mbedtls_ssl_get_curve_name_from_tls_id(*group_list),
+                                      *group_list));
         }
 #endif /* MBEDTLS_ECP_C */
         /* Add DHE groups here */
@@ -281,30 +280,29 @@
 
     /* Length of named_group_list */
     named_group_list_len = p - named_group_list;
-    if( named_group_list_len == 0 )
-    {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "No group available." ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+    if (named_group_list_len == 0) {
+        MBEDTLS_SSL_DEBUG_MSG(1, ("No group available."));
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
     }
 
     /* Write extension_type */
-    MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_GROUPS, buf, 0 );
+    MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SUPPORTED_GROUPS, buf, 0);
     /* Write extension_data_length */
-    MBEDTLS_PUT_UINT16_BE( named_group_list_len + 2, buf, 2 );
+    MBEDTLS_PUT_UINT16_BE(named_group_list_len + 2, buf, 2);
     /* Write length of named_group_list */
-    MBEDTLS_PUT_UINT16_BE( named_group_list_len, buf, 4 );
+    MBEDTLS_PUT_UINT16_BE(named_group_list_len, buf, 4);
 
-    MBEDTLS_SSL_DEBUG_BUF( 3, "Supported groups extension",
-                           buf + 4, named_group_list_len + 2 );
+    MBEDTLS_SSL_DEBUG_BUF(3, "Supported groups extension",
+                          buf + 4, named_group_list_len + 2);
 
     *out_len = p - buf;
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
     mbedtls_ssl_tls13_set_hs_sent_ext_mask(
-        ssl, MBEDTLS_TLS_EXT_SUPPORTED_GROUPS );
+        ssl, MBEDTLS_TLS_EXT_SUPPORTED_GROUPS);
 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
 
-    return( 0 );
+    return 0;
 }
 
 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
@@ -312,11 +310,11 @@
 
 MBEDTLS_CHECK_RETURN_CRITICAL
 static int ssl_write_client_hello_cipher_suites(
-            mbedtls_ssl_context *ssl,
-            unsigned char *buf,
-            unsigned char *end,
-            int *tls12_uses_ec,
-            size_t *out_len )
+    mbedtls_ssl_context *ssl,
+    unsigned char *buf,
+    unsigned char *end,
+    int *tls12_uses_ec,
+    size_t *out_len)
 {
     unsigned char *p = buf;
     const int *ciphersuite_list;
@@ -337,38 +335,38 @@
     ciphersuite_list = ssl->conf->ciphersuite_list;
 
     /* Check there is space for the cipher suite list length (2 bytes). */
-    MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
+    MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
     p += 2;
 
     /* Write cipher_suites
      * CipherSuite cipher_suites<2..2^16-2>;
      */
     cipher_suites = p;
-    for ( size_t i = 0; ciphersuite_list[i] != 0; i++ )
-    {
+    for (size_t i = 0; ciphersuite_list[i] != 0; i++) {
         int cipher_suite = ciphersuite_list[i];
         const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
 
-        ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite );
+        ciphersuite_info = mbedtls_ssl_ciphersuite_from_id(cipher_suite);
 
-        if( mbedtls_ssl_validate_ciphersuite( ssl, ciphersuite_info,
-                                              ssl->handshake->min_tls_version,
-                                              ssl->tls_version ) != 0 )
+        if (mbedtls_ssl_validate_ciphersuite(ssl, ciphersuite_info,
+                                             ssl->handshake->min_tls_version,
+                                             ssl->tls_version) != 0) {
             continue;
+        }
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
-    ( defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
-      defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) )
-        *tls12_uses_ec |= mbedtls_ssl_ciphersuite_uses_ec( ciphersuite_info );
+        (defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
+        defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED))
+        *tls12_uses_ec |= mbedtls_ssl_ciphersuite_uses_ec(ciphersuite_info);
 #endif
 
-        MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x, %s",
-                                    (unsigned int) cipher_suite,
-                                    ciphersuite_info->name ) );
+        MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, add ciphersuite: %04x, %s",
+                                  (unsigned int) cipher_suite,
+                                  ciphersuite_info->name));
 
         /* Check there is space for the cipher suite identifier (2 bytes). */
-        MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
-        MBEDTLS_PUT_UINT16_BE( cipher_suite, p, 0 );
+        MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
+        MBEDTLS_PUT_UINT16_BE(cipher_suite, p, 0);
         p += 2;
     }
 
@@ -377,27 +375,26 @@
      */
     int renegotiating = 0;
 #if defined(MBEDTLS_SSL_RENEGOTIATION)
-    renegotiating = ( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE );
+    renegotiating = (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE);
 #endif
-    if( !renegotiating )
-    {
-        MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding EMPTY_RENEGOTIATION_INFO_SCSV" ) );
-        MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
-        MBEDTLS_PUT_UINT16_BE( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO, p, 0 );
+    if (!renegotiating) {
+        MBEDTLS_SSL_DEBUG_MSG(3, ("adding EMPTY_RENEGOTIATION_INFO_SCSV"));
+        MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
+        MBEDTLS_PUT_UINT16_BE(MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO, p, 0);
         p += 2;
     }
 
     /* Write the cipher_suites length in number of bytes */
     cipher_suites_len = p - cipher_suites;
-    MBEDTLS_PUT_UINT16_BE( cipher_suites_len, buf, 0 );
-    MBEDTLS_SSL_DEBUG_MSG( 3,
-                           ( "client hello, got %" MBEDTLS_PRINTF_SIZET " cipher suites",
-                             cipher_suites_len/2 ) );
+    MBEDTLS_PUT_UINT16_BE(cipher_suites_len, buf, 0);
+    MBEDTLS_SSL_DEBUG_MSG(3,
+                          ("client hello, got %" MBEDTLS_PRINTF_SIZET " cipher suites",
+                           cipher_suites_len/2));
 
     /* Output the total length of cipher_suites field. */
     *out_len = p - buf;
 
-    return( 0 );
+    return 0;
 }
 
 /*
@@ -430,11 +427,11 @@
  * } ClientHello;
  */
 MBEDTLS_CHECK_RETURN_CRITICAL
-static int ssl_write_client_hello_body( mbedtls_ssl_context *ssl,
-                                        unsigned char *buf,
-                                        unsigned char *end,
-                                        size_t *out_len,
-                                        size_t *binders_len )
+static int ssl_write_client_hello_body(mbedtls_ssl_context *ssl,
+                                       unsigned char *buf,
+                                       unsigned char *end,
+                                       size_t *out_len,
+                                       size_t *binders_len)
 {
     int ret;
     mbedtls_ssl_handshake_params *handshake = ssl->handshake;
@@ -449,15 +446,15 @@
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
     unsigned char propose_tls12 =
-        ( handshake->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_2 )
+        (handshake->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_2)
         &&
-        ( MBEDTLS_SSL_VERSION_TLS1_2 <= ssl->tls_version );
+        (MBEDTLS_SSL_VERSION_TLS1_2 <= ssl->tls_version);
 #endif
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
     unsigned char propose_tls13 =
-        ( handshake->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_3 )
+        (handshake->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_3)
         &&
-        ( MBEDTLS_SSL_VERSION_TLS1_3 <= ssl->tls_version );
+        (MBEDTLS_SSL_VERSION_TLS1_3 <= ssl->tls_version);
 #endif
 
     /*
@@ -465,9 +462,9 @@
      *
      * In all cases this is the TLS 1.2 version.
      */
-    MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
-    mbedtls_ssl_write_version( p, ssl->conf->transport,
-                               MBEDTLS_SSL_VERSION_TLS1_2 );
+    MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
+    mbedtls_ssl_write_version(p, ssl->conf->transport,
+                              MBEDTLS_SSL_VERSION_TLS1_2);
     p += 2;
 
     /* ...
@@ -478,10 +475,10 @@
      * the handshake->randbytes buffer and are copied here into the output
      * buffer.
      */
-    MBEDTLS_SSL_CHK_BUF_PTR( p, end, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
-    memcpy( p, handshake->randbytes, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
-    MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes",
-                           p, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
+    MBEDTLS_SSL_CHK_BUF_PTR(p, end, MBEDTLS_CLIENT_HELLO_RANDOM_LEN);
+    memcpy(p, handshake->randbytes, MBEDTLS_CLIENT_HELLO_RANDOM_LEN);
+    MBEDTLS_SSL_DEBUG_BUF(3, "client hello, random bytes",
+                          p, MBEDTLS_CLIENT_HELLO_RANDOM_LEN);
     p += MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
 
     /* TLS 1.2:
@@ -500,13 +497,13 @@
      * ssl_prepare_client_hello() into the ssl->session_negotiate->id buffer
      * and are copied here into the output buffer.
      */
-    MBEDTLS_SSL_CHK_BUF_PTR( p, end, ssl->session_negotiate->id_len + 1 );
-    *p++ = (unsigned char)ssl->session_negotiate->id_len;
-    memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
+    MBEDTLS_SSL_CHK_BUF_PTR(p, end, ssl->session_negotiate->id_len + 1);
+    *p++ = (unsigned char) ssl->session_negotiate->id_len;
+    memcpy(p, ssl->session_negotiate->id, ssl->session_negotiate->id_len);
     p += ssl->session_negotiate->id_len;
 
-    MBEDTLS_SSL_DEBUG_BUF( 3, "session id", ssl->session_negotiate->id,
-                              ssl->session_negotiate->id_len );
+    MBEDTLS_SSL_DEBUG_BUF(3, "session id", ssl->session_negotiate->id,
+                          ssl->session_negotiate->id_len);
 
     /* DTLS 1.2 ONLY
      * ...
@@ -514,38 +511,36 @@
      * ...
      */
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_DTLS)
-    if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
-    {
+    if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
 #if !defined(MBEDTLS_SSL_PROTO_TLS1_3)
         uint8_t cookie_len = 0;
 #else
         uint16_t cookie_len = 0;
 #endif /* !MBEDTLS_SSL_PROTO_TLS1_3 */
 
-        if( handshake->cookie != NULL )
-        {
-            MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
-                                   handshake->cookie,
-                                   handshake->cookie_len );
+        if (handshake->cookie != NULL) {
+            MBEDTLS_SSL_DEBUG_BUF(3, "client hello, cookie",
+                                  handshake->cookie,
+                                  handshake->cookie_len);
             cookie_len = handshake->cookie_len;
         }
 
-        MBEDTLS_SSL_CHK_BUF_PTR( p, end, cookie_len + 1 );
-        *p++ = ( unsigned char )cookie_len;
-        if( cookie_len > 0 )
-        {
-            memcpy( p, handshake->cookie, cookie_len );
+        MBEDTLS_SSL_CHK_BUF_PTR(p, end, cookie_len + 1);
+        *p++ = (unsigned char) cookie_len;
+        if (cookie_len > 0) {
+            memcpy(p, handshake->cookie, cookie_len);
             p += cookie_len;
         }
     }
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_SSL_PROTO_DTLS */
 
     /* Write cipher_suites */
-    ret = ssl_write_client_hello_cipher_suites( ssl, p, end,
-                                                &tls12_uses_ec,
-                                                &output_len );
-    if( ret != 0 )
-        return( ret );
+    ret = ssl_write_client_hello_cipher_suites(ssl, p, end,
+                                               &tls12_uses_ec,
+                                               &output_len);
+    if (ret != 0) {
+        return ret;
+    }
     p += output_len;
 
     /* Write legacy_compression_methods (TLS 1.3) or
@@ -558,7 +553,7 @@
      * For TLS 1.2 ClientHello, for security reasons we do not support
      * compression anymore, thus also just the 'null' compression method.
      */
-    MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
+    MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
     *p++ = 1;
     *p++ = MBEDTLS_SSL_COMPRESS_NULL;
 
@@ -570,80 +565,82 @@
 #endif
 
     /* First write extensions, then the total length */
-    MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
+    MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
     p_extensions_len = p;
     p += 2;
 
 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
     /* Write server name extension */
-    ret = ssl_write_hostname_ext( ssl, p, end, &output_len );
-    if( ret != 0 )
-        return( ret );
+    ret = ssl_write_hostname_ext(ssl, p, end, &output_len);
+    if (ret != 0) {
+        return ret;
+    }
     p += output_len;
 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
 
 #if defined(MBEDTLS_SSL_ALPN)
-    ret = ssl_write_alpn_ext( ssl, p, end, &output_len );
-    if( ret != 0 )
-        return( ret );
+    ret = ssl_write_alpn_ext(ssl, p, end, &output_len);
+    if (ret != 0) {
+        return ret;
+    }
     p += output_len;
 #endif /* MBEDTLS_SSL_ALPN */
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
-    if( propose_tls13 )
-    {
-        ret = mbedtls_ssl_tls13_write_client_hello_exts( ssl, p, end,
-                                                         &output_len );
-        if( ret != 0 )
-            return( ret );
+    if (propose_tls13) {
+        ret = mbedtls_ssl_tls13_write_client_hello_exts(ssl, p, end,
+                                                        &output_len);
+        if (ret != 0) {
+            return ret;
+        }
         p += output_len;
     }
 #endif
 
 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
     defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
-    if(
+    if (
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
-        ( propose_tls13 &&
-          mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) ) ||
+        (propose_tls13 &&
+         mbedtls_ssl_conf_tls13_some_ephemeral_enabled(ssl)) ||
 #endif
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
-        ( propose_tls12 && tls12_uses_ec ) ||
+        (propose_tls12 && tls12_uses_ec) ||
 #endif
-        0 )
-    {
-        ret = ssl_write_supported_groups_ext( ssl, p, end, &output_len );
-        if( ret != 0 )
-            return( ret );
+        0) {
+        ret = ssl_write_supported_groups_ext(ssl, p, end, &output_len);
+        if (ret != 0) {
+            return ret;
+        }
         p += output_len;
     }
 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
 
 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
-    if(
+    if (
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
-        ( propose_tls13 && mbedtls_ssl_conf_tls13_ephemeral_enabled( ssl ) ) ||
+        (propose_tls13 && mbedtls_ssl_conf_tls13_ephemeral_enabled(ssl)) ||
 #endif
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
         propose_tls12 ||
 #endif
-       0 )
-    {
-        ret = mbedtls_ssl_write_sig_alg_ext( ssl, p, end, &output_len );
-        if( ret != 0 )
-            return( ret );
+        0) {
+        ret = mbedtls_ssl_write_sig_alg_ext(ssl, p, end, &output_len);
+        if (ret != 0) {
+            return ret;
+        }
         p += output_len;
     }
 #endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
-    if( propose_tls12 )
-    {
-        ret = mbedtls_ssl_tls12_write_client_hello_exts( ssl, p, end,
-                                                         tls12_uses_ec,
-                                                         &output_len );
-        if( ret != 0 )
-            return( ret );
+    if (propose_tls12) {
+        ret = mbedtls_ssl_tls12_write_client_hello_exts(ssl, p, end,
+                                                        tls12_uses_ec,
+                                                        &output_len);
+        if (ret != 0) {
+            return ret;
+        }
         p += output_len;
     }
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
@@ -652,12 +649,12 @@
     /* The "pre_shared_key" extension (RFC 8446 Section 4.2.11)
      * MUST be the last extension in the ClientHello.
      */
-    if( propose_tls13 && mbedtls_ssl_conf_tls13_some_psk_enabled( ssl ) )
-    {
+    if (propose_tls13 && mbedtls_ssl_conf_tls13_some_psk_enabled(ssl)) {
         ret = mbedtls_ssl_tls13_write_identities_of_pre_shared_key_ext(
-                  ssl, p, end, &output_len, binders_len );
-        if( ret != 0 )
-            return( ret );
+            ssl, p, end, &output_len, binders_len);
+        if (ret != 0) {
+            return ret;
+        }
         p += output_len;
     }
 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
@@ -665,28 +662,27 @@
     /* Write the length of the list of extensions. */
     extensions_len = p - p_extensions_len - 2;
 
-    if( extensions_len == 0 )
-       p = p_extensions_len;
-    else
-    {
-        MBEDTLS_PUT_UINT16_BE( extensions_len, p_extensions_len, 0 );
-        MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %" \
-                                    MBEDTLS_PRINTF_SIZET, extensions_len ) );
-        MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions",
-                                  p_extensions_len, extensions_len );
+    if (extensions_len == 0) {
+        p = p_extensions_len;
+    } else {
+        MBEDTLS_PUT_UINT16_BE(extensions_len, p_extensions_len, 0);
+        MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, total extension length: %" \
+                                  MBEDTLS_PRINTF_SIZET, extensions_len));
+        MBEDTLS_SSL_DEBUG_BUF(3, "client hello extensions",
+                              p_extensions_len, extensions_len);
     }
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
     MBEDTLS_SSL_PRINT_EXTS(
-        3, MBEDTLS_SSL_HS_CLIENT_HELLO, handshake->sent_extensions );
+        3, MBEDTLS_SSL_HS_CLIENT_HELLO, handshake->sent_extensions);
 #endif
 
     *out_len = p - buf;
-    return( 0 );
+    return 0;
 }
 
 MBEDTLS_CHECK_RETURN_CRITICAL
-static int ssl_generate_random( mbedtls_ssl_context *ssl )
+static int ssl_generate_random(mbedtls_ssl_context *ssl)
 {
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
     unsigned char *randbytes = ssl->handshake->randbytes;
@@ -704,52 +700,50 @@
      * TLS 1.3 case:
      * opaque Random[32];
      */
-    if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 )
-    {
+    if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2) {
 #if defined(MBEDTLS_HAVE_TIME)
-        mbedtls_time_t gmt_unix_time = mbedtls_time( NULL );
-        MBEDTLS_PUT_UINT32_BE( gmt_unix_time, randbytes, 0 );
+        mbedtls_time_t gmt_unix_time = mbedtls_time(NULL);
+        MBEDTLS_PUT_UINT32_BE(gmt_unix_time, randbytes, 0);
         gmt_unix_time_len = 4;
 
-        MBEDTLS_SSL_DEBUG_MSG( 3,
-            ( "client hello, current time: %" MBEDTLS_PRINTF_LONGLONG,
-               (long long) gmt_unix_time ) );
+        MBEDTLS_SSL_DEBUG_MSG(3,
+                              ("client hello, current time: %" MBEDTLS_PRINTF_LONGLONG,
+                               (long long) gmt_unix_time));
 #endif /* MBEDTLS_HAVE_TIME */
     }
 
-    ret = ssl->conf->f_rng( ssl->conf->p_rng,
-                            randbytes + gmt_unix_time_len,
-                            MBEDTLS_CLIENT_HELLO_RANDOM_LEN - gmt_unix_time_len );
-    return( ret );
+    ret = ssl->conf->f_rng(ssl->conf->p_rng,
+                           randbytes + gmt_unix_time_len,
+                           MBEDTLS_CLIENT_HELLO_RANDOM_LEN - gmt_unix_time_len);
+    return ret;
 }
 
 MBEDTLS_CHECK_RETURN_CRITICAL
-static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl )
+static int ssl_prepare_client_hello(mbedtls_ssl_context *ssl)
 {
     int ret;
     size_t session_id_len;
     mbedtls_ssl_session *session_negotiate = ssl->session_negotiate;
 
-    if( session_negotiate == NULL )
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+    if (session_negotiate == NULL) {
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
+    }
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
     defined(MBEDTLS_SSL_SESSION_TICKETS) && \
     defined(MBEDTLS_HAVE_TIME)
 
     /* Check if a tls13 ticket has been configured. */
-    if( ssl->handshake->resume != 0 &&
+    if (ssl->handshake->resume != 0 &&
         session_negotiate->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
-        session_negotiate->ticket != NULL )
-    {
-        mbedtls_time_t now = mbedtls_time( NULL );
-        uint64_t age = (uint64_t)( now - session_negotiate->ticket_received );
-        if( session_negotiate->ticket_received > now ||
-            age > session_negotiate->ticket_lifetime )
-        {
+        session_negotiate->ticket != NULL) {
+        mbedtls_time_t now = mbedtls_time(NULL);
+        uint64_t age = (uint64_t) (now - session_negotiate->ticket_received);
+        if (session_negotiate->ticket_received > now ||
+            age > session_negotiate->ticket_lifetime) {
             /* Without valid ticket, disable session resumption.*/
             MBEDTLS_SSL_DEBUG_MSG(
-                3, ( "Ticket expired, disable session resumption" ) );
+                3, ("Ticket expired, disable session resumption"));
             ssl->handshake->resume = 0;
         }
     }
@@ -757,30 +751,26 @@
           MBEDTLS_SSL_SESSION_TICKETS &&
           MBEDTLS_HAVE_TIME */
 
-    if( ssl->conf->f_rng == NULL )
-    {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided" ) );
-        return( MBEDTLS_ERR_SSL_NO_RNG );
+    if (ssl->conf->f_rng == NULL) {
+        MBEDTLS_SSL_DEBUG_MSG(1, ("no RNG provided"));
+        return MBEDTLS_ERR_SSL_NO_RNG;
     }
 
     /* Bet on the highest configured version if we are not in a TLS 1.2
      * renegotiation or session resumption.
      */
 #if defined(MBEDTLS_SSL_RENEGOTIATION)
-    if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
+    if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) {
         ssl->handshake->min_tls_version = ssl->tls_version;
-    else
+    } else
 #endif
     {
-        if( ssl->handshake->resume )
-        {
-             ssl->tls_version = session_negotiate->tls_version;
-             ssl->handshake->min_tls_version = ssl->tls_version;
-        }
-        else
-        {
-             ssl->tls_version = ssl->conf->max_tls_version;
-             ssl->handshake->min_tls_version = ssl->conf->min_tls_version;
+        if (ssl->handshake->resume) {
+            ssl->tls_version = session_negotiate->tls_version;
+            ssl->handshake->min_tls_version = ssl->tls_version;
+        } else {
+            ssl->tls_version = ssl->conf->max_tls_version;
+            ssl->handshake->min_tls_version = ssl->conf->min_tls_version;
         }
     }
 
@@ -790,15 +780,14 @@
      * (RFC 6347 4.2.1).
      */
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
-    if( ( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ) ||
-        ( ssl->handshake->cookie == NULL ) )
+    if ((ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) ||
+        (ssl->handshake->cookie == NULL))
 #endif
     {
-        ret = ssl_generate_random( ssl );
-        if( ret != 0 )
-        {
-            MBEDTLS_SSL_DEBUG_RET( 1, "Random bytes generation failed", ret );
-            return( ret );
+        ret = ssl_generate_random(ssl);
+        if (ret != 0) {
+            MBEDTLS_SSL_DEBUG_RET(1, "Random bytes generation failed", ret);
+            return ret;
         }
     }
 
@@ -811,32 +800,29 @@
     session_id_len = session_negotiate->id_len;
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
-    if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 )
-    {
-        if( session_id_len < 16 || session_id_len > 32 ||
+    if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2) {
+        if (session_id_len < 16 || session_id_len > 32 ||
 #if defined(MBEDTLS_SSL_RENEGOTIATION)
             ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ||
 #endif
-            ssl->handshake->resume == 0 )
-        {
+            ssl->handshake->resume == 0) {
             session_id_len = 0;
         }
 
 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
-    /*
-     * RFC 5077 section 3.4: "When presenting a ticket, the client MAY
-     * generate and include a Session ID in the TLS ClientHello."
-     */
+        /*
+         * RFC 5077 section 3.4: "When presenting a ticket, the client MAY
+         * generate and include a Session ID in the TLS ClientHello."
+         */
         int renegotiating = 0;
 #if defined(MBEDTLS_SSL_RENEGOTIATION)
-        if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
+        if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) {
             renegotiating = 1;
+        }
 #endif
-        if( !renegotiating )
-        {
-            if( ( session_negotiate->ticket != NULL ) &&
-                ( session_negotiate->ticket_len != 0 ) )
-            {
+        if (!renegotiating) {
+            if ((session_negotiate->ticket != NULL) &&
+                (session_negotiate->ticket_len != 0)) {
                 session_id_len = 32;
             }
         }
@@ -845,8 +831,7 @@
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
 
 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
-    if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
-    {
+    if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
         /*
          * Create a legacy session identifier for the purpose of middlebox
          * compatibility only if one has not been created already, which is
@@ -867,18 +852,15 @@
     }
 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
 
-    if( session_id_len != session_negotiate->id_len )
-    {
+    if (session_id_len != session_negotiate->id_len) {
         session_negotiate->id_len = session_id_len;
-        if( session_id_len > 0 )
-        {
-            ret = ssl->conf->f_rng( ssl->conf->p_rng,
-                                    session_negotiate->id,
-                                    session_id_len );
-            if( ret != 0 )
-            {
-                MBEDTLS_SSL_DEBUG_RET( 1, "creating session id failed", ret );
-                return( ret );
+        if (session_id_len > 0) {
+            ret = ssl->conf->f_rng(ssl->conf->p_rng,
+                                   session_negotiate->id,
+                                   session_id_len);
+            if (ret != 0) {
+                MBEDTLS_SSL_DEBUG_RET(1, "creating session id failed", ret);
+                return ret;
             }
         }
     }
@@ -886,64 +868,58 @@
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
     defined(MBEDTLS_SSL_SESSION_TICKETS) && \
     defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
-    if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3  &&
-        ssl->handshake->resume )
-    {
+    if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3  &&
+        ssl->handshake->resume) {
         int hostname_mismatch = ssl->hostname != NULL ||
                                 session_negotiate->hostname != NULL;
-        if( ssl->hostname != NULL && session_negotiate->hostname != NULL )
-        {
+        if (ssl->hostname != NULL && session_negotiate->hostname != NULL) {
             hostname_mismatch = strcmp(
-                ssl->hostname, session_negotiate->hostname ) != 0;
+                ssl->hostname, session_negotiate->hostname) != 0;
         }
 
-        if( hostname_mismatch )
-        {
+        if (hostname_mismatch) {
             MBEDTLS_SSL_DEBUG_MSG(
-                1, ( "Hostname mismatch the session ticket, "
-                     "disable session resumption." ) );
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+                1, ("Hostname mismatch the session ticket, "
+                    "disable session resumption."));
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
         }
-    }
-    else
-    {
-        return mbedtls_ssl_session_set_hostname( session_negotiate,
-                                                 ssl->hostname );
+    } else {
+        return mbedtls_ssl_session_set_hostname(session_negotiate,
+                                                ssl->hostname);
     }
 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
           MBEDTLS_SSL_SESSION_TICKETS &&
           MBEDTLS_SSL_SERVER_NAME_INDICATION */
 
-    return( 0 );
+    return 0;
 }
 /*
  * Write ClientHello handshake message.
  * Handler for MBEDTLS_SSL_CLIENT_HELLO
  */
-int mbedtls_ssl_write_client_hello( mbedtls_ssl_context *ssl )
+int mbedtls_ssl_write_client_hello(mbedtls_ssl_context *ssl)
 {
     int ret = 0;
     unsigned char *buf;
     size_t buf_len, msg_len, binders_len;
 
-    MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
+    MBEDTLS_SSL_DEBUG_MSG(2, ("=> write client hello"));
 
-    MBEDTLS_SSL_PROC_CHK( ssl_prepare_client_hello( ssl ) );
+    MBEDTLS_SSL_PROC_CHK(ssl_prepare_client_hello(ssl));
 
-    MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_start_handshake_msg(
-                                ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
-                                &buf, &buf_len ) );
+    MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
+                             ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
+                             &buf, &buf_len));
 
-    MBEDTLS_SSL_PROC_CHK( ssl_write_client_hello_body( ssl, buf,
-                                                       buf + buf_len,
-                                                       &msg_len,
-                                                       &binders_len ) );
+    MBEDTLS_SSL_PROC_CHK(ssl_write_client_hello_body(ssl, buf,
+                                                     buf + buf_len,
+                                                     &msg_len,
+                                                     &binders_len));
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_DTLS)
-    if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
-    {
+    if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
         ssl->out_msglen = msg_len + 4;
-        mbedtls_ssl_send_flight_completed( ssl );
+        mbedtls_ssl_send_flight_completed(ssl);
 
         /*
          * The two functions below may try to send data on the network and
@@ -954,48 +930,44 @@
          * that we will not write and send again a ClientHello when we
          * eventually succeed in sending the pending data.
          */
-        mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_HELLO );
+        mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_HELLO);
 
-        if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
-        {
-            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
-            return( ret );
+        if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
+            MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
+            return ret;
         }
 
-        if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
-        {
-            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
-            return( ret );
+        if ((ret = mbedtls_ssl_flight_transmit(ssl)) != 0) {
+            MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_flight_transmit", ret);
+            return ret;
         }
-    }
-    else
+    } else
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_SSL_PROTO_DTLS */
     {
 
-        mbedtls_ssl_add_hs_hdr_to_checksum( ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
-                                            msg_len );
-        ssl->handshake->update_checksum( ssl, buf, msg_len - binders_len );
+        mbedtls_ssl_add_hs_hdr_to_checksum(ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
+                                           msg_len);
+        ssl->handshake->update_checksum(ssl, buf, msg_len - binders_len);
 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
-        if( binders_len > 0 )
-        {
+        if (binders_len > 0) {
             MBEDTLS_SSL_PROC_CHK(
                 mbedtls_ssl_tls13_write_binders_of_pre_shared_key_ext(
-                      ssl, buf + msg_len - binders_len, buf + msg_len ) );
-            ssl->handshake->update_checksum( ssl, buf + msg_len - binders_len,
-                                             binders_len );
+                    ssl, buf + msg_len - binders_len, buf + msg_len));
+            ssl->handshake->update_checksum(ssl, buf + msg_len - binders_len,
+                                            binders_len);
         }
 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
 
-        MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_finish_handshake_msg( ssl,
-                                                                buf_len,
-                                                                msg_len ) );
-        mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_HELLO );
+        MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(ssl,
+                                                              buf_len,
+                                                              msg_len));
+        mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_HELLO);
     }
 
 
 cleanup:
 
-    MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
+    MBEDTLS_SSL_DEBUG_MSG(2, ("<= write client hello"));
     return ret;
 }