early-access version 1255

externals/mbedtls/tests/scripts/basic-build-test.sh

@@ -0,0 +1,219 @@
+#!/bin/sh
+
+# basic-build-tests.sh
+#
+# This file is part of mbed TLS (https://tls.mbed.org)
+#
+# Copyright (c) 2016, ARM Limited, All Rights Reserved
+#
+# Purpose
+#
+# Executes the basic test suites, captures the results, and generates a simple
+# test report and code coverage report.
+#
+# The tests include:
+#   * Unit tests                - executed using tests/scripts/run-test-suite.pl
+#   * Self-tests                - executed using the test suites above
+#   * System tests              - executed using tests/ssl-opt.sh
+#   * Interoperability tests    - executed using tests/compat.sh
+#
+# The tests focus on functionality and do not consider performance.
+#
+# Note the tests self-adapt due to configurations in include/mbedtls/config.h
+# which can lead to some tests being skipped, and can cause the number of
+# available tests to fluctuate.
+#
+# This script has been written to be generic and should work on any shell.
+#
+# Usage: basic-build-tests.sh
+#
+
+# Abort on errors (and uninitiliased variables)
+set -eu
+
+if [ -d library -a -d include -a -d tests ]; then :; else
+    echo "Must be run from mbed TLS root" >&2
+    exit 1
+fi
+
+: ${OPENSSL:="openssl"}
+: ${OPENSSL_LEGACY:="$OPENSSL"}
+: ${GNUTLS_CLI:="gnutls-cli"}
+: ${GNUTLS_SERV:="gnutls-serv"}
+: ${GNUTLS_LEGACY_CLI:="$GNUTLS_CLI"}
+: ${GNUTLS_LEGACY_SERV:="$GNUTLS_SERV"}
+
+# To avoid setting OpenSSL and GnuTLS for each call to compat.sh and ssl-opt.sh
+# we just export the variables they require
+export OPENSSL_CMD="$OPENSSL"
+export GNUTLS_CLI="$GNUTLS_CLI"
+export GNUTLS_SERV="$GNUTLS_SERV"
+
+CONFIG_H='include/mbedtls/config.h'
+CONFIG_BAK="$CONFIG_H.bak"
+
+# Step 0 - print build environment info
+OPENSSL="$OPENSSL"                           \
+    OPENSSL_LEGACY="$OPENSSL_LEGACY"         \
+    GNUTLS_CLI="$GNUTLS_CLI"                 \
+    GNUTLS_SERV="$GNUTLS_SERV"               \
+    GNUTLS_LEGACY_CLI="$GNUTLS_LEGACY_CLI"   \
+    GNUTLS_LEGACY_SERV="$GNUTLS_LEGACY_SERV" \
+    scripts/output_env.sh
+echo
+
+# Step 1 - Make and instrumented build for code coverage
+export CFLAGS=' --coverage -g3 -O0 '
+make clean
+cp "$CONFIG_H" "$CONFIG_BAK"
+scripts/config.pl full
+scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE
+make -j
+
+
+# Step 2 - Execute the tests
+TEST_OUTPUT=out_${PPID}
+cd tests
+
+# Step 2a - Unit Tests
+perl scripts/run-test-suites.pl -v |tee unit-test-$TEST_OUTPUT
+echo
+
+# Step 2b - System Tests
+sh ssl-opt.sh |tee sys-test-$TEST_OUTPUT
+echo
+
+# Step 2c - Compatibility tests
+sh compat.sh -m 'tls1 tls1_1 tls1_2 dtls1 dtls1_2' | \
+    tee compat-test-$TEST_OUTPUT
+OPENSSL_CMD="$OPENSSL_LEGACY"                               \
+    sh compat.sh -m 'ssl3' |tee -a compat-test-$TEST_OUTPUT
+OPENSSL_CMD="$OPENSSL_LEGACY"                                       \
+    GNUTLS_CLI="$GNUTLS_LEGACY_CLI"                                 \
+    GNUTLS_SERV="$GNUTLS_LEGACY_SERV"                               \
+    sh compat.sh -e '3DES\|DES-CBC3' -f 'NULL\|DES\|RC4\|ARCFOUR' | \
+    tee -a compat-test-$TEST_OUTPUT
+echo
+
+# Step 3 - Process the coverage report
+cd ..
+make lcov |tee tests/cov-$TEST_OUTPUT
+
+
+# Step 4 - Summarise the test report
+echo
+echo "========================================================================="
+echo "Test Report Summary"
+echo
+
+cd tests
+
+# Step 4a - Unit tests
+echo "Unit tests - tests/scripts/run-test-suites.pl"
+
+PASSED_TESTS=$(tail -n6 unit-test-$TEST_OUTPUT|sed -n -e 's/test cases passed :[\t]*\([0-9]*\)/\1/p'| tr -d ' ')
+SKIPPED_TESTS=$(tail -n6 unit-test-$TEST_OUTPUT|sed -n -e 's/skipped :[ \t]*\([0-9]*\)/\1/p'| tr -d ' ')
+TOTAL_SUITES=$(tail -n6 unit-test-$TEST_OUTPUT|sed -n -e 's/.* (\([0-9]*\) .*, [0-9]* tests run)/\1/p'| tr -d ' ')
+FAILED_TESTS=$(tail -n6 unit-test-$TEST_OUTPUT|sed -n -e 's/failed :[\t]*\([0-9]*\)/\1/p' |tr -d ' ')
+
+echo "No test suites     : $TOTAL_SUITES"
+echo "Passed             : $PASSED_TESTS"
+echo "Failed             : $FAILED_TESTS"
+echo "Skipped            : $SKIPPED_TESTS"
+echo "Total exec'd tests : $(($PASSED_TESTS + $FAILED_TESTS))"
+echo "Total avail tests  : $(($PASSED_TESTS + $FAILED_TESTS + $SKIPPED_TESTS))"
+echo
+
+TOTAL_PASS=$PASSED_TESTS
+TOTAL_FAIL=$FAILED_TESTS
+TOTAL_SKIP=$SKIPPED_TESTS
+TOTAL_AVAIL=$(($PASSED_TESTS + $FAILED_TESTS + $SKIPPED_TESTS))
+TOTAL_EXED=$(($PASSED_TESTS + $FAILED_TESTS))
+
+# Step 4b - TLS Options tests
+echo "TLS Options tests - tests/ssl-opt.sh"
+
+PASSED_TESTS=$(tail -n5 sys-test-$TEST_OUTPUT|sed -n -e 's/.* (\([0-9]*\) \/ [0-9]* tests ([0-9]* skipped))$/\1/p')
+SKIPPED_TESTS=$(tail -n5 sys-test-$TEST_OUTPUT|sed -n -e 's/.* ([0-9]* \/ [0-9]* tests (\([0-9]*\) skipped))$/\1/p')
+TOTAL_TESTS=$(tail -n5 sys-test-$TEST_OUTPUT|sed -n -e 's/.* ([0-9]* \/ \([0-9]*\) tests ([0-9]* skipped))$/\1/p')
+FAILED_TESTS=$(($TOTAL_TESTS - $PASSED_TESTS))
+
+echo "Passed             : $PASSED_TESTS"
+echo "Failed             : $FAILED_TESTS"
+echo "Skipped            : $SKIPPED_TESTS"
+echo "Total exec'd tests : $TOTAL_TESTS"
+echo "Total avail tests  : $(($TOTAL_TESTS + $SKIPPED_TESTS))"
+echo
+
+TOTAL_PASS=$(($TOTAL_PASS+$PASSED_TESTS))
+TOTAL_FAIL=$(($TOTAL_FAIL+$FAILED_TESTS))
+TOTAL_SKIP=$(($TOTAL_SKIP+$SKIPPED_TESTS))
+TOTAL_AVAIL=$(($TOTAL_AVAIL + $TOTAL_TESTS + $SKIPPED_TESTS))
+TOTAL_EXED=$(($TOTAL_EXED + $TOTAL_TESTS))
+
+
+# Step 4c - System Compatibility tests
+echo "System/Compatibility tests - tests/compat.sh"
+
+PASSED_TESTS=$(cat compat-test-$TEST_OUTPUT | sed -n -e 's/.* (\([0-9]*\) \/ [0-9]* tests ([0-9]* skipped))$/\1/p' | awk 'BEGIN{ s = 0 } { s += $1 } END{ print s }')
+SKIPPED_TESTS=$(cat compat-test-$TEST_OUTPUT | sed -n -e 's/.* ([0-9]* \/ [0-9]* tests (\([0-9]*\) skipped))$/\1/p' | awk 'BEGIN{ s = 0 } { s += $1 } END{ print s }')
+EXED_TESTS=$(cat compat-test-$TEST_OUTPUT | sed -n -e 's/.* ([0-9]* \/ \([0-9]*\) tests ([0-9]* skipped))$/\1/p' | awk 'BEGIN{ s = 0 } { s += $1 } END{ print s }')
+FAILED_TESTS=$(($EXED_TESTS - $PASSED_TESTS))
+
+echo "Passed             : $PASSED_TESTS"
+echo "Failed             : $FAILED_TESTS"
+echo "Skipped            : $SKIPPED_TESTS"
+echo "Total exec'd tests : $EXED_TESTS"
+echo "Total avail tests  : $(($EXED_TESTS + $SKIPPED_TESTS))"
+echo
+
+TOTAL_PASS=$(($TOTAL_PASS+$PASSED_TESTS))
+TOTAL_FAIL=$(($TOTAL_FAIL+$FAILED_TESTS))
+TOTAL_SKIP=$(($TOTAL_SKIP+$SKIPPED_TESTS))
+TOTAL_AVAIL=$(($TOTAL_AVAIL + $EXED_TESTS + $SKIPPED_TESTS))
+TOTAL_EXED=$(($TOTAL_EXED + $EXED_TESTS))
+
+
+# Step 4d - Grand totals
+echo "-------------------------------------------------------------------------"
+echo "Total tests"
+
+echo "Total Passed       : $TOTAL_PASS"
+echo "Total Failed       : $TOTAL_FAIL"
+echo "Total Skipped      : $TOTAL_SKIP"
+echo "Total exec'd tests : $TOTAL_EXED"
+echo "Total avail tests  : $TOTAL_AVAIL"
+echo
+
+
+# Step 4e - Coverage
+echo "Coverage"
+
+LINES_TESTED=$(tail -n3 cov-$TEST_OUTPUT|sed -n -e 's/  lines......: [0-9]*.[0-9]% (\([0-9]*\) of [0-9]* lines)/\1/p')
+LINES_TOTAL=$(tail -n3 cov-$TEST_OUTPUT|sed -n -e 's/  lines......: [0-9]*.[0-9]% ([0-9]* of \([0-9]*\) lines)/\1/p')
+FUNCS_TESTED=$(tail -n3 cov-$TEST_OUTPUT|sed -n -e 's/  functions..: [0-9]*.[0-9]% (\([0-9]*\) of [0-9]* functions)$/\1/p')
+FUNCS_TOTAL=$(tail -n3 cov-$TEST_OUTPUT|sed -n -e 's/  functions..: [0-9]*.[0-9]% ([0-9]* of \([0-9]*\) functions)$/\1/p')
+
+LINES_PERCENT=$((1000*$LINES_TESTED/$LINES_TOTAL))
+LINES_PERCENT="$(($LINES_PERCENT/10)).$(($LINES_PERCENT-($LINES_PERCENT/10)*10))"
+
+FUNCS_PERCENT=$((1000*$FUNCS_TESTED/$FUNCS_TOTAL))
+FUNCS_PERCENT="$(($FUNCS_PERCENT/10)).$(($FUNCS_PERCENT-($FUNCS_PERCENT/10)*10))"
+
+echo "Lines Tested       : $LINES_TESTED of $LINES_TOTAL $LINES_PERCENT%"
+echo "Functions Tested   : $FUNCS_TESTED of $FUNCS_TOTAL $FUNCS_PERCENT%"
+echo
+
+
+rm unit-test-$TEST_OUTPUT
+rm sys-test-$TEST_OUTPUT
+rm compat-test-$TEST_OUTPUT
+rm cov-$TEST_OUTPUT
+
+cd ..
+
+make clean
+
+if [ -f "$CONFIG_BAK" ]; then
+    mv "$CONFIG_BAK" "$CONFIG_H"
+fi

externals/mbedtls/tests/scripts/check-doxy-blocks.pl

@@ -0,0 +1,64 @@
+#!/usr/bin/env perl
+
+# Detect comment blocks that are likely meant to be doxygen blocks but aren't.
+#
+# More precisely, look for normal comment block containing '\'.
+# Of course one could use doxygen warnings, eg with:
+#   sed -e '/EXTRACT/s/YES/NO/' doxygen/mbedtls.doxyfile | doxygen -
+# but that would warn about any undocumented item, while our goal is to find
+# items that are documented, but not marked as such by mistake.
+
+use warnings;
+use strict;
+use File::Basename;
+
+# C/header files in the following directories will be checked
+my @directories = qw(include/mbedtls library doxygen/input);
+
+# very naive pattern to find directives:
+# everything with a backslach except '\0' and backslash at EOL
+my $doxy_re = qr/\\(?!0|\n)/;
+
+# Return an error code to the environment if a potential error in the
+# source code is found.
+my $exit_code = 0;
+
+sub check_file {
+    my ($fname) = @_;
+    open my $fh, '<', $fname or die "Failed to open '$fname': $!\n";
+
+    # first line of the last normal comment block,
+    # or 0 if not in a normal comment block
+    my $block_start = 0;
+    while (my $line = <$fh>) {
+        $block_start = $.   if $line =~ m/\/\*(?![*!])/;
+        $block_start = 0    if $line =~ m/\*\//;
+        if ($block_start and $line =~ m/$doxy_re/) {
+            print "$fname:$block_start: directive on line $.\n";
+            $block_start = 0; # report only one directive per block
+            $exit_code = 1;
+        }
+    }
+
+    close $fh;
+}
+
+sub check_dir {
+    my ($dirname) = @_;
+    for my $file (<$dirname/*.[ch]>) {
+        check_file($file);
+    }
+}
+
+# Check that the script is being run from the project's root directory.
+for my $dir (@directories) {
+    if (! -d $dir) {
+        die "This script must be run from the mbed TLS root directory";
+    } else {
+        check_dir($dir)
+    }
+}
+
+exit $exit_code;
+
+__END__

externals/mbedtls/tests/scripts/check-files.py

@@ -0,0 +1,223 @@
+#!/usr/bin/env python3
+"""
+This file is part of Mbed TLS (https://tls.mbed.org)
+
+Copyright (c) 2018, Arm Limited, All Rights Reserved
+
+Purpose
+
+This script checks the current state of the source code for minor issues,
+including incorrect file permissions, presence of tabs, non-Unix line endings,
+trailing whitespace, presence of UTF-8 BOM, and TODO comments.
+Note: requires python 3, must be run from Mbed TLS root.
+"""
+
+import os
+import argparse
+import logging
+import codecs
+import sys
+
+
+class IssueTracker(object):
+    """Base class for issue tracking. Issues should inherit from this and
+    overwrite either issue_with_line if they check the file line by line, or
+    overwrite check_file_for_issue if they check the file as a whole."""
+
+    def __init__(self):
+        self.heading = ""
+        self.files_exemptions = []
+        self.files_with_issues = {}
+
+    def should_check_file(self, filepath):
+        for files_exemption in self.files_exemptions:
+            if filepath.endswith(files_exemption):
+                return False
+        return True
+
+    def issue_with_line(self, line):
+        raise NotImplementedError
+
+    def check_file_for_issue(self, filepath):
+        with open(filepath, "rb") as f:
+            for i, line in enumerate(iter(f.readline, b"")):
+                self.check_file_line(filepath, line, i + 1)
+
+    def check_file_line(self, filepath, line, line_number):
+        if self.issue_with_line(line):
+            if filepath not in self.files_with_issues.keys():
+                self.files_with_issues[filepath] = []
+            self.files_with_issues[filepath].append(line_number)
+
+    def output_file_issues(self, logger):
+        if self.files_with_issues.values():
+            logger.info(self.heading)
+            for filename, lines in sorted(self.files_with_issues.items()):
+                if lines:
+                    logger.info("{}: {}".format(
+                        filename, ", ".join(str(x) for x in lines)
+                    ))
+                else:
+                    logger.info(filename)
+            logger.info("")
+
+
+class PermissionIssueTracker(IssueTracker):
+
+    def __init__(self):
+        super().__init__()
+        self.heading = "Incorrect permissions:"
+
+    def check_file_for_issue(self, filepath):
+        if not (os.access(filepath, os.X_OK) ==
+                filepath.endswith((".sh", ".pl", ".py"))):
+            self.files_with_issues[filepath] = None
+
+
+class EndOfFileNewlineIssueTracker(IssueTracker):
+
+    def __init__(self):
+        super().__init__()
+        self.heading = "Missing newline at end of file:"
+
+    def check_file_for_issue(self, filepath):
+        with open(filepath, "rb") as f:
+            if not f.read().endswith(b"\n"):
+                self.files_with_issues[filepath] = None
+
+
+class Utf8BomIssueTracker(IssueTracker):
+
+    def __init__(self):
+        super().__init__()
+        self.heading = "UTF-8 BOM present:"
+
+    def check_file_for_issue(self, filepath):
+        with open(filepath, "rb") as f:
+            if f.read().startswith(codecs.BOM_UTF8):
+                self.files_with_issues[filepath] = None
+
+
+class LineEndingIssueTracker(IssueTracker):
+
+    def __init__(self):
+        super().__init__()
+        self.heading = "Non Unix line endings:"
+
+    def issue_with_line(self, line):
+        return b"\r" in line
+
+
+class TrailingWhitespaceIssueTracker(IssueTracker):
+
+    def __init__(self):
+        super().__init__()
+        self.heading = "Trailing whitespace:"
+        self.files_exemptions = [".md"]
+
+    def issue_with_line(self, line):
+        return line.rstrip(b"\r\n") != line.rstrip()
+
+
+class TabIssueTracker(IssueTracker):
+
+    def __init__(self):
+        super().__init__()
+        self.heading = "Tabs present:"
+        self.files_exemptions = [
+            "Makefile", "generate_visualc_files.pl"
+        ]
+
+    def issue_with_line(self, line):
+        return b"\t" in line
+
+
+class TodoIssueTracker(IssueTracker):
+
+    def __init__(self):
+        super().__init__()
+        self.heading = "TODO present:"
+        self.files_exemptions = [
+            __file__, "benchmark.c", "pull_request_template.md"
+        ]
+
+    def issue_with_line(self, line):
+        return b"todo" in line.lower()
+
+
+class IntegrityChecker(object):
+
+    def __init__(self, log_file):
+        self.check_repo_path()
+        self.logger = None
+        self.setup_logger(log_file)
+        self.files_to_check = (
+            ".c", ".h", ".sh", ".pl", ".py", ".md", ".function", ".data",
+            "Makefile", "CMakeLists.txt", "ChangeLog"
+        )
+        self.issues_to_check = [
+            PermissionIssueTracker(),
+            EndOfFileNewlineIssueTracker(),
+            Utf8BomIssueTracker(),
+            LineEndingIssueTracker(),
+            TrailingWhitespaceIssueTracker(),
+            TabIssueTracker(),
+            TodoIssueTracker(),
+        ]
+
+    def check_repo_path(self):
+        if not all(os.path.isdir(d) for d in ["include", "library", "tests"]):
+            raise Exception("Must be run from Mbed TLS root")
+
+    def setup_logger(self, log_file, level=logging.INFO):
+        self.logger = logging.getLogger()
+        self.logger.setLevel(level)
+        if log_file:
+            handler = logging.FileHandler(log_file)
+            self.logger.addHandler(handler)
+        else:
+            console = logging.StreamHandler()
+            self.logger.addHandler(console)
+
+    def check_files(self):
+        for root, dirs, files in sorted(os.walk(".")):
+            for filename in sorted(files):
+                filepath = os.path.join(root, filename)
+                if (os.path.join("yotta", "module") in filepath or
+                        not filepath.endswith(self.files_to_check)):
+                    continue
+                for issue_to_check in self.issues_to_check:
+                    if issue_to_check.should_check_file(filepath):
+                        issue_to_check.check_file_for_issue(filepath)
+
+    def output_issues(self):
+        integrity_return_code = 0
+        for issue_to_check in self.issues_to_check:
+            if issue_to_check.files_with_issues:
+                integrity_return_code = 1
+            issue_to_check.output_file_issues(self.logger)
+        return integrity_return_code
+
+
+def run_main():
+    parser = argparse.ArgumentParser(
+        description=(
+            "This script checks the current state of the source code for "
+            "minor issues, including incorrect file permissions, "
+            "presence of tabs, non-Unix line endings, trailing whitespace, "
+            "presence of UTF-8 BOM, and TODO comments. "
+            "Note: requires python 3, must be run from Mbed TLS root."
+        )
+    )
+    parser.add_argument(
+        "-l", "--log_file", type=str, help="path to optional output log",
+    )
+    check_args = parser.parse_args()
+    integrity_check = IntegrityChecker(check_args.log_file)
+    integrity_check.check_files()
+    return_code = integrity_check.output_issues()
+    sys.exit(return_code)
+
+
+if __name__ == "__main__":
+    run_main()

externals/mbedtls/tests/scripts/check-generated-files.sh

@@ -0,0 +1,69 @@
+#! /usr/bin/env sh
+
+# This file is part of mbed TLS (https://tls.mbed.org)
+#
+# Copyright (c) 2018, ARM Limited, All Rights Reserved
+#
+# Purpose
+#
+# Check if generated files are up-to-date.
+
+set -eu
+
+if [ -d library -a -d include -a -d tests ]; then :; else
+    echo "Must be run from mbed TLS root" >&2
+    exit 1
+fi
+
+check()
+{
+    SCRIPT=$1
+    TO_CHECK=$2
+    PATTERN=""
+    FILES=""
+
+    if [ -d $TO_CHECK ]; then
+        for FILE in $TO_CHECK/*; do
+            FILES="$FILE $FILES"
+        done
+    else
+        FILES=$TO_CHECK
+    fi
+
+    for FILE in $FILES; do
+        cp $FILE $FILE.bak
+    done
+
+    $SCRIPT
+
+    # Compare the script output to the old files and remove backups
+    for FILE in $FILES; do
+        if ! diff $FILE $FILE.bak >/dev/null 2>&1; then
+            echo "'$FILE' was either modified or deleted by '$SCRIPT'"
+            exit 1
+        fi
+        mv $FILE.bak $FILE
+
+        if [ -d $TO_CHECK ]; then
+            # Create a grep regular expression that we can check against the
+            # directory contents to test whether new files have been created
+            if [ -z $PATTERN ]; then
+                PATTERN="$(basename $FILE)"
+            else
+                PATTERN="$PATTERN\|$(basename $FILE)"
+            fi
+        fi
+    done
+
+    if [ -d $TO_CHECK ]; then
+        # Check if there are any new files
+        if ls -1 $TO_CHECK | grep -v "$PATTERN" >/dev/null 2>&1; then
+            echo "Files were created by '$SCRIPT'"
+            exit 1
+        fi
+    fi
+}
+
+check scripts/generate_errors.pl library/error.c
+check scripts/generate_features.pl library/version_features.c
+check scripts/generate_visualc_files.pl visualc/VS2010

externals/mbedtls/tests/scripts/check-names.sh

@@ -0,0 +1,93 @@
+#!/bin/sh
+#
+# This file is part of mbed TLS (https://tls.mbed.org)
+#
+# Copyright (c) 2015-2016, ARM Limited, All Rights Reserved
+#
+# Purpose
+#
+# This script confirms that the naming of all symbols and identifiers in mbed
+# TLS are consistent with the house style and are also self-consistent.
+#
+set -eu
+
+if grep --version|head -n1|grep GNU >/dev/null; then :; else
+    echo "This script requires GNU grep.">&2
+    exit 1
+fi
+
+printf "Analysing source code...\n"
+
+tests/scripts/list-macros.sh
+tests/scripts/list-enum-consts.pl
+tests/scripts/list-identifiers.sh
+tests/scripts/list-symbols.sh
+
+FAIL=0
+
+printf "\nExported symbols declared in header: "
+UNDECLARED=$( diff exported-symbols identifiers | sed -n -e 's/^< //p' )
+if [ "x$UNDECLARED" = "x" ]; then
+    echo "PASS"
+else
+    echo "FAIL"
+    echo "$UNDECLARED"
+    FAIL=1
+fi
+
+diff macros identifiers | sed -n -e 's/< //p' > actual-macros
+
+for THING in actual-macros enum-consts; do
+    printf "Names of $THING: "
+    test -r $THING
+    BAD=$( grep -v '^MBEDTLS_[0-9A-Z_]*[0-9A-Z]$\|^YOTTA_[0-9A-Z_]*[0-9A-Z]$' $THING || true )
+    if [ "x$BAD" = "x" ]; then
+        echo "PASS"
+    else
+        echo "FAIL"
+        echo "$BAD"
+        FAIL=1
+    fi
+done
+
+for THING in identifiers; do
+    printf "Names of $THING: "
+    test -r $THING
+    BAD=$( grep -v '^mbedtls_[0-9a-z_]*[0-9a-z]$' $THING || true )
+    if [ "x$BAD" = "x" ]; then
+        echo "PASS"
+    else
+        echo "FAIL"
+        echo "$BAD"
+        FAIL=1
+    fi
+done
+
+printf "Likely typos: "
+sort -u actual-macros enum-consts > _caps
+HEADERS=$( ls include/mbedtls/*.h | egrep -v 'compat-1\.3\.h' )
+NL='
+'
+sed -n 's/MBED..._[A-Z0-9_]*/\'"$NL"'&\'"$NL"/gp \
+    $HEADERS library/*.c \
+    | grep MBEDTLS | sort -u > _MBEDTLS_XXX
+TYPOS=$( diff _caps _MBEDTLS_XXX | sed -n 's/^> //p' \
+            | egrep -v 'XXX|__|_$|^MBEDTLS_.*CONFIG_FILE$' || true )
+rm _MBEDTLS_XXX _caps
+if [ "x$TYPOS" = "x" ]; then
+    echo "PASS"
+else
+    echo "FAIL"
+    echo "$TYPOS"
+    FAIL=1
+fi
+
+printf "\nOverall: "
+if [ "$FAIL" -eq 0 ]; then
+    rm macros actual-macros enum-consts identifiers exported-symbols
+    echo "PASSED"
+    exit 0
+else
+    echo "FAILED"
+    exit 1
+fi

externals/mbedtls/tests/scripts/curves.pl

@@ -0,0 +1,67 @@
+#!/usr/bin/env perl
+
+# curves.pl
+#
+# Copyright (c) 2014-2016, ARM Limited, All Rights Reserved
+#
+# Purpose
+#
+# To test the code dependencies on individual curves in each test suite. This
+# is a verification step to ensure we don't ship test suites that do not work
+# for some build options.
+#
+# The process is:
+#       for each possible curve
+#           build the library and test suites with the curve disabled
+#           execute the test suites
+#
+# And any test suite with the wrong dependencies will fail.
+#
+# Usage: tests/scripts/curves.pl
+#
+# This script should be executed from the root of the project directory.
+#
+# For best effect, run either with cmake disabled, or cmake enabled in a mode
+# that includes -Werror.
+
+use warnings;
+use strict;
+
+-d 'library' && -d 'include' && -d 'tests' or die "Must be run from root\n";
+
+my $sed_cmd = 's/^#define \(MBEDTLS_ECP_DP.*_ENABLED\)/\1/p';
+my $config_h = 'include/mbedtls/config.h';
+my @curves = split( /\s+/, `sed -n -e '$sed_cmd' $config_h` );
+
+system( "cp $config_h $config_h.bak" ) and die;
+sub abort {
+    system( "mv $config_h.bak $config_h" ) and warn "$config_h not restored\n";
+    # use an exit code between 1 and 124 for git bisect (die returns 255)
+    warn $_[0];
+    exit 1;
+}
+
+for my $curve (@curves) {
+    system( "cp $config_h.bak $config_h" ) and die "$config_h not restored\n";
+    system( "make clean" ) and die;
+
+    # depends on a specific curve. Also, ignore error if it wasn't enabled
+    system( "scripts/config.pl unset MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED" );
+
+    print "\n******************************************\n";
+    print "* Testing without curve: $curve\n";
+    print "******************************************\n";
+
+    system( "scripts/config.pl unset $curve" )
+        and abort "Failed to disable $curve\n";
+
+    system( "CFLAGS='-Werror -Wall -Wextra' make lib" )
+        and abort "Failed to build lib: $curve\n";
+    system( "cd tests && make" ) and abort "Failed to build tests: $curve\n";
+    system( "make test" ) and abort "Failed test suite: $curve\n";
+
+}
+
+system( "mv $config_h.bak $config_h" ) and die "$config_h not restored\n";
+system( "make clean" ) and die;
+exit 0;

externals/mbedtls/tests/scripts/depends-hashes.pl

@@ -0,0 +1,77 @@
+#!/usr/bin/env perl
+
+# depends-hashes.pl
+#
+# Copyright (c) 2017, ARM Limited, All Rights Reserved
+#
+# Purpose
+#
+# To test the code dependencies on individual hashes in each test suite. This
+# is a verification step to ensure we don't ship test suites that do not work
+# for some build options.
+#
+# The process is:
+#       for each possible hash
+#           build the library and test suites with the hash disabled
+#           execute the test suites
+#
+# And any test suite with the wrong dependencies will fail.
+#
+# Usage: tests/scripts/depends-hashes.pl
+#
+# This script should be executed from the root of the project directory.
+#
+# For best effect, run either with cmake disabled, or cmake enabled in a mode
+# that includes -Werror.
+
+use warnings;
+use strict;
+
+-d 'library' && -d 'include' && -d 'tests' or die "Must be run from root\n";
+
+my $config_h = 'include/mbedtls/config.h';
+
+# as many SSL options depend on specific hashes,
+# and SSL is not in the test suites anyways,
+# disable it to avoid dependcies issues
+my $ssl_sed_cmd = 's/^#define \(MBEDTLS_SSL.*\)/\1/p';
+my @ssl = split( /\s+/, `sed -n -e '$ssl_sed_cmd' $config_h` );
+
+# for md we want to catch MD5_C but not MD_C, hence the extra dot
+my $mdx_sed_cmd = 's/^#define \(MBEDTLS_MD..*_C\)/\1/p';
+my $sha_sed_cmd = 's/^#define \(MBEDTLS_SHA.*_C\)/\1/p';
+my @hashes = split( /\s+/,
+                    `sed -n -e '$mdx_sed_cmd' -e '$sha_sed_cmd' $config_h` );
+system( "cp $config_h $config_h.bak" ) and die;
+sub abort {
+    system( "mv $config_h.bak $config_h" ) and warn "$config_h not restored\n";
+    # use an exit code between 1 and 124 for git bisect (die returns 255)
+    warn $_[0];
+    exit 1;
+}
+
+for my $hash (@hashes) {
+    system( "cp $config_h.bak $config_h" ) and die "$config_h not restored\n";
+    system( "make clean" ) and die;
+
+    print "\n******************************************\n";
+    print "* Testing without hash: $hash\n";
+    print "******************************************\n";
+
+    system( "scripts/config.pl unset $hash" )
+        and abort "Failed to disable $hash\n";
+
+    for my $opt (@ssl) {
+        system( "scripts/config.pl unset $opt" )
+            and abort "Failed to disable $opt\n";
+    }
+
+    system( "CFLAGS='-Werror -Wall -Wextra' make lib" )
+        and abort "Failed to build lib: $hash\n";
+    system( "cd tests && make" ) and abort "Failed to build tests: $hash\n";
+    system( "make test" ) and abort "Failed test suite: $hash\n";
+}
+
+system( "mv $config_h.bak $config_h" ) and die "$config_h not restored\n";
+system( "make clean" ) and die;
+exit 0;

externals/mbedtls/tests/scripts/depends-pkalgs.pl

@@ -0,0 +1,91 @@
+#!/usr/bin/env perl
+
+# depends-pkalgs.pl
+#
+# Copyright (c) 2017, ARM Limited, All Rights Reserved
+#
+# Purpose
+#
+# To test the code dependencies on individual PK algs (those that can be used
+# from the PK layer, so currently signature and encryption but not key
+# exchange) in each test suite. This is a verification step to ensure we don't
+# ship test suites that do not work for some build options.
+#
+# The process is:
+#       for each possible PK alg
+#           build the library and test suites with that alg disabled
+#           execute the test suites
+#
+# And any test suite with the wrong dependencies will fail.
+#
+# Usage: tests/scripts/depends-pkalgs.pl
+#
+# This script should be executed from the root of the project directory.
+#
+# For best effect, run either with cmake disabled, or cmake enabled in a mode
+# that includes -Werror.
+
+use warnings;
+use strict;
+
+-d 'library' && -d 'include' && -d 'tests' or die "Must be run from root\n";
+
+my $config_h = 'include/mbedtls/config.h';
+
+# Some algorithms can't be disabled on their own as others depend on them, so
+# we list those reverse-dependencies here to keep check_config.h happy.
+my %algs = (
+    'MBEDTLS_ECDSA_C'   => ['MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED'],
+    'MBEDTLS_ECP_C'     => ['MBEDTLS_ECDSA_C',
+                            'MBEDTLS_ECDH_C',
+                            'MBEDTLS_ECJPAKE_C',
+                            'MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED',
+                            'MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED',
+                            'MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED',
+                            'MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED',
+                            'MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED'],
+    'MBEDTLS_X509_RSASSA_PSS_SUPPORT'   => [],
+    'MBEDTLS_PKCS1_V21' => ['MBEDTLS_X509_RSASSA_PSS_SUPPORT'],
+    'MBEDTLS_PKCS1_V15' => ['MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED',
+                            'MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED',
+                            'MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED',
+                            'MBEDTLS_KEY_EXCHANGE_RSA_ENABLED'],
+    'MBEDTLS_RSA_C'     => ['MBEDTLS_X509_RSASSA_PSS_SUPPORT',
+                            'MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED',
+                            'MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED',
+                            'MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED',
+                            'MBEDTLS_KEY_EXCHANGE_RSA_ENABLED'],
+);
+
+system( "cp $config_h $config_h.bak" ) and die;
+sub abort {
+    system( "mv $config_h.bak $config_h" ) and warn "$config_h not restored\n";
+    # use an exit code between 1 and 124 for git bisect (die returns 255)
+    warn $_[0];
+    exit 1;
+}
+
+while( my ($alg, $extras) = each %algs ) {
+    system( "cp $config_h.bak $config_h" ) and die "$config_h not restored\n";
+    system( "make clean" ) and die;
+
+    print "\n******************************************\n";
+    print "* Testing without alg: $alg\n";
+    print "******************************************\n";
+
+    system( "scripts/config.pl unset $alg" )
+        and abort "Failed to disable $alg\n";
+    for my $opt (@$extras) {
+        system( "scripts/config.pl unset $opt" )
+            and abort "Failed to disable $opt\n";
+    }
+
+    system( "CFLAGS='-Werror -Wall -Wextra' make lib" )
+        and abort "Failed to build lib: $alg\n";
+    system( "cd tests && make" ) and abort "Failed to build tests: $alg\n";
+    system( "make test" ) and abort "Failed test suite: $alg\n";
+}
+
+system( "mv $config_h.bak $config_h" ) and die "$config_h not restored\n";
+system( "make clean" ) and die;
+exit 0;

externals/mbedtls/tests/scripts/doxygen.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+
+# Make sure the doxygen documentation builds without warnings
+
+# Abort on errors (and uninitiliased variables)
+set -eu
+
+if [ -d library -a -d include -a -d tests ]; then :; else
+    echo "Must be run from mbed TLS root" >&2
+    exit 1
+fi
+
+if scripts/apidoc_full.sh > doc.out 2>doc.err; then :; else
+    cat doc.err
+    echo "FAIL" >&2
+    exit 1;
+fi
+
+cat doc.out doc.err | \
+    grep -v "warning: ignoring unsupported tag" \
+    > doc.filtered
+
+if egrep "(warning|error):" doc.filtered; then
+    echo "FAIL" >&2
+    exit 1;
+fi
+
+make apidoc_clean
+rm -f doc.out doc.err doc.filtered

externals/mbedtls/tests/scripts/gen_ctr_drbg.pl

@@ -0,0 +1,93 @@
+#!/usr/bin/env perl
+#
+# Based on NIST CTR_DRBG.rsp validation file
+# Only uses AES-256-CTR cases that use a Derivation function
+# and concats nonce and personalization for initialization.
+
+use strict;
+
+my $file = shift;
+
+open(TEST_DATA, "$file") or die "Opening test cases '$file': $!";
+
+sub get_suite_val($)
+{
+    my $name = shift;
+    my $val = "";
+
+    my $line = <TEST_DATA>;
+    ($val) = ($line =~ /\[$name\s\=\s(\w+)\]/);
+
+    return $val;
+}
+
+sub get_val($)
+{
+    my $name = shift;
+    my $val = "";
+    my $line;
+
+    while($line = <TEST_DATA>)
+    {
+        next if($line !~ /=/);
+        last;
+    }
+
+    ($val) = ($line =~ /^$name = (\w+)/);
+
+    return $val;
+}
+
+my $cnt = 1;;
+while (my $line = <TEST_DATA>)
+{
+    next if ($line !~ /^\[AES-256 use df/);
+
+    my $PredictionResistanceStr = get_suite_val("PredictionResistance");
+    my $PredictionResistance = 0;
+    $PredictionResistance = 1 if ($PredictionResistanceStr eq 'True');
+    my $EntropyInputLen = get_suite_val("EntropyInputLen");
+    my $NonceLen = get_suite_val("NonceLen");
+    my $PersonalizationStringLen = get_suite_val("PersonalizationStringLen");
+    my $AdditionalInputLen = get_suite_val("AdditionalInputLen");
+
+    for ($cnt = 0; $cnt < 15; $cnt++)
+    {
+        my $Count = get_val("COUNT");
+        my $EntropyInput = get_val("EntropyInput");
+        my $Nonce = get_val("Nonce");
+        my $PersonalizationString = get_val("PersonalizationString");
+        my $AdditionalInput1 = get_val("AdditionalInput");
+        my $EntropyInputPR1 = get_val("EntropyInputPR") if ($PredictionResistance == 1);
+        my $EntropyInputReseed = get_val("EntropyInputReseed") if ($PredictionResistance == 0);
+        my $AdditionalInputReseed = get_val("AdditionalInputReseed") if ($PredictionResistance == 0);
+        my $AdditionalInput2 = get_val("AdditionalInput");
+        my $EntropyInputPR2 = get_val("EntropyInputPR") if ($PredictionResistance == 1);
+        my $ReturnedBits = get_val("ReturnedBits");
+
+        if ($PredictionResistance == 1)
+        {
+            print("CTR_DRBG NIST Validation (AES-256 use df,$PredictionResistanceStr,$EntropyInputLen,$NonceLen,$PersonalizationStringLen,$AdditionalInputLen) #$Count\n");
+            print("ctr_drbg_validate_pr");
+            print(":\"$Nonce$PersonalizationString\"");
+            print(":\"$EntropyInput$EntropyInputPR1$EntropyInputPR2\"");
+            print(":\"$AdditionalInput1\"");
+            print(":\"$AdditionalInput2\"");
+            print(":\"$ReturnedBits\"");
+            print("\n\n");
+        }
+        else
+        {
+            print("CTR_DRBG NIST Validation (AES-256 use df,$PredictionResistanceStr,$EntropyInputLen,$NonceLen,$PersonalizationStringLen,$AdditionalInputLen) #$Count\n");
+            print("ctr_drbg_validate_nopr");
+            print(":\"$Nonce$PersonalizationString\"");
+            print(":\"$EntropyInput$EntropyInputReseed\"");
+            print(":\"$AdditionalInput1\"");
+            print(":\"$AdditionalInputReseed\"");
+            print(":\"$AdditionalInput2\"");
+            print(":\"$ReturnedBits\"");
+            print("\n\n");
+        }
+    }
+}
+close(TEST_DATA);

externals/mbedtls/tests/scripts/gen_gcm_decrypt.pl

@@ -0,0 +1,98 @@
+#!/usr/bin/env perl
+#
+# Based on NIST gcmDecryptxxx.rsp validation files
+# Only first 3 of every set used for compile time saving
+
+use strict;
+
+my $file = shift;
+
+open(TEST_DATA, "$file") or die "Opening test cases '$file': $!";
+
+sub get_suite_val($)
+{
+    my $name = shift;
+    my $val = "";
+
+    while(my $line = <TEST_DATA>)
+    {
+        next if ($line !~ /^\[/);
+        ($val) = ($line =~ /\[$name\s\=\s(\w+)\]/);
+        last;
+    }
+
+    return $val;
+}
+
+sub get_val($)
+{
+    my $name = shift;
+    my $val = "";
+    my $line;
+
+    while($line = <TEST_DATA>)
+    {
+        next if($line !~ /=/);
+        last;
+    }
+
+    ($val) = ($line =~ /^$name = (\w+)/);
+
+    return $val;
+}
+
+sub get_val_or_fail($)
+{
+    my $name = shift;
+    my $val = "FAIL";
+    my $line;
+
+    while($line = <TEST_DATA>)
+    {
+        next if($line !~ /=/ && $line !~ /FAIL/);
+        last;
+    }
+
+    ($val) = ($line =~ /^$name = (\w+)/) if ($line =~ /=/);
+
+    return $val;
+}
+
+my $cnt = 1;;
+while (my $line = <TEST_DATA>)
+{
+    my $key_len = get_suite_val("Keylen");
+    next if ($key_len !~ /\d+/);
+    my $iv_len = get_suite_val("IVlen");
+    my $pt_len = get_suite_val("PTlen");
+    my $add_len = get_suite_val("AADlen");
+    my $tag_len = get_suite_val("Taglen");
+
+    for ($cnt = 0; $cnt < 3; $cnt++)
+    {
+        my $Count = get_val("Count");
+        my $key = get_val("Key");
+        my $iv = get_val("IV");
+        my $ct = get_val("CT");
+        my $add = get_val("AAD");
+        my $tag = get_val("Tag");
+        my $pt = get_val_or_fail("PT");
+
+        print("GCM NIST Validation (AES-$key_len,$iv_len,$pt_len,$add_len,$tag_len) #$Count\n");
+        print("gcm_decrypt_and_verify");
+        print(":\"$key\"");
+        print(":\"$ct\"");
+        print(":\"$iv\"");
+        print(":\"$add\"");
+        print(":$tag_len");
+        print(":\"$tag\"");
+        print(":\"$pt\"");
+        print(":0");
+        print("\n\n");
+    }
+}
+
+print("GCM Selftest\n");
+print("gcm_selftest:\n\n");
+
+close(TEST_DATA);

externals/mbedtls/tests/scripts/gen_gcm_encrypt.pl

@@ -0,0 +1,81 @@
+#!/usr/bin/env perl
+#
+# Based on NIST gcmEncryptIntIVxxx.rsp validation files
+# Only first 3 of every set used for compile time saving
+
+use strict;
+
+my $file = shift;
+
+open(TEST_DATA, "$file") or die "Opening test cases '$file': $!";
+
+sub get_suite_val($)
+{
+    my $name = shift;
+    my $val = "";
+
+    while(my $line = <TEST_DATA>)
+    {
+        next if ($line !~ /^\[/);
+        ($val) = ($line =~ /\[$name\s\=\s(\w+)\]/);
+        last;
+    }
+
+    return $val;
+}
+
+sub get_val($)
+{
+    my $name = shift;
+    my $val = "";
+    my $line;
+
+    while($line = <TEST_DATA>)
+    {
+        next if($line !~ /=/);
+        last;
+    }
+
+    ($val) = ($line =~ /^$name = (\w+)/);
+
+    return $val;
+}
+
+my $cnt = 1;;
+while (my $line = <TEST_DATA>)
+{
+    my $key_len = get_suite_val("Keylen");
+    next if ($key_len !~ /\d+/);
+    my $iv_len = get_suite_val("IVlen");
+    my $pt_len = get_suite_val("PTlen");
+    my $add_len = get_suite_val("AADlen");
+    my $tag_len = get_suite_val("Taglen");
+
+    for ($cnt = 0; $cnt < 3; $cnt++)
+    {
+        my $Count = get_val("Count");
+        my $key = get_val("Key");
+        my $pt = get_val("PT");
+        my $add = get_val("AAD");
+        my $iv = get_val("IV");
+        my $ct = get_val("CT");
+        my $tag = get_val("Tag");
+
+        print("GCM NIST Validation (AES-$key_len,$iv_len,$pt_len,$add_len,$tag_len) #$Count\n");
+        print("gcm_encrypt_and_tag");
+        print(":\"$key\"");
+        print(":\"$pt\"");
+        print(":\"$iv\"");
+        print(":\"$add\"");
+        print(":\"$ct\"");
+        print(":$tag_len");
+        print(":\"$tag\"");
+        print(":0");
+        print("\n\n");
+    }
+}
+
+print("GCM Selftest\n");
+print("gcm_selftest:\n\n");
+
+close(TEST_DATA);

externals/mbedtls/tests/scripts/gen_pkcs1_v21_sign_verify.pl

@@ -0,0 +1,72 @@
+#!/usr/bin/env perl
+#
+
+use strict;
+
+my $file = shift;
+
+open(TEST_DATA, "$file") or die "Opening test cases '$file': $!";
+
+sub get_val($$)
+{
+    my $str = shift;
+    my $name = shift;
+    my $val = "";
+
+    while(my $line = <TEST_DATA>)
+    {
+        next if($line !~ /^# $str/);
+        last;
+    }
+
+    while(my $line = <TEST_DATA>)
+    {
+        last if($line eq "\r\n");
+        $val .= $line;
+    }
+
+    $val =~ s/[ \r\n]//g;
+
+    return $val;
+}
+
+my $state = 0;
+my $val_n = "";
+my $val_e = "";
+my $val_p = "";
+my $val_q = "";
+my $mod = 0;
+my $cnt = 1;
+while (my $line = <TEST_DATA>)
+{
+    next if ($line !~ /^# Example/);
+
+    ( $mod ) = ($line =~ /A (\d+)/);
+    $val_n = get_val("RSA modulus n", "N");
+    $val_e = get_val("RSA public exponent e", "E");
+    $val_p = get_val("Prime p", "P");
+    $val_q = get_val("Prime q", "Q");
+
+    for(my $i = 1; $i <= 6; $i++)
+    {
+        my $val_m = get_val("Message to be", "M");
+        my $val_salt = get_val("Salt", "Salt");
+        my $val_sig = get_val("Signature", "Sig");
+
+        print("RSASSA-PSS Signature Example ${cnt}_${i}\n");
+        print("pkcs1_rsassa_pss_sign:$mod:16:\"$val_p\":16:\"$val_q\":16:\"$val_n\":16:\"$val_e\":SIG_RSA_SHA1:MBEDTLS_MD_SHA1");
+        print(":\"$val_m\"");
+        print(":\"$val_salt\"");
+        print(":\"$val_sig\":0");
+        print("\n\n");
+
+        print("RSASSA-PSS Signature Example ${cnt}_${i} (verify)\n");
+        print("pkcs1_rsassa_pss_verify:$mod:16:\"$val_n\":16:\"$val_e\":SIG_RSA_SHA1:MBEDTLS_MD_SHA1");
+        print(":\"$val_m\"");
+        print(":\"$val_salt\"");
+        print(":\"$val_sig\":0");
+        print("\n\n");
+    }
+    $cnt++;
+}
+close(TEST_DATA);

externals/mbedtls/tests/scripts/generate-afl-tests.sh

@@ -0,0 +1,68 @@
+#!/bin/sh
+
+# This script splits the data test files containing the test cases into
+# individual files (one test case per file) suitable for use with afl
+# (American Fuzzy Lop). http://lcamtuf.coredump.cx/afl/
+#
+# Usage: generate-afl-tests.sh <test data file path>
+#  <test data file path> - should be the path to one of the test suite files
+#                          such as 'test_suite_mpi.data'
+
+# Abort on errors
+set -e
+
+if [ -z $1 ]
+then
+    echo " [!] No test file specified" >&2
+    echo "Usage: $0 <test data file>" >&2
+    exit 1
+fi
+
+SRC_FILEPATH=$(dirname $1)/$(basename $1)
+TESTSUITE=$(basename $1 .data)
+
+THIS_DIR=$(basename $PWD)
+
+if [ -d ../library -a -d ../include -a -d ../tests -a $THIS_DIR == "tests" ];
+then :;
+else
+    echo " [!] Must be run from mbed TLS tests directory" >&2
+    exit 1
+fi
+
+DEST_TESTCASE_DIR=$TESTSUITE-afl-tests
+DEST_OUTPUT_DIR=$TESTSUITE-afl-out
+
+echo " [+] Creating output directories" >&2
+
+if [ -e $DEST_OUTPUT_DIR/* ];
+then :
+    echo " [!] Test output files already exist." >&2
+    exit 1
+else
+    mkdir -p $DEST_OUTPUT_DIR
+fi
+
+if [ -e $DEST_TESTCASE_DIR/* ];
+then :
+    echo " [!] Test output files already exist." >&2
+else
+    mkdir -p $DEST_TESTCASE_DIR
+fi
+
+echo " [+] Creating test cases" >&2
+cd $DEST_TESTCASE_DIR
+
+split -p '^\s*$' ../$SRC_FILEPATH
+
+for f in *;
+do
+    # Strip out any blank lines (no trim on OS X)
+    sed '/^\s*$/d' $f >testcase_$f
+    rm $f
+done
+
+cd ..
+
+echo " [+] Test cases in $DEST_TESTCASE_DIR" >&2
+

externals/mbedtls/tests/scripts/generate_code.pl

@@ -0,0 +1,411 @@
+#!/usr/bin/env perl
+
+# generate_code.pl
+#
+# This file is part of mbed TLS (https://tls.mbed.org)
+#
+# Copyright (c) 2009-2016, ARM Limited, All Rights Reserved
+#
+# Purpose
+#
+# Generates the test suite code given inputs of the test suite directory that
+# contain the test suites, and the test suite file names for the test code and
+# test data.
+#
+# Usage: generate_code.pl <suite dir> <code file> <data file> [main code file]
+#
+# Structure of files
+#
+#   - main code file - 'main_test.function'
+#       Template file that contains the main() function for the test suite,
+#       test dispatch code as well as support functions. It contains the
+#       following symbols which are substituted by this script during
+#       processing:
+#           TESTCASE_FILENAME
+#           TESTCODE_FILENAME
+#           SUITE_PRE_DEP
+#           MAPPING_CODE
+#           FUNCTION CODE
+#           SUITE_POST_DEP
+#           DEP_CHECK_CODE
+#           DISPATCH_FUNCTION
+#           !LINE_NO!
+#
+#   - common helper code file - 'helpers.function'
+#       Common helper functions
+#
+#   - test suite code file - file name in the form 'test_suite_xxx.function'
+#       Code file that contains the actual test cases. The file contains a
+#       series of code sequences delimited by the following:
+#           BEGIN_HEADER / END_HEADER - list of headers files
+#           BEGIN_SUITE_HELPERS / END_SUITE_HELPERS - helper functions common to
+#               the test suite
+#           BEGIN_CASE / END_CASE - the test cases in the test suite. Each test
+#               case contains at least one function that is used to create the
+#               dispatch code.
+#
+#   - test data file - file name in the form 'test_suite_xxxx.data'
+#       The test case parameters to to be used in execution of the test. The
+#       file name is used to replace the symbol 'TESTCASE_FILENAME' in the main
+#       code file above.
+#
+#       A test data file consists of a sequence of paragraphs separated by
+#       a single empty line. Line breaks may be in Unix (LF) or Windows (CRLF)
+#       format. Lines starting with the character '#' are ignored
+#       (the parser behaves as if they were not present).
+#
+#       Each paragraph describes one test case and must consist of: (1) one
+#       line which is the test case name; (2) an optional line starting with
+#       the 11-character prefix "depends_on:"; (3) a line containing the test
+#       function to execute and its parameters.
+#
+#       A depends_on: line consists of a list of compile-time options
+#       separated by the character ':', with no whitespace. The test case
+#       is executed only if this compilation option is enabled in config.h.
+#
+#       The last line of each paragraph contains a test function name and
+#       a list of parameters separated by the character ':'. Running the
+#       test case calls this function with the specified parameters. Each
+#       parameter may either be an integer written in decimal or hexadecimal,
+#       or a string surrounded by double quotes which may not contain the
+#       ':' character.
+#
+
+use strict;
+
+my $suite_dir = shift or die "Missing suite directory";
+my $suite_name = shift or die "Missing suite name";
+my $data_name = shift or die "Missing data name";
+my $test_main_file = do { my $arg = shift; defined($arg) ? $arg :  $suite_dir."/main_test.function" };
+my $test_file = $data_name.".c";
+my $test_common_helper_file = $suite_dir."/helpers.function";
+my $test_case_file = $suite_dir."/".$suite_name.".function";
+my $test_case_data = $suite_dir."/".$data_name.".data";
+
+my $line_separator = $/;
+undef $/;
+
+
+#
+# Open and read in the input files
+#
+
+open(TEST_HELPERS, "$test_common_helper_file") or die "Opening test helpers
+'$test_common_helper_file': $!";
+my $test_common_helpers = <TEST_HELPERS>;
+close(TEST_HELPERS);
+
+open(TEST_MAIN, "$test_main_file") or die "Opening test main '$test_main_file': $!";
+my @test_main_lines = split/^/,  <TEST_MAIN>;
+my $test_main;
+my $index = 2;
+for my $line (@test_main_lines) {
+    $line =~ s/!LINE_NO!/$index/;
+    $test_main = $test_main.$line;
+    $index++;
+}
+close(TEST_MAIN);
+
+open(TEST_CASES, "$test_case_file") or die "Opening test cases '$test_case_file': $!";
+my @test_cases_lines = split/^/,  <TEST_CASES>;
+my $test_cases;
+my $index = 2;
+for my $line (@test_cases_lines) {
+    if ($line =~ /^\/\* BEGIN_SUITE_HELPERS .*\*\//)
+    {
+        $line = $line."#line $index \"$test_case_file\"\n";
+    }
+
+    if ($line =~ /^\/\* BEGIN_CASE .*\*\//)
+    {
+        $line = $line."#line $index \"$test_case_file\"\n";
+    }
+
+    $line =~ s/!LINE_NO!/$index/;
+
+    $test_cases = $test_cases.$line;
+    $index++;
+}
+
+close(TEST_CASES);
+
+open(TEST_DATA, "$test_case_data") or die "Opening test data '$test_case_data': $!";
+my $test_data = <TEST_DATA>;
+close(TEST_DATA);
+
+
+#
+# Find the headers, dependencies, and suites in the test cases file
+#
+
+my ( $suite_header ) = $test_cases =~ /\/\* BEGIN_HEADER \*\/\n(.*?)\n\/\* END_HEADER \*\//s;
+my ( $suite_defines ) = $test_cases =~ /\/\* BEGIN_DEPENDENCIES\n \* (.*?)\n \* END_DEPENDENCIES/s;
+my ( $suite_helpers ) = $test_cases =~ /\/\* BEGIN_SUITE_HELPERS \*\/\n(.*?)\n\/\* END_SUITE_HELPERS \*\//s;
+
+my $requirements;
+if ($suite_defines =~ /^depends_on:/)
+{
+    ( $requirements ) = $suite_defines =~ /^depends_on:(.*)$/;
+}
+
+my @var_req_arr = split(/:/, $requirements);
+my $suite_pre_code;
+my $suite_post_code;
+my $dispatch_code;
+my $mapping_code;
+my %mapping_values;
+
+while (@var_req_arr)
+{
+    my $req = shift @var_req_arr;
+    $req =~ s/(!?)(.*)/$1defined($2)/;
+
+    $suite_pre_code .= "#if $req\n";
+    $suite_post_code .= "#endif /* $req */\n";
+}
+
+$/ = $line_separator;
+
+open(TEST_FILE, ">$test_file") or die "Opening destination file '$test_file': $!";
+print TEST_FILE << "END";
+/*
+ * *** THIS FILE HAS BEEN MACHINE GENERATED ***
+ *
+ * This file has been machine generated using the script: $0
+ *
+ * Test file      : $test_file
+ *
+ * The following files were used to create this file.
+ *
+ *      Main code file  : $test_main_file
+ *      Helper file     : $test_common_helper_file
+ *      Test suite file : $test_case_file
+ *      Test suite data : $test_case_data
+ *
+ *
+ *  This file is part of mbed TLS (https://tls.mbed.org)
+ */
+
+#if !defined(MBEDTLS_CONFIG_FILE)
+#include <mbedtls/config.h>
+#else
+#include MBEDTLS_CONFIG_FILE
+#endif
+
+
+/*----------------------------------------------------------------------------*/
+/* Common helper code */
+
+$test_common_helpers
+
+
+/*----------------------------------------------------------------------------*/
+/* Test Suite Code */
+
+$suite_pre_code
+$suite_header
+$suite_helpers
+$suite_post_code
+
+END
+
+$test_main =~ s/SUITE_PRE_DEP/$suite_pre_code/;
+$test_main =~ s/SUITE_POST_DEP/$suite_post_code/;
+
+while($test_cases =~ /\/\* BEGIN_CASE *([\w:]*) \*\/\n(.*?)\n\/\* END_CASE \*\//msg)
+{
+    my $function_deps = $1;
+    my $function_decl = $2;
+
+    # Sanity checks of function
+    if ($function_decl !~ /^#line\s*.*\nvoid /)
+    {
+        die "Test function does not have 'void' as return type.\n" .
+            "Function declaration:\n" .
+            $function_decl;
+    }
+    if ($function_decl !~ /^(#line\s*.*)\nvoid (\w+)\(\s*(.*?)\s*\)\s*{(.*)}/ms)
+    {
+        die "Function declaration not in expected format\n";
+    }
+    my $line_directive = $1;
+    my $function_name = $2;
+    my $function_params = $3;
+    my $function_pre_code;
+    my $function_post_code;
+    my $param_defs;
+    my $param_checks;
+    my @dispatch_params;
+    my @var_def_arr = split(/,\s*/, $function_params);
+    my $i = 1;
+    my $mapping_regex = "".$function_name;
+    my $mapping_count = 0;
+
+    $function_decl =~ s/(^#line\s*.*)\nvoid /$1\nvoid test_suite_/;
+
+    # Add exit label if not present
+    if ($function_decl !~ /^exit:$/m)
+    {
+        $function_decl =~ s/}\s*$/\nexit:\n    return;\n}/;
+    }
+
+    if ($function_deps =~ /^depends_on:/)
+    {
+        ( $function_deps ) = $function_deps =~ /^depends_on:(.*)$/;
+    }
+
+    foreach my $req (split(/:/, $function_deps))
+    {
+        $function_pre_code .= "#ifdef $req\n";
+        $function_post_code .= "#endif /* $req */\n";
+    }
+
+    foreach my $def (@var_def_arr)
+    {
+        # Handle the different parameter types
+        if( substr($def, 0, 4) eq "int " )
+        {
+            $param_defs .= "    int param$i;\n";
+            $param_checks .= "    if( verify_int( params[$i], &param$i ) != 0 ) return( DISPATCH_INVALID_TEST_DATA );\n";
+            push @dispatch_params, "param$i";
+
+            $mapping_regex .= ":([\\d\\w |\\+\\-\\(\\)]+)";
+            $mapping_count++;
+        }
+        elsif( substr($def, 0, 6) eq "char *" )
+        {
+            $param_defs .= "    char *param$i = params[$i];\n";
+            $param_checks .= "    if( verify_string( &param$i ) != 0 ) return( DISPATCH_INVALID_TEST_DATA );\n";
+            push @dispatch_params, "param$i";
+            $mapping_regex .= ":(?:\\\\.|[^:\n])+";
+        }
+        else
+        {
+            die "Parameter declaration not of supported type (int, char *)\n";
+        }
+        $i++;
+
+    }
+
+    # Find non-integer values we should map for this function
+    if( $mapping_count)
+    {
+        my @res = $test_data =~ /^$mapping_regex/msg;
+        foreach my $value (@res)
+        {
+            next unless ($value !~ /^\d+$/);
+            if ( $mapping_values{$value} ) {
+                ${ $mapping_values{$value} }{$function_pre_code} = 1;
+            } else {
+                $mapping_values{$value} = { $function_pre_code => 1 };
+            }
+        }
+    }
+
+    my $call_params = join ", ", @dispatch_params;
+    my $param_count = @var_def_arr + 1;
+    $dispatch_code .= << "END";
+if( strcmp( params[0], "$function_name" ) == 0 )
+{
+$function_pre_code
+$param_defs
+    if( cnt != $param_count )
+    {
+        mbedtls_fprintf( stderr, "\\nIncorrect argument count (%d != %d)\\n", cnt, $param_count );
+        return( DISPATCH_INVALID_TEST_DATA );
+    }
+
+$param_checks
+    test_suite_$function_name( $call_params );
+    return ( DISPATCH_TEST_SUCCESS );
+$function_post_code
+    return ( DISPATCH_UNSUPPORTED_SUITE );
+}
+else
+END
+
+    my $function_code = $function_pre_code . $function_decl . "\n" .
+                        $function_post_code;
+    $test_main =~ s/FUNCTION_CODE/$function_code\nFUNCTION_CODE/;
+}
+
+# Find specific case dependencies that we should be able to check
+# and make check code
+my $dep_check_code;
+
+my @res = $test_data =~ /^depends_on:([!:\w]+)/msg;
+my %case_deps;
+foreach my $deps (@res)
+{
+    foreach my $dep (split(/:/, $deps))
+    {
+        $case_deps{$dep} = 1;
+    }
+}
+while( my ($key, $value) = each(%case_deps) )
+{
+    if( substr($key, 0, 1) eq "!" )
+    {
+        my $key = substr($key, 1);
+        $dep_check_code .= << "END";
+    if( strcmp( str, "!$key" ) == 0 )
+    {
+#if !defined($key)
+        return( DEPENDENCY_SUPPORTED );
+#else
+        return( DEPENDENCY_NOT_SUPPORTED );
+#endif
+    }
+END
+    }
+    else
+    {
+        $dep_check_code .= << "END";
+    if( strcmp( str, "$key" ) == 0 )
+    {
+#if defined($key)
+        return( DEPENDENCY_SUPPORTED );
+#else
+        return( DEPENDENCY_NOT_SUPPORTED );
+#endif
+    }
+END
+    }
+}
+
+# Make mapping code
+while( my ($key, $value) = each(%mapping_values) )
+{
+    my $key_mapping_code = << "END";
+    if( strcmp( str, "$key" ) == 0 )
+    {
+        *value = ( $key );
+        return( KEY_VALUE_MAPPING_FOUND );
+    }
+END
+
+    # handle depenencies, unless used at least one without depends
+    if ($value->{""}) {
+        $mapping_code .= $key_mapping_code;
+        next;
+    }
+    for my $ifdef ( keys %$value ) {
+        (my $endif = $ifdef) =~ s!ifdef!endif //!g;
+        $mapping_code .= $ifdef . $key_mapping_code . $endif;
+    }
+}
+
+$dispatch_code =~ s/^(.+)/    $1/mg;
+
+$test_main =~ s/TESTCASE_FILENAME/$test_case_data/g;
+$test_main =~ s/TESTCODE_FILENAME/$test_case_file/g;
+$test_main =~ s/FUNCTION_CODE//;
+$test_main =~ s/DEP_CHECK_CODE/$dep_check_code/;
+$test_main =~ s/DISPATCH_FUNCTION/$dispatch_code/;
+$test_main =~ s/MAPPING_CODE/$mapping_code/;
+
+print TEST_FILE << "END";
+$test_main
+END
+
+close(TEST_FILE);

externals/mbedtls/tests/scripts/key-exchanges.pl

@@ -0,0 +1,62 @@
+#!/usr/bin/env perl
+
+# key-exchanges.pl
+#
+# Copyright (c) 2015-2017, ARM Limited, All Rights Reserved
+#
+# Purpose
+#
+# To test the code dependencies on individual key exchanges in the SSL module.
+# is a verification step to ensure we don't ship SSL code that do not work
+# for some build options.
+#
+# The process is:
+#       for each possible key exchange
+#           build the library with all but that key exchange disabled
+#
+# Usage: tests/scripts/key-exchanges.pl
+#
+# This script should be executed from the root of the project directory.
+#
+# For best effect, run either with cmake disabled, or cmake enabled in a mode
+# that includes -Werror.
+
+use warnings;
+use strict;
+
+-d 'library' && -d 'include' && -d 'tests' or die "Must be run from root\n";
+
+my $sed_cmd = 's/^#define \(MBEDTLS_KEY_EXCHANGE_.*_ENABLED\)/\1/p';
+my $config_h = 'include/mbedtls/config.h';
+my @kexes = split( /\s+/, `sed -n -e '$sed_cmd' $config_h` );
+
+system( "cp $config_h $config_h.bak" ) and die;
+sub abort {
+    system( "mv $config_h.bak $config_h" ) and warn "$config_h not restored\n";
+    # use an exit code between 1 and 124 for git bisect (die returns 255)
+    warn $_[0];
+    exit 1;
+}
+
+for my $kex (@kexes) {
+    system( "cp $config_h.bak $config_h" ) and die "$config_h not restored\n";
+    system( "make clean" ) and die;
+
+    print "\n******************************************\n";
+    print "* Testing with key exchange: $kex\n";
+    print "******************************************\n";
+
+    # full config with all key exchanges disabled except one
+    system( "scripts/config.pl full" ) and abort "Failed config full\n";
+    for my $k (@kexes) {
+        next if $k eq $kex;
+        system( "scripts/config.pl unset $k" )
+            and abort "Failed to disable $k\n";
+    }
+
+    system( "make lib CFLAGS='-Os -Werror'" ) and abort "Failed to build lib: $kex\n";
+}
+
+system( "mv $config_h.bak $config_h" ) and die "$config_h not restored\n";
+system( "make clean" ) and die;
+exit 0;

externals/mbedtls/tests/scripts/list-enum-consts.pl

@@ -0,0 +1,35 @@
+#!/usr/bin/env perl
+
+use warnings;
+use strict;
+
+use utf8;
+use open qw(:std utf8);
+
+-d 'include/mbedtls' or die "$0: must be run from root\n";
+
+@ARGV = grep { ! /compat-1\.3\.h/ } <include/mbedtls/*.h>;
+
+my @consts;
+my $state = 'out';
+while (<>)
+{
+    if( $state eq 'out' and /^(typedef )?enum \{/ ) {
+        $state = 'in';
+    } elsif( $state eq 'out' and /^(typedef )?enum/ ) {
+        $state = 'start';
+    } elsif( $state eq 'start' and /{/ ) {
+        $state = 'in';
+    } elsif( $state eq 'in' and /}/ ) {
+        $state = 'out';
+    } elsif( $state eq 'in' ) {
+        s/=.*//; s!/\*.*!!; s/,.*//; s/\s+//g; chomp;
+        push @consts, $_ if $_;
+    }
+}
+
+open my $fh, '>', 'enum-consts' or die;
+print $fh "$_\n" for sort @consts;
+close $fh or die;
+
+printf "%8d enum-consts\n", scalar @consts;

externals/mbedtls/tests/scripts/list-identifiers.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+
+set -eu
+
+if [ -d include/mbedtls ]; then :; else
+    echo "$0: must be run from root" >&2
+    exit 1
+fi
+
+HEADERS=$( ls include/mbedtls/*.h | egrep -v 'compat-1\.3\.h|bn_mul' )
+
+rm -f identifiers
+
+grep '^[^ /#{]' $HEADERS | \
+    sed -e 's/^[^:]*://' | \
+    egrep -v '^(extern "C"|(typedef )?(struct|enum)( {)?$|};?$)' \
+    > _decls
+
+if true; then
+sed -n -e 's/.* \**\([a-zA-Z_][a-zA-Z0-9_]*\)(.*/\1/p' \
+       -e 's/.*(\*\(.*\))(.*/\1/p' _decls
+grep -v '(' _decls | sed -e 's/\([a-zA-Z0-9_]*\)[;[].*/\1/' -e 's/.* \**//'
+fi > _identifiers
+
+if [ $( wc -l < _identifiers ) -eq $( wc -l < _decls ) ]; then
+    rm _decls
+    egrep -v '^(u?int(16|32|64)_t)$' _identifiers | sort > identifiers
+    rm _identifiers
+else
+    echo "$0: oops, lost some identifiers" 2>&1
+    exit 1
+fi
+
+wc -l identifiers

externals/mbedtls/tests/scripts/list-macros.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+set -eu
+
+if [ -d include/mbedtls ]; then :; else
+    echo "$0: must be run from root" >&2
+    exit 1
+fi
+
+HEADERS=$( ls include/mbedtls/*.h | egrep -v 'compat-1\.3\.h' )
+
+sed -n -e 's/.*#define \([a-zA-Z0-9_]*\).*/\1/p' $HEADERS \
+    | egrep -v '^(asm|inline|EMIT|_CRT_SECURE_NO_DEPRECATE)$|^MULADDC_' \
+    | sort -u > macros
+
+wc -l macros

externals/mbedtls/tests/scripts/list-symbols.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -eu
+
+if [ -d include/mbedtls ]; then :; else
+    echo "$0: must be run from root" >&2
+    exit 1
+fi
+
+if grep -i cmake Makefile >/dev/null; then
+    echo "$0: not compatible with cmake" >&2
+    exit 1
+fi
+
+cp include/mbedtls/config.h include/mbedtls/config.h.bak
+scripts/config.pl full
+CFLAGS=-fno-asynchronous-unwind-tables make clean lib >/dev/null 2>&1
+mv include/mbedtls/config.h.bak include/mbedtls/config.h
+if uname | grep -F Darwin >/dev/null; then
+    nm -gUj library/libmbed*.a 2>/dev/null | sed -n -e 's/^_//p'
+elif uname | grep -F Linux >/dev/null; then
+    nm -og library/libmbed*.a | grep -v '^[^ ]*: *U \|^$\|^[^ ]*:$' | sed 's/^[^ ]* . //'
+fi | sort > exported-symbols
+make clean
+
+wc -l exported-symbols

externals/mbedtls/tests/scripts/recursion.pl

@@ -0,0 +1,44 @@
+#!/usr/bin/env perl
+
+# Find functions making recursive calls to themselves.
+# (Multiple recursion where a() calls b() which calls a() not covered.)
+#
+# When the recursion depth might depend on data controlled by the attacker in
+# an unbounded way, those functions should use interation instead.
+#
+# Typical usage: scripts/recursion.pl library/*.c
+
+use warnings;
+use strict;
+
+use utf8;
+use open qw(:std utf8);
+
+# exclude functions that are ok:
+# - mpi_write_hlp: bounded by size of mbedtls_mpi, a compile-time constant
+# - x509_crt_verify_child: bounded by MBEDTLS_X509_MAX_INTERMEDIATE_CA
+my $known_ok = qr/mpi_write_hlp|x509_crt_verify_child/;
+
+my $cur_name;
+my $inside;
+my @funcs;
+
+die "Usage: $0 file.c [...]\n" unless @ARGV;
+
+while (<>)
+{
+    if( /^[^\/#{}\s]/ && ! /\[.*]/ ) {
+        chomp( $cur_name = $_ ) unless $inside;
+    } elsif( /^{/ && $cur_name ) {
+        $inside = 1;
+        $cur_name =~ s/.* ([^ ]*)\(.*/$1/;
+    } elsif( /^}/ && $inside ) {
+        undef $inside;
+        undef $cur_name;
+    } elsif( $inside && /\b\Q$cur_name\E\([^)]/ ) {
+        push @funcs, $cur_name unless /$known_ok/;
+    }
+}
+
+print "$_\n" for @funcs;
+exit @funcs;

externals/mbedtls/tests/scripts/run-test-suites.pl

@@ -0,0 +1,101 @@
+#!/usr/bin/env perl
+
+# run-test-suites.pl
+#
+# This file is part of mbed TLS (https://tls.mbed.org)
+#
+# Copyright (c) 2015-2016, ARM Limited, All Rights Reserved
+#
+# Purpose
+#
+# Executes all the available test suites, and provides a basic summary of the
+# results.
+#
+# Usage: run-test-suites.pl [-v]
+#
+# Options :
+#   -v|--verbose    - Provide a pass/fail/skip breakdown per test suite and
+#                     in total
+#
+
+use warnings;
+use strict;
+
+use utf8;
+use open qw(:std utf8);
+
+use constant FALSE => 0;
+use constant TRUE => 1;
+
+my $verbose;
+my $switch = shift;
+if ( defined($switch) && ( $switch eq "-v" || $switch eq "--verbose" ) ) {
+    $verbose = TRUE;
+}
+
+# All test suites = executable files, excluding source files, debug
+# and profiling information, etc. We can't just grep {! /\./} because
+#some of our test cases' base names contain a dot.
+my @suites = grep { -x $_ || /\.exe$/ } glob 'test_suite_*';
+die "$0: no test suite found\n" unless @suites;
+
+# in case test suites are linked dynamically
+$ENV{'LD_LIBRARY_PATH'} = '../library';
+$ENV{'DYLD_LIBRARY_PATH'} = '../library';
+
+my $prefix = $^O eq "MSWin32" ? '' : './';
+
+my ($failed_suites, $total_tests_run, $failed, $suite_cases_passed,
+    $suite_cases_failed, $suite_cases_skipped, $total_cases_passed,
+    $total_cases_failed, $total_cases_skipped );
+
+for my $suite (@suites)
+{
+    print "$suite ", "." x ( 72 - length($suite) - 2 - 4 ), " ";
+    my $result = `$prefix$suite`;
+
+    $suite_cases_passed = () = $result =~ /.. PASS/g;
+    $suite_cases_failed = () = $result =~ /.. FAILED/g;
+    $suite_cases_skipped = () = $result =~ /.. ----/g;
+
+    if( $result =~ /PASSED/ ) {
+        print "PASS\n";
+    } else {
+        $failed_suites++;
+        print "FAIL\n";
+    }
+
+    my ($passed, $tests, $skipped) = $result =~ /([0-9]*) \/ ([0-9]*) tests.*?([0-9]*) skipped/;
+    $total_tests_run += $tests - $skipped;
+
+    if ( $verbose ) {
+        print "(test cases passed:", $suite_cases_passed,
+                " failed:", $suite_cases_failed,
+                " skipped:", $suite_cases_skipped,
+                " of total:", ($suite_cases_passed + $suite_cases_failed +
+                               $suite_cases_skipped),
+                ")\n"
+    }
+
+    $total_cases_passed += $suite_cases_passed;
+    $total_cases_failed += $suite_cases_failed;
+    $total_cases_skipped += $suite_cases_skipped;
+}
+
+print "-" x 72, "\n";
+print $failed_suites ? "FAILED" : "PASSED";
+printf " (%d suites, %d tests run)\n", scalar @suites, $total_tests_run;
+
+if ( $verbose ) {
+    print "  test cases passed :", $total_cases_passed, "\n";
+    print "             failed :", $total_cases_failed, "\n";
+    print "            skipped :", $total_cases_skipped, "\n";
+    print "  of tests executed :", ( $total_cases_passed + $total_cases_failed ),
+            "\n";
+    print " of available tests :",
+            ( $total_cases_passed + $total_cases_failed + $total_cases_skipped ),
+            "\n"
+    }
+
+exit( $failed_suites ? 1 : 0 );
+

externals/mbedtls/tests/scripts/tcp_client.pl

@@ -0,0 +1,86 @@
+#!/usr/bin/env perl
+
+# A simple TCP client that sends some data and expects a response.
+# Usage: tcp_client.pl HOSTNAME PORT DATA1 RESPONSE1
+#   DATA: hex-encoded data to send to the server
+#   RESPONSE: regexp that must match the server's response
+
+use warnings;
+use strict;
+use IO::Socket::INET;
+
+# Pack hex digits into a binary string, ignoring whitespace.
+sub parse_hex {
+    my ($hex) = @_;
+    $hex =~ s/\s+//g;
+    return pack('H*', $hex);
+}
+
+## Open a TCP connection to the specified host and port.
+sub open_connection {
+    my ($host, $port) = @_;
+    my $socket = IO::Socket::INET->new(PeerAddr => $host,
+                                       PeerPort => $port,
+                                       Proto => 'tcp',
+                                       Timeout => 1);
+    die "Cannot connect to $host:$port: $!" unless $socket;
+    return $socket;
+}
+
+## Close the TCP connection.
+sub close_connection {
+    my ($connection) = @_;
+    $connection->shutdown(2);
+    # Ignore shutdown failures (at least for now)
+    return 1;
+}
+
+## Write the given data, expressed as hexadecimal
+sub write_data {
+    my ($connection, $hexdata) = @_;
+    my $data = parse_hex($hexdata);
+    my $total_sent = 0;
+    while ($total_sent < length($data)) {
+        my $sent = $connection->send($data, 0);
+        if (!defined $sent) {
+            die "Unable to send data: $!";
+        }
+        $total_sent += $sent;
+    }
+    return 1;
+}
+
+## Read a response and check it against an expected prefix
+sub read_response {
+    my ($connection, $expected_hex) = @_;
+    my $expected_data = parse_hex($expected_hex);
+    my $start_offset = 0;
+    while ($start_offset < length($expected_data)) {
+        my $actual_data;
+        my $ok = $connection->recv($actual_data, length($expected_data));
+        if (!defined $ok) {
+            die "Unable to receive data: $!";
+        }
+        if (($actual_data ^ substr($expected_data, $start_offset)) =~ /[^\000]/) {
+            printf STDERR ("Received \\x%02x instead of \\x%02x at offset %d\n",
+                           ord(substr($actual_data, $-[0], 1)),
+                           ord(substr($expected_data, $start_offset + $-[0], 1)),
+                           $start_offset + $-[0]);
+            return 0;
+        }
+        $start_offset += length($actual_data);
+    }
+    return 1;
+}
+
+if (@ARGV != 4) {
+    print STDERR "Usage: $0 HOSTNAME PORT DATA1 RESPONSE1\n";
+    exit(3);
+}
+my ($host, $port, $data1, $response1) = @ARGV;
+my $connection = open_connection($host, $port);
+write_data($connection, $data1);
+if (!read_response($connection, $response1)) {
+    exit(1);
+}
+close_connection($connection);

externals/mbedtls/tests/scripts/test-ref-configs.pl

@@ -0,0 +1,102 @@
+#!/usr/bin/env perl
+
+# test-ref-configs.pl
+#
+# This file is part of mbed TLS (https://tls.mbed.org)
+#
+# Copyright (c) 2013-2016, ARM Limited, All Rights Reserved
+#
+# Purpose
+#
+# For each reference configuration file in the configs directory, build the
+# configuration, run the test suites and compat.sh
+#
+# Usage: tests/scripts/test-ref-configs.pl [config-name [...]]
+
+use warnings;
+use strict;
+
+my %configs = (
+    'config-mini-tls1_1.h' => {
+        'compat' => '-m tls1_1 -f \'^DES-CBC3-SHA$\|^TLS-RSA-WITH-3DES-EDE-CBC-SHA$\'',
+    },
+    'config-suite-b.h' => {
+        'compat' => "-m tls1_2 -f 'ECDHE-ECDSA.*AES.*GCM' -p mbedTLS",
+    },
+    'config-ccm-psk-tls1_2.h' => {
+        'compat' => '-m tls1_2 -f \'^TLS-PSK-WITH-AES-...-CCM-8\'',
+    },
+    'config-thread.h' => {
+        'opt' => '-f ECJPAKE.*nolog',
+    },
+);
+
+# If no config-name is provided, use all known configs.
+# Otherwise, use the provided names only.
+if ($#ARGV >= 0) {
+    my %configs_ori = ( %configs );
+    %configs = ();
+
+    foreach my $conf_name (@ARGV) {
+        if( ! exists $configs_ori{$conf_name} ) {
+            die "Unknown configuration: $conf_name\n";
+        } else {
+            $configs{$conf_name} = $configs_ori{$conf_name};
+        }
+    }
+}
+
+-d 'library' && -d 'include' && -d 'tests' or die "Must be run from root\n";
+
+my $config_h = 'include/mbedtls/config.h';
+
+system( "cp $config_h $config_h.bak" ) and die;
+sub abort {
+    system( "mv $config_h.bak $config_h" ) and warn "$config_h not restored\n";
+    # use an exit code between 1 and 124 for git bisect (die returns 255)
+    warn $_[0];
+    exit 1;
+}
+
+while( my ($conf, $data) = each %configs ) {
+    system( "cp $config_h.bak $config_h" ) and die;
+    system( "make clean" ) and die;
+
+    print "\n******************************************\n";
+    print "* Testing configuration: $conf\n";
+    print "******************************************\n";
+
+    system( "cp configs/$conf $config_h" )
+        and abort "Failed to activate $conf\n";
+
+    system( "CFLAGS='-Os -Werror -Wall -Wextra' make" ) and abort "Failed to build: $conf\n";
+    system( "make test" ) and abort "Failed test suite: $conf\n";
+
+    my $compat = $data->{'compat'};
+    if( $compat )
+    {
+        print "\nrunning compat.sh $compat\n";
+        system( "tests/compat.sh $compat" )
+            and abort "Failed compat.sh: $conf\n";
+    }
+    else
+    {
+        print "\nskipping compat.sh\n";
+    }
+
+    my $opt = $data->{'opt'};
+    if( $opt )
+    {
+        print "\nrunning ssl-opt.sh $opt\n";
+        system( "tests/ssl-opt.sh $opt" )
+            and abort "Failed ssl-opt.sh: $conf\n";
+    }
+    else
+    {
+        print "\nskipping ssl-opt.sh\n";
+    }
+}
+
+system( "mv $config_h.bak $config_h" ) and warn "$config_h not restored\n";
+system( "make clean" );
+exit 0;

externals/mbedtls/tests/scripts/test_zeroize.gdb

@@ -0,0 +1,70 @@
+# test_zeroize.gdb
+#
+# This file is part of Mbed TLS (https://tls.mbed.org)
+#
+# Copyright (c) 2018, Arm Limited, All Rights Reserved
+#
+# Purpose
+#
+# Run a test using the debugger to check that the mbedtls_platform_zeroize()
+# function in platform_util.h is not being optimized out by the compiler. To do
+# so, the script loads the test program at programs/test/zeroize.c and sets a
+# breakpoint at the last return statement in main(). When the breakpoint is
+# hit, the debugger manually checks the contents to be zeroized and checks that
+# it is actually cleared.
+#
+# The mbedtls_platform_zeroize() test is debugger driven because there does not
+# seem to be a mechanism to reliably check whether the zeroize calls are being
+# eliminated by compiler optimizations from within the compiled program. The
+# problem is that a compiler would typically remove what it considers to be
+# "unecessary" assignments as part of redundant code elimination. To identify
+# such code, the compilar will create some form dependency graph between
+# reads and writes to variables (among other situations). It will then use this
+# data structure to remove redundant code that does not have an impact on the
+# program's observable behavior. In the case of mbedtls_platform_zeroize(), an
+# intelligent compiler could determine that this function clears a block of
+# memory that is not accessed later in the program, so removing the call to
+# mbedtls_platform_zeroize() does not have an observable behavior. However,
+# inserting a test after a call to mbedtls_platform_zeroize() to check whether
+# the block of memory was correctly zeroed would force the compiler to not
+# eliminate the mbedtls_platform_zeroize() call. If this does not occur, then
+# the compiler potentially has a bug.
+#
+# Note: This test requires that the test program is compiled with -g3.
+#
+# WARNING: There does not seem to be a mechanism in GDB scripts to set a
+# breakpoint at the end of a function (probably because there are a lot of
+# complications as function can have multiple exit points, etc). Therefore, it
+# was necessary to hard-code the line number of the breakpoint in the zeroize.c
+# test app. The assumption is that zeroize.c is a simple test app that does not
+# change often (as opposed to the actual library code), so the breakpoint line
+# number does not need to be updated often.
+
+set confirm off
+file ./programs/test/zeroize
+break zeroize.c:100
+
+set args ./programs/test/zeroize.c
+run
+
+set $i = 0
+set $len = sizeof(buf)
+set $buf = buf
+
+while $i < $len
+    if $buf[$i++] != 0
+        echo The buffer at was not zeroized\n
+        quit 1
+    end
+end
+
+echo The buffer was correctly zeroized\n
+
+continue
+
+if $_exitcode != 0
+    echo The program did not terminate correctly\n
+    quit 1
+end
+
+quit 0

externals/mbedtls/tests/scripts/travis-log-failure.sh

@@ -0,0 +1,36 @@
+#!/bin/sh
+
+# travis-log-failure.sh
+#
+# This file is part of mbed TLS (https://tls.mbed.org)
+#
+# Copyright (c) 2016, ARM Limited, All Rights Reserved
+#
+# Purpose
+#
+# List the server and client logs on failed ssl-opt.sh and compat.sh tests.
+# This script is used to make the logs show up in the Travis test results.
+#
+# Some of the logs can be very long: this means usually a couple of megabytes
+# but it can be much more. For example, the client log of test 273 in ssl-opt.sh
+# is more than 630 Megabytes long.
+
+if [ -d include/mbedtls ]; then :; else
+    echo "$0: must be run from root" >&2
+    exit 1
+fi
+
+FILES="o-srv-*.log o-cli-*.log c-srv-*.log c-cli-*.log o-pxy-*.log"
+MAX_LOG_SIZE=1048576
+
+for PATTERN in $FILES; do
+    for LOG in $( ls tests/$PATTERN 2>/dev/null ); do
+        echo
+        echo "****** BEGIN file: $LOG ******"
+        echo
+        tail -c $MAX_LOG_SIZE $LOG
+        echo "****** END file: $LOG ******"
+        echo
+        rm $LOG
+    done
+done

externals/mbedtls/tests/scripts/yotta-build.sh

@@ -0,0 +1,61 @@
+#!/bin/sh
+
+# yotta-build.sh
+#
+# This file is part of mbed TLS (https://tls.mbed.org)
+#
+# Copyright (c) 2015-2016, ARM Limited, All Rights Reserved
+#
+# Purpose
+#
+# To run test builds of the yotta module for all supported targets.
+
+set -eu
+
+check_tools()
+{
+    for TOOL in "$@"; do
+        if ! `hash "$TOOL" >/dev/null 2>&1`; then
+            echo "$TOOL not found!" >&2
+            exit 1
+        fi
+    done
+}
+
+yotta_build()
+{
+    TARGET=$1
+
+    echo; echo "*** $TARGET (release) ***"
+    yt -t $TARGET build
+
+    echo; echo "*** $TARGET (debug) ***"
+    yt -t $TARGET build -d
+}
+
+# Make sure the tools we need are available.
+check_tools "arm-none-eabi-gcc" "armcc" "yotta"
+
+yotta/create-module.sh
+cd yotta/module
+yt update || true # needs network
+
+if uname -a | grep 'Linux.*x86' >/dev/null; then
+    yotta_build x86-linux-native
+fi
+if uname -a | grep 'Darwin.*x86' >/dev/null; then
+    yotta_build x86-osx-native
+fi
+
+# armcc build tests.
+yotta_build frdm-k64f-armcc
+#yotta_build nordic-nrf51822-16k-armcc
+
+# arm-none-eabi-gcc build tests.
+yotta_build frdm-k64f-gcc
+#yotta_build st-nucleo-f401re-gcc # dirent
+#yotta_build stm32f429i-disco-gcc # fails in mbed-hal-st-stm32f4
+#yotta_build nordic-nrf51822-16k-gcc # fails in minar-platform
+#yotta_build bbc-microbit-classic-gcc # fails in minar-platform
+#yotta_build st-stm32f439zi-gcc # fails in mbed-hal-st-stm32f4
+#yotta_build st-stm32f429i-disco-gcc # fails in mbed-hal-st-stm32f4