初始提交：terminalX 可运行态（M0/M1/M1.5 已真机验证）

- M0: libghostty SSH 终端（渲染/输入/连接）+ 白屏修复(OutputGate) + 会话状态机/自动重连
- M1: tsnet 用户态组网 + SSH-over-tsnet(fd 桥)，shell 级真机验证；R5(Go+gvisor+C+++Swift 同进程) retire
- M1.5: tmux -CC 原生 tab（MVP）
- 结构: packages/(TXCore·TXTransport), apps/TerminalX, vendor/(libghostty-spm/libssh2/mbedtls/tsnet-bridge), artifacts/
- 文档: CLAUDE.md + docs/HANDOFF.md（新会话入口）
- 环境: 认证代理→依赖 vendor 本地化；Go 在 ~/.local/go；仅模拟器/未签名
- 待续: M2 mosh, tmux 多 pane, M4 安全(host key/SE)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vendor/mbedtls/programs/test/CMakeLists.txt

@@ -0,0 +1,106 @@
+set(libs
+    ${mbedtls_target}
+)
+
+set(executables_libs
+    metatest
+    query_included_headers
+    selftest
+    udp_proxy
+)
+add_dependencies(${programs_target} ${executables_libs})
+add_dependencies(${ssl_opt_target} udp_proxy)
+
+set(executables_mbedcrypto
+    benchmark
+    query_compile_time_config
+    zeroize
+)
+add_dependencies(${programs_target} ${executables_mbedcrypto})
+add_dependencies(${ssl_opt_target} query_compile_time_config)
+
+if(TEST_CPP)
+    set(cpp_dummy_build_cpp "${CMAKE_CURRENT_BINARY_DIR}/cpp_dummy_build.cpp")
+    set(generate_cpp_dummy_build "${CMAKE_CURRENT_SOURCE_DIR}/generate_cpp_dummy_build.sh")
+    add_custom_command(
+        OUTPUT "${cpp_dummy_build_cpp}"
+        COMMAND "${generate_cpp_dummy_build}" "${cpp_dummy_build_cpp}"
+        DEPENDS "${generate_cpp_dummy_build}"
+        WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
+    )
+    add_executable(cpp_dummy_build "${cpp_dummy_build_cpp}")
+    target_include_directories(cpp_dummy_build PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../include)
+    target_link_libraries(cpp_dummy_build ${mbedcrypto_target} ${CMAKE_THREAD_LIBS_INIT})
+endif()
+
+if(USE_SHARED_MBEDTLS_LIBRARY AND
+   NOT ${CMAKE_SYSTEM_NAME} MATCHES "[Ww][Ii][Nn]")
+    add_executable(dlopen "dlopen.c")
+    target_include_directories(dlopen PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../include)
+    target_link_libraries(dlopen ${CMAKE_DL_LIBS})
+endif()
+
+if(GEN_FILES)
+    find_package(Perl REQUIRED)
+
+    add_custom_command(
+        OUTPUT
+            ${CMAKE_CURRENT_BINARY_DIR}/query_config.c
+        COMMAND
+            ${PERL}
+                ${CMAKE_CURRENT_SOURCE_DIR}/../../scripts/generate_query_config.pl
+                ${CMAKE_CURRENT_SOURCE_DIR}/../../include/mbedtls/mbedtls_config.h
+                ${CMAKE_CURRENT_SOURCE_DIR}/../../include/psa/crypto_config.h
+                ${CMAKE_CURRENT_SOURCE_DIR}/../../scripts/data_files/query_config.fmt
+                ${CMAKE_CURRENT_BINARY_DIR}/query_config.c
+        DEPENDS
+            ${CMAKE_CURRENT_SOURCE_DIR}/../../scripts/generate_query_config.pl
+            ${CMAKE_CURRENT_SOURCE_DIR}/../../include/mbedtls/mbedtls_config.h
+            ${CMAKE_CURRENT_SOURCE_DIR}/../../include/psa/crypto_config.h
+            ${CMAKE_CURRENT_SOURCE_DIR}/../../scripts/data_files/query_config.fmt
+    )
+    # this file will also be used in another directory, so create a target, see
+    # https://gitlab.kitware.com/cmake/community/-/wikis/FAQ#how-can-i-add-a-dependency-to-a-source-file-which-is-generated-in-a-subdirectory
+    add_custom_target(generate_query_config_c
+        DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/query_config.c)
+else()
+    link_to_source(query_config.c)
+endif()
+
+foreach(exe IN LISTS executables_libs executables_mbedcrypto)
+    set(source ${exe}.c)
+    set(extra_sources "")
+    if(NOT EXISTS ${source} AND
+       EXISTS ${MBEDTLS_FRAMEWORK_DIR}/tests/programs/${source})
+         set(source ${MBEDTLS_FRAMEWORK_DIR}/tests/programs/${source})
+    endif()
+
+    if(exe STREQUAL "query_compile_time_config")
+        list(APPEND extra_sources
+            ${MBEDTLS_FRAMEWORK_DIR}/tests/programs/query_config.h
+            ${CMAKE_CURRENT_BINARY_DIR}/query_config.c)
+    endif()
+    add_executable(${exe} ${source} $<TARGET_OBJECTS:mbedtls_test>
+        ${extra_sources})
+    target_include_directories(${exe} PRIVATE ${MBEDTLS_FRAMEWORK_DIR}/tests/include)
+    target_include_directories(${exe} PRIVATE ${MBEDTLS_FRAMEWORK_DIR}/tests/programs)
+    target_include_directories(${exe} PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../library)
+    if(exe STREQUAL "query_compile_time_config")
+        target_include_directories(${exe} PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    endif()
+
+    # Request C11, required for memory poisoning
+    set_target_properties(${exe} PROPERTIES C_STANDARD 11)
+
+    # This emulates "if ( ... IN_LIST ... )" which becomes available in CMake 3.3
+    list(FIND executables_libs ${exe} exe_index)
+    if (${exe_index} GREATER -1)
+        target_link_libraries(${exe} ${libs} ${CMAKE_THREAD_LIBS_INIT})
+    else()
+        target_link_libraries(${exe} ${mbedcrypto_target} ${CMAKE_THREAD_LIBS_INIT})
+    endif()
+endforeach()
+
+install(TARGETS ${executables_libs} ${executables_mbedcrypto}
+        DESTINATION "bin"
+        PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)

vendor/mbedtls/programs/test/cmake_package/.gitignore

@@ -0,0 +1,4 @@
+build
+Makefile
+cmake_package
+mbedtls

vendor/mbedtls/programs/test/cmake_package/CMakeLists.txt

@@ -0,0 +1,38 @@
+cmake_minimum_required(VERSION 3.5.1)
+
+#
+# Simulate configuring and building Mbed TLS as the user might do it. We'll
+# skip installing it, and use the build directory directly instead.
+#
+
+set(MbedTLS_SOURCE_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../../..")
+set(MbedTLS_BINARY_DIR "${CMAKE_CURRENT_BINARY_DIR}/mbedtls")
+
+execute_process(
+    COMMAND "${CMAKE_COMMAND}"
+        "-H${MbedTLS_SOURCE_DIR}"
+        "-B${MbedTLS_BINARY_DIR}"
+        "-DENABLE_PROGRAMS=NO"
+        "-DENABLE_TESTING=NO"
+        # Turn on generated files explicitly in case this is a release
+        "-DGEN_FILES=ON")
+
+execute_process(
+    COMMAND "${CMAKE_COMMAND}"
+        --build "${MbedTLS_BINARY_DIR}")
+
+#
+# Locate the package.
+#
+
+set(MbedTLS_DIR "${MbedTLS_BINARY_DIR}/cmake")
+find_package(MbedTLS REQUIRED)
+
+#
+# At this point, the Mbed TLS targets should have been imported, and we can now
+# link to them from our own program.
+#
+
+add_executable(cmake_package cmake_package.c)
+target_link_libraries(cmake_package
+    MbedTLS::mbedcrypto MbedTLS::mbedtls MbedTLS::mbedx509)

vendor/mbedtls/programs/test/cmake_package/cmake_package.c

@@ -0,0 +1,27 @@
+/*
+ *  Simple program to test that Mbed TLS builds correctly as a CMake package.
+ *
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+#include "mbedtls/build_info.h"
+
+#include "mbedtls/platform.h"
+
+#include "mbedtls/version.h"
+
+/* The main reason to build this is for testing the CMake build, so the program
+ * doesn't need to do very much. It calls a single library function to ensure
+ * linkage works, but that is all. */
+int main()
+{
+    /* This version string is 18 bytes long, as advised by version.h. */
+    char version[18];
+
+    mbedtls_version_get_string_full(version);
+
+    mbedtls_printf("Built against %s\n", version);
+
+    return 0;
+}

vendor/mbedtls/programs/test/cmake_package_install/.gitignore

@@ -0,0 +1,4 @@
+build
+Makefile
+cmake_package_install
+mbedtls

vendor/mbedtls/programs/test/cmake_package_install/CMakeLists.txt

@@ -0,0 +1,41 @@
+cmake_minimum_required(VERSION 3.5.1)
+
+#
+# Simulate configuring and building Mbed TLS as the user might do it. We'll
+# install into a directory inside our own build directory.
+#
+
+set(MbedTLS_SOURCE_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../../..")
+set(MbedTLS_INSTALL_DIR "${CMAKE_CURRENT_BINARY_DIR}/mbedtls")
+set(MbedTLS_BINARY_DIR "${MbedTLS_INSTALL_DIR}${CMAKE_FILES_DIRECTORY}")
+
+execute_process(
+    COMMAND "${CMAKE_COMMAND}"
+        "-H${MbedTLS_SOURCE_DIR}"
+        "-B${MbedTLS_BINARY_DIR}"
+        "-DENABLE_PROGRAMS=NO"
+        "-DENABLE_TESTING=NO"
+        # Turn on generated files explicitly in case this is a release
+        "-DGEN_FILES=ON"
+        "-DCMAKE_INSTALL_PREFIX=${MbedTLS_INSTALL_DIR}")
+
+execute_process(
+    COMMAND "${CMAKE_COMMAND}"
+        --build "${MbedTLS_BINARY_DIR}"
+        --target install)
+
+#
+# Locate the package.
+#
+
+list(INSERT CMAKE_PREFIX_PATH 0 "${MbedTLS_INSTALL_DIR}")
+find_package(MbedTLS REQUIRED)
+
+#
+# At this point, the Mbed TLS targets should have been imported, and we can now
+# link to them from our own program.
+#
+
+add_executable(cmake_package_install cmake_package_install.c)
+target_link_libraries(cmake_package_install
+    MbedTLS::mbedcrypto MbedTLS::mbedtls MbedTLS::mbedx509)

vendor/mbedtls/programs/test/cmake_package_install/cmake_package_install.c

@@ -0,0 +1,28 @@
+/*
+ * Simple program to test that Mbed TLS builds correctly as an installable CMake
+ * package.
+ *
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+#include "mbedtls/build_info.h"
+
+#include "mbedtls/platform.h"
+
+#include "mbedtls/version.h"
+
+/* The main reason to build this is for testing the CMake build, so the program
+ * doesn't need to do very much. It calls a single library function to ensure
+ * linkage works, but that is all. */
+int main()
+{
+    /* This version string is 18 bytes long, as advised by version.h. */
+    char version[18];
+
+    mbedtls_version_get_string_full(version);
+
+    mbedtls_printf("Built against %s\n", version);
+
+    return 0;
+}

vendor/mbedtls/programs/test/cmake_subproject/.gitignore

@@ -0,0 +1,3 @@
+build
+Makefile
+cmake_subproject

vendor/mbedtls/programs/test/cmake_subproject/CMakeLists.txt

@@ -0,0 +1,23 @@
+cmake_minimum_required(VERSION 3.5.1)
+
+# Test the target renaming support by adding a prefix to the targets built
+set(MBEDTLS_TARGET_PREFIX subproject_test_)
+
+# We use the parent Mbed TLS directory as the MBEDTLS_DIR for this test. Other
+# projects that use Mbed TLS as a subproject are likely to add by their own
+# relative paths.
+set(MBEDTLS_DIR ../../../)
+
+# Add Mbed TLS as a subdirectory.
+add_subdirectory(${MBEDTLS_DIR} build)
+
+# Link against all the Mbed TLS libraries. Verifies that the targets have been
+# created using the specified prefix
+set(libs
+    subproject_test_mbedcrypto
+    subproject_test_mbedx509
+    subproject_test_mbedtls
+)
+
+add_executable(cmake_subproject cmake_subproject.c)
+target_link_libraries(cmake_subproject ${libs} ${CMAKE_THREAD_LIBS_INIT})

vendor/mbedtls/programs/test/cmake_subproject/cmake_subproject.c

@@ -0,0 +1,28 @@
+/*
+ *  Simple program to test that CMake builds with Mbed TLS as a subdirectory
+ *  work correctly.
+ *
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+#include "mbedtls/build_info.h"
+
+#include "mbedtls/platform.h"
+
+#include "mbedtls/version.h"
+
+/* The main reason to build this is for testing the CMake build, so the program
+ * doesn't need to do very much. It calls a single library function to ensure
+ * linkage works, but that is all. */
+int main()
+{
+    /* This version string is 18 bytes long, as advised by version.h. */
+    char version[18];
+
+    mbedtls_version_get_string_full(version);
+
+    mbedtls_printf("Built against %s\n", version);
+
+    return 0;
+}

vendor/mbedtls/programs/test/dlopen.c

@@ -0,0 +1,106 @@
+/*
+ *  Test dynamic loading of libmbed*
+ *
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+#include "mbedtls/build_info.h"
+
+#include "mbedtls/platform.h"
+
+#if defined(MBEDTLS_X509_CRT_PARSE_C)
+#include "mbedtls/x509_crt.h"
+#endif
+
+#if defined(__APPLE__)
+#define SO_SUFFIX ".dylib"
+#else
+#define SO_SUFFIX ".so"
+#endif
+
+#define CRYPTO_SO_FILENAME "libmbedcrypto" SO_SUFFIX
+#define X509_SO_FILENAME "libmbedx509" SO_SUFFIX
+#define TLS_SO_FILENAME "libmbedtls" SO_SUFFIX
+
+#include <dlfcn.h>
+
+#define CHECK_DLERROR(function, argument)                             \
+    do                                                                  \
+    {                                                                   \
+        char *CHECK_DLERROR_error = dlerror();                        \
+        if (CHECK_DLERROR_error != NULL)                               \
+        {                                                               \
+            fprintf(stderr, "Dynamic loading error for %s(%s): %s\n",  \
+                    function, argument, CHECK_DLERROR_error);         \
+            mbedtls_exit(MBEDTLS_EXIT_FAILURE);                       \
+        }                                                               \
+    }                                                                   \
+    while (0)
+
+int main(void)
+{
+#if defined(MBEDTLS_MD_C) || defined(MBEDTLS_SSL_TLS_C)
+    unsigned n;
+#endif
+
+#if defined(MBEDTLS_SSL_TLS_C)
+    void *tls_so = dlopen(TLS_SO_FILENAME, RTLD_NOW);
+    CHECK_DLERROR("dlopen", TLS_SO_FILENAME);
+#pragma GCC diagnostic push
+    /* dlsym() returns an object pointer which is meant to be used as a
+     * function pointer. This has undefined behavior in standard C, so
+     * "gcc -std=c99 -pedantic" complains about it, but it is perfectly
+     * fine on platforms that have dlsym(). */
+#pragma GCC diagnostic ignored "-Wpedantic"
+    const int *(*ssl_list_ciphersuites)(void) =
+        dlsym(tls_so, "mbedtls_ssl_list_ciphersuites");
+#pragma GCC diagnostic pop
+    CHECK_DLERROR("dlsym", "mbedtls_ssl_list_ciphersuites");
+    const int *ciphersuites = ssl_list_ciphersuites();
+    for (n = 0; ciphersuites[n] != 0; n++) {/* nothing to do, we're just counting */
+        ;
+    }
+    mbedtls_printf("dlopen(%s): %u ciphersuites\n",
+                   TLS_SO_FILENAME, n);
+    dlclose(tls_so);
+    CHECK_DLERROR("dlclose", TLS_SO_FILENAME);
+#endif  /* MBEDTLS_SSL_TLS_C */
+
+#if defined(MBEDTLS_X509_CRT_PARSE_C)
+    void *x509_so = dlopen(X509_SO_FILENAME, RTLD_NOW);
+    CHECK_DLERROR("dlopen", X509_SO_FILENAME);
+    const mbedtls_x509_crt_profile *profile =
+        dlsym(x509_so, "mbedtls_x509_crt_profile_default");
+    CHECK_DLERROR("dlsym", "mbedtls_x509_crt_profile_default");
+    mbedtls_printf("dlopen(%s): Allowed md mask: %08x\n",
+                   X509_SO_FILENAME, (unsigned) profile->allowed_mds);
+    dlclose(x509_so);
+    CHECK_DLERROR("dlclose", X509_SO_FILENAME);
+#endif  /* MBEDTLS_X509_CRT_PARSE_C */
+
+#if defined(MBEDTLS_MD_C)
+    void *crypto_so = dlopen(CRYPTO_SO_FILENAME, RTLD_NOW);
+    CHECK_DLERROR("dlopen", CRYPTO_SO_FILENAME);
+#pragma GCC diagnostic push
+    /* dlsym() returns an object pointer which is meant to be used as a
+     * function pointer. This has undefined behavior in standard C, so
+     * "gcc -std=c99 -pedantic" complains about it, but it is perfectly
+     * fine on platforms that have dlsym(). */
+#pragma GCC diagnostic ignored "-Wpedantic"
+    const int *(*md_list)(void) =
+        dlsym(crypto_so, "mbedtls_md_list");
+#pragma GCC diagnostic pop
+    CHECK_DLERROR("dlsym", "mbedtls_md_list");
+    const int *mds = md_list();
+    for (n = 0; mds[n] != 0; n++) {/* nothing to do, we're just counting */
+        ;
+    }
+    mbedtls_printf("dlopen(%s): %u hashes\n",
+                   CRYPTO_SO_FILENAME, n);
+    dlclose(crypto_so);
+    CHECK_DLERROR("dlclose", CRYPTO_SO_FILENAME);
+#endif  /* MBEDTLS_MD_C */
+
+    return 0;
+}

vendor/mbedtls/programs/test/generate_cpp_dummy_build.sh

@@ -0,0 +1,78 @@
+#!/bin/sh
+
+DEFAULT_OUTPUT_FILE=programs/test/cpp_dummy_build.cpp
+
+if [ "$1" = "--help" ]; then
+    cat <<EOF
+Usage: $0 [OUTPUT]
+Generate a C++ dummy build program that includes all the headers.
+OUTPUT defaults to "programs/test/cpp_dummy_build.cpp".
+Run this program from the root of an Mbed TLS directory tree or from
+its "programs" or "programs/test" subdirectory.
+EOF
+    exit
+fi
+
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+set -e
+
+# Ensure a reproducible order for *.h
+export LC_ALL=C
+
+print_cpp () {
+    cat <<'EOF'
+/* Automatically generated file. Do not edit.
+ *
+ *  This program is a dummy C++ program to ensure Mbed TLS library header files
+ *  can be included and built with a C++ compiler.
+ *
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ *
+ */
+
+#include "mbedtls/build_info.h"
+
+EOF
+
+    for header in include/mbedtls/*.h include/psa/*.h; do
+        case ${header#include/} in
+            mbedtls/mbedtls_config.h) :;; # not meant for direct inclusion
+            mbedtls/config_*.h) :;; # not meant for direct inclusion
+            psa/crypto_config.h) :;; # not meant for direct inclusion
+            psa/crypto_ajdust_config*.h) :;; # not meant for direct inclusion
+            # Some of the psa/crypto_*.h headers are not meant to be included
+            # directly. They do have include guards that make them no-ops if
+            # psa/crypto.h has been included before. Since psa/crypto.h comes
+            # before psa/crypto_*.h in the wildcard enumeration, we don't need
+            # to skip those headers.
+            *) echo "#include \"${header#include/}\"";;
+        esac
+    done
+
+    cat <<'EOF'
+
+int main()
+{
+    mbedtls_platform_context *ctx = NULL;
+    mbedtls_platform_setup(ctx);
+    mbedtls_printf("CPP Build test passed\n");
+    mbedtls_platform_teardown(ctx);
+}
+EOF
+}
+
+if [ -d include/mbedtls ]; then
+    :
+elif [ -d ../include/mbedtls ]; then
+    cd ..
+elif [ -d ../../include/mbedtls ]; then
+    cd ../..
+else
+    echo >&2 "This script must be run from an Mbed TLS source tree."
+    exit 3
+fi
+
+print_cpp >"${1:-$DEFAULT_OUTPUT_FILE}"

vendor/mbedtls/programs/test/selftest.c

@@ -0,0 +1,584 @@
+/*
+ *  Self-test demonstration program
+ *
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+#include "mbedtls/build_info.h"
+
+#include "mbedtls/entropy.h"
+#include "mbedtls/hmac_drbg.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/dhm.h"
+#include "mbedtls/gcm.h"
+#include "mbedtls/ccm.h"
+#include "mbedtls/cmac.h"
+#include "mbedtls/md5.h"
+#include "mbedtls/ripemd160.h"
+#include "mbedtls/sha1.h"
+#include "mbedtls/sha256.h"
+#include "mbedtls/sha512.h"
+#include "mbedtls/sha3.h"
+#include "mbedtls/des.h"
+#include "mbedtls/aes.h"
+#include "mbedtls/camellia.h"
+#include "mbedtls/aria.h"
+#include "mbedtls/chacha20.h"
+#include "mbedtls/poly1305.h"
+#include "mbedtls/chachapoly.h"
+#include "mbedtls/base64.h"
+#include "mbedtls/bignum.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/x509.h"
+#include "mbedtls/pkcs5.h"
+#include "mbedtls/ecp.h"
+#include "mbedtls/ecjpake.h"
+#include "mbedtls/timing.h"
+#include "mbedtls/nist_kw.h"
+#include "mbedtls/debug.h"
+
+#include <limits.h>
+#include <string.h>
+
+#include "mbedtls/platform.h"
+
+#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
+#include "mbedtls/memory_buffer_alloc.h"
+#endif
+
+
+#if defined MBEDTLS_SELF_TEST
+/* Sanity check for malloc. This is not expected to fail, and is rather
+ * intended to display potentially useful information about the platform,
+ * in particular the behavior of malloc(0). */
+static int calloc_self_test(int verbose)
+{
+    int failures = 0;
+    void *empty1 = mbedtls_calloc(0, 1);
+    void *empty2 = mbedtls_calloc(0, 1);
+    void *buffer1 = mbedtls_calloc(1, 1);
+    void *buffer2 = mbedtls_calloc(1, 1);
+    unsigned int buffer_3_size = 256;
+    unsigned int buffer_4_size = 4097; /* Allocate more than the usual page size */
+    unsigned char *buffer3 = mbedtls_calloc(buffer_3_size, 1);
+    unsigned char *buffer4 = mbedtls_calloc(buffer_4_size, 1);
+
+    if (empty1 == NULL && empty2 == NULL) {
+        if (verbose) {
+            mbedtls_printf("  CALLOC(0,1): passed (NULL)\n");
+        }
+    } else if (empty1 == NULL || empty2 == NULL) {
+        if (verbose) {
+            mbedtls_printf("  CALLOC(0,1): failed (mix of NULL and non-NULL)\n");
+        }
+        ++failures;
+    } else if (empty1 == empty2) {
+        if (verbose) {
+            mbedtls_printf("  CALLOC(0,1): passed (same non-null)\n");
+        }
+        empty2 = NULL;
+    } else {
+        if (verbose) {
+            mbedtls_printf("  CALLOC(0,1): passed (distinct non-null)\n");
+        }
+    }
+
+    mbedtls_free(empty1);
+    mbedtls_free(empty2);
+
+    empty1 = mbedtls_calloc(1, 0);
+    empty2 = mbedtls_calloc(1, 0);
+    if (empty1 == NULL && empty2 == NULL) {
+        if (verbose) {
+            mbedtls_printf("  CALLOC(1,0): passed (NULL)\n");
+        }
+    } else if (empty1 == NULL || empty2 == NULL) {
+        if (verbose) {
+            mbedtls_printf("  CALLOC(1,0): failed (mix of NULL and non-NULL)\n");
+        }
+        ++failures;
+    } else if (empty1 == empty2) {
+        if (verbose) {
+            mbedtls_printf("  CALLOC(1,0): passed (same non-null)\n");
+        }
+        empty2 = NULL;
+    } else {
+        if (verbose) {
+            mbedtls_printf("  CALLOC(1,0): passed (distinct non-null)\n");
+        }
+    }
+
+    if (buffer1 == NULL || buffer2 == NULL) {
+        if (verbose) {
+            mbedtls_printf("  CALLOC(1): failed (NULL)\n");
+        }
+        ++failures;
+    } else if (buffer1 == buffer2) {
+        if (verbose) {
+            mbedtls_printf("  CALLOC(1): failed (same buffer twice)\n");
+        }
+        ++failures;
+        buffer2 = NULL;
+    } else {
+        if (verbose) {
+            mbedtls_printf("  CALLOC(1): passed\n");
+        }
+    }
+
+    mbedtls_free(buffer1);
+    buffer1 = mbedtls_calloc(1, 1);
+    if (buffer1 == NULL) {
+        if (verbose) {
+            mbedtls_printf("  CALLOC(1 again): failed (NULL)\n");
+        }
+        ++failures;
+    } else {
+        if (verbose) {
+            mbedtls_printf("  CALLOC(1 again): passed\n");
+        }
+    }
+
+    for (unsigned int i = 0; i < buffer_3_size; i++) {
+        if (buffer3[i] != 0) {
+            ++failures;
+            if (verbose) {
+                mbedtls_printf("  CALLOC(%u): failed (memory not initialized to 0)\n",
+                               buffer_3_size);
+            }
+            break;
+        }
+    }
+
+    for (unsigned int i = 0; i < buffer_4_size; i++) {
+        if (buffer4[i] != 0) {
+            ++failures;
+            if (verbose) {
+                mbedtls_printf("  CALLOC(%u): failed (memory not initialized to 0)\n",
+                               buffer_4_size);
+            }
+            break;
+        }
+    }
+
+    if (verbose) {
+        mbedtls_printf("\n");
+    }
+    mbedtls_free(empty1);
+    mbedtls_free(empty2);
+    mbedtls_free(buffer1);
+    mbedtls_free(buffer2);
+    mbedtls_free(buffer3);
+    mbedtls_free(buffer4);
+    return failures;
+}
+#endif /* MBEDTLS_SELF_TEST */
+
+static int test_snprintf(size_t n, const char *ref_buf, int ref_ret)
+{
+    int ret;
+    char buf[10] = "xxxxxxxxx";
+    const char ref[10] = "xxxxxxxxx";
+
+    ret = mbedtls_snprintf(buf, n, "%s", "123");
+    if (ret < 0 || (size_t) ret >= n) {
+        ret = -1;
+    }
+
+    if (strncmp(ref_buf, buf, sizeof(buf)) != 0 ||
+        ref_ret != ret ||
+        memcmp(buf + n, ref + n, sizeof(buf) - n) != 0) {
+        return 1;
+    }
+
+    return 0;
+}
+
+static int run_test_snprintf(void)
+{
+    return test_snprintf(0, "xxxxxxxxx",  -1) != 0 ||
+           test_snprintf(1, "",           -1) != 0 ||
+           test_snprintf(2, "1",          -1) != 0 ||
+           test_snprintf(3, "12",         -1) != 0 ||
+           test_snprintf(4, "123",         3) != 0 ||
+           test_snprintf(5, "123",         3) != 0;
+}
+
+/*
+ * Check if a seed file is present, and if not create one for the entropy
+ * self-test. If this fails, we attempt the test anyway, so no error is passed
+ * back.
+ */
+#if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_ENTROPY_C)
+#if defined(MBEDTLS_ENTROPY_NV_SEED) && !defined(MBEDTLS_NO_PLATFORM_ENTROPY)
+static void create_entropy_seed_file(void)
+{
+    int result;
+    size_t output_len = 0;
+    unsigned char seed_value[MBEDTLS_ENTROPY_BLOCK_SIZE];
+
+    /* Attempt to read the entropy seed file. If this fails - attempt to write
+     * to the file to ensure one is present. */
+    result = mbedtls_platform_std_nv_seed_read(seed_value,
+                                               MBEDTLS_ENTROPY_BLOCK_SIZE);
+    if (0 == result) {
+        return;
+    }
+
+    result = mbedtls_platform_entropy_poll(NULL,
+                                           seed_value,
+                                           MBEDTLS_ENTROPY_BLOCK_SIZE,
+                                           &output_len);
+    if (0 != result) {
+        return;
+    }
+
+    if (MBEDTLS_ENTROPY_BLOCK_SIZE != output_len) {
+        return;
+    }
+
+    mbedtls_platform_std_nv_seed_write(seed_value, MBEDTLS_ENTROPY_BLOCK_SIZE);
+}
+#endif
+
+static int mbedtls_entropy_self_test_wrapper(int verbose)
+{
+#if defined(MBEDTLS_ENTROPY_NV_SEED) && !defined(MBEDTLS_NO_PLATFORM_ENTROPY)
+    create_entropy_seed_file();
+#endif
+    return mbedtls_entropy_self_test(verbose);
+}
+#endif
+
+#if defined(MBEDTLS_SELF_TEST)
+#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
+static int mbedtls_memory_buffer_alloc_free_and_self_test(int verbose)
+{
+    if (verbose != 0) {
+#if defined(MBEDTLS_MEMORY_DEBUG)
+        mbedtls_memory_buffer_alloc_status();
+#endif
+    }
+    mbedtls_memory_buffer_alloc_free();
+    return mbedtls_memory_buffer_alloc_self_test(verbose);
+}
+#endif
+
+typedef struct {
+    const char *name;
+    int (*function)(int);
+} selftest_t;
+
+const selftest_t selftests[] =
+{
+    { "calloc", calloc_self_test },
+#if defined(MBEDTLS_MD5_C)
+    { "md5", mbedtls_md5_self_test },
+#endif
+#if defined(MBEDTLS_RIPEMD160_C)
+    { "ripemd160", mbedtls_ripemd160_self_test },
+#endif
+#if defined(MBEDTLS_SHA1_C)
+    { "sha1", mbedtls_sha1_self_test },
+#endif
+#if defined(MBEDTLS_SHA224_C)
+    { "sha224", mbedtls_sha224_self_test },
+#endif
+#if defined(MBEDTLS_SHA256_C)
+    { "sha256", mbedtls_sha256_self_test },
+#endif
+#if defined(MBEDTLS_SHA384_C)
+    { "sha384", mbedtls_sha384_self_test },
+#endif
+#if defined(MBEDTLS_SHA512_C)
+    { "sha512", mbedtls_sha512_self_test },
+#endif
+#if defined(MBEDTLS_SHA3_C)
+    { "sha3", mbedtls_sha3_self_test },
+#endif
+#if defined(MBEDTLS_DES_C)
+    { "des", mbedtls_des_self_test },
+#endif
+#if defined(MBEDTLS_AES_C)
+    { "aes", mbedtls_aes_self_test },
+#endif
+#if defined(MBEDTLS_GCM_C) && defined(MBEDTLS_AES_C)
+    { "gcm", mbedtls_gcm_self_test },
+#endif
+#if defined(MBEDTLS_CCM_C) && defined(MBEDTLS_AES_C)
+    { "ccm", mbedtls_ccm_self_test },
+#endif
+#if defined(MBEDTLS_NIST_KW_C) && defined(MBEDTLS_AES_C)
+    { "nist_kw", mbedtls_nist_kw_self_test },
+#endif
+#if defined(MBEDTLS_CMAC_C)
+    { "cmac", mbedtls_cmac_self_test },
+#endif
+#if defined(MBEDTLS_CHACHA20_C)
+    { "chacha20", mbedtls_chacha20_self_test },
+#endif
+#if defined(MBEDTLS_POLY1305_C)
+    { "poly1305", mbedtls_poly1305_self_test },
+#endif
+#if defined(MBEDTLS_CHACHAPOLY_C)
+    { "chacha20-poly1305", mbedtls_chachapoly_self_test },
+#endif
+#if defined(MBEDTLS_BASE64_C)
+    { "base64", mbedtls_base64_self_test },
+#endif
+#if defined(MBEDTLS_BIGNUM_C)
+    { "mpi", mbedtls_mpi_self_test },
+#endif
+#if defined(MBEDTLS_RSA_C)
+    { "rsa", mbedtls_rsa_self_test },
+#endif
+#if defined(MBEDTLS_CAMELLIA_C)
+    { "camellia", mbedtls_camellia_self_test },
+#endif
+#if defined(MBEDTLS_ARIA_C)
+    { "aria", mbedtls_aria_self_test },
+#endif
+#if defined(MBEDTLS_CTR_DRBG_C)
+    { "ctr_drbg", mbedtls_ctr_drbg_self_test },
+#endif
+#if defined(MBEDTLS_HMAC_DRBG_C)
+    { "hmac_drbg", mbedtls_hmac_drbg_self_test },
+#endif
+#if defined(MBEDTLS_ECP_C)
+    { "ecp", mbedtls_ecp_self_test },
+#endif
+#if defined(MBEDTLS_ECJPAKE_C)
+    { "ecjpake", mbedtls_ecjpake_self_test },
+#endif
+#if defined(MBEDTLS_DHM_C)
+    { "dhm", mbedtls_dhm_self_test },
+#endif
+#if defined(MBEDTLS_ENTROPY_C)
+    { "entropy", mbedtls_entropy_self_test_wrapper },
+#endif
+#if defined(MBEDTLS_PKCS5_C)
+    { "pkcs5", mbedtls_pkcs5_self_test },
+#endif
+/* Heap test comes last */
+#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
+    { "memory_buffer_alloc", mbedtls_memory_buffer_alloc_free_and_self_test },
+#endif
+    { NULL, NULL }
+};
+#endif /* MBEDTLS_SELF_TEST */
+
+int main(int argc, char *argv[])
+{
+#if defined(MBEDTLS_SELF_TEST)
+    const selftest_t *test;
+#endif /* MBEDTLS_SELF_TEST */
+    char **argp;
+    int v = 1; /* v=1 for verbose mode */
+    int exclude_mode = 0;
+    int suites_tested = 0, suites_failed = 0;
+#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) && defined(MBEDTLS_SELF_TEST)
+    unsigned char buf[1000000];
+#endif
+    void *pointer;
+
+    /*
+     * Check some basic platform requirements as specified in README.md
+     */
+    if (SIZE_MAX < INT_MAX || SIZE_MAX < UINT_MAX) {
+        mbedtls_printf("SIZE_MAX must be at least as big as INT_MAX and UINT_MAX\n");
+        mbedtls_exit(MBEDTLS_EXIT_FAILURE);
+    }
+
+    if (sizeof(int) < 4) {
+        mbedtls_printf("int must be at least 32 bits\n");
+        mbedtls_exit(MBEDTLS_EXIT_FAILURE);
+    }
+
+    if (sizeof(size_t) < 4) {
+        mbedtls_printf("size_t must be at least 32 bits\n");
+        mbedtls_exit(MBEDTLS_EXIT_FAILURE);
+    }
+
+    uint32_t endian_test = 0x12345678;
+    char *p = (char *) &endian_test;
+    if (!(p[0] == 0x12 && p[1] == 0x34 && p[2] == 0x56 && p[3] == 0x78) &&
+        !(p[3] == 0x12 && p[2] == 0x34 && p[1] == 0x56 && p[0] == 0x78)) {
+        mbedtls_printf("Mixed-endian platforms are not supported\n");
+        mbedtls_exit(MBEDTLS_EXIT_FAILURE);
+    }
+
+    /*
+     * The C standard doesn't guarantee that all-bits-0 is the representation
+     * of a NULL pointer. We do however use that in our code for initializing
+     * structures, which should work on every modern platform. Let's be sure.
+     */
+    memset(&pointer, 0, sizeof(void *));
+    if (pointer != NULL) {
+        mbedtls_printf("all-bits-zero is not a NULL pointer\n");
+        mbedtls_exit(MBEDTLS_EXIT_FAILURE);
+    }
+
+    /*
+     * The C standard allows padding bits in the representation
+     * of standard integer types, but our code does currently not
+     * support them.
+     *
+     * Here we check that the underlying C implementation doesn't
+     * use padding bits, and fail cleanly if it does.
+     *
+     * The check works by casting the maximum value representable
+     * by a given integer type into the unpadded integer type of the
+     * same bit-width and checking that it agrees with the maximum value
+     * of that unpadded type. For example, for a 4-byte int,
+     * MAX_INT should be 0x7fffffff in int32_t. This assumes that
+     * CHAR_BIT == 8, which is checked in check_config.h.
+     *
+     * We assume that [u]intxx_t exist and that they don't
+     * have padding bits, as the standard requires.
+     */
+
+#define CHECK_PADDING_SIGNED(TYPE, NAME)                                \
+    do                                                                  \
+    {                                                                   \
+        if (sizeof(TYPE) == 2 || sizeof(TYPE) == 4 ||               \
+            sizeof(TYPE) == 8) {                                 \
+            if ((sizeof(TYPE) == 2 &&                                \
+                 (int16_t) NAME ## _MAX != 0x7FFF)             ||       \
+                (sizeof(TYPE) == 4 &&                                \
+                 (int32_t) NAME ## _MAX != 0x7FFFFFFF)         ||       \
+                (sizeof(TYPE) == 8 &&                                \
+                 (int64_t) NAME ## _MAX != 0x7FFFFFFFFFFFFFFF))        \
+            {                                                           \
+                mbedtls_printf("Type '" #TYPE "' has padding bits\n"); \
+                mbedtls_exit(MBEDTLS_EXIT_FAILURE);                   \
+            }                                                           \
+        } else {                                                        \
+            mbedtls_printf("Padding checks only implemented for types of size 2, 4 or 8" \
+                           " - cannot check type '" #TYPE "' of size %" MBEDTLS_PRINTF_SIZET "\n",       \
+                           sizeof(TYPE));                                       \
+            mbedtls_exit(MBEDTLS_EXIT_FAILURE);                       \
+        }                                                               \
+    } while (0)
+
+#define CHECK_PADDING_UNSIGNED(TYPE, NAME)                              \
+    do                                                                  \
+    {                                                                   \
+        if ((sizeof(TYPE) == 2 &&                                    \
+             (uint16_t) NAME ## _MAX != 0xFFFF)             ||        \
+            (sizeof(TYPE) == 4 &&                                    \
+             (uint32_t) NAME ## _MAX != 0xFFFFFFFF)         ||        \
+            (sizeof(TYPE) == 8 &&                                    \
+             (uint64_t) NAME ## _MAX != 0xFFFFFFFFFFFFFFFF))         \
+        {                                                               \
+            mbedtls_printf("Type '" #TYPE "' has padding bits\n");    \
+            mbedtls_exit(MBEDTLS_EXIT_FAILURE);                       \
+        }                                                               \
+    } while (0)
+
+    CHECK_PADDING_SIGNED(short,        SHRT);
+    CHECK_PADDING_SIGNED(int,           INT);
+    CHECK_PADDING_SIGNED(long,         LONG);
+    CHECK_PADDING_SIGNED(long long,   LLONG);
+    CHECK_PADDING_SIGNED(ptrdiff_t, PTRDIFF);
+
+    CHECK_PADDING_UNSIGNED(unsigned short,      USHRT);
+    CHECK_PADDING_UNSIGNED(unsigned,             UINT);
+    CHECK_PADDING_UNSIGNED(unsigned long,       ULONG);
+    CHECK_PADDING_UNSIGNED(unsigned long long, ULLONG);
+    CHECK_PADDING_UNSIGNED(size_t,               SIZE);
+
+#undef CHECK_PADDING_SIGNED
+#undef CHECK_PADDING_UNSIGNED
+
+    /*
+     * Make sure we have a snprintf that correctly zero-terminates
+     */
+    if (run_test_snprintf() != 0) {
+        mbedtls_printf("the snprintf implementation is broken\n");
+        mbedtls_exit(MBEDTLS_EXIT_FAILURE);
+    }
+
+    for (argp = argv + (argc >= 1 ? 1 : argc); *argp != NULL; ++argp) {
+        if (strcmp(*argp, "--quiet") == 0 ||
+            strcmp(*argp, "-q") == 0) {
+            v = 0;
+        } else if (strcmp(*argp, "--exclude") == 0 ||
+                   strcmp(*argp, "-x") == 0) {
+            exclude_mode = 1;
+        } else {
+            break;
+        }
+    }
+
+    if (v != 0) {
+        mbedtls_printf("\n");
+    }
+
+#if defined(MBEDTLS_SELF_TEST)
+
+#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
+    mbedtls_memory_buffer_alloc_init(buf, sizeof(buf));
+#endif
+
+    if (*argp != NULL && exclude_mode == 0) {
+        /* Run the specified tests */
+        for (; *argp != NULL; argp++) {
+            for (test = selftests; test->name != NULL; test++) {
+                if (!strcmp(*argp, test->name)) {
+                    if (test->function(v)  != 0) {
+                        suites_failed++;
+                    }
+                    suites_tested++;
+                    break;
+                }
+            }
+            if (test->name == NULL) {
+                mbedtls_printf("  Test suite %s not available -> failed\n\n", *argp);
+                suites_failed++;
+            }
+        }
+    } else {
+        /* Run all the tests except excluded ones */
+        for (test = selftests; test->name != NULL; test++) {
+            if (exclude_mode) {
+                char **excluded;
+                for (excluded = argp; *excluded != NULL; ++excluded) {
+                    if (!strcmp(*excluded, test->name)) {
+                        break;
+                    }
+                }
+                if (*excluded) {
+                    if (v) {
+                        mbedtls_printf("  Skip: %s\n", test->name);
+                    }
+                    continue;
+                }
+            }
+            if (test->function(v)  != 0) {
+                suites_failed++;
+            }
+            suites_tested++;
+        }
+    }
+
+#else
+    (void) exclude_mode;
+    mbedtls_printf(" MBEDTLS_SELF_TEST not defined.\n");
+#endif
+
+    if (v != 0) {
+        mbedtls_printf("  Executed %d test suites\n\n", suites_tested);
+
+        if (suites_failed > 0) {
+            mbedtls_printf("  [ %d tests FAIL ]\n\n", suites_failed);
+        } else {
+            mbedtls_printf("  [ All tests PASS ]\n\n");
+        }
+    }
+
+    if (suites_failed > 0) {
+        mbedtls_exit(MBEDTLS_EXIT_FAILURE);
+    }
+
+    mbedtls_exit(MBEDTLS_EXIT_SUCCESS);
+}

vendor/mbedtls/programs/test/udp_proxy_wrapper.sh

@@ -0,0 +1,120 @@
+#!/bin/sh
+# -*-sh-basic-offset: 4-*-
+# Usage: udp_proxy_wrapper.sh [PROXY_PARAM...] -- [SERVER_PARAM...]
+#
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+set -u
+
+MBEDTLS_BASE="$(dirname -- "$0")/../.."
+TPXY_BIN="$MBEDTLS_BASE/programs/test/udp_proxy"
+SRV_BIN="$MBEDTLS_BASE/programs/ssl/ssl_server2"
+
+: ${VERBOSE:=0}
+
+stop_proxy() {
+    if [ -n "${tpxy_pid:-}" ]; then
+        echo
+        echo "  * Killing proxy (pid $tpxy_pid) ..."
+        kill $tpxy_pid
+    fi
+}
+
+stop_server() {
+    if [ -n "${srv_pid:-}" ]; then
+        echo
+        echo "  * Killing server (pid $srv_pid) ..."
+        kill $srv_pid >/dev/null 2>/dev/null
+    fi
+}
+
+cleanup() {
+    stop_server
+    stop_proxy
+    exit 129
+}
+
+trap cleanup INT TERM HUP
+
+# Extract the proxy parameters
+tpxy_cmd_snippet='"$TPXY_BIN"'
+while [ $# -ne 0 ] && [ "$1" != "--" ]; do
+    tail="$1" quoted=""
+    while [ -n "$tail" ]; do
+        case "$tail" in
+            *\'*) quoted="${quoted}${tail%%\'*}'\\''" tail="${tail#*\'}";;
+            *) quoted="${quoted}${tail}"; tail=; false;;
+        esac
+    done
+    tpxy_cmd_snippet="$tpxy_cmd_snippet '$quoted'"
+    shift
+done
+unset tail quoted
+if [ $# -eq 0 ]; then
+    echo "  * No server arguments (must be preceded by \" -- \") - exit"
+    exit 3
+fi
+shift
+
+dtls_enabled=
+ipv6_in_use=
+server_port_orig=
+server_addr_orig=
+for param; do
+    case "$param" in
+        server_port=*) server_port_orig="${param#*=}";;
+        server_addr=*:*) server_addr_orig="${param#*=}"; ipv6_in_use=1;;
+        server_addr=*) server_addr_orig="${param#*=}";;
+        dtls=[!0]*) dtls_enabled=1;;
+    esac
+done
+
+if [ -z "$dtls_enabled" ] || [ -n "$ipv6_in_use" ]; then
+    echo >&2 "$0: Couldn't find DTLS enabling, or IPv6 is in use - immediate fallback to server application..."
+    if [ $VERBOSE -gt 0 ]; then
+        echo "[ $SRV_BIN $* ]"
+    fi
+    exec "$SRV_BIN" "$@"
+fi
+
+if [ -z "$server_port_orig" ]; then
+    server_port_orig=4433
+fi
+echo "  * Server port:       $server_port_orig"
+tpxy_cmd_snippet="$tpxy_cmd_snippet \"listen_port=\$server_port_orig\""
+tpxy_cmd_snippet="$tpxy_cmd_snippet \"server_port=\$server_port\""
+
+if [ -n "$server_addr_orig" ]; then
+    echo "  * Server address:    $server_addr_orig"
+    tpxy_cmd_snippet="$tpxy_cmd_snippet \"server_addr=\$server_addr_orig\""
+    tpxy_cmd_snippet="$tpxy_cmd_snippet \"listen_addr=\$server_addr_orig\""
+fi
+
+server_port=$(( server_port_orig + 1 ))
+set -- "$@" "server_port=$server_port"
+echo "  * Intermediate port: $server_port"
+
+echo "  * Start proxy in background ..."
+if [ $VERBOSE -gt 0 ]; then
+    echo "[ $tpxy_cmd_snippet ]"
+fi
+eval exec "$tpxy_cmd_snippet" >/dev/null 2>&1 &
+tpxy_pid=$!
+
+if [ $VERBOSE -gt 0 ]; then
+    echo "  * Proxy ID:          $TPXY_PID"
+fi
+
+echo "  * Starting server ..."
+if [ $VERBOSE -gt 0 ]; then
+    echo "[ $SRV_BIN $* ]"
+fi
+
+exec "$SRV_BIN" "$@" >&2 &
+srv_pid=$!
+
+wait $srv_pid
+
+stop_proxy
+return 0