[LT] Add package.json

[LT] Fix compilation errors
[LT] Add vendor changes from amb1_sdk/v1.4.1 (misc)
2023-02-25 21:10:49 +01:00 · 2022-11-26 15:24:57 +01:00 · 2022-11-26 14:03:09 +01:00 · 2022-11-26 14:00:13 +01:00 · 2022-11-26 13:57:42 +01:00 · 2022-11-26 13:50:58 +01:00
330 changed files with 49856 additions and 13793 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -2,3 +2,9 @@
 *.txt     text
 *.c       text
 *.h       text
+
+# For git archive
+.gitignore              export-ignore
+.gitattributes          export-ignore
+.travis.yml             export-ignore
+.vscode                 export-ignore
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,5 @@
+*.o
+*.a
 /doc/doxygen/output/html
 /src/apps/snmp/LwipMibCompiler/CCodeGeneration/bin/
 /src/apps/snmp/LwipMibCompiler/CCodeGeneration/obj/
@@ -11,3 +13,7 @@
 /src/apps/snmp/LwipMibCompiler/SharpSnmpLib/obj/
 /src/apps/snmp/LwipMibCompiler/LwipMibCompiler.userprefs
 /src/apps/snmp/LwipMibCompiler/*.suo
+/test/fuzz/output
+/test/fuzz/lwip_fuzz
+/test/fuzz/.depend
+/build
--- a/418
+++ b/418
@@ -1,9 +1,427 @@
 HISTORY
+ * These are only the most important changes. For a full list, use git log:
+   http://git.savannah.nongnu.org/cgit/lwip.git

 (git master)

  * [Enter new changes just after this line - do not remove this line]

+(STABLE-2.1.2):
+
+  ++ Bugfixes:
+
+  2018-11-21: Jens Nielsen
+  * netbiosns.c: fix expecting too large packet (bug #55069)
+
+  2018-11-19: Dirk Ziegelmeier
+  * smtp.c: fix compiling with strict C compatibility because of strnlen (bug #55034)
+
+  2018-11-12: Simon Goldschmidt
+  * tcp.c: fix overflow check in tcp_recved triggering invalid assertion (bug #55015)
+
+  2018-11-12: Simon Goldschmidt
+  * tcp.c: fix a bug in sending RST segments (sent from port 0)
+
+(STABLE-2.1.1):
+
+  ++ Bugfixes:
+
+  2018-11-01: Joan Lledó
+  * sockets.c: fix bad assertion in lwip_poll_dec_sockets_used() (bug #54933)
+
+  2018-11-01: Dirk Ziegelmeier
+  * ip4.c: don't send 127.* to default netif (bug #54670)
+
+  2018-10-23: David Girault
+  * altcp_tls_mbedtls.c: fix use-after free (bug #54774)
+
+  2018-10-23: Ognjen Bjelica, Dirk Ziegelmeier
+  * snmp_scalar.c: Avoid NULL pointer dereference (bug #54886)
+
+  2018-10-23: Simon Goldschmidt
+  * Fix missing standard includes in multiple files
+
+  2018-10-17: Ivan Warren
+  * def.h: fix casting htonX and ntohX to u16_t (bug #54850)
+
+  2018-10-12: Simon Goldschmidt
+  * Revert "tcp_abandon: no need to buffer pcb->local_port" (fix that source port was 0 for RST
+    called when aborting a connection)
+
+  2018-10-11: Jonas Rabenstein
+  * tcp.c: tcp_recved: check for overflow and warn about too big values (patch #9699)              
+
+  2018-10-06: Joan Lledó
+  * sockets.c: alloc_socket(): Check for LWIP_SOCKET_POLL when setting select-
+    related variables (patch #9696)
+
+  2018-10-04: Spencer
+  * tcp.c: Update prev pointer when skipping entries in tcp_slowtmr (patch #9694)
+
+  2018-09-27: Martine Lenders
+  * lowpan6.c: Fix IEEE 802.15.4 address setting (bug #54749)
+
+(STABLE-2.1.0):
+
+  ++ New features:
+
+  2018-06-17: Simon Goldschmidt
+  * lwiperf: implemented iPerf client mode
+
+  2018-04-23: Dirk Ziegelmeier
+  * added cmake build files
+
+  2018-03-04: Ray Abram
+  * netbios responder: respond to '*' queries
+
+  2018-02-23: Benjamin Aigner
+  * 6lowpan: add 6lowpan-over-BLE netif (based on existing 6lowpan netif)
+
+  2018-02-22: Simon Goldschmidt
+  * ipv6: add support for stateless DHCPv6 (to get DNS servers in SLAAC nets)
+
+  2018-02-16: Simon Goldschmidt
+  * add raw API http(s) client (with proxy support)
+
+  2018-02-01: Simon Goldschmidt
+  * tcp: add hooks to implement additional socket options
+
+  2018-02-01: Simon Goldschmidt
+  * tcp: add hooks to implement tcp md5 signatures or similar (see contrib/addons for an example)
+
+  2018-01-05: Simon Goldschmidt
+  * Added sys_mbox_trypost_fromisr() and tcpip_callbackmsg_trycallback_fromisr()
+    These can be used to post preallocated messages from an ISR to the tcpip thread
+    (e.g. when using FreeRTOS)
+
+  2018-01-02: Dirk Ziegelmeier
+  * task #14780: Add debug helper asserts to ensure threading/locking requirements are met
+
+  2017-11-21: Simon Goldschmidt
+  * task #14600: tcp_alloc(): kill TF_CLOSEPEND connections before other ESTABLISHED
+
+  2017-11-21: Simon Goldschmidt
+  * makefsdata: added option "-ssi:<filename>" to control SSI tag checking/insertion
+    through a list of filenames, not by checking the file extension at runtime
+
+  2017-11-20: Joel Cunningham
+  * netconn: add LWIP_HOOK_NETCONN_EXTERNAL_RESOLVE to use external DNS resolver (patch #9427)
+
+  2017-11-14: Joel Cunningham
+  * netifapi: Add thread safe ARP cache APIs (task #14724)
+
+  2017-11-06: Axel Lin
+  * TCP: kill existing connections with a LOWER priority than the one currently being opened.
+    Previous implementations also kill existing connections of the SAME priority.
+
+  2017-09-21: Kalle Olavi Niemitalo
+  * sockets: add poll() implementation (patch #9450)
+
+  2017-09-10: Joel Cunningham
+  * sockets: add readv() implementation (task #14610)
+
+  2017-08-04: Simon Goldschmidt
+  * Clean up DHCP a bit: no need keep msg_out and msg_in as members in struct
+    dhcp - they are used in a call stack only (p_out and options_out_len as well)
+
+  2017-08-04: Simon Goldschmidt
+  * pbuf: split pbuf_header(s16_t) into pbuf_add_header(size_t) and
+    pbuf_remove_header(size_t)
+
+  2017-07-20: Douglas
+  * sys: deprecate sys_arch_sem_wait and sys_arch_mbox_fetch returning the
+    time waited rather they are now defined to return != SYS_ARCH_TIMEOUT
+    on success.
+
+  2017-07-03: Jakub Schmidtke
+  * tcp: added support for sending TCP SACKs
+
+  2017-06-20: Joel Cunningham
+  * netconn/netdb: added core locking support to netconn_gethostbyname (task #14523)
+
+  2017-04-25: Simon Goldschmidt
+  * dhcp: added two hooks for adding and parsing user defined DHCP options
+
+  2017-04-25: Joel Cunningham
+  * sockets: added recvmsg for UDP (together with CMSG and IP_PKTINFO) (task #14247)
+
+  2017-04-20: Joel Cunningham
+  * tcp: added Appropriate Byte Counting support (task #14128)
+
+  2017-04-11: Simon Goldschmidt
+  * netconn/sockets: remove fatal error handling, fix asynchronous error handling,
+    ensure data before RST can be received
+
+  2017-03-30: Simon Goldschmidt
+  * added "application layered TCP" connection API (altcp) for seamless integration
+    of TLS or proxy connections
+
+  2017-03-09: Simon Goldschmidt
+  * sockets: add recvmsg for TCP
+
+  2017-03-02: Joel Cunningham
+  * netconn/sockets: vectorize netconn_write for TCP, treating a vectored I/O write
+    atomically in regards to TCP segmentation (patch #8882)
+
+  2017-03-02: Simon Goldschmidt
+  * netconn: added nonblocking accept/recv to netconn API (task #14396)
+
+  2017-02-28: Simon Goldschmidt
+  * Added LWIP_SINGLE_NETIF for small targets with only one netif
+
+  2017-02-10: David van Moolenbroek
+  * Implement UDP and RAW multicast support for IPv6 (core API, not netconn/sockets)
+
+  2017-02-04: David van Moolenbroek
+  * IPv6 scopes support
+
+  2017-01-20: Joel Cunningham
+  * sockets: add interface name/index APIs (task #14314)
+  
+  2017-01-08: David van Moolenbroek
+  * Extensions to RAW API (patch #9208)
+    - Connected RAW PCBs
+    - Add raw_sendto_if_src()
+    - Support IP_HDRINCL socket option
+
+  ++ Bugfixes:
+
+  2018-06-19: Simon Goldschmidt
+  * tcp: fix RTO timer not working if link is down
+
+  2018-06-15: Sylvain Rochet
+  * ppp: multiple smaller bugfixes
+
+  2018-05-17: Simon Goldschmidt
+  * etharp: arp table can now be bigger than 127 entries
+
+  2018-04-25: Jens Nielsen
+  * tftp server: correctly handle retransmissions
+
+  2018-04-18: Simon Goldschmidt
+  sockets: fix race conditions when closing full-duplex sockets
+
+  2018-03-09: Simon Goldschmidt
+  * 6lowpan: fix to work against contiki; added ZigBee encapsulation netif for tests
+
+  2018-02-04: Simon Goldschmidt
+  * sockets: fix inconsistencies on close (inconsistent error codes, double FIN)
+
+  2018-01-05: Dirk Ziegelmeier
+  * Fix bug #52748: the bug in timeouts.c by reimplementing timer logic to use
+    absolute instead of relative timeout values
+
+  2017-12-31: Dirk Ziegelmeier
+  * Fix bug #52704: DHCP and bad OFFER: Stop timeout only if offer is accepted
+
+  2017-11-08: Joel Cunningham
+  * netif: ensure link and admin states are up in issue reports (bug #52353)
+
+  2017-09-12: David Lockyer
+  * select: allocate select_cb from memp for LWIP_MPU_COMPATIBLE = 1 (bug #51990)
+
+  2017-09-11: Simon Goldschmidt
+  * tcp_in.c: fix bug #51937 (leaking tcp_pcbs on passive close with unacked data)
+
+  2017-08-11: Joel Cunningham
+  * lwip_itoa: fix converting the number 0 (previously converted to '\0') (bug #51729)
+
+  2017-08-08: Dirk Ziegelmeier
+  * ip4_route_src: parameter order is reversed: ip4_route_src(dest, src) -> ip4_route_src(src, dest)
+    to make parameter order consistent with other ip*_route*() functions
+    Same also applies to LWIP_HOOK_IP4_ROUTE_SRC() parameter order.
+
+  2017-08-04: Joel Cunningham
+  * tcp: re-work persist timer to fully close window (details in bug #50837)
+
+  2017-07-26: Simon Goldschmidt
+  * snmp_msg.c: fix bug #51578 (SNMP failed to decode some values on non 32bit platforms)
+
+  2017-07-20: Simon Goldschmidt
+  * compatibility headers: moved from 'src/include/posix' to 'src/include/compat/posix',
+    'src/include/compat/stdc' etc.
+
+  2017-05-09: Joel Cunningham
+  * tcp: add zero-window probe timeout (bug #50837)
+
+  2017-04-11: Simon Goldschmidt
+  * sockets.c: task #14420 (Remove sys_sem_signal from inside SYS_ARCH_PROTECT
+    crit section) done for LWIP_TCPIP_CORE_LOCKING==1
+
+  2017-02-24: Simon Goldschmidt
+  * sockets.c: fixed close race conditions in lwip_select (for LWIP_NETCONN_FULLDUPLEX)
+
+  2017-02-24: Simon Goldschmidt
+  * sockets.c: fixed that select ignored invalid/not open sockets in the fd_sets (bug #50392)
+
+  2017-01-11: David van Moolenbroek
+  * Lots of IPv6 related fixes and improvements
+
+(STABLE-2.0.3)
+
+  ++ Bugfixes:
+
+  2017-09-11: Simon Goldschmidt
+  * tcp_in.c: fix bug #51937 (leaking tcp_pcbs on passive close with unacked data)
+
+  2017-08-02: Abroz Bizjak/Simon Goldschmidt
+  * multiple fixes in IPv4 reassembly (leading to corrupted datagrams received)
+  
+  2017-03-30: Simon Goldschmidt
+  * dhcp.c: return ERR_VAL instead of asserting on offset-out-of-pbuf
+
+  2017-03-23: Dirk Ziegelmeier
+  * dhcp.h: fix bug #50618 (dhcp_remove_struct() macro does not work)
+
+(STABLE-2.0.2)
+
+  ++ New features:
+
+  2017-02-10: Dirk Ziegelmeier
+  * Implement task #14367: Hooks need a better place to be defined:
+    We now have a #define for a header file name that is #included in every .c
+    file that provides hooks.
+
+  2017-02-10: Simon Goldschmidt
+  * tcp_close does not fail on memory error (instead, FIN is sent from tcp_tmr)
+
+  ++ Bugfixes:
+
+  2017-03-08
+  * tcp: do not keep sending SYNs when getting ACKs
+
+  2017-03-08: Joel Cunningham
+  * tcp: Initialize ssthresh to TCP_SND_BUF (bug #50476)
+
+  2017-03-01: Simon Goldschmidt
+  * httpd: LWIP_HTTPD_POST_MANUAL_WND: fixed double-free when httpd_post_data_recved
+    is called nested from httpd_post_receive_data() (bug #50424)
+
+  2017-02-28: David van Moolenbroek/Simon Goldschmidt
+  * tcp: fixed bug #50418: LWIP_EVENT_API: fix invalid calbacks for SYN_RCVD pcb
+
+  2017-02-17: Simon Goldschmidt
+  * dns: Improved DNS_LOCAL_HOSTLIST interface (bug #50325)
+
+  2017-02-16: Simon Goldschmidt
+  * LWIP_NETCONN_FULLDUPLEX: fixed shutdown during write (bug #50274)
+
+  2017-02-13: Simon Goldschmidt/Dirk Ziegelmeier
+  * For tiny targtes, LWIP_RAND is optional (fix compile time checks)
+
+  2017-02-10: Simon Goldschmidt
+  * tcp: Fixed bug #47485 (tcp_close() should not fail on memory error) by retrying
+    to send FIN from tcp_fasttmr
+
+  2017-02-09: Simon Goldschmidt
+  * sockets: Fixed bug #44032 (LWIP_NETCONN_FULLDUPLEX: select might work on
+    invalid/reused socket) by not allowing to reallocate a socket that has
+    "select_waiting != 0"
+
+  2017-02-09: Simon Goldschmidt
+  * httpd: Fixed bug #50059 (httpd LWIP_HTTPD_SUPPORT_11_KEEPALIVE vs.
+    LWIP_HTTPD_KILL_OLD_ON_CONNECTIONS_EXCEEDED)
+
+  2017-02-08: Dirk Ziegelmeier
+  * Rename "IPv6 mapped IPv4 addresses" to their correct name from RFC4191:
+    "IPv4-mapped IPv6 address"
+
+  2017-02-08: Luc Revardel
+  * mld6.c: Fix bug #50220 (mld6_leavegroup does not send ICMP6_TYPE_MLD, even
+    if last reporter)
+
+  2017-02-08: David van Moolenbroek
+  * ip6.c: Patch #9250: fix source substitution in ip6_output_if()
+
+  2017-02-08: Simon Goldschmidt
+  * tcp_out.c: Fixed bug #50090 (last_unsent->oversize_left can become wrong value
+    in tcp_write error path)
+
+  2017-02-02: Dirk Ziegelmeier
+  * Fix bug #50206: UDP Netconn bind to IP6_ADDR_ANY fails
+
+  2017-01-18: Dirk Ziegelmeier
+  * Fix zero-copy RX, see bug bug #50064. PBUF_REFs were not supported as ARP requests.
+
+  2017-01-15: Axel Lin, Dirk Ziegelmeier
+  * minor bug fixes in mqtt
+
+  2017-01-11: Knut Andre Tidemann
+  * sockets/netconn: fix broken default ICMPv6 handling of checksums
+
+(STABLE-2.0.1)
+
+  ++ New features:
+
+  2016-12-31: Simon Goldschmidt
+  * tcp.h/.c: added function tcp_listen_with_backlog_and_err() to get the error
+    reason when listening fails (bug #49861)
+
+  2016-12-20: Erik Andersen
+  * Add MQTT client
+
+  2016-12-14: Jan Breuer:
+  * opt.h, ndc.h/.c: add support for RDNSS option (as per RFC 6106)
+
+  2016-12-14: David van Moolenbroek
+  * opt.h, nd6.c: Added LWIP_HOOK_ND6_GET_GW()
+
+  2016-12-09: Dirk Ziegelmeier
+  * ip6_frag.c: Implemented support for LWIP_NETIF_TX_SINGLE_PBUF
+
+  2016-12-09: Simon Goldschmidt
+  * dns.c: added one-shot multicast DNS queries
+
+  2016-11-24: Ambroz Bizjak, David van Moolenbroek
+  * tcp_out.c: Optimize passing contiguous nocopy buffers to tcp_write (bug #46290)
+
+  2016-11-16: Dirk Ziegelmeier
+  * sockets.c: added support for IPv6 mapped IPv4 addresses
+
+  ++ Bugfixes:
+
+  2016-12-16: Thomas Mueller
+  * api_lib.c: fixed race condition in return value of netconn_gethostbyname()
+    (and thus also lwip_gethostbyname/_r() and lwip_getaddrinfo())
+
+  2016-12-15: David van Moolenbroek
+  * opt.h, tcp: added LWIP_HOOK_TCP_ISN() to implement less predictable initial
+    sequence numbers (see contrib/addons/tcp_isn for an example implementation)
+
+  2016-12-05: Dirk Ziegelmeier
+  * fixed compiling with IPv4 disabled (IPv6 only case)
+
+  2016-11-28: Simon Goldschmidt
+  * api_lib.c: fixed bug #49725 (send-timeout: netconn_write() can return
+    ERR_OK without all bytes being written)
+
+  2016-11-28: Ambroz Bizjak
+  * tcpi_in.c: fixed bug #49717 (window size in received SYN and SYN-ACK
+    assumed scaled)
+
+  2016-11-25: Simon Goldschmidt
+  * dhcp.c: fixed bug #49676 (Possible endless loop when parsing dhcp options)
+
+  2016-11-23: Dirk Ziegelmeier
+  * udp.c: fixed bug #49662: multicast traffic is now only received on a UDP PCB
+   (and therefore on a UDP socket/netconn) when the PCB is bound to IP_ADDR_ANY
+
+  2016-11-16: Dirk Ziegelmeier
+  * *: Fixed dual-stack behaviour, IPv6 mapped IPv4 support in socket API
+
+  2016-11-14: Joel Cunningham
+  * tcp_out.c: fixed bug #49533 (start persist timer when unsent seg can't fit
+    in window) 
+
+  2016-11-16: Roberto Barbieri Carrera
+  * autoip.c: fixed bug #49610 (sometimes AutoIP fails to reuse the same address)
+
+  2016-11-11: Dirk Ziegelmeier
+  * sockets.c: fixed bug #49578 (dropping multicast membership does not work
+    with LWIP_SOCKET_OFFSET)
+
+(STABLE-2.0.0)
+
  ++ New features:

  2016-07-27: Simon Goldschmidt
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -0,0 +1,20 @@
+cmake_minimum_required(VERSION 3.7)
+
+project(lwIP)
+
+set(LWIP_DIR ${CMAKE_CURRENT_SOURCE_DIR})
+include(src/Filelists.cmake)
+
+# Package generation
+set(CPACK_SOURCE_GENERATOR "ZIP")
+set(CPACK_SOURCE_PACKAGE_DESCRIPTION_SUMMARY "lwIP lightweight IP stack")
+set(CPACK_PACKAGE_VERSION_MAJOR "${LWIP_VERSION_MAJOR}")
+set(CPACK_PACKAGE_VERSION_MINOR "${LWIP_VERSION_MINOR}")
+set(CPACK_PACKAGE_VERSION_PATCH "${LWIP_VERSION_REVISION}")
+set(CPACK_SOURCE_IGNORE_FILES "/build/;${CPACK_SOURCE_IGNORE_FILES};.git")
+set(CPACK_SOURCE_PACKAGE_FILE_NAME "lwip-${LWIP_VERSION_MAJOR}.${LWIP_VERSION_MINOR}.${LWIP_VERSION_REVISION}")
+include(CPack)
+
+# Target for package generation
+add_custom_target(dist COMMAND ${CMAKE_MAKE_PROGRAM} package_source)
+add_dependencies(dist lwipdocs)
--- a/11
+++ b/11
@@ -0,0 +1,11 @@
+lwIP is a small independent implementation of the TCP/IP protocol suite targeted at embedded systems.
+
+The focus of the lwIP TCP/IP implementation is to reduce resource usage while still having a full scale TCP. This makes lwIP suitable for use in embedded systems with tens of kilobytes of free RAM and room for around 40 kilobytes of code ROM.
+
+Main features include:
+- Protocols: IP, IPv6, ICMP, ND, MLD, UDP, TCP, IGMP, ARP, PPPoS, PPPoE, 6LowPAN (via IEEE 802.15.4, BLE or ZEP; since v2.1.0)
+- DHCP client, stateless DHCPv6 (since v2.1.0), DNS client (incl. mDNS hostname resolver), AutoIP/APIPA (Zeroconf), SNMP agent (v1, v2c, v3 (since v2.1.0), private MIB support & MIB compiler)
+- APIs: specialized APIs for enhanced performance & zero copy, optional Berkeley-alike socket API
+- Extended features: IP forwarding over multiple network interfaces
+- Extended TCP features: congestion control, RTT estimation and fast recovery/fast retransmit, sending SACKs (since v2.1.0), "altcp": nearly transparent TLS for any tcp pcb (since v2.1.0)
+- Addon applications: HTTP server (HTTPS via altcp), HTTP(S) client (since v2.1.0), SNTP client, SMTP client (SMTPS via altcp), ping, NetBIOS nameserver, mDNS responder, MQTT client (TLS support since v2.1.0), TFTP server, iPerf2 counterpart
--- a/22
+++ b/22
@@ -1,15 +1,15 @@
 INTRODUCTION

-lwIP is a small independent implementation of the TCP/IP protocol
-suite that has been developed by Adam Dunkels at the Computer and
-Networks Architectures (CNA) lab at the Swedish Institute of Computer
-Science (SICS).
+lwIP is a small independent implementation of the TCP/IP protocol suite.

 The focus of the lwIP TCP/IP implementation is to reduce the RAM usage
 while still having a full scale TCP. This making lwIP suitable for use
 in embedded systems with tens of kilobytes of free RAM and room for
 around 40 kilobytes of code ROM.

+lwIP was originally developed by Adam Dunkels at the Computer and Networks
+Architectures (CNA) lab at the Swedish Institute of Computer Science (SICS)
+and is now developed and maintained by a worldwide network of developers.

 FEATURES

@@ -22,22 +22,28 @@ FEATURES
  * ND (Neighbor discovery and stateless address autoconfiguration for IPv6).
    Aims to be compliant with RFC 4861 (Neighbor discovery) and RFC 4862
    (Address autoconfiguration)
+  * DHCP, AutoIP/APIPA (Zeroconf) and (stateless) DHCPv6
  * UDP (User Datagram Protocol) including experimental UDP-lite extensions
  * TCP (Transmission Control Protocol) with congestion control, RTT estimation
-    and fast recovery/fast retransmit
+    fast recovery/fast retransmit and sending SACKs
  * raw/native API for enhanced performance
  * Optional Berkeley-like socket API
-  * DNS (Domain names resolver)
+  * TLS: optional layered TCP ("altcp") for nearly transparent TLS for any
+    TCP-based protocol (ported to mbedTLS) (see changelog for more info)
+  * PPPoS and PPPoE (Point-to-point protocol over Serial/Ethernet)
+  * DNS (Domain name resolver incl. mDNS)
+  * 6LoWPAN (via IEEE 802.15.4, BLE or ZEP)


 APPLICATIONS

-  * HTTP server with SSI and CGI
-  * SNMPv2c agent with MIB compiler (Simple Network Management Protocol)
+  * HTTP server with SSI and CGI (HTTPS via altcp)
+  * SNMPv2c agent with MIB compiler (Simple Network Management Protocol), v3 via altcp
  * SNTP (Simple network time protocol)
  * NetBIOS name service responder
  * MDNS (Multicast DNS) responder
  * iPerf server implementation
+  * MQTT client (TLS support via altcp)


 LICENSE
--- a/52
+++ b/52
@@ -8,7 +8,57 @@ with newer versions.

  * [Enter new changes just after this line - do not remove this line]

-  * TODO
+(2.1.0)
+
+  ++ Application changes:
+
+  * Use the new altcp API for seamless TLS integration into existing TCP applications (see changelog)
+  * TCP only kills existing connections with a LOWER priority than the one currently being opened.
+    Previous implementations also kill existing connections of the SAME priority.
+  * ip4_route_src: parameter order is reversed: ip4_route_src(dest, src) -> ip4_route_src(src, dest)
+    to make parameter order consistent with other ip*_route*() functions.
+    Same also applies to LWIP_HOOK_IP4_ROUTE_SRC() parameter order.
+  * pbuf API: pbuf->type (an u8_t holding the enum 'pbuf_type') has changed to only hold a
+    description of the pbuf (e.g. data following pbuf struct, data volatile, allocation
+    source heap/pool/etc.). As a consequence, applications can't test pbuf->type any more.
+    Use pbuf_match_type(pbuf, type) instead.
+  * socket API: according to the standard, SO_ERROR now only returns asynchronous errors.
+    All other/normal/synchronous errors are (and always were) available via 'errno'.
+    LWIP_SOCKET_SET_ERRNO has been removed - 'errno' is always set - and required!
+  * httpd LWIP_HTTPD_CGI_SSI: httpd_cgi_handler() has an additional parameter "struct fs_file *"
+
+  ++ Port changes:
+
+  * tcpip_trycallback() was renamed to tcpip_callbackmsg_trycallback() to avoid confusion
+    with tcpip_try_callback()
+  * compatibility headers: moved from 'src/include/posix' to 'src/include/compat/posix',
+    'src/include/compat/stdc' etc.
+  * The IPv6 implementation now supports address scopes. (See LWIP_IPV6_SCOPES documentation
+    and ip6_zone.h for more documentation)
+  * LWIP_HOOK_DHCP_APPEND_OPTIONS() has changed, see description in opt.h (options_out_len is not
+    available in struct dhcp any more)
+  * Added debug helper asserts to ensure threading/locking requirements are met (define
+    LWIP_MARK_TCPIP_THREAD() and LWIP_ASSERT_CORE_LOCKED()).
+  * Added sys_mbox_trypost_fromisr() and tcpip_callbackmsg_trycallback_fromisr()
+    These can be used to post preallocated messages from an ISR to the tcpip thread
+    (e.g. when using FreeRTOS)
+
+(2.0.2)
+
+  ++ Application changes:
+
+  * slipif: The way to pass serial port number has changed. netif->num is not
+    supported any more, netif->state is interpreted as an u8_t port number now
+    (it's not a POINTER to an u8_t any more!)
+
+(2.0.1)
+
+  ++ Application changes:
+
+  * UDP does NOT receive multicast traffic from ALL netifs on an UDP PCB bound to a specific
+    netif any more. Users need to bind to IP_ADDR_ANY to receive multicast traffic and compare 
+    ip_current_netif() to the desired netif for every packet.
+    See bug #49662 for an explanation.

 (2.0.0)

--- a/doc/NO_SYS_SampleCode.c
+++ b/doc/NO_SYS_SampleCode.c
@@ -1,4 +1,5 @@
-void eth_mac_irq()
+void
+eth_mac_irq()
 {
  /* Service MAC IRQ here */

@@ -17,7 +18,8 @@ void eth_mac_irq()
  }
 }

-static err_t netif_output(struct netif *netif, struct pbuf *p)
+static err_t 
+netif_output(struct netif *netif, struct pbuf *p)
 {
  LINK_STATS_INC(link.xmit);

@@ -38,12 +40,14 @@ static err_t netif_output(struct netif *netif, struct pbuf *p)
  return ERR_OK;
 }

-static void netif_status_callback(struct netif *netif)
+static void 
+netif_status_callback(struct netif *netif)
 {
  printf("netif status changed %s\n", ip4addr_ntoa(netif_ip4_addr(netif)));
 }

-static err_t netif_init(struct netif *netif)
+static err_t 
+netif_init(struct netif *netif)
 {
  netif->linkoutput = netif_output;
  netif->output     = etharp_output;
@@ -52,13 +56,14 @@ static err_t netif_init(struct netif *netif)
  netif->flags      = NETIF_FLAG_BROADCAST | NETIF_FLAG_ETHARP | NETIF_FLAG_ETHERNET | NETIF_FLAG_IGMP | NETIF_FLAG_MLD6;
  MIB2_INIT_NETIF(netif, snmp_ifType_ethernet_csmacd, 100000000);

-  SMEMCPY(netif->hwaddr, your_mac_address_goes_here, sizeof(netif->hwaddr));
-  netif->hwaddr_len = sizeof(netif->hwaddr);
+  SMEMCPY(netif->hwaddr, your_mac_address_goes_here, ETH_HWADDR_LEN);
+  netif->hwaddr_len = ETH_HWADDR_LEN;

  return ERR_OK;
 }

-void main(void)
+void 
+main(void)
 {
  struct netif netif;

@@ -74,7 +79,7 @@ void main(void)
  netif_set_up(&netif);
  
  /* Start DHCP and HTTPD */
-  dhcp_init();
+  dhcp_start(&netif );
  httpd_init();

  while(1) {
--- a/doc/ZeroCopyRx.c
+++ b/doc/ZeroCopyRx.c
@@ -0,0 +1,45 @@
+typedef struct my_custom_pbuf
+{
+   struct pbuf_custom p;
+   void* dma_descriptor;
+} my_custom_pbuf_t;
+
+LWIP_MEMPOOL_DECLARE(RX_POOL, 10, sizeof(my_custom_pbuf_t), "Zero-copy RX PBUF pool");
+
+void my_pbuf_free_custom(void* p)
+{
+  SYS_ARCH_DECL_PROTECT(old_level);
+
+  my_custom_pbuf_t* my_puf = (my_custom_pbuf_t*)p;
+
+  // invalidate data cache here - lwIP and/or application may have written into buffer!
+  // (invalidate is faster than flushing, and noone needs the correct data in the buffer)
+  invalidate_cpu_cache(p->payload, p->tot_len);
+
+  SYS_ARCH_PROTECT(old_level);
+  free_rx_dma_descriptor(my_pbuf->dma_descriptor);
+  LWIP_MEMPOOL_FREE(RX_POOL, my_pbuf);
+  SYS_ARCH_UNPROTECT(old_level);
+}
+
+void eth_rx_irq()
+{
+  dma_descriptor*   dma_desc = get_RX_DMA_descriptor_from_ethernet();
+  my_custom_pbuf_t* my_pbuf  = (my_custom_pbuf_t*)LWIP_MEMPOOL_ALLOC(RX_POOL);
+
+  my_pbuf->p.custom_free_function = my_pbuf_free_custom;
+  my_pbuf->dma_descriptor         = dma_desc;
+
+  invalidate_cpu_cache(dma_desc->rx_data, dma_desc->rx_length);
+  
+  struct pbuf* p = pbuf_alloced_custom(PBUF_RAW,
+     dma_desc->rx_length,
+     PBUF_REF,
+     &my_pbuf->p,
+     dma_desc->rx_data,
+     dma_desc->max_buffer_size);
+
+  if(netif->input(p, netif) != ERR_OK) {
+    pbuf_free(p);
+  }
+}
--- a/doc/doxygen/generate.sh
+++ b/doc/doxygen/generate.sh
@@ -1 +1,3 @@
+#!/bin/sh
+
 doxygen lwip.Doxyfile
--- a/doc/doxygen/lwip.Doxyfile
+++ b/doc/doxygen/lwip.Doxyfile
@@ -1,4 +1,4 @@
-# Doxyfile 1.8.11
+# Doxyfile 1.8.13

 # This file describes the settings to be used by the documentation system
 # doxygen (www.doxygen.org) for a project.
@@ -32,19 +32,19 @@ DOXYFILE_ENCODING      = UTF-8
 # title of most generated pages and in a few other places.
 # The default value is: My Project.

-PROJECT_NAME           = "lwIP 2.0.0"
+PROJECT_NAME           = "lwIP"

 # The PROJECT_NUMBER tag can be used to enter a project or revision number. This
 # could be handy for archiving the generated documentation or if some version
 # control system is used.

-PROJECT_NUMBER         = "lwIP 2.0.0"
+PROJECT_NUMBER         = "2.1.3"

 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
 # quick idea about the purpose of the project. Keep the description short.

-PROJECT_BRIEF          = Lightweight IP stack
+PROJECT_BRIEF          = "Lightweight IP stack"

 # With the PROJECT_LOGO tag one can specify a logo or an icon that is included
 # in the documentation. The maximum height of the logo should not exceed 55
@@ -58,7 +58,7 @@ PROJECT_LOGO           =
 # entered, it will be relative to the location where doxygen was started. If
 # left blank the current directory will be used.

-OUTPUT_DIRECTORY       = output
+OUTPUT_DIRECTORY       = "output"

 # If the CREATE_SUBDIRS tag is set to YES then doxygen will create 4096 sub-
 # directories (in 2 levels) under the output directory of each output format and
@@ -303,6 +303,15 @@ EXTENSION_MAPPING      =

 MARKDOWN_SUPPORT       = YES

+# When the TOC_INCLUDE_HEADINGS tag is set to a non-zero value, all headings up
+# to that level are automatically included in the table of contents, even if
+# they do not have an id attribute.
+# Note: This feature currently applies only to Markdown headings.
+# Minimum value: 0, maximum value: 99, default value: 0.
+# This tag requires that the tag MARKDOWN_SUPPORT is set to YES.
+
+TOC_INCLUDE_HEADINGS   = 0
+
 # When enabled doxygen tries to link words that correspond to documented
 # classes, or namespaces to their corresponding documentation. Such a link can
 # be prevented in individual cases by putting a % sign in front of the word or
@@ -781,7 +790,8 @@ WARN_LOGFILE           =
 # spaces. See also FILE_PATTERNS and EXTENSION_MAPPING
 # Note: If this tag is empty the current directory is searched.

-INPUT                  = main_page.h ../../src
+INPUT                  = main_page.h \
+                         ../../src

 # This tag can be used to specify the character encoding of the source files
 # that doxygen parses. Internally doxygen uses the UTF-8 encoding. Doxygen uses
@@ -803,8 +813,8 @@ INPUT_ENCODING         = UTF-8
 # If left blank the following patterns are tested:*.c, *.cc, *.cxx, *.cpp,
 # *.c++, *.java, *.ii, *.ixx, *.ipp, *.i++, *.inl, *.idl, *.ddl, *.odl, *.h,
 # *.hh, *.hxx, *.hpp, *.h++, *.cs, *.d, *.php, *.php4, *.php5, *.phtml, *.inc,
-# *.m, *.markdown, *.md, *.mm, *.dox, *.py, *.pyw, *.f90, *.f, *.for, *.tcl,
-# *.vhd, *.vhdl, *.ucf, *.qsf, *.as and *.js.
+# *.m, *.markdown, *.md, *.mm, *.dox, *.py, *.pyw, *.f90, *.f95, *.f03, *.f08,
+# *.f, *.for, *.tcl, *.vhd, *.vhdl, *.ucf and *.qsf.

 FILE_PATTERNS          = *.c \
                         *.cc \
@@ -875,7 +885,8 @@ EXCLUDE_SYMBOLS        =
 # that contain example code fragments that are included (see the \include
 # command).

-EXAMPLE_PATH           = ../ ../../
+EXAMPLE_PATH           = ../ \
+                         ../../

 # If the value of the EXAMPLE_PATH tag contains directories, you can use the
 # EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp and
@@ -2077,16 +2088,26 @@ PREDEFINED             = __DOXYGEN__=1 \
                         LWIP_ICMP=1 \
                         LWIP_RAW=1 \
                         LWIP_DHCP=1 \
+                         LWIP_IPV6_DHCP6=1 \
                         LWIP_UDPLITE=1 \
                         LWIP_UDP=1 \
                         LWIP_IGMP=1 \
                         LWIP_TCP=1 \
+                         LWIP_ALTCP=1 \
+                         LWIP_ALTCP_TLS=1 \
+                         LWIP_IPV6_SCOPES=1 \
                         TCP_LISTEN_BACKLOG=1 \
                         LWIP_SNMP=1 \
                         SNMP_USE_NETCONN=1 \
                         SNMP_USE_RAW=1 \
                         MIB2_STATS=1 \
                         LWIP_MDNS_RESPONDER=1 \
+                         HTTPD_ENABLE_HTTPS=1 \
+                         LWIP_HTTPD_CGI=1 \
+                         LWIP_HTTPD_SSI=1 \
+                         LWIP_HTTPD_SSI_RAW=1 \
+                         LWIP_HTTPD_SUPPORT_POST=1 \
+                         LWIP_HTTPD_POST_MANUAL_WND=1 \
                         MEMP_OVERFLOW_CHECK=0 \
                         MEMP_SANITY_CHECK=1 \
                         LWIP_ARP=1 \
@@ -2097,6 +2118,7 @@ PREDEFINED             = __DOXYGEN__=1 \
                         LWIP_NETIF_STATUS_CALLBACK=1 \
                         LWIP_NETIF_REMOVE_CALLBACK=1 \
                         LWIP_NETIF_LINK_CALLBACK=1 \
+                         LWIP_NETIF_EXT_STATUS_CALLBACK=1 \
                         LWIP_NUM_NETIF_CLIENT_DATA=1 \
                         ENABLE_LOOPBACK=1 \
                         LWIP_AUTOIP=1 \
@@ -2115,7 +2137,8 @@ PREDEFINED             = __DOXYGEN__=1 \
                         SO_REUSE=1 \
                         SO_REUSE_RXTOALL=1 \
                         LWIP_HAVE_SLIPIF=1 \
-                         LWIP_6LOWPAN=1
+                         SLIP_RX_FROM_ISR=1 \
+                         LWIP_TCP_PCB_NUM_EXT_ARGS=1

 # If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then this
 # tag can be used to specify a list of macro names that should be expanded. The
@@ -2228,7 +2251,7 @@ HIDE_UNDOC_RELATIONS   = YES
 # http://www.graphviz.org/), a graph visualization toolkit from AT&T and Lucent
 # Bell Labs. The other options in this section have no effect if this option is
 # set to NO
-# The default value is: YES.
+# The default value is: NO.

 HAVE_DOT               = NO

@@ -2384,9 +2407,7 @@ DIRECTORY_GRAPH        = YES
 # Note: If you choose svg you need to set HTML_FILE_EXTENSION to xhtml in order
 # to make the SVG files visible in IE 9+ (other browsers do not have this
 # requirement).
-# Possible values are: png, png:cairo, png:cairo:cairo, png:cairo:gd, png:gd,
-# png:gd:gd, jpg, jpg:cairo, jpg:cairo:gd, jpg:gd, jpg:gd:gd, gif, gif:cairo,
-# gif:cairo:gd, gif:gd, gif:gd:gd, svg, png:gd, png:gd:gd, png:cairo,
+# Possible values are: png, jpg, gif, svg, png:gd, png:gd:gd, png:cairo,
 # png:cairo:gd, png:cairo:cairo, png:cairo:gdiplus, png:gdiplus and
 # png:gdiplus:gdiplus.
 # The default value is: png.
@@ -2439,6 +2460,11 @@ DIAFILE_DIRS           =

 PLANTUML_JAR_PATH      =

+# When using plantuml, the PLANTUML_CFG_FILE tag can be used to specify a
+# configuration file for plantuml.
+
+PLANTUML_CFG_FILE      =
+
 # When using plantuml, the specified paths are searched for files specified by
 # the !include statement in a plantuml block.

--- a/doc/doxygen/lwip.Doxyfile.cmake.in
+++ b/doc/doxygen/lwip.Doxyfile.cmake.in
--- a/doc/doxygen/main_page.h
+++ b/doc/doxygen/main_page.h
@@ -1,17 +1,90 @@
-/**
+/**
 * @defgroup lwip lwIP
 *
 * @defgroup infrastructure Infrastructure
 * 
- * @defgroup callbackstyle_api Callback-style APIs
+ * @defgroup api APIs
+ * lwIP provides three Application Program's Interfaces (APIs) for programs
+ * to use for communication with the TCP/IP code:
+ * - low-level "core" / "callback" or @ref callbackstyle_api.
+ * - higher-level @ref sequential_api.
+ * - BSD-style @ref socket.
+ * 
+ * The raw TCP/IP interface allows the application program to integrate
+ * better with the TCP/IP code. Program execution is event based by
+ * having callback functions being called from within the TCP/IP
+ * code. The TCP/IP code and the application program both run in the same
+ * thread. The sequential API has a much higher overhead and is not very
+ * well suited for small systems since it forces a multithreaded paradigm
+ * on the application.
+ * 
+ * The raw TCP/IP interface is not only faster in terms of code execution
+ * time but is also less memory intensive. The drawback is that program
+ * development is somewhat harder and application programs written for
+ * the raw TCP/IP interface are more difficult to understand. Still, this
+ * is the preferred way of writing applications that should be small in
+ * code size and memory usage.
+ * 
+ * All APIs can be used simultaneously by different application
+ * programs. In fact, the sequential API is implemented as an application
+ * program using the raw TCP/IP interface.
+ * 
+ * Do not confuse the lwIP raw API with raw Ethernet or IP sockets.
+ * The former is a way of interfacing the lwIP network stack (including
+ * TCP and UDP), the latter refers to processing raw Ethernet or IP data
+ * instead of TCP connections or UDP packets.
+ * 
+ * Raw API applications may never block since all packet processing
+ * (input and output) as well as timer processing (TCP mainly) is done
+ * in a single execution context.
+ *
+ * @defgroup callbackstyle_api "raw" APIs
+ * @ingroup api
 * Non thread-safe APIs, callback style for maximum performance and minimum
 * memory footprint.
+ * Program execution is driven by callbacks functions, which are then
+ * invoked by the lwIP core when activity related to that application
+ * occurs. A particular application may register to be notified via a
+ * callback function for events such as incoming data available, outgoing
+ * data sent, error notifications, poll timer expiration, connection
+ * closed, etc. An application can provide a callback function to perform
+ * processing for any or all of these events. Each callback is an ordinary
+ * C function that is called from within the TCP/IP code. Every callback
+ * function is passed the current TCP or UDP connection state as an
+ * argument. Also, in order to be able to keep program specific state,
+ * the callback functions are called with a program specified argument
+ * that is independent of the TCP/IP state.
+ * The raw API (sometimes called native API) is an event-driven API designed
+ * to be used without an operating system that implements zero-copy send and
+ * receive. This API is also used by the core stack for interaction between
+ * the various protocols. It is the only API available when running lwIP
+ * without an operating system.
 * 
 * @defgroup sequential_api Sequential-style APIs
+ * @ingroup api
 * Sequential-style APIs, blocking functions. More overhead, but can be called
 * from any thread except TCPIP thread.
+ * The sequential API provides a way for ordinary, sequential, programs
+ * to use the lwIP stack. It is quite similar to the BSD socket API. The
+ * model of execution is based on the blocking open-read-write-close
+ * paradigm. Since the TCP/IP stack is event based by nature, the TCP/IP
+ * code and the application program must reside in different execution
+ * contexts (threads).
 * 
- * @defgroup addons Addons
+ * @defgroup socket Socket API
+ * @ingroup api
+ * BSD-style socket API.\n
+ * Thread-safe, to be called from non-TCPIP threads only.\n
+ * Can be activated by defining @ref LWIP_SOCKET to 1.\n
+ * Header is in posix/sys/socket.h\n
+ * The socket API is a compatibility API for existing applications,
+ * currently it is built on top of the sequential API. It is meant to
+ * provide all functions needed to run socket API applications running
+ * on other platforms (e.g. unix / windows etc.). However, due to limitations
+ * in the specification of this API, there might be incompatibilities
+ * that require small modifications of existing programs.
+ * 
+ * @defgroup netifs NETIFs
 * 
 * @defgroup apps Applications
 */
@@ -26,6 +99,25 @@
 * @verbinclude "UPGRADING"
 */

+/**
+ * @page changelog Changelog
+ *
+ * 2.1.0
+ * -----
+ * * Support TLS via new @ref altcp_api connection API (https, smtps, mqtt over TLS)
+ * * Switch to cmake as the main build system (Makefile file lists are still
+ *   maintained for now)
+ * * Improve IPv6 support: support address scopes, support stateless DHCPv6, bugfixes
+ * * Add debug helper asserts to ensure threading/locking requirements are met
+ * * Add sys_mbox_trypost_fromisr() and tcpip_callbackmsg_trycallback_fromisr()
+ *   (for FreeRTOS, mainly)
+ * * socket API: support poll(), sendmsg() and recvmsg(); fix problems on close
+ * 
+ * Detailed Changelog
+ * ------------------
+ * @verbinclude "CHANGELOG"
+ */
+
 /**
 * @page contrib How to contribute to lwIP
 * @verbinclude "contrib.txt"
@@ -44,6 +136,8 @@
 * running on target system) or @ref lwip_os (there is an OS running
 * on the target system).
 * 
+ * See also: @ref multithreading (especially the part about @ref LWIP_ASSERT_CORE_LOCKED()!)
+ *
 * Mainloop Mode
 * -------------
 * In mainloop mode, only @ref callbackstyle_api can be used.
@@ -86,6 +180,37 @@
 *    @ref LOCK_TCPIP_CORE() and @ref UNLOCK_TCPIP_CORE().
 *    These macros cannot be used in an interrupt context!
 *    Note the OS must correctly handle priority inversion for this.
+ *
+ * Cache / DMA issues
+ * ==================
+ *
+ * DMA-capable ethernet hardware and zero-copy RX
+ * ----------------------------------------------
+ * 
+ * lwIP changes the content of RECEIVED pbufs in the TCP code path.
+ * This implies one or more cacheline(s) of the RX pbuf become dirty
+ * and need to be flushed before the memory is handed over to the
+ * DMA ethernet hardware for the next telegram to be received.
+ * See http://lists.nongnu.org/archive/html/lwip-devel/2017-12/msg00070.html
+ * for a more detailed explanation.
+ * Also keep in mind the user application may also write into pbufs,
+ * so it is generally a bug not to flush the data cache before handing
+ * a buffer to DMA hardware.
+ *
+ * DMA-capable ethernet hardware and cacheline alignment
+ * -----------------------------------------------------
+ * Nice description about DMA capable hardware and buffer handling:
+ * http://www.pebblebay.com/a-guide-to-using-direct-memory-access-in-embedded-systems-part-two/
+ * Read especially sections "Cache coherency" and "Buffer alignment".
+ */
+
+/**
+ * @page mem_err Debugging memory pool sizes
+ * If you have issues with lwIP and you are using memory pools, check that your pools
+ * are correctly sized.\n
+ * To debug pool sizes, \#define LWIP_STATS and MEMP_STATS to 1. Check the global variable
+ * lwip_stats.memp[] using a debugger. If the "err" member of a pool is > 0, the pool
+ * may be too small for your application and you need to increase its size.
 */

 /**
@@ -95,6 +220,12 @@
 * https://savannah.nongnu.org/bugs/?group=lwip
 */

+/**
+ * @page zerocopyrx Zero-copy RX
+ * The following code is an example for zero-copy RX ethernet driver:
+ * @include ZeroCopyRx.c
+ */
+
 /**
 * @defgroup lwip_nosys Mainloop mode ("NO_SYS")
 * @ingroup lwip
@@ -103,7 +234,8 @@
 * *not* *from* *interrupt* *context*. You can allocate a @ref pbuf in interrupt
 * context and put them into a queue which is processed from mainloop.\n
 * Call sys_check_timeouts() periodically in the mainloop.\n
- * Porting: implement all functions in @ref sys_time and @ref sys_prot.\n
+ * Porting: implement all functions in @ref sys_time, @ref sys_prot and 
+ * @ref compiler_abstraction.\n
 * You can only use @ref callbackstyle_api in this mode.\n
 * Sample code:\n
 * @include NO_SYS_SampleCode.c
@@ -121,6 +253,160 @@
 */

 /**
- * @page raw_api lwIP API
- * @verbinclude "rawapi.txt"
+ * @page sys_init System initalization
+A truly complete and generic sequence for initializing the lwIP stack
+cannot be given because it depends on additional initializations for
+your runtime environment (e.g. timers).
+
+We can give you some idea on how to proceed when using the raw API.
+We assume a configuration using a single Ethernet netif and the
+UDP and TCP transport layers, IPv4 and the DHCP client.
+
+Call these functions in the order of appearance:
+
+- lwip_init(): Initialize the lwIP stack and all of its subsystems.
+
+- netif_add(struct netif *netif, ...):
+  Adds your network interface to the netif_list. Allocate a struct
+  netif and pass a pointer to this structure as the first argument.
+  Give pointers to cleared ip_addr structures when using DHCP,
+  or fill them with sane numbers otherwise. The state pointer may be NULL.
+
+  The init function pointer must point to a initialization function for
+  your Ethernet netif interface. The following code illustrates its use.
+  
+@code{.c}
+  err_t netif_if_init(struct netif *netif)
+  {
+    u8_t i;
+    
+    for (i = 0; i < ETHARP_HWADDR_LEN; i++) {
+      netif->hwaddr[i] = some_eth_addr[i];
+    }
+    init_my_eth_device();
+    return ERR_OK;
+  }
+@endcode
+  
+  For Ethernet drivers, the input function pointer must point to the lwIP
+  function ethernet_input() declared in "netif/etharp.h". Other drivers
+  must use ip_input() declared in "lwip/ip.h".
+  
+- netif_set_default(struct netif *netif)
+  Registers the default network interface.
+
+- netif_set_link_up(struct netif *netif)
+  This is the hardware link state; e.g. whether cable is plugged for wired
+  Ethernet interface. This function must be called even if you don't know
+  the current state. Having link up and link down events is optional but
+  DHCP and IPv6 discover benefit well from those events.
+
+- netif_set_up(struct netif *netif)
+  This is the administrative (= software) state of the netif, when the
+  netif is fully configured this function must be called.
+
+- dhcp_start(struct netif *netif)
+  Creates a new DHCP client for this interface on the first call.
+  You can peek in the netif->dhcp struct for the actual DHCP status.
+
+- sys_check_timeouts()
+  When the system is running, you have to periodically call
+  sys_check_timeouts() which will handle all timers for all protocols in
+  the stack; add this to your main loop or equivalent.
+ */
+
+/**
+ * @page multithreading Multithreading
+ * lwIP started targeting single-threaded environments. When adding multi-
+ * threading support, instead of making the core thread-safe, another
+ * approach was chosen: there is one main thread running the lwIP core
+ * (also known as the "tcpip_thread"). When running in a multithreaded
+ * environment, raw API functions MUST only be called from the core thread
+ * since raw API functions are not protected from concurrent access (aside
+ * from pbuf- and memory management functions). Application threads using
+ * the sequential- or socket API communicate with this main thread through
+ * message passing.
+ * 
+ * As such, the list of functions that may be called from
+ * other threads or an ISR is very limited! Only functions
+ * from these API header files are thread-safe:
+ * - api.h
+ * - netbuf.h
+ * - netdb.h
+ * - netifapi.h
+ * - pppapi.h
+ * - sockets.h
+ * - sys.h
+ * 
+ * Additionaly, memory (de-)allocation functions may be
+ * called from multiple threads (not ISR!) with NO_SYS=0
+ * since they are protected by @ref SYS_LIGHTWEIGHT_PROT and/or
+ * semaphores.
+ * 
+ * Netconn or Socket API functions are thread safe against the
+ * core thread but they are not reentrant at the control block
+ * granularity level. That is, a UDP or TCP control block must
+ * not be shared among multiple threads without proper locking.
+ * 
+ * If @ref SYS_LIGHTWEIGHT_PROT is set to 1 and
+ * @ref LWIP_ALLOW_MEM_FREE_FROM_OTHER_CONTEXT is set to 1,
+ * pbuf_free() may also be called from another thread or
+ * an ISR (since only then, mem_free - for PBUF_RAM - may
+ * be called from an ISR: otherwise, the HEAP is only
+ * protected by semaphores).
+ * 
+ * How to get threading done right
+ * -------------------------------
+ * 
+ * It is strongly recommended to implement the LWIP_ASSERT_CORE_LOCKED()
+ * macro in an application that uses multithreading. lwIP code has
+ * several places where a check for a correct thread context is
+ * implemented which greatly helps the user to get threading done right.
+ * See the example sys_arch.c files in unix and Win32 port 
+ * in the contrib repository.
+ * 
+ * In short: Copy the functions sys_mark_tcpip_thread() and 
+ * sys_check_core_locking() to your port and modify them to work with your OS.
+ * Then let @ref LWIP_ASSERT_CORE_LOCKED() and @ref LWIP_MARK_TCPIP_THREAD()
+ * point to these functions.
+ * 
+ * If you use @ref LWIP_TCPIP_CORE_LOCKING, you also need to copy and adapt
+ * the functions sys_lock_tcpip_core() and sys_unlock_tcpip_core().
+ * Let @ref LOCK_TCPIP_CORE() and @ref UNLOCK_TCPIP_CORE() point 
+ * to these functions. 
+ */
+
+/**
+ * @page optimization Optimization hints
+The first thing you want to optimize is the lwip_standard_checksum()
+routine from src/core/inet.c. You can override this standard
+function with the \#define LWIP_CHKSUM your_checksum_routine().
+
+There are C examples given in inet.c or you might want to
+craft an assembly function for this. RFC1071 is a good
+introduction to this subject.
+
+Other significant improvements can be made by supplying
+assembly or inline replacements for htons() and htonl()
+if you're using a little-endian architecture.
+\#define lwip_htons(x) your_htons()
+\#define lwip_htonl(x) your_htonl()
+If you \#define them to htons() and htonl(), you should
+\#define LWIP_DONT_PROVIDE_BYTEORDER_FUNCTIONS to prevent lwIP from
+defining htonx / ntohx compatibility macros.
+
+Check your network interface driver if it reads at
+a higher speed than the maximum wire-speed. If the
+hardware isn't serviced frequently and fast enough
+buffer overflows are likely to occur.
+
+E.g. when using the cs8900 driver, call cs8900if_service(ethif)
+as frequently as possible. When using an RTOS let the cs8900 interrupt
+wake a high priority task that services your driver using a binary
+semaphore or event flag. Some drivers might allow additional tuning
+to match your application and network.
+
+For a production release it is recommended to set LWIP_STATS to 0.
+Note that speed performance isn't influenced much by simply setting
+high values to the memory options.
 */
--- a/doc/mdns.txt
+++ b/doc/mdns.txt
@@ -32,8 +32,8 @@ generated.
 The MDNS code puts its structs on the stack where suitable to reduce dynamic
 memory allocation. It may use up to 1kB of stack.

-MDNS needs a strncasecmp() implementation. If you have one, define
-LWIP_MDNS_STRNCASECMP to it. Otherwise the code will provide an implementation
+MDNS (like other apps) needs a strncasecmp() implementation. If you have one, define
+'lwip_strnicmp' to it. Otherwise the code will provide an implementation
 for you.


@@ -57,11 +57,11 @@ Answers will use the supplied TTL (in seconds)
 MDNS allows UTF-8 names, but it is recommended to stay within ASCII,
 since the default case-insensitive comparison assumes this.

-It is recommended to call this function after an IPv4 address has been set,
-since there is currently no check if the v4 address is valid.
+Call mdns_resp_announce() every time the IP address on the netif has changed.

-Call mdns_resp_netif_settings_changed() every time the IP address
-on the netif has changed.
+Call mdns_resp_restart() every time the network interface comes up after being
+down, for example cable connected after being disconnected, administrative 
+interface comes up after being down, or the device wakes up from sleep.

 To stop responding on a netif, run
  mdns_resp_remove_netif(struct netif *netif)
@@ -108,6 +108,5 @@ and point them to <hostname>.local:80
 Relevant information will be sent as additional records to reduce number of
 requests required from a client.

-Removing services is currently not supported. Services are removed when the
-netif is removed.
-
+To remove a service from a netif, run
+  mdns_resp_del_service(struct netif *netif, s8_t slot)
--- a/doc/mqtt_client.txt
+++ b/doc/mqtt_client.txt
@@ -0,0 +1,162 @@
+MQTT client for lwIP
+
+Author: Erik Andersson
+
+Details of the MQTT protocol can be found at:
+http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/os/mqtt-v3.1.1-os.html 
+
+-----------------------------------------------------------------
+1. Initial steps, reserve memory and make connection to server:
+
+1.1: Provide storage
+
+Static allocation:
+  mqtt_client_t static_client;
+  example_do_connect(&static_client);
+
+Dynamic allocation:
+  mqtt_client_t *client = mqtt_client_new();
+  if(client != NULL) {
+    example_do_connect(&client);
+  }
+  
+1.2: Establish Connection with server
+
+void example_do_connect(mqtt_client_t *client)
+{
+  struct mqtt_connect_client_info_t ci;
+  err_t err;
+  
+  /* Setup an empty client info structure */
+  memset(&ci, 0, sizeof(ci));
+  
+  /* Minimal amount of information required is client identifier, so set it here */ 
+  ci.client_id = "lwip_test";
+  
+  /* Initiate client and connect to server, if this fails immediately an error code is returned
+     otherwise mqtt_connection_cb will be called with connection result after attempting 
+     to establish a connection with the server. 
+     For now MQTT version 3.1.1 is always used */
+  
+  err = mqtt_client_connect(client, ip_addr, MQTT_PORT, mqtt_connection_cb, 0, &ci);
+  
+  /* For now just print the result code if something goes wrong */
+  if(err != ERR_OK) {
+    printf("mqtt_connect return %d\n", err);
+  }
+}
+
+Connection to server can also be probed by calling mqtt_client_is_connected(client) 
+
+-----------------------------------------------------------------
+2. Implementing the connection status callback
+
+
+static void mqtt_connection_cb(mqtt_client_t *client, void *arg, mqtt_connection_status_t status)
+{
+  err_t err;
+  if(status == MQTT_CONNECT_ACCEPTED) {
+    printf("mqtt_connection_cb: Successfully connected\n");
+    
+    /* Setup callback for incoming publish requests */
+    mqtt_set_inpub_callback(client, mqtt_incoming_publish_cb, mqtt_incoming_data_cb, arg);
+    
+    /* Subscribe to a topic named "subtopic" with QoS level 1, call mqtt_sub_request_cb with result */ 
+    err = mqtt_subscribe(client, "subtopic", 1, mqtt_sub_request_cb, arg);
+
+    if(err != ERR_OK) {
+      printf("mqtt_subscribe return: %d\n", err);
+    }
+  } else {
+    printf("mqtt_connection_cb: Disconnected, reason: %d\n", status);
+    
+    /* Its more nice to be connected, so try to reconnect */
+    example_do_connect(client);
+  }  
+}
+
+static void mqtt_sub_request_cb(void *arg, err_t result)
+{
+  /* Just print the result code here for simplicity, 
+     normal behaviour would be to take some action if subscribe fails like 
+     notifying user, retry subscribe or disconnect from server */
+  printf("Subscribe result: %d\n", result);
+}
+
+-----------------------------------------------------------------
+3. Implementing callbacks for incoming publish and data
+
+/* The idea is to demultiplex topic and create some reference to be used in data callbacks
+   Example here uses a global variable, better would be to use a member in arg
+   If RAM and CPU budget allows it, the easiest implementation might be to just take a copy of
+   the topic string and use it in mqtt_incoming_data_cb
+*/
+static int inpub_id;
+static void mqtt_incoming_publish_cb(void *arg, const char *topic, u32_t tot_len)
+{
+  printf("Incoming publish at topic %s with total length %u\n", topic, (unsigned int)tot_len);
+
+  /* Decode topic string into a user defined reference */
+  if(strcmp(topic, "print_payload") == 0) {
+    inpub_id = 0;
+  } else if(topic[0] == 'A') {
+    /* All topics starting with 'A' might be handled at the same way */
+    inpub_id = 1;
+  } else {
+    /* For all other topics */
+    inpub_id = 2;
+  }
+}
+
+static void mqtt_incoming_data_cb(void *arg, const u8_t *data, u16_t len, u8_t flags)
+{
+  printf("Incoming publish payload with length %d, flags %u\n", len, (unsigned int)flags);
+
+  if(flags & MQTT_DATA_FLAG_LAST) {
+    /* Last fragment of payload received (or whole part if payload fits receive buffer
+       See MQTT_VAR_HEADER_BUFFER_LEN)  */
+
+    /* Call function or do action depending on reference, in this case inpub_id */
+    if(inpub_id == 0) {
+      /* Don't trust the publisher, check zero termination */
+      if(data[len-1] == 0) {
+        printf("mqtt_incoming_data_cb: %s\n", (const char *)data);
+      }
+    } else if(inpub_id == 1) {
+      /* Call an 'A' function... */
+    } else {
+      printf("mqtt_incoming_data_cb: Ignoring payload...\n");
+    }
+  } else {
+    /* Handle fragmented payload, store in buffer, write to file or whatever */
+  }
+}
+
+-----------------------------------------------------------------
+4. Using outgoing publish
+
+
+void example_publish(mqtt_client_t *client, void *arg)
+{
+  const char *pub_payload= "PubSubHubLubJub";
+  err_t err;
+  u8_t qos = 2; /* 0 1 or 2, see MQTT specification */
+  u8_t retain = 0; /* No don't retain such crappy payload... */
+  err = mqtt_publish(client, "pub_topic", pub_payload, strlen(pub_payload), qos, retain, mqtt_pub_request_cb, arg);
+  if(err != ERR_OK) {
+    printf("Publish err: %d\n", err);
+  }
+}
+
+/* Called when publish is complete either with sucess or failure */
+static void mqtt_pub_request_cb(void *arg, err_t result)
+{
+  if(result != ERR_OK) {
+    printf("Publish result: %d\n", result);
+  }
+}
+
+-----------------------------------------------------------------
+5. Disconnecting
+
+Simply call mqtt_disconnect(client)
--- a/doc/rawapi.txt
+++ b/doc/rawapi.txt
@@ -1,499 +0,0 @@
-Raw TCP/IP interface for lwIP
-
-Authors: Adam Dunkels, Leon Woestenberg, Christiaan Simons
-
-lwIP provides three Application Program's Interfaces (APIs) for programs
-to use for communication with the TCP/IP code:
-* low-level "core" / "callback" or "raw" API.
-* higher-level "sequential" API.
-* BSD-style socket API.
-
-The raw API (sometimes called native API) is an event-driven API designed
-to be used without an operating system that implements zero-copy send and
-receive. This API is also used by the core stack for interaction between
-the various protocols. It is the only API available when running lwIP
-without an operating system.
-
-The sequential API provides a way for ordinary, sequential, programs
-to use the lwIP stack. It is quite similar to the BSD socket API. The
-model of execution is based on the blocking open-read-write-close
-paradigm. Since the TCP/IP stack is event based by nature, the TCP/IP
-code and the application program must reside in different execution
-contexts (threads).
-
-The socket API is a compatibility API for existing applications,
-currently it is built on top of the sequential API. It is meant to
-provide all functions needed to run socket API applications running
-on other platforms (e.g. unix / windows etc.). However, due to limitations
-in the specification of this API, there might be incompatibilities
-that require small modifications of existing programs.
-
-** Multithreading
-
-lwIP started targeting single-threaded environments. When adding multi-
-threading support, instead of making the core thread-safe, another
-approach was chosen: there is one main thread running the lwIP core
-(also known as the "tcpip_thread"). When running in a multithreaded
-environment, raw API functions MUST only be called from the core thread
-since raw API functions are not protected from concurrent access (aside
-from pbuf- and memory management functions). Application threads using
-the sequential- or socket API communicate with this main thread through
-message passing.
-
-      As such, the list of functions that may be called from
-      other threads or an ISR is very limited! Only functions
-      from these API header files are thread-safe:
-      - api.h
-      - netbuf.h
-      - netdb.h
-      - netifapi.h
-      - pppapi.h
-      - sockets.h
-      - sys.h
-
-      Additionaly, memory (de-)allocation functions may be
-      called from multiple threads (not ISR!) with NO_SYS=0
-      since they are protected by SYS_LIGHTWEIGHT_PROT and/or
-      semaphores.
-
-      Netconn or Socket API functions are thread safe against the
-      core thread but they are not reentrant at the control block
-      granularity level. That is, a UDP or TCP control block must
-      not be shared among multiple threads without proper locking.
-
-      If SYS_LIGHTWEIGHT_PROT is set to 1 and
-      LWIP_ALLOW_MEM_FREE_FROM_OTHER_CONTEXT is set to 1,
-      pbuf_free() may also be called from another thread or
-      an ISR (since only then, mem_free - for PBUF_RAM - may
-      be called from an ISR: otherwise, the HEAP is only
-      protected by semaphores).
-
-
-** The remainder of this document discusses the "raw" API. **
-
-The raw TCP/IP interface allows the application program to integrate
-better with the TCP/IP code. Program execution is event based by
-having callback functions being called from within the TCP/IP
-code. The TCP/IP code and the application program both run in the same
-thread. The sequential API has a much higher overhead and is not very
-well suited for small systems since it forces a multithreaded paradigm
-on the application.
-
-The raw TCP/IP interface is not only faster in terms of code execution
-time but is also less memory intensive. The drawback is that program
-development is somewhat harder and application programs written for
-the raw TCP/IP interface are more difficult to understand. Still, this
-is the preferred way of writing applications that should be small in
-code size and memory usage.
-
-All APIs can be used simultaneously by different application
-programs. In fact, the sequential API is implemented as an application
-program using the raw TCP/IP interface.
-
-Do not confuse the lwIP raw API with raw Ethernet or IP sockets.
-The former is a way of interfacing the lwIP network stack (including
-TCP and UDP), the later refers to processing raw Ethernet or IP data
-instead of TCP connections or UDP packets.
-
-Raw API applications may never block since all packet processing
-(input and output) as well as timer processing (TCP mainly) is done
-in a single execution context.
-
--- Callbacks
-
-Program execution is driven by callbacks functions, which are then
-invoked by the lwIP core when activity related to that application
-occurs. A particular application may register to be notified via a
-callback function for events such as incoming data available, outgoing
-data sent, error notifications, poll timer expiration, connection
-closed, etc. An application can provide a callback function to perform
-processing for any or all of these events. Each callback is an ordinary
-C function that is called from within the TCP/IP code. Every callback
-function is passed the current TCP or UDP connection state as an
-argument. Also, in order to be able to keep program specific state,
-the callback functions are called with a program specified argument
-that is independent of the TCP/IP state.
-
-The function for setting the application connection state is:
-
- void tcp_arg(struct tcp_pcb *pcb, void *arg)
-
-  Specifies the program specific state that should be passed to all
-  other callback functions. The "pcb" argument is the current TCP
-  connection control block, and the "arg" argument is the argument
-  that will be passed to the callbacks.
-
-  
--- TCP connection setup
-
-The functions used for setting up connections is similar to that of
-the sequential API and of the BSD socket API. A new TCP connection
-identifier (i.e., a protocol control block - PCB) is created with the
-tcp_new() function. This PCB can then be either set to listen for new
-incoming connections or be explicitly connected to another host.
-
- struct tcp_pcb *tcp_new(void)
-
-  Creates a new connection identifier (PCB). If memory is not
-  available for creating the new pcb, NULL is returned.
-
- err_t tcp_bind(struct tcp_pcb *pcb, ip_addr_t *ipaddr,
-                 u16_t port)
-
-  Binds the pcb to a local IP address and port number. The IP address
-  can be specified as IP_ADDR_ANY in order to bind the connection to
-  all local IP addresses.
-
-  If another connection is bound to the same port, the function will
-  return ERR_USE, otherwise ERR_OK is returned.
-
- struct tcp_pcb *tcp_listen(struct tcp_pcb *pcb)
-
-  Commands a pcb to start listening for incoming connections. When an
-  incoming connection is accepted, the function specified with the
-  tcp_accept() function will be called. The pcb will have to be bound
-  to a local port with the tcp_bind() function.
-
-  The tcp_listen() function returns a new connection identifier, and
-  the one passed as an argument to the function will be
-  deallocated. The reason for this behavior is that less memory is
-  needed for a connection that is listening, so tcp_listen() will
-  reclaim the memory needed for the original connection and allocate a
-  new smaller memory block for the listening connection.
-
-  tcp_listen() may return NULL if no memory was available for the
-  listening connection. If so, the memory associated with the pcb
-  passed as an argument to tcp_listen() will not be deallocated.
-
- struct tcp_pcb *tcp_listen_with_backlog(struct tcp_pcb *pcb, u8_t backlog)
-
-  Same as tcp_listen, but limits the number of outstanding connections
-  in the listen queue to the value specified by the backlog argument.
-  To use it, your need to set TCP_LISTEN_BACKLOG=1 in your lwipopts.h.
-
- void tcp_accept(struct tcp_pcb *pcb,
-                  err_t (* accept)(void *arg, struct tcp_pcb *newpcb,
-                                   err_t err))
-
-  Specified the callback function that should be called when a new
-  connection arrives on a listening connection.
-
- err_t tcp_connect(struct tcp_pcb *pcb, ip_addr_t *ipaddr,
-                    u16_t port, err_t (* connected)(void *arg,
-                                                    struct tcp_pcb *tpcb,
-                                                    err_t err));
-
-  Sets up the pcb to connect to the remote host and sends the
-  initial SYN segment which opens the connection. 
-
-  The tcp_connect() function returns immediately; it does not wait for
-  the connection to be properly setup. Instead, it will call the
-  function specified as the fourth argument (the "connected" argument)
-  when the connection is established. If the connection could not be
-  properly established, either because the other host refused the
-  connection or because the other host didn't answer, the "err"
-  callback function of this pcb (registered with tcp_err, see below)
-  will be called.
-
-  The tcp_connect() function can return ERR_MEM if no memory is
-  available for enqueueing the SYN segment. If the SYN indeed was
-  enqueued successfully, the tcp_connect() function returns ERR_OK.
-
-
--- Sending TCP data
-
-TCP data is sent by enqueueing the data with a call to
-tcp_write(). When the data is successfully transmitted to the remote
-host, the application will be notified with a call to a specified
-callback function.
-
- err_t tcp_write(struct tcp_pcb *pcb, const void *dataptr, u16_t len,
-                  u8_t apiflags)
-
-  Enqueues the data pointed to by the argument dataptr. The length of
-  the data is passed as the len parameter. The apiflags can be one or more of:
-  - TCP_WRITE_FLAG_COPY: indicates whether the new memory should be allocated
-    for the data to be copied into. If this flag is not given, no new memory
-    should be allocated and the data should only be referenced by pointer. This
-    also means that the memory behind dataptr must not change until the data is
-    ACKed by the remote host
-  - TCP_WRITE_FLAG_MORE: indicates that more data follows. If this is omitted,
-    the PSH flag is set in the last segment created by this call to tcp_write.
-    If this flag is given, the PSH flag is not set.
-
-  The tcp_write() function will fail and return ERR_MEM if the length
-  of the data exceeds the current send buffer size or if the length of
-  the queue of outgoing segment is larger than the upper limit defined
-  in lwipopts.h. The number of bytes available in the output queue can
-  be retrieved with the tcp_sndbuf() function.
-
-  The proper way to use this function is to call the function with at
-  most tcp_sndbuf() bytes of data. If the function returns ERR_MEM,
-  the application should wait until some of the currently enqueued
-  data has been successfully received by the other host and try again.
-
- void tcp_sent(struct tcp_pcb *pcb,
-                err_t (* sent)(void *arg, struct tcp_pcb *tpcb,
-                u16_t len))
-
-  Specifies the callback function that should be called when data has
-  successfully been received (i.e., acknowledged) by the remote
-  host. The len argument passed to the callback function gives the
-  amount bytes that was acknowledged by the last acknowledgment.
-
-  
--- Receiving TCP data
-
-TCP data reception is callback based - an application specified
-callback function is called when new data arrives. When the
-application has taken the data, it has to call the tcp_recved()
-function to indicate that TCP can advertise increase the receive
-window.
-
- void tcp_recv(struct tcp_pcb *pcb,
-                err_t (* recv)(void *arg, struct tcp_pcb *tpcb,
-                               struct pbuf *p, err_t err))
-
-  Sets the callback function that will be called when new data
-  arrives. The callback function will be passed a NULL pbuf to
-  indicate that the remote host has closed the connection. If
-  there are no errors and the callback function is to return
-  ERR_OK, then it must free the pbuf. Otherwise, it must not
-  free the pbuf so that lwIP core code can store it.
-
- void tcp_recved(struct tcp_pcb *pcb, u16_t len)
-
-  Must be called when the application has received the data. The len
-  argument indicates the length of the received data.
-
-
--- Application polling
-
-When a connection is idle (i.e., no data is either transmitted or
-received), lwIP will repeatedly poll the application by calling a
-specified callback function. This can be used either as a watchdog
-timer for killing connections that have stayed idle for too long, or
-as a method of waiting for memory to become available. For instance,
-if a call to tcp_write() has failed because memory wasn't available,
-the application may use the polling functionality to call tcp_write()
-again when the connection has been idle for a while.
-
- void tcp_poll(struct tcp_pcb *pcb, 
-                err_t (* poll)(void *arg, struct tcp_pcb *tpcb),
-                u8_t interval)
-
-  Specifies the polling interval and the callback function that should
-  be called to poll the application. The interval is specified in
-  number of TCP coarse grained timer shots, which typically occurs
-  twice a second. An interval of 10 means that the application would
-  be polled every 5 seconds.
-
-
--- Closing and aborting connections
-
- err_t tcp_close(struct tcp_pcb *pcb)
-
-  Closes the connection. The function may return ERR_MEM if no memory
-  was available for closing the connection. If so, the application
-  should wait and try again either by using the acknowledgment
-  callback or the polling functionality. If the close succeeds, the
-  function returns ERR_OK.
-
-  The pcb is deallocated by the TCP code after a call to tcp_close(). 
-
- void tcp_abort(struct tcp_pcb *pcb)
-
-  Aborts the connection by sending a RST (reset) segment to the remote
-  host. The pcb is deallocated. This function never fails.
-
-  ATTENTION: When calling this from one of the TCP callbacks, make
-  sure you always return ERR_ABRT (and never return ERR_ABRT otherwise
-  or you will risk accessing deallocated memory or memory leaks!
-
-
-If a connection is aborted because of an error, the application is
-alerted of this event by the err callback. Errors that might abort a
-connection are when there is a shortage of memory. The callback
-function to be called is set using the tcp_err() function.
-
- void tcp_err(struct tcp_pcb *pcb, void (* err)(void *arg,
-       err_t err))
-
-  The error callback function does not get the pcb passed to it as a
-  parameter since the pcb may already have been deallocated.
-
-
--- UDP interface
-
-The UDP interface is similar to that of TCP, but due to the lower
-level of complexity of UDP, the interface is significantly simpler.
-
- struct udp_pcb *udp_new(void)
-
-  Creates a new UDP pcb which can be used for UDP communication. The
-  pcb is not active until it has either been bound to a local address
-  or connected to a remote address.
-
- void udp_remove(struct udp_pcb *pcb)
-
-  Removes and deallocates the pcb.  
-  
- err_t udp_bind(struct udp_pcb *pcb, ip_addr_t *ipaddr,
-                 u16_t port)
-
-  Binds the pcb to a local address. The IP-address argument "ipaddr"
-  can be IP_ADDR_ANY to indicate that it should listen to any local IP
-  address. The function currently always return ERR_OK.
-
- err_t udp_connect(struct udp_pcb *pcb, ip_addr_t *ipaddr,
-                    u16_t port)
-
-  Sets the remote end of the pcb. This function does not generate any
-  network traffic, but only set the remote address of the pcb.
-
- err_t udp_disconnect(struct udp_pcb *pcb)
-
-  Remove the remote end of the pcb. This function does not generate
-  any network traffic, but only removes the remote address of the pcb.
-
- err_t udp_send(struct udp_pcb *pcb, struct pbuf *p)
-
-  Sends the pbuf p. The pbuf is not deallocated.
-
- void udp_recv(struct udp_pcb *pcb,
-                void (* recv)(void *arg, struct udp_pcb *upcb,
-                                         struct pbuf *p,
-                                         ip_addr_t *addr,
-                                         u16_t port),
-                              void *recv_arg)
-
-  Specifies a callback function that should be called when a UDP
-  datagram is received.
-  
-
--- System initalization
-
-A truly complete and generic sequence for initializing the lwIP stack
-cannot be given because it depends on additional initializations for
-your runtime environment (e.g. timers).
-
-We can give you some idea on how to proceed when using the raw API.
-We assume a configuration using a single Ethernet netif and the
-UDP and TCP transport layers, IPv4 and the DHCP client.
-
-Call these functions in the order of appearance:
-
- lwip_init()
-
-  Initialize the lwIP stack and all of its subsystems.
-
- netif_add(struct netif *netif, const ip4_addr_t *ipaddr,
-            const ip4_addr_t *netmask, const ip4_addr_t *gw,
-            void *state, netif_init_fn init, netif_input_fn input)
-
-  Adds your network interface to the netif_list. Allocate a struct
-  netif and pass a pointer to this structure as the first argument.
-  Give pointers to cleared ip_addr structures when using DHCP,
-  or fill them with sane numbers otherwise. The state pointer may be NULL.
-
-  The init function pointer must point to a initialization function for
-  your Ethernet netif interface. The following code illustrates its use.
-  
-  err_t netif_if_init(struct netif *netif)
-  {
-    u8_t i;
-    
-    for (i = 0; i < ETHARP_HWADDR_LEN; i++) {
-      netif->hwaddr[i] = some_eth_addr[i];
-    }
-    init_my_eth_device();
-    return ERR_OK;
-  }
-  
-  For Ethernet drivers, the input function pointer must point to the lwIP
-  function ethernet_input() declared in "netif/etharp.h". Other drivers
-  must use ip_input() declared in "lwip/ip.h".
-  
- netif_set_default(struct netif *netif)
-
-  Registers the default network interface.
-
- netif_set_link_up(struct netif *netif)
-
-  This is the hardware link state; e.g. whether cable is plugged for wired
-  Ethernet interface. This function must be called even if you don't know
-  the current state. Having link up and link down events is optional but
-  DHCP and IPv6 discover benefit well from those events.
-
- netif_set_up(struct netif *netif)
-
-  This is the administrative (= software) state of the netif, when the
-  netif is fully configured this function must be called.
-
- dhcp_start(struct netif *netif)
-
-  Creates a new DHCP client for this interface on the first call.
-  
-  You can peek in the netif->dhcp struct for the actual DHCP status.
-
- sys_check_timeouts()
-
-  When the system is running, you have to periodically call
-  sys_check_timeouts() which will handle all timers for all protocols in
-  the stack; add this to your main loop or equivalent.
-
-
--- Optimalization hints
-
-The first thing you want to optimize is the lwip_standard_checksum()
-routine from src/core/inet.c. You can override this standard
-function with the #define LWIP_CHKSUM <your_checksum_routine>.
-
-There are C examples given in inet.c or you might want to
-craft an assembly function for this. RFC1071 is a good
-introduction to this subject.
-
-Other significant improvements can be made by supplying
-assembly or inline replacements for htons() and htonl()
-if you're using a little-endian architecture.
-#define lwip_htons(x) <your_htons>
-#define lwip_htonl(x) <your_htonl>
-If you #define them to htons() and htonl(), you should
-#define LWIP_DONT_PROVIDE_BYTEORDER_FUNCTIONS to prevent lwIP from
-defining hton*/ntoh* compatibility macros.
-
-Check your network interface driver if it reads at
-a higher speed than the maximum wire-speed. If the
-hardware isn't serviced frequently and fast enough
-buffer overflows are likely to occur.
-
-E.g. when using the cs8900 driver, call cs8900if_service(ethif)
-as frequently as possible. When using an RTOS let the cs8900 interrupt
-wake a high priority task that services your driver using a binary
-semaphore or event flag. Some drivers might allow additional tuning
-to match your application and network.
-
-For a production release it is recommended to set LWIP_STATS to 0.
-Note that speed performance isn't influenced much by simply setting
-high values to the memory options.
-
-For more optimization hints take a look at the lwIP wiki.
-
--- Zero-copy MACs
-
-To achieve zero-copy on transmit, the data passed to the raw API must
-remain unchanged until sent. Because the send- (or write-)functions return
-when the packets have been enqueued for sending, data must be kept stable
-after that, too.
-
-This implies that PBUF_RAM/PBUF_POOL pbufs passed to raw-API send functions
-must *not* be reused by the application unless their ref-count is 1.
-
-For no-copy pbufs (PBUF_ROM/PBUF_REF), data must be kept unchanged, too,
-but the stack/driver will/must copy PBUF_REF'ed data when enqueueing, while
-PBUF_ROM-pbufs are just enqueued (as ROM-data is expected to never change).
-
-Also, data passed to tcp_write without the copy-flag must not be changed!
-
-Therefore, be careful which type of PBUF you use and if you copy TCP data
-or not!
--- a/doc/savannah.txt
+++ b/doc/savannah.txt
@@ -29,12 +29,12 @@ Or, obtain a specific (fixed) release as follows:
 The Savannah server uses SSH (Secure Shell) protocol 2 authentication and encryption.
 As such, Git commits to the server occur through a SSH tunnel for project members.
 To create a SSH2 key pair in UNIX-like environments, do this:
- ssh-keygen -t dsa
+ ssh-keygen

 Under Windows, a recommended SSH client is "PuTTY", freely available with good
 documentation and a graphic user interface. Use its key generator.

-Now paste the id_dsa.pub contents into your Savannah account public key list. Wait
+Now paste the id_rsa.pub contents into your Savannah account public key list. Wait
 a while so that Savannah can update its configuration (This can take minutes).

 Try to login using SSH:
--- a/doc/sys_arch.txt
+++ b/doc/sys_arch.txt
@@ -1,303 +0,0 @@
-sys_arch interface for lwIP
-
-Author: Adam Dunkels
-        Simon Goldschmidt
-
-The operating system emulation layer provides a common interface
-between the lwIP code and the underlying operating system kernel. The
-general idea is that porting lwIP to new architectures requires only
-small changes to a few header files and a new sys_arch
-implementation. It is also possible to do a sys_arch implementation
-that does not rely on any underlying operating system.
-
-The sys_arch provides semaphores, mailboxes and mutexes to lwIP. For the full
-lwIP functionality, multiple threads support can be implemented in the
-sys_arch, but this is not required for the basic lwIP
-functionality. Timer scheduling is implemented in lwIP, but can be implemented
-by the sys_arch port (LWIP_TIMERS_CUSTOM==1).
-
-In addition to the source file providing the functionality of sys_arch,
-the OS emulation layer must provide several header files defining
-macros used throughout lwip.  The files required and the macros they
-must define are listed below the sys_arch description.
-
-Semaphores can be either counting or binary - lwIP works with both
-kinds. Mailboxes should be implemented as a queue which allows multiple messages
-to be posted (implementing as a rendez-vous point where only one message can be
-posted at a time can have a highly negative impact on performance). A message
-in a mailbox is just a pointer, nothing more. 
-
-Semaphores are represented by the type "sys_sem_t" which is typedef'd
-in the sys_arch.h file. Mailboxes are equivalently represented by the
-type "sys_mbox_t". Mutexes are represented ny the type "sys_mutex_t".
-lwIP does not place any restrictions on how these types are represented
-internally.
-
-Since lwIP 1.4.0, semaphore, mutexes and mailbox functions are prototyped in a way that
-allows both using pointers or actual OS structures to be used. This way, memory
-required for such types can be either allocated in place (globally or on the
-stack) or on the heap (allocated internally in the "*_new()" functions).
-
-The following functions must be implemented by the sys_arch:
-
- void sys_init(void)
-
-  Is called to initialize the sys_arch layer.
-
- err_t sys_sem_new(sys_sem_t *sem, u8_t count)
-
-  Creates a new semaphore. The semaphore is allocated to the memory that 'sem'
-  points to (which can be both a pointer or the actual OS structure).
-  The "count" argument specifies the initial state of the semaphore (which is
-  either 0 or 1).
-  If the semaphore has been created, ERR_OK should be returned. Returning any
-  other error will provide a hint what went wrong, but except for assertions,
-  no real error handling is implemented.
-
- void sys_sem_free(sys_sem_t *sem)
-
-  Deallocates a semaphore.
-
- void sys_sem_signal(sys_sem_t *sem)
-
-  Signals a semaphore.
-
- u32_t sys_arch_sem_wait(sys_sem_t *sem, u32_t timeout)
-
-  Blocks the thread while waiting for the semaphore to be
-  signaled. If the "timeout" argument is non-zero, the thread should
-  only be blocked for the specified time (measured in
-  milliseconds). If the "timeout" argument is zero, the thread should be
-  blocked until the semaphore is signalled.
-
-  If the timeout argument is non-zero, the return value is the number of
-  milliseconds spent waiting for the semaphore to be signaled. If the
-  semaphore wasn't signaled within the specified time, the return value is
-  SYS_ARCH_TIMEOUT. If the thread didn't have to wait for the semaphore
-  (i.e., it was already signaled), the function may return zero.
-
-  Notice that lwIP implements a function with a similar name,
-  sys_sem_wait(), that uses the sys_arch_sem_wait() function.
-
- int sys_sem_valid(sys_sem_t *sem)
-
-  Returns 1 if the semaphore is valid, 0 if it is not valid.
-  When using pointers, a simple way is to check the pointer for != NULL.
-  When directly using OS structures, implementing this may be more complex.
-  This may also be a define, in which case the function is not prototyped.
-
- void sys_sem_set_invalid(sys_sem_t *sem)
-
-  Invalidate a semaphore so that sys_sem_valid() returns 0.
-  ATTENTION: This does NOT mean that the semaphore shall be deallocated:
-  sys_sem_free() is always called before calling this function!
-  This may also be a define, in which case the function is not prototyped.
-
- void sys_mutex_new(sys_mutex_t *mutex)
-
-  Creates a new mutex. The mutex is allocated to the memory that 'mutex'
-  points to (which can be both a pointer or the actual OS structure).
-  If the mutex has been created, ERR_OK should be returned. Returning any
-  other error will provide a hint what went wrong, but except for assertions,
-  no real error handling is implemented.
-
- void sys_mutex_free(sys_mutex_t *mutex)
-
-  Deallocates a mutex.
-
- void sys_mutex_lock(sys_mutex_t *mutex)
-  
-  Blocks the thread until the mutex can be grabbed.
-
- void sys_mutex_unlock(sys_mutex_t *mutex)
-
-  Releases the mutex previously locked through 'sys_mutex_lock()'.
-
- void sys_mutex_valid(sys_mutex_t *mutex)
-
-  Returns 1 if the mutes is valid, 0 if it is not valid.
-  When using pointers, a simple way is to check the pointer for != NULL.
-  When directly using OS structures, implementing this may be more complex.
-  This may also be a define, in which case the function is not prototyped.
-
- void sys_mutex_set_invalid(sys_mutex_t *mutex)
-
-  Invalidate a mutex so that sys_mutex_valid() returns 0.
-  ATTENTION: This does NOT mean that the mutex shall be deallocated:
-  sys_mutex_free() is always called before calling this function!
-  This may also be a define, in which case the function is not prototyped.
-
- err_t sys_mbox_new(sys_mbox_t *mbox, int size)
-
-  Creates an empty mailbox for maximum "size" elements. Elements stored
-  in mailboxes are pointers. You have to define macros "_MBOX_SIZE"
-  in your lwipopts.h, or ignore this parameter in your implementation
-  and use a default size.
-  If the mailbox has been created, ERR_OK should be returned. Returning any
-  other error will provide a hint what went wrong, but except for assertions,
-  no real error handling is implemented.
-
- void sys_mbox_free(sys_mbox_t *mbox)
-
-  Deallocates a mailbox. If there are messages still present in the
-  mailbox when the mailbox is deallocated, it is an indication of a
-  programming error in lwIP and the developer should be notified.
-
- void sys_mbox_post(sys_mbox_t *mbox, void *msg)
-
-  Posts the "msg" to the mailbox. This function have to block until
-  the "msg" is really posted.
-
- err_t sys_mbox_trypost(sys_mbox_t *mbox, void *msg)
-
-  Try to post the "msg" to the mailbox. Returns ERR_MEM if this one
-  is full, else, ERR_OK if the "msg" is posted.
-
- u32_t sys_arch_mbox_fetch(sys_mbox_t *mbox, void **msg, u32_t timeout)
-
-  Blocks the thread until a message arrives in the mailbox, but does
-  not block the thread longer than "timeout" milliseconds (similar to
-  the sys_arch_sem_wait() function). If "timeout" is 0, the thread should
-  be blocked until a message arrives. The "msg" argument is a result
-  parameter that is set by the function (i.e., by doing "*msg =
-  ptr"). The "msg" parameter maybe NULL to indicate that the message
-  should be dropped.
-
-  The return values are the same as for the sys_arch_sem_wait() function:
-  Number of milliseconds spent waiting or SYS_ARCH_TIMEOUT if there was a
-  timeout.
-
-  Note that a function with a similar name, sys_mbox_fetch(), is
-  implemented by lwIP. 
-
- u32_t sys_arch_mbox_tryfetch(sys_mbox_t *mbox, void **msg)
-
-  This is similar to sys_arch_mbox_fetch, however if a message is not
-  present in the mailbox, it immediately returns with the code
-  SYS_MBOX_EMPTY. On success 0 is returned.
-
-  To allow for efficient implementations, this can be defined as a
-  function-like macro in sys_arch.h instead of a normal function. For
-  example, a naive implementation could be:
-    #define sys_arch_mbox_tryfetch(mbox,msg) \
-      sys_arch_mbox_fetch(mbox,msg,1)
-  although this would introduce unnecessary delays.
-
- int sys_mbox_valid(sys_mbox_t *mbox)
-
-  Returns 1 if the mailbox is valid, 0 if it is not valid.
-  When using pointers, a simple way is to check the pointer for != NULL.
-  When directly using OS structures, implementing this may be more complex.
-  This may also be a define, in which case the function is not prototyped.
-
- void sys_mbox_set_invalid(sys_mbox_t *mbox)
-
-  Invalidate a mailbox so that sys_mbox_valid() returns 0.
-  ATTENTION: This does NOT mean that the mailbox shall be deallocated:
-  sys_mbox_free() is always called before calling this function!
-  This may also be a define, in which case the function is not prototyped.
-
-If threads are supported by the underlying operating system and if
-such functionality is needed in lwIP, the following function will have
-to be implemented as well:
-
- sys_thread_t sys_thread_new(char *name, void (* thread)(void *arg), void *arg, int stacksize, int prio)
-
-  Starts a new thread named "name" with priority "prio" that will begin its
-  execution in the function "thread()". The "arg" argument will be passed as an
-  argument to the thread() function. The stack size to used for this thread is
-  the "stacksize" parameter. The id of the new thread is returned. Both the id
-  and the priority are system dependent.
-
-When lwIP is used from more than one context (e.g. from multiple threads OR from
-main-loop and from interrupts), the SYS_LIGHTWEIGHT_PROT protection SHOULD be enabled!
-
- sys_prot_t sys_arch_protect(void)
-
-  This optional function does a "fast" critical region protection and returns
-  the previous protection level. This function is only called during very short
-  critical regions. An embedded system which supports ISR-based drivers might
-  want to implement this function by disabling interrupts. Task-based systems
-  might want to implement this by using a mutex or disabling tasking. This
-  function should support recursive calls from the same task or interrupt. In
-  other words, sys_arch_protect() could be called while already protected. In
-  that case the return value indicates that it is already protected.
-
-  sys_arch_protect() is only required if your port is supporting an operating
-  system.
-
- void sys_arch_unprotect(sys_prot_t pval)
-
-  This optional function does a "fast" set of critical region protection to the
-  value specified by pval. See the documentation for sys_arch_protect() for
-  more information. This function is only required if your port is supporting
-  an operating system.
-
-For some configurations, you also need:
-
- u32_t sys_now(void)
-
-  This optional function returns the current time in milliseconds (don't care
-  for wraparound, this is only used for time diffs).
-  Not implementing this function means you cannot use some modules (e.g. TCP
-  timestamps, internal timeouts for NO_SYS==1).
-
-
-Note:
-
-Be careful with using mem_malloc() in sys_arch. When malloc() refers to
-mem_malloc() you can run into a circular function call problem. In mem.c
-mem_init() tries to allcate a semaphore using mem_malloc, which of course
-can't be performed when sys_arch uses mem_malloc.
-
-------------------------------------------------------------------------------
-Additional files required for the "OS support" emulation layer:
-------------------------------------------------------------------------------
-
-cc.h       - Architecture environment, some compiler specific, some
-             environment specific (probably should move env stuff 
-             to sys_arch.h.)
-
-  Typedefs for the types used by lwip -
-    u8_t, s8_t, u16_t, s16_t, u32_t, s32_t, mem_ptr_t
-
-  Compiler hints for packing lwip's structures -
-    PACK_STRUCT_FIELD(x)
-    PACK_STRUCT_STRUCT
-    PACK_STRUCT_BEGIN
-    PACK_STRUCT_END
-
-  Platform specific diagnostic output -
-    LWIP_PLATFORM_DIAG(x)    - non-fatal, print a message.
-    LWIP_PLATFORM_ASSERT(x)  - fatal, print message and abandon execution.
-    Portability defines for printf formatters:
-    U16_F, S16_F, X16_F, U32_F, S32_F, X32_F, SZT_F
-
-  "lightweight" synchronization mechanisms -
-    SYS_ARCH_DECL_PROTECT(x) - declare a protection state variable.
-    SYS_ARCH_PROTECT(x)      - enter protection mode.
-    SYS_ARCH_UNPROTECT(x)    - leave protection mode.
-
-  If the compiler does not provide memset() this file must include a
-  definition of it, or include a file which defines it.
-
-  This file must either include a system-local <errno.h> which defines
-  the standard *nix error codes, or it should #define LWIP_PROVIDE_ERRNO
-  to make lwip/arch.h define the codes which are used throughout.
-
-
-perf.h     - Architecture specific performance measurement.
-  Measurement calls made throughout lwip, these can be defined to nothing.
-    PERF_START               - start measuring something.
-    PERF_STOP(x)             - stop measuring something, and record the result.
-
-sys_arch.h - Tied to sys_arch.c
-
-  Arch dependent types for the following objects:
-    sys_sem_t, sys_mbox_t, sys_thread_t,
-  And, optionally:
-    sys_prot_t
-
-  Defines to set vars of sys_mbox_t and sys_sem_t to NULL.
-    SYS_MBOX_NULL NULL
-    SYS_SEM_NULL NULL
--- a/package.json
+++ b/package.json
@@ -0,0 +1,5 @@
+{
+  "name": "library-lwip",
+  "version": "2.1.3-amb1",
+  "description": "lwIP - A Lightweight TCPIP stack"
+}
--- a/port/realtek/arch/bpstruct.h
+++ b/port/realtek/arch/bpstruct.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2001-2003 Swedish Institute of Computer Science.
+ * All rights reserved. 
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED 
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT 
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY 
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ * 
+ * Author: Adam Dunkels <adam@sics.se>
+ *
+ */
+
+#if defined(__IAR_SYSTEMS_ICC__)|| defined (__GNUC__)
+#pragma pack(1)
+#endif
+
--- a/port/realtek/arch/cc.h
+++ b/port/realtek/arch/cc.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 2001-2003 Swedish Institute of Computer Science.
+ * All rights reserved. 
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED 
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT 
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY 
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ * 
+ * Author: Adam Dunkels <adam@sics.se>
+ *
+ */
+#ifndef __CC_H__
+#define __CC_H__
+
+#include "cpu.h"
+
+typedef int sys_prot_t;
+
+#define U16_F "d"
+#define S16_F "d"
+#define X16_F "x"
+#define U32_F "d"
+#define S32_F "d"
+#define X32_F "x"
+#define SZT_F "uz" 
+
+/* define compiler specific symbols */
+#if defined (__ICCARM__) 
+#if !defined (__IARSTDLIB__)
+#define _STRING
+#ifndef memcmp
+#define memcmp(dst, src, sz)			_memcmp(dst, src, sz)
+#endif
+#ifndef memset
+#define memset(dst, val, sz)			_memset(dst, val, sz)
+#endif
+#ifndef memcpy
+#define memcpy(dst, src, sz)			_memcpy(dst, src, sz)
+#endif
+#endif // __IARSTDLIB__
+
+#define PACK_STRUCT_BEGIN
+#define PACK_STRUCT_STRUCT 
+#define PACK_STRUCT_END
+#define PACK_STRUCT_FIELD(x) x
+#define PACK_STRUCT_USE_INCLUDES
+
+#elif defined (__CC_ARM)
+
+#define PACK_STRUCT_BEGIN __packed
+#define PACK_STRUCT_STRUCT 
+#define PACK_STRUCT_END
+#define PACK_STRUCT_FIELD(x) x
+
+#elif defined (__GNUC__)
+
+#define PACK_STRUCT_BEGIN
+#define PACK_STRUCT_STRUCT __attribute__ ((__packed__))
+#define PACK_STRUCT_END
+#define PACK_STRUCT_FIELD(x) x
+#define PACK_STRUCT_USE_INCLUDES
+
+#elif defined (__TASKING__)
+
+#define PACK_STRUCT_BEGIN
+#define PACK_STRUCT_STRUCT
+#define PACK_STRUCT_END
+#define PACK_STRUCT_FIELD(x) x
+
+#endif
+
+#define LWIP_PLATFORM_ASSERT(x) //do { if(!(x)) while(1); } while(0)
+#define LWIP_PLATFORM_DIAG printf
+
+#endif /* __CC_H__ */
--- a/port/realtek/arch/cpu.h
+++ b/port/realtek/arch/cpu.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2001-2003 Swedish Institute of Computer Science.
+ * All rights reserved. 
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED 
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT 
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY 
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ * 
+ * Author: Adam Dunkels <adam@sics.se>
+ *
+ */
+#ifndef __CPU_H__
+#define __CPU_H__
+
+#define BYTE_ORDER LITTLE_ENDIAN
+
+#endif /* __CPU_H__ */
--- a/port/realtek/arch/epstruct.h
+++ b/port/realtek/arch/epstruct.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2001-2003 Swedish Institute of Computer Science.
+ * All rights reserved. 
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED 
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT 
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY 
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ * 
+ * Author: Adam Dunkels <adam@sics.se>
+ *
+ */
+
+#if defined(__IAR_SYSTEMS_ICC__)
+#pragma pack()
+#elif defined (__GNUC__)
+#pragma pack()
+#endif
+
--- a/port/realtek/arch/init.h
+++ b/port/realtek/arch/init.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2001-2003 Swedish Institute of Computer Science.
+ * All rights reserved. 
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED 
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT 
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY 
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ * 
+ * Author: Adam Dunkels <adam@sics.se>
+ *
+ */
+#ifndef __ARCH_INIT_H__
+#define __ARCH_INIT_H__
+
+#define TCPIP_INIT_DONE(arg)  tcpip_init_done(arg)
+
+void tcpip_init_done(void *);
+int wait_for_tcpip_init(void);
+
+#endif /* __ARCH_INIT_H__ */
+
+
+
+
--- a/port/realtek/arch/lib.h
+++ b/port/realtek/arch/lib.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2001-2003 Swedish Institute of Computer Science.
+ * All rights reserved. 
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED 
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT 
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY 
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ * 
+ * Author: Adam Dunkels <adam@sics.se>
+ *
+ */
+#ifndef __LIB_H__
+#define __LIB_H__
+
+#include <string.h>
+
+
+#endif /* __LIB_H__ */
--- a/port/realtek/arch/perf.h
+++ b/port/realtek/arch/perf.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2001-2003 Swedish Institute of Computer Science.
+ * All rights reserved. 
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED 
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT 
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY 
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ * 
+ * Author: Adam Dunkels <adam@sics.se>
+ *
+ */
+#ifndef __PERF_H__
+#define __PERF_H__
+
+#define PERF_START    /* null definition */
+#define PERF_STOP(x)  /* null definition */
+
+#endif /* __PERF_H__ */
--- a/port/realtek/arch/sys_arch.h
+++ b/port/realtek/arch/sys_arch.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (c) 2001-2003 Swedish Institute of Computer Science.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ *
+ * Author: Adam Dunkels <adam@sics.se>
+ *
+ */
+#ifndef __SYS_RTXC_H__
+#define __SYS_RTXC_H__
+
+#include "FreeRTOS.h"
+#include "task.h"
+#include "queue.h"
+#include "semphr.h"
+
+#define SYS_MBOX_NULL (xQueueHandle)0
+#define SYS_SEM_NULL  (xSemaphoreHandle)0
+#define SYS_DEFAULT_THREAD_STACK_DEPTH	configMINIMAL_STACK_SIZE
+
+typedef xSemaphoreHandle sys_sem_t;
+typedef xSemaphoreHandle sys_mutex_t;
+typedef xQueueHandle sys_mbox_t;
+typedef xTaskHandle sys_thread_t;
+
+typedef struct _sys_arch_state_t
+{
+	// Task creation data.
+	char cTaskName[configMAX_TASK_NAME_LEN];
+	unsigned short nStackDepth;
+	unsigned short nTaskCount;
+} sys_arch_state_t;
+
+
+
+//extern sys_arch_state_t s_sys_arch_state;
+
+//void sys_set_default_state();
+//void sys_set_state(signed char *pTaskName, unsigned short nStackSize);
+
+/* Message queue constants. */
+#define archMESG_QUEUE_LENGTH	( 6 )
+#endif /* __SYS_RTXC_H__ */
+
--- a/port/realtek/freertos/ethernetif.c
+++ b/port/realtek/freertos/ethernetif.c
@@ -0,0 +1,377 @@
+/**
+ * @file
+ * Ethernet Interface Skeleton
+ *
+ */
+
+/*
+ * Copyright (c) 2001-2004 Swedish Institute of Computer Science.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ *
+ * Author: Adam Dunkels <adam@sics.se>
+ *
+ */
+
+/*
+ * This file is a skeleton for developing Ethernet network interface
+ * drivers for lwIP. Add code to the low_level functions and do a
+ * search-and-replace for the word "ethernetif" to replace it with
+ * something that better describes your network interface.
+ */
+
+#include "lwip/opt.h"
+#include "lwip/def.h"
+#include "lwip/mem.h"
+#include "lwip/pbuf.h"
+#include "lwip/sys.h"
+#include "lwip/tcpip.h"
+#include "lwip/icmp.h"
+#include "lwip/lwip_timers.h"
+#include "netif/etharp.h"
+#include "err.h"
+#include "ethernetif.h"
+#include "queue.h"
+#include "lwip_netconf.h"
+
+//#include "lwip/ethip6.h" //Add for ipv6
+
+#include <platform/platform_stdlib.h>
+#include "platform_opts.h"
+
+#if CONFIG_WLAN
+#include <lwip_intf.h>
+#endif
+
+#if CONFIG_INIC_HOST
+#include "freertos/inic_intf.h"
+#endif
+
+#define netifMTU                                (1500)
+#define netifINTERFACE_TASK_STACK_SIZE		( 350 )
+#define netifINTERFACE_TASK_PRIORITY		( configMAX_PRIORITIES - 1 )
+#define netifGUARD_BLOCK_TIME			( 250 )
+/* The time to block waiting for input. */
+#define emacBLOCK_TIME_WAITING_FOR_INPUT	( ( portTickType ) 100 )
+
+
+#ifdef CONFIG_CONCURRENT_MODE
+#define IF2NAME0 'r'
+#define IF2NAME1 '2'
+#endif
+
+static void arp_timer(void *arg);
+
+
+/**
+ * In this function, the hardware should be initialized.
+ * Called from ethernetif_init().
+ *
+ * @param netif the already initialized lwip network interface structure
+ *        for this ethernetif
+ */
+
+static void low_level_init(struct netif *netif)
+{
+
+	/* set netif MAC hardware address length */
+	netif->hwaddr_len = ETHARP_HWADDR_LEN;
+
+	/* set netif maximum transfer unit */
+	netif->mtu = 1500;
+
+	/* Accept broadcast address and ARP traffic */
+	netif->flags = NETIF_FLAG_BROADCAST | NETIF_FLAG_ETHARP;	     
+
+#if LWIP_IGMP
+	/* make LwIP_Init do igmp_start to add group 224.0.0.1 */
+	netif->flags |= NETIF_FLAG_IGMP;
+#endif
+
+	/* Wlan interface is initialized later */
+}
+
+
+/**
+ * This function should do the actual transmission of the packet. The packet is
+ * contained in the pbuf that is passed to the function. This pbuf
+ * might be chained.
+ *
+ * @param netif the lwip network interface structure for this ethernetif
+ * @param p the MAC packet to send (e.g. IP packet including MAC addresses and type)
+ * @return ERR_OK if the packet could be sent
+ *         an err_t value if the packet couldn't be sent
+ *
+ * @note Returning ERR_MEM here if a DMA queue of your MAC is full can lead to
+ *       strange results. You might consider waiting for space in the DMA queue
+ *       to become availale since the stack doesn't retry to send a packet
+ *       dropped because of memory failure (except for the TCP timers).
+ */
+
+static err_t low_level_output(struct netif *netif, struct pbuf *p)
+{
+
+
+  /* Refer to eCos lwip eth_drv_send() */
+	struct eth_drv_sg sg_list[MAX_ETH_DRV_SG];
+	int sg_len = 0;
+	struct pbuf *q;
+#if CONFIG_WLAN
+	if(!rltk_wlan_running(netif_get_idx(netif)))
+		return ERR_IF;
+#endif
+	for (q = p; q != NULL && sg_len < MAX_ETH_DRV_SG; q = q->next) {
+		sg_list[sg_len].buf = (unsigned int) q->payload;
+		sg_list[sg_len++].len = q->len;
+	}
+
+	if (sg_len) {
+#if CONFIG_WLAN
+		if (rltk_wlan_send(netif_get_idx(netif), sg_list, sg_len, p->tot_len) == 0)
+#elif CONFIG_INIC_HOST
+		if(rltk_inic_send( sg_list, sg_len, p->tot_len) == 0)
+#else
+                if(1)
+#endif
+			return ERR_OK;
+		else
+			return ERR_BUF;	// return a non-fatal error
+	}
+	return ERR_OK;
+}
+
+/*for ethernet mii interface*/
+static err_t low_level_output_mii(struct netif *netif, struct pbuf *p)
+{
+	struct eth_drv_sg sg_list[MAX_ETH_DRV_SG];
+	int sg_len = 0;
+	struct pbuf *q;
+	for (q = p; q != NULL && sg_len < MAX_ETH_DRV_SG; q = q->next) {
+		sg_list[sg_len].buf = (unsigned int) q->payload;
+		sg_list[sg_len++].len = q->len;
+	}
+	if (sg_len) {
+		 if(rltk_mii_send(sg_list, sg_len, p->tot_len) == 0)
+			return ERR_OK;
+		else
+			return ERR_BUF;	// return a non-fatal error
+	}
+	return ERR_OK;
+}
+
+	
+/**
+ * Should allocate a pbuf and transfer the bytes of the incoming
+ * packet from the interface into the pbuf.
+ *
+ * @param netif the lwip network interface structure for this ethernetif
+ * @return a pbuf filled with the received packet (including MAC header)
+ *         NULL on memory error
+ */
+//static struct pbuf * low_level_input(struct netif *netif){}
+
+
+/**
+ * This function is the ethernetif_input task, it is processed when a packet 
+ * is ready to be read from the interface. It uses the function low_level_input() 
+ * that should handle the actual reception of bytes from the network
+ * interface. Then the type of the received packet is determined and
+ * the appropriate input function is called.
+ *
+ * @param netif the lwip network interface structure for this ethernetif
+ */
+//void ethernetif_input( void * pvParameters )
+
+
+/* Refer to eCos eth_drv_recv to do similarly in ethernetif_input */
+void ethernetif_recv(struct netif *netif, int total_len)
+{
+	struct eth_drv_sg sg_list[MAX_ETH_DRV_SG];
+	struct pbuf *p, *q;
+	int sg_len = 0;
+#if CONFIG_WLAN
+	if(!rltk_wlan_running(netif_get_idx(netif)))
+		return;
+#endif
+	if ((total_len > MAX_ETH_MSG) || (total_len < 0))
+		total_len = MAX_ETH_MSG;
+
+	// Allocate buffer to store received packet
+	p = pbuf_alloc(PBUF_RAW, total_len, PBUF_POOL);
+	if (p == NULL) {
+		printf("\n\rCannot allocate pbuf to receive packet");
+		return;
+	}
+
+	// Create scatter list
+	for (q = p; q != NULL && sg_len < MAX_ETH_DRV_SG; q = q->next) {
+   		sg_list[sg_len].buf = (unsigned int) q->payload;
+		sg_list[sg_len++].len = q->len;
+	}
+
+	// Copy received packet to scatter list from wrapper rx skb
+  	//printf("\n\rwlan:%c: Recv sg_len: %d, tot_len:%d", netif->name[1],sg_len, total_len);
+#if CONFIG_WLAN
+	rltk_wlan_recv(netif_get_idx(netif), sg_list, sg_len);
+#elif CONFIG_INIC_HOST
+	rltk_inic_recv(sg_list, sg_len);
+#endif
+	// Pass received packet to the interface
+	if (ERR_OK != netif->input(p, netif))
+		pbuf_free(p);
+
+}
+
+void ethernetif_mii_recv(struct netif *netif, int total_len)
+{
+	struct eth_drv_sg sg_list[MAX_ETH_DRV_SG];
+	struct pbuf *p, *q;
+	int sg_len = 0;
+
+	if ((total_len > MAX_ETH_MSG) || (total_len < 0))
+		total_len = MAX_ETH_MSG;
+
+	// Allocate buffer to store received packet
+	p = pbuf_alloc(PBUF_RAW, total_len, PBUF_POOL);
+	if (p == NULL) {
+		printf("\n\rCannot allocate pbuf to receive packet");
+		return;
+	}
+
+	// Create scatter list
+	for (q = p; q != NULL && sg_len < MAX_ETH_DRV_SG; q = q->next) {
+   		sg_list[sg_len].buf = (unsigned int) q->payload;
+		sg_list[sg_len++].len = q->len;
+	}
+	rltk_mii_recv(sg_list, sg_len);
+
+	// Pass received packet to the interface
+	if (ERR_OK != netif->input(p, netif))
+		pbuf_free(p);
+
+}
+/**
+ * Should be called at the beginning of the program to set up the
+ * network interface. It calls the function low_level_init() to do the
+ * actual setup of the hardware.
+ *
+ * This function should be passed as a parameter to netif_add().
+ *
+ * @param netif the lwip network interface structure for this ethernetif
+ * @return ERR_OK if the loopif is initialized
+ *         ERR_MEM if private data couldn't be allocated
+ *         any other err_t on error
+ */
+err_t ethernetif_init(struct netif *netif)
+{
+	LWIP_ASSERT("netif != NULL", (netif != NULL));
+
+#if LWIP_NETIF_HOSTNAME
+	/* Initialize interface hostname */
+	if(netif->name[1] == '0')
+		netif->hostname = "lwip0";
+	else if(netif->name[1] == '1')
+		netif->hostname = "lwip1";
+#endif /* LWIP_NETIF_HOSTNAME */
+
+	netif->output = etharp_output;
+//#if LWIP_IPV6
+//	netif->output_ip6 = ethip6_output;
+//#endif
+	netif->linkoutput = low_level_output;
+
+	/* initialize the hardware */
+	low_level_init(netif);
+
+	etharp_init();
+
+	return ERR_OK;
+}
+
+err_t ethernetif_mii_init(struct netif *netif)
+{
+	LWIP_ASSERT("netif != NULL", (netif != NULL));
+
+#if LWIP_NETIF_HOSTNAME
+		netif->hostname = "lwip2";		
+#endif /* LWIP_NETIF_HOSTNAME */
+
+	netif->output = etharp_output;
+//#if LWIP_IPV6
+//	netif->output_ip6 = ethip6_output;
+//#endif
+	netif->linkoutput = low_level_output_mii;
+
+	/* initialize the hardware */
+	low_level_init(netif);
+
+	etharp_init();
+
+	return ERR_OK;
+}
+
+static void arp_timer(void *arg)
+{
+  etharp_tmr();
+  sys_timeout(ARP_TMR_INTERVAL, arp_timer, NULL);
+}
+
+/*
+ * For FreeRTOS tickless
+ */
+int lwip_tickless_used = 0;
+
+int arp_timeout_exist(void)
+{
+	struct sys_timeouts *timeouts;
+	struct sys_timeo *t;
+
+	timeouts = sys_arch_timeouts();
+
+	for(t = timeouts->next; t != NULL;t = t->next)
+		if(t->h == arp_timer)
+			return 1;
+
+	return 0;
+}
+
+//Called by rltk_wlan_PRE_SLEEP_PROCESSING()
+void lwip_PRE_SLEEP_PROCESSING(void)
+{
+	if(arp_timeout_exist()) {
+		tcpip_untimeout(arp_timer, NULL);
+	}
+	lwip_tickless_used = 1;
+}
+
+//Called in ips_leave() path, support tickless when wifi power wakeup due to ioctl or deinit
+void lwip_POST_SLEEP_PROCESSING(void)
+{
+	if(lwip_tickless_used) {
+		tcpip_timeout(ARP_TMR_INTERVAL, arp_timer, NULL);
+	}
+}
+
--- a/port/realtek/freertos/ethernetif.h
+++ b/port/realtek/freertos/ethernetif.h
@@ -0,0 +1,25 @@
+#ifndef __ETHERNETIF_H__
+#define __ETHERNETIF_H__
+
+
+#include "lwip/err.h"
+#include "lwip/netif.h"
+
+//----- ------------------------------------------------------------------
+// Ethernet Buffer
+//----- ------------------------------------------------------------------
+struct eth_drv_sg {
+    unsigned int	buf;
+    unsigned int 	len;
+};
+
+#define MAX_ETH_DRV_SG	32
+#define MAX_ETH_MSG	1540
+
+void ethernetif_recv(struct netif *netif, int total_len);
+err_t ethernetif_init(struct netif *netif);
+err_t ethernetif_mii_init(struct netif *netif);
+void lwip_PRE_SLEEP_PROCESSING(void);
+void lwip_POST_SLEEP_PROCESSING(void);
+
+#endif 
--- a/port/realtek/freertos/sys_arch.c
+++ b/port/realtek/freertos/sys_arch.c
@@ -0,0 +1,633 @@
+/*
+ * Copyright (c) 2001-2003 Swedish Institute of Computer Science.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ *
+ * Author: Adam Dunkels <adam@sics.se>
+ *
+ */
+
+/* lwIP includes. */
+#include "lwip/debug.h"
+#include "lwip/def.h"
+#include "lwip/sys.h"
+#include "lwip/mem.h"
+#include "lwip/stats.h"
+#include "FreeRTOS.h"
+#include "task.h"
+#include "queue.h"
+#include "lwip/lwip_timers.h"
+#include "autoconf.h"
+#include "tcm_heap.h"
+
+xTaskHandle xTaskGetCurrentTaskHandle( void ) PRIVILEGED_FUNCTION;
+extern void * vTaskGetCurrentTCB( void );
+struct timeoutlist
+{
+	struct sys_timeouts timeouts;
+	xTaskHandle pid;
+};
+
+/* This is the number of threads that can be started with sys_thread_new() */
+#define SYS_THREAD_MAX 6
+
+static struct timeoutlist s_timeoutlist[SYS_THREAD_MAX];
+static u16_t s_nextthread = 0;
+
+
+/*-----------------------------------------------------------------------------------*/
+//  Creates an empty mailbox.
+err_t sys_mbox_new(sys_mbox_t *mbox, int size)
+{
+	(void ) size;
+	
+	*mbox = xQueueCreate( size, sizeof( void * ) );
+
+#if SYS_STATS
+      ++lwip_stats.sys.mbox.used;
+      if (lwip_stats.sys.mbox.max < lwip_stats.sys.mbox.used) {
+         lwip_stats.sys.mbox.max = lwip_stats.sys.mbox.used;
+	  }
+#endif /* SYS_STATS */
+ if (*mbox == NULL)
+  return ERR_MEM;
+ 
+ return ERR_OK;
+}
+
+/*-----------------------------------------------------------------------------------*/
+/*
+  Deallocates a mailbox. If there are messages still present in the
+  mailbox when the mailbox is deallocated, it is an indication of a
+  programming error in lwIP and the developer should be notified.
+*/
+void sys_mbox_free(sys_mbox_t *mbox)
+{
+	if( uxQueueMessagesWaiting( *mbox ) )
+	{
+		/* Line for breakpoint.  Should never break here! */
+		portNOP();
+#if SYS_STATS
+	    lwip_stats.sys.mbox.err++;
+#endif /* SYS_STATS */
+			
+		// TODO notify the user of failure.
+	}
+
+	vQueueDelete( *mbox );
+
+#if SYS_STATS
+     --lwip_stats.sys.mbox.used;
+#endif /* SYS_STATS */
+}
+
+/*-----------------------------------------------------------------------------------*/
+//   Posts the "msg" to the mailbox.
+void sys_mbox_post(sys_mbox_t *mbox, void *data)
+{
+	while ( xQueueSendToBack(*mbox, &data, portMAX_DELAY ) != pdTRUE ){}
+}
+
+
+/*-----------------------------------------------------------------------------------*/
+//   Try to post the "msg" to the mailbox.
+err_t sys_mbox_trypost(sys_mbox_t *mbox, void *msg)
+{
+err_t result;
+
+   if ( xQueueSend( *mbox, &msg, 0 ) == pdPASS )
+   {
+      result = ERR_OK;
+   }
+   else {
+      // could not post, queue must be full
+      result = ERR_MEM;
+			
+#if SYS_STATS
+      lwip_stats.sys.mbox.err++;
+#endif /* SYS_STATS */
+			
+   }
+
+   return result;
+}
+
+/*-----------------------------------------------------------------------------------*/
+/*
+  Blocks the thread until a message arrives in the mailbox, but does
+  not block the thread longer than "timeout" milliseconds (similar to
+  the sys_arch_sem_wait() function). The "msg" argument is a result
+  parameter that is set by the function (i.e., by doing "*msg =
+  ptr"). The "msg" parameter maybe NULL to indicate that the message
+  should be dropped.
+
+  The return values are the same as for the sys_arch_sem_wait() function:
+  Number of milliseconds spent waiting or SYS_ARCH_TIMEOUT if there was a
+  timeout.
+
+  Note that a function with a similar name, sys_mbox_fetch(), is
+  implemented by lwIP.
+*/
+u32_t sys_arch_mbox_fetch(sys_mbox_t *mbox, void **msg, u32_t timeout)
+{
+void *dummyptr;
+portTickType StartTime, EndTime, Elapsed;
+
+	StartTime = xTaskGetTickCount();
+
+	if ( msg == NULL )
+	{
+		msg = &dummyptr;
+	}
+		
+	if ( timeout != 0 )
+	{
+		if ( pdTRUE == xQueueReceive( *mbox, &(*msg), timeout / portTICK_RATE_MS ) )
+		{
+			EndTime = xTaskGetTickCount();
+			Elapsed = (EndTime - StartTime) * portTICK_RATE_MS;
+			
+			return ( Elapsed );
+		}
+		else // timed out blocking for message
+		{
+			*msg = NULL;
+			
+			return SYS_ARCH_TIMEOUT;
+		}
+	}
+	else // block forever for a message.
+	{
+		while( pdTRUE != xQueueReceive( *mbox, &(*msg), portMAX_DELAY ) ){} // time is arbitrary
+		EndTime = xTaskGetTickCount();
+		Elapsed = (EndTime - StartTime) * portTICK_RATE_MS;
+		
+		return ( Elapsed ); // return time blocked TODO test	
+	}
+}
+
+/*-----------------------------------------------------------------------------------*/
+/*
+  Similar to sys_arch_mbox_fetch, but if message is not ready immediately, we'll
+  return with SYS_MBOX_EMPTY.  On success, 0 is returned.
+*/
+u32_t sys_arch_mbox_tryfetch(sys_mbox_t *mbox, void **msg)
+{
+void *dummyptr;
+
+	if ( msg == NULL )
+	{
+		msg = &dummyptr;
+	}
+
+   if ( pdTRUE == xQueueReceive( *mbox, &(*msg), 0 ) )
+   {
+      return ERR_OK;
+   }
+   else
+   {
+      return SYS_MBOX_EMPTY;
+   }
+}
+/*----------------------------------------------------------------------------------*/
+int sys_mbox_valid(sys_mbox_t *mbox)          
+{      
+  if (*mbox == SYS_MBOX_NULL) 
+    return 0;
+  else
+    return 1;
+}                                             
+/*-----------------------------------------------------------------------------------*/                                              
+void sys_mbox_set_invalid(sys_mbox_t *mbox)   
+{                                             
+  *mbox = SYS_MBOX_NULL;                      
+}                                             
+
+/*-----------------------------------------------------------------------------------*/
+//  Creates a new semaphore. The "count" argument specifies
+//  the initial state of the semaphore.
+err_t sys_sem_new(sys_sem_t *sem, u8_t count)
+{
+	vSemaphoreCreateBinary(*sem );
+	if(*sem == NULL)
+	{
+		
+#if SYS_STATS
+      ++lwip_stats.sys.sem.err;
+#endif /* SYS_STATS */	
+		return ERR_MEM;
+	}
+	
+	if(count == 0)	// Means it can't be taken
+	{
+		xSemaphoreTake(*sem,1);
+	}
+
+#if SYS_STATS
+	++lwip_stats.sys.sem.used;
+ 	if (lwip_stats.sys.sem.max < lwip_stats.sys.sem.used) {
+		lwip_stats.sys.sem.max = lwip_stats.sys.sem.used;
+	}
+#endif /* SYS_STATS */
+		
+	return ERR_OK;
+}
+
+/*-----------------------------------------------------------------------------------*/
+/*
+  Blocks the thread while waiting for the semaphore to be
+  signaled. If the "timeout" argument is non-zero, the thread should
+  only be blocked for the specified time (measured in
+  milliseconds).
+
+  If the timeout argument is non-zero, the return value is the number of
+  milliseconds spent waiting for the semaphore to be signaled. If the
+  semaphore wasn't signaled within the specified time, the return value is
+  SYS_ARCH_TIMEOUT. If the thread didn't have to wait for the semaphore
+  (i.e., it was already signaled), the function may return zero.
+
+  Notice that lwIP implements a function with a similar name,
+  sys_sem_wait(), that uses the sys_arch_sem_wait() function.
+*/
+u32_t sys_arch_sem_wait(sys_sem_t *sem, u32_t timeout)
+{
+portTickType StartTime, EndTime, Elapsed;
+
+	StartTime = xTaskGetTickCount();
+
+	if(	timeout != 0)
+	{
+		if( xSemaphoreTake( *sem, timeout / portTICK_RATE_MS ) == pdTRUE )
+		{
+			EndTime = xTaskGetTickCount();
+			Elapsed = (EndTime - StartTime) * portTICK_RATE_MS;
+			
+			return (Elapsed); // return time blocked TODO test	
+		}
+		else
+		{
+			return SYS_ARCH_TIMEOUT;
+		}
+	}
+	else // must block without a timeout
+	{
+		while( xSemaphoreTake(*sem, portMAX_DELAY) != pdTRUE){}
+		EndTime = xTaskGetTickCount();
+		Elapsed = (EndTime - StartTime) * portTICK_RATE_MS;
+
+		return ( Elapsed ); // return time blocked	
+		
+	}
+}
+
+/*-----------------------------------------------------------------------------------*/
+// Signals a semaphore
+void sys_sem_signal(sys_sem_t *sem)
+{
+	xSemaphoreGive(*sem);
+}
+
+/*-----------------------------------------------------------------------------------*/
+// Deallocates a semaphore
+void sys_sem_free(sys_sem_t *sem)
+{
+#if SYS_STATS
+      --lwip_stats.sys.sem.used;
+#endif /* SYS_STATS */
+			
+	vQueueDelete(*sem);
+}
+/*-----------------------------------------------------------------------------------*/
+int sys_sem_valid(sys_sem_t *sem)                                               
+{
+  if (*sem == SYS_SEM_NULL)
+    return 0;
+  else
+    return 1;                                       
+}
+
+/*-----------------------------------------------------------------------------------*/                                                                                                                                                                
+void sys_sem_set_invalid(sys_sem_t *sem)                                        
+{                                                                               
+  *sem = SYS_SEM_NULL;                                                          
+} 
+
+/*-----------------------------------------------------------------------------------*/
+// Initialize sys arch
+void sys_init(void)
+{
+	int i;
+
+	// Initialize the the per-thread sys_timeouts structures
+	// make sure there are no valid pids in the list
+	for(i = 0; i < SYS_THREAD_MAX; i++)
+	{
+		s_timeoutlist[i].pid = 0;
+		s_timeoutlist[i].timeouts.next = NULL;
+	}
+
+	// keep track of how many threads have been created
+	s_nextthread = 0;
+}
+
+/*-----------------------------------------------------------------------------------*/
+/*
+  Returns a pointer to the per-thread sys_timeouts structure. In lwIP,
+  each thread has a list of timeouts which is represented as a linked
+  list of sys_timeout structures. The sys_timeouts structure holds a
+  pointer to a linked list of timeouts. This function is called by
+  the lwIP timeout scheduler and must not return a NULL value.
+
+  In a single threaded sys_arch implementation, this function will
+  simply return a pointer to a global sys_timeouts variable stored in
+  the sys_arch module.
+*/
+struct sys_timeouts *sys_arch_timeouts(void)
+{
+int i;
+xTaskHandle pid;
+struct timeoutlist *tl;
+
+	pid =  xTaskGetCurrentTaskHandle();
+              
+	for(i = 0; i < s_nextthread; i++)
+	{
+		tl = &(s_timeoutlist[i]);
+		if(tl->pid == pid)
+		{
+			return &(tl->timeouts);
+		}
+	}
+	// Error
+	return NULL;
+}
+/*-----------------------------------------------------------------------------------*/
+                                      /* Mutexes*/
+/*-----------------------------------------------------------------------------------*/
+/*-----------------------------------------------------------------------------------*/
+#if LWIP_COMPAT_MUTEX == 0
+/* Create a new mutex*/
+err_t sys_mutex_new(sys_mutex_t *mutex) {
+
+  *mutex = xSemaphoreCreateMutex();
+		if(*mutex == NULL)
+	{
+#if SYS_STATS
+      ++lwip_stats.sys.mutex.err;
+#endif /* SYS_STATS */	
+		return ERR_MEM;
+	}
+
+#if SYS_STATS
+	++lwip_stats.sys.mutex.used;
+ 	if (lwip_stats.sys.mutex.max < lwip_stats.sys.mutex.used) {
+		lwip_stats.sys.mutex.max = lwip_stats.sys.mutex.used;
+	}
+#endif /* SYS_STATS */
+        return ERR_OK;
+}
+/*-----------------------------------------------------------------------------------*/
+/* Deallocate a mutex*/
+void sys_mutex_free(sys_mutex_t *mutex)
+{
+#if SYS_STATS
+      --lwip_stats.sys.mutex.used;
+#endif /* SYS_STATS */
+			
+	vQueueDelete(*mutex);
+}
+/*-----------------------------------------------------------------------------------*/
+/* Lock a mutex*/
+void sys_mutex_lock(sys_mutex_t *mutex)
+{
+	sys_arch_sem_wait(*mutex, 0);
+}
+
+/*-----------------------------------------------------------------------------------*/
+/* Unlock a mutex*/
+void sys_mutex_unlock(sys_mutex_t *mutex)
+{
+	xSemaphoreGive(*mutex);
+}
+#endif /*LWIP_COMPAT_MUTEX*/
+
+/*-----------------------------------------------------------------------------------*/
+// TODO
+/*-----------------------------------------------------------------------------------*/
+/*
+  Starts a new thread with priority "prio" that will begin its execution in the
+  function "thread()". The "arg" argument will be passed as an argument to the
+  thread() function. The id of the new thread is returned. Both the id and
+  the priority are system dependent.
+*/
+sys_thread_t sys_thread_new_tcm(const char *name, lwip_thread_fn thread , void *arg, int stacksize, int prio)
+{
+xTaskHandle CreatedTask;
+int result;
+
+   if ( s_nextthread < SYS_THREAD_MAX )
+   {
+	   vPortEnterCritical();
+#if CONFIG_USE_TCM_HEAP
+	   {
+		   void *stack_addr = tcm_heap_malloc(stacksize * sizeof(int));
+
+		   if(stack_addr == NULL){
+		   }
+
+		   result = xTaskGenericCreate(
+				   thread,
+				   ( signed portCHAR * ) name,
+				   stacksize,
+				   arg,
+				   prio,
+				   &CreatedTask,
+				   stack_addr,
+				   NULL);
+	   }
+#else		
+	   result = xTaskCreate( thread, ( signed portCHAR * ) name, stacksize, arg, prio, &CreatedTask );
+#endif
+
+	   // For each task created, store the task handle (pid) in the timers array.
+	   // This scheme doesn't allow for threads to be deleted
+	   s_timeoutlist[s_nextthread++].pid = CreatedTask;
+       vPortExitCritical();
+	   
+	   if(result == pdPASS)
+	   {
+		   return CreatedTask;
+	   }
+	   else
+	   {
+		   return NULL;
+	   }
+   }
+   else
+   {
+      return NULL;
+   }
+}
+/*-----------------------------------------------------------------------------------*/
+// TODO
+/*-----------------------------------------------------------------------------------*/
+/*
+  Starts a new thread with priority "prio" that will begin its execution in the
+  function "thread()". The "arg" argument will be passed as an argument to the
+  thread() function. The id of the new thread is returned. Both the id and
+  the priority are system dependent.
+*/
+sys_thread_t sys_thread_new(const char *name, lwip_thread_fn thread , void *arg, int stacksize, int prio)
+{
+xTaskHandle CreatedTask;
+int result;
+
+   if ( s_nextthread < SYS_THREAD_MAX )
+   {
+	   vPortEnterCritical();
+       result = xTaskCreate( thread, ( signed portCHAR * ) name, stacksize, arg, prio, &CreatedTask );
+
+	   // For each task created, store the task handle (pid) in the timers array.
+	   // This scheme doesn't allow for threads to be deleted
+	   s_timeoutlist[s_nextthread++].pid = CreatedTask;
+       vPortExitCritical();
+	   
+	   if(result == pdPASS)
+	   {
+		   return CreatedTask;
+	   }
+	   else
+	   {
+		   return NULL;
+	   }
+   }
+   else
+   {
+      return NULL;
+   }
+}
+
+int sys_thread_delete(xTaskHandle pid)
+{
+	int i, isFind = 0;
+	struct timeoutlist *tl, *tend = NULL;
+
+	pid = (( pid == NULL)?(xTaskHandle) vTaskGetCurrentTCB() : pid);
+
+	if (s_nextthread)
+	{
+		vPortEnterCritical();
+
+		tend = &(s_timeoutlist[s_nextthread-1]);//the last one
+		for(i = 0; i < s_nextthread; i++)
+		{
+			tl = &(s_timeoutlist[i]);
+			if(tl->pid == pid)
+			{//find the task, exchange with the last one
+				memcpy(tl, tend, sizeof(struct timeoutlist));
+				memset(tend, 0, sizeof(struct timeoutlist));
+				s_nextthread --;
+				isFind = 1;
+				break;
+			}
+		}
+
+		if (isFind) {
+			vTaskDelete( pid);
+		}
+
+		vPortExitCritical();
+	   
+		if (isFind)
+		{
+			return pdPASS;
+		}
+		else
+		{
+			return pdFAIL;
+		}
+	}
+	else
+	{
+		return pdFAIL;
+	}
+}
+
+/*
+  This optional function does a "fast" critical region protection and returns
+  the previous protection level. This function is only called during very short
+  critical regions. An embedded system which supports ISR-based drivers might
+  want to implement this function by disabling interrupts. Task-based systems
+  might want to implement this by using a mutex or disabling tasking. This
+  function should support recursive calls from the same task or interrupt. In
+  other words, sys_arch_protect() could be called while already protected. In
+  that case the return value indicates that it is already protected.
+
+  sys_arch_protect() is only required if your port is supporting an operating
+  system.
+*/
+sys_prot_t sys_arch_protect(void)
+{
+	vPortEnterCritical();
+	return 1;
+}
+
+/*
+  This optional function does a "fast" set of critical region protection to the
+  value specified by pval. See the documentation for sys_arch_protect() for
+  more information. This function is only required if your port is supporting
+  an operating system.
+*/
+void sys_arch_unprotect(sys_prot_t pval)
+{
+	( void ) pval;
+	vPortExitCritical();
+}
+
+/*
+ * Prints an assertion messages and aborts execution.
+ */
+void sys_assert( const char *msg )
+{	
+	( void ) msg;
+	/*FSL:only needed for debugging
+	printf(msg);
+	printf("\n\r");
+	*/
+    vPortEnterCritical(  );
+    for(;;)
+    ;
+}
+
+u32_t sys_now(void)
+{
+	return xTaskGetTickCount();
+}
+
+u32_t sys_jiffies(void)
+{
+	return xTaskGetTickCount();
+}
--- a/port/realtek/freertos/sys_arch.h
+++ b/port/realtek/freertos/sys_arch.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2001-2003 Swedish Institute of Computer Science.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ *
+ * Author: Adam Dunkels <adam@sics.se>
+ *
+ */
+#ifndef __SYS_RTXC_H__
+#define __SYS_RTXC_H__
+
+#include "FreeRTOS.h"
+#include "task.h"
+#include "queue.h"
+#include "semphr.h"
+
+#define SYS_MBOX_NULL (xQueueHandle)0
+#define SYS_SEM_NULL  (xSemaphoreHandle)0
+#define SYS_DEFAULT_THREAD_STACK_DEPTH	configMINIMAL_STACK_SIZE
+
+typedef xSemaphoreHandle sys_sem_t;
+typedef xQueueHandle sys_mbox_t;
+typedef xTaskHandle sys_thread_t;
+
+typedef struct _sys_arch_state_t
+{
+	// Task creation data.
+	char cTaskName[configMAX_TASK_NAME_LEN];
+	unsigned short nStackDepth;
+	unsigned short nTaskCount;
+} sys_arch_state_t;
+
+
+
+//extern sys_arch_state_t s_sys_arch_state;
+
+//void sys_set_default_state();
+//void sys_set_state(signed char *pTaskName, unsigned short nStackSize);
+
+/* Message queue constants. */
+#define archMESG_QUEUE_LENGTH	( 6 )
+#endif /* __SYS_RTXC_H__ */
+
--- a/src/Filelists.cmake
+++ b/src/Filelists.cmake
@@ -0,0 +1,279 @@
+# This file is indended to be included in end-user CMakeLists.txt
+# include(/path/to/Filelists.cmake)
+# It assumes the variable LWIP_DIR is defined pointing to the
+# root path of lwIP sources.
+#
+# This file is NOT designed (on purpose) to be used as cmake
+# subdir via add_subdirectory()
+# The intention is to provide greater flexibility to users to 
+# create their own targets using the *_SRCS variables.
+
+set(LWIP_VERSION_MAJOR    "2")
+set(LWIP_VERSION_MINOR    "1")
+set(LWIP_VERSION_REVISION "3")
+# LWIP_VERSION_RC is set to LWIP_RC_RELEASE for official releases
+# LWIP_VERSION_RC is set to LWIP_RC_DEVELOPMENT for Git versions
+# Numbers 1..31 are reserved for release candidates
+set(LWIP_VERSION_RC       "LWIP_RC_RELEASE")
+
+if ("${LWIP_VERSION_RC}" STREQUAL "LWIP_RC_RELEASE")
+    set(LWIP_VERSION_STRING
+        "${LWIP_VERSION_MAJOR}.${LWIP_VERSION_MINOR}.${LWIP_VERSION_REVISION}"
+    )
+elseif ("${LWIP_VERSION_RC}" STREQUAL "LWIP_RC_DEVELOPMENT")
+    set(LWIP_VERSION_STRING
+        "${LWIP_VERSION_MAJOR}.${LWIP_VERSION_MINOR}.${LWIP_VERSION_REVISION}.dev"
+    )
+else ("${LWIP_VERSION_RC}" STREQUAL "LWIP_RC_RELEASE")
+    set(LWIP_VERSION_STRING
+        "${LWIP_VERSION_MAJOR}.${LWIP_VERSION_MINOR}.${LWIP_VERSION_REVISION}.rc${LWIP_VERSION_RC}"
+    )
+endif ("${LWIP_VERSION_RC}" STREQUAL "LWIP_RC_RELEASE")
+
+# The minimum set of files needed for lwIP.
+set(lwipcore_SRCS
+    ${LWIP_DIR}/src/core/init.c
+    ${LWIP_DIR}/src/core/def.c
+    ${LWIP_DIR}/src/core/dns.c
+    ${LWIP_DIR}/src/core/inet_chksum.c
+    ${LWIP_DIR}/src/core/ip.c
+    ${LWIP_DIR}/src/core/mem.c
+    ${LWIP_DIR}/src/core/memp.c
+    ${LWIP_DIR}/src/core/netif.c
+    ${LWIP_DIR}/src/core/pbuf.c
+    ${LWIP_DIR}/src/core/raw.c
+    ${LWIP_DIR}/src/core/stats.c
+    ${LWIP_DIR}/src/core/sys.c
+    ${LWIP_DIR}/src/core/altcp.c
+    ${LWIP_DIR}/src/core/altcp_alloc.c
+    ${LWIP_DIR}/src/core/altcp_tcp.c
+    ${LWIP_DIR}/src/core/tcp.c
+    ${LWIP_DIR}/src/core/tcp_in.c
+    ${LWIP_DIR}/src/core/tcp_out.c
+    ${LWIP_DIR}/src/core/timeouts.c
+    ${LWIP_DIR}/src/core/udp.c
+)
+set(lwipcore4_SRCS
+    ${LWIP_DIR}/src/core/ipv4/autoip.c
+    ${LWIP_DIR}/src/core/ipv4/dhcp.c
+    ${LWIP_DIR}/src/core/ipv4/etharp.c
+    ${LWIP_DIR}/src/core/ipv4/icmp.c
+    ${LWIP_DIR}/src/core/ipv4/igmp.c
+    ${LWIP_DIR}/src/core/ipv4/ip4_frag.c
+    ${LWIP_DIR}/src/core/ipv4/ip4.c
+    ${LWIP_DIR}/src/core/ipv4/ip4_addr.c
+)
+set(lwipcore6_SRCS
+    ${LWIP_DIR}/src/core/ipv6/dhcp6.c
+    ${LWIP_DIR}/src/core/ipv6/ethip6.c
+    ${LWIP_DIR}/src/core/ipv6/icmp6.c
+    ${LWIP_DIR}/src/core/ipv6/inet6.c
+    ${LWIP_DIR}/src/core/ipv6/ip6.c
+    ${LWIP_DIR}/src/core/ipv6/ip6_addr.c
+    ${LWIP_DIR}/src/core/ipv6/ip6_frag.c
+    ${LWIP_DIR}/src/core/ipv6/mld6.c
+    ${LWIP_DIR}/src/core/ipv6/nd6.c
+)
+
+# APIFILES: The files which implement the sequential and socket APIs.
+set(lwipapi_SRCS
+    ${LWIP_DIR}/src/api/api_lib.c
+    ${LWIP_DIR}/src/api/api_msg.c
+    ${LWIP_DIR}/src/api/err.c
+    ${LWIP_DIR}/src/api/if_api.c
+    ${LWIP_DIR}/src/api/netbuf.c
+    ${LWIP_DIR}/src/api/netdb.c
+    ${LWIP_DIR}/src/api/netifapi.c
+    ${LWIP_DIR}/src/api/sockets.c
+    ${LWIP_DIR}/src/api/tcpip.c
+)
+
+# Files implementing various generic network interface functions
+set(lwipnetif_SRCS
+    ${LWIP_DIR}/src/netif/ethernet.c
+    ${LWIP_DIR}/src/netif/bridgeif.c
+    ${LWIP_DIR}/src/netif/bridgeif_fdb.c
+    ${LWIP_DIR}/src/netif/slipif.c
+)
+
+# 6LoWPAN
+set(lwipsixlowpan_SRCS
+    ${LWIP_DIR}/src/netif/lowpan6_common.c
+    ${LWIP_DIR}/src/netif/lowpan6.c
+    ${LWIP_DIR}/src/netif/lowpan6_ble.c
+    ${LWIP_DIR}/src/netif/zepif.c
+)
+
+# PPP
+set(lwipppp_SRCS
+    ${LWIP_DIR}/src/netif/ppp/auth.c
+    ${LWIP_DIR}/src/netif/ppp/ccp.c
+    ${LWIP_DIR}/src/netif/ppp/chap-md5.c
+    ${LWIP_DIR}/src/netif/ppp/chap_ms.c
+    ${LWIP_DIR}/src/netif/ppp/chap-new.c
+    ${LWIP_DIR}/src/netif/ppp/demand.c
+    ${LWIP_DIR}/src/netif/ppp/eap.c
+    ${LWIP_DIR}/src/netif/ppp/ecp.c
+    ${LWIP_DIR}/src/netif/ppp/eui64.c
+    ${LWIP_DIR}/src/netif/ppp/fsm.c
+    ${LWIP_DIR}/src/netif/ppp/ipcp.c
+    ${LWIP_DIR}/src/netif/ppp/ipv6cp.c
+    ${LWIP_DIR}/src/netif/ppp/lcp.c
+    ${LWIP_DIR}/src/netif/ppp/magic.c
+    ${LWIP_DIR}/src/netif/ppp/mppe.c
+    ${LWIP_DIR}/src/netif/ppp/multilink.c
+    ${LWIP_DIR}/src/netif/ppp/ppp.c
+    ${LWIP_DIR}/src/netif/ppp/pppapi.c
+    ${LWIP_DIR}/src/netif/ppp/pppcrypt.c
+    ${LWIP_DIR}/src/netif/ppp/pppoe.c
+    ${LWIP_DIR}/src/netif/ppp/pppol2tp.c
+    ${LWIP_DIR}/src/netif/ppp/pppos.c
+    ${LWIP_DIR}/src/netif/ppp/upap.c
+    ${LWIP_DIR}/src/netif/ppp/utils.c
+    ${LWIP_DIR}/src/netif/ppp/vj.c
+    ${LWIP_DIR}/src/netif/ppp/polarssl/arc4.c
+    ${LWIP_DIR}/src/netif/ppp/polarssl/des.c
+    ${LWIP_DIR}/src/netif/ppp/polarssl/md4.c
+    ${LWIP_DIR}/src/netif/ppp/polarssl/md5.c
+    ${LWIP_DIR}/src/netif/ppp/polarssl/sha1.c
+)
+
+# SNMPv3 agent
+set(lwipsnmp_SRCS
+    ${LWIP_DIR}/src/apps/snmp/snmp_asn1.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_core.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_mib2.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_mib2_icmp.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_mib2_interfaces.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_mib2_ip.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_mib2_snmp.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_mib2_system.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_mib2_tcp.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_mib2_udp.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_snmpv2_framework.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_snmpv2_usm.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_msg.c
+    ${LWIP_DIR}/src/apps/snmp/snmpv3.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_netconn.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_pbuf_stream.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_raw.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_scalar.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_table.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_threadsync.c
+    ${LWIP_DIR}/src/apps/snmp/snmp_traps.c
+)
+
+# HTTP server + client
+set(lwiphttp_SRCS
+    ${LWIP_DIR}/src/apps/http/altcp_proxyconnect.c
+    ${LWIP_DIR}/src/apps/http/fs.c
+    ${LWIP_DIR}/src/apps/http/http_client.c
+    ${LWIP_DIR}/src/apps/http/httpd.c
+)
+
+# MAKEFSDATA HTTP server host utility
+set(lwipmakefsdata_SRCS
+    ${LWIP_DIR}/src/apps/http/makefsdata/makefsdata.c
+)
+
+# IPERF server
+set(lwipiperf_SRCS
+    ${LWIP_DIR}/src/apps/lwiperf/lwiperf.c
+)
+
+# SMTP client
+set(lwipsmtp_SRCS
+    ${LWIP_DIR}/src/apps/smtp/smtp.c
+)
+
+# SNTP client
+set(lwipsntp_SRCS
+    ${LWIP_DIR}/src/apps/sntp/sntp.c
+)
+
+# MDNS responder
+set(lwipmdns_SRCS
+    ${LWIP_DIR}/src/apps/mdns/mdns.c
+)
+
+# NetBIOS name server
+set(lwipnetbios_SRCS
+    ${LWIP_DIR}/src/apps/netbiosns/netbiosns.c
+)
+
+# TFTP server files
+set(lwiptftp_SRCS
+    ${LWIP_DIR}/src/apps/tftp/tftp_server.c
+)
+
+# MQTT client files
+set(lwipmqtt_SRCS
+    ${LWIP_DIR}/src/apps/mqtt/mqtt.c
+)
+
+# ARM MBEDTLS related files of lwIP rep
+set(lwipmbedtls_SRCS
+    ${LWIP_DIR}/src/apps/altcp_tls/altcp_tls_mbedtls.c
+    ${LWIP_DIR}/src/apps/altcp_tls/altcp_tls_mbedtls_mem.c
+    ${LWIP_DIR}/src/apps/snmp/snmpv3_mbedtls.c
+)
+
+# All LWIP files without apps
+set(lwipnoapps_SRCS
+    ${lwipcore_SRCS}
+    ${lwipcore4_SRCS}
+    ${lwipcore6_SRCS}
+    ${lwipapi_SRCS}
+    ${lwipnetif_SRCS}
+    ${lwipsixlowpan_SRCS}
+    ${lwipppp_SRCS}
+)
+
+# LWIPAPPFILES: All LWIP APPs
+set(lwipallapps_SRCS
+    ${lwipsnmp_SRCS}
+    ${lwiphttp_SRCS}
+    ${lwipiperf_SRCS}
+    ${lwipsmtp_SRCS}
+    ${lwipsntp_SRCS}
+    ${lwipmdns_SRCS}
+    ${lwipnetbios_SRCS}
+    ${lwiptftp_SRCS}
+    ${lwipmqtt_SRCS}
+    ${lwipmbedtls_SRCS}
+)
+
+# Generate lwip/init.h (version info)
+configure_file(${LWIP_DIR}/src/include/lwip/init.h.cmake.in ${LWIP_DIR}/src/include/lwip/init.h)
+
+# Documentation
+set(DOXYGEN_DIR ${LWIP_DIR}/doc/doxygen)
+set(DOXYGEN_OUTPUT_DIR output)
+set(DOXYGEN_IN  ${LWIP_DIR}/doc/doxygen/lwip.Doxyfile.cmake.in)
+set(DOXYGEN_OUT ${LWIP_DIR}/doc/doxygen/lwip.Doxyfile)
+configure_file(${DOXYGEN_IN} ${DOXYGEN_OUT})
+
+find_package(Doxygen)
+if (DOXYGEN_FOUND)
+    message("Doxygen build started")
+
+    add_custom_target(lwipdocs
+        COMMAND ${CMAKE_COMMAND} -E remove_directory ${DOXYGEN_DIR}/${DOXYGEN_OUTPUT_DIR}/html
+        COMMAND ${DOXYGEN_EXECUTABLE} ${DOXYGEN_OUT}
+        WORKING_DIRECTORY ${DOXYGEN_DIR}
+        COMMENT "Generating API documentation with Doxygen"
+        VERBATIM)
+else (DOXYGEN_FOUND)
+    message("Doxygen needs to be installed to generate the doxygen documentation")
+endif (DOXYGEN_FOUND)
+
+# lwIP libraries
+add_library(lwipcore EXCLUDE_FROM_ALL ${lwipnoapps_SRCS})
+target_compile_options(lwipcore PRIVATE ${LWIP_COMPILER_FLAGS})
+target_compile_definitions(lwipcore PRIVATE ${LWIP_DEFINITIONS}  ${LWIP_MBEDTLS_DEFINITIONS})
+target_include_directories(lwipcore PRIVATE ${LWIP_INCLUDE_DIRS} ${LWIP_MBEDTLS_INCLUDE_DIRS})
+
+add_library(lwipallapps EXCLUDE_FROM_ALL ${lwipallapps_SRCS})
+target_compile_options(lwipallapps PRIVATE ${LWIP_COMPILER_FLAGS})
+target_compile_definitions(lwipallapps PRIVATE ${LWIP_DEFINITIONS}  ${LWIP_MBEDTLS_DEFINITIONS})
+target_include_directories(lwipallapps PRIVATE ${LWIP_INCLUDE_DIRS} ${LWIP_MBEDTLS_INCLUDE_DIRS})
--- a/src/Filelists.mk
+++ b/src/Filelists.mk
@@ -42,6 +42,9 @@ COREFILES=$(LWIPDIR)/core/init.c \
 	$(LWIPDIR)/core/raw.c \
 	$(LWIPDIR)/core/stats.c \
 	$(LWIPDIR)/core/sys.c \
+	$(LWIPDIR)/core/altcp.c \
+	$(LWIPDIR)/core/altcp_alloc.c \
+	$(LWIPDIR)/core/altcp_tcp.c \
 	$(LWIPDIR)/core/tcp.c \
 	$(LWIPDIR)/core/tcp_in.c \
 	$(LWIPDIR)/core/tcp_out.c \
@@ -71,6 +74,7 @@ CORE6FILES=$(LWIPDIR)/core/ipv6/dhcp6.c \
 APIFILES=$(LWIPDIR)/api/api_lib.c \
 	$(LWIPDIR)/api/api_msg.c \
 	$(LWIPDIR)/api/err.c \
+	$(LWIPDIR)/api/if_api.c \
 	$(LWIPDIR)/api/netbuf.c \
 	$(LWIPDIR)/api/netdb.c \
 	$(LWIPDIR)/api/netifapi.c \
@@ -79,10 +83,15 @@ APIFILES=$(LWIPDIR)/api/api_lib.c \

 # NETIFFILES: Files implementing various generic network interface functions
 NETIFFILES=$(LWIPDIR)/netif/ethernet.c \
+	$(LWIPDIR)/netif/bridgeif.c \
+	$(LWIPDIR)/netif/bridgeif_fdb.c \
 	$(LWIPDIR)/netif/slipif.c

 # SIXLOWPAN: 6LoWPAN
-SIXLOWPAN=$(LWIPDIR)/netif/lowpan6.c \
+SIXLOWPAN=$(LWIPDIR)/netif/lowpan6_common.c \
+        $(LWIPDIR)/netif/lowpan6.c \
+	$(LWIPDIR)/netif/lowpan6_ble.c \
+	$(LWIPDIR)/netif/zepif.c

 # PPPFILES: PPP
 PPPFILES=$(LWIPDIR)/netif/ppp/auth.c \
@@ -136,6 +145,8 @@ SNMPFILES=$(LWIPDIR)/apps/snmp/snmp_asn1.c \
 	$(LWIPDIR)/apps/snmp/snmp_mib2_system.c \
 	$(LWIPDIR)/apps/snmp/snmp_mib2_tcp.c \
 	$(LWIPDIR)/apps/snmp/snmp_mib2_udp.c \
+	$(LWIPDIR)/apps/snmp/snmp_snmpv2_framework.c \
+	$(LWIPDIR)/apps/snmp/snmp_snmpv2_usm.c \
 	$(LWIPDIR)/apps/snmp/snmp_msg.c \
 	$(LWIPDIR)/apps/snmp/snmpv3.c \
 	$(LWIPDIR)/apps/snmp/snmp_netconn.c \
@@ -144,17 +155,23 @@ SNMPFILES=$(LWIPDIR)/apps/snmp/snmp_asn1.c \
 	$(LWIPDIR)/apps/snmp/snmp_scalar.c \
 	$(LWIPDIR)/apps/snmp/snmp_table.c \
 	$(LWIPDIR)/apps/snmp/snmp_threadsync.c \
-	$(LWIPDIR)/apps/snmp/snmp_traps.c \
-	$(LWIPDIR)/apps/snmp/snmpv3_mbedtls.c \
-	$(LWIPDIR)/apps/snmp/snmpv3_dummy.c
+	$(LWIPDIR)/apps/snmp/snmp_traps.c

-# HTTPDFILES: HTTP server
-HTTPDFILES=$(LWIPDIR)/apps/httpd/fs.c \
-	$(LWIPDIR)/apps/httpd/httpd.c
+# HTTPFILES: HTTP server + client
+HTTPFILES=$(LWIPDIR)/apps/http/altcp_proxyconnect.c \
+	$(LWIPDIR)/apps/http/fs.c \
+	$(LWIPDIR)/apps/http/http_client.c \
+	$(LWIPDIR)/apps/http/httpd.c
+
+# MAKEFSDATA: MAKEFSDATA HTTP server host utility
+MAKEFSDATAFILES=$(LWIPDIR)/apps/http/makefsdata/makefsdata.c

 # LWIPERFFILES: IPERF server
 LWIPERFFILES=$(LWIPDIR)/apps/lwiperf/lwiperf.c

+# SMTPFILES: SMTP client
+SMTPFILES=$(LWIPDIR)/apps/smtp/smtp.c
+
 # SNTPFILES: SNTP client
 SNTPFILES=$(LWIPDIR)/apps/sntp/sntp.c

@@ -167,11 +184,22 @@ NETBIOSNSFILES=$(LWIPDIR)/apps/netbiosns/netbiosns.c
 # TFTPFILES: TFTP server files
 TFTPFILES=$(LWIPDIR)/apps/tftp/tftp_server.c

+# MQTTFILES: MQTT client files
+MQTTFILES=$(LWIPDIR)/apps/mqtt/mqtt.c
+
+# MBEDTLS_FILES: MBEDTLS related files of lwIP rep
+MBEDTLS_FILES=$(LWIPDIR)/apps/altcp_tls/altcp_tls_mbedtls.c \
+	$(LWIPDIR)/apps/altcp_tls/altcp_tls_mbedtls_mem.c \
+	$(LWIPDIR)/apps/snmp/snmpv3_mbedtls.c
+
 # LWIPAPPFILES: All LWIP APPs
 LWIPAPPFILES=$(SNMPFILES) \
-	$(HTTPDFILES) \
+	$(HTTPFILES) \
 	$(LWIPERFFILES) \
+	$(SMTPFILES) \
 	$(SNTPFILES) \
 	$(MDNSFILES) \
 	$(NETBIOSNSFILES) \
-	$(TFTPFILES)
+	$(TFTPFILES) \
+	$(MQTTFILES) \
+	$(MBEDTLS_FILES)
--- a/src/api/api_lib.c
+++ b/src/api/api_lib.c
@@ -69,6 +69,10 @@
 #include "lwip/priv/tcp_priv.h"
 #include "lwip/priv/tcpip_priv.h"

+#ifdef LWIP_HOOK_FILENAME
+#include LWIP_HOOK_FILENAME
+#endif
+
 #include <string.h>

 #define API_MSG_VAR_REF(name)               API_VAR_REF(name)
@@ -77,6 +81,28 @@
 #define API_MSG_VAR_ALLOC_RETURN_NULL(name) API_VAR_ALLOC(struct api_msg, MEMP_API_MSG, name, NULL)
 #define API_MSG_VAR_FREE(name)              API_VAR_FREE(MEMP_API_MSG, name)

+#if TCP_LISTEN_BACKLOG
+/* need to allocate API message for accept so empty message pool does not result in event loss
+ * see bug #47512: MPU_COMPATIBLE may fail on empty pool */
+#define API_MSG_VAR_ALLOC_ACCEPT(msg) API_MSG_VAR_ALLOC(msg)
+#define API_MSG_VAR_FREE_ACCEPT(msg) API_MSG_VAR_FREE(msg)
+#else /* TCP_LISTEN_BACKLOG */
+#define API_MSG_VAR_ALLOC_ACCEPT(msg)
+#define API_MSG_VAR_FREE_ACCEPT(msg)
+#endif /* TCP_LISTEN_BACKLOG */
+
+#if LWIP_NETCONN_FULLDUPLEX
+#define NETCONN_RECVMBOX_WAITABLE(conn) (sys_mbox_valid(&(conn)->recvmbox) && (((conn)->flags & NETCONN_FLAG_MBOXINVALID) == 0))
+#define NETCONN_ACCEPTMBOX_WAITABLE(conn) (sys_mbox_valid(&(conn)->acceptmbox) && (((conn)->flags & (NETCONN_FLAG_MBOXCLOSED|NETCONN_FLAG_MBOXINVALID)) == 0))
+#define NETCONN_MBOX_WAITING_INC(conn) SYS_ARCH_INC(conn->mbox_threads_waiting, 1)
+#define NETCONN_MBOX_WAITING_DEC(conn) SYS_ARCH_DEC(conn->mbox_threads_waiting, 1)
+#else /* LWIP_NETCONN_FULLDUPLEX */
+#define NETCONN_RECVMBOX_WAITABLE(conn)   sys_mbox_valid(&(conn)->recvmbox)
+#define NETCONN_ACCEPTMBOX_WAITABLE(conn) (sys_mbox_valid(&(conn)->acceptmbox) && (((conn)->flags & NETCONN_FLAG_MBOXCLOSED) == 0))
+#define NETCONN_MBOX_WAITING_INC(conn)
+#define NETCONN_MBOX_WAITING_DEC(conn)
+#endif /* LWIP_NETCONN_FULLDUPLEX */
+
 static err_t netconn_close_shutdown(struct netconn *conn, u8_t how);

 /**
@@ -155,7 +181,7 @@ netconn_new_with_proto_and_callback(enum netconn_type t, u8_t proto, netconn_cal

 /**
 * @ingroup netconn_common
- * Close a netconn 'connection' and free its resources.
+ * Close a netconn 'connection' and free all its resources but not the netconn itself.
 * UDP and RAW connection are completely closed, TCP pcbs might still be in a waitstate
 * after this returns.
 *
@@ -163,7 +189,7 @@ netconn_new_with_proto_and_callback(enum netconn_type t, u8_t proto, netconn_cal
 * @return ERR_OK if the connection was deleted
 */
 err_t
-netconn_delete(struct netconn *conn)
+netconn_prepare_delete(struct netconn *conn)
 {
  err_t err;
  API_MSG_VAR_DECLARE(msg);
@@ -175,28 +201,59 @@ netconn_delete(struct netconn *conn)

  API_MSG_VAR_ALLOC(msg);
  API_MSG_VAR_REF(msg).conn = conn;
+#if LWIP_TCP
 #if LWIP_SO_SNDTIMEO || LWIP_SO_LINGER
  /* get the time we started, which is later compared to
     sys_now() + conn->send_timeout */
  API_MSG_VAR_REF(msg).msg.sd.time_started = sys_now();
 #else /* LWIP_SO_SNDTIMEO || LWIP_SO_LINGER */
-#if LWIP_TCP
  API_MSG_VAR_REF(msg).msg.sd.polls_left =
    ((LWIP_TCP_CLOSE_TIMEOUT_MS_DEFAULT + TCP_SLOW_INTERVAL - 1) / TCP_SLOW_INTERVAL) + 1;
-#endif /* LWIP_TCP */
 #endif /* LWIP_SO_SNDTIMEO || LWIP_SO_LINGER */
+#endif /* LWIP_TCP */
  err = netconn_apimsg(lwip_netconn_do_delconn, &API_MSG_VAR_REF(msg));
  API_MSG_VAR_FREE(msg);

  if (err != ERR_OK) {
    return err;
  }
-
-  netconn_free(conn);
-
  return ERR_OK;
 }

+/**
+ * @ingroup netconn_common
+ * Close a netconn 'connection' and free its resources.
+ * UDP and RAW connection are completely closed, TCP pcbs might still be in a waitstate
+ * after this returns.
+ *
+ * @param conn the netconn to delete
+ * @return ERR_OK if the connection was deleted
+ */
+err_t
+netconn_delete(struct netconn *conn)
+{
+  err_t err;
+
+  /* No ASSERT here because possible to get a (conn == NULL) if we got an accept error */
+  if (conn == NULL) {
+    return ERR_OK;
+  }
+
+#if LWIP_NETCONN_FULLDUPLEX
+  if (conn->flags & NETCONN_FLAG_MBOXINVALID) {
+    /* Already called netconn_prepare_delete() before */
+    err = ERR_OK;
+  } else
+#endif /* LWIP_NETCONN_FULLDUPLEX */
+  {
+    err = netconn_prepare_delete(conn);
+  }
+  if (err == ERR_OK) {
+    netconn_free(conn);
+  }
+  return err;
+}
+
 /**
 * Get the local or remote IP address and port of a netconn.
 * For RAW netconns, this returns the protocol instead of a port!
@@ -254,10 +311,22 @@ netconn_bind(struct netconn *conn, const ip_addr_t *addr, u16_t port)

  LWIP_ERROR("netconn_bind: invalid conn", (conn != NULL), return ERR_ARG;);

+#if LWIP_IPV4
  /* Don't propagate NULL pointer (IP_ADDR_ANY alias) to subsequent functions */
  if (addr == NULL) {
    addr = IP4_ADDR_ANY;
  }
+#endif /* LWIP_IPV4 */
+
+#if LWIP_IPV4 && LWIP_IPV6
+  /* "Socket API like" dual-stack support: If IP to bind to is IP6_ADDR_ANY,
+   * and NETCONN_FLAG_IPV6_V6ONLY is 0, use IP_ANY_TYPE to bind
+   */
+  if ((netconn_get_ipv6only(conn) == 0) &&
+      ip_addr_cmp(addr, IP6_ADDR_ANY)) {
+    addr = IP_ANY_TYPE;
+  }
+#endif /* LWIP_IPV4 && LWIP_IPV6 */

  API_MSG_VAR_ALLOC(msg);
  API_MSG_VAR_REF(msg).conn = conn;
@@ -269,6 +338,32 @@ netconn_bind(struct netconn *conn, const ip_addr_t *addr, u16_t port)
  return err;
 }

+/**
+ * @ingroup netconn_common
+ * Bind a netconn to a specific interface and port.
+ * Binding one netconn twice might not always be checked correctly!
+ *
+ * @param conn the netconn to bind
+ * @param if_idx the local interface index to bind the netconn to
+ * @return ERR_OK if bound, any other err_t on failure
+ */
+err_t
+netconn_bind_if(struct netconn *conn, u8_t if_idx)
+{
+  API_MSG_VAR_DECLARE(msg);
+  err_t err;
+
+  LWIP_ERROR("netconn_bind_if: invalid conn", (conn != NULL), return ERR_ARG;);
+
+  API_MSG_VAR_ALLOC(msg);
+  API_MSG_VAR_REF(msg).conn = conn;
+  API_MSG_VAR_REF(msg).msg.bc.if_idx = if_idx;
+  err = netconn_apimsg(lwip_netconn_do_bind_if, &API_MSG_VAR_REF(msg));
+  API_MSG_VAR_FREE(msg);
+
+  return err;
+}
+
 /**
 * @ingroup netconn_common
 * Connect a netconn to a specific remote IP address and port.
@@ -286,10 +381,12 @@ netconn_connect(struct netconn *conn, const ip_addr_t *addr, u16_t port)

  LWIP_ERROR("netconn_connect: invalid conn", (conn != NULL), return ERR_ARG;);

+#if LWIP_IPV4
  /* Don't propagate NULL pointer (IP_ADDR_ANY alias) to subsequent functions */
  if (addr == NULL) {
    addr = IP4_ADDR_ANY;
  }
+#endif /* LWIP_IPV4 */

  API_MSG_VAR_ALLOC(msg);
  API_MSG_VAR_REF(msg).conn = conn;
@@ -374,9 +471,9 @@ err_t
 netconn_accept(struct netconn *conn, struct netconn **new_conn)
 {
 #if LWIP_TCP
+  err_t err;
  void *accept_ptr;
  struct netconn *newconn;
-  err_t err;
 #if TCP_LISTEN_BACKLOG
  API_MSG_VAR_DECLARE(msg);
 #endif /* TCP_LISTEN_BACKLOG */
@@ -385,53 +482,65 @@ netconn_accept(struct netconn *conn, struct netconn **new_conn)
  *new_conn = NULL;
  LWIP_ERROR("netconn_accept: invalid conn",       (conn != NULL),                      return ERR_ARG;);

-  err = conn->last_err;
-  if (ERR_IS_FATAL(err)) {
-    /* don't recv on fatal errors: this might block the application task
-       waiting on acceptmbox forever! */
+  /* NOTE: Although the opengroup spec says a pending error shall be returned to
+           send/recv/getsockopt(SO_ERROR) only, we return it for listening
+           connections also, to handle embedded-system errors */
+  err = netconn_err(conn);
+  if (err != ERR_OK) {
+    /* return pending error */
    return err;
  }
-  if (!sys_mbox_valid(&conn->acceptmbox)) {
+  if (!NETCONN_ACCEPTMBOX_WAITABLE(conn)) {
+    /* don't accept if closed: this might block the application task
+       waiting on acceptmbox forever! */
    return ERR_CLSD;
  }

-#if TCP_LISTEN_BACKLOG
-  API_MSG_VAR_ALLOC(msg);
-#endif /* TCP_LISTEN_BACKLOG */
+  API_MSG_VAR_ALLOC_ACCEPT(msg);

+  NETCONN_MBOX_WAITING_INC(conn);
+  if (netconn_is_nonblocking(conn)) {
+    if (sys_arch_mbox_tryfetch(&conn->acceptmbox, &accept_ptr) == SYS_MBOX_EMPTY) {
+      API_MSG_VAR_FREE_ACCEPT(msg);
+      NETCONN_MBOX_WAITING_DEC(conn);
+      return ERR_WOULDBLOCK;
+    }
+  } else {
 #if LWIP_SO_RCVTIMEO
    if (sys_arch_mbox_fetch(&conn->acceptmbox, &accept_ptr, conn->recv_timeout) == SYS_ARCH_TIMEOUT) {
-#if TCP_LISTEN_BACKLOG
-    API_MSG_VAR_FREE(msg);
-#endif /* TCP_LISTEN_BACKLOG */
+      API_MSG_VAR_FREE_ACCEPT(msg);
+      NETCONN_MBOX_WAITING_DEC(conn);
      return ERR_TIMEOUT;
    }
 #else
    sys_arch_mbox_fetch(&conn->acceptmbox, &accept_ptr, 0);
 #endif /* LWIP_SO_RCVTIMEO*/
-  newconn = (struct netconn *)accept_ptr;
+  }
+  NETCONN_MBOX_WAITING_DEC(conn);
+#if LWIP_NETCONN_FULLDUPLEX
+  if (conn->flags & NETCONN_FLAG_MBOXINVALID) {
+    if (lwip_netconn_is_deallocated_msg(accept_ptr)) {
+      /* the netconn has been closed from another thread */
+      API_MSG_VAR_FREE_ACCEPT(msg);
+      return ERR_CONN;
+    }
+  }
+#endif
+
  /* Register event with callback */
  API_EVENT(conn, NETCONN_EVT_RCVMINUS, 0);

-  if (accept_ptr == &netconn_aborted) {
-    /* a connection has been aborted: out of pcbs or out of netconns during accept */
-    /* @todo: set netconn error, but this would be fatal and thus block further accepts */
-#if TCP_LISTEN_BACKLOG
-    API_MSG_VAR_FREE(msg);
-#endif /* TCP_LISTEN_BACKLOG */
-    return ERR_ABRT;
+  if (lwip_netconn_is_err_msg(accept_ptr, &err)) {
+    /* a connection has been aborted: e.g. out of pcbs or out of netconns during accept */
+    API_MSG_VAR_FREE_ACCEPT(msg);
+    return err;
  }
-  if (newconn == NULL) {
+  if (accept_ptr == NULL) {
    /* connection has been aborted */
-    /* in this special case, we set the netconn error from application thread, as
-       on a ready-to-accept listening netconn, there should not be anything running
-       in tcpip_thread */
-    NETCONN_SET_SAFE_ERR(conn, ERR_CLSD);
-#if TCP_LISTEN_BACKLOG
-    API_MSG_VAR_FREE(msg);
-#endif /* TCP_LISTEN_BACKLOG */
+    API_MSG_VAR_FREE_ACCEPT(msg);
    return ERR_CLSD;
  }
+  newconn = (struct netconn *)accept_ptr;
 #if TCP_LISTEN_BACKLOG
  /* Let the stack know that we have accepted the connection. */
  API_MSG_VAR_REF(msg).conn = newconn;
@@ -453,105 +562,89 @@ netconn_accept(struct netconn *conn, struct netconn **new_conn)
 /**
 * @ingroup netconn_common
 * Receive data: actual implementation that doesn't care whether pbuf or netbuf
- * is received
+ * is received (this is internal, it's just here for describing common errors)
 *
 * @param conn the netconn from which to receive data
 * @param new_buf pointer where a new pbuf/netbuf is stored when received data
+ * @param apiflags flags that control function behaviour. For now only:
+ * - NETCONN_DONTBLOCK: only read data that is available now, don't wait for more data
 * @return ERR_OK if data has been received, an error code otherwise (timeout,
 *                memory error or another error)
+ *         ERR_CONN if not connected
+ *         ERR_CLSD if TCP connection has been closed
+ *         ERR_WOULDBLOCK if the netconn is nonblocking but would block to wait for data
+ *         ERR_TIMEOUT if the netconn has a receive timeout and no data was received
 */
 static err_t
-netconn_recv_data(struct netconn *conn, void **new_buf)
+netconn_recv_data(struct netconn *conn, void **new_buf, u8_t apiflags)
 {
  void *buf = NULL;
  u16_t len;
-  err_t err;
-#if LWIP_TCP
-  API_MSG_VAR_DECLARE(msg);
-#if LWIP_MPU_COMPATIBLE
-  msg = NULL;
-#endif
-#endif /* LWIP_TCP */

  LWIP_ERROR("netconn_recv: invalid pointer", (new_buf != NULL), return ERR_ARG;);
  *new_buf = NULL;
  LWIP_ERROR("netconn_recv: invalid conn",    (conn != NULL),    return ERR_ARG;);
-#if LWIP_TCP
-#if (LWIP_UDP || LWIP_RAW)
-  if (NETCONNTYPE_GROUP(conn->type) == NETCONN_TCP)
-#endif /* (LWIP_UDP || LWIP_RAW) */
-  {
-    if (!sys_mbox_valid(&conn->recvmbox)) {
-      /* This happens when calling this function after receiving FIN */
-      return sys_mbox_valid(&conn->acceptmbox) ? ERR_CONN : ERR_CLSD;
-    }
-  }
-#endif /* LWIP_TCP */
-  LWIP_ERROR("netconn_recv: invalid recvmbox", sys_mbox_valid(&conn->recvmbox), return ERR_CONN;);

-  err = conn->last_err;
-  if (ERR_IS_FATAL(err)) {
-    /* don't recv on fatal errors: this might block the application task
-       waiting on recvmbox forever! */
-    /* @todo: this does not allow us to fetch data that has been put into recvmbox
-       before the fatal error occurred - is that a problem? */
+  if (!NETCONN_RECVMBOX_WAITABLE(conn)) {
+    err_t err = netconn_err(conn);
+    if (err != ERR_OK) {
+      /* return pending error */
      return err;
    }
-#if LWIP_TCP
-#if (LWIP_UDP || LWIP_RAW)
-  if (NETCONNTYPE_GROUP(conn->type) == NETCONN_TCP)
-#endif /* (LWIP_UDP || LWIP_RAW) */
-  {
-    API_MSG_VAR_ALLOC(msg);
+    return ERR_CONN;
  }
-#endif /* LWIP_TCP */

+  NETCONN_MBOX_WAITING_INC(conn);
+  if (netconn_is_nonblocking(conn) || (apiflags & NETCONN_DONTBLOCK) ||
+      (conn->flags & NETCONN_FLAG_MBOXCLOSED) || (conn->pending_err != ERR_OK)) {
+    if (sys_arch_mbox_tryfetch(&conn->recvmbox, &buf) == SYS_MBOX_EMPTY) {
+      err_t err;
+      NETCONN_MBOX_WAITING_DEC(conn);
+      err = netconn_err(conn);
+      if (err != ERR_OK) {
+        /* return pending error */
+        return err;
+      }
+      if (conn->flags & NETCONN_FLAG_MBOXCLOSED) {
+        return ERR_CONN;
+      }
+      return ERR_WOULDBLOCK;
+    }
+  } else {
 #if LWIP_SO_RCVTIMEO
    if (sys_arch_mbox_fetch(&conn->recvmbox, &buf, conn->recv_timeout) == SYS_ARCH_TIMEOUT) {
-#if LWIP_TCP
-#if (LWIP_UDP || LWIP_RAW)
-    if (NETCONNTYPE_GROUP(conn->type) == NETCONN_TCP)
-#endif /* (LWIP_UDP || LWIP_RAW) */
-    {
-      API_MSG_VAR_FREE(msg);
-    }
-#endif /* LWIP_TCP */
+      NETCONN_MBOX_WAITING_DEC(conn);
      return ERR_TIMEOUT;
    }
 #else
    sys_arch_mbox_fetch(&conn->recvmbox, &buf, 0);
 #endif /* LWIP_SO_RCVTIMEO*/
+  }
+  NETCONN_MBOX_WAITING_DEC(conn);
+#if LWIP_NETCONN_FULLDUPLEX
+  if (conn->flags & NETCONN_FLAG_MBOXINVALID) {
+    if (lwip_netconn_is_deallocated_msg(buf)) {
+      /* the netconn has been closed from another thread */
+      API_MSG_VAR_FREE_ACCEPT(msg);
+      return ERR_CONN;
+    }
+  }
+#endif

 #if LWIP_TCP
 #if (LWIP_UDP || LWIP_RAW)
  if (NETCONNTYPE_GROUP(conn->type) == NETCONN_TCP)
 #endif /* (LWIP_UDP || LWIP_RAW) */
  {
-    /* Let the stack know that we have taken the data. */
-    /* @todo: Speedup: Don't block and wait for the answer here
-       (to prevent multiple thread-switches). */
-    API_MSG_VAR_REF(msg).conn = conn;
-    if (buf != NULL) {
-      API_MSG_VAR_REF(msg).msg.r.len = ((struct pbuf *)buf)->tot_len;
-    } else {
-      API_MSG_VAR_REF(msg).msg.r.len = 1;
+    err_t err;
+    /* Check if this is an error message or a pbuf */
+    if (lwip_netconn_is_err_msg(buf, &err)) {
+      /* new_buf has been zeroed above already */
+      if (err == ERR_CLSD) {
+        /* connection closed translates to ERR_OK with *new_buf == NULL */
+        return ERR_OK;
      }
-
-    /* don't care for the return value of lwip_netconn_do_recv */
-    netconn_apimsg(lwip_netconn_do_recv, &API_MSG_VAR_REF(msg));
-    API_MSG_VAR_FREE(msg);
-
-    /* If we are closed, we indicate that we no longer wish to use the socket */
-    if (buf == NULL) {
-      API_EVENT(conn, NETCONN_EVT_RCVMINUS, 0);
-      if (conn->pcb.ip == NULL) {
-        /* race condition: RST during recv */
-        return conn->last_err == ERR_OK ? ERR_RST : conn->last_err;
-      }
-      /* RX side is closed, so deallocate the recvmbox */
-      netconn_close_shutdown(conn, NETCONN_SHUT_RD);
-      /* Don' store ERR_CLSD as conn->err since we are only half-closed */
-      return ERR_CLSD;
+      return err;
    }
    len = ((struct pbuf *)buf)->tot_len;
  }
@@ -579,6 +672,102 @@ netconn_recv_data(struct netconn *conn, void **new_buf)
  return ERR_OK;
 }

+#if LWIP_TCP
+static err_t
+netconn_tcp_recvd_msg(struct netconn *conn, size_t len, struct api_msg *msg)
+{
+  LWIP_ERROR("netconn_recv_tcp_pbuf: invalid conn", (conn != NULL) &&
+             NETCONNTYPE_GROUP(netconn_type(conn)) == NETCONN_TCP, return ERR_ARG;);
+
+  msg->conn = conn;
+  msg->msg.r.len = len;
+
+  return netconn_apimsg(lwip_netconn_do_recv, msg);
+}
+
+err_t
+netconn_tcp_recvd(struct netconn *conn, size_t len)
+{
+  err_t err;
+  API_MSG_VAR_DECLARE(msg);
+  LWIP_ERROR("netconn_recv_tcp_pbuf: invalid conn", (conn != NULL) &&
+             NETCONNTYPE_GROUP(netconn_type(conn)) == NETCONN_TCP, return ERR_ARG;);
+
+  API_MSG_VAR_ALLOC(msg);
+  err = netconn_tcp_recvd_msg(conn, len, &API_VAR_REF(msg));
+  API_MSG_VAR_FREE(msg);
+  return err;
+}
+
+static err_t
+netconn_recv_data_tcp(struct netconn *conn, struct pbuf **new_buf, u8_t apiflags)
+{
+  err_t err;
+  struct pbuf *buf;
+  API_MSG_VAR_DECLARE(msg);
+#if LWIP_MPU_COMPATIBLE
+  msg = NULL;
+#endif
+
+  if (!NETCONN_RECVMBOX_WAITABLE(conn)) {
+    /* This only happens when calling this function more than once *after* receiving FIN */
+    return ERR_CONN;
+  }
+  if (netconn_is_flag_set(conn, NETCONN_FIN_RX_PENDING)) {
+    netconn_clear_flags(conn, NETCONN_FIN_RX_PENDING);
+    goto handle_fin;
+  }
+
+  if (!(apiflags & NETCONN_NOAUTORCVD)) {
+    /* need to allocate API message here so empty message pool does not result in event loss
+      * see bug #47512: MPU_COMPATIBLE may fail on empty pool */
+    API_MSG_VAR_ALLOC(msg);
+  }
+
+  err = netconn_recv_data(conn, (void **)new_buf, apiflags);
+  if (err != ERR_OK) {
+    if (!(apiflags & NETCONN_NOAUTORCVD)) {
+      API_MSG_VAR_FREE(msg);
+    }
+    return err;
+  }
+  buf = *new_buf;
+  if (!(apiflags & NETCONN_NOAUTORCVD)) {
+    /* Let the stack know that we have taken the data. */
+    u16_t len = buf ? buf->tot_len : 1;
+    /* don't care for the return value of lwip_netconn_do_recv */
+    /* @todo: this should really be fixed, e.g. by retrying in poll on error */
+    netconn_tcp_recvd_msg(conn, len,  &API_VAR_REF(msg));
+    API_MSG_VAR_FREE(msg);
+  }
+
+  /* If we are closed, we indicate that we no longer wish to use the socket */
+  if (buf == NULL) {
+    if (apiflags & NETCONN_NOFIN) {
+      /* received a FIN but the caller cannot handle it right now:
+         re-enqueue it and return "no data" */
+      netconn_set_flags(conn, NETCONN_FIN_RX_PENDING);
+      return ERR_WOULDBLOCK;
+    } else {
+handle_fin:
+      API_EVENT(conn, NETCONN_EVT_RCVMINUS, 0);
+      if (conn->pcb.ip == NULL) {
+        /* race condition: RST during recv */
+        err = netconn_err(conn);
+        if (err != ERR_OK) {
+          return err;
+        }
+        return ERR_RST;
+      }
+      /* RX side is closed, so deallocate the recvmbox */
+      netconn_close_shutdown(conn, NETCONN_SHUT_RD);
+      /* Don' store ERR_CLSD as conn->err since we are only half-closed */
+      return ERR_CLSD;
+    }
+  }
+  return err;
+}
+
 /**
 * @ingroup netconn_tcp
 * Receive data (in form of a pbuf) from a TCP netconn
@@ -586,16 +775,76 @@ netconn_recv_data(struct netconn *conn, void **new_buf)
 * @param conn the netconn from which to receive data
 * @param new_buf pointer where a new pbuf is stored when received data
 * @return ERR_OK if data has been received, an error code otherwise (timeout,
- *                memory error or another error)
+ *                memory error or another error, @see netconn_recv_data)
 *         ERR_ARG if conn is not a TCP netconn
 */
 err_t
 netconn_recv_tcp_pbuf(struct netconn *conn, struct pbuf **new_buf)
 {
-  LWIP_ERROR("netconn_recv: invalid conn", (conn != NULL) &&
+  LWIP_ERROR("netconn_recv_tcp_pbuf: invalid conn", (conn != NULL) &&
             NETCONNTYPE_GROUP(netconn_type(conn)) == NETCONN_TCP, return ERR_ARG;);

-  return netconn_recv_data(conn, (void **)new_buf);
+  return netconn_recv_data_tcp(conn, new_buf, 0);
+}
+
+/**
+ * @ingroup netconn_tcp
+ * Receive data (in form of a pbuf) from a TCP netconn
+ *
+ * @param conn the netconn from which to receive data
+ * @param new_buf pointer where a new pbuf is stored when received data
+ * @param apiflags flags that control function behaviour. For now only:
+ * - NETCONN_DONTBLOCK: only read data that is available now, don't wait for more data
+ * @return ERR_OK if data has been received, an error code otherwise (timeout,
+ *                memory error or another error, @see netconn_recv_data)
+ *         ERR_ARG if conn is not a TCP netconn
+ */
+err_t
+netconn_recv_tcp_pbuf_flags(struct netconn *conn, struct pbuf **new_buf, u8_t apiflags)
+{
+  LWIP_ERROR("netconn_recv_tcp_pbuf: invalid conn", (conn != NULL) &&
+             NETCONNTYPE_GROUP(netconn_type(conn)) == NETCONN_TCP, return ERR_ARG;);
+
+  return netconn_recv_data_tcp(conn, new_buf, apiflags);
+}
+#endif /* LWIP_TCP */
+
+/**
+ * Receive data (in form of a netbuf) from a UDP or RAW netconn
+ *
+ * @param conn the netconn from which to receive data
+ * @param new_buf pointer where a new netbuf is stored when received data
+ * @return ERR_OK if data has been received, an error code otherwise (timeout,
+ *                memory error or another error)
+ *         ERR_ARG if conn is not a UDP/RAW netconn
+ */
+err_t
+netconn_recv_udp_raw_netbuf(struct netconn *conn, struct netbuf **new_buf)
+{
+  LWIP_ERROR("netconn_recv_udp_raw_netbuf: invalid conn", (conn != NULL) &&
+             NETCONNTYPE_GROUP(netconn_type(conn)) != NETCONN_TCP, return ERR_ARG;);
+
+  return netconn_recv_data(conn, (void **)new_buf, 0);
+}
+
+/**
+ * Receive data (in form of a netbuf) from a UDP or RAW netconn
+ *
+ * @param conn the netconn from which to receive data
+ * @param new_buf pointer where a new netbuf is stored when received data
+ * @param apiflags flags that control function behaviour. For now only:
+ * - NETCONN_DONTBLOCK: only read data that is available now, don't wait for more data
+ * @return ERR_OK if data has been received, an error code otherwise (timeout,
+ *                memory error or another error)
+ *         ERR_ARG if conn is not a UDP/RAW netconn
+ */
+err_t
+netconn_recv_udp_raw_netbuf_flags(struct netconn *conn, struct netbuf **new_buf, u8_t apiflags)
+{
+  LWIP_ERROR("netconn_recv_udp_raw_netbuf: invalid conn", (conn != NULL) &&
+             NETCONNTYPE_GROUP(netconn_type(conn)) != NETCONN_TCP, return ERR_ARG;);
+
+  return netconn_recv_data(conn, (void **)new_buf, apiflags);
 }

 /**
@@ -632,7 +881,7 @@ netconn_recv(struct netconn *conn, struct netbuf **new_buf)
      return ERR_MEM;
    }

-    err = netconn_recv_data(conn, (void **)&p);
+    err = netconn_recv_data_tcp(conn, &p, 0);
    if (err != ERR_OK) {
      memp_free(MEMP_NETBUF, buf);
      return err;
@@ -653,7 +902,7 @@ netconn_recv(struct netconn *conn, struct netbuf **new_buf)
 #endif /* LWIP_TCP && (LWIP_UDP || LWIP_RAW) */
  {
 #if (LWIP_UDP || LWIP_RAW)
-    return netconn_recv_data(conn, (void **)new_buf);
+    return netconn_recv_data(conn, (void **)new_buf, 0);
 #endif /* (LWIP_UDP || LWIP_RAW) */
  }
 }
@@ -697,6 +946,7 @@ netconn_send(struct netconn *conn, struct netbuf *buf)
  LWIP_ERROR("netconn_send: invalid conn",  (conn != NULL), return ERR_ARG;);

  LWIP_DEBUGF(API_LIB_DEBUG, ("netconn_send: sending %"U16_F" bytes\n", buf->p->tot_len));
+
  API_MSG_VAR_ALLOC(msg);
  API_MSG_VAR_REF(msg).conn = conn;
  API_MSG_VAR_REF(msg).msg.b = buf;
@@ -723,29 +973,81 @@ netconn_send(struct netconn *conn, struct netbuf *buf)
 err_t
 netconn_write_partly(struct netconn *conn, const void *dataptr, size_t size,
                     u8_t apiflags, size_t *bytes_written)
+{
+  struct netvector vector;
+  vector.ptr = dataptr;
+  vector.len = size;
+  return netconn_write_vectors_partly(conn, &vector, 1, apiflags, bytes_written);
+}
+
+/**
+ * Send vectorized data atomically over a TCP netconn.
+ *
+ * @param conn the TCP netconn over which to send data
+ * @param vectors array of vectors containing data to send
+ * @param vectorcnt number of vectors in the array
+ * @param apiflags combination of following flags :
+ * - NETCONN_COPY: data will be copied into memory belonging to the stack
+ * - NETCONN_MORE: for TCP connection, PSH flag will be set on last segment sent
+ * - NETCONN_DONTBLOCK: only write the data if all data can be written at once
+ * @param bytes_written pointer to a location that receives the number of written bytes
+ * @return ERR_OK if data was sent, any other err_t on error
+ */
+err_t
+netconn_write_vectors_partly(struct netconn *conn, struct netvector *vectors, u16_t vectorcnt,
+                             u8_t apiflags, size_t *bytes_written)
 {
  API_MSG_VAR_DECLARE(msg);
  err_t err;
  u8_t dontblock;
+  size_t size;
+  int i;

  LWIP_ERROR("netconn_write: invalid conn",  (conn != NULL), return ERR_ARG;);
  LWIP_ERROR("netconn_write: invalid conn->type",  (NETCONNTYPE_GROUP(conn->type) == NETCONN_TCP), return ERR_VAL;);
-  if (size == 0) {
-    return ERR_OK;
-  }
  dontblock = netconn_is_nonblocking(conn) || (apiflags & NETCONN_DONTBLOCK);
+#if LWIP_SO_SNDTIMEO
+  if (conn->send_timeout != 0) {
+    dontblock = 1;
+  }
+#endif /* LWIP_SO_SNDTIMEO */
  if (dontblock && !bytes_written) {
    /* This implies netconn_write() cannot be used for non-blocking send, since
       it has no way to return the number of bytes written. */
    return ERR_VAL;
  }

+  /* sum up the total size */
+  size = 0;
+  for (i = 0; i < vectorcnt; i++) {
+    size += vectors[i].len;
+    if (size < vectors[i].len) {
+      /* overflow */
+      return ERR_VAL;
+    }
+  }
+  if (size == 0) {
+    return ERR_OK;
+  } else if (size > SSIZE_MAX) {
+    ssize_t limited;
+    /* this is required by the socket layer (cannot send full size_t range) */
+    if (!bytes_written) {
+      return ERR_VAL;
+    }
+    /* limit the amount of data to send */
+    limited = SSIZE_MAX;
+    size = (size_t)limited;
+  }
+
  API_MSG_VAR_ALLOC(msg);
  /* non-blocking write sends as much  */
  API_MSG_VAR_REF(msg).conn = conn;
-  API_MSG_VAR_REF(msg).msg.w.dataptr = dataptr;
+  API_MSG_VAR_REF(msg).msg.w.vector = vectors;
+  API_MSG_VAR_REF(msg).msg.w.vector_cnt = vectorcnt;
+  API_MSG_VAR_REF(msg).msg.w.vector_off = 0;
  API_MSG_VAR_REF(msg).msg.w.apiflags = apiflags;
  API_MSG_VAR_REF(msg).msg.w.len = size;
+  API_MSG_VAR_REF(msg).msg.w.offset = 0;
 #if LWIP_SO_SNDTIMEO
  if (conn->send_timeout != 0) {
    /* get the time we started, which is later compared to
@@ -760,17 +1062,14 @@ netconn_write_partly(struct netconn *conn, const void *dataptr, size_t size,
     but if it is, this is done inside api_msg.c:do_write(), so we can use the
     non-blocking version here. */
  err = netconn_apimsg(lwip_netconn_do_write, &API_MSG_VAR_REF(msg));
-  if ((err == ERR_OK) && (bytes_written != NULL)) {
-    if (dontblock
-#if LWIP_SO_SNDTIMEO
-        || (conn->send_timeout != 0)
-#endif /* LWIP_SO_SNDTIMEO */
-       ) {
-      /* nonblocking write: maybe the data has been sent partly */
-      *bytes_written = API_MSG_VAR_REF(msg).msg.w.len;
-    } else {
-      /* blocking call succeeded: all data has been sent if it */
-      *bytes_written = size;
+  if (err == ERR_OK) {
+    if (bytes_written != NULL) {
+      *bytes_written = API_MSG_VAR_REF(msg).msg.w.offset;
+    }
+    /* for blocking, check all requested bytes were written, NOTE: send_timeout is
+       treated as dontblock (see dontblock assignment above) */
+    if (!dontblock) {
+      LWIP_ASSERT("do_write failed to write all bytes", API_MSG_VAR_REF(msg).msg.w.offset == size);
    }
  }
  API_MSG_VAR_FREE(msg);
@@ -829,6 +1128,28 @@ netconn_close(struct netconn *conn)
  return netconn_close_shutdown(conn, NETCONN_SHUT_RDWR);
 }

+/**
+ * @ingroup netconn_common
+ * Get and reset pending error on a netconn
+ *
+ * @param conn the netconn to get the error from
+ * @return and pending error or ERR_OK if no error was pending
+ */
+err_t
+netconn_err(struct netconn *conn)
+{
+  err_t err;
+  SYS_ARCH_DECL_PROTECT(lev);
+  if (conn == NULL) {
+    return ERR_OK;
+  }
+  SYS_ARCH_PROTECT(lev);
+  err = conn->pending_err;
+  conn->pending_err = ERR_OK;
+  SYS_ARCH_UNPROTECT(lev);
+  return err;
+}
+
 /**
 * @ingroup netconn_tcp
 * Shut down one or both sides of a TCP netconn (doesn't delete it).
@@ -841,7 +1162,7 @@ netconn_close(struct netconn *conn)
 err_t
 netconn_shutdown(struct netconn *conn, u8_t shut_rx, u8_t shut_tx)
 {
-  return netconn_close_shutdown(conn, (shut_rx ? NETCONN_SHUT_RD : 0) | (shut_tx ? NETCONN_SHUT_WR : 0));
+  return netconn_close_shutdown(conn, (u8_t)((shut_rx ? NETCONN_SHUT_RD : 0) | (shut_tx ? NETCONN_SHUT_WR : 0)));
 }

 #if LWIP_IGMP || (LWIP_IPV6 && LWIP_IPV6_MLD)
@@ -869,6 +1190,7 @@ netconn_join_leave_group(struct netconn *conn,

  API_MSG_VAR_ALLOC(msg);

+#if LWIP_IPV4
  /* Don't propagate NULL pointer (IP_ADDR_ANY alias) to subsequent functions */
  if (multiaddr == NULL) {
    multiaddr = IP4_ADDR_ANY;
@@ -876,6 +1198,7 @@ netconn_join_leave_group(struct netconn *conn,
  if (netif_addr == NULL) {
    netif_addr = IP4_ADDR_ANY;
  }
+#endif /* LWIP_IPV4 */

  API_MSG_VAR_REF(msg).conn = conn;
  API_MSG_VAR_REF(msg).msg.jl.multiaddr = API_MSG_VAR_REF(multiaddr);
@@ -886,6 +1209,48 @@ netconn_join_leave_group(struct netconn *conn,

  return err;
 }
+/**
+ * @ingroup netconn_udp
+ * Join multicast groups for UDP netconns.
+ *
+ * @param conn the UDP netconn for which to change multicast addresses
+ * @param multiaddr IP address of the multicast group to join or leave
+ * @param if_idx the index of the netif
+ * @param join_or_leave flag whether to send a join- or leave-message
+ * @return ERR_OK if the action was taken, any err_t on error
+ */
+err_t
+netconn_join_leave_group_netif(struct netconn *conn,
+                               const ip_addr_t *multiaddr,
+                               u8_t if_idx,
+                               enum netconn_igmp join_or_leave)
+{
+  API_MSG_VAR_DECLARE(msg);
+  err_t err;
+
+  LWIP_ERROR("netconn_join_leave_group: invalid conn",  (conn != NULL), return ERR_ARG;);
+
+  API_MSG_VAR_ALLOC(msg);
+
+#if LWIP_IPV4
+  /* Don't propagate NULL pointer (IP_ADDR_ANY alias) to subsequent functions */
+  if (multiaddr == NULL) {
+    multiaddr = IP4_ADDR_ANY;
+  }
+  if (if_idx == NETIF_NO_INDEX) {
+    return ERR_IF;
+  }
+#endif /* LWIP_IPV4 */
+
+  API_MSG_VAR_REF(msg).conn = conn;
+  API_MSG_VAR_REF(msg).msg.jl.multiaddr = API_MSG_VAR_REF(multiaddr);
+  API_MSG_VAR_REF(msg).msg.jl.if_idx = if_idx;
+  API_MSG_VAR_REF(msg).msg.jl.join_or_leave = join_or_leave;
+  err = netconn_apimsg(lwip_netconn_do_join_leave_group_netif, &API_MSG_VAR_REF(msg));
+  API_MSG_VAR_FREE(msg);
+
+  return err;
+}
 #endif /* LWIP_IGMP || (LWIP_IPV6 && LWIP_IPV6_MLD) */

 #if LWIP_DNS
@@ -914,6 +1279,7 @@ netconn_gethostbyname(const char *name, ip_addr_t *addr)
  sys_sem_t sem;
 #endif /* LWIP_MPU_COMPATIBLE */
  err_t err;
+  err_t cberr;

  LWIP_ERROR("netconn_gethostbyname: invalid name", (name != NULL), return ERR_ARG;);
  LWIP_ERROR("netconn_gethostbyname: invalid addr", (addr != NULL), return ERR_ARG;);
@@ -923,6 +1289,16 @@ netconn_gethostbyname(const char *name, ip_addr_t *addr)
  }
 #endif

+#ifdef LWIP_HOOK_NETCONN_EXTERNAL_RESOLVE
+#if LWIP_IPV4 && LWIP_IPV6
+  if (LWIP_HOOK_NETCONN_EXTERNAL_RESOLVE(name, addr, dns_addrtype, &err)) {
+#else
+  if (LWIP_HOOK_NETCONN_EXTERNAL_RESOLVE(name, addr, NETCONN_DNS_DEFAULT, &err)) {
+#endif /* LWIP_IPV4 && LWIP_IPV6 */
+    return err;
+  }
+#endif /* LWIP_HOOK_NETCONN_EXTERNAL_RESOLVE */
+
  API_VAR_ALLOC(struct dns_api_msg, MEMP_DNS_API_MSG, msg, ERR_MEM);
 #if LWIP_MPU_COMPATIBLE
  strncpy(API_VAR_REF(msg).name, name, DNS_MAX_NAME_LENGTH - 1);
@@ -946,18 +1322,14 @@ netconn_gethostbyname(const char *name, ip_addr_t *addr)
  }
 #endif /* LWIP_NETCONN_SEM_PER_THREAD */

-  err = tcpip_callback(lwip_netconn_do_gethostbyname, &API_VAR_REF(msg));
-  if (err != ERR_OK) {
+  cberr = tcpip_send_msg_wait_sem(lwip_netconn_do_gethostbyname, &API_VAR_REF(msg), API_EXPR_REF(API_VAR_REF(msg).sem));
 #if !LWIP_NETCONN_SEM_PER_THREAD
  sys_sem_free(API_EXPR_REF(API_VAR_REF(msg).sem));
 #endif /* !LWIP_NETCONN_SEM_PER_THREAD */
+  if (cberr != ERR_OK) {
    API_VAR_FREE(MEMP_DNS_API_MSG, msg);
-    return err;
+    return cberr;
  }
-  sys_sem_wait(API_EXPR_REF_SEM(API_VAR_REF(msg).sem));
-#if !LWIP_NETCONN_SEM_PER_THREAD
-  sys_sem_free(API_EXPR_REF(API_VAR_REF(msg).sem));
-#endif /* !LWIP_NETCONN_SEM_PER_THREAD */

 #if LWIP_MPU_COMPATIBLE
  *addr = msg->addr;
@@ -969,12 +1341,24 @@ netconn_gethostbyname(const char *name, ip_addr_t *addr)
 }
 #endif /* LWIP_DNS*/

+//Realtek add
+err_t netconn_abort(struct netconn *conn)
+{
+  if (conn->acceptmbox != SYS_MBOX_NULL) {
+    /* Register event with callback */
+    API_EVENT(conn, NETCONN_EVT_RCVPLUS, 0);
+    sys_mbox_post(&conn->acceptmbox, NULL);
+  }
+  return ERR_OK;
+}
+//Realtek add end
+
 #if LWIP_NETCONN_SEM_PER_THREAD
 void
 netconn_thread_init(void)
 {
  sys_sem_t *sem = LWIP_NETCONN_THREAD_SEM_GET();
-  if ((sem == NULL) || !sys_sem_valid(sem)) {
+  if (!sys_sem_valid(sem)) {
    /* call alloc only once */
    LWIP_NETCONN_THREAD_SEM_ALLOC();
    LWIP_ASSERT("LWIP_NETCONN_THREAD_SEM_ALLOC() failed", sys_sem_valid(LWIP_NETCONN_THREAD_SEM_GET()));
@@ -985,7 +1369,7 @@ void
 netconn_thread_cleanup(void)
 {
  sys_sem_t *sem = LWIP_NETCONN_THREAD_SEM_GET();
-  if ((sem != NULL) && sys_sem_valid(sem)) {
+  if (sys_sem_valid(sem)) {
    /* call free only once */
    LWIP_NETCONN_THREAD_SEM_FREE();
  }
--- a/src/api/api_msg.c
+++ b/src/api/api_msg.c
--- a/src/api/err.c
+++ b/src/api/err.c
@@ -64,6 +64,15 @@ static const int err_to_errno_table[] = {
  ENOTCONN,      /* ERR_CLSD       -15     Connection closed.       */
  EIO            /* ERR_ARG        -16     Illegal argument.        */
 };
+
+int
+err_to_errno(err_t err)
+{
+  if ((err > 0) || (-err >= (err_t)LWIP_ARRAYSIZE(err_to_errno_table))) {
+    return EIO;
+  }
+  return err_to_errno_table[-err];
+}
 #endif /* !NO_SYS */

 #ifdef LWIP_DEBUG
@@ -104,14 +113,3 @@ lwip_strerr(err_t err)
 }

 #endif /* LWIP_DEBUG */
-
-#if !NO_SYS
-int
-err_to_errno(err_t err)
-{
-  if ((err > 0) || (-err >= (err_t)LWIP_ARRAYSIZE(err_to_errno_table))) {
-    return EIO;
-  }
-  return err_to_errno_table[-err];
-}
-#endif /* !NO_SYS */
--- a/src/api/if_api.c
+++ b/src/api/if_api.c
@@ -0,0 +1,102 @@
+/**
+ * @file
+ * Interface Identification APIs from:
+ *              RFC 3493: Basic Socket Interface Extensions for IPv6
+ *                  Section 4: Interface Identification
+ *
+ * @defgroup if_api Interface Identification API
+ * @ingroup socket
+ */
+
+/*
+ * Copyright (c) 2017 Joel Cunningham, Garmin International, Inc. <joel.cunningham@garmin.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ *
+ * Author: Joel Cunningham <joel.cunningham@me.com>
+ *
+ */
+#include "lwip/opt.h"
+
+#if LWIP_SOCKET
+
+#include "lwip/errno.h"
+#include "lwip/if_api.h"
+#include "lwip/netifapi.h"
+#include "lwip/priv/sockets_priv.h"
+
+/**
+ * @ingroup if_api
+ * Maps an interface index to its corresponding name.
+ * @param ifindex interface index
+ * @param ifname shall point to a buffer of at least {IF_NAMESIZE} bytes
+ * @return If ifindex is an interface index, then the function shall return the
+ * value supplied in ifname, which points to a buffer now containing the interface name.
+ * Otherwise, the function shall return a NULL pointer.
+ */
+char *
+lwip_if_indextoname(unsigned int ifindex, char *ifname)
+{
+#if LWIP_NETIF_API
+  if (ifindex <= 0xff) {
+    err_t err = netifapi_netif_index_to_name((u8_t)ifindex, ifname);
+    if (!err && ifname[0] != '\0') {
+      return ifname;
+    }
+  }
+#else /* LWIP_NETIF_API */
+  LWIP_UNUSED_ARG(ifindex);
+  LWIP_UNUSED_ARG(ifname);
+#endif /* LWIP_NETIF_API */
+  set_errno(ENXIO);
+  return NULL;
+}
+
+/**
+ * @ingroup if_api
+ * Returs the interface index corresponding to name ifname.
+ * @param ifname Interface name
+ * @return The corresponding index if ifname is the name of an interface;
+ * otherwise, zero.
+ */
+unsigned int
+lwip_if_nametoindex(const char *ifname)
+{
+#if LWIP_NETIF_API
+  err_t err;
+  u8_t idx;
+
+  err = netifapi_netif_name_to_index(ifname, &idx);
+  if (!err) {
+    return idx;
+  }
+#else /* LWIP_NETIF_API */
+  LWIP_UNUSED_ARG(ifname);
+#endif /* LWIP_NETIF_API */
+  return 0; /* invalid index */
+}
+
+#endif /* LWIP_SOCKET */
--- a/src/api/netbuf.c
+++ b/src/api/netbuf.c
@@ -131,6 +131,10 @@ netbuf_free(struct netbuf *buf)
    pbuf_free(buf->p);
  }
  buf->p = buf->ptr = NULL;
+#if LWIP_CHECKSUM_ON_COPY
+  buf->flags = 0;
+  buf->toport_chksum = 0;
+#endif /* LWIP_CHECKSUM_ON_COPY */
 }

 /**
--- a/src/api/netdb.c
+++ b/src/api/netdb.c
@@ -46,8 +46,8 @@
 #include "lwip/api.h"
 #include "lwip/dns.h"

-#include <string.h>
-#include <stdlib.h>
+#include <string.h> /* memset */
+#include <stdlib.h> /* atoi */

 /** helper struct for gethostbyname_r to access the char* buffer */
 struct gethostbyname_r_helper {
@@ -128,8 +128,7 @@ lwip_gethostbyname(const char *name)
  if (s_hostent.h_addr_list != NULL) {
    u8_t idx;
    for (idx = 0; s_hostent.h_addr_list[idx]; idx++) {
-      LWIP_DEBUGF(DNS_DEBUG, ("hostent.h_addr_list[%i]   == %p\n", idx, s_hostent.h_addr_list[idx]));
-      LWIP_DEBUGF(DNS_DEBUG, ("hostent.h_addr_list[%i]-> == %s\n", idx, ipaddr_ntoa((ip_addr_t*)s_hostent.h_addr_list[idx])));
+      LWIP_DEBUGF(DNS_DEBUG, ("hostent.h_addr_list[%i]-> == %s\n", idx, ipaddr_ntoa(s_phostent_addr[idx])));
    }
  }
 #endif /* DNS_DEBUG */
@@ -187,7 +186,7 @@ lwip_gethostbyname_r(const char *name, struct hostent *ret, char *buf,
  }

  namelen = strlen(name);
-  if (buflen < (sizeof(struct gethostbyname_r_helper) + namelen + 1 + (MEM_ALIGNMENT - 1))) {
+  if (buflen < (sizeof(struct gethostbyname_r_helper) + LWIP_MEM_ALIGN_BUFFER(namelen + 1))) {
    /* buf can't hold the data needed + a copy of name */
    *h_errnop = ERANGE;
    return -1;
@@ -306,7 +305,11 @@ lwip_getaddrinfo(const char *nodename, const char *servname,
    /* service name specified: convert to port number
     * @todo?: currently, only ASCII integers (port numbers) are supported (AI_NUMERICSERV)! */
    port_nr = atoi(servname);
-    if ((port_nr <= 0) || (port_nr > 0xffff)) {
+    if (port_nr == 0 && (servname[0] != '0')) {
+      /* atoi failed - service was not numeric */
+      return EAI_SERVICE;
+    }
+    if ((port_nr < 0) || (port_nr > 0xffff)) {
      return EAI_SERVICE;
    }
  }
@@ -342,9 +345,9 @@ lwip_getaddrinfo(const char *nodename, const char *servname,
  } else {
    /* service location specified, use loopback address */
    if ((hints != NULL) && (hints->ai_flags & AI_PASSIVE)) {
-      ip_addr_set_any(ai_family == AF_INET6, &addr);
+      ip_addr_set_any_val(ai_family == AF_INET6, addr);
    } else {
-      ip_addr_set_loopback(ai_family == AF_INET6, &addr);
+      ip_addr_set_loopback_val(ai_family == AF_INET6, addr);
    }
  }

@@ -376,13 +379,14 @@ lwip_getaddrinfo(const char *nodename, const char *servname,
    sa6->sin6_family = AF_INET6;
    sa6->sin6_len = sizeof(struct sockaddr_in6);
    sa6->sin6_port = lwip_htons((u16_t)port_nr);
+    sa6->sin6_scope_id = ip6_addr_zone(ip_2_ip6(&addr));
    ai->ai_family = AF_INET6;
 #endif /* LWIP_IPV6 */
  } else {
 #if LWIP_IPV4
    struct sockaddr_in *sa4 = (struct sockaddr_in *)sa;
    /* set up sockaddr */
-    inet_addr_from_ipaddr(&sa4->sin_addr, ip_2_ip4(&addr));
+    inet_addr_from_ip4addr(&sa4->sin_addr, ip_2_ip4(&addr));
    sa4->sin_family = AF_INET;
    sa4->sin_len = sizeof(struct sockaddr_in);
    sa4->sin_port = lwip_htons((u16_t)port_nr);
--- a/src/api/netifapi.c
+++ b/src/api/netifapi.c
@@ -42,10 +42,13 @@

 #if LWIP_NETIF_API /* don't build if not configured for use in lwipopts.h */

+#include "lwip/etharp.h"
 #include "lwip/netifapi.h"
 #include "lwip/memp.h"
 #include "lwip/priv/tcpip_priv.h"

+#include <string.h> /* strncpy */
+
 #define NETIFAPI_VAR_REF(name)      API_VAR_REF(name)
 #define NETIFAPI_VAR_DECLARE(name)  API_VAR_DECLARE(struct netifapi_msg, name)
 #define NETIFAPI_VAR_ALLOC(name)    API_VAR_ALLOC(struct netifapi_msg, MEMP_NETIFAPI_MSG, name, ERR_MEM)
@@ -95,6 +98,37 @@ netifapi_do_netif_set_addr(struct tcpip_api_call_data *m)
 }
 #endif /* LWIP_IPV4 */

+/**
+* Call netif_name_to_index() inside the tcpip_thread context.
+*/
+static err_t
+netifapi_do_name_to_index(struct tcpip_api_call_data *m)
+{
+  /* cast through void* to silence alignment warnings.
+   * We know it works because the structs have been instantiated as struct netifapi_msg */
+  struct netifapi_msg *msg = (struct netifapi_msg *)(void *)m;
+
+  msg->msg.ifs.index = netif_name_to_index(msg->msg.ifs.name);
+  return ERR_OK;
+}
+
+/**
+* Call netif_index_to_name() inside the tcpip_thread context.
+*/
+static err_t
+netifapi_do_index_to_name(struct tcpip_api_call_data *m)
+{
+  /* cast through void* to silence alignment warnings.
+   * We know it works because the structs have been instantiated as struct netifapi_msg */
+  struct netifapi_msg *msg = (struct netifapi_msg *)(void *)m;
+
+  if (!netif_index_to_name(msg->msg.ifs.index, msg->msg.ifs.name)) {
+    /* return failure via empty name */
+    msg->msg.ifs.name[0] = '\0';
+  }
+  return ERR_OK;
+}
+
 /**
 * Call the "errtfunc" (or the "voidfunc" if "errtfunc" is NULL) inside the
 * tcpip_thread context.
@@ -114,6 +148,69 @@ netifapi_do_netif_common(struct tcpip_api_call_data *m)
  }
 }

+#if LWIP_ARP && LWIP_IPV4
+/**
+ * @ingroup netifapi_arp
+ * Add or update an entry in the ARP cache.
+ * For an update, ipaddr is used to find the cache entry.
+ *
+ * @param ipaddr IPv4 address of cache entry
+ * @param ethaddr hardware address mapped to ipaddr
+ * @param type type of ARP cache entry
+ * @return ERR_OK: entry added/updated, else error from err_t
+ */
+err_t
+netifapi_arp_add(const ip4_addr_t *ipaddr, struct eth_addr *ethaddr, enum netifapi_arp_entry type)
+{
+  err_t err;
+
+  /* We only support permanent entries currently */
+  LWIP_UNUSED_ARG(type);
+
+#if ETHARP_SUPPORT_STATIC_ENTRIES && LWIP_TCPIP_CORE_LOCKING
+  LOCK_TCPIP_CORE();
+  err = etharp_add_static_entry(ipaddr, ethaddr);
+  UNLOCK_TCPIP_CORE();
+#else
+  /* @todo add new vars to struct netifapi_msg and create a 'do' func */
+  LWIP_UNUSED_ARG(ipaddr);
+  LWIP_UNUSED_ARG(ethaddr);
+  err = ERR_VAL;
+#endif /* ETHARP_SUPPORT_STATIC_ENTRIES && LWIP_TCPIP_CORE_LOCKING */
+
+  return err;
+}
+
+/**
+ * @ingroup netifapi_arp
+ * Remove an entry in the ARP cache identified by ipaddr
+ *
+ * @param ipaddr IPv4 address of cache entry
+ * @param type type of ARP cache entry
+ * @return ERR_OK: entry removed, else error from err_t
+ */
+err_t
+netifapi_arp_remove(const ip4_addr_t *ipaddr, enum netifapi_arp_entry type)
+{
+  err_t err;
+
+  /* We only support permanent entries currently */
+  LWIP_UNUSED_ARG(type);
+
+#if ETHARP_SUPPORT_STATIC_ENTRIES && LWIP_TCPIP_CORE_LOCKING
+  LOCK_TCPIP_CORE();
+  err = etharp_remove_static_entry(ipaddr);
+  UNLOCK_TCPIP_CORE();
+#else
+  /* @todo add new vars to struct netifapi_msg and create a 'do' func */
+  LWIP_UNUSED_ARG(ipaddr);
+  err = ERR_VAL;
+#endif /* ETHARP_SUPPORT_STATIC_ENTRIES && LWIP_TCPIP_CORE_LOCKING */
+
+  return err;
+}
+#endif /* LWIP_ARP && LWIP_IPV4 */
+
 /**
 * @ingroup netifapi_netif
 * Call netif_add() in a thread-safe way by running that function inside the
@@ -218,4 +315,66 @@ netifapi_netif_common(struct netif *netif, netifapi_void_fn voidfunc,
  return err;
 }

+/**
+* @ingroup netifapi_netif
+* Call netif_name_to_index() in a thread-safe way by running that function inside the
+* tcpip_thread context.
+*
+* @param name the interface name of the netif
+* @param idx output index of the found netif
+*/
+err_t
+netifapi_netif_name_to_index(const char *name, u8_t *idx)
+{
+  err_t err;
+  NETIFAPI_VAR_DECLARE(msg);
+  NETIFAPI_VAR_ALLOC(msg);
+
+  *idx = 0;
+
+#if LWIP_MPU_COMPATIBLE
+  strncpy(NETIFAPI_VAR_REF(msg).msg.ifs.name, name, NETIF_NAMESIZE - 1);
+  NETIFAPI_VAR_REF(msg).msg.ifs.name[NETIF_NAMESIZE - 1] = '\0';
+#else
+  NETIFAPI_VAR_REF(msg).msg.ifs.name = LWIP_CONST_CAST(char *, name);
+#endif /* LWIP_MPU_COMPATIBLE */
+  err = tcpip_api_call(netifapi_do_name_to_index, &API_VAR_REF(msg).call);
+  if (!err) {
+    *idx = NETIFAPI_VAR_REF(msg).msg.ifs.index;
+  }
+  NETIFAPI_VAR_FREE(msg);
+  return err;
+}
+
+/**
+* @ingroup netifapi_netif
+* Call netif_index_to_name() in a thread-safe way by running that function inside the
+* tcpip_thread context.
+*
+* @param idx the interface index of the netif
+* @param name output name of the found netif, empty '\0' string if netif not found.
+*             name should be of at least NETIF_NAMESIZE bytes
+*/
+err_t
+netifapi_netif_index_to_name(u8_t idx, char *name)
+{
+  err_t err;
+  NETIFAPI_VAR_DECLARE(msg);
+  NETIFAPI_VAR_ALLOC(msg);
+
+  NETIFAPI_VAR_REF(msg).msg.ifs.index = idx;
+#if !LWIP_MPU_COMPATIBLE
+  NETIFAPI_VAR_REF(msg).msg.ifs.name = name;
+#endif /* LWIP_MPU_COMPATIBLE */
+  err = tcpip_api_call(netifapi_do_index_to_name, &API_VAR_REF(msg).call);
+#if LWIP_MPU_COMPATIBLE
+  if (!err) {
+    strncpy(name, NETIFAPI_VAR_REF(msg).msg.ifs.name, NETIF_NAMESIZE - 1);
+    name[NETIF_NAMESIZE - 1] = '\0';
+  }
+#endif /* LWIP_MPU_COMPATIBLE */
+  NETIFAPI_VAR_FREE(msg);
+  return err;
+}
+
 #endif /* LWIP_NETIF_API */
--- a/src/api/sockets.c
+++ b/src/api/sockets.c
--- a/src/api/tcpip.c
+++ b/src/api/tcpip.c
@@ -50,6 +50,8 @@
 #include "lwip/etharp.h"
 #include "netif/ethernet.h"

+#include "osdep_service.h"
+
 #define TCPIP_MSG_VAR_REF(name)     API_VAR_REF(name)
 #define TCPIP_MSG_VAR_DECLARE(name) API_VAR_DECLARE(struct tcpip_msg, name)
 #define TCPIP_MSG_VAR_ALLOC(name)   API_VAR_ALLOC(struct tcpip_msg, MEMP_TCPIP_MSG_API, name, ERR_MEM)
@@ -58,20 +60,60 @@
 /* global variables */
 static tcpip_init_done_fn tcpip_init_done;
 static void *tcpip_init_done_arg;
-static sys_mbox_t mbox;
+static sys_mbox_t tcpip_mbox;

 #if LWIP_TCPIP_CORE_LOCKING
 /** The global semaphore to lock the stack. */
 sys_mutex_t lock_tcpip_core;
 #endif /* LWIP_TCPIP_CORE_LOCKING */

-#if LWIP_TIMERS
-/* wait for a message, timeouts are processed while waiting */
-#define TCPIP_MBOX_FETCH(mbox, msg) sys_timeouts_mbox_fetch(mbox, msg)
-#else /* LWIP_TIMERS */
+static void tcpip_thread_handle_msg(struct tcpip_msg *msg);
+
+#if !LWIP_TIMERS
 /* wait for a message with timers disabled (e.g. pass a timer-check trigger into tcpip_thread) */
 #define TCPIP_MBOX_FETCH(mbox, msg) sys_mbox_fetch(mbox, msg)
-#endif /* LWIP_TIMERS */
+#else /* !LWIP_TIMERS */
+/* wait for a message, timeouts are processed while waiting */
+#define TCPIP_MBOX_FETCH(mbox, msg) tcpip_timeouts_mbox_fetch(mbox, msg)
+/**
+ * Wait (forever) for a message to arrive in an mbox.
+ * While waiting, timeouts are processed.
+ *
+ * @param mbox the mbox to fetch the message from
+ * @param msg the place to store the message
+ */
+static void
+tcpip_timeouts_mbox_fetch(sys_mbox_t *mbox, void **msg)
+{
+  u32_t sleeptime, res;
+
+again:
+  LWIP_ASSERT_CORE_LOCKED();
+
+  sleeptime = sys_timeouts_sleeptime();
+  if (sleeptime == SYS_TIMEOUTS_SLEEPTIME_INFINITE) {
+    UNLOCK_TCPIP_CORE();
+    sys_arch_mbox_fetch(mbox, msg, 0);
+    LOCK_TCPIP_CORE();
+    return;
+  } else if (sleeptime == 0) {
+    sys_check_timeouts();
+    /* We try again to fetch a message from the mbox. */
+    goto again;
+  }
+
+  UNLOCK_TCPIP_CORE();
+  res = sys_arch_mbox_fetch(mbox, msg, sleeptime);
+  LOCK_TCPIP_CORE();
+  if (res == SYS_ARCH_TIMEOUT) {
+    /* If a SYS_ARCH_TIMEOUT value is returned, a timeout occurred
+       before a message could be fetched. */
+    sys_check_timeouts();
+    /* We try again to fetch a message from the mbox. */
+    goto again;
+  }
+}
+#endif /* !LWIP_TIMERS */

 /**
 * The main lwIP thread. This thread has exclusive access to lwIP core functions
@@ -89,22 +131,32 @@ tcpip_thread(void *arg)
  struct tcpip_msg *msg;
  LWIP_UNUSED_ARG(arg);

+  LWIP_MARK_TCPIP_THREAD();
+
+  LOCK_TCPIP_CORE();
  if (tcpip_init_done != NULL) {
    tcpip_init_done(tcpip_init_done_arg);
  }

-  LOCK_TCPIP_CORE();
  while (1) {                          /* MAIN Loop */
-    UNLOCK_TCPIP_CORE();
    LWIP_TCPIP_THREAD_ALIVE();
    /* wait for a message, timeouts are processed while waiting */
-    TCPIP_MBOX_FETCH(&mbox, (void **)&msg);
-    LOCK_TCPIP_CORE();
+    TCPIP_MBOX_FETCH(&tcpip_mbox, (void **)&msg);
    if (msg == NULL) {
      LWIP_DEBUGF(TCPIP_DEBUG, ("tcpip_thread: invalid message: NULL\n"));
      LWIP_ASSERT("tcpip_thread: invalid message", 0);
      continue;
    }
+    tcpip_thread_handle_msg(msg);
+  }
+}
+
+/* Handle a single tcpip_msg
+ * This is in its own function for access by tests only.
+ */
+static void
+tcpip_thread_handle_msg(struct tcpip_msg *msg)
+{
  switch (msg->type) {
 #if !LWIP_TCPIP_CORE_LOCKING
    case TCPIP_MSG_API:
@@ -121,7 +173,9 @@ tcpip_thread(void *arg)
 #if !LWIP_TCPIP_CORE_LOCKING_INPUT
    case TCPIP_MSG_INPKT:
      LWIP_DEBUGF(TCPIP_DEBUG, ("tcpip_thread: PACKET %p\n", (void *)msg));
-      msg->msg.inp.input_fn(msg->msg.inp.p, msg->msg.inp.netif);
+      if (msg->msg.inp.input_fn(msg->msg.inp.p, msg->msg.inp.netif) != ERR_OK) {
+        pbuf_free(msg->msg.inp.p);
+      }
      memp_free(MEMP_TCPIP_MSG_INPKT, msg);
      break;
 #endif /* !LWIP_TCPIP_CORE_LOCKING_INPUT */
@@ -156,7 +210,26 @@ tcpip_thread(void *arg)
      break;
  }
 }
+
+#ifdef TCPIP_THREAD_TEST
+/** Work on queued items in single-threaded test mode */
+int
+tcpip_thread_poll_one(void)
+{
+  int ret = 0;
+  struct tcpip_msg *msg;
+
+  if (sys_arch_mbox_tryfetch(&tcpip_mbox, (void **)&msg) != SYS_MBOX_EMPTY) {
+    LOCK_TCPIP_CORE();
+    if (msg != NULL) {
+      tcpip_thread_handle_msg(msg);
+      ret = 1;
    }
+    UNLOCK_TCPIP_CORE();
+  }
+  return ret;
+}
+#endif

 /**
 * Pass a received packet to tcpip_thread for input processing
@@ -178,7 +251,7 @@ tcpip_inpkt(struct pbuf *p, struct netif *inp, netif_input_fn input_fn)
 #else /* LWIP_TCPIP_CORE_LOCKING_INPUT */
  struct tcpip_msg *msg;

-  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(mbox));
+  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(tcpip_mbox));

  msg = (struct tcpip_msg *)memp_malloc(MEMP_TCPIP_MSG_INPKT);
  if (msg == NULL) {
@@ -189,7 +262,7 @@ tcpip_inpkt(struct pbuf *p, struct netif *inp, netif_input_fn input_fn)
  msg->msg.inp.p = p;
  msg->msg.inp.netif = inp;
  msg->msg.inp.input_fn = input_fn;
-  if (sys_mbox_trypost(&mbox, msg) != ERR_OK) {
+  if (sys_mbox_trypost(&tcpip_mbox, msg) != ERR_OK) {
    memp_free(MEMP_TCPIP_MSG_INPKT, msg);
    return ERR_MEM;
  }
@@ -220,22 +293,26 @@ tcpip_input(struct pbuf *p, struct netif *inp)
 }

 /**
+ * @ingroup lwip_os
 * Call a specific function in the thread context of
 * tcpip_thread for easy access synchronization.
 * A function called in that way may access lwIP core code
 * without fearing concurrent access.
+ * Blocks until the request is posted.
+ * Must not be called from interrupt context!
 *
 * @param function the function to call
 * @param ctx parameter passed to f
- * @param block 1 to block until the request is posted, 0 to non-blocking mode
 * @return ERR_OK if the function was called, another err_t if not
+ *
+ * @see tcpip_try_callback
 */
 err_t
-tcpip_callback_with_block(tcpip_callback_fn function, void *ctx, u8_t block)
+tcpip_callback(tcpip_callback_fn function, void *ctx)
 {
  struct tcpip_msg *msg;

-  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(mbox));
+  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(tcpip_mbox));

  msg = (struct tcpip_msg *)memp_malloc(MEMP_TCPIP_MSG_API);
  if (msg == NULL) {
@@ -245,13 +322,46 @@ tcpip_callback_with_block(tcpip_callback_fn function, void *ctx, u8_t block)
  msg->type = TCPIP_MSG_CALLBACK;
  msg->msg.cb.function = function;
  msg->msg.cb.ctx = ctx;
-  if (block) {
-    sys_mbox_post(&mbox, msg);
-  } else {
-    if (sys_mbox_trypost(&mbox, msg) != ERR_OK) {
-      memp_free(MEMP_TCPIP_MSG_API, msg);
+
+  sys_mbox_post(&tcpip_mbox, msg);
+  return ERR_OK;
+}
+
+/**
+ * @ingroup lwip_os
+ * Call a specific function in the thread context of
+ * tcpip_thread for easy access synchronization.
+ * A function called in that way may access lwIP core code
+ * without fearing concurrent access.
+ * Does NOT block when the request cannot be posted because the
+ * tcpip_mbox is full, but returns ERR_MEM instead.
+ * Can be called from interrupt context.
+ *
+ * @param function the function to call
+ * @param ctx parameter passed to f
+ * @return ERR_OK if the function was called, another err_t if not
+ *
+ * @see tcpip_callback
+ */
+err_t
+tcpip_try_callback(tcpip_callback_fn function, void *ctx)
+{
+  struct tcpip_msg *msg;
+
+  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(tcpip_mbox));
+
+  msg = (struct tcpip_msg *)memp_malloc(MEMP_TCPIP_MSG_API);
+  if (msg == NULL) {
    return ERR_MEM;
  }
+
+  msg->type = TCPIP_MSG_CALLBACK;
+  msg->msg.cb.function = function;
+  msg->msg.cb.ctx = ctx;
+
+  if (sys_mbox_trypost(&tcpip_mbox, msg) != ERR_OK) {
+    memp_free(MEMP_TCPIP_MSG_API, msg);
+    return ERR_MEM;
  }
  return ERR_OK;
 }
@@ -270,7 +380,7 @@ tcpip_timeout(u32_t msecs, sys_timeout_handler h, void *arg)
 {
  struct tcpip_msg *msg;

-  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(mbox));
+  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(tcpip_mbox));

  msg = (struct tcpip_msg *)memp_malloc(MEMP_TCPIP_MSG_API);
  if (msg == NULL) {
@@ -281,7 +391,7 @@ tcpip_timeout(u32_t msecs, sys_timeout_handler h, void *arg)
  msg->msg.tmo.msecs = msecs;
  msg->msg.tmo.h = h;
  msg->msg.tmo.arg = arg;
-  sys_mbox_post(&mbox, msg);
+  sys_mbox_post(&tcpip_mbox, msg);
  return ERR_OK;
 }

@@ -297,7 +407,7 @@ tcpip_untimeout(sys_timeout_handler h, void *arg)
 {
  struct tcpip_msg *msg;

-  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(mbox));
+  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(tcpip_mbox));

  msg = (struct tcpip_msg *)memp_malloc(MEMP_TCPIP_MSG_API);
  if (msg == NULL) {
@@ -307,7 +417,7 @@ tcpip_untimeout(sys_timeout_handler h, void *arg)
  msg->type = TCPIP_MSG_UNTIMEOUT;
  msg->msg.tmo.h = h;
  msg->msg.tmo.arg = arg;
-  sys_mbox_post(&mbox, msg);
+  sys_mbox_post(&tcpip_mbox, msg);
  return ERR_OK;
 }
 #endif /* LWIP_TCPIP_TIMEOUT && LWIP_TIMERS */
@@ -338,14 +448,19 @@ tcpip_send_msg_wait_sem(tcpip_callback_fn fn, void *apimsg, sys_sem_t* sem)
  TCPIP_MSG_VAR_DECLARE(msg);

  LWIP_ASSERT("semaphore not initialized", sys_sem_valid(sem));
-  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(mbox));
+  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(tcpip_mbox));
+
+  UBaseType_t prio = uxTaskPriorityGet(NULL);       // add to prevent switch to tcpip thread between mbox post and sem wait
+  if((TCPIP_THREAD_PRIO + 1) > prio)
+    vTaskPrioritySet(NULL, TCPIP_THREAD_PRIO + 1);  // set priority higher than tcpip thread

  TCPIP_MSG_VAR_ALLOC(msg);
  TCPIP_MSG_VAR_REF(msg).type = TCPIP_MSG_API;
  TCPIP_MSG_VAR_REF(msg).msg.api_msg.function = fn;
  TCPIP_MSG_VAR_REF(msg).msg.api_msg.msg = apimsg;
-  sys_mbox_post(&mbox, &TCPIP_MSG_VAR_REF(msg));
+  sys_mbox_post(&tcpip_mbox, &TCPIP_MSG_VAR_REF(msg));
  sys_arch_sem_wait(sem, 0);
+  vTaskPrioritySet(NULL, prio);                     // restore to original priority
  TCPIP_MSG_VAR_FREE(msg);
  return ERR_OK;
 #endif /* LWIP_TCPIP_CORE_LOCKING */
@@ -380,7 +495,7 @@ tcpip_api_call(tcpip_api_call_fn fn, struct tcpip_api_call_data *call)
  }
 #endif /* LWIP_NETCONN_SEM_PER_THREAD */

-  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(mbox));
+  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(tcpip_mbox));

  TCPIP_MSG_VAR_ALLOC(msg);
  TCPIP_MSG_VAR_REF(msg).type = TCPIP_MSG_API_CALL;
@@ -391,7 +506,7 @@ tcpip_api_call(tcpip_api_call_fn fn, struct tcpip_api_call_data *call)
 #else /* LWIP_NETCONN_SEM_PER_THREAD */
  TCPIP_MSG_VAR_REF(msg).msg.api_call.sem = &call->sem;
 #endif /* LWIP_NETCONN_SEM_PER_THREAD */
-  sys_mbox_post(&mbox, &TCPIP_MSG_VAR_REF(msg));
+  sys_mbox_post(&tcpip_mbox, &TCPIP_MSG_VAR_REF(msg));
  sys_arch_sem_wait(TCPIP_MSG_VAR_REF(msg).msg.api_call.sem, 0);
  TCPIP_MSG_VAR_FREE(msg);

@@ -404,12 +519,20 @@ tcpip_api_call(tcpip_api_call_fn fn, struct tcpip_api_call_data *call)
 }

 /**
+ * @ingroup lwip_os
 * Allocate a structure for a static callback message and initialize it.
- * This is intended to be used to send "static" messages from interrupt context.
+ * The message has a special type such that lwIP never frees it.
+ * This is intended to be used to send "static" messages from interrupt context,
+ * e.g. the message is allocated once and posted several times from an IRQ
+ * using tcpip_callbackmsg_trycallback().
+ * Example usage: Trigger execution of an ethernet IRQ DPC routine in lwIP thread context.
 * 
 * @param function the function to call
 * @param ctx parameter passed to function
- * @return a struct pointer to pass to tcpip_trycallback().
+ * @return a struct pointer to pass to tcpip_callbackmsg_trycallback().
+ *
+ * @see tcpip_callbackmsg_trycallback()
+ * @see tcpip_callbackmsg_delete()
 */
 struct tcpip_callback_msg *
 tcpip_callbackmsg_new(tcpip_callback_fn function, void *ctx)
@@ -425,9 +548,12 @@ tcpip_callbackmsg_new(tcpip_callback_fn function, void *ctx)
 }

 /**
+ * @ingroup lwip_os
 * Free a callback message allocated by tcpip_callbackmsg_new().
 *
 * @param msg the message to free
+ *
+ * @see tcpip_callbackmsg_new()
 */
 void
 tcpip_callbackmsg_delete(struct tcpip_callback_msg *msg)
@@ -436,17 +562,38 @@ tcpip_callbackmsg_delete(struct tcpip_callback_msg* msg)
 }

 /**
- * Try to post a callback-message to the tcpip_thread mbox
- * This is intended to be used to send "static" messages from interrupt context.
+ * @ingroup lwip_os
+ * Try to post a callback-message to the tcpip_thread tcpip_mbox.
 *
 * @param msg pointer to the message to post
 * @return sys_mbox_trypost() return code
+ *
+ * @see tcpip_callbackmsg_new()
 */
 err_t
-tcpip_trycallback(struct tcpip_callback_msg* msg)
+tcpip_callbackmsg_trycallback(struct tcpip_callback_msg *msg)
 {
-  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(mbox));
-  return sys_mbox_trypost(&mbox, msg);
+  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(tcpip_mbox));
+  return sys_mbox_trypost(&tcpip_mbox, msg);
+}
+
+/**
+ * @ingroup lwip_os
+ * Try to post a callback-message to the tcpip_thread mbox.
+ * Same as @ref tcpip_callbackmsg_trycallback but calls sys_mbox_trypost_fromisr(),
+ * mainly to help FreeRTOS, where calls differ between task level and ISR level.
+ *
+ * @param msg pointer to the message to post
+ * @return sys_mbox_trypost_fromisr() return code (without change, so this
+ *         knowledge can be used to e.g. propagate "bool needs_scheduling")
+ *
+ * @see tcpip_callbackmsg_new()
+ */
+err_t
+tcpip_callbackmsg_trycallback_fromisr(struct tcpip_callback_msg *msg)
+{
+  LWIP_ASSERT("Invalid mbox", sys_mbox_valid_val(tcpip_mbox));
+  return sys_mbox_trypost_fromisr(&tcpip_mbox, msg);
 }

 /**
@@ -465,7 +612,7 @@ tcpip_init(tcpip_init_done_fn initfunc, void *arg)

  tcpip_init_done = initfunc;
  tcpip_init_done_arg = arg;
-  if (sys_mbox_new(&mbox, TCPIP_MBOX_SIZE) != ERR_OK) {
+  if (sys_mbox_new(&tcpip_mbox, TCPIP_MBOX_SIZE) != ERR_OK) {
    LWIP_ASSERT("failed to create tcpip_thread mbox", 0);
  }
 #if LWIP_TCPIP_CORE_LOCKING
@@ -473,8 +620,11 @@ tcpip_init(tcpip_init_done_fn initfunc, void *arg)
    LWIP_ASSERT("failed to create lock_tcpip_core", 0);
  }
 #endif /* LWIP_TCPIP_CORE_LOCKING */
-
+#if CONFIG_USE_TCM_HEAP
+	sys_thread_new_tcm(TCPIP_THREAD_NAME, tcpip_thread, NULL, TCPIP_THREAD_STACKSIZE, TCPIP_THREAD_PRIO);
+#else
 	sys_thread_new(TCPIP_THREAD_NAME, tcpip_thread, NULL, TCPIP_THREAD_STACKSIZE, TCPIP_THREAD_PRIO);
+#endif
 }

 /**
@@ -499,7 +649,7 @@ pbuf_free_int(void *p)
 err_t
 pbuf_free_callback(struct pbuf *p)
 {
-  return tcpip_callback_with_block(pbuf_free_int, p, 0);
+  return tcpip_try_callback(pbuf_free_int, p);
 }

 /**
@@ -512,7 +662,7 @@ pbuf_free_callback(struct pbuf *p)
 err_t
 mem_free_callback(void *m)
 {
-  return tcpip_callback_with_block(mem_free, m, 0);
+  return tcpip_try_callback(mem_free, m);
 }

 #endif /* !NO_SYS */
--- a/src/apps/altcp_tls/altcp_tls_mbedtls.c
+++ b/src/apps/altcp_tls/altcp_tls_mbedtls.c
--- a/src/apps/altcp_tls/altcp_tls_mbedtls_mem.c
+++ b/src/apps/altcp_tls/altcp_tls_mbedtls_mem.c
@@ -0,0 +1,210 @@
+/**
+ * @file
+ * Application layered TCP connection API (to be used from TCPIP thread)
+ *
+ * This file contains memory management functions for a TLS layer using mbedTLS.
+ *
+ * ATTENTION: For production usage, you might want to override this file with
+ *            your own implementation since this implementation simply uses the
+ *            lwIP heap without caring for fragmentation or leaving heap for
+ *            other parts of lwIP!
+ */
+
+/*
+ * Copyright (c) 2017 Simon Goldschmidt
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ *
+ * Author: Simon Goldschmidt <goldsimon@gmx.de>
+ *
+ * Missing things / @todo:
+ * - RX data is acknowledged after receiving (tcp_recved is called when enqueueing
+ *   the pbuf for mbedTLS receive, not when processed by mbedTLS or the inner
+ *   connection; altcp_recved() from inner connection does nothing)
+ * - TX data is marked as 'sent' (i.e. acknowledged; sent callback is called) right
+ *   after enqueueing for transmission, not when actually ACKed be the remote host.
+ */
+
+#include "lwip/opt.h"
+
+#if LWIP_ALTCP /* don't build if not configured for use in lwipopts.h */
+
+#include "lwip/apps/altcp_tls_mbedtls_opts.h"
+
+#if LWIP_ALTCP_TLS && LWIP_ALTCP_TLS_MBEDTLS
+
+#include "altcp_tls_mbedtls_mem.h"
+#include "altcp_tls_mbedtls_structs.h"
+#include "lwip/mem.h"
+
+#include "mbedtls/platform.h"
+
+#include <string.h>
+
+#ifndef ALTCP_MBEDTLS_MEM_DEBUG
+#define ALTCP_MBEDTLS_MEM_DEBUG   LWIP_DBG_OFF
+#endif
+
+#if defined(MBEDTLS_PLATFORM_MEMORY) && \
+   (!defined(MBEDTLS_PLATFORM_FREE_MACRO) || \
+    defined(MBEDTLS_PLATFORM_CALLOC_MACRO))
+#define ALTCP_MBEDTLS_PLATFORM_ALLOC 1
+#else
+#define ALTCP_MBEDTLS_PLATFORM_ALLOC 0
+#endif
+
+#if ALTCP_MBEDTLS_PLATFORM_ALLOC
+
+#ifndef ALTCP_MBEDTLS_PLATFORM_ALLOC_STATS
+#define ALTCP_MBEDTLS_PLATFORM_ALLOC_STATS 0
+#endif
+
+/* This is an example/debug implementation of alloc/free functions only */
+typedef struct altcp_mbedtls_malloc_helper_s {
+  size_t c;
+  size_t len;
+} altcp_mbedtls_malloc_helper_t;
+
+#if ALTCP_MBEDTLS_PLATFORM_ALLOC_STATS
+typedef struct altcp_mbedtls_malloc_stats_s {
+  size_t allocedBytes;
+  size_t allocCnt;
+  size_t maxBytes;
+  size_t totalBytes;
+} altcp_mbedtls_malloc_stats_t;
+altcp_mbedtls_malloc_stats_t altcp_mbedtls_malloc_stats;
+volatile int altcp_mbedtls_malloc_clear_stats;
+#endif
+
+static void *
+tls_malloc(size_t c, size_t len)
+{
+  altcp_mbedtls_malloc_helper_t *hlpr;
+  void *ret;
+  size_t alloc_size;
+#if ALTCP_MBEDTLS_PLATFORM_ALLOC_STATS
+  if (altcp_mbedtls_malloc_clear_stats) {
+    altcp_mbedtls_malloc_clear_stats = 0;
+    memset(&altcp_mbedtls_malloc_stats, 0, sizeof(altcp_mbedtls_malloc_stats));
+  }
+#endif
+  alloc_size = sizeof(altcp_mbedtls_malloc_helper_t) + (c * len);
+  /* check for maximum allocation size, mainly to prevent mem_size_t overflow */
+  if (alloc_size > MEM_SIZE) {
+    LWIP_DEBUGF(ALTCP_MBEDTLS_MEM_DEBUG, ("mbedtls allocation too big: %c * %d bytes vs MEM_SIZE=%d",
+                                          (int)c, (int)len, (int)MEM_SIZE));
+    return NULL;
+  }
+  hlpr = (altcp_mbedtls_malloc_helper_t *)mem_malloc((mem_size_t)alloc_size);
+  if (hlpr == NULL) {
+    LWIP_DEBUGF(ALTCP_MBEDTLS_MEM_DEBUG, ("mbedtls alloc callback failed for %c * %d bytes", (int)c, (int)len));
+    return NULL;
+  }
+#if ALTCP_MBEDTLS_PLATFORM_ALLOC_STATS
+  altcp_mbedtls_malloc_stats.allocCnt++;
+  altcp_mbedtls_malloc_stats.allocedBytes += c * len;
+  if (altcp_mbedtls_malloc_stats.allocedBytes > altcp_mbedtls_malloc_stats.maxBytes) {
+    altcp_mbedtls_malloc_stats.maxBytes = altcp_mbedtls_malloc_stats.allocedBytes;
+  }
+  altcp_mbedtls_malloc_stats.totalBytes += c * len;
+#endif
+  hlpr->c = c;
+  hlpr->len = len;
+  ret = hlpr + 1;
+  /* zeroing the allocated chunk is required by mbedTLS! */
+  memset(ret, 0, c * len);
+  return ret;
+}
+
+static void
+tls_free(void *ptr)
+{
+  altcp_mbedtls_malloc_helper_t *hlpr;
+  if (ptr == NULL) {
+    /* this obviously happened in mbedtls... */
+    return;
+  }
+  hlpr = ((altcp_mbedtls_malloc_helper_t *)ptr) - 1;
+#if ALTCP_MBEDTLS_PLATFORM_ALLOC_STATS
+  if (!altcp_mbedtls_malloc_clear_stats) {
+    altcp_mbedtls_malloc_stats.allocedBytes -= hlpr->c * hlpr->len;
+  }
+#endif
+  mem_free(hlpr);
+}
+#endif /* ALTCP_MBEDTLS_PLATFORM_ALLOC*/
+
+void
+altcp_mbedtls_mem_init(void)
+{
+  /* not much to do here when using the heap */
+
+#if ALTCP_MBEDTLS_PLATFORM_ALLOC
+  /* set mbedtls allocation methods */
+  mbedtls_platform_set_calloc_free(&tls_malloc, &tls_free);
+#endif
+}
+
+altcp_mbedtls_state_t *
+altcp_mbedtls_alloc(void *conf)
+{
+  altcp_mbedtls_state_t *ret = (altcp_mbedtls_state_t *)mem_calloc(1, sizeof(altcp_mbedtls_state_t));
+  if (ret != NULL) {
+    ret->conf = conf;
+  }
+  return ret;
+}
+
+void
+altcp_mbedtls_free(void *conf, altcp_mbedtls_state_t *state)
+{
+  LWIP_UNUSED_ARG(conf);
+  LWIP_ASSERT("state != NULL", state != NULL);
+  mem_free(state);
+}
+
+void *
+altcp_mbedtls_alloc_config(size_t size)
+{
+  void *ret;
+  size_t checked_size = (mem_size_t)size;
+  if (size != checked_size) {
+    /* allocation too big (mem_size_t overflow) */
+    return NULL;
+  }
+  ret = (altcp_mbedtls_state_t *)mem_calloc(1, (mem_size_t)size);
+  return ret;
+}
+
+void
+altcp_mbedtls_free_config(void *item)
+{
+  LWIP_ASSERT("item != NULL", item != NULL);
+  mem_free(item);
+}
+
+#endif /* LWIP_ALTCP_TLS && LWIP_ALTCP_TLS_MBEDTLS */
+#endif /* LWIP_ALTCP */
--- a/src/apps/altcp_tls/altcp_tls_mbedtls_mem.h
+++ b/src/apps/altcp_tls/altcp_tls_mbedtls_mem.h
@@ -0,0 +1,72 @@
+/**
+ * @file
+ * Application layered TCP/TLS connection API (to be used from TCPIP thread)
+ *
+ * This file contains memory management function prototypes for a TLS layer using mbedTLS.
+ *
+ * Memory management contains:
+ * - allocating/freeing altcp_mbedtls_state_t
+ * - allocating/freeing memory used in the mbedTLS library
+ */
+
+/*
+ * Copyright (c) 2017 Simon Goldschmidt
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ *
+ * Author: Simon Goldschmidt <goldsimon@gmx.de>
+ *
+ */
+#ifndef LWIP_HDR_ALTCP_MBEDTLS_MEM_H
+#define LWIP_HDR_ALTCP_MBEDTLS_MEM_H
+
+#include "lwip/opt.h"
+
+#if LWIP_ALTCP /* don't build if not configured for use in lwipopts.h */
+
+#include "lwip/apps/altcp_tls_mbedtls_opts.h"
+
+#if LWIP_ALTCP_TLS && LWIP_ALTCP_TLS_MBEDTLS
+
+#include "altcp_tls_mbedtls_structs.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void altcp_mbedtls_mem_init(void);
+altcp_mbedtls_state_t *altcp_mbedtls_alloc(void *conf);
+void altcp_mbedtls_free(void *conf, altcp_mbedtls_state_t *state);
+void *altcp_mbedtls_alloc_config(size_t size);
+void altcp_mbedtls_free_config(void *item);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* LWIP_ALTCP_TLS && LWIP_ALTCP_TLS_MBEDTLS */
+#endif /* LWIP_ALTCP */
+#endif /* LWIP_HDR_ALTCP_MBEDTLS_MEM_H */
--- a/src/apps/altcp_tls/altcp_tls_mbedtls_structs.h
+++ b/src/apps/altcp_tls/altcp_tls_mbedtls_structs.h
@@ -0,0 +1,83 @@
+/**
+ * @file
+ * Application layered TCP/TLS connection API (to be used from TCPIP thread)
+ *
+ * This file contains structure definitions for a TLS layer using mbedTLS.
+ */
+
+/*
+ * Copyright (c) 2017 Simon Goldschmidt
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ *
+ * Author: Simon Goldschmidt <goldsimon@gmx.de>
+ *
+ */
+#ifndef LWIP_HDR_ALTCP_MBEDTLS_STRUCTS_H
+#define LWIP_HDR_ALTCP_MBEDTLS_STRUCTS_H
+
+#include "lwip/opt.h"
+
+#if LWIP_ALTCP /* don't build if not configured for use in lwipopts.h */
+
+#include "lwip/apps/altcp_tls_mbedtls_opts.h"
+
+#if LWIP_ALTCP_TLS && LWIP_ALTCP_TLS_MBEDTLS
+
+#include "lwip/altcp.h"
+#include "lwip/pbuf.h"
+
+#include "mbedtls/ssl.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define ALTCP_MBEDTLS_FLAGS_HANDSHAKE_DONE    0x01
+#define ALTCP_MBEDTLS_FLAGS_UPPER_CALLED      0x02
+#define ALTCP_MBEDTLS_FLAGS_RX_CLOSE_QUEUED   0x04
+#define ALTCP_MBEDTLS_FLAGS_RX_CLOSED         0x08
+#define ALTCP_MBEDTLS_FLAGS_APPLDATA_SENT     0x10
+
+typedef struct altcp_mbedtls_state_s {
+  void *conf;
+  mbedtls_ssl_context ssl_context;
+  /* chain of rx pbufs (before decryption) */
+  struct pbuf *rx;
+  struct pbuf *rx_app;
+  u8_t flags;
+  int rx_passed_unrecved;
+  int bio_bytes_read;
+  int bio_bytes_appl;
+} altcp_mbedtls_state_t;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* LWIP_ALTCP_TLS && LWIP_ALTCP_TLS_MBEDTLS */
+#endif /* LWIP_ALTCP */
+#endif /* LWIP_HDR_ALTCP_MBEDTLS_STRUCTS_H */
--- a/src/apps/http/altcp_proxyconnect.c
+++ b/src/apps/http/altcp_proxyconnect.c
@@ -0,0 +1,584 @@
+/**
+ * @file
+ * Application layered TCP connection API that executes a proxy-connect.
+ *
+ * This file provides a starting layer that executes a proxy-connect e.g. to
+ * set up TLS connections through a http proxy.
+ */
+
+/*
+ * Copyright (c) 2018 Simon Goldschmidt
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ *
+ * Author: Simon Goldschmidt <goldsimon@gmx.de>
+ *
+ */
+
+#include "lwip/apps/altcp_proxyconnect.h"
+
+#if LWIP_ALTCP /* don't build if not configured for use in lwipopts.h */
+
+#include "lwip/altcp.h"
+#include "lwip/priv/altcp_priv.h"
+
+#include "lwip/altcp_tcp.h"
+#include "lwip/altcp_tls.h"
+
+#include "lwip/mem.h"
+#include "lwip/init.h"
+
+#include <stdio.h>
+
+/** This string is passed in the HTTP header as "User-Agent: " */
+#ifndef ALTCP_PROXYCONNECT_CLIENT_AGENT
+#define ALTCP_PROXYCONNECT_CLIENT_AGENT "lwIP/" LWIP_VERSION_STRING " (http://savannah.nongnu.org/projects/lwip)"
+#endif
+
+#define ALTCP_PROXYCONNECT_FLAGS_CONNECT_STARTED  0x01
+#define ALTCP_PROXYCONNECT_FLAGS_HANDSHAKE_DONE   0x02
+
+typedef struct altcp_proxyconnect_state_s
+{
+  ip_addr_t outer_addr;
+  u16_t outer_port;
+  struct altcp_proxyconnect_config *conf;
+  u8_t flags;
+} altcp_proxyconnect_state_t;
+
+/* Variable prototype, the actual declaration is at the end of this file
+   since it contains pointers to static functions declared here */
+extern const struct altcp_functions altcp_proxyconnect_functions;
+
+/* memory management functions: */
+
+static altcp_proxyconnect_state_t *
+altcp_proxyconnect_state_alloc(void)
+{
+  altcp_proxyconnect_state_t *ret = (altcp_proxyconnect_state_t *)mem_calloc(1, sizeof(altcp_proxyconnect_state_t));
+  return ret;
+}
+
+static void
+altcp_proxyconnect_state_free(altcp_proxyconnect_state_t *state)
+{
+  LWIP_ASSERT("state != NULL", state != NULL);
+  mem_free(state);
+}
+
+/* helper functions */
+
+#define PROXY_CONNECT "CONNECT %s:%d HTTP/1.1\r\n" /* HOST, PORT */ \
+  "User-Agent: %s\r\n" /* User-Agent */\
+  "Proxy-Connection: keep-alive\r\n" \
+  "Connection: keep-alive\r\n" \
+  "\r\n"
+#define PROXY_CONNECT_FORMAT(host, port) PROXY_CONNECT, host, port, ALTCP_PROXYCONNECT_CLIENT_AGENT
+
+/* Format the http proxy connect request via snprintf */
+static int
+altcp_proxyconnect_format_request(char *buffer, size_t bufsize, const char *host, int port)
+{
+  return snprintf(buffer, bufsize, PROXY_CONNECT_FORMAT(host, port));
+}
+
+/* Create and send the http proxy connect request */
+static err_t
+altcp_proxyconnect_send_request(struct altcp_pcb *conn)
+{
+  int len, len2;
+  mem_size_t alloc_len;
+  char *buffer, *host;
+  altcp_proxyconnect_state_t *state = (altcp_proxyconnect_state_t *)conn->state;
+
+  if (!state) {
+    return ERR_VAL;
+  }
+  /* Use printf with zero length to get the required allocation size */
+  len = altcp_proxyconnect_format_request(NULL, 0, "", state->outer_port);
+  if (len < 0) {
+    return ERR_VAL;
+  }
+  /* add allocation size for IP address strings */
+#if LWIP_IPV6
+  len += 40; /* worst-case IPv6 address length */
+#else
+  len += 16; /* worst-case IPv4 address length */
+#endif
+  alloc_len = (mem_size_t)len;
+  if ((len < 0) || (int)alloc_len != len) {
+    /* overflow */
+    return ERR_MEM;
+  }
+  /* Allocate a bufer for the request string */
+  buffer = (char *)mem_malloc(alloc_len);
+  if (buffer == NULL) {
+    return ERR_MEM;
+  }
+  host = ipaddr_ntoa(&state->outer_addr);
+  len2 = altcp_proxyconnect_format_request(buffer, alloc_len, host, state->outer_port);
+  if ((len2 > 0) && (len2 <= len) && (len2 <= 0xFFFF)) {
+    err_t err = altcp_write(conn->inner_conn, buffer, (u16_t)len2, TCP_WRITE_FLAG_COPY);
+    if (err != ERR_OK) {
+      /* @todo: abort? */
+      mem_free(buffer);
+      return err;
+    }
+  }
+  mem_free(buffer);
+  return ERR_OK;
+}
+
+/* callback functions from inner/lower connection: */
+
+/** Connected callback from lower connection (i.e. TCP).
+ * Not really implemented/tested yet...
+ */
+static err_t
+altcp_proxyconnect_lower_connected(void *arg, struct altcp_pcb *inner_conn, err_t err)
+{
+  struct altcp_pcb *conn = (struct altcp_pcb *)arg;
+  if (conn && conn->state) {
+    LWIP_ASSERT("pcb mismatch", conn->inner_conn == inner_conn);
+    LWIP_UNUSED_ARG(inner_conn); /* for LWIP_NOASSERT */
+    /* upper connected is called when handshake is done */
+    if (err != ERR_OK) {
+      if (conn->connected) {
+        if (conn->connected(conn->arg, conn, err) == ERR_ABRT) {
+          return ERR_ABRT;
+        }
+        return ERR_OK;
+      }
+    }
+    /* send proxy connect request here */
+    return altcp_proxyconnect_send_request(conn);
+  }
+  return ERR_VAL;
+}
+
+/** Recv callback from lower connection (i.e. TCP)
+ * This one mainly differs between connection setup (wait for proxy OK string)
+ * and application phase (data is passed on to the application).
+ */
+static err_t
+altcp_proxyconnect_lower_recv(void *arg, struct altcp_pcb *inner_conn, struct pbuf *p, err_t err)
+{
+  altcp_proxyconnect_state_t *state;
+  struct altcp_pcb *conn = (struct altcp_pcb *)arg;
+
+  LWIP_ASSERT("no err expected", err == ERR_OK);
+  LWIP_UNUSED_ARG(err);
+
+  if (!conn) {
+    /* no connection given as arg? should not happen, but prevent pbuf/conn leaks */
+    if (p != NULL) {
+      pbuf_free(p);
+    }
+    altcp_close(inner_conn);
+    return ERR_CLSD;
+  }
+  state = (altcp_proxyconnect_state_t *)conn->state;
+  LWIP_ASSERT("pcb mismatch", conn->inner_conn == inner_conn);
+  if (!state) {
+    /* already closed */
+    if (p != NULL) {
+      pbuf_free(p);
+    }
+    altcp_close(inner_conn);
+    return ERR_CLSD;
+  }
+  if (state->flags & ALTCP_PROXYCONNECT_FLAGS_HANDSHAKE_DONE) {
+    /* application phase, just pass this through */
+    if (conn->recv) {
+      return conn->recv(conn->arg, conn, p, err);
+    }
+    pbuf_free(p);
+    return ERR_OK;
+  } else {
+    /* setup phase */
+    /* handle NULL pbuf (inner connection closed) */
+    if (p == NULL) {
+      if (altcp_close(conn) != ERR_OK) {
+        altcp_abort(conn);
+        return ERR_ABRT;
+      }
+      return ERR_OK;
+    } else {
+      /* @todo: parse setup phase rx data
+         for now, we just wait for the end of the header... */
+      u16_t idx = pbuf_memfind(p, "\r\n\r\n", 4, 0);
+      altcp_recved(inner_conn, p->tot_len);
+      pbuf_free(p);
+      if (idx != 0xFFFF) {
+        state->flags |= ALTCP_PROXYCONNECT_FLAGS_HANDSHAKE_DONE;
+        if (conn->connected) {
+          return conn->connected(conn->arg, conn, ERR_OK);
+        }
+      }
+      return ERR_OK;
+    }
+  }
+}
+
+/** Sent callback from lower connection (i.e. TCP)
+ * This only informs the upper layer to try to send more, not about
+ * the number of ACKed bytes.
+ */
+static err_t
+altcp_proxyconnect_lower_sent(void *arg, struct altcp_pcb *inner_conn, u16_t len)
+{
+  struct altcp_pcb *conn = (struct altcp_pcb *)arg;
+  LWIP_UNUSED_ARG(len);
+  if (conn) {
+    altcp_proxyconnect_state_t *state = (altcp_proxyconnect_state_t *)conn->state;
+    LWIP_ASSERT("pcb mismatch", conn->inner_conn == inner_conn);
+    LWIP_UNUSED_ARG(inner_conn); /* for LWIP_NOASSERT */
+    if (!state || !(state->flags & ALTCP_PROXYCONNECT_FLAGS_HANDSHAKE_DONE)) {
+      /* @todo: do something here? */
+      return ERR_OK;
+    }
+    /* pass this on to upper sent */
+    if (conn->sent) {
+      return conn->sent(conn->arg, conn, len);
+    }
+  }
+  return ERR_OK;
+}
+
+/** Poll callback from lower connection (i.e. TCP)
+ * Just pass this on to the application.
+ * @todo: retry sending?
+ */
+static err_t
+altcp_proxyconnect_lower_poll(void *arg, struct altcp_pcb *inner_conn)
+{
+  struct altcp_pcb *conn = (struct altcp_pcb *)arg;
+  if (conn) {
+    LWIP_ASSERT("pcb mismatch", conn->inner_conn == inner_conn);
+    LWIP_UNUSED_ARG(inner_conn); /* for LWIP_NOASSERT */
+    if (conn->poll) {
+      return conn->poll(conn->arg, conn);
+    }
+  }
+  return ERR_OK;
+}
+
+static void
+altcp_proxyconnect_lower_err(void *arg, err_t err)
+{
+  struct altcp_pcb *conn = (struct altcp_pcb *)arg;
+  if (conn) {
+    conn->inner_conn = NULL; /* already freed */
+    if (conn->err) {
+      conn->err(conn->arg, err);
+    }
+    altcp_free(conn);
+  }
+}
+
+
+/* setup functions */
+
+static void
+altcp_proxyconnect_setup_callbacks(struct altcp_pcb *conn, struct altcp_pcb *inner_conn)
+{
+  altcp_arg(inner_conn, conn);
+  altcp_recv(inner_conn, altcp_proxyconnect_lower_recv);
+  altcp_sent(inner_conn, altcp_proxyconnect_lower_sent);
+  altcp_err(inner_conn, altcp_proxyconnect_lower_err);
+  /* tcp_poll is set when interval is set by application */
+  /* listen is set totally different :-) */
+}
+
+static err_t
+altcp_proxyconnect_setup(struct altcp_proxyconnect_config *config, struct altcp_pcb *conn, struct altcp_pcb *inner_conn)
+{
+  altcp_proxyconnect_state_t *state;
+  if (!config) {
+    return ERR_ARG;
+  }
+  LWIP_ASSERT("invalid inner_conn", conn != inner_conn);
+
+  /* allocate proxyconnect context */
+  state = altcp_proxyconnect_state_alloc();
+  if (state == NULL) {
+    return ERR_MEM;
+  }
+  state->flags = 0;
+  state->conf = config;
+  altcp_proxyconnect_setup_callbacks(conn, inner_conn);
+  conn->inner_conn = inner_conn;
+  conn->fns = &altcp_proxyconnect_functions;
+  conn->state = state;
+  return ERR_OK;
+}
+
+/** Allocate a new altcp layer connecting through a proxy.
+ * This function gets the inner pcb passed.
+ *
+ * @param config struct altcp_proxyconnect_config that contains the proxy settings
+ * @param inner_pcb pcb that makes the connection to the proxy (i.e. tcp pcb)
+ */
+struct altcp_pcb *
+altcp_proxyconnect_new(struct altcp_proxyconnect_config *config, struct altcp_pcb *inner_pcb)
+{
+  struct altcp_pcb *ret;
+  if (inner_pcb == NULL) {
+    return NULL;
+  }
+  ret = altcp_alloc();
+  if (ret != NULL) {
+    if (altcp_proxyconnect_setup(config, ret, inner_pcb) != ERR_OK) {
+      altcp_free(ret);
+      return NULL;
+    }
+  }
+  return ret;
+}
+
+/** Allocate a new altcp layer connecting through a proxy.
+ * This function allocates the inner pcb as tcp pcb, resulting in a direct tcp
+ * connection to the proxy.
+ *
+ * @param config struct altcp_proxyconnect_config that contains the proxy settings
+ * @param ip_type IP type of the connection (@ref lwip_ip_addr_type)
+ */
+struct altcp_pcb *
+altcp_proxyconnect_new_tcp(struct altcp_proxyconnect_config *config, u8_t ip_type)
+{
+  struct altcp_pcb *inner_pcb, *ret;
+
+  /* inner pcb is tcp */
+  inner_pcb = altcp_tcp_new_ip_type(ip_type);
+  if (inner_pcb == NULL) {
+    return NULL;
+  }
+  ret = altcp_proxyconnect_new(config, inner_pcb);
+  if (ret == NULL) {
+    altcp_close(inner_pcb);
+  }
+  return ret;
+}
+
+/** Allocator function to allocate a proxy connect altcp pcb connecting directly
+ * via tcp to the proxy.
+ *
+ * The returned pcb is a chain: altcp_proxyconnect - altcp_tcp - tcp pcb
+ *
+ * This function is meant for use with @ref altcp_new.
+ *
+ * @param arg struct altcp_proxyconnect_config that contains the proxy settings
+ * @param ip_type IP type of the connection (@ref lwip_ip_addr_type)
+ */
+struct altcp_pcb *
+altcp_proxyconnect_alloc(void *arg, u8_t ip_type)
+{
+  return altcp_proxyconnect_new_tcp((struct altcp_proxyconnect_config *)arg, ip_type);
+}
+
+
+#if LWIP_ALTCP_TLS
+
+/** Allocator function to allocate a TLS connection through a proxy.
+ *
+ * The returned pcb is a chain: altcp_tls - altcp_proxyconnect - altcp_tcp - tcp pcb
+ *
+ * This function is meant for use with @ref altcp_new.
+ *
+ * @param arg struct altcp_proxyconnect_tls_config that contains the proxy settings
+ *        and tls settings
+ * @param ip_type IP type of the connection (@ref lwip_ip_addr_type)
+ */
+struct altcp_pcb *
+altcp_proxyconnect_tls_alloc(void *arg, u8_t ip_type)
+{
+  struct altcp_proxyconnect_tls_config *cfg = (struct altcp_proxyconnect_tls_config *)arg;
+  struct altcp_pcb *proxy_pcb;
+  struct altcp_pcb *tls_pcb;
+
+  proxy_pcb = altcp_proxyconnect_new_tcp(&cfg->proxy, ip_type);
+  tls_pcb = altcp_tls_wrap(cfg->tls_config, proxy_pcb);
+
+  if (tls_pcb == NULL) {
+    altcp_close(proxy_pcb);
+  }
+  return tls_pcb;
+}
+#endif /* LWIP_ALTCP_TLS */
+
+/* "virtual" functions */
+static void
+altcp_proxyconnect_set_poll(struct altcp_pcb *conn, u8_t interval)
+{
+  if (conn != NULL) {
+    altcp_poll(conn->inner_conn, altcp_proxyconnect_lower_poll, interval);
+  }
+}
+
+static void
+altcp_proxyconnect_recved(struct altcp_pcb *conn, u16_t len)
+{
+  altcp_proxyconnect_state_t *state;
+  if (conn == NULL) {
+    return;
+  }
+  state = (altcp_proxyconnect_state_t *)conn->state;
+  if (state == NULL) {
+    return;
+  }
+  if (!(state->flags & ALTCP_PROXYCONNECT_FLAGS_HANDSHAKE_DONE)) {
+    return;
+  }
+  altcp_recved(conn->inner_conn, len);
+}
+
+static err_t
+altcp_proxyconnect_connect(struct altcp_pcb *conn, const ip_addr_t *ipaddr, u16_t port, altcp_connected_fn connected)
+{
+  altcp_proxyconnect_state_t *state;
+
+  if ((conn == NULL) || (ipaddr == NULL)) {
+    return ERR_VAL;
+  }
+  state = (altcp_proxyconnect_state_t *)conn->state;
+  if (state == NULL) {
+    return ERR_VAL;
+  }
+  if (state->flags & ALTCP_PROXYCONNECT_FLAGS_CONNECT_STARTED) {
+    return ERR_VAL;
+  }
+  state->flags |= ALTCP_PROXYCONNECT_FLAGS_CONNECT_STARTED;
+
+  conn->connected = connected;
+  /* connect to our proxy instead, but store the requested address and port */
+  ip_addr_copy(state->outer_addr, *ipaddr);
+  state->outer_port = port;
+
+  return altcp_connect(conn->inner_conn, &state->conf->proxy_addr, state->conf->proxy_port, altcp_proxyconnect_lower_connected);
+}
+
+static struct altcp_pcb *
+altcp_proxyconnect_listen(struct altcp_pcb *conn, u8_t backlog, err_t *err)
+{
+  LWIP_UNUSED_ARG(conn);
+  LWIP_UNUSED_ARG(backlog);
+  LWIP_UNUSED_ARG(err);
+  /* listen not supported! */
+  return NULL;
+}
+
+static void
+altcp_proxyconnect_abort(struct altcp_pcb *conn)
+{
+  if (conn != NULL) {
+    if (conn->inner_conn != NULL) {
+      altcp_abort(conn->inner_conn);
+    }
+    altcp_free(conn);
+  }
+}
+
+static err_t
+altcp_proxyconnect_close(struct altcp_pcb *conn)
+{
+  if (conn == NULL) {
+    return ERR_VAL;
+  }
+  if (conn->inner_conn != NULL) {
+    err_t err = altcp_close(conn->inner_conn);
+    if (err != ERR_OK) {
+      /* closing inner conn failed, return the error */
+      return err;
+    }
+  }
+  /* no inner conn or closing it succeeded, deallocate myself */
+  altcp_free(conn);
+  return ERR_OK;
+}
+
+static err_t
+altcp_proxyconnect_write(struct altcp_pcb *conn, const void *dataptr, u16_t len, u8_t apiflags)
+{
+  altcp_proxyconnect_state_t *state;
+
+  LWIP_UNUSED_ARG(apiflags);
+
+  if (conn == NULL) {
+    return ERR_VAL;
+  }
+
+  state = (altcp_proxyconnect_state_t *)conn->state;
+  if (state == NULL) {
+    /* @todo: which error? */
+    return ERR_CLSD;
+  }
+  if (!(state->flags & ALTCP_PROXYCONNECT_FLAGS_HANDSHAKE_DONE)) {
+    /* @todo: which error? */
+    return ERR_VAL;
+  }
+  return altcp_write(conn->inner_conn, dataptr, len, apiflags);
+}
+
+static void
+altcp_proxyconnect_dealloc(struct altcp_pcb *conn)
+{
+  /* clean up and free tls state */
+  if (conn) {
+    altcp_proxyconnect_state_t *state = (altcp_proxyconnect_state_t *)conn->state;
+    if (state) {
+      altcp_proxyconnect_state_free(state);
+      conn->state = NULL;
+    }
+  }
+}
+const struct altcp_functions altcp_proxyconnect_functions = {
+  altcp_proxyconnect_set_poll,
+  altcp_proxyconnect_recved,
+  altcp_default_bind,
+  altcp_proxyconnect_connect,
+  altcp_proxyconnect_listen,
+  altcp_proxyconnect_abort,
+  altcp_proxyconnect_close,
+  altcp_default_shutdown,
+  altcp_proxyconnect_write,
+  altcp_default_output,
+  altcp_default_mss,
+  altcp_default_sndbuf,
+  altcp_default_sndqueuelen,
+  altcp_default_nagle_disable,
+  altcp_default_nagle_enable,
+  altcp_default_nagle_disabled,
+  altcp_default_setprio,
+  altcp_proxyconnect_dealloc,
+  altcp_default_get_tcp_addrinfo,
+  altcp_default_get_ip,
+  altcp_default_get_port
+#ifdef LWIP_DEBUG
+  , altcp_default_dbg_get_tcp_state
+#endif
+};
+
+#endif /* LWIP_ALTCP */
--- a/src/apps/httpd/fs.c
+++ b/src/apps/httpd/fs.c
@@ -33,15 +33,10 @@
 #include "lwip/apps/httpd_opts.h"
 #include "lwip/def.h"
 #include "lwip/apps/fs.h"
-#include "fsdata.h"
 #include <string.h>


-#if HTTPD_USE_CUSTOM_FSDATA
-#include "fsdata_custom.c"
-#else /* HTTPD_USE_CUSTOM_FSDATA */
-#include "fsdata.c"
-#endif /* HTTPD_USE_CUSTOM_FSDATA */
+#include HTTPD_FSDATA_FILE

 /*-----------------------------------------------------------------------------------*/

--- a/src/apps/httpd/fs/404.html
+++ b/src/apps/httpd/fs/404.html
--- a/src/apps/httpd/fs/img/sics.gif
+++ b/src/apps/httpd/fs/img/sics.gif
--- a/src/apps/httpd/fs/index.html
+++ b/src/apps/httpd/fs/index.html
--- a/src/apps/httpd/fsdata.c
+++ b/src/apps/httpd/fsdata.c
@@ -1,13 +1,33 @@
 #include "lwip/apps/fs.h"
 #include "lwip/def.h"
-#include "fsdata.h"


 #define file_NULL (struct fsdata_file *) NULL


+#ifndef FS_FILE_FLAGS_HEADER_INCLUDED
+#define FS_FILE_FLAGS_HEADER_INCLUDED 1
+#endif
+#ifndef FS_FILE_FLAGS_HEADER_PERSISTENT
+#define FS_FILE_FLAGS_HEADER_PERSISTENT 0
+#endif
+/* FSDATA_FILE_ALIGNMENT: 0=off, 1=by variable, 2=by include */
+#ifndef FSDATA_FILE_ALIGNMENT
+#define FSDATA_FILE_ALIGNMENT 0
+#endif
+#ifndef FSDATA_ALIGN_PRE
+#define FSDATA_ALIGN_PRE
+#endif
+#ifndef FSDATA_ALIGN_POST
+#define FSDATA_ALIGN_POST
+#endif
+#if FSDATA_FILE_ALIGNMENT==2
+#include "fsdata_alignment.h"
+#endif
+#if FSDATA_FILE_ALIGNMENT==1
 static const unsigned int dummy_align__img_sics_gif = 0;
-static const unsigned char data__img_sics_gif[] = {
+#endif
+static const unsigned char FSDATA_ALIGN_PRE data__img_sics_gif[] FSDATA_ALIGN_POST = {
 /* /img/sics.gif (14 chars) */
 0x2f,0x69,0x6d,0x67,0x2f,0x73,0x69,0x63,0x73,0x2e,0x67,0x69,0x66,0x00,0x00,0x00,

@@ -16,16 +36,21 @@ static const unsigned char data__img_sics_gif[] = {
 " (17 bytes) */
 0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x30,0x20,0x32,0x30,0x30,0x20,0x4f,0x4b,0x0d,
 0x0a,
-/* "Server: lwIP/1.3.1 (http://savannah.nongnu.org/projects/lwip)
-" (63 bytes) */
-0x53,0x65,0x72,0x76,0x65,0x72,0x3a,0x20,0x6c,0x77,0x49,0x50,0x2f,0x31,0x2e,0x33,
-0x2e,0x31,0x20,0x28,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x73,0x61,0x76,0x61,0x6e,
-0x6e,0x61,0x68,0x2e,0x6e,0x6f,0x6e,0x67,0x6e,0x75,0x2e,0x6f,0x72,0x67,0x2f,0x70,
-0x72,0x6f,0x6a,0x65,0x63,0x74,0x73,0x2f,0x6c,0x77,0x69,0x70,0x29,0x0d,0x0a,
-/* "Content-type: image/gif
+/* "Server: lwIP/2.0.3d (http://savannah.nongnu.org/projects/lwip)
+" (64 bytes) */
+0x53,0x65,0x72,0x76,0x65,0x72,0x3a,0x20,0x6c,0x77,0x49,0x50,0x2f,0x32,0x2e,0x30,
+0x2e,0x33,0x64,0x20,0x28,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x73,0x61,0x76,0x61,
+0x6e,0x6e,0x61,0x68,0x2e,0x6e,0x6f,0x6e,0x67,0x6e,0x75,0x2e,0x6f,0x72,0x67,0x2f,
+0x70,0x72,0x6f,0x6a,0x65,0x63,0x74,0x73,0x2f,0x6c,0x77,0x69,0x70,0x29,0x0d,0x0a,
+
+/* "Content-Length: 724
+" (18+ bytes) */
+0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x4c,0x65,0x6e,0x67,0x74,0x68,0x3a,0x20,
+0x37,0x32,0x34,0x0d,0x0a,
+/* "Content-Type: image/gif

 " (27 bytes) */
-0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x74,0x79,0x70,0x65,0x3a,0x20,0x69,0x6d,
+0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x54,0x79,0x70,0x65,0x3a,0x20,0x69,0x6d,
 0x61,0x67,0x65,0x2f,0x67,0x69,0x66,0x0d,0x0a,0x0d,0x0a,
 /* raw file data (724 bytes) */
 0x47,0x49,0x46,0x38,0x39,0x61,0x46,0x00,0x22,0x00,0xa5,0x00,0x00,0xd9,0x2b,0x39,
@@ -75,8 +100,10 @@ static const unsigned char data__img_sics_gif[] = {
 0x82,0x0c,0x36,0xe8,0xe0,0x83,0x10,0x46,0x28,0xe1,0x84,0x14,0x56,0x68,0xa1,0x10,
 0x41,0x00,0x00,0x3b,};

+#if FSDATA_FILE_ALIGNMENT==1
 static const unsigned int dummy_align__404_html = 1;
-static const unsigned char data__404_html[] = {
+#endif
+static const unsigned char FSDATA_ALIGN_PRE data__404_html[] FSDATA_ALIGN_POST = {
 /* /404.html (10 chars) */
 0x2f,0x34,0x30,0x34,0x2e,0x68,0x74,0x6d,0x6c,0x00,0x00,0x00,

@@ -85,16 +112,21 @@ static const unsigned char data__404_html[] = {
 " (29 bytes) */
 0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x30,0x20,0x34,0x30,0x34,0x20,0x46,0x69,0x6c,
 0x65,0x20,0x6e,0x6f,0x74,0x20,0x66,0x6f,0x75,0x6e,0x64,0x0d,0x0a,
-/* "Server: lwIP/1.3.1 (http://savannah.nongnu.org/projects/lwip)
-" (63 bytes) */
-0x53,0x65,0x72,0x76,0x65,0x72,0x3a,0x20,0x6c,0x77,0x49,0x50,0x2f,0x31,0x2e,0x33,
-0x2e,0x31,0x20,0x28,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x73,0x61,0x76,0x61,0x6e,
-0x6e,0x61,0x68,0x2e,0x6e,0x6f,0x6e,0x67,0x6e,0x75,0x2e,0x6f,0x72,0x67,0x2f,0x70,
-0x72,0x6f,0x6a,0x65,0x63,0x74,0x73,0x2f,0x6c,0x77,0x69,0x70,0x29,0x0d,0x0a,
-/* "Content-type: text/html
+/* "Server: lwIP/2.0.3d (http://savannah.nongnu.org/projects/lwip)
+" (64 bytes) */
+0x53,0x65,0x72,0x76,0x65,0x72,0x3a,0x20,0x6c,0x77,0x49,0x50,0x2f,0x32,0x2e,0x30,
+0x2e,0x33,0x64,0x20,0x28,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x73,0x61,0x76,0x61,
+0x6e,0x6e,0x61,0x68,0x2e,0x6e,0x6f,0x6e,0x67,0x6e,0x75,0x2e,0x6f,0x72,0x67,0x2f,
+0x70,0x72,0x6f,0x6a,0x65,0x63,0x74,0x73,0x2f,0x6c,0x77,0x69,0x70,0x29,0x0d,0x0a,
+
+/* "Content-Length: 565
+" (18+ bytes) */
+0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x4c,0x65,0x6e,0x67,0x74,0x68,0x3a,0x20,
+0x35,0x36,0x35,0x0d,0x0a,
+/* "Content-Type: text/html

 " (27 bytes) */
-0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x74,0x79,0x70,0x65,0x3a,0x20,0x74,0x65,
+0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x54,0x79,0x70,0x65,0x3a,0x20,0x74,0x65,
 0x78,0x74,0x2f,0x68,0x74,0x6d,0x6c,0x0d,0x0a,0x0d,0x0a,
 /* raw file data (565 bytes) */
 0x3c,0x68,0x74,0x6d,0x6c,0x3e,0x0d,0x0a,0x3c,0x68,0x65,0x61,0x64,0x3e,0x3c,0x74,
@@ -134,8 +166,10 @@ static const unsigned char data__404_html[] = {
 0x3e,0x0d,0x0a,0x3c,0x2f,0x62,0x6f,0x64,0x79,0x3e,0x0d,0x0a,0x3c,0x2f,0x68,0x74,
 0x6d,0x6c,0x3e,0x0d,0x0a,};

+#if FSDATA_FILE_ALIGNMENT==1
 static const unsigned int dummy_align__index_html = 2;
-static const unsigned char data__index_html[] = {
+#endif
+static const unsigned char FSDATA_ALIGN_PRE data__index_html[] FSDATA_ALIGN_POST = {
 /* /index.html (12 chars) */
 0x2f,0x69,0x6e,0x64,0x65,0x78,0x2e,0x68,0x74,0x6d,0x6c,0x00,

@@ -144,16 +178,21 @@ static const unsigned char data__index_html[] = {
 " (17 bytes) */
 0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x30,0x20,0x32,0x30,0x30,0x20,0x4f,0x4b,0x0d,
 0x0a,
-/* "Server: lwIP/1.3.1 (http://savannah.nongnu.org/projects/lwip)
-" (63 bytes) */
-0x53,0x65,0x72,0x76,0x65,0x72,0x3a,0x20,0x6c,0x77,0x49,0x50,0x2f,0x31,0x2e,0x33,
-0x2e,0x31,0x20,0x28,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x73,0x61,0x76,0x61,0x6e,
-0x6e,0x61,0x68,0x2e,0x6e,0x6f,0x6e,0x67,0x6e,0x75,0x2e,0x6f,0x72,0x67,0x2f,0x70,
-0x72,0x6f,0x6a,0x65,0x63,0x74,0x73,0x2f,0x6c,0x77,0x69,0x70,0x29,0x0d,0x0a,
-/* "Content-type: text/html
+/* "Server: lwIP/2.0.3d (http://savannah.nongnu.org/projects/lwip)
+" (64 bytes) */
+0x53,0x65,0x72,0x76,0x65,0x72,0x3a,0x20,0x6c,0x77,0x49,0x50,0x2f,0x32,0x2e,0x30,
+0x2e,0x33,0x64,0x20,0x28,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x73,0x61,0x76,0x61,
+0x6e,0x6e,0x61,0x68,0x2e,0x6e,0x6f,0x6e,0x67,0x6e,0x75,0x2e,0x6f,0x72,0x67,0x2f,
+0x70,0x72,0x6f,0x6a,0x65,0x63,0x74,0x73,0x2f,0x6c,0x77,0x69,0x70,0x29,0x0d,0x0a,
+
+/* "Content-Length: 1751
+" (18+ bytes) */
+0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x4c,0x65,0x6e,0x67,0x74,0x68,0x3a,0x20,
+0x31,0x37,0x35,0x31,0x0d,0x0a,
+/* "Content-Type: text/html

 " (27 bytes) */
-0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x74,0x79,0x70,0x65,0x3a,0x20,0x74,0x65,
+0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x54,0x79,0x70,0x65,0x3a,0x20,0x74,0x65,
 0x78,0x74,0x2f,0x68,0x74,0x6d,0x6c,0x0d,0x0a,0x0d,0x0a,
 /* raw file data (1751 bytes) */
 0x3c,0x68,0x74,0x6d,0x6c,0x3e,0x0d,0x0a,0x3c,0x68,0x65,0x61,0x64,0x3e,0x3c,0x74,
@@ -274,7 +313,7 @@ file_NULL,
 data__img_sics_gif,
 data__img_sics_gif + 16,
 sizeof(data__img_sics_gif) - 16,
-1,
+FS_FILE_FLAGS_HEADER_INCLUDED | FS_FILE_FLAGS_HEADER_PERSISTENT,
 }};

 const struct fsdata_file file__404_html[] = { {
@@ -282,7 +321,7 @@ file__img_sics_gif,
 data__404_html,
 data__404_html + 12,
 sizeof(data__404_html) - 12,
-1,
+FS_FILE_FLAGS_HEADER_INCLUDED | FS_FILE_FLAGS_HEADER_PERSISTENT,
 }};

 const struct fsdata_file file__index_html[] = { {
@@ -290,7 +329,7 @@ file__404_html,
 data__index_html,
 data__index_html + 12,
 sizeof(data__index_html) - 12,
-1,
+FS_FILE_FLAGS_HEADER_INCLUDED | FS_FILE_FLAGS_HEADER_PERSISTENT,
 }};

 #define FS_ROOT file__index_html
--- a/src/apps/httpd/fsdata.h
+++ b/src/apps/httpd/fsdata.h
@@ -35,16 +35,7 @@
 #include "lwip/apps/httpd_opts.h"
 #include "lwip/apps/fs.h"

-struct fsdata_file {
-  const struct fsdata_file *next;
-  const unsigned char *name;
-  const unsigned char *data;
-  int len;
-  u8_t flags;
-#if HTTPD_PRECALCULATED_CHECKSUM
-  u16_t chksum_count;
-  const struct fsdata_chksum *chksum;
-#endif /* HTTPD_PRECALCULATED_CHECKSUM */
-};
+/* THIS FILE IS DEPRECATED AND WILL BE REMOVED IN THE FUTURE */
+/* content was moved to fs.h to simplify #include structure */

 #endif /* LWIP_FSDATA_H */
--- a/src/apps/http/http_client.c
+++ b/src/apps/http/http_client.c
@@ -0,0 +1,909 @@
+/**
+ * @file
+ * HTTP client
+ */
+
+/*
+ * Copyright (c) 2018 Simon Goldschmidt <goldsimon@gmx.de>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ *
+ * Author: Simon Goldschmidt <goldsimon@gmx.de>
+ */
+
+/**
+ * @defgroup httpc HTTP client
+ * @ingroup apps
+ * @todo:
+ * - persistent connections
+ * - select outgoing http version
+ * - optionally follow redirect
+ * - check request uri for invalid characters? (e.g. encode spaces)
+ * - IPv6 support
+ */
+
+#include "lwip/apps/http_client.h"
+
+#include "lwip/altcp_tcp.h"
+#include "lwip/dns.h"
+#include "lwip/debug.h"
+#include "lwip/mem.h"
+#include "lwip/altcp_tls.h"
+#include "lwip/init.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#if LWIP_TCP && LWIP_CALLBACK_API
+
+/**
+ * HTTPC_DEBUG: Enable debugging for HTTP client.
+ */
+#ifndef HTTPC_DEBUG
+#define HTTPC_DEBUG                 LWIP_DBG_OFF
+#endif
+
+/** Set this to 1 to keep server name and uri in request state */
+#ifndef HTTPC_DEBUG_REQUEST
+#define HTTPC_DEBUG_REQUEST         0
+#endif
+
+/** This string is passed in the HTTP header as "User-Agent: " */
+#ifndef HTTPC_CLIENT_AGENT
+#define HTTPC_CLIENT_AGENT "lwIP/" LWIP_VERSION_STRING " (http://savannah.nongnu.org/projects/lwip)"
+#endif
+
+/* the various debug levels for this file */
+#define HTTPC_DEBUG_TRACE        (HTTPC_DEBUG | LWIP_DBG_TRACE)
+#define HTTPC_DEBUG_STATE        (HTTPC_DEBUG | LWIP_DBG_STATE)
+#define HTTPC_DEBUG_WARN         (HTTPC_DEBUG | LWIP_DBG_LEVEL_WARNING)
+#define HTTPC_DEBUG_WARN_STATE   (HTTPC_DEBUG | LWIP_DBG_LEVEL_WARNING | LWIP_DBG_STATE)
+#define HTTPC_DEBUG_SERIOUS      (HTTPC_DEBUG | LWIP_DBG_LEVEL_SERIOUS)
+
+#define HTTPC_POLL_INTERVAL     1
+#define HTTPC_POLL_TIMEOUT      30 /* 15 seconds */
+
+#define HTTPC_CONTENT_LEN_INVALID 0xFFFFFFFF
+
+/* GET request basic */
+#define HTTPC_REQ_11 "GET %s HTTP/1.1\r\n" /* URI */\
+    "User-Agent: %s\r\n" /* User-Agent */ \
+    "Accept: */*\r\n" \
+    "Connection: Close\r\n" /* we don't support persistent connections, yet */ \
+    "\r\n"
+#define HTTPC_REQ_11_FORMAT(uri) HTTPC_REQ_11, uri, HTTPC_CLIENT_AGENT
+
+/* GET request with host */
+#define HTTPC_REQ_11_HOST "GET %s HTTP/1.1\r\n" /* URI */\
+    "User-Agent: %s\r\n" /* User-Agent */ \
+    "Accept: */*\r\n" \
+    "Host: %s\r\n" /* server name */ \
+    "Connection: Close\r\n" /* we don't support persistent connections, yet */ \
+    "\r\n"
+#define HTTPC_REQ_11_HOST_FORMAT(uri, srv_name) HTTPC_REQ_11_HOST, uri, HTTPC_CLIENT_AGENT, srv_name
+
+/* GET request with proxy */
+#define HTTPC_REQ_11_PROXY "GET http://%s%s HTTP/1.1\r\n" /* HOST, URI */\
+    "User-Agent: %s\r\n" /* User-Agent */ \
+    "Accept: */*\r\n" \
+    "Host: %s\r\n" /* server name */ \
+    "Connection: Close\r\n" /* we don't support persistent connections, yet */ \
+    "\r\n"
+#define HTTPC_REQ_11_PROXY_FORMAT(host, uri, srv_name) HTTPC_REQ_11_PROXY, host, uri, HTTPC_CLIENT_AGENT, srv_name
+
+/* GET request with proxy (non-default server port) */
+#define HTTPC_REQ_11_PROXY_PORT "GET http://%s:%d%s HTTP/1.1\r\n" /* HOST, host-port, URI */\
+    "User-Agent: %s\r\n" /* User-Agent */ \
+    "Accept: */*\r\n" \
+    "Host: %s\r\n" /* server name */ \
+    "Connection: Close\r\n" /* we don't support persistent connections, yet */ \
+    "\r\n"
+#define HTTPC_REQ_11_PROXY_PORT_FORMAT(host, host_port, uri, srv_name) HTTPC_REQ_11_PROXY_PORT, host, host_port, uri, HTTPC_CLIENT_AGENT, srv_name
+
+typedef enum ehttpc_parse_state {
+  HTTPC_PARSE_WAIT_FIRST_LINE = 0,
+  HTTPC_PARSE_WAIT_HEADERS,
+  HTTPC_PARSE_RX_DATA
+} httpc_parse_state_t;
+
+typedef struct _httpc_state
+{
+  struct altcp_pcb* pcb;
+  ip_addr_t remote_addr;
+  u16_t remote_port;
+  int timeout_ticks;
+  struct pbuf *request;
+  struct pbuf *rx_hdrs;
+  u16_t rx_http_version;
+  u16_t rx_status;
+  altcp_recv_fn recv_fn;
+  const httpc_connection_t *conn_settings;
+  void* callback_arg;
+  u32_t rx_content_len;
+  u32_t hdr_content_len;
+  httpc_parse_state_t parse_state;
+#if HTTPC_DEBUG_REQUEST
+  char* server_name;
+  char* uri;
+#endif
+} httpc_state_t;
+
+/** Free http client state and deallocate all resources within */
+static err_t
+httpc_free_state(httpc_state_t* req)
+{
+  struct altcp_pcb* tpcb;
+
+  if (req->request != NULL) {
+    pbuf_free(req->request);
+    req->request = NULL;
+  }
+  if (req->rx_hdrs != NULL) {
+    pbuf_free(req->rx_hdrs);
+    req->rx_hdrs = NULL;
+  }
+
+  tpcb = req->pcb;
+  mem_free(req);
+  req = NULL;
+
+  if (tpcb != NULL) {
+    err_t r;
+    altcp_arg(tpcb, NULL);
+    altcp_recv(tpcb, NULL);
+    altcp_err(tpcb, NULL);
+    altcp_poll(tpcb, NULL, 0);
+    altcp_sent(tpcb, NULL);
+    r = altcp_close(tpcb);
+    if (r != ERR_OK) {
+      altcp_abort(tpcb);
+      return ERR_ABRT;
+    }
+  }
+  return ERR_OK;
+}
+
+/** Close the connection: call finished callback and free the state */
+static err_t
+httpc_close(httpc_state_t* req, httpc_result_t result, u32_t server_response, err_t err)
+{
+  if (req != NULL) {
+    if (req->conn_settings != NULL) {
+      if (req->conn_settings->result_fn != NULL) {
+        req->conn_settings->result_fn(req->callback_arg, result, req->rx_content_len, server_response, err);
+      }
+    }
+    return httpc_free_state(req);
+  }
+  return ERR_OK;
+}
+
+/** Parse http header response line 1 */
+static err_t
+http_parse_response_status(struct pbuf *p, u16_t *http_version, u16_t *http_status, u16_t *http_status_str_offset)
+{
+  u16_t end1 = pbuf_memfind(p, "\r\n", 2, 0);
+  if (end1 != 0xFFFF) {
+    /* get parts of first line */
+    u16_t space1, space2;
+    space1 = pbuf_memfind(p, " ", 1, 0);
+    if (space1 != 0xFFFF) {
+      if ((pbuf_memcmp(p, 0, "HTTP/", 5) == 0)  && (pbuf_get_at(p, 6) == '.')) {
+        char status_num[10];
+        size_t status_num_len;
+        /* parse http version */
+        u16_t version = pbuf_get_at(p, 5) - '0';
+        version <<= 8;
+        version |= pbuf_get_at(p, 7) - '0';
+        *http_version = version;
+
+        /* parse http status number */
+        space2 = pbuf_memfind(p, " ", 1, space1 + 1);
+        if (space2 != 0xFFFF) {
+          *http_status_str_offset = space2 + 1;
+          status_num_len = space2 - space1 - 1;
+        } else {
+          status_num_len = end1 - space1 - 1;
+        }
+        memset(status_num, 0, sizeof(status_num));
+        if (pbuf_copy_partial(p, status_num, (u16_t)status_num_len, space1 + 1) == status_num_len) {
+          int status = atoi(status_num);
+          if ((status > 0) && (status <= 0xFFFF)) {
+            *http_status = (u16_t)status;
+            return ERR_OK;
+          }
+        }
+      }
+    }
+  }
+  return ERR_VAL;
+}
+
+/** Wait for all headers to be received, return its length and content-length (if available) */
+static err_t
+http_wait_headers(struct pbuf *p, u32_t *content_length, u16_t *total_header_len)
+{
+  u16_t end1 = pbuf_memfind(p, "\r\n\r\n", 4, 0);
+  if (end1 < (0xFFFF - 2)) {
+    /* all headers received */
+    /* check if we have a content length (@todo: case insensitive?) */
+    u16_t content_len_hdr;
+    *content_length = HTTPC_CONTENT_LEN_INVALID;
+    *total_header_len = end1 + 4;
+
+    content_len_hdr = pbuf_memfind(p, "Content-Length: ", 16, 0);
+    if (content_len_hdr != 0xFFFF) {
+      u16_t content_len_line_end = pbuf_memfind(p, "\r\n", 2, content_len_hdr);
+      if (content_len_line_end != 0xFFFF) {
+        char content_len_num[16];
+        u16_t content_len_num_len = (u16_t)(content_len_line_end - content_len_hdr - 16);
+        memset(content_len_num, 0, sizeof(content_len_num));
+        if (pbuf_copy_partial(p, content_len_num, content_len_num_len, content_len_hdr + 16) == content_len_num_len) {
+          int len = atoi(content_len_num);
+          if ((len >= 0) && ((u32_t)len < HTTPC_CONTENT_LEN_INVALID)) {
+            *content_length = (u32_t)len;
+          }
+        }
+      }
+    }
+    return ERR_OK;
+  }
+  return ERR_VAL;
+}
+
+/** http client tcp recv callback */
+static err_t
+httpc_tcp_recv(void *arg, struct altcp_pcb *pcb, struct pbuf *p, err_t r)
+{
+  httpc_state_t* req = (httpc_state_t*)arg;
+  LWIP_UNUSED_ARG(r);
+
+  if (p == NULL) {
+    httpc_result_t result;
+    if (req->parse_state != HTTPC_PARSE_RX_DATA) {
+      /* did not get RX data yet */
+      result = HTTPC_RESULT_ERR_CLOSED;
+    } else if ((req->hdr_content_len != HTTPC_CONTENT_LEN_INVALID) &&
+      (req->hdr_content_len != req->rx_content_len)) {
+      /* header has been received with content length but not all data received */
+      result = HTTPC_RESULT_ERR_CONTENT_LEN;
+    } else {
+      /* receiving data and either all data received or no content length header */
+      result = HTTPC_RESULT_OK;
+    }
+    return httpc_close(req, result, req->rx_status, ERR_OK);
+  }
+  if (req->parse_state != HTTPC_PARSE_RX_DATA) {
+    if (req->rx_hdrs == NULL) {
+      req->rx_hdrs = p;
+    } else {
+      pbuf_cat(req->rx_hdrs, p);
+    }
+    if (req->parse_state == HTTPC_PARSE_WAIT_FIRST_LINE) {
+      u16_t status_str_off;
+      err_t err = http_parse_response_status(req->rx_hdrs, &req->rx_http_version, &req->rx_status, &status_str_off);
+      if (err == ERR_OK) {
+        /* don't care status string */
+        req->parse_state = HTTPC_PARSE_WAIT_HEADERS;
+      }
+    }
+    if (req->parse_state == HTTPC_PARSE_WAIT_HEADERS) {
+      u16_t total_header_len;
+      err_t err = http_wait_headers(req->rx_hdrs, &req->hdr_content_len, &total_header_len);
+      if (err == ERR_OK) {
+        struct pbuf *q;
+        /* full header received, send window update for header bytes and call into client callback */
+        altcp_recved(pcb, total_header_len);
+        if (req->conn_settings) {
+          if (req->conn_settings->headers_done_fn) {
+            err = req->conn_settings->headers_done_fn(req, req->callback_arg, req->rx_hdrs, total_header_len, req->hdr_content_len);
+            if (err != ERR_OK) {
+              return httpc_close(req, HTTPC_RESULT_LOCAL_ABORT, req->rx_status, err);
+            }
+          }
+        }
+        /* hide header bytes in pbuf */
+        q = pbuf_free_header(req->rx_hdrs, total_header_len);
+        p = q;
+        req->rx_hdrs = NULL;
+        /* go on with data */
+        req->parse_state = HTTPC_PARSE_RX_DATA;
+      }
+    }
+  }
+  if ((p != NULL) && (req->parse_state == HTTPC_PARSE_RX_DATA)) {
+    req->rx_content_len += p->tot_len;
+    if (req->recv_fn != NULL) {
+      /* directly return here: the connection migth already be aborted from the callback! */
+      return req->recv_fn(req->callback_arg, pcb, p, r);
+    } else {
+      altcp_recved(pcb, p->tot_len);
+      pbuf_free(p);
+    }
+  }
+  return ERR_OK;
+}
+
+/** http client tcp err callback */
+static void
+httpc_tcp_err(void *arg, err_t err)
+{
+  httpc_state_t* req = (httpc_state_t*)arg;
+  if (req != NULL) {
+    /* pcb has already been deallocated */
+    req->pcb = NULL;
+    httpc_close(req, HTTPC_RESULT_ERR_CLOSED, 0, err);
+  }
+}
+
+/** http client tcp poll callback */
+static err_t
+httpc_tcp_poll(void *arg, struct altcp_pcb *pcb)
+{
+  /* implement timeout */
+  httpc_state_t* req = (httpc_state_t*)arg;
+  LWIP_UNUSED_ARG(pcb);
+  if (req != NULL) {
+    if (req->timeout_ticks) {
+      req->timeout_ticks--;
+    }
+    if (!req->timeout_ticks) {
+      return httpc_close(req, HTTPC_RESULT_ERR_TIMEOUT, 0, ERR_OK);
+    }
+  }
+  return ERR_OK;
+}
+
+/** http client tcp sent callback */
+static err_t
+httpc_tcp_sent(void *arg, struct altcp_pcb *pcb, u16_t len)
+{
+  /* nothing to do here for now */
+  LWIP_UNUSED_ARG(arg);
+  LWIP_UNUSED_ARG(pcb);
+  LWIP_UNUSED_ARG(len);
+  return ERR_OK;
+}
+
+/** http client tcp connected callback */
+static err_t
+httpc_tcp_connected(void *arg, struct altcp_pcb *pcb, err_t err)
+{
+  err_t r;
+  httpc_state_t* req = (httpc_state_t*)arg;
+  LWIP_UNUSED_ARG(pcb);
+  LWIP_UNUSED_ARG(err);
+
+  /* send request; last char is zero termination */
+  r = altcp_write(req->pcb, req->request->payload, req->request->len - 1, TCP_WRITE_FLAG_COPY);
+  if (r != ERR_OK) {
+     /* could not write the single small request -> fail, don't retry */
+     return httpc_close(req, HTTPC_RESULT_ERR_MEM, 0, r);
+  }
+  /* everything written, we can free the request */
+  pbuf_free(req->request);
+  req->request = NULL;
+
+  altcp_output(req->pcb);
+  return ERR_OK;
+}
+
+/** Start the http request when the server IP addr is known */
+static err_t
+httpc_get_internal_addr(httpc_state_t* req, const ip_addr_t *ipaddr)
+{
+  err_t err;
+  LWIP_ASSERT("req != NULL", req != NULL);
+
+  if (&req->remote_addr != ipaddr) {
+    /* fill in remote addr if called externally */
+    req->remote_addr = *ipaddr;
+  }
+
+  err = altcp_connect(req->pcb, &req->remote_addr, req->remote_port, httpc_tcp_connected);
+  if (err == ERR_OK) {
+    return ERR_OK;
+  }
+  LWIP_DEBUGF(HTTPC_DEBUG_WARN_STATE, ("tcp_connect failed: %d\n", (int)err));
+  return err;
+}
+
+#if LWIP_DNS
+/** DNS callback
+ * If ipaddr is non-NULL, resolving succeeded and the request can be sent, otherwise it failed.
+ */
+static void
+httpc_dns_found(const char* hostname, const ip_addr_t *ipaddr, void *arg)
+{
+  httpc_state_t* req = (httpc_state_t*)arg;
+  err_t err;
+  httpc_result_t result;
+
+  LWIP_UNUSED_ARG(hostname);
+
+  if (ipaddr != NULL) {
+    err = httpc_get_internal_addr(req, ipaddr);
+    if (err == ERR_OK) {
+      return;
+    }
+    result = HTTPC_RESULT_ERR_CONNECT;
+  } else {
+    LWIP_DEBUGF(HTTPC_DEBUG_WARN_STATE, ("httpc_dns_found: failed to resolve hostname: %s\n",
+      hostname));
+    result = HTTPC_RESULT_ERR_HOSTNAME;
+    err = ERR_ARG;
+  }
+  httpc_close(req, result, 0, err);
+}
+#endif /* LWIP_DNS */
+
+/** Start the http request after converting 'server_name' to ip address (DNS or address string) */
+static err_t
+httpc_get_internal_dns(httpc_state_t* req, const char* server_name)
+{
+  err_t err;
+  LWIP_ASSERT("req != NULL", req != NULL);
+
+#if LWIP_DNS
+  err = dns_gethostbyname(server_name, &req->remote_addr, httpc_dns_found, req);
+#else
+  err = ipaddr_aton(server_name, &req->remote_addr) ? ERR_OK : ERR_ARG;
+#endif
+
+  if (err == ERR_OK) {
+    /* cached or IP-string */
+    err = httpc_get_internal_addr(req, &req->remote_addr);
+  } else if (err == ERR_INPROGRESS) {
+    return ERR_OK;
+  }
+  return err;
+}
+
+static int
+httpc_create_request_string(const httpc_connection_t *settings, const char* server_name, int server_port, const char* uri,
+                            int use_host, char *buffer, size_t buffer_size)
+{
+  if (settings->use_proxy) {
+    LWIP_ASSERT("server_name != NULL", server_name != NULL);
+    if (server_port != HTTP_DEFAULT_PORT) {
+      return snprintf(buffer, buffer_size, HTTPC_REQ_11_PROXY_PORT_FORMAT(server_name, server_port, uri, server_name));
+    } else {
+      return snprintf(buffer, buffer_size, HTTPC_REQ_11_PROXY_FORMAT(server_name, uri, server_name));
+    }
+  } else if (use_host) {
+    LWIP_ASSERT("server_name != NULL", server_name != NULL);
+    return snprintf(buffer, buffer_size, HTTPC_REQ_11_HOST_FORMAT(uri, server_name));
+  } else {
+    return snprintf(buffer, buffer_size, HTTPC_REQ_11_FORMAT(uri));
+  }
+}
+
+/** Initialize the connection struct */
+static err_t
+httpc_init_connection_common(httpc_state_t **connection, const httpc_connection_t *settings, const char* server_name,
+                      u16_t server_port, const char* uri, altcp_recv_fn recv_fn, void* callback_arg, int use_host)
+{
+  size_t alloc_len;
+  mem_size_t mem_alloc_len;
+  int req_len, req_len2;
+  httpc_state_t *req;
+#if HTTPC_DEBUG_REQUEST
+  size_t server_name_len, uri_len;
+#endif
+
+  LWIP_ASSERT("uri != NULL", uri != NULL);
+
+  /* get request len */
+  req_len = httpc_create_request_string(settings, server_name, server_port, uri, use_host, NULL, 0);
+  if ((req_len < 0) || (req_len > 0xFFFF)) {
+    return ERR_VAL;
+  }
+  /* alloc state and request in one block */
+  alloc_len = sizeof(httpc_state_t);
+#if HTTPC_DEBUG_REQUEST
+  server_name_len = server_name ? strlen(server_name) : 0;
+  uri_len = strlen(uri);
+  alloc_len += server_name_len + 1 + uri_len + 1;
+#endif
+  mem_alloc_len = (mem_size_t)alloc_len;
+  if ((mem_alloc_len < alloc_len) || (req_len + 1 > 0xFFFF)) {
+    return ERR_VAL;
+  }
+
+  req = (httpc_state_t*)mem_malloc((mem_size_t)alloc_len);
+  if(req == NULL) {
+    return ERR_MEM;
+  }
+  memset(req, 0, sizeof(httpc_state_t));
+  req->timeout_ticks = HTTPC_POLL_TIMEOUT;
+  req->request = pbuf_alloc(PBUF_RAW, (u16_t)(req_len + 1), PBUF_RAM);
+  if (req->request == NULL) {
+    httpc_free_state(req);
+    return ERR_MEM;
+  }
+  if (req->request->next != NULL) {
+    /* need a pbuf in one piece */
+    httpc_free_state(req);
+    return ERR_MEM;
+  }
+  req->hdr_content_len = HTTPC_CONTENT_LEN_INVALID;
+#if HTTPC_DEBUG_REQUEST
+  req->server_name = (char*)(req + 1);
+  if (server_name) {
+    memcpy(req->server_name, server_name, server_name_len + 1);
+  }
+  req->uri = req->server_name + server_name_len + 1;
+  memcpy(req->uri, uri, uri_len + 1);
+#endif
+  req->pcb = altcp_new(settings->altcp_allocator);
+  if(req->pcb == NULL) {
+    httpc_free_state(req);
+    return ERR_MEM;
+  }
+  req->remote_port = settings->use_proxy ? settings->proxy_port : server_port;
+  altcp_arg(req->pcb, req);
+  altcp_recv(req->pcb, httpc_tcp_recv);
+  altcp_err(req->pcb, httpc_tcp_err);
+  altcp_poll(req->pcb, httpc_tcp_poll, HTTPC_POLL_INTERVAL);
+  altcp_sent(req->pcb, httpc_tcp_sent);
+
+  /* set up request buffer */
+  req_len2 = httpc_create_request_string(settings, server_name, server_port, uri, use_host,
+    (char *)req->request->payload, req_len + 1);
+  if (req_len2 != req_len) {
+    httpc_free_state(req);
+    return ERR_VAL;
+  }
+
+  req->recv_fn = recv_fn;
+  req->conn_settings = settings;
+  req->callback_arg = callback_arg;
+
+  *connection = req;
+  return ERR_OK;
+}
+
+/**
+ * Initialize the connection struct
+ */
+static err_t
+httpc_init_connection(httpc_state_t **connection, const httpc_connection_t *settings, const char* server_name,
+                      u16_t server_port, const char* uri, altcp_recv_fn recv_fn, void* callback_arg)
+{
+  return httpc_init_connection_common(connection, settings, server_name, server_port, uri, recv_fn, callback_arg, 1);
+}
+
+
+/**
+ * Initialize the connection struct (from IP address)
+ */
+static err_t
+httpc_init_connection_addr(httpc_state_t **connection, const httpc_connection_t *settings,
+                           const ip_addr_t* server_addr, u16_t server_port, const char* uri,
+                           altcp_recv_fn recv_fn, void* callback_arg)
+{
+  char *server_addr_str = ipaddr_ntoa(server_addr);
+  if (server_addr_str == NULL) {
+    return ERR_VAL;
+  }
+  return httpc_init_connection_common(connection, settings, server_addr_str, server_port, uri,
+    recv_fn, callback_arg, 1);
+}
+
+/**
+ * @ingroup httpc 
+ * HTTP client API: get a file by passing server IP address
+ *
+ * @param server_addr IP address of the server to connect
+ * @param port tcp port of the server
+ * @param uri uri to get from the server, remember leading "/"!
+ * @param settings connection settings (callbacks, proxy, etc.)
+ * @param recv_fn the http body (not the headers) are passed to this callback
+ * @param callback_arg argument passed to all the callbacks
+ * @param connection retreives the connection handle (to match in callbacks)
+ * @return ERR_OK if starting the request succeeds (callback_fn will be called later)
+ *         or an error code
+ */
+err_t
+httpc_get_file(const ip_addr_t* server_addr, u16_t port, const char* uri, const httpc_connection_t *settings,
+               altcp_recv_fn recv_fn, void* callback_arg, httpc_state_t **connection)
+{
+  err_t err;
+  httpc_state_t* req;
+
+  LWIP_ERROR("invalid parameters", (server_addr != NULL) && (uri != NULL) && (recv_fn != NULL), return ERR_ARG;);
+
+  err = httpc_init_connection_addr(&req, settings, server_addr, port,
+    uri, recv_fn, callback_arg);
+  if (err != ERR_OK) {
+    return err;
+  }
+
+  if (settings->use_proxy) {
+    err = httpc_get_internal_addr(req, &settings->proxy_addr);
+  } else {
+    err = httpc_get_internal_addr(req, server_addr);
+  }
+  if(err != ERR_OK) {
+    httpc_free_state(req);
+    return err;
+  }
+
+  if (connection != NULL) {
+    *connection = req;
+  }
+  return ERR_OK;
+}
+
+/**
+ * @ingroup httpc 
+ * HTTP client API: get a file by passing server name as string (DNS name or IP address string)
+ *
+ * @param server_name server name as string (DNS name or IP address string)
+ * @param port tcp port of the server
+ * @param uri uri to get from the server, remember leading "/"!
+ * @param settings connection settings (callbacks, proxy, etc.)
+ * @param recv_fn the http body (not the headers) are passed to this callback
+ * @param callback_arg argument passed to all the callbacks
+ * @param connection retreives the connection handle (to match in callbacks)
+ * @return ERR_OK if starting the request succeeds (callback_fn will be called later)
+ *         or an error code
+ */
+err_t
+httpc_get_file_dns(const char* server_name, u16_t port, const char* uri, const httpc_connection_t *settings,
+                   altcp_recv_fn recv_fn, void* callback_arg, httpc_state_t **connection)
+{
+  err_t err;
+  httpc_state_t* req;
+
+  LWIP_ERROR("invalid parameters", (server_name != NULL) && (uri != NULL) && (recv_fn != NULL), return ERR_ARG;);
+
+  err = httpc_init_connection(&req, settings, server_name, port, uri, recv_fn, callback_arg);
+  if (err != ERR_OK) {
+    return err;
+  }
+
+  if (settings->use_proxy) {
+    err = httpc_get_internal_addr(req, &settings->proxy_addr);
+  } else {
+    err = httpc_get_internal_dns(req, server_name);
+  }
+  if(err != ERR_OK) {
+    httpc_free_state(req);
+    return err;
+  }
+
+  if (connection != NULL) {
+    *connection = req;
+  }
+  return ERR_OK;
+}
+
+#if LWIP_HTTPC_HAVE_FILE_IO
+/* Implementation to disk via fopen/fwrite/fclose follows */
+
+typedef struct _httpc_filestate
+{
+  const char* local_file_name;
+  FILE *file;
+  httpc_connection_t settings;
+  const httpc_connection_t *client_settings;
+  void *callback_arg;
+} httpc_filestate_t;
+
+static void httpc_fs_result(void *arg, httpc_result_t httpc_result, u32_t rx_content_len,
+  u32_t srv_res, err_t err);
+
+/** Initalize http client state for download to file system */
+static err_t
+httpc_fs_init(httpc_filestate_t **filestate_out, const char* local_file_name,
+              const httpc_connection_t *settings, void* callback_arg)
+{
+  httpc_filestate_t *filestate;
+  size_t file_len, alloc_len;
+  FILE *f;
+
+  file_len = strlen(local_file_name);
+  alloc_len = sizeof(httpc_filestate_t) + file_len + 1;
+
+  filestate = (httpc_filestate_t *)mem_malloc((mem_size_t)alloc_len);
+  if (filestate == NULL) {
+    return ERR_MEM;
+  }
+  memset(filestate, 0, sizeof(httpc_filestate_t));
+  filestate->local_file_name = (const char *)(filestate + 1);
+  memcpy((char *)(filestate + 1), local_file_name, file_len + 1);
+  filestate->file = NULL;
+  filestate->client_settings = settings;
+  filestate->callback_arg = callback_arg;
+  /* copy client settings but override result callback */
+  memcpy(&filestate->settings, settings, sizeof(httpc_connection_t));
+  filestate->settings.result_fn = httpc_fs_result;
+
+  f = fopen(local_file_name, "wb");
+  if(f == NULL) {
+    /* could not open file */
+    mem_free(filestate);
+    return ERR_VAL;
+  }
+  filestate->file = f;
+  *filestate_out = filestate;
+  return ERR_OK;
+}
+
+/** Free http client state for download to file system */
+static void
+httpc_fs_free(httpc_filestate_t *filestate)
+{
+  if (filestate != NULL) {
+    if (filestate->file != NULL) {
+      fclose(filestate->file);
+      filestate->file = NULL;
+    }
+    mem_free(filestate);
+  }
+}
+
+/** Connection closed (success or error) */
+static void
+httpc_fs_result(void *arg, httpc_result_t httpc_result, u32_t rx_content_len,
+                u32_t srv_res, err_t err)
+{
+  httpc_filestate_t *filestate = (httpc_filestate_t *)arg;
+  if (filestate != NULL) {
+    if (filestate->client_settings->result_fn != NULL) {
+      filestate->client_settings->result_fn(filestate->callback_arg, httpc_result, rx_content_len,
+        srv_res, err);
+    }
+    httpc_fs_free(filestate);
+  }
+}
+
+/** tcp recv callback */
+static err_t
+httpc_fs_tcp_recv(void *arg, struct altcp_pcb *pcb, struct pbuf *p, err_t err)
+{
+  httpc_filestate_t *filestate = (httpc_filestate_t*)arg;
+  struct pbuf* q;
+  LWIP_UNUSED_ARG(err);
+
+  LWIP_ASSERT("p != NULL", p != NULL);
+
+  for (q = p; q != NULL; q = q->next) {
+    fwrite(q->payload, 1, q->len, filestate->file);
+  }
+  altcp_recved(pcb, p->tot_len);
+  pbuf_free(p);
+  return ERR_OK;
+}
+
+/**
+ * @ingroup httpc 
+ * HTTP client API: get a file to disk by passing server IP address
+ *
+ * @param server_addr IP address of the server to connect
+ * @param port tcp port of the server
+ * @param uri uri to get from the server, remember leading "/"!
+ * @param settings connection settings (callbacks, proxy, etc.)
+ * @param callback_arg argument passed to all the callbacks
+ * @param connection retreives the connection handle (to match in callbacks)
+ * @return ERR_OK if starting the request succeeds (callback_fn will be called later)
+ *         or an error code
+ */
+err_t
+httpc_get_file_to_disk(const ip_addr_t* server_addr, u16_t port, const char* uri, const httpc_connection_t *settings,
+                       void* callback_arg, const char* local_file_name, httpc_state_t **connection)
+{
+  err_t err;
+  httpc_state_t* req;
+  httpc_filestate_t *filestate;
+
+  LWIP_ERROR("invalid parameters", (server_addr != NULL) && (uri != NULL) && (local_file_name != NULL), return ERR_ARG;);
+
+  err = httpc_fs_init(&filestate, local_file_name, settings, callback_arg);
+  if (err != ERR_OK) {
+    return err;
+  }
+
+  err = httpc_init_connection_addr(&req, &filestate->settings, server_addr, port,
+    uri, httpc_fs_tcp_recv, filestate);
+  if (err != ERR_OK) {
+    httpc_fs_free(filestate);
+    return err;
+  }
+
+  if (settings->use_proxy) {
+    err = httpc_get_internal_addr(req, &settings->proxy_addr);
+  } else {
+    err = httpc_get_internal_addr(req, server_addr);
+  }
+  if(err != ERR_OK) {
+    httpc_fs_free(filestate);
+    httpc_free_state(req);
+    return err;
+  }
+
+  if (connection != NULL) {
+    *connection = req;
+  }
+  return ERR_OK;
+}
+
+/**
+ * @ingroup httpc 
+ * HTTP client API: get a file to disk by passing server name as string (DNS name or IP address string)
+ *
+ * @param server_name server name as string (DNS name or IP address string)
+ * @param port tcp port of the server
+ * @param uri uri to get from the server, remember leading "/"!
+ * @param settings connection settings (callbacks, proxy, etc.)
+ * @param callback_arg argument passed to all the callbacks
+ * @param connection retreives the connection handle (to match in callbacks)
+ * @return ERR_OK if starting the request succeeds (callback_fn will be called later)
+ *         or an error code
+ */
+err_t
+httpc_get_file_dns_to_disk(const char* server_name, u16_t port, const char* uri, const httpc_connection_t *settings,
+                           void* callback_arg, const char* local_file_name, httpc_state_t **connection)
+{
+  err_t err;
+  httpc_state_t* req;
+  httpc_filestate_t *filestate;
+
+  LWIP_ERROR("invalid parameters", (server_name != NULL) && (uri != NULL) && (local_file_name != NULL), return ERR_ARG;);
+
+  err = httpc_fs_init(&filestate, local_file_name, settings, callback_arg);
+  if (err != ERR_OK) {
+    return err;
+  }
+
+  err = httpc_init_connection(&req, &filestate->settings, server_name, port,
+    uri, httpc_fs_tcp_recv, filestate);
+  if (err != ERR_OK) {
+    httpc_fs_free(filestate);
+    return err;
+  }
+
+  if (settings->use_proxy) {
+    err = httpc_get_internal_addr(req, &settings->proxy_addr);
+  } else {
+    err = httpc_get_internal_dns(req, server_name);
+  }
+  if(err != ERR_OK) {
+    httpc_fs_free(filestate);
+    httpc_free_state(req);
+    return err;
+  }
+
+  if (connection != NULL) {
+    *connection = req;
+  }
+  return ERR_OK;
+}
+#endif /* LWIP_HTTPC_HAVE_FILE_IO */
+
+#endif /* LWIP_TCP && LWIP_CALLBACK_API */
--- a/src/apps/httpd/httpd.c
+++ b/src/apps/httpd/httpd.c
--- a/src/apps/http/httpd_structs.h
+++ b/src/apps/http/httpd_structs.h
@@ -0,0 +1,123 @@
+#ifndef LWIP_HTTPD_STRUCTS_H
+#define LWIP_HTTPD_STRUCTS_H
+
+#include "lwip/apps/httpd.h"
+
+#if LWIP_HTTPD_DYNAMIC_HEADERS
+/** This struct is used for a list of HTTP header strings for various
+ * filename extensions. */
+typedef struct {
+  const char *extension;
+  const char *content_type;
+} tHTTPHeader;
+
+/** A list of strings used in HTTP headers (see RFC 1945 HTTP/1.0 and
+ * RFC 2616 HTTP/1.1 for header field definitions) */
+static const char *const g_psHTTPHeaderStrings[] = {
+  "HTTP/1.0 200 OK\r\n",
+  "HTTP/1.0 404 File not found\r\n",
+  "HTTP/1.0 400 Bad Request\r\n",
+  "HTTP/1.0 501 Not Implemented\r\n",
+  "HTTP/1.1 200 OK\r\n",
+  "HTTP/1.1 404 File not found\r\n",
+  "HTTP/1.1 400 Bad Request\r\n",
+  "HTTP/1.1 501 Not Implemented\r\n",
+  "Content-Length: ",
+  "Connection: Close\r\n",
+  "Connection: keep-alive\r\n",
+  "Connection: keep-alive\r\nContent-Length: ",
+  "Server: "HTTPD_SERVER_AGENT"\r\n",
+  "\r\n<html><body><h2>404: The requested file cannot be found.</h2></body></html>\r\n"
+#if LWIP_HTTPD_SUPPORT_11_KEEPALIVE
+  , "Connection: keep-alive\r\nContent-Length: 77\r\n\r\n<html><body><h2>404: The requested file cannot be found.</h2></body></html>\r\n"
+#endif
+};
+
+/* Indexes into the g_psHTTPHeaderStrings array */
+#define HTTP_HDR_OK             0 /* 200 OK */
+#define HTTP_HDR_NOT_FOUND      1 /* 404 File not found */
+#define HTTP_HDR_BAD_REQUEST    2 /* 400 Bad request */
+#define HTTP_HDR_NOT_IMPL       3 /* 501 Not Implemented */
+#define HTTP_HDR_OK_11          4 /* 200 OK */
+#define HTTP_HDR_NOT_FOUND_11   5 /* 404 File not found */
+#define HTTP_HDR_BAD_REQUEST_11 6 /* 400 Bad request */
+#define HTTP_HDR_NOT_IMPL_11    7 /* 501 Not Implemented */
+#define HTTP_HDR_CONTENT_LENGTH 8 /* Content-Length: (HTTP 1.0)*/
+#define HTTP_HDR_CONN_CLOSE     9 /* Connection: Close (HTTP 1.1) */
+#define HTTP_HDR_CONN_KEEPALIVE 10 /* Connection: keep-alive (HTTP 1.1) */
+#define HTTP_HDR_KEEPALIVE_LEN  11 /* Connection: keep-alive + Content-Length: (HTTP 1.1)*/
+#define HTTP_HDR_SERVER         12 /* Server: HTTPD_SERVER_AGENT */
+#define DEFAULT_404_HTML        13 /* default 404 body */
+#if LWIP_HTTPD_SUPPORT_11_KEEPALIVE
+#define DEFAULT_404_HTML_PERSISTENT 14 /* default 404 body, but including Connection: keep-alive */
+#endif
+
+#define HTTP_CONTENT_TYPE(contenttype) "Content-Type: "contenttype"\r\n\r\n"
+#define HTTP_CONTENT_TYPE_ENCODING(contenttype, encoding) "Content-Type: "contenttype"\r\nContent-Encoding: "encoding"\r\n\r\n"
+
+#define HTTP_HDR_HTML           HTTP_CONTENT_TYPE("text/html")
+#define HTTP_HDR_SSI            HTTP_CONTENT_TYPE("text/html\r\nExpires: Fri, 10 Apr 2008 14:00:00 GMT\r\nPragma: no-cache")
+#define HTTP_HDR_GIF            HTTP_CONTENT_TYPE("image/gif")
+#define HTTP_HDR_PNG            HTTP_CONTENT_TYPE("image/png")
+#define HTTP_HDR_JPG            HTTP_CONTENT_TYPE("image/jpeg")
+#define HTTP_HDR_BMP            HTTP_CONTENT_TYPE("image/bmp")
+#define HTTP_HDR_ICO            HTTP_CONTENT_TYPE("image/x-icon")
+#define HTTP_HDR_APP            HTTP_CONTENT_TYPE("application/octet-stream")
+#define HTTP_HDR_JS             HTTP_CONTENT_TYPE("application/javascript")
+#define HTTP_HDR_RA             HTTP_CONTENT_TYPE("application/javascript")
+#define HTTP_HDR_CSS            HTTP_CONTENT_TYPE("text/css")
+#define HTTP_HDR_SWF            HTTP_CONTENT_TYPE("application/x-shockwave-flash")
+#define HTTP_HDR_XML            HTTP_CONTENT_TYPE("text/xml")
+#define HTTP_HDR_PDF            HTTP_CONTENT_TYPE("application/pdf")
+#define HTTP_HDR_JSON           HTTP_CONTENT_TYPE("application/json")
+#define HTTP_HDR_CSV            HTTP_CONTENT_TYPE("text/csv")
+#define HTTP_HDR_TSV            HTTP_CONTENT_TYPE("text/tsv")
+#define HTTP_HDR_SVG            HTTP_CONTENT_TYPE("image/svg+xml")
+#define HTTP_HDR_SVGZ           HTTP_CONTENT_TYPE_ENCODING("image/svg+xml", "gzip")
+
+#define HTTP_HDR_DEFAULT_TYPE   HTTP_CONTENT_TYPE("text/plain")
+
+/** A list of extension-to-HTTP header strings (see outdated RFC 1700 MEDIA TYPES
+ * and http://www.iana.org/assignments/media-types for registered content types
+ * and subtypes) */
+static const tHTTPHeader g_psHTTPHeaders[] = {
+  { "html", HTTP_HDR_HTML},
+  { "htm",  HTTP_HDR_HTML},
+  { "shtml", HTTP_HDR_SSI},
+  { "shtm", HTTP_HDR_SSI},
+  { "ssi",  HTTP_HDR_SSI},
+  { "gif",  HTTP_HDR_GIF},
+  { "png",  HTTP_HDR_PNG},
+  { "jpg",  HTTP_HDR_JPG},
+  { "bmp",  HTTP_HDR_BMP},
+  { "ico",  HTTP_HDR_ICO},
+  { "class", HTTP_HDR_APP},
+  { "cls",  HTTP_HDR_APP},
+  { "js",   HTTP_HDR_JS},
+  { "ram",  HTTP_HDR_RA},
+  { "css",  HTTP_HDR_CSS},
+  { "swf",  HTTP_HDR_SWF},
+  { "xml",  HTTP_HDR_XML},
+  { "xsl",  HTTP_HDR_XML},
+  { "pdf",  HTTP_HDR_PDF},
+  { "json", HTTP_HDR_JSON}
+#ifdef HTTPD_ADDITIONAL_CONTENT_TYPES
+  /* If you need to add content types not listed here:
+   * #define HTTPD_ADDITIONAL_CONTENT_TYPES {"ct1", HTTP_CONTENT_TYPE("text/ct1")}, {"exe", HTTP_CONTENT_TYPE("application/exe")}
+   */
+  , HTTPD_ADDITIONAL_CONTENT_TYPES
+#endif
+};
+
+#define NUM_HTTP_HEADERS LWIP_ARRAYSIZE(g_psHTTPHeaders)
+
+#endif /* LWIP_HTTPD_DYNAMIC_HEADERS */
+
+#if LWIP_HTTPD_SSI
+static const char *const g_pcSSIExtensions[] = {
+  ".shtml", ".shtm", ".ssi", ".xml", ".json"
+};
+#define NUM_SHTML_EXTENSIONS LWIP_ARRAYSIZE(g_pcSSIExtensions)
+#endif /* LWIP_HTTPD_SSI */
+
+#endif /* LWIP_HTTPD_STRUCTS_H */
--- a/src/apps/httpd/makefsdata/makefsdata
+++ b/src/apps/httpd/makefsdata/makefsdata
--- a/src/apps/httpd/makefsdata/makefsdata.c
+++ b/src/apps/httpd/makefsdata/makefsdata.c
@@ -13,17 +13,12 @@

 #include <stdio.h>
 #include <stdlib.h>
-#ifdef WIN32
-#define WIN32_LEAN_AND_MEAN
-#include "windows.h"
-#else
-#include <dir.h>
-#endif
-#include <dos.h>
 #include <string.h>
 #include <time.h>
 #include <sys/stat.h>

+#include "tinydir.h"
+
 /** Makefsdata can generate *all* files deflate-compressed (where file size shrinks).
 * Since nearly all browsers support this, this is a good way to reduce ROM size.
 * To compress the files, "miniz.c" must be downloaded seperately.
@@ -65,41 +60,22 @@ int deflate_level = 10; /* default compression level, can be changed via command
 #define USAGE_ARG_DEFLATE ""
 #endif /* MAKEFS_SUPPORT_DEFLATE */

-/* Compatibility defines Win32 vs. DOS */
 #ifdef WIN32

-#define FIND_T                        WIN32_FIND_DATAA
-#define FIND_T_FILENAME(fInfo)        (fInfo.cFileName)
-#define FIND_T_IS_DIR(fInfo)          ((fInfo.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0)
-#define FIND_T_IS_FILE(fInfo)         ((fInfo.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) == 0)
-#define FIND_RET_T                    HANDLE
-#define FINDFIRST_FILE(path, result)  FindFirstFileA(path, result)
-#define FINDFIRST_DIR(path, result)   FindFirstFileA(path, result)
-#define FINDNEXT(ff_res, result)      FindNextFileA(ff_res, result)
-#define FINDFIRST_SUCCEEDED(ret)      (ret != INVALID_HANDLE_VALUE)
-#define FINDNEXT_SUCCEEDED(ret)       (ret == TRUE)
-
 #define GETCWD(path, len)             GetCurrentDirectoryA(len, path)
 #define CHDIR(path)                   SetCurrentDirectoryA(path)
 #define CHDIR_SUCCEEDED(ret)          (ret == TRUE)

-#else
-
-#define FIND_T                        struct ffblk
-#define FIND_T_FILENAME(fInfo)        (fInfo.ff_name)
-#define FIND_T_IS_DIR(fInfo)          ((fInfo.ff_attrib & FA_DIREC) == FA_DIREC)
-#define FIND_T_IS_FILE(fInfo)         (1)
-#define FIND_RET_T                    int
-#define FINDFIRST_FILE(path, result)  findfirst(path, result, FA_ARCH)
-#define FINDFIRST_DIR(path, result)   findfirst(path, result, FA_DIREC)
-#define FINDNEXT(ff_res, result)      FindNextFileA(ff_res, result)
-#define FINDFIRST_SUCCEEDED(ret)      (ret == 0)
-#define FINDNEXT_SUCCEEDED(ret)       (ret == 0)
+#elif __linux__

 #define GETCWD(path, len)             getcwd(path, len)
 #define CHDIR(path)                   chdir(path)
 #define CHDIR_SUCCEEDED(ret)          (ret == 0)

+#else
+
+#error makefsdata not supported on this platform
+
 #endif

 #define NEWLINE     "\r\n"
@@ -131,8 +107,7 @@ static int payload_alingment_dummy_counter = 0;

 #define MAX_PATH_LEN 256

-struct file_entry
-{
+struct file_entry {
  struct file_entry *next;
  const char *filename_c;
 };
@@ -145,6 +120,10 @@ int file_put_ascii(FILE *file, const char *ascii_string, int len, int *i);
 int s_put_ascii(char *buf, const char *ascii_string, int len, int *i);
 void concat_files(const char *file1, const char *file2, const char *targetfile);
 int check_path(char *path, size_t size);
+static int checkSsiByFilelist(const char* filename_listfile);
+static int ext_in_list(const char* filename, const char *ext_list);
+static int file_to_exclude(const char* filename);
+static int file_can_be_compressed(const char* filename);

 /* 5 bytes per char + 3 bytes per line */
 static char file_buffer_c[COPY_BUFSIZE * 5 + ((COPY_BUFSIZE / HEX_BYTES_PER_LINE) * 3)];
@@ -164,22 +143,31 @@ unsigned char deflateNonSsiFiles = 0;
 size_t deflatedBytesReduced = 0;
 size_t overallDataBytes = 0;
 #endif
+const char *exclude_list = NULL;
+const char *ncompress_list = NULL;

 struct file_entry *first_file = NULL;
 struct file_entry *last_file = NULL;

+static char *ssi_file_buffer;
+static char **ssi_file_lines;
+static size_t ssi_file_num_lines;
+
 static void print_usage(void)
 {
-  printf(" Usage: htmlgen [targetdir] [-s] [-e] [-i] [-11] [-nossi] [-c] [-f:<filename>] [-m] [-svr:<name>]" USAGE_ARG_DEFLATE NEWLINE NEWLINE);
+  printf(" Usage: htmlgen [targetdir] [-s] [-e] [-11] [-nossi] [-ssi:<filename>] [-c] [-f:<filename>] [-m] [-svr:<name>] [-x:<ext_list>] [-xc:<ext_list>" USAGE_ARG_DEFLATE NEWLINE NEWLINE);
  printf("   targetdir: relative or absolute path to files to convert" NEWLINE);
  printf("   switch -s: toggle processing of subdirectories (default is on)" NEWLINE);
  printf("   switch -e: exclude HTTP header from file (header is created at runtime, default is off)" NEWLINE);
  printf("   switch -11: include HTTP 1.1 header (1.0 is default)" NEWLINE);
  printf("   switch -nossi: no support for SSI (cannot calculate Content-Length for SSI)" NEWLINE);
+  printf("   switch -ssi: ssi filename (ssi support controlled by file list, not by extension)" NEWLINE);
  printf("   switch -c: precalculate checksums for all pages (default is off)" NEWLINE);
  printf("   switch -f: target filename (default is \"fsdata.c\")" NEWLINE);
  printf("   switch -m: include \"Last-Modified\" header based on file time" NEWLINE);
  printf("   switch -svr: server identifier sent in HTTP response header ('Server' field)" NEWLINE);
+  printf("   switch -x: comma separated list of extensions of files to exclude (e.g., -x:json,txt)" NEWLINE);
+  printf("   switch -xc: comma separated list of extensions of files to not compress (e.g., -xc:mp3,jpg)" NEWLINE);
 #if MAKEFS_SUPPORT_DEFLATE
  printf("   switch -defl: deflate-compress all non-SSI files (with opt. compr.-level, default=10)" NEWLINE);
  printf("                 ATTENTION: browser has to support \"Content-Encoding: deflate\"!" NEWLINE);
@@ -206,6 +194,8 @@ int main(int argc, char *argv[])
  printf("     by Jim Pettinato               - circa 2003 " NEWLINE);
  printf("     extended by Simon Goldschmidt  - 2009 " NEWLINE NEWLINE);

+  LWIP_ASSERT("sizeof(hdr_buf) must fit into an u16_t", sizeof(hdr_buf) <= 0xffff);
+
  strcpy(path, "fs");
  for (i = 1; i < argc; i++) {
    if (argv[i] == NULL) {
@@ -216,23 +206,30 @@ int main(int argc, char *argv[])
        snprintf(serverIDBuffer, sizeof(serverIDBuffer), "Server: %s\r\n", &argv[i][5]);
        serverID = serverIDBuffer;
        printf("Using Server-ID: \"%s\"\n", serverID);
-      } else if (strstr(argv[i], "-s") == argv[i]) {
+      } else if (!strcmp(argv[i], "-s")) {
        processSubs = 0;
-      } else if (strstr(argv[i], "-e") == argv[i]) {
+      } else if (!strcmp(argv[i], "-e")) {
        includeHttpHeader = 0;
-      } else if (strstr(argv[i], "-11") == argv[i]) {
+      } else if (!strcmp(argv[i], "-11")) {
        useHttp11 = 1;
-      } else if (strstr(argv[i], "-nossi") == argv[i]) {
+      } else if (!strcmp(argv[i], "-nossi")) {
        supportSsi = 0;
-      } else if (strstr(argv[i], "-c") == argv[i]) {
+      } else if (strstr(argv[i], "-ssi:") == argv[i]) {
+        const char* ssi_list_filename = &argv[i][5];
+        if (checkSsiByFilelist(ssi_list_filename)) {
+          printf("Reading list of SSI files from \"%s\"\n", ssi_list_filename);
+        } else {
+          printf("Failed to load list of SSI files from \"%s\"\n", ssi_list_filename);
+        }
+      } else if (!strcmp(argv[i], "-c")) {
        precalcChksum = 1;
      } else if (strstr(argv[i], "-f:") == argv[i]) {
        strncpy(targetfile, &argv[i][3], sizeof(targetfile) - 1);
        targetfile[sizeof(targetfile) - 1] = 0;
        printf("Writing to file \"%s\"\n", targetfile);
-      } else if (strstr(argv[i], "-m") == argv[i]) {
+      } else if (!strcmp(argv[i], "-m")) {
        includeLastModified = 1;
-      } else if (strstr(argv[i], "-defl") == argv[i]) {
+      } else if (!strcmp(argv[i], "-defl")) {
 #if MAKEFS_SUPPORT_DEFLATE
        char *colon = strstr(argv[i], ":");
        if (colon) {
@@ -251,6 +248,12 @@ int main(int argc, char *argv[])
 #else
        printf("WARNING: Deflate support is disabled\n");
 #endif
+      } else if (strstr(argv[i], "-x:") == argv[i]) {
+        exclude_list = &argv[i][3];
+        printf("Excluding files with extensions %s" NEWLINE, exclude_list);
+      } else if (strstr(argv[i], "-xc:") == argv[i]) {
+        ncompress_list = &argv[i][4];
+        printf("Skipping compresion for files with extensions %s" NEWLINE, ncompress_list);
      } else if ((strstr(argv[i], "-?")) || (strstr(argv[i], "-h"))) {
        print_usage();
        exit(0);
@@ -283,7 +286,7 @@ int main(int argc, char *argv[])
         (includeHttpHeader ? (useHttp11 ? "1.1 " : "1.0 ") : ""),
         (includeHttpHeader ? "be" : "not be"));

-  sprintf(curSubdir, "");  /* start off in web page's root directory - relative paths */
+  curSubdir[0] = '\0'; /* start off in web page's root directory - relative paths */
  printf("  Processing all files in directory %s", path);
  if (processSubs) {
    printf(" and subdirectories..." NEWLINE NEWLINE);
@@ -306,8 +309,7 @@ int main(int argc, char *argv[])
  CHDIR(path);

  fprintf(data_file, "#include \"lwip/apps/fs.h\"" NEWLINE);
-  fprintf(data_file, "#include \"lwip/def.h\"" NEWLINE);
-  fprintf(data_file, "#include \"fsdata.h\"" NEWLINE NEWLINE NEWLINE);
+  fprintf(data_file, "#include \"lwip/def.h\"" NEWLINE NEWLINE NEWLINE);

  fprintf(data_file, "#define file_NULL (struct fsdata_file *) NULL" NEWLINE NEWLINE NEWLINE);
  /* define FS_FILE_FLAGS_HEADER_INCLUDED to 1 if not defined (compatibility with older httpd/fs) */
@@ -366,6 +368,13 @@ int main(int argc, char *argv[])
    free(fe);
  }

+  if (ssi_file_buffer) {
+    free(ssi_file_buffer);
+  }
+  if (ssi_file_lines) {
+    free(ssi_file_lines);
+  }
+
  return 0;
 }

@@ -425,66 +434,109 @@ void concat_files(const char *file1, const char *file2, const char *targetfile)

 int process_sub(FILE *data_file, FILE *struct_file)
 {
-  FIND_T fInfo;
-  FIND_RET_T fret;
+  tinydir_dir dir;
  int filesProcessed = 0;

  if (processSubs) {
    /* process subs recursively */
    size_t sublen = strlen(curSubdir);
    size_t freelen = sizeof(curSubdir) - sublen - 1;
+    int ret;
    LWIP_ASSERT("sublen < sizeof(curSubdir)", sublen < sizeof(curSubdir));
-    fret = FINDFIRST_DIR("*", &fInfo);
-    if (FINDFIRST_SUCCEEDED(fret)) {
-      do {
-        const char *curName = FIND_T_FILENAME(fInfo);
-        if ((curName[0] == '.') || (strcmp(curName, "CVS") == 0)) {
+
+    ret = tinydir_open_sorted(&dir, TINYDIR_STRING("."));
+
+    if (ret == 0) {
+      unsigned int i;
+      for (i = 0; i < dir.n_files; i++) {
+        tinydir_file file;
+
+        ret = tinydir_readfile_n(&dir, &file, i);
+
+        if (ret == 0) {
+#if (defined _MSC_VER || defined __MINGW32__) && (defined _UNICODE)
+          size_t num_char_converted;
+          char currName[256];
+          wcstombs_s(&num_char_converted, currName, sizeof(currName), file.name, sizeof(currName));
+#else
+          const char *currName = file.name;
+#endif
+
+          if (currName[0] == '.') {
            continue;
          }
-        if (!FIND_T_IS_DIR(fInfo)) {
+          if (!file.is_dir) {
            continue;
          }
          if (freelen > 0) {
-           CHDIR(curName);
+            CHDIR(currName);
            strncat(curSubdir, "/", freelen);
-           strncat(curSubdir, curName, freelen - 1);
+            strncat(curSubdir, currName, freelen - 1);
            curSubdir[sizeof(curSubdir) - 1] = 0;
            printf("processing subdirectory %s/..." NEWLINE, curSubdir);
            filesProcessed += process_sub(data_file, struct_file);
            CHDIR("..");
            curSubdir[sublen] = 0;
          } else {
-           printf("WARNING: cannot process sub due to path length restrictions: \"%s/%s\"\n", curSubdir, curName);
+            printf("WARNING: cannot process sub due to path length restrictions: \"%s/%s\"\n", curSubdir, currName);
+          }
        }
-      } while (FINDNEXT_SUCCEEDED(FINDNEXT(fret, &fInfo)));
      }
    }

-  fret = FINDFIRST_FILE("*.*", &fInfo);
-  if (FINDFIRST_SUCCEEDED(fret)) {
-    /* at least one file in directory */
-    do {
-      if (FIND_T_IS_FILE(fInfo)) {
-        const char *curName = FIND_T_FILENAME(fInfo);
+    ret = tinydir_open_sorted(&dir, TINYDIR_STRING("."));
+    if (ret == 0) {
+      unsigned int i;
+      for (i = 0; i < dir.n_files; i++) {
+        tinydir_file file;
+
+        ret = tinydir_readfile_n(&dir, &file, i);
+
+        if (ret == 0) {
+          if (!file.is_dir) {
+#if (defined _MSC_VER || defined __MINGW32__) && (defined _UNICODE)
+            size_t num_char_converted;
+            char curName[256];
+            wcstombs_s(&num_char_converted, curName, sizeof(curName), file.name, sizeof(curName));
+#else
+            const char *curName = file.name;
+#endif
+
+            if (strcmp(curName, "fsdata.tmp") == 0) {
+              continue;
+            }
+            if (strcmp(curName, "fshdr.tmp") == 0) {
+              continue;
+            }
+            if (file_to_exclude(curName)) {
+              printf("skipping %s/%s by exclude list (-x option)..." NEWLINE, curSubdir, curName);
+              continue;
+            }
+
            printf("processing %s/%s..." NEWLINE, curSubdir, curName);
+
            if (process_file(data_file, struct_file, curName) < 0) {
              printf(NEWLINE "Error... aborting" NEWLINE);
              return -1;
            }
            filesProcessed++;
          }
-    } while (FINDNEXT_SUCCEEDED(FINDNEXT(fret, &fInfo)));
        }
+      }
+    }
+  }
+
  return filesProcessed;
 }

-u8_t* get_file_data(const char* filename, int* file_size, int can_be_compressed, int* is_compressed)
+static u8_t *get_file_data(const char *filename, int *file_size, int can_be_compressed, int *is_compressed)
 {
  FILE *inFile;
  size_t fsize = 0;
  u8_t *buf;
  size_t r;
  int rs;
+  LWIP_UNUSED_ARG(r); /* for LWIP_NOASSERT */
  inFile = fopen(filename, "rb");
  if (inFile == NULL) {
    printf("Failed to open file \"%s\"\n", filename);
@@ -501,6 +553,7 @@ u8_t* get_file_data(const char* filename, int* file_size, int can_be_compressed,
  buf = (u8_t *)malloc(fsize);
  LWIP_ASSERT("buf != NULL", buf != NULL);
  r = fread(buf, 1, fsize, inFile);
+  LWIP_ASSERT("r == fsize", r == fsize);
  *file_size = fsize;
  *is_compressed = 0;
 #if MAKEFS_SUPPORT_DEFLATE
@@ -564,7 +617,7 @@ u8_t* get_file_data(const char* filename, int* file_size, int can_be_compressed,
        printf(" - uncompressed: (file is larger than deflate bufer)" NEWLINE);
      }
    } else {
-      printf(" - SSI file, cannot be compressed" NEWLINE);
+      printf(" - cannot be compressed" NEWLINE);
    }
  }
 #else
@@ -574,14 +627,14 @@ u8_t* get_file_data(const char* filename, int* file_size, int can_be_compressed,
  return buf;
 }

-void process_file_data(FILE* data_file, u8_t* file_data, size_t file_size)
+static void process_file_data(FILE *data_file, u8_t *file_data, size_t file_size)
 {
  size_t written, i, src_off = 0;
-
  size_t off = 0;
+  LWIP_UNUSED_ARG(written); /* for LWIP_NOASSERT */
  for (i = 0; i < file_size; i++) {
    LWIP_ASSERT("file_buffer_c overflow", off < sizeof(file_buffer_c) - 5);
-    sprintf(&file_buffer_c[off], "0x%02.2x,", file_data[i]);
+    sprintf(&file_buffer_c[off], "0x%02x,", file_data[i]);
    off += 5;
    if ((++src_off % HEX_BYTES_PER_LINE) == 0) {
      LWIP_ASSERT("file_buffer_c overflow", off < sizeof(file_buffer_c) - NEWLINE_LEN);
@@ -598,7 +651,7 @@ void process_file_data(FILE* data_file, u8_t* file_data, size_t file_size)
  LWIP_ASSERT("written == off", written == off);
 }

-int write_checksums(FILE *struct_file, const char *varname,
+static int write_checksums(FILE *struct_file, const char *varname,
                           u16_t hdr_len, u16_t hdr_chksum, const u8_t *file_data, size_t file_size)
 {
  int chunk_size = TCP_MSS;
@@ -621,14 +674,14 @@ int write_checksums(FILE *struct_file, const char *varname,
  src_offset = 0;
  for (offset = hdr_len; ; offset += len) {
    unsigned short chksum;
-    void* data = (void*)&file_data[src_offset];
+    const void *data = (const void *)&file_data[src_offset];
    len = LWIP_MIN(chunk_size, (int)file_size - src_offset);
    if (len == 0) {
      break;
    }
    chksum = ~inet_chksum(data, (u16_t)len);
    /* add checksum for data */
-    fprintf(struct_file, "{%d, 0x%04x, %d}," NEWLINE, offset, chksum, len);
+    fprintf(struct_file, "{%d, 0x%04x, %"SZT_F"}," NEWLINE, offset, chksum, len);
    i++;
  }
  fprintf(struct_file, "};" NEWLINE);
@@ -698,17 +751,157 @@ static void register_filename(const char* qualifiedName)
  }
 }

-int is_ssi_file(const char* filename)
+static int checkSsiByFilelist(const char* filename_listfile)
 {
+  FILE *f = fopen(filename_listfile, "r");
+  if (f != NULL) {
+    char *buf;
+    long rs;
+    size_t fsize, readcount;
+    size_t i, l, num_lines;
+    char **lines;
+    int state;
+
+    fseek(f, 0, SEEK_END);
+    rs = ftell(f);
+    if (rs < 0) {
+      printf("ftell failed with %d\n", errno);
+      fclose(f);
+      return 0;
+    }
+    fsize = (size_t)rs;
+    fseek(f, 0, SEEK_SET);
+    buf = (char*)malloc(fsize);
+    if (!buf) {
+      printf("failed to allocate ssi file buffer\n");
+      fclose(f);
+      return 0;
+    }
+    memset(buf, 0, fsize);
+    readcount = fread(buf, 1, fsize, f);
+    fclose(f);
+    if ((readcount > fsize) || !readcount) {
+      printf("failed to read data from ssi file\n");
+      free(buf);
+      return 0;
+    }
+
+    /* first pass: get the number of lines (and convert newlines to '0') */
+    num_lines = 1;
+    for (i = 0; i < readcount; i++) {
+      if (buf[i] == '\n') {
+        num_lines++;
+        buf[i] = 0;
+      } else if (buf[i] == '\r') {
+        buf[i] = 0;
+      }
+    }
+    /* allocate the line pointer array */
+    lines = (char**)malloc(sizeof(char*) * num_lines);
+    if (!lines) {
+      printf("failed to allocate ssi line buffer\n");
+      free(buf);
+      return 0;
+    }
+    memset(lines, 0, sizeof(char*) * num_lines);
+    l = 0;
+    state = 0;
+    for (i = 0; i < readcount; i++) {
+      if (state) {
+        /* waiting for null */
+        if (buf[i] == 0) {
+          state = 0;
+        }
+      } else {
+        /* waiting for beginning of new string */
+        if (buf[i] != 0) {
+          LWIP_ASSERT("lines array overflow", l < num_lines);
+          lines[l] = &buf[i];
+          state = 1;
+          l++;
+        }
+      }
+    }
+    LWIP_ASSERT("lines array overflow", l < num_lines);
+
+    ssi_file_buffer = buf;
+    ssi_file_lines = lines;
+    ssi_file_num_lines = l;
+  }
+  return 0;
+}
+
+static int is_ssi_file(const char *filename)
+{
+  if (supportSsi) {
+    if (ssi_file_buffer) {
+      /* compare by list */
+      size_t i;
+      int ret = 0;
+      /* build up the relative path to this file */
+      size_t sublen = strlen(curSubdir);
+      size_t freelen = sizeof(curSubdir) - sublen - 1;
+      strncat(curSubdir, "/", freelen);
+      strncat(curSubdir, filename, freelen - 1);
+      curSubdir[sizeof(curSubdir) - 1] = 0;
+      for (i = 0; i < ssi_file_num_lines; i++) {
+        const char *listed_file = ssi_file_lines[i];
+        /* compare without the leading '/' */
+        if (!strcmp(&curSubdir[1], listed_file)) {
+          ret = 1;
+        }
+      }
+      curSubdir[sublen] = 0;
+      return ret;
+    } else {
+      /* check file extension */
      size_t loop;
      for (loop = 0; loop < NUM_SHTML_EXTENSIONS; loop++) {
        if (strstr(filename, g_pcSSIExtensions[loop])) {
          return 1;
        }
      }
+    }
+  }
  return 0;
 }

+static int ext_in_list(const char* filename, const char *ext_list)
+{
+  int found = 0;
+  const char *ext = ext_list;
+  if (ext_list == NULL) {
+    return 0;
+  }
+  while(*ext != '\0') {
+    const char *comma = strchr(ext, ',');
+    size_t ext_size;
+    size_t filename_size = strlen(filename);
+    if (comma == NULL) {
+      comma = strchr(ext, '\0');
+    }
+    ext_size = comma - ext;
+    if ((filename[filename_size - ext_size - 1] == '.') &&
+      !strncmp(&filename[filename_size - ext_size], ext, ext_size)) {
+        found = 1;
+        break;
+    }
+    ext = comma + 1;
+  }
+
+  return found;
+}
+
+static int file_to_exclude(const char *filename)
+{
+    return (exclude_list != NULL) && ext_in_list(filename, exclude_list);
+}
+
+static int file_can_be_compressed(const char *filename)
+{
+    return (ncompress_list == NULL) || !ext_in_list(filename, ncompress_list);
+}
+
 int process_file(FILE *data_file, FILE *struct_file, const char *filename)
 {
  char varname[MAX_PATH_LEN];
@@ -719,10 +912,12 @@ int process_file(FILE *data_file, FILE *struct_file, const char *filename)
  u16_t http_hdr_len = 0;
  int chksum_count = 0;
  u8_t flags = 0;
-  const char* flags_str;
  u8_t has_content_len;
  u8_t *file_data;
+  int is_ssi;
+  int can_be_compressed;
  int is_compressed = 0;
+  int flags_printed;

  /* create qualified name (@todo: prepend slash or not?) */
  sprintf(qualifiedName, "%s/%s", curSubdir, filename);
@@ -739,24 +934,32 @@ int process_file(FILE *data_file, FILE *struct_file, const char *filename)
 #endif /* ALIGN_PAYLOAD */
  fprintf(data_file, "static const unsigned char FSDATA_ALIGN_PRE data_%s[] FSDATA_ALIGN_POST = {" NEWLINE, varname);
  /* encode source file name (used by file system, not returned to browser) */
-  fprintf(data_file, "/* %s (%d chars) */" NEWLINE, qualifiedName, strlen(qualifiedName)+1);
+  fprintf(data_file, "/* %s (%"SZT_F" chars) */" NEWLINE, qualifiedName, strlen(qualifiedName) + 1);
  file_put_ascii(data_file, qualifiedName, strlen(qualifiedName) + 1, &i);
 #if ALIGN_PAYLOAD
  /* pad to even number of bytes to assure payload is on aligned boundary */
  while (i % PAYLOAD_ALIGNMENT != 0) {
-    fprintf(data_file, "0x%02.2x,", 0);
+    fprintf(data_file, "0x%02x,", 0);
    i++;
  }
 #endif /* ALIGN_PAYLOAD */
  fprintf(data_file, NEWLINE);

-  has_content_len = !is_ssi_file(filename);
-  file_data = get_file_data(filename, &file_size, includeHttpHeader && has_content_len, &is_compressed);
+  is_ssi = is_ssi_file(filename);
+  if (is_ssi) {
+    flags |= FS_FILE_FLAGS_SSI;
+  }
+  has_content_len = !is_ssi;
+  can_be_compressed = includeHttpHeader && !is_ssi && file_can_be_compressed(filename);
+  file_data = get_file_data(filename, &file_size, can_be_compressed, &is_compressed);
  if (includeHttpHeader) {
    file_write_http_header(data_file, filename, file_size, &http_hdr_len, &http_hdr_chksum, has_content_len, is_compressed);
-    flags = FS_FILE_FLAGS_HEADER_INCLUDED;
+    flags |= FS_FILE_FLAGS_HEADER_INCLUDED;
    if (has_content_len) {
      flags |= FS_FILE_FLAGS_HEADER_PERSISTENT;
+      if (useHttp11) {
+        flags |= FS_FILE_FLAGS_HEADER_HTTPVER_1_1;
+      }
    }
  }
  if (precalcChksum) {
@@ -769,22 +972,37 @@ int process_file(FILE *data_file, FILE *struct_file, const char *filename)
  fprintf(struct_file, "data_%s," NEWLINE, varname);
  fprintf(struct_file, "data_%s + %d," NEWLINE, varname, i);
  fprintf(struct_file, "sizeof(data_%s) - %d," NEWLINE, varname, i);
-  switch(flags)
-  {
-  case(FS_FILE_FLAGS_HEADER_INCLUDED):
-     flags_str = "FS_FILE_FLAGS_HEADER_INCLUDED";
-     break;
-  case(FS_FILE_FLAGS_HEADER_PERSISTENT):
-     flags_str = "FS_FILE_FLAGS_HEADER_PERSISTENT";
-     break;
-  case(FS_FILE_FLAGS_HEADER_INCLUDED | FS_FILE_FLAGS_HEADER_PERSISTENT):
-     flags_str = "FS_FILE_FLAGS_HEADER_INCLUDED | FS_FILE_FLAGS_HEADER_PERSISTENT";
-     break;
-  default:
-     flags_str = "0";
-     break;
+
+  flags_printed = 0;
+  if (flags & FS_FILE_FLAGS_HEADER_INCLUDED) {
+    fputs("FS_FILE_FLAGS_HEADER_INCLUDED", struct_file);
+    flags_printed = 1;
  }
-  fprintf(struct_file, "%s," NEWLINE, flags_str);
+  if (flags & FS_FILE_FLAGS_HEADER_PERSISTENT) {
+    if (flags_printed) {
+      fputs(" | ", struct_file);
+    }
+    fputs("FS_FILE_FLAGS_HEADER_PERSISTENT", struct_file);
+    flags_printed = 1;
+  }
+  if (flags & FS_FILE_FLAGS_HEADER_HTTPVER_1_1) {
+    if (flags_printed) {
+      fputs(" | ", struct_file);
+    }
+    fputs("FS_FILE_FLAGS_HEADER_HTTPVER_1_1", struct_file);
+    flags_printed = 1;
+  }
+  if (flags & FS_FILE_FLAGS_SSI) {
+    if (flags_printed) {
+      fputs(" | ", struct_file);
+    }
+    fputs("FS_FILE_FLAGS_SSI", struct_file);
+    flags_printed = 1;
+  }
+  if (!flags_printed) {
+    fputs("0", struct_file);
+  }
+  fputs("," NEWLINE, struct_file);
  if (precalcChksum) {
    fprintf(struct_file, "#if HTTPD_PRECALCULATED_CHECKSUM" NEWLINE);
    fprintf(struct_file, "%d, chksums_%s," NEWLINE, chksum_count, varname);
@@ -814,7 +1032,7 @@ int file_write_http_header(FILE *data_file, const char *filename, int file_size,
  size_t hdr_len = 0;
  u16_t acc;
  const char *file_ext;
-  int j;
+  size_t j;
  u8_t provide_last_modified = includeLastModified;

  memset(hdr_buf, 0, sizeof(hdr_buf));
@@ -842,7 +1060,7 @@ int file_write_http_header(FILE *data_file, const char *filename, int file_size,
  }
  cur_string = g_psHTTPHeaderStrings[response_type];
  cur_len = strlen(cur_string);
-  fprintf(data_file, NEWLINE "/* \"%s\" (%d bytes) */" NEWLINE, cur_string, cur_len);
+  fprintf(data_file, NEWLINE "/* \"%s\" (%"SZT_F" bytes) */" NEWLINE, cur_string, cur_len);
  written += file_put_ascii(data_file, cur_string, cur_len, &i);
  i = 0;
  if (precalcChksum) {
@@ -852,7 +1070,7 @@ int file_write_http_header(FILE *data_file, const char *filename, int file_size,

  cur_string = serverID;
  cur_len = strlen(cur_string);
-  fprintf(data_file, NEWLINE "/* \"%s\" (%d bytes) */" NEWLINE, cur_string, cur_len);
+  fprintf(data_file, NEWLINE "/* \"%s\" (%"SZT_F" bytes) */" NEWLINE, cur_string, cur_len);
  written += file_put_ascii(data_file, cur_string, cur_len, &i);
  i = 0;
  if (precalcChksum) {
@@ -893,14 +1111,14 @@ int file_write_http_header(FILE *data_file, const char *filename, int file_size,
    memset(intbuf, 0, sizeof(intbuf));
    cur_string = g_psHTTPHeaderStrings[HTTP_HDR_CONTENT_LENGTH];
    cur_len = strlen(cur_string);
-    fprintf(data_file, NEWLINE "/* \"%s%d\r\n\" (%d+ bytes) */" NEWLINE, cur_string, content_len, cur_len+2);
+    fprintf(data_file, NEWLINE "/* \"%s%d\r\n\" (%"SZT_F"+ bytes) */" NEWLINE, cur_string, content_len, cur_len + 2);
    written += file_put_ascii(data_file, cur_string, cur_len, &i);
    if (precalcChksum) {
      memcpy(&hdr_buf[hdr_len], cur_string, cur_len);
      hdr_len += cur_len;
    }

-    _itoa(content_len, intbuf, 10);
+    lwip_itoa(intbuf, sizeof(intbuf), content_len);
    strcat(intbuf, "\r\n");
    cur_len = strlen(intbuf);
    written += file_put_ascii(data_file, intbuf, cur_len, &i);
@@ -929,7 +1147,7 @@ int file_write_http_header(FILE *data_file, const char *filename, int file_size,
    }
    strftime(&modbuf[15], sizeof(modbuf) - 15, "%a, %d %b %Y %H:%M:%S GMT", t);
    cur_len = strlen(cur_string);
-    fprintf(data_file, NEWLINE "/* \"%s\"\r\n\" (%d+ bytes) */" NEWLINE, cur_string, cur_len+2);
+    fprintf(data_file, NEWLINE "/* \"%s\"\r\n\" (%"SZT_F"+ bytes) */" NEWLINE, cur_string, cur_len + 2);
    written += file_put_ascii(data_file, cur_string, cur_len, &i);
    if (precalcChksum) {
      memcpy(&hdr_buf[hdr_len], cur_string, cur_len);
@@ -957,7 +1175,7 @@ int file_write_http_header(FILE *data_file, const char *filename, int file_size,
      cur_string = g_psHTTPHeaderStrings[HTTP_HDR_CONN_CLOSE];
    }
    cur_len = strlen(cur_string);
-    fprintf(data_file, NEWLINE "/* \"%s\" (%d bytes) */" NEWLINE, cur_string, cur_len);
+    fprintf(data_file, NEWLINE "/* \"%s\" (%"SZT_F" bytes) */" NEWLINE, cur_string, cur_len);
    written += file_put_ascii(data_file, cur_string, cur_len, &i);
    i = 0;
    if (precalcChksum) {
@@ -983,17 +1201,17 @@ int file_write_http_header(FILE *data_file, const char *filename, int file_size,
  /* write content-type, ATTENTION: this includes the double-CRLF! */
  cur_string = file_type;
  cur_len = strlen(cur_string);
-  fprintf(data_file, NEWLINE "/* \"%s\" (%d bytes) */" NEWLINE, cur_string, cur_len);
+  fprintf(data_file, NEWLINE "/* \"%s\" (%"SZT_F" bytes) */" NEWLINE, cur_string, cur_len);
  written += file_put_ascii(data_file, cur_string, cur_len, &i);
  i = 0;

  /* ATTENTION: headers are done now (double-CRLF has been written!) */

  if (precalcChksum) {
+    LWIP_ASSERT("hdr_len + cur_len <= sizeof(hdr_buf)", hdr_len + cur_len <= sizeof(hdr_buf));
    memcpy(&hdr_buf[hdr_len], cur_string, cur_len);
    hdr_len += cur_len;

-    LWIP_ASSERT("hdr_len <= 0xffff", hdr_len <= 0xffff);
    LWIP_ASSERT("strlen(hdr_buf) == hdr_len", strlen(hdr_buf) == hdr_len);
    acc = ~inet_chksum(hdr_buf, (u16_t)hdr_len);
    *http_hdr_len = (u16_t)hdr_len;
@@ -1008,7 +1226,7 @@ int file_put_ascii(FILE *file, const char* ascii_string, int len, int *i)
  int x;
  for (x = 0; x < len; x++) {
    unsigned char cur = ascii_string[x];
-    fprintf(file, "0x%02.2x,", cur);
+    fprintf(file, "0x%02x,", cur);
    if ((++(*i) % HEX_BYTES_PER_LINE) == 0) {
      fprintf(file, NEWLINE);
    }
@@ -1022,7 +1240,7 @@ int s_put_ascii(char *buf, const char *ascii_string, int len, int *i)
  int idx = 0;
  for (x = 0; x < len; x++) {
    unsigned char cur = ascii_string[x];
-    sprintf(&buf[idx], "0x%02.2x,", cur);
+    sprintf(&buf[idx], "0x%02x,", cur);
    idx += 5;
    if ((++(*i) % HEX_BYTES_PER_LINE) == 0) {
      sprintf(&buf[idx], NEWLINE);
--- a/src/apps/httpd/makefsdata/readme.txt
+++ b/src/apps/httpd/makefsdata/readme.txt
--- a/src/apps/http/makefsdata/tinydir.h
+++ b/src/apps/http/makefsdata/tinydir.h
@@ -0,0 +1,808 @@
+/*
+Copyright (c) 2013-2017, tinydir authors:
+- Cong Xu
+- Lautis Sun
+- Baudouin Feildel
+- Andargor <andargor@yahoo.com>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+#ifndef TINYDIR_H
+#define TINYDIR_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#if ((defined _UNICODE) && !(defined UNICODE))
+#define UNICODE
+#endif
+
+#if ((defined UNICODE) && !(defined _UNICODE))
+#define _UNICODE
+#endif
+
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+#ifdef _MSC_VER
+# define WIN32_LEAN_AND_MEAN
+# include <windows.h>
+# include <tchar.h>
+# pragma warning(push)
+# pragma warning (disable : 4996)
+#else
+# include <dirent.h>
+# include <libgen.h>
+# include <sys/stat.h>
+# include <stddef.h>
+#endif
+#ifdef __MINGW32__
+# include <tchar.h>
+#endif
+
+
+/* types */
+
+/* Windows UNICODE wide character support */
+#if defined _MSC_VER || defined __MINGW32__
+#define _tinydir_char_t TCHAR
+#define TINYDIR_STRING(s) _TEXT(s)
+#define _tinydir_strlen _tcslen
+#define _tinydir_strcpy _tcscpy
+#define _tinydir_strcat _tcscat
+#define _tinydir_strcmp _tcscmp
+#define _tinydir_strrchr _tcsrchr
+#define _tinydir_strncmp _tcsncmp
+#else
+#define _tinydir_char_t char
+#define TINYDIR_STRING(s) s
+#define _tinydir_strlen strlen
+#define _tinydir_strcpy strcpy
+#define _tinydir_strcat strcat
+#define _tinydir_strcmp strcmp
+#define _tinydir_strrchr strrchr
+#define _tinydir_strncmp strncmp
+#endif
+
+#if (defined _MSC_VER || defined __MINGW32__)
+#include <windows.h>
+#define _TINYDIR_PATH_MAX MAX_PATH
+#elif defined  __linux__
+#include <linux/limits.h>
+#define _TINYDIR_PATH_MAX PATH_MAX
+#else
+#define _TINYDIR_PATH_MAX 4096
+#endif
+
+#ifdef _MSC_VER
+/* extra chars for the "\\*" mask */
+# define _TINYDIR_PATH_EXTRA 2
+#else
+# define _TINYDIR_PATH_EXTRA 0
+#endif
+
+#define _TINYDIR_FILENAME_MAX 256
+
+#if (defined _MSC_VER || defined __MINGW32__)
+#define _TINYDIR_DRIVE_MAX 3
+#endif
+
+#ifdef _MSC_VER
+# define _TINYDIR_FUNC static __inline
+#elif !defined __STDC_VERSION__ || __STDC_VERSION__ < 199901L
+# define _TINYDIR_FUNC static __inline__
+#else
+# define _TINYDIR_FUNC static inline
+#endif
+
+/* readdir_r usage; define TINYDIR_USE_READDIR_R to use it (if supported) */
+#ifdef TINYDIR_USE_READDIR_R
+
+/* readdir_r is a POSIX-only function, and may not be available under various
+ * environments/settings, e.g. MinGW. Use readdir fallback */
+#if _POSIX_C_SOURCE >= 1 || _XOPEN_SOURCE || _BSD_SOURCE || _SVID_SOURCE ||\
+	_POSIX_SOURCE
+# define _TINYDIR_HAS_READDIR_R
+#endif
+#if _POSIX_C_SOURCE >= 200112L
+# define _TINYDIR_HAS_FPATHCONF
+# include <unistd.h>
+#endif
+#if _BSD_SOURCE || _SVID_SOURCE || \
+	(_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700)
+# define _TINYDIR_HAS_DIRFD
+# include <sys/types.h>
+#endif
+#if defined _TINYDIR_HAS_FPATHCONF && defined _TINYDIR_HAS_DIRFD &&\
+	defined _PC_NAME_MAX
+# define _TINYDIR_USE_FPATHCONF
+#endif
+#if defined __MINGW32__ || !defined _TINYDIR_HAS_READDIR_R ||\
+	!(defined _TINYDIR_USE_FPATHCONF || defined NAME_MAX)
+# define _TINYDIR_USE_READDIR
+#endif
+
+/* Use readdir by default */
+#else
+# define _TINYDIR_USE_READDIR
+#endif
+
+/* MINGW32 has two versions of dirent, ASCII and UNICODE*/
+#ifndef _MSC_VER
+#if (defined __MINGW32__) && (defined _UNICODE)
+#define _TINYDIR_DIR _WDIR
+#define _tinydir_dirent _wdirent
+#define _tinydir_opendir _wopendir
+#define _tinydir_readdir _wreaddir
+#define _tinydir_closedir _wclosedir
+#else
+#define _TINYDIR_DIR DIR
+#define _tinydir_dirent dirent
+#define _tinydir_opendir opendir
+#define _tinydir_readdir readdir
+#define _tinydir_closedir closedir
+#endif
+#endif
+
+/* Allow user to use a custom allocator by defining _TINYDIR_MALLOC and _TINYDIR_FREE. */
+#if    defined(_TINYDIR_MALLOC) &&  defined(_TINYDIR_FREE)
+#elif !defined(_TINYDIR_MALLOC) && !defined(_TINYDIR_FREE)
+#else
+#error "Either define both alloc and free or none of them!"
+#endif
+
+#if !defined(_TINYDIR_MALLOC)
+	#define _TINYDIR_MALLOC(_size) malloc(_size)
+	#define _TINYDIR_FREE(_ptr)    free(_ptr)
+#endif /* !defined(_TINYDIR_MALLOC) */
+
+typedef struct tinydir_file
+{
+	_tinydir_char_t path[_TINYDIR_PATH_MAX];
+	_tinydir_char_t name[_TINYDIR_FILENAME_MAX];
+	_tinydir_char_t *extension;
+	int is_dir;
+	int is_reg;
+
+#ifndef _MSC_VER
+#ifdef __MINGW32__
+	struct _stat _s;
+#else
+	struct stat _s;
+#endif
+#endif
+} tinydir_file;
+
+typedef struct tinydir_dir
+{
+	_tinydir_char_t path[_TINYDIR_PATH_MAX];
+	int has_next;
+	size_t n_files;
+
+	tinydir_file *_files;
+#ifdef _MSC_VER
+	HANDLE _h;
+	WIN32_FIND_DATA _f;
+#else
+	_TINYDIR_DIR *_d;
+	struct _tinydir_dirent *_e;
+#ifndef _TINYDIR_USE_READDIR
+	struct _tinydir_dirent *_ep;
+#endif
+#endif
+} tinydir_dir;
+
+
+/* declarations */
+
+_TINYDIR_FUNC
+int tinydir_open(tinydir_dir *dir, const _tinydir_char_t *path);
+_TINYDIR_FUNC
+int tinydir_open_sorted(tinydir_dir *dir, const _tinydir_char_t *path);
+_TINYDIR_FUNC
+void tinydir_close(tinydir_dir *dir);
+
+_TINYDIR_FUNC
+int tinydir_next(tinydir_dir *dir);
+_TINYDIR_FUNC
+int tinydir_readfile(const tinydir_dir *dir, tinydir_file *file);
+_TINYDIR_FUNC
+int tinydir_readfile_n(const tinydir_dir *dir, tinydir_file *file, size_t i);
+_TINYDIR_FUNC
+int tinydir_open_subdir_n(tinydir_dir *dir, size_t i);
+
+_TINYDIR_FUNC
+int tinydir_file_open(tinydir_file *file, const _tinydir_char_t *path);
+_TINYDIR_FUNC
+void _tinydir_get_ext(tinydir_file *file);
+_TINYDIR_FUNC
+int _tinydir_file_cmp(const void *a, const void *b);
+#ifndef _MSC_VER
+#ifndef _TINYDIR_USE_READDIR
+_TINYDIR_FUNC
+size_t _tinydir_dirent_buf_size(_TINYDIR_DIR *dirp);
+#endif
+#endif
+
+
+/* definitions*/
+
+_TINYDIR_FUNC
+int tinydir_open(tinydir_dir *dir, const _tinydir_char_t *path)
+{
+#ifndef _MSC_VER
+#ifndef _TINYDIR_USE_READDIR
+	int error;
+	int size;	/* using int size */
+#endif
+#else
+	_tinydir_char_t path_buf[_TINYDIR_PATH_MAX];
+#endif
+	_tinydir_char_t *pathp;
+
+	if (dir == NULL || path == NULL || _tinydir_strlen(path) == 0)
+	{
+		errno = EINVAL;
+		return -1;
+	}
+	if (_tinydir_strlen(path) + _TINYDIR_PATH_EXTRA >= _TINYDIR_PATH_MAX)
+	{
+		errno = ENAMETOOLONG;
+		return -1;
+	}
+
+	/* initialise dir */
+	dir->_files = NULL;
+#ifdef _MSC_VER
+	dir->_h = INVALID_HANDLE_VALUE;
+#else
+	dir->_d = NULL;
+#ifndef _TINYDIR_USE_READDIR
+	dir->_ep = NULL;
+#endif
+#endif
+	tinydir_close(dir);
+
+	_tinydir_strcpy(dir->path, path);
+	/* Remove trailing slashes */
+	pathp = &dir->path[_tinydir_strlen(dir->path) - 1];
+	while (pathp != dir->path && (*pathp == TINYDIR_STRING('\\') || *pathp == TINYDIR_STRING('/')))
+	{
+		*pathp = TINYDIR_STRING('\0');
+		pathp++;
+	}
+#ifdef _MSC_VER
+	_tinydir_strcpy(path_buf, dir->path);
+	_tinydir_strcat(path_buf, TINYDIR_STRING("\\*"));
+#if (defined WINAPI_FAMILY) && (WINAPI_FAMILY != WINAPI_FAMILY_DESKTOP_APP)
+	dir->_h = FindFirstFileEx(path_buf, FindExInfoStandard, &dir->_f, FindExSearchNameMatch, NULL, 0);
+#else
+	dir->_h = FindFirstFile(path_buf, &dir->_f);
+#endif
+	if (dir->_h == INVALID_HANDLE_VALUE)
+	{
+		errno = ENOENT;
+#else
+	dir->_d = _tinydir_opendir(path);
+	if (dir->_d == NULL)
+	{
+#endif
+		goto bail;
+	}
+
+	/* read first file */
+	dir->has_next = 1;
+#ifndef _MSC_VER
+#ifdef _TINYDIR_USE_READDIR
+	dir->_e = _tinydir_readdir(dir->_d);
+#else
+	/* allocate dirent buffer for readdir_r */
+	size = _tinydir_dirent_buf_size(dir->_d); /* conversion to int */
+	if (size == -1) return -1;
+	dir->_ep = (struct _tinydir_dirent*)_TINYDIR_MALLOC(size);
+	if (dir->_ep == NULL) return -1;
+
+	error = readdir_r(dir->_d, dir->_ep, &dir->_e);
+	if (error != 0) return -1;
+#endif
+	if (dir->_e == NULL)
+	{
+		dir->has_next = 0;
+	}
+#endif
+
+	return 0;
+
+bail:
+	tinydir_close(dir);
+	return -1;
+}
+
+_TINYDIR_FUNC
+int tinydir_open_sorted(tinydir_dir *dir, const _tinydir_char_t *path)
+{
+	/* Count the number of files first, to pre-allocate the files array */
+	size_t n_files = 0;
+	if (tinydir_open(dir, path) == -1)
+	{
+		return -1;
+	}
+	while (dir->has_next)
+	{
+		n_files++;
+		if (tinydir_next(dir) == -1)
+		{
+			goto bail;
+		}
+	}
+	tinydir_close(dir);
+
+	if (tinydir_open(dir, path) == -1)
+	{
+		return -1;
+	}
+
+	dir->n_files = 0;
+	dir->_files = (tinydir_file *)_TINYDIR_MALLOC(sizeof *dir->_files * n_files);
+	if (dir->_files == NULL)
+	{
+		goto bail;
+	}
+	while (dir->has_next)
+	{
+		tinydir_file *p_file;
+		dir->n_files++;
+
+		p_file = &dir->_files[dir->n_files - 1];
+		if (tinydir_readfile(dir, p_file) == -1)
+		{
+			goto bail;
+		}
+
+		if (tinydir_next(dir) == -1)
+		{
+			goto bail;
+		}
+
+		/* Just in case the number of files has changed between the first and
+		second reads, terminate without writing into unallocated memory */
+		if (dir->n_files == n_files)
+		{
+			break;
+		}
+	}
+
+	qsort(dir->_files, dir->n_files, sizeof(tinydir_file), _tinydir_file_cmp);
+
+	return 0;
+
+bail:
+	tinydir_close(dir);
+	return -1;
+}
+
+_TINYDIR_FUNC
+void tinydir_close(tinydir_dir *dir)
+{
+	if (dir == NULL)
+	{
+		return;
+	}
+
+	memset(dir->path, 0, sizeof(dir->path));
+	dir->has_next = 0;
+	dir->n_files = 0;
+	_TINYDIR_FREE(dir->_files);
+	dir->_files = NULL;
+#ifdef _MSC_VER
+	if (dir->_h != INVALID_HANDLE_VALUE)
+	{
+		FindClose(dir->_h);
+	}
+	dir->_h = INVALID_HANDLE_VALUE;
+#else
+	if (dir->_d)
+	{
+		_tinydir_closedir(dir->_d);
+	}
+	dir->_d = NULL;
+	dir->_e = NULL;
+#ifndef _TINYDIR_USE_READDIR
+	_TINYDIR_FREE(dir->_ep);
+	dir->_ep = NULL;
+#endif
+#endif
+}
+
+_TINYDIR_FUNC
+int tinydir_next(tinydir_dir *dir)
+{
+	if (dir == NULL)
+	{
+		errno = EINVAL;
+		return -1;
+	}
+	if (!dir->has_next)
+	{
+		errno = ENOENT;
+		return -1;
+	}
+
+#ifdef _MSC_VER
+	if (FindNextFile(dir->_h, &dir->_f) == 0)
+#else
+#ifdef _TINYDIR_USE_READDIR
+	dir->_e = _tinydir_readdir(dir->_d);
+#else
+	if (dir->_ep == NULL)
+	{
+		return -1;
+	}
+	if (readdir_r(dir->_d, dir->_ep, &dir->_e) != 0)
+	{
+		return -1;
+	}
+#endif
+	if (dir->_e == NULL)
+#endif
+	{
+		dir->has_next = 0;
+#ifdef _MSC_VER
+		if (GetLastError() != ERROR_SUCCESS &&
+			GetLastError() != ERROR_NO_MORE_FILES)
+		{
+			tinydir_close(dir);
+			errno = EIO;
+			return -1;
+		}
+#endif
+	}
+
+	return 0;
+}
+
+_TINYDIR_FUNC
+int tinydir_readfile(const tinydir_dir *dir, tinydir_file *file)
+{
+	if (dir == NULL || file == NULL)
+	{
+		errno = EINVAL;
+		return -1;
+	}
+#ifdef _MSC_VER
+	if (dir->_h == INVALID_HANDLE_VALUE)
+#else
+	if (dir->_e == NULL)
+#endif
+	{
+		errno = ENOENT;
+		return -1;
+	}
+	if (_tinydir_strlen(dir->path) +
+		_tinydir_strlen(
+#ifdef _MSC_VER
+			dir->_f.cFileName
+#else
+			dir->_e->d_name
+#endif
+		) + 1 + _TINYDIR_PATH_EXTRA >=
+		_TINYDIR_PATH_MAX)
+	{
+		/* the path for the file will be too long */
+		errno = ENAMETOOLONG;
+		return -1;
+	}
+	if (_tinydir_strlen(
+#ifdef _MSC_VER
+			dir->_f.cFileName
+#else
+			dir->_e->d_name
+#endif
+		) >= _TINYDIR_FILENAME_MAX)
+	{
+		errno = ENAMETOOLONG;
+		return -1;
+	}
+
+	_tinydir_strcpy(file->path, dir->path);
+	_tinydir_strcat(file->path, TINYDIR_STRING("/"));
+	_tinydir_strcpy(file->name,
+#ifdef _MSC_VER
+		dir->_f.cFileName
+#else
+		dir->_e->d_name
+#endif
+	);
+	_tinydir_strcat(file->path, file->name);
+#ifndef _MSC_VER
+#ifdef __MINGW32__
+	if (_tstat(
+#else
+	if (stat(
+#endif
+		file->path, &file->_s) == -1)
+	{
+		return -1;
+	}
+#endif
+	_tinydir_get_ext(file);
+
+	file->is_dir =
+#ifdef _MSC_VER
+		!!(dir->_f.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY);
+#else
+		S_ISDIR(file->_s.st_mode);
+#endif
+	file->is_reg =
+#ifdef _MSC_VER
+		!!(dir->_f.dwFileAttributes & FILE_ATTRIBUTE_NORMAL) ||
+		(
+			!(dir->_f.dwFileAttributes & FILE_ATTRIBUTE_DEVICE) &&
+			!(dir->_f.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) &&
+			!(dir->_f.dwFileAttributes & FILE_ATTRIBUTE_ENCRYPTED) &&
+#ifdef FILE_ATTRIBUTE_INTEGRITY_STREAM
+			!(dir->_f.dwFileAttributes & FILE_ATTRIBUTE_INTEGRITY_STREAM) &&
+#endif
+#ifdef FILE_ATTRIBUTE_NO_SCRUB_DATA
+			!(dir->_f.dwFileAttributes & FILE_ATTRIBUTE_NO_SCRUB_DATA) &&
+#endif
+			!(dir->_f.dwFileAttributes & FILE_ATTRIBUTE_OFFLINE) &&
+			!(dir->_f.dwFileAttributes & FILE_ATTRIBUTE_TEMPORARY));
+#else
+		S_ISREG(file->_s.st_mode);
+#endif
+
+	return 0;
+}
+
+_TINYDIR_FUNC
+int tinydir_readfile_n(const tinydir_dir *dir, tinydir_file *file, size_t i)
+{
+	if (dir == NULL || file == NULL)
+	{
+		errno = EINVAL;
+		return -1;
+	}
+	if (i >= dir->n_files)
+	{
+		errno = ENOENT;
+		return -1;
+	}
+
+	memcpy(file, &dir->_files[i], sizeof(tinydir_file));
+	_tinydir_get_ext(file);
+
+	return 0;
+}
+
+_TINYDIR_FUNC
+int tinydir_open_subdir_n(tinydir_dir *dir, size_t i)
+{
+	_tinydir_char_t path[_TINYDIR_PATH_MAX];
+	if (dir == NULL)
+	{
+		errno = EINVAL;
+		return -1;
+	}
+	if (i >= dir->n_files || !dir->_files[i].is_dir)
+	{
+		errno = ENOENT;
+		return -1;
+	}
+
+	_tinydir_strcpy(path, dir->_files[i].path);
+	tinydir_close(dir);
+	if (tinydir_open_sorted(dir, path) == -1)
+	{
+		return -1;
+	}
+
+	return 0;
+}
+
+/* Open a single file given its path */
+_TINYDIR_FUNC
+int tinydir_file_open(tinydir_file *file, const _tinydir_char_t *path)
+{
+	tinydir_dir dir;
+	int result = 0;
+	int found = 0;
+	_tinydir_char_t dir_name_buf[_TINYDIR_PATH_MAX];
+	_tinydir_char_t file_name_buf[_TINYDIR_FILENAME_MAX];
+	_tinydir_char_t *dir_name;
+	_tinydir_char_t *base_name;
+#if (defined _MSC_VER || defined __MINGW32__)
+	_tinydir_char_t drive_buf[_TINYDIR_PATH_MAX];
+	_tinydir_char_t ext_buf[_TINYDIR_FILENAME_MAX];
+#endif
+
+	if (file == NULL || path == NULL || _tinydir_strlen(path) == 0)
+	{
+		errno = EINVAL;
+		return -1;
+	}
+	if (_tinydir_strlen(path) + _TINYDIR_PATH_EXTRA >= _TINYDIR_PATH_MAX)
+	{
+		errno = ENAMETOOLONG;
+		return -1;
+	}
+
+	/* Get the parent path */
+#if (defined _MSC_VER || defined __MINGW32__)
+#if ((defined _MSC_VER) && (_MSC_VER >= 1400))
+		_tsplitpath_s(
+			path,
+			drive_buf, _TINYDIR_DRIVE_MAX,
+			dir_name_buf, _TINYDIR_FILENAME_MAX,
+			file_name_buf, _TINYDIR_FILENAME_MAX,
+			ext_buf, _TINYDIR_FILENAME_MAX);
+#else
+		_tsplitpath(
+			path,
+			drive_buf,
+			dir_name_buf,
+			file_name_buf,
+			ext_buf);
+#endif
+
+/* _splitpath_s not work fine with only filename and widechar support */
+#ifdef _UNICODE
+		if (drive_buf[0] == L'\xFEFE')
+			drive_buf[0] = '\0';
+		if (dir_name_buf[0] == L'\xFEFE')
+			dir_name_buf[0] = '\0';
+#endif
+
+	if (errno)
+	{
+		errno = EINVAL;
+		return -1;
+	}
+	/* Emulate the behavior of dirname by returning "." for dir name if it's
+	empty */
+	if (drive_buf[0] == '\0' && dir_name_buf[0] == '\0')
+	{
+		_tinydir_strcpy(dir_name_buf, TINYDIR_STRING("."));
+	}
+	/* Concatenate the drive letter and dir name to form full dir name */
+	_tinydir_strcat(drive_buf, dir_name_buf);
+	dir_name = drive_buf;
+	/* Concatenate the file name and extension to form base name */
+	_tinydir_strcat(file_name_buf, ext_buf);
+	base_name = file_name_buf;
+#else
+	_tinydir_strcpy(dir_name_buf, path);
+	dir_name = dirname(dir_name_buf);
+	_tinydir_strcpy(file_name_buf, path);
+	base_name =basename(file_name_buf);
+#endif
+
+	/* Open the parent directory */
+	if (tinydir_open(&dir, dir_name) == -1)
+	{
+		return -1;
+	}
+
+	/* Read through the parent directory and look for the file */
+	while (dir.has_next)
+	{
+		if (tinydir_readfile(&dir, file) == -1)
+		{
+			result = -1;
+			goto bail;
+		}
+		if (_tinydir_strcmp(file->name, base_name) == 0)
+		{
+			/* File found */
+			found = 1;
+			break;
+		}
+		tinydir_next(&dir);
+	}
+	if (!found)
+	{
+		result = -1;
+		errno = ENOENT;
+	}
+
+bail:
+	tinydir_close(&dir);
+	return result;
+}
+
+_TINYDIR_FUNC
+void _tinydir_get_ext(tinydir_file *file)
+{
+	_tinydir_char_t *period = _tinydir_strrchr(file->name, TINYDIR_STRING('.'));
+	if (period == NULL)
+	{
+		file->extension = &(file->name[_tinydir_strlen(file->name)]);
+	}
+	else
+	{
+		file->extension = period + 1;
+	}
+}
+
+_TINYDIR_FUNC
+int _tinydir_file_cmp(const void *a, const void *b)
+{
+	const tinydir_file *fa = (const tinydir_file *)a;
+	const tinydir_file *fb = (const tinydir_file *)b;
+	if (fa->is_dir != fb->is_dir)
+	{
+		return -(fa->is_dir - fb->is_dir);
+	}
+	return _tinydir_strncmp(fa->name, fb->name, _TINYDIR_FILENAME_MAX);
+}
+
+#ifndef _MSC_VER
+#ifndef _TINYDIR_USE_READDIR
+/*
+The following authored by Ben Hutchings <ben@decadent.org.uk>
+from https://womble.decadent.org.uk/readdir_r-advisory.html
+*/
+/* Calculate the required buffer size (in bytes) for directory      *
+* entries read from the given directory handle.  Return -1 if this  *
+* this cannot be done.                                              *
+*                                                                   *
+* This code does not trust values of NAME_MAX that are less than    *
+* 255, since some systems (including at least HP-UX) incorrectly    *
+* define it to be a smaller value.                                  */
+_TINYDIR_FUNC
+size_t _tinydir_dirent_buf_size(_TINYDIR_DIR *dirp)
+{
+	long name_max;
+	size_t name_end;
+	/* parameter may be unused */
+	(void)dirp;
+
+#if defined _TINYDIR_USE_FPATHCONF
+	name_max = fpathconf(dirfd(dirp), _PC_NAME_MAX);
+	if (name_max == -1)
+#if defined(NAME_MAX)
+		name_max = (NAME_MAX > 255) ? NAME_MAX : 255;
+#else
+		return (size_t)(-1);
+#endif
+#elif defined(NAME_MAX)
+ 	name_max = (NAME_MAX > 255) ? NAME_MAX : 255;
+#else
+#error "buffer size for readdir_r cannot be determined"
+#endif
+	name_end = (size_t)offsetof(struct _tinydir_dirent, d_name) + name_max + 1;
+	return (name_end > sizeof(struct _tinydir_dirent) ?
+		name_end : sizeof(struct _tinydir_dirent));
+}
+#endif
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+# if defined (_MSC_VER)
+# pragma warning(pop)
+# endif
+
+#endif
--- a/src/apps/httpd/httpd_structs.h
+++ b/src/apps/httpd/httpd_structs.h
@@ -1,114 +0,0 @@
-#ifndef LWIP_HTTPD_STRUCTS_H
-#define LWIP_HTTPD_STRUCTS_H
-
-#include "lwip/apps/httpd.h"
-
-#if LWIP_HTTPD_DYNAMIC_HEADERS
-/** This struct is used for a list of HTTP header strings for various
- * filename extensions. */
-typedef struct
-{
-  const char *extension;
-  const char *content_type;
-} tHTTPHeader;
-
-/** A list of strings used in HTTP headers (see RFC 1945 HTTP/1.0 and
- * RFC 2616 HTTP/1.1 for header field definitions) */
-static const char * const g_psHTTPHeaderStrings[] =
-{
- "HTTP/1.0 200 OK\r\n",
- "HTTP/1.0 404 File not found\r\n",
- "HTTP/1.0 400 Bad Request\r\n",
- "HTTP/1.0 501 Not Implemented\r\n",
- "HTTP/1.1 200 OK\r\n",
- "HTTP/1.1 404 File not found\r\n",
- "HTTP/1.1 400 Bad Request\r\n",
- "HTTP/1.1 501 Not Implemented\r\n",
- "Content-Length: ",
- "Connection: Close\r\n",
- "Connection: keep-alive\r\n",
- "Connection: keep-alive\r\nContent-Length: ",
- "Server: "HTTPD_SERVER_AGENT"\r\n",
- "\r\n<html><body><h2>404: The requested file cannot be found.</h2></body></html>\r\n"
-#if LWIP_HTTPD_SUPPORT_11_KEEPALIVE
- ,"Connection: keep-alive\r\nContent-Length: 77\r\n\r\n<html><body><h2>404: The requested file cannot be found.</h2></body></html>\r\n"
-#endif
-};
-
-/* Indexes into the g_psHTTPHeaderStrings array */
-#define HTTP_HDR_OK             0 /* 200 OK */
-#define HTTP_HDR_NOT_FOUND      1 /* 404 File not found */
-#define HTTP_HDR_BAD_REQUEST    2 /* 400 Bad request */
-#define HTTP_HDR_NOT_IMPL       3 /* 501 Not Implemented */
-#define HTTP_HDR_OK_11          4 /* 200 OK */
-#define HTTP_HDR_NOT_FOUND_11   5 /* 404 File not found */
-#define HTTP_HDR_BAD_REQUEST_11 6 /* 400 Bad request */
-#define HTTP_HDR_NOT_IMPL_11    7 /* 501 Not Implemented */
-#define HTTP_HDR_CONTENT_LENGTH 8 /* Content-Length: (HTTP 1.0)*/
-#define HTTP_HDR_CONN_CLOSE     9 /* Connection: Close (HTTP 1.1) */
-#define HTTP_HDR_CONN_KEEPALIVE 10 /* Connection: keep-alive (HTTP 1.1) */
-#define HTTP_HDR_KEEPALIVE_LEN  11 /* Connection: keep-alive + Content-Length: (HTTP 1.1)*/
-#define HTTP_HDR_SERVER         12 /* Server: HTTPD_SERVER_AGENT */
-#define DEFAULT_404_HTML        13 /* default 404 body */
-#if LWIP_HTTPD_SUPPORT_11_KEEPALIVE
-#define DEFAULT_404_HTML_PERSISTENT 14 /* default 404 body, but including Connection: keep-alive */
-#endif
-
-
-#define HTTP_HDR_HTML           "Content-type: text/html\r\n\r\n"
-#define HTTP_HDR_SSI            "Content-type: text/html\r\nExpires: Fri, 10 Apr 2008 14:00:00 GMT\r\nPragma: no-cache\r\n\r\n"
-#define HTTP_HDR_GIF            "Content-type: image/gif\r\n\r\n"
-#define HTTP_HDR_PNG            "Content-type: image/png\r\n\r\n"
-#define HTTP_HDR_JPG            "Content-type: image/jpeg\r\n\r\n"
-#define HTTP_HDR_BMP            "Content-type: image/bmp\r\n\r\n"
-#define HTTP_HDR_ICO            "Content-type: image/x-icon\r\n\r\n"
-#define HTTP_HDR_APP            "Content-type: application/octet-stream\r\n\r\n"
-#define HTTP_HDR_JS             "Content-type: application/javascript\r\n\r\n"
-#define HTTP_HDR_RA             "Content-type: application/javascript\r\n\r\n"
-#define HTTP_HDR_CSS            "Content-type: text/css\r\n\r\n"
-#define HTTP_HDR_SWF            "Content-type: application/x-shockwave-flash\r\n\r\n"
-#define HTTP_HDR_XML            "Content-type: text/xml\r\n\r\n"
-#define HTTP_HDR_PDF            "Content-type: application/pdf\r\n\r\n"
-#define HTTP_HDR_JSON           "Content-type: application/json\r\n\r\n"
-
-#define HTTP_HDR_DEFAULT_TYPE   "Content-type: text/plain\r\n\r\n"
-
-/** A list of extension-to-HTTP header strings (see outdated RFC 1700 MEDIA TYPES
- * and http://www.iana.org/assignments/media-types for registered content types
- * and subtypes) */
-static const tHTTPHeader g_psHTTPHeaders[] =
-{
- { "html", HTTP_HDR_HTML},
- { "htm",  HTTP_HDR_HTML},
- { "shtml",HTTP_HDR_SSI},
- { "shtm", HTTP_HDR_SSI},
- { "ssi",  HTTP_HDR_SSI},
- { "gif",  HTTP_HDR_GIF},
- { "png",  HTTP_HDR_PNG},
- { "jpg",  HTTP_HDR_JPG},
- { "bmp",  HTTP_HDR_BMP},
- { "ico",  HTTP_HDR_ICO},
- { "class",HTTP_HDR_APP},
- { "cls",  HTTP_HDR_APP},
- { "js",   HTTP_HDR_JS},
- { "ram",  HTTP_HDR_RA},
- { "css",  HTTP_HDR_CSS},
- { "swf",  HTTP_HDR_SWF},
- { "xml",  HTTP_HDR_XML},
- { "xsl",  HTTP_HDR_XML},
- { "pdf",  HTTP_HDR_PDF},
- { "json", HTTP_HDR_JSON}
-};
-
-#define NUM_HTTP_HEADERS (sizeof(g_psHTTPHeaders) / sizeof(tHTTPHeader))
-
-#endif /* LWIP_HTTPD_DYNAMIC_HEADERS */
-
-#if LWIP_HTTPD_SSI
-static const char * const g_pcSSIExtensions[] = {
-  ".shtml", ".shtm", ".ssi", ".xml"
-};
-#define NUM_SHTML_EXTENSIONS (sizeof(g_pcSSIExtensions) / sizeof(const char *))
-#endif /* LWIP_HTTPD_SSI */
-
-#endif /* LWIP_HTTPD_STRUCTS_H */
--- a/src/apps/lwiperf/lwiperf.c
+++ b/src/apps/lwiperf/lwiperf.c
@@ -7,11 +7,15 @@
 * @defgroup iperf Iperf server
 * @ingroup apps
 *
- * This is a simple performance measuring server to check your bandwith using
- * iPerf2 on a PC as client.
- * It is currently a minimal implementation providing an IPv4 TCP server only.
+ * This is a simple performance measuring client/server to check your bandwith using
+ * iPerf2 on a PC as server/client.
+ * It is currently a minimal implementation providing a TCP client/server only.
 *
- * @todo: implement UDP mode and IPv6
+ * @todo:
+ * - implement UDP mode
+ * - protect combined sessions handling (via 'related_master_state') against reallocation
+ *   (this is a pointer address, currently, so if the same memory is allocated again,
+ *    session pairs (tx/rx) can be confused on reallocation)
 */

 /*
@@ -52,8 +56,8 @@

 #include <string.h>

-/* Currently, only TCP-over-IPv4 is implemented (does iperf support IPv6 anyway?) */
-#if LWIP_IPV4 && LWIP_TCP
+/* Currently, only TCP is implemented */
+#if LWIP_TCP && LWIP_CALLBACK_API

 /** Specify the idle timeout (in seconds) after that the test fails */
 #ifndef LWIPERF_TCP_MAX_IDLE_SEC
@@ -63,6 +67,11 @@
 #error LWIPERF_TCP_MAX_IDLE_SEC must fit into an u8_t
 #endif

+/** Change this if you don't want to lwiperf to listen to any IP version */
+#ifndef LWIPERF_SERVER_IP_TYPE
+#define LWIPERF_SERVER_IP_TYPE      IPADDR_TYPE_ANY
+#endif
+
 /* File internal memory allocation (struct lwiperf_*): this defaults to
   the heap */
 #ifndef LWIPERF_ALLOC
@@ -91,12 +100,14 @@ typedef struct _lwiperf_settings {
 struct _lwiperf_state_base;
 typedef struct _lwiperf_state_base lwiperf_state_base_t;
 struct _lwiperf_state_base {
+  /* linked list */
+  lwiperf_state_base_t *next;
  /* 1=tcp, 0=udp */
  u8_t tcp;
  /* 1=server, 0=client */
  u8_t server;
-  lwiperf_state_base_t* next;
-  lwiperf_state_base_t* related_server_state;
+  /* master state used to abort sessions (e.g. listener, main client) */
+  lwiperf_state_base_t *related_master_state;
 };

 /** Connection handle for a TCP iperf session */
@@ -109,9 +120,13 @@ typedef struct _lwiperf_state_tcp {
  void *report_arg;
  u8_t poll_count;
  u8_t next_num;
+  /* 1=start server when client is closed */
+  u8_t client_tradeoff_mode;
  u32_t bytes_transferred;
  lwiperf_settings_t settings;
  u8_t have_settings_buf;
+  u8_t specific_remote;
+  ip_addr_t remote_addr;
 } lwiperf_state_tcp_t;

 /** List of active iperf sessions */
@@ -162,16 +177,17 @@ static const u8_t lwiperf_txbuf_const[1600] = {

 static err_t lwiperf_tcp_poll(void *arg, struct tcp_pcb *tpcb);
 static void lwiperf_tcp_err(void *arg, err_t err);
+static err_t lwiperf_start_tcp_server_impl(const ip_addr_t *local_addr, u16_t local_port,
+                                           lwiperf_report_fn report_fn, void *report_arg,
+                                           lwiperf_state_base_t *related_master_state, lwiperf_state_tcp_t **state);
+

 /** Add an iperf session to the 'active' list */
 static void
 lwiperf_list_add(lwiperf_state_base_t *item)
 {
-  if (lwiperf_all_connections == NULL) {
+  item->next = lwiperf_all_connections;
  lwiperf_all_connections = item;
-  } else {
-    item = lwiperf_all_connections;
-  }
 }

 /** Remove an iperf session from the 'active' list */
@@ -185,7 +201,7 @@ lwiperf_list_remove(lwiperf_state_base_t* item)
      if (prev == NULL) {
        lwiperf_all_connections = iter->next;
      } else {
-        prev->next = item;
+        prev->next = iter->next;
      }
      /* @debug: ensure this item is listed only once */
      for (iter = iter->next; iter != NULL; iter = iter->next) {
@@ -196,6 +212,18 @@ lwiperf_list_remove(lwiperf_state_base_t* item)
  }
 }

+static lwiperf_state_base_t *
+lwiperf_list_find(lwiperf_state_base_t *item)
+{
+  lwiperf_state_base_t *iter;
+  for (iter = lwiperf_all_connections; iter != NULL; iter = iter->next) {
+    if (iter == item) {
+      return item;
+    }
+  }
+  return NULL;
+}
+
 /** Call the report function of an iperf tcp session */
 static void
 lwip_tcp_conn_report(lwiperf_state_tcp_t *conn, enum lwiperf_report_type report_type)
@@ -222,8 +250,8 @@ lwiperf_tcp_close(lwiperf_state_tcp_t* conn, enum lwiperf_report_type report_typ
 {
  err_t err;

-  lwip_tcp_conn_report(conn, report_type);
  lwiperf_list_remove(&conn->base);
+  lwip_tcp_conn_report(conn, report_type);
  if (conn->conn_pcb != NULL) {
    tcp_arg(conn->conn_pcb, NULL);
    tcp_poll(conn->conn_pcb, NULL, 0);
@@ -236,9 +264,9 @@ lwiperf_tcp_close(lwiperf_state_tcp_t* conn, enum lwiperf_report_type report_typ
      tcp_abort(conn->conn_pcb);
    }
  } else {
-    /* no conn pcb, this is the server pcb */
+    /* no conn pcb, this is the listener pcb */
    err = tcp_close(conn->server_pcb);
-    LWIP_ASSERT("error", err != ERR_OK);
+    LWIP_ASSERT("error", err == ERR_OK);
  }
  LWIPERF_FREE(lwiperf_state_tcp_t, conn);
 }
@@ -294,7 +322,7 @@ lwiperf_tcp_client_send_more(lwiperf_state_tcp_t* conn)
    } else {
      /* transmit data */
      /* @todo: every x bytes, transmit the settings again */
-      txptr = (void*)(size_t)&lwiperf_txbuf_const[conn->bytes_transferred % 10];
+      txptr = LWIP_CONST_CAST(void *, &lwiperf_txbuf_const[conn->bytes_transferred % 10]);
      txlen_max = TCP_MSS;
      if (conn->bytes_transferred == 48) { /* @todo: fix this for intermediate settings, too */
        txlen_max = TCP_MSS - 24;
@@ -356,41 +384,46 @@ lwiperf_tcp_client_connected(void *arg, struct tcp_pcb *tpcb, err_t err)
 * receive test has finished.
 */
 static err_t
-lwiperf_tx_start(lwiperf_state_tcp_t* conn)
+lwiperf_tx_start_impl(const ip_addr_t *remote_ip, u16_t remote_port, lwiperf_settings_t *settings, lwiperf_report_fn report_fn,
+                      void *report_arg, lwiperf_state_base_t *related_master_state, lwiperf_state_tcp_t **new_conn)
 {
  err_t err;
  lwiperf_state_tcp_t *client_conn;
  struct tcp_pcb *newpcb;
  ip_addr_t remote_addr;
-  u16_t remote_port;
+
+  LWIP_ASSERT("remote_ip != NULL", remote_ip != NULL);
+  LWIP_ASSERT("remote_ip != NULL", settings != NULL);
+  LWIP_ASSERT("new_conn != NULL", new_conn != NULL);
+  *new_conn = NULL;

  client_conn = (lwiperf_state_tcp_t *)LWIPERF_ALLOC(lwiperf_state_tcp_t);
  if (client_conn == NULL) {
    return ERR_MEM;
  }
-  newpcb = tcp_new();
+  newpcb = tcp_new_ip_type(IP_GET_TYPE(remote_ip));
  if (newpcb == NULL) {
    LWIPERF_FREE(lwiperf_state_tcp_t, client_conn);
    return ERR_MEM;
  }
-
-  MEMCPY(client_conn, conn, sizeof(lwiperf_state_tcp_t));
-  client_conn->base.server = 0;
-  client_conn->server_pcb = NULL;
+  memset(client_conn, 0, sizeof(lwiperf_state_tcp_t));
+  client_conn->base.tcp = 1;
+  client_conn->base.related_master_state = related_master_state;
  client_conn->conn_pcb = newpcb;
  client_conn->time_started = sys_now(); /* @todo: set this again on 'connected' */
-  client_conn->poll_count = 0;
+  client_conn->report_fn = report_fn;
+  client_conn->report_arg = report_arg;
  client_conn->next_num = 4; /* initial nr is '4' since the header has 24 byte */
  client_conn->bytes_transferred = 0;
-  client_conn->settings.flags = 0; /* prevent the remote side starting back as client again */
+  memcpy(&client_conn->settings, settings, sizeof(*settings));
+  client_conn->have_settings_buf = 1;

  tcp_arg(newpcb, client_conn);
  tcp_sent(newpcb, lwiperf_tcp_client_sent);
  tcp_poll(newpcb, lwiperf_tcp_poll, 2U);
  tcp_err(newpcb, lwiperf_tcp_err);

-  ip_addr_copy(remote_addr, conn->conn_pcb->remote_ip);
-  remote_port = (u16_t)lwip_htonl(client_conn->settings.remote_port);
+  ip_addr_copy(remote_addr, *remote_ip);

  err = tcp_connect(newpcb, &remote_addr, remote_port, lwiperf_tcp_client_connected);
  if (err != ERR_OK) {
@@ -398,9 +431,26 @@ lwiperf_tx_start(lwiperf_state_tcp_t* conn)
    return err;
  }
  lwiperf_list_add(&client_conn->base);
+  *new_conn = client_conn;
  return ERR_OK;
 }

+static err_t
+lwiperf_tx_start_passive(lwiperf_state_tcp_t *conn)
+{
+  err_t ret;
+  lwiperf_state_tcp_t *new_conn = NULL;
+  u16_t remote_port = (u16_t)lwip_htonl(conn->settings.remote_port);
+
+  ret = lwiperf_tx_start_impl(&conn->conn_pcb->remote_ip, remote_port, &conn->settings, conn->report_fn, conn->report_arg,
+    conn->base.related_master_state, &new_conn);
+  if (ret == ERR_OK) {
+    LWIP_ASSERT("new_conn != NULL", new_conn != NULL);
+    new_conn->settings.flags = 0; /* prevent the remote side starting back as client again */
+  }
+  return ret;
+}
+
 /** Receive data on an iperf tcp session */
 static err_t
 lwiperf_tcp_recv(void *arg, struct tcp_pcb *tpcb, struct pbuf *p, err_t err)
@@ -420,10 +470,11 @@ lwiperf_tcp_recv(void *arg, struct tcp_pcb *tpcb, struct pbuf *p, err_t err)
  }
  if (p == NULL) {
    /* connection closed -> test done */
-    if ((conn->settings.flags & PP_HTONL(LWIPERF_FLAGS_ANSWER_TEST|LWIPERF_FLAGS_ANSWER_NOW)) ==
-        PP_HTONL(LWIPERF_FLAGS_ANSWER_TEST)) {
+    if (conn->settings.flags & PP_HTONL(LWIPERF_FLAGS_ANSWER_TEST)) {
+      if ((conn->settings.flags & PP_HTONL(LWIPERF_FLAGS_ANSWER_NOW)) == 0) {
        /* client requested transmission after end of test */
-      lwiperf_tx_start(conn);
+        lwiperf_tx_start_passive(conn);
+      }
    }
    lwiperf_tcp_close(conn, LWIPERF_TCP_DONE_SERVER);
    return ERR_OK;
@@ -437,30 +488,33 @@ lwiperf_tcp_recv(void *arg, struct tcp_pcb *tpcb, struct pbuf *p, err_t err)
    if (p->tot_len < sizeof(lwiperf_settings_t)) {
      lwiperf_tcp_close(conn, LWIPERF_TCP_ABORTED_LOCAL_DATAERROR);
      pbuf_free(p);
-      return ERR_VAL;
+      return ERR_OK;
    }
    if (!conn->have_settings_buf) {
      if (pbuf_copy_partial(p, &conn->settings, sizeof(lwiperf_settings_t), 0) != sizeof(lwiperf_settings_t)) {
        lwiperf_tcp_close(conn, LWIPERF_TCP_ABORTED_LOCAL);
        pbuf_free(p);
-        return ERR_VAL;
+        return ERR_OK;
      }
      conn->have_settings_buf = 1;
-      if ((conn->settings.flags & PP_HTONL(LWIPERF_FLAGS_ANSWER_TEST|LWIPERF_FLAGS_ANSWER_NOW)) ==
-        PP_HTONL(LWIPERF_FLAGS_ANSWER_TEST|LWIPERF_FLAGS_ANSWER_NOW)) {
+      if (conn->settings.flags & PP_HTONL(LWIPERF_FLAGS_ANSWER_TEST)) {
+        if (conn->settings.flags & PP_HTONL(LWIPERF_FLAGS_ANSWER_NOW)) {
          /* client requested parallel transmission test */
-          err_t err2 = lwiperf_tx_start(conn);
+          err_t err2 = lwiperf_tx_start_passive(conn);
          if (err2 != ERR_OK) {
            lwiperf_tcp_close(conn, LWIPERF_TCP_ABORTED_LOCAL_TXERROR);
            pbuf_free(p);
-            return err2;
+            return ERR_OK;
+          }
        }
      }
    } else {
+      if (conn->settings.flags & PP_HTONL(LWIPERF_FLAGS_ANSWER_TEST)) {
        if (pbuf_memcmp(p, 0, &conn->settings, sizeof(lwiperf_settings_t)) != 0) {
          lwiperf_tcp_close(conn, LWIPERF_TCP_ABORTED_LOCAL_DATAERROR);
          pbuf_free(p);
-        return ERR_VAL;
+          return ERR_OK;
+        }
      }
    }
    conn->bytes_transferred += sizeof(lwiperf_settings_t);
@@ -471,8 +525,9 @@ lwiperf_tcp_recv(void *arg, struct tcp_pcb *tpcb, struct pbuf *p, err_t err)
      return ERR_OK;
    }
    conn->next_num = 4; /* 24 bytes received... */
-    tmp = pbuf_header(p, -24);
-    LWIP_ASSERT("pbuf_header failed", tmp == 0);
+    tmp = pbuf_remove_header(p, 24);
+    LWIP_ASSERT("pbuf_remove_header failed", tmp == 0);
+    LWIP_UNUSED_ARG(tmp); /* for LWIP_NOASSERT */
  }

  packet_idx = 0;
@@ -491,13 +546,11 @@ lwiperf_tcp_recv(void *arg, struct tcp_pcb *tpcb, struct pbuf *p, err_t err)
      } else {
        lwiperf_tcp_close(conn, LWIPERF_TCP_ABORTED_LOCAL_DATAERROR);
        pbuf_free(p);
-        return ERR_VAL;
+        return ERR_OK;
      }
    }
-    packet_idx += i;
-#else
-    packet_idx += q->len;
 #endif
+    packet_idx += q->len;
  }
  LWIP_ASSERT("count mismatch", packet_idx == p->tot_len);
  conn->bytes_transferred += packet_idx;
@@ -544,6 +597,19 @@ lwiperf_tcp_accept(void *arg, struct tcp_pcb *newpcb, err_t err)
  }

  s = (lwiperf_state_tcp_t *)arg;
+  LWIP_ASSERT("invalid session", s->base.server);
+  LWIP_ASSERT("invalid listen pcb", s->server_pcb != NULL);
+  LWIP_ASSERT("invalid conn pcb", s->conn_pcb == NULL);
+  if (s->specific_remote) {
+    LWIP_ASSERT("s->base.related_master_state != NULL", s->base.related_master_state != NULL);
+    if (!ip_addr_cmp(&newpcb->remote_ip, &s->remote_addr)) {
+      /* this listener belongs to a client session, and this is not the correct remote */
+      return ERR_VAL;
+    }
+  } else {
+    LWIP_ASSERT("s->base.related_master_state == NULL", s->base.related_master_state == NULL);
+  }
+
  conn = (lwiperf_state_tcp_t *)LWIPERF_ALLOC(lwiperf_state_tcp_t);
  if (conn == NULL) {
    return ERR_MEM;
@@ -551,8 +617,7 @@ lwiperf_tcp_accept(void *arg, struct tcp_pcb *newpcb, err_t err)
  memset(conn, 0, sizeof(lwiperf_state_tcp_t));
  conn->base.tcp = 1;
  conn->base.server = 1;
-  conn->base.related_server_state = &s->base;
-  conn->server_pcb = s->server_pcb;
+  conn->base.related_master_state = &s->base;
  conn->conn_pcb = newpcb;
  conn->time_started = sys_now();
  conn->report_fn = s->report_fn;
@@ -564,6 +629,16 @@ lwiperf_tcp_accept(void *arg, struct tcp_pcb *newpcb, err_t err)
  tcp_poll(newpcb, lwiperf_tcp_poll, 2U);
  tcp_err(conn->conn_pcb, lwiperf_tcp_err);

+  if (s->specific_remote) {
+    /* this listener belongs to a client, so make the client the master of the newly created connection */
+    conn->base.related_master_state = s->base.related_master_state;
+    /* if dual mode or (tradeoff mode AND client is done): close the listener */
+    if (!s->client_tradeoff_mode || !lwiperf_list_find(s->base.related_master_state)) {
+      /* prevent report when closing: this is expected */
+      s->report_fn = NULL;
+      lwiperf_tcp_close(s, LWIPERF_TCP_ABORTED_LOCAL);
+    }
+  }
  lwiperf_list_add(&conn->base);
  return ERR_OK;
 }
@@ -579,7 +654,7 @@ lwiperf_tcp_accept(void *arg, struct tcp_pcb *newpcb, err_t err)
 void *
 lwiperf_start_tcp_server_default(lwiperf_report_fn report_fn, void *report_arg)
 {
-  return lwiperf_start_tcp_server(IP4_ADDR_ANY, LWIPERF_TCP_PORT_DEFAULT,
+  return lwiperf_start_tcp_server(IP_ADDR_ANY, LWIPERF_TCP_PORT_DEFAULT,
                                  report_fn, report_arg);
 }

@@ -594,38 +669,60 @@ lwiperf_start_tcp_server_default(lwiperf_report_fn report_fn, void* report_arg)
 void *
 lwiperf_start_tcp_server(const ip_addr_t *local_addr, u16_t local_port,
                         lwiperf_report_fn report_fn, void *report_arg)
+{
+  err_t err;
+  lwiperf_state_tcp_t *state = NULL;
+
+  err = lwiperf_start_tcp_server_impl(local_addr, local_port, report_fn, report_arg,
+    NULL, &state);
+  if (err == ERR_OK) {
+    return state;
+  }
+  return NULL;
+}
+
+static err_t lwiperf_start_tcp_server_impl(const ip_addr_t *local_addr, u16_t local_port,
+                                           lwiperf_report_fn report_fn, void *report_arg,
+                                           lwiperf_state_base_t *related_master_state, lwiperf_state_tcp_t **state)
 {
  err_t err;
  struct tcp_pcb *pcb;
  lwiperf_state_tcp_t *s;

+  LWIP_ASSERT_CORE_LOCKED();
+
+  LWIP_ASSERT("state != NULL", state != NULL);
+
  if (local_addr == NULL) {
-    return NULL;
+    return ERR_ARG;
  }

  s = (lwiperf_state_tcp_t *)LWIPERF_ALLOC(lwiperf_state_tcp_t);
  if (s == NULL) {
-    return NULL;
+    return ERR_MEM;
  }
  memset(s, 0, sizeof(lwiperf_state_tcp_t));
  s->base.tcp = 1;
  s->base.server = 1;
+  s->base.related_master_state = related_master_state;
  s->report_fn = report_fn;
  s->report_arg = report_arg;

-  pcb = tcp_new();
-  if (pcb != NULL) {
+  pcb = tcp_new_ip_type(LWIPERF_SERVER_IP_TYPE);
+  if (pcb == NULL) {
+    return ERR_MEM;
+  }
  err = tcp_bind(pcb, local_addr, local_port);
-    if (err == ERR_OK) {
+  if (err != ERR_OK) {
+    return err;
+  }
  s->server_pcb = tcp_listen_with_backlog(pcb, 1);
-    }
-  }
  if (s->server_pcb == NULL) {
    if (pcb != NULL) {
      tcp_close(pcb);
    }
    LWIPERF_FREE(lwiperf_state_tcp_t, s);
-    return NULL;
+    return ERR_MEM;
  }
  pcb = NULL;

@@ -633,7 +730,86 @@ lwiperf_start_tcp_server(const ip_addr_t* local_addr, u16_t local_port,
  tcp_accept(s->server_pcb, lwiperf_tcp_accept);

  lwiperf_list_add(&s->base);
-  return s;
+  *state = s;
+  return ERR_OK;
+}
+
+/**
+ * @ingroup iperf
+ * Start a TCP iperf client to the default TCP port (5001).
+ *
+ * @returns a connection handle that can be used to abort the client
+ *          by calling @ref lwiperf_abort()
+ */
+void* lwiperf_start_tcp_client_default(const ip_addr_t* remote_addr,
+                               lwiperf_report_fn report_fn, void* report_arg)
+{
+  return lwiperf_start_tcp_client(remote_addr, LWIPERF_TCP_PORT_DEFAULT, LWIPERF_CLIENT,
+                                  report_fn, report_arg);
+}
+
+/**
+ * @ingroup iperf
+ * Start a TCP iperf client to a specific IP address and port.
+ *
+ * @returns a connection handle that can be used to abort the client
+ *          by calling @ref lwiperf_abort()
+ */
+void* lwiperf_start_tcp_client(const ip_addr_t* remote_addr, u16_t remote_port,
+  enum lwiperf_client_type type, lwiperf_report_fn report_fn, void* report_arg)
+{
+  err_t ret;
+  lwiperf_settings_t settings;
+  lwiperf_state_tcp_t *state = NULL;
+
+  memset(&settings, 0, sizeof(settings));
+  switch (type) {
+  case LWIPERF_CLIENT:
+    /* Unidirectional tx only test */
+    settings.flags = 0;
+    break;
+  case LWIPERF_DUAL:
+    /* Do a bidirectional test simultaneously */
+    settings.flags = htonl(LWIPERF_FLAGS_ANSWER_TEST | LWIPERF_FLAGS_ANSWER_NOW);
+    break;
+  case LWIPERF_TRADEOFF:
+    /* Do a bidirectional test individually */
+    settings.flags = htonl(LWIPERF_FLAGS_ANSWER_TEST);
+    break;
+  default:
+    /* invalid argument */
+    return NULL;
+  }
+  settings.num_threads = htonl(1);
+  settings.remote_port = htonl(LWIPERF_TCP_PORT_DEFAULT);
+  /* TODO: implement passing duration/amount of bytes to transfer */
+  settings.amount = htonl((u32_t)-1000);
+
+  ret = lwiperf_tx_start_impl(remote_addr, remote_port, &settings, report_fn, report_arg, NULL, &state);
+  if (ret == ERR_OK) {
+    LWIP_ASSERT("state != NULL", state != NULL);
+    if (type != LWIPERF_CLIENT) {
+      /* start corresponding server now */
+      lwiperf_state_tcp_t *server = NULL;
+      ret = lwiperf_start_tcp_server_impl(&state->conn_pcb->local_ip, LWIPERF_TCP_PORT_DEFAULT,
+        report_fn, report_arg, (lwiperf_state_base_t *)state, &server);
+      if (ret != ERR_OK) {
+        /* starting server failed, abort client */
+        lwiperf_abort(state);
+        return NULL;
+      }
+      /* make this server accept one connection only */
+      server->specific_remote = 1;
+      server->remote_addr = state->conn_pcb->remote_ip;
+      if (type == LWIPERF_TRADEOFF) {
+        /* tradeoff means that the remote host connects only after the client is done,
+           so keep the listen pcb open until the client is done */
+        server->client_tradeoff_mode = 1;
+      }
+    }
+    return state;
+  }
+  return NULL;
 }

 /**
@@ -645,8 +821,10 @@ lwiperf_abort(void* lwiperf_session)
 {
  lwiperf_state_base_t *i, *dealloc, *last = NULL;

+  LWIP_ASSERT_CORE_LOCKED();
+
  for (i = lwiperf_all_connections; i != NULL; ) {
-    if ((i == lwiperf_session) || (i->related_server_state == lwiperf_session)) {
+    if ((i == lwiperf_session) || (i->related_master_state == lwiperf_session)) {
      dealloc = i;
      i = i->next;
      if (last != NULL) {
@@ -660,4 +838,4 @@ lwiperf_abort(void* lwiperf_session)
  }
 }

-#endif /* LWIP_IPV4 && LWIP_TCP */
+#endif /* LWIP_TCP && LWIP_CALLBACK_API */
--- a/src/apps/mdns/mdns.c
+++ b/src/apps/mdns/mdns.c
--- a/src/apps/mqtt/mqtt.c
+++ b/src/apps/mqtt/mqtt.c
--- a/src/apps/netbiosns/netbiosns.c
+++ b/src/apps/netbiosns/netbiosns.c
@@ -40,6 +40,10 @@
 *
 * This file is part of the lwIP TCP/IP stack.
 *
+ * Modifications by Ray Abram to respond to NetBIOS name requests when Incoming name = *
+ * - based on code from "https://github.com/esp8266/Arduino/commit/1f7989b31d26d7df9776a08f36d685eae7ac8f99"
+ * - with permission to relicense to BSD from original author:
+ *   http://www.xpablo.cz/?p=751#more-751
 */

 #include "lwip/apps/netbiosns.h"
@@ -48,13 +52,12 @@

 #include "lwip/def.h"
 #include "lwip/udp.h"
+#include "lwip/ip.h"
 #include "lwip/netif.h"
+#include "lwip/prot/iana.h"

 #include <string.h>

-/** default port number for "NetBIOS Name service */
-#define NETBIOS_PORT     137
-
 /** size of a NetBIOS name */
 #define NETBIOS_NAME_LEN 16

@@ -74,6 +77,10 @@
 #define NETB_HFLAG_REPLYCODE          0x0008U
 #define NETB_HFLAG_REPLYCODE_NOERROR  0x0000U

+/* NetBIOS question types */
+#define NETB_QTYPE_NB                 0x0020U
+#define NETB_QTYPE_NBSTAT             0x0021U
+
 /** NetBIOS name flags */
 #define NETB_NFLAG_UNIQUE             0x8000U
 #define NETB_NFLAG_NODETYPE           0x6000U
@@ -82,6 +89,10 @@
 #define NETB_NFLAG_NODETYPE_PNODE     0x2000U
 #define NETB_NFLAG_NODETYPE_BNODE     0x0000U

+#define NETB_NFLAG_NAME_IN_CONFLICT   0x0800U /* 1=Yes, 0=No */
+#define NETB_NFLAG_NAME_IS_ACTIVE     0x0400U /* 1=Yes, 0=No */
+#define NETB_NFLAG_NAME_IS_PERMANENT  0x0200U /* 1=Yes (Name is Permanent Node Name), 0=No */
+
 /** NetBIOS message header */
 #ifdef PACK_STRUCT_USE_INCLUDES
 #  include "arch/bpstruct.h"
@@ -100,6 +111,22 @@ PACK_STRUCT_END
 #  include "arch/epstruct.h"
 #endif

+/** NetBIOS message question part */
+#ifdef PACK_STRUCT_USE_INCLUDES
+#  include "arch/bpstruct.h"
+#endif
+PACK_STRUCT_BEGIN
+struct netbios_question_hdr {
+  PACK_STRUCT_FLD_8(u8_t  nametype);
+  PACK_STRUCT_FLD_8(u8_t  encname[(NETBIOS_NAME_LEN * 2) + 1]);
+  PACK_STRUCT_FIELD(u16_t type);
+  PACK_STRUCT_FIELD(u16_t cls);
+} PACK_STRUCT_STRUCT;
+PACK_STRUCT_END
+#ifdef PACK_STRUCT_USE_INCLUDES
+#  include "arch/epstruct.h"
+#endif
+
 /** NetBIOS message name part */
 #ifdef PACK_STRUCT_USE_INCLUDES
 #  include "arch/bpstruct.h"
@@ -125,8 +152,7 @@ PACK_STRUCT_END
 #  include "arch/bpstruct.h"
 #endif
 PACK_STRUCT_BEGIN
-struct netbios_resp
-{
+struct netbios_resp {
  struct netbios_hdr      resp_hdr;
  struct netbios_name_hdr resp_name;
 } PACK_STRUCT_STRUCT;
@@ -135,6 +161,74 @@ PACK_STRUCT_END
 #  include "arch/epstruct.h"
 #endif

+/** The NBNS Structure Responds to a Name Query */
+#ifdef PACK_STRUCT_USE_INCLUDES
+#  include "arch/bpstruct.h"
+#endif
+PACK_STRUCT_BEGIN
+struct netbios_answer {
+  struct netbios_hdr      answer_hdr;
+  /** the length of the next string */
+  PACK_STRUCT_FIELD(u8_t  name_size);
+  /** WARNING!!! this item may be of a different length (we use this struct for transmission) */
+  PACK_STRUCT_FLD_8(u8_t  query_name[(NETBIOS_NAME_LEN * 2) + 1]);
+  PACK_STRUCT_FIELD(u16_t packet_type);
+  PACK_STRUCT_FIELD(u16_t cls);
+  PACK_STRUCT_FIELD(u32_t ttl);
+  PACK_STRUCT_FIELD(u16_t data_length);
+#define OFFSETOF_STRUCT_NETBIOS_ANSWER_NUMBER_OF_NAMES 56
+  /** number of names */
+  PACK_STRUCT_FLD_8(u8_t  number_of_names);
+  /** node name */
+  PACK_STRUCT_FLD_8(u8_t  answer_name[NETBIOS_NAME_LEN]);
+  /** node flags */
+  PACK_STRUCT_FIELD(u16_t answer_name_flags);
+  /** Unit ID */
+  PACK_STRUCT_FLD_8(u8_t  unit_id[6]);
+  /** Jumpers */
+  PACK_STRUCT_FLD_8(u8_t  jumpers);
+  /** Test result */
+  PACK_STRUCT_FLD_8(u8_t  test_result);
+  /** Version number */
+  PACK_STRUCT_FIELD(u16_t version_number);
+  /** Period of statistics */
+  PACK_STRUCT_FIELD(u16_t period_of_statistics);
+  /** Statistics */
+  PACK_STRUCT_FIELD(u16_t number_of_crcs);
+  /** Statistics */
+  PACK_STRUCT_FIELD(u16_t number_of_alignment_errors);
+  /** Statistics */
+  PACK_STRUCT_FIELD(u16_t number_of_collisions);
+  /** Statistics */
+  PACK_STRUCT_FIELD(u16_t number_of_send_aborts);
+  /** Statistics */
+  PACK_STRUCT_FIELD(u32_t number_of_good_sends);
+  /** Statistics */
+  PACK_STRUCT_FIELD(u32_t number_of_good_receives);
+  /** Statistics */
+  PACK_STRUCT_FIELD(u16_t number_of_retransmits);
+  /** Statistics */
+  PACK_STRUCT_FIELD(u16_t number_of_no_resource_condition);
+  /** Statistics */
+  PACK_STRUCT_FIELD(u16_t number_of_free_command_blocks);
+  /** Statistics */
+  PACK_STRUCT_FIELD(u16_t total_number_of_command_blocks);
+  /** Statistics */
+  PACK_STRUCT_FIELD(u16_t max_total_number_of_command_blocks);
+  /** Statistics */
+  PACK_STRUCT_FIELD(u16_t number_of_pending_sessions);
+  /** Statistics */
+  PACK_STRUCT_FIELD(u16_t max_number_of_pending_sessions);
+  /** Statistics */
+  PACK_STRUCT_FIELD(u16_t max_total_sessions_possible);
+  /** Statistics */
+  PACK_STRUCT_FIELD(u16_t session_data_packet_size);
+} PACK_STRUCT_STRUCT;
+PACK_STRUCT_END
+#ifdef PACK_STRUCT_USE_INCLUDES
+#  include "arch/epstruct.h"
+#endif
+
 #ifdef NETBIOS_LWIP_NAME
 #define NETBIOS_LOCAL_NAME NETBIOS_LWIP_NAME
 #else
@@ -142,13 +236,13 @@ static char netbiosns_local_name[NETBIOS_NAME_LEN];
 #define NETBIOS_LOCAL_NAME netbiosns_local_name
 #endif

-struct udp_pcb *netbiosns_pcb;
+static struct udp_pcb *netbiosns_pcb;

 /** Decode a NetBIOS name (from packet to string) */
 static int
-netbiosns_name_decode(char *name_enc, char *name_dec, int name_dec_len)
+netbiosns_name_decode(const char *name_enc, char *name_dec, int name_dec_len)
 {
-  char *pname;
+  const char *pname;
  char       cname;
  char       cnbname;
  int        idx = 0;
@@ -161,11 +255,13 @@ netbiosns_name_decode(char *name_enc, char *name_dec, int name_dec_len)
    /* Every two characters of the first level-encoded name
     * turn into one character in the decoded name. */
    cname = *pname;
-    if (cname == '\0')
+    if (cname == '\0') {
      break;  /* no more characters */
-    if (cname == '.')
+    }
+    if (cname == '.') {
      break;  /* scope ID follows */
-    if (cname < 'A' || cname > 'Z') {
+    }
+    if (!lwip_isupper(cname)) {
      /* Not legal. */
      return -1;
    }
@@ -174,12 +270,7 @@ netbiosns_name_decode(char *name_enc, char *name_dec, int name_dec_len)
    pname++;

    cname = *pname;
-    if (cname == '\0' || cname == '.') {
-      /* No more characters in the name - but we're in
-       * the middle of a pair.  Not legal. */
-      return -1;
-    }
-    if (cname < 'A' || cname > 'Z') {
+    if (!lwip_isupper(cname)) {
      /* Not legal. */
      return -1;
    }
@@ -215,10 +306,12 @@ netbiosns_name_encode(char *name_enc, char *name_dec, int name_dec_len)
    /* Every two characters of the first level-encoded name
     * turn into one character in the decoded name. */
    cname = *pname;
-    if (cname == '\0')
+    if (cname == '\0') {
      break;  /* no more characters */
-    if (cname == '.')
+    }
+    if (cname == '.') {
      break;  /* scope ID follows */
+    }
    if ((cname < 'A' || cname > 'Z') && (cname < '0' || cname > '9')) {
      /* Not legal. */
      return -1;
@@ -259,8 +352,14 @@ netbiosns_recv(void *arg, struct udp_pcb *upcb, struct pbuf *p, const ip_addr_t
  if (p != NULL) {
    char   netbios_name[NETBIOS_NAME_LEN + 1];
    struct netbios_hdr          *netbios_hdr          = (struct netbios_hdr *)p->payload;
-    struct netbios_name_hdr* netbios_name_hdr = (struct netbios_name_hdr*)(netbios_hdr+1);
+    struct netbios_question_hdr *netbios_question_hdr = (struct netbios_question_hdr *)(netbios_hdr + 1);

+    /* is the packet long enough (we need the header in one piece) */
+    if (p->len < (sizeof(struct netbios_hdr) + sizeof(struct netbios_question_hdr))) {
+      /* packet too short */
+      pbuf_free(p);
+      return;
+    }
    /* we only answer if we got a default interface */
    if (netif_default != NULL) {
      /* @todo: do we need to check answerRRs/authorityRRs/additionalRRs? */
@@ -269,7 +368,9 @@ netbiosns_recv(void *arg, struct udp_pcb *upcb, struct pbuf *p, const ip_addr_t
          ((netbios_hdr->flags & PP_NTOHS(NETB_HFLAG_RESPONSE)) == 0) &&
          (netbios_hdr->questions == PP_NTOHS(1))) {
        /* decode the NetBIOS name */
-        netbiosns_name_decode((char*)(netbios_name_hdr->encname), netbios_name, sizeof(netbios_name));
+        netbiosns_name_decode((char *)(netbios_question_hdr->encname), netbios_name, sizeof(netbios_name));
+        /* check the request type */
+        if (netbios_question_hdr->type == PP_HTONS(NETB_QTYPE_NB)) {
          /* if the packet is for us */
          if (lwip_strnicmp(netbios_name, NETBIOS_LOCAL_NAME, sizeof(NETBIOS_LOCAL_NAME)) == 0) {
            struct pbuf *q;
@@ -291,10 +392,10 @@ netbiosns_recv(void *arg, struct udp_pcb *upcb, struct pbuf *p, const ip_addr_t
              resp->resp_hdr.additionalRRs = 0;

              /* prepare NetBIOS header datas */
-            MEMCPY( resp->resp_name.encname, netbios_name_hdr->encname, sizeof(netbios_name_hdr->encname));
-            resp->resp_name.nametype     = netbios_name_hdr->nametype;
-            resp->resp_name.type         = netbios_name_hdr->type;
-            resp->resp_name.cls          = netbios_name_hdr->cls;
+              MEMCPY( resp->resp_name.encname, netbios_question_hdr->encname, sizeof(netbios_question_hdr->encname));
+              resp->resp_name.nametype     = netbios_question_hdr->nametype;
+              resp->resp_name.type         = netbios_question_hdr->type;
+              resp->resp_name.cls          = netbios_question_hdr->cls;
              resp->resp_name.ttl          = PP_HTONL(NETBIOS_NAME_TTL);
              resp->resp_name.datalen      = PP_HTONS(sizeof(resp->resp_name.flags) + sizeof(resp->resp_name.addr));
              resp->resp_name.flags        = PP_HTONS(NETB_NFLAG_NODETYPE_BNODE);
@@ -307,6 +408,61 @@ netbiosns_recv(void *arg, struct udp_pcb *upcb, struct pbuf *p, const ip_addr_t
              pbuf_free(q);
            }
          }
+#if LWIP_NETBIOS_RESPOND_NAME_QUERY
+        } else if (netbios_question_hdr->type == PP_HTONS(NETB_QTYPE_NBSTAT)) {
+          /* if the packet is for us or general query */
+          if (!lwip_strnicmp(netbios_name, NETBIOS_LOCAL_NAME, sizeof(NETBIOS_LOCAL_NAME)) ||
+              !lwip_strnicmp(netbios_name, "*", sizeof(NETBIOS_LOCAL_NAME))) {
+            /* general query - ask for our IP address */
+            struct pbuf *q;
+            struct netbios_answer *resp;
+
+            q = pbuf_alloc(PBUF_TRANSPORT, sizeof(struct netbios_answer), PBUF_RAM);
+            if (q != NULL) {
+              /* buffer to which a response is compiled */
+              resp = (struct netbios_answer *) q->payload;
+
+              /* Init response to zero, especially the statistics fields */
+              memset(resp, 0, sizeof(*resp));
+
+              /* copy the query to the response ID */
+              resp->answer_hdr.trans_id        = netbios_hdr->trans_id;
+              /* acknowledgment of termination */
+              resp->answer_hdr.flags           = PP_HTONS(NETB_HFLAG_RESPONSE | NETB_HFLAG_OPCODE_NAME_QUERY | NETB_HFLAG_AUTHORATIVE);
+              /* resp->answer_hdr.questions       = PP_HTONS(0); done by memset() */
+              /* serial number of the answer */
+              resp->answer_hdr.answerRRs       = PP_HTONS(1);
+              /* resp->answer_hdr.authorityRRs    = PP_HTONS(0); done by memset() */
+              /* resp->answer_hdr.additionalRRs   = PP_HTONS(0); done by memset() */
+              /* we will copy the length of the station name */
+              resp->name_size                  = netbios_question_hdr->nametype;
+              /* we will copy the queried name */
+              MEMCPY(resp->query_name, netbios_question_hdr->encname, (NETBIOS_NAME_LEN * 2) + 1);
+              /* NBSTAT */
+              resp->packet_type                = PP_HTONS(0x21);
+              /* Internet name */
+              resp->cls                        = PP_HTONS(1);
+              /* resp->ttl                        = PP_HTONL(0); done by memset() */
+              resp->data_length                = PP_HTONS(sizeof(struct netbios_answer) - offsetof(struct netbios_answer, number_of_names));
+              resp->number_of_names            = 1;
+
+              /* make windows see us as workstation, not as a server */
+              memset(resp->answer_name, 0x20, NETBIOS_NAME_LEN - 1);
+              /* strlen is checked to be < NETBIOS_NAME_LEN during initialization */
+              MEMCPY(resp->answer_name, NETBIOS_LOCAL_NAME, strlen(NETBIOS_LOCAL_NAME));
+
+              /* b-node, unique, active */
+              resp->answer_name_flags          = PP_HTONS(NETB_NFLAG_NAME_IS_ACTIVE);
+
+              /* Set responder netif MAC address */
+              SMEMCPY(resp->unit_id, ip_current_input_netif()->hwaddr, sizeof(resp->unit_id));
+
+              udp_sendto(upcb, q, addr, port);
+              pbuf_free(q);
+            }
+          }
+#endif /* LWIP_NETBIOS_RESPOND_NAME_QUERY */
+        }
      }
    }
    /* free the pbuf */
@@ -321,6 +477,7 @@ netbiosns_recv(void *arg, struct udp_pcb *upcb, struct pbuf *p, const ip_addr_t
 void
 netbiosns_init(void)
 {
+  /* LWIP_ASSERT_CORE_LOCKED(); is checked by udp_new() */
 #ifdef NETBIOS_LWIP_NAME
  LWIP_ASSERT("NetBIOS name is too long!", strlen(NETBIOS_LWIP_NAME) < NETBIOS_NAME_LEN);
 #endif
@@ -329,7 +486,7 @@ netbiosns_init(void)
  if (netbiosns_pcb != NULL) {
    /* we have to be allowed to send broadcast packets! */
    ip_set_option(netbiosns_pcb, SOF_BROADCAST);
-    udp_bind(netbiosns_pcb, IP_ANY_TYPE, NETBIOS_PORT);
+    udp_bind(netbiosns_pcb, IP_ANY_TYPE, LWIP_IANA_PORT_NETBIOS);
    udp_recv(netbiosns_pcb, netbiosns_recv, netbiosns_pcb);
  }
 }
@@ -338,18 +495,26 @@ netbiosns_init(void)
 /**
 * @ingroup netbiosns
 * Set netbios name. ATTENTION: the hostname must be less than 15 characters!
+ *                              the NetBIOS name spec says the name MUST be upper case, so incoming name is forced into uppercase :-)
 */
 void
 netbiosns_set_name(const char *hostname)
 {
+  size_t i;
  size_t copy_len = strlen(hostname);
+  LWIP_ASSERT_CORE_LOCKED();
  LWIP_ASSERT("NetBIOS name is too long!", copy_len < NETBIOS_NAME_LEN);
  if (copy_len >= NETBIOS_NAME_LEN) {
    copy_len = NETBIOS_NAME_LEN - 1;
  }
-  MEMCPY(netbiosns_local_name, hostname, copy_len + 1);
+
+  /* make name into upper case */
+  for (i = 0; i < copy_len; i++ ) {
+    netbiosns_local_name[i] = (char)lwip_toupper(hostname[i]);
  }
-#endif
+  netbiosns_local_name[copy_len] = '\0';
+}
+#endif /* NETBIOS_LWIP_NAME */

 /**
 * @ingroup netbiosns
@@ -358,6 +523,7 @@ netbiosns_set_name(const char* hostname)
 void
 netbiosns_stop(void)
 {
+  LWIP_ASSERT_CORE_LOCKED();
  if (netbiosns_pcb != NULL) {
    udp_remove(netbiosns_pcb);
    netbiosns_pcb = NULL;
--- a/src/apps/smtp/smtp.c
+++ b/src/apps/smtp/smtp.c
--- a/src/apps/snmp/snmp_asn1.c
+++ b/src/apps/snmp/snmp_asn1.c
@@ -169,48 +169,6 @@ snmp_asn1_enc_u32t(struct snmp_pbuf_stream* pbuf_stream, u16_t octets_needed, u3

  return ERR_OK;
 }
-
-/**
- * Encodes u64_t (counter64) into a pbuf chained ASN1 msg.
- *
- * @param pbuf_stream points to a pbuf stream
- * @param octets_needed encoding length (from snmp_asn1_enc_u32t_cnt())
- * @param value is the host order u32_t value to be encoded
- * @return ERR_OK if successful, ERR_ARG if we can't (or won't) encode
- *
- * @see snmp_asn1_enc_u64t_cnt()
- */
-err_t
-snmp_asn1_enc_u64t(struct snmp_pbuf_stream* pbuf_stream, u16_t octets_needed, const u32_t* value)
-{
-  if (octets_needed > 9) {
-    return ERR_ARG;
-  }
-  if (octets_needed == 9) {
-    /* not enough bits in 'value' add leading 0x00 */
-    PBUF_OP_EXEC(snmp_pbuf_stream_write(pbuf_stream, 0x00));
-    octets_needed--;
-  }
-
-  while (octets_needed > 4) {
-    octets_needed--;
-    PBUF_OP_EXEC(snmp_pbuf_stream_write(pbuf_stream, (u8_t)(*value >> ((octets_needed-4) << 3))));
-  }
-
-  /* skip to low u32 */
-  value++;
-
-  while (octets_needed > 1) {
-    octets_needed--;
-    PBUF_OP_EXEC(snmp_pbuf_stream_write(pbuf_stream, (u8_t)(*value >> (octets_needed << 3))));
-  }
-
-  /* always write at least one octet (also in case of value == 0) */
-  PBUF_OP_EXEC(snmp_pbuf_stream_write(pbuf_stream, (u8_t)(*value)));
-
-  return ERR_OK;
-}
-
 /**
 * Encodes s32_t integer into a pbuf chained ASN1 msg.
 *
@@ -329,31 +287,6 @@ snmp_asn1_enc_u32t_cnt(u32_t value, u16_t *octets_needed)
  }
 }

-/**
- * Returns octet count for an u64_t.
- *
- * @param value value to be encoded
- * @param octets_needed points to the return value
- *
- * @note ASN coded integers are _always_ signed. E.g. +0xFFFF is coded
- * as 0x00,0xFF,0xFF. Note the leading sign octet. A positive value
- * of 0xFFFFFFFF is preceded with 0x00 and the length is 5 octets!!
- */
-void
-snmp_asn1_enc_u64t_cnt(const u32_t *value, u16_t *octets_needed)
-{
-  /* check if high u32 is 0 */
-  if (*value == 0x00) {
-    /* only low u32 is important */
-    value++;
-    snmp_asn1_enc_u32t_cnt(*value, octets_needed);
-  } else {
-    /* low u32 does not matter for length determination */
-    snmp_asn1_enc_u32t_cnt(*value, octets_needed);
-    *octets_needed = *octets_needed + 4; /* add the 4 bytes of low u32 */
-  }
-}
-
 /**
 * Returns octet count for an s32_t.
 *
@@ -442,6 +375,9 @@ snmp_asn1_dec_tlv(struct snmp_pbuf_stream* pbuf_stream, struct snmp_asn1_tlv* tl
    tlv->value_len  = data;
  } else if (data > 0x80) { /* long form */
    u8_t length_bytes = data - 0x80;
+    if (length_bytes > pbuf_stream->length) {
+      return ERR_VAL;
+    }
    tlv->length_len = length_bytes + 1; /* this byte + defined number of length bytes following */
    tlv->value_len = 0;

@@ -509,60 +445,6 @@ snmp_asn1_dec_u32t(struct snmp_pbuf_stream *pbuf_stream, u16_t len, u32_t *value
  return ERR_VAL;
 }

-/**
- * Decodes large positive integer (counter64) into 2x u32_t.
- *
- * @param pbuf_stream points to a pbuf stream
- * @param len length of the coded integer field
- * @param value return host order integer
- * @return ERR_OK if successful, ERR_ARG if we can't (or won't) decode
- *
- * @note ASN coded integers are _always_ signed. E.g. +0xFFFF is coded
- * as 0x00,0xFF,0xFF. Note the leading sign octet. A positive value
- * of 0xFFFFFFFF is preceded with 0x00 and the length is 5 octets!!
- */
-err_t
-snmp_asn1_dec_u64t(struct snmp_pbuf_stream *pbuf_stream, u16_t len, u32_t *value)
-{
-  u8_t data;
-
-  if (len <= 4) {
-    /* high u32 is 0 */
-    *value = 0;
-    /* directly skip to low u32 */
-    value++;
-  }
-
-  if ((len > 0) && (len <= 9)) {
-    PBUF_OP_EXEC(snmp_pbuf_stream_read(pbuf_stream, &data));
-
-    /* expecting sign bit to be zero, only unsigned please! */
-    if (((len == 9) && (data == 0x00)) || ((len < 9) && ((data & 0x80) == 0))) {
-      *value = data;
-      len--;
-
-      while (len > 0) {
-        PBUF_OP_EXEC(snmp_pbuf_stream_read(pbuf_stream, &data));
-
-        if (len == 4) {
-          /* skip to low u32 */
-          value++;
-          *value = 0;
-        } else {
-          *value <<= 8;
-        }
-
-        *value |= data;
-        len--;
-      }
-
-      return ERR_OK;
-    }
-  }
-
-  return ERR_VAL;
-}
-
 /**
 * Decodes integer into s32_t.
 *
@@ -576,51 +458,26 @@ snmp_asn1_dec_u64t(struct snmp_pbuf_stream *pbuf_stream, u16_t len, u32_t *value
 err_t
 snmp_asn1_dec_s32t(struct snmp_pbuf_stream *pbuf_stream, u16_t len, s32_t *value)
 {
-#if BYTE_ORDER == LITTLE_ENDIAN
-  u8_t *lsb_ptr = (u8_t*)value;
-#endif
-#if BYTE_ORDER == BIG_ENDIAN
-  u8_t *lsb_ptr = (u8_t*)value + sizeof(s32_t) - 1;
-#endif
-  u8_t sign;
  u8_t data;

  if ((len > 0) && (len < 5)) {
    PBUF_OP_EXEC(snmp_pbuf_stream_read(pbuf_stream, &data));
-    len--;

    if (data & 0x80) {
      /* negative, start from -1 */
      *value = -1;
-      sign = 1;
-      *lsb_ptr &= data;
+      *value = (*value << 8) | data;
    } else {
      /* positive, start from 0 */
-      *value = 0;
-      sign = 0;
-      *lsb_ptr |= data;
+      *value = data;
    }
-
-    /* OR/AND octets with value */
+    len--;
+    /* shift in the remaining value */
    while (len > 0) {
      PBUF_OP_EXEC(snmp_pbuf_stream_read(pbuf_stream, &data));
+      *value = (*value << 8) | data;
      len--;
-
-#if BYTE_ORDER == LITTLE_ENDIAN
-      *value <<= 8;
-#endif
-#if BYTE_ORDER == BIG_ENDIAN
-      *value >>= 8;
-#endif
-
-      if (sign) {
-        *lsb_ptr |= 255;
-        *lsb_ptr &= data;
-      } else {
-        *lsb_ptr |= data;
    }
-    }
-
    return ERR_OK;
  }

@@ -746,4 +603,102 @@ snmp_asn1_dec_raw(struct snmp_pbuf_stream *pbuf_stream, u16_t len, u8_t *buf, u1
  return ERR_OK;
 }

+#if LWIP_HAVE_INT64
+/**
+ * Returns octet count for an u64_t.
+ *
+ * @param value value to be encoded
+ * @param octets_needed points to the return value
+ *
+ * @note ASN coded integers are _always_ signed. E.g. +0xFFFF is coded
+ * as 0x00,0xFF,0xFF. Note the leading sign octet. A positive value
+ * of 0xFFFFFFFFFFFFFFFF is preceded with 0x00 and the length is 9 octets!!
+ */
+void
+snmp_asn1_enc_u64t_cnt(u64_t value, u16_t *octets_needed)
+{
+  /* check if high u32 is 0 */
+  if ((value >> 32) == 0) {
+    /* only low u32 is important */
+    snmp_asn1_enc_u32t_cnt((u32_t)value, octets_needed);
+  } else {
+    /* low u32 does not matter for length determination */
+    snmp_asn1_enc_u32t_cnt((u32_t)(value >> 32), octets_needed);
+    *octets_needed = *octets_needed + 4; /* add the 4 bytes of low u32 */
+  }
+}
+
+/**
+ * Decodes large positive integer (counter64) into 2x u32_t.
+ *
+ * @param pbuf_stream points to a pbuf stream
+ * @param len length of the coded integer field
+ * @param value return 64 bit integer
+ * @return ERR_OK if successful, ERR_ARG if we can't (or won't) decode
+ *
+ * @note ASN coded integers are _always_ signed. E.g. +0xFFFF is coded
+ * as 0x00,0xFF,0xFF. Note the leading sign octet. A positive value
+ * of 0xFFFFFFFFFFFFFFFF is preceded with 0x00 and the length is 9 octets!!
+ */
+err_t
+snmp_asn1_dec_u64t(struct snmp_pbuf_stream *pbuf_stream, u16_t len, u64_t *value)
+{
+  u8_t data;
+
+  if ((len > 0) && (len <= 9)) {
+    PBUF_OP_EXEC(snmp_pbuf_stream_read(pbuf_stream, &data));
+
+    /* expecting sign bit to be zero, only unsigned please! */
+    if (((len == 9) && (data == 0x00)) || ((len < 9) && ((data & 0x80) == 0))) {
+      *value = data;
+      len--;
+
+      while (len > 0) {
+        PBUF_OP_EXEC(snmp_pbuf_stream_read(pbuf_stream, &data));
+        *value <<= 8;
+        *value |= data;
+        len--;
+      }
+
+      return ERR_OK;
+    }
+  }
+
+  return ERR_VAL;
+}
+
+/**
+ * Encodes u64_t (counter64) into a pbuf chained ASN1 msg.
+ *
+ * @param pbuf_stream points to a pbuf stream
+ * @param octets_needed encoding length (from snmp_asn1_enc_u32t_cnt())
+ * @param value is the value to be encoded
+ * @return ERR_OK if successful, ERR_ARG if we can't (or won't) encode
+ *
+ * @see snmp_asn1_enc_u64t_cnt()
+ */
+err_t
+snmp_asn1_enc_u64t(struct snmp_pbuf_stream *pbuf_stream, u16_t octets_needed, u64_t value)
+{
+  if (octets_needed > 9) {
+    return ERR_ARG;
+  }
+  if (octets_needed == 9) {
+    /* not enough bits in 'value' add leading 0x00 */
+    PBUF_OP_EXEC(snmp_pbuf_stream_write(pbuf_stream, 0x00));
+    octets_needed--;
+  }
+
+  while (octets_needed > 1) {
+    octets_needed--;
+    PBUF_OP_EXEC(snmp_pbuf_stream_write(pbuf_stream, (u8_t)(value >> (octets_needed << 3))));
+  }
+
+  /* always write at least one octet (also in case of value == 0) */
+  PBUF_OP_EXEC(snmp_pbuf_stream_write(pbuf_stream, (u8_t)(value)));
+
+  return ERR_OK;
+}
+#endif
+
 #endif /* LWIP_SNMP */
--- a/src/apps/snmp/snmp_asn1.h
+++ b/src/apps/snmp/snmp_asn1.h
@@ -57,19 +57,21 @@ extern "C" {
 #define SNMP_ASN1_DATATYPE_MASK     0x1F
 #define SNMP_ASN1_DATATYPE_EXTENDED 0x1F /* DataType indicating that datatype is encoded in following bytes */

-/* context specific (SNMP) tags (from SNMP spec. RFC1157) */
+/* context specific (SNMP) tags (from SNMP spec. RFC1157 and RFC1905) */
 #define SNMP_ASN1_CONTEXT_PDU_GET_REQ      0
 #define SNMP_ASN1_CONTEXT_PDU_GET_NEXT_REQ 1
 #define SNMP_ASN1_CONTEXT_PDU_GET_RESP     2
 #define SNMP_ASN1_CONTEXT_PDU_SET_REQ      3
 #define SNMP_ASN1_CONTEXT_PDU_TRAP         4
 #define SNMP_ASN1_CONTEXT_PDU_GET_BULK_REQ 5
+#define SNMP_ASN1_CONTEXT_PDU_INFORM_REQ   6
+#define SNMP_ASN1_CONTEXT_PDU_V2_TRAP      7
+#define SNMP_ASN1_CONTEXT_PDU_REPORT       8

 #define SNMP_ASN1_CONTEXT_VARBIND_NO_SUCH_OBJECT      0
 #define SNMP_ASN1_CONTEXT_VARBIND_END_OF_MIB_VIEW     2

-struct snmp_asn1_tlv
-{
+struct snmp_asn1_tlv {
  u8_t  type;       /* only U8 because extended types are not specified by SNMP */
  u8_t  type_len;   /* encoded length of 'type' field (normally 1) */
  u8_t  length_len; /* indicates how many bytes are required to encode the 'value_len' field */
@@ -81,7 +83,6 @@ struct snmp_asn1_tlv

 err_t snmp_asn1_dec_tlv(struct snmp_pbuf_stream *pbuf_stream, struct snmp_asn1_tlv *tlv);
 err_t snmp_asn1_dec_u32t(struct snmp_pbuf_stream *pbuf_stream, u16_t len, u32_t *value);
-err_t snmp_asn1_dec_u64t(struct snmp_pbuf_stream *pbuf_stream, u16_t len, u32_t *value);
 err_t snmp_asn1_dec_s32t(struct snmp_pbuf_stream *pbuf_stream, u16_t len, s32_t *value);
 err_t snmp_asn1_dec_oid(struct snmp_pbuf_stream *pbuf_stream, u16_t len, u32_t *oid, u8_t *oid_len, u8_t oid_max_len);
 err_t snmp_asn1_dec_raw(struct snmp_pbuf_stream *pbuf_stream, u16_t len, u8_t *buf, u16_t *buf_len, u16_t buf_max_len);
@@ -90,15 +91,19 @@ err_t snmp_ans1_enc_tlv(struct snmp_pbuf_stream* pbuf_stream, struct snmp_asn1_t

 void snmp_asn1_enc_length_cnt(u16_t length, u8_t *octets_needed);
 void snmp_asn1_enc_u32t_cnt(u32_t value, u16_t *octets_needed);
-void snmp_asn1_enc_u64t_cnt(const u32_t *value, u16_t *octets_needed);
 void snmp_asn1_enc_s32t_cnt(s32_t value, u16_t *octets_needed);
 void snmp_asn1_enc_oid_cnt(const u32_t *oid, u16_t oid_len, u16_t *octets_needed);
 err_t snmp_asn1_enc_oid(struct snmp_pbuf_stream *pbuf_stream, const u32_t *oid, u16_t oid_len);
 err_t snmp_asn1_enc_s32t(struct snmp_pbuf_stream *pbuf_stream, u16_t octets_needed, s32_t value);
 err_t snmp_asn1_enc_u32t(struct snmp_pbuf_stream *pbuf_stream, u16_t octets_needed, u32_t value);
-err_t snmp_asn1_enc_u64t(struct snmp_pbuf_stream* pbuf_stream, u16_t octets_needed, const u32_t* value);
 err_t snmp_asn1_enc_raw(struct snmp_pbuf_stream *pbuf_stream, const u8_t *raw, u16_t raw_len);

+#if LWIP_HAVE_INT64
+err_t snmp_asn1_dec_u64t(struct snmp_pbuf_stream *pbuf_stream, u16_t len, u64_t *value);
+void snmp_asn1_enc_u64t_cnt(u64_t value, u16_t *octets_needed);
+err_t snmp_asn1_enc_u64t(struct snmp_pbuf_stream *pbuf_stream, u16_t octets_needed, u64_t value);
+#endif
+
 #ifdef __cplusplus
 }
 #endif
--- a/src/apps/snmp/snmp_core.c
+++ b/src/apps/snmp/snmp_core.c
@@ -34,17 +34,16 @@
 */

 /**
- * @defgroup snmp SNMPv2c agent
+ * @defgroup snmp SNMPv2c/v3 agent
 * @ingroup apps
- * SNMPv2c compatible agent\n
+ * SNMPv2c and SNMPv3 compatible agent\n
 * There is also a MIB compiler and a MIB viewer in lwIP contrib repository
 * (lwip-contrib/apps/LwipMibCompiler).\n
 * The agent implements the most important MIB2 MIBs including IPv6 support
 * (interfaces, UDP, TCP, SNMP, ICMP, SYSTEM). IP MIB is an older version
- * whithout IPv6 statistics (TODO).\n
+ * without IPv6 statistics (TODO).\n
 * Rewritten by Martin Hentschel <info@cl-soft.de> and
 * Dirk Ziegelmeier <dziegel@gmx.de>\n
- * Work on SNMPv3 has started, but is not finished.\n
 *
 * 0 Agent Capabilities
 * ====================
@@ -52,6 +51,7 @@
 * Features:
 * ---------
 * - SNMPv2c support.
+ * - SNMPv3 support (a port to ARM mbedtls is provided, LWIP_SNMP_V3_MBEDTLS option).
 * - Low RAM usage - no memory pools, stack only.
 * - MIB2 implementation is separated from SNMP stack.
 * - Support for multiple MIBs (snmp_set_mibs() call) - e.g. for private MIB.
@@ -91,6 +91,14 @@
 *   management protocols CMIP (Common Management Information Protocol)
 *   and CMOT (CMip Over Tcp).
 *
+ * SNMPv3
+ * ------
+ * When SNMPv3 is used, several functions from snmpv3.h must be implemented
+ * by the user. This is mainly user management and persistence handling.
+ * The sample provided in lwip-contrib is insecure, don't use it in production
+ * systems, especially the missing persistence for engine boots variable
+ * simplifies replay attacks.
+ *
 * MIB II
 * ------
 *   The standard lwIP stack management information base.
@@ -185,6 +193,9 @@
 #if (!LWIP_UDP && LWIP_SNMP)
 #error "If you want to use SNMP, you have to define LWIP_UDP=1 in your lwipopts.h"
 #endif
+#if SNMP_MAX_OBJ_ID_LEN > 255
+#error "SNMP_MAX_OBJ_ID_LEN must fit into an u8_t"
+#endif

 struct snmp_statistics snmp_stats;
 static const struct snmp_obj_id  snmp_device_enterprise_oid_default = {SNMP_DEVICE_ENTERPRISE_OID_LEN, SNMP_DEVICE_ENTERPRISE_OID};
@@ -193,11 +204,16 @@ static const struct snmp_obj_id* snmp_device_enterprise_oid         = &snmp_devi
 const u32_t snmp_zero_dot_zero_values[] = { 0, 0 };
 const struct snmp_obj_id_const_ref snmp_zero_dot_zero = { LWIP_ARRAYSIZE(snmp_zero_dot_zero_values), snmp_zero_dot_zero_values };

-
-#if SNMP_LWIP_MIB2
+#if SNMP_LWIP_MIB2 && LWIP_SNMP_V3
+#include "lwip/apps/snmp_mib2.h"
+#include "lwip/apps/snmp_snmpv2_framework.h"
+#include "lwip/apps/snmp_snmpv2_usm.h"
+static const struct snmp_mib *const default_mibs[] = { &mib2, &snmpframeworkmib, &snmpusmmib };
+static u8_t snmp_num_mibs                          = LWIP_ARRAYSIZE(default_mibs);
+#elif SNMP_LWIP_MIB2
 #include "lwip/apps/snmp_mib2.h"
 static const struct snmp_mib *const default_mibs[] = { &mib2 };
-static u8_t snmp_num_mibs                          = 1;
+static u8_t snmp_num_mibs                          = LWIP_ARRAYSIZE(default_mibs);
 #else
 static const struct snmp_mib *const default_mibs[] = { NULL };
 static u8_t snmp_num_mibs                          = 0;
@@ -219,6 +235,7 @@ static struct snmp_mib const * const *snmp_mibs = default_mibs;
 void
 snmp_set_mibs(const struct snmp_mib **mibs, u8_t num_mibs)
 {
+  LWIP_ASSERT_CORE_LOCKED();
  LWIP_ASSERT("mibs pointer must be != NULL", (mibs != NULL));
  LWIP_ASSERT("num_mibs pointer must be != 0", (num_mibs != 0));
  snmp_mibs     = mibs;
@@ -241,6 +258,7 @@ snmp_set_mibs(const struct snmp_mib **mibs, u8_t num_mibs)
 */
 void snmp_set_device_enterprise_oid(const struct snmp_obj_id *device_enterprise_oid)
 {
+  LWIP_ASSERT_CORE_LOCKED();
  if (device_enterprise_oid == NULL) {
    snmp_device_enterprise_oid = &snmp_device_enterprise_oid_default;
  } else {
@@ -254,6 +272,7 @@ void snmp_set_device_enterprise_oid(const struct snmp_obj_id* device_enterprise_
 */
 const struct snmp_obj_id *snmp_get_device_enterprise_oid(void)
 {
+  LWIP_ASSERT_CORE_LOCKED();
  return snmp_device_enterprise_oid;
 }

@@ -496,10 +515,10 @@ snmp_oid_to_ip(const u32_t *oid, u8_t oid_len, ip_addr_t *ip)
 u8_t
 snmp_oid_to_ip_port(const u32_t *oid, u8_t oid_len, ip_addr_t *ip, u16_t *port)
 {
-  u8_t idx = 0;
+  u8_t idx;

  /* InetAddressType + InetAddress */
-  idx += snmp_oid_to_ip(&oid[idx], oid_len-idx, ip);
+  idx = snmp_oid_to_ip(&oid[0], oid_len, ip);
  if (idx == 0) {
    return 0;
  }
@@ -528,7 +547,7 @@ snmp_oid_to_ip_port(const u32_t *oid, u8_t oid_len, ip_addr_t *ip, u16_t *port)
 void
 snmp_oid_assign(struct snmp_obj_id *target, const u32_t *oid, u8_t oid_len)
 {
-  LWIP_ASSERT("oid_len <= LWIP_SNMP_OBJ_ID_LEN", oid_len <= SNMP_MAX_OBJ_ID_LEN);
+  LWIP_ASSERT("oid_len <= SNMP_MAX_OBJ_ID_LEN", oid_len <= SNMP_MAX_OBJ_ID_LEN);

  target->len = oid_len;

@@ -546,7 +565,7 @@ snmp_oid_assign(struct snmp_obj_id* target, const u32_t *oid, u8_t oid_len)
 void
 snmp_oid_prefix(struct snmp_obj_id *target, const u32_t *oid, u8_t oid_len)
 {
-  LWIP_ASSERT("target->len + oid_len <= LWIP_SNMP_OBJ_ID_LEN", (target->len + oid_len) <= SNMP_MAX_OBJ_ID_LEN);
+  LWIP_ASSERT("target->len + oid_len <= SNMP_MAX_OBJ_ID_LEN", (target->len + oid_len) <= SNMP_MAX_OBJ_ID_LEN);

  if (oid_len > 0) {
    /* move existing OID to make room at the beginning for OID to insert */
@@ -584,11 +603,11 @@ snmp_oid_combine(struct snmp_obj_id* target, const u32_t *oid1, u8_t oid1_len, c
 void
 snmp_oid_append(struct snmp_obj_id *target, const u32_t *oid, u8_t oid_len)
 {
-  LWIP_ASSERT("offset + oid_len <= LWIP_SNMP_OBJ_ID_LEN", (target->len + oid_len) <= SNMP_MAX_OBJ_ID_LEN);
+  LWIP_ASSERT("offset + oid_len <= SNMP_MAX_OBJ_ID_LEN", (target->len + oid_len) <= SNMP_MAX_OBJ_ID_LEN);

  if (oid_len > 0) {
    MEMCPY(&target->id[target->len], oid, oid_len * sizeof(u32_t));
-    target->len += oid_len;
+    target->len = (u8_t)(target->len + oid_len);
  }
 }

@@ -655,21 +674,7 @@ snmp_oid_equal(const u32_t *oid1, u8_t oid1_len, const u32_t *oid2, u8_t oid2_le
 u8_t
 netif_to_num(const struct netif *netif)
 {
-  u8_t result = 0;
-  struct netif *netif_iterator = netif_list;
-
-  while (netif_iterator != NULL) {
-    result++;
-
-    if (netif_iterator == netif) {
-      return result;
-    }
-
-    netif_iterator = netif_iterator->next;
-  }
-
-  LWIP_ASSERT("netif not found in netif_list", 0);
-  return 0;
+  return netif_get_index(netif);
 }

 static const struct snmp_mib *
@@ -1121,7 +1126,7 @@ snmp_next_oid_init(struct snmp_next_oid_state *state,
 this methid is intended if the complete OID is not yet known but it is very expensive to build it up,
 so it is possible to test the starting part before building up the complete oid and pass it to snmp_next_oid_check()*/
 u8_t
-snmp_next_oid_precheck(struct snmp_next_oid_state *state, const u32_t *oid, const u8_t oid_len)
+snmp_next_oid_precheck(struct snmp_next_oid_state *state, const u32_t *oid, u8_t oid_len)
 {
  if (state->status != SNMP_NEXT_OID_STATUS_BUF_TO_SMALL) {
    u8_t start_oid_len = (oid_len < state->start_oid_len) ? oid_len : state->start_oid_len;
@@ -1141,7 +1146,7 @@ snmp_next_oid_precheck(struct snmp_next_oid_state *state, const u32_t *oid, cons

 /** checks the passed OID if it is a candidate to be the next one (get_next); returns !=0 if passed oid is currently closest, otherwise 0 */
 u8_t
-snmp_next_oid_check(struct snmp_next_oid_state *state, const u32_t *oid, const u8_t oid_len, void* reference)
+snmp_next_oid_check(struct snmp_next_oid_state *state, const u32_t *oid, u8_t oid_len, void *reference)
 {
  /* do not overwrite a fail result */
  if (state->status != SNMP_NEXT_OID_STATUS_BUF_TO_SMALL) {
@@ -1228,8 +1233,7 @@ snmp_decode_bits(const u8_t *buf, u32_t buf_len, u32_t *bit_value)
        }
        bits_processed++;
        b <<= 1;
-      }
-      while ((bits_processed & 0x07) != 0); /* &0x07 -> % 8 */
+      } while ((bits_processed & 0x07) != 0); /* &0x07 -> % 8 */
    } else {
      bits_processed += 8;
    }
--- a/src/apps/snmp/snmp_core_priv.h
+++ b/src/apps/snmp/snmp_core_priv.h
@@ -55,6 +55,13 @@ extern "C" {
 */
 #define SNMP_ERR_TOOBIG               1
 #define SNMP_ERR_AUTHORIZATIONERROR   16
+
+#define SNMP_ERR_UNKNOWN_ENGINEID     30
+#define SNMP_ERR_UNKNOWN_SECURITYNAME 31
+#define SNMP_ERR_UNSUPPORTED_SECLEVEL 32
+#define SNMP_ERR_NOTINTIMEWINDOW      33
+#define SNMP_ERR_DECRYIPTION_ERROR    34
+
 #define SNMP_ERR_NOSUCHOBJECT         SNMP_VARBIND_EXCEPTION_OFFSET + SNMP_ASN1_CONTEXT_VARBIND_NO_SUCH_OBJECT
 #define SNMP_ERR_ENDOFMIBVIEW         SNMP_VARBIND_EXCEPTION_OFFSET + SNMP_ASN1_CONTEXT_VARBIND_END_OF_MIB_VIEW

--- a/src/apps/snmp/snmp_mib2_interfaces.c
+++ b/src/apps/snmp/snmp_mib2_interfaces.c
@@ -65,10 +65,9 @@ interfaces_get_value(struct snmp_node_instance* instance, void* value)
    s32_t *sint_ptr = (s32_t *)value;
    s32_t num_netifs = 0;

-    struct netif *netif = netif_list;
-    while (netif != NULL) {
+    struct netif *netif;
+    NETIF_FOREACH(netif) {
      num_netifs++;
-      netif = netif->next;
    }

    *sint_ptr = num_netifs;
@@ -109,14 +108,12 @@ interfaces_Table_get_cell_instance(const u32_t* column, const u32_t* row_oid, u8
  ifIndex = row_oid[0];

  /* find netif with index */
-  netif = netif_list;
-  while (netif != NULL) {
+  NETIF_FOREACH(netif) {
    if (netif_to_num(netif) == ifIndex) {
      /* store netif pointer for subsequent operations (get/test/set) */
      cell_instance->reference.ptr = netif;
      return SNMP_ERR_NOERROR;
    }
-    netif = netif->next;
  }

  /* not found */
@@ -136,15 +133,12 @@ interfaces_Table_get_next_cell_instance(const u32_t* column, struct snmp_obj_id*
  snmp_next_oid_init(&state, row_oid->id, row_oid->len, result_temp, LWIP_ARRAYSIZE(interfaces_Table_oid_ranges));

  /* iterate over all possible OIDs to find the next one */
-  netif = netif_list;
-  while (netif != NULL) {
+  NETIF_FOREACH(netif) {
    u32_t test_oid[LWIP_ARRAYSIZE(interfaces_Table_oid_ranges)];
    test_oid[0] = netif_to_num(netif);

    /* check generated OID: is it a candidate for the next one? */
    snmp_next_oid_check(&state, test_oid, LWIP_ARRAYSIZE(interfaces_Table_oid_ranges), netif);
-
-    netif = netif->next;
  }

  /* did we find a next one? */
@@ -167,8 +161,7 @@ interfaces_Table_get_value(struct snmp_node_instance* instance, void* value)
  s32_t *value_s32 = (s32_t *)value;
  u16_t value_len;

-  switch (SNMP_TABLE_GET_COLUMN_FROM_OID(instance->instance_oid.id))
-  {
+  switch (SNMP_TABLE_GET_COLUMN_FROM_OID(instance->instance_oid.id)) {
    case 1: /* ifIndex */
      *value_s32 = netif_to_num(netif);
      value_len = sizeof(*value_s32);
--- a/src/apps/snmp/snmp_mib2_ip.c
+++ b/src/apps/snmp/snmp_mib2_ip.c
@@ -262,14 +262,11 @@ ip_AddrTable_get_cell_value(const u32_t* column, const u32_t* row_oid, u8_t row_
  snmp_oid_to_ip4(&row_oid[0], &ip); /* we know it succeeds because of oid_in_range check above */

  /* find netif with requested ip */
-  netif = netif_list;
-  while (netif != NULL) {
+  NETIF_FOREACH(netif) {
    if (ip4_addr_cmp(&ip, netif_ip4_addr(netif))) {
      /* fill in object properties */
      return ip_AddrTable_get_cell_value_core(netif, column, value, value_len);
    }
-
-    netif = netif->next;
  }

  /* not found */
@@ -287,15 +284,12 @@ ip_AddrTable_get_next_cell_instance_and_value(const u32_t* column, struct snmp_o
  snmp_next_oid_init(&state, row_oid->id, row_oid->len, result_temp, LWIP_ARRAYSIZE(ip_AddrTable_oid_ranges));

  /* iterate over all possible OIDs to find the next one */
-  netif = netif_list;
-  while (netif != NULL) {
+  NETIF_FOREACH(netif) {
    u32_t test_oid[LWIP_ARRAYSIZE(ip_AddrTable_oid_ranges)];
    snmp_ip4_to_oid(netif_ip4_addr(netif), &test_oid[0]);

    /* check generated OID: is it a candidate for the next one? */
    snmp_next_oid_check(&state, test_oid, LWIP_ARRAYSIZE(ip_AddrTable_oid_ranges), netif);
-
-    netif = netif->next;
  }

  /* did we find a next one? */
@@ -419,8 +413,7 @@ ip_RouteTable_get_cell_value(const u32_t* column, const u32_t* row_oid, u8_t row
  }

  /* find netif with requested route */
-  netif = netif_list;
-  while (netif != NULL) {
+  NETIF_FOREACH(netif) {
    ip4_addr_t dst;
    ip4_addr_get_network(&dst, netif_ip4_addr(netif), netif_ip4_netmask(netif));

@@ -428,8 +421,6 @@ ip_RouteTable_get_cell_value(const u32_t* column, const u32_t* row_oid, u8_t row
      /* fill in object properties */
      return ip_RouteTable_get_cell_value_core(netif, 0, column, value, value_len);
    }
-
-    netif = netif->next;
  }

  /* not found */
@@ -454,8 +445,7 @@ ip_RouteTable_get_next_cell_instance_and_value(const u32_t* column, struct snmp_
  }

  /* iterate over all possible OIDs to find the next one */
-  netif = netif_list;
-  while (netif != NULL) {
+  NETIF_FOREACH(netif) {
    ip4_addr_t dst;
    ip4_addr_get_network(&dst, netif_ip4_addr(netif), netif_ip4_netmask(netif));

@@ -464,8 +454,6 @@ ip_RouteTable_get_next_cell_instance_and_value(const u32_t* column, struct snmp_
      snmp_ip4_to_oid(&dst, &test_oid[0]);
      snmp_next_oid_check(&state, test_oid, LWIP_ARRAYSIZE(ip_RouteTable_oid_ranges), netif);
    }
-
-    netif = netif->next;
  }

  /* did we find a next one? */
@@ -494,7 +482,7 @@ static const struct snmp_oid_range ip_NetToMediaTable_oid_ranges[] = {
 };

 static snmp_err_t
-ip_NetToMediaTable_get_cell_value_core(u8_t arp_table_index, const u32_t* column, union snmp_variant_value* value, u32_t* value_len)
+ip_NetToMediaTable_get_cell_value_core(size_t arp_table_index, const u32_t *column, union snmp_variant_value *value, u32_t *value_len)
 {
  ip4_addr_t *ip;
  struct netif *netif;
@@ -529,7 +517,7 @@ ip_NetToMediaTable_get_cell_value(const u32_t* column, const u32_t* row_oid, u8_
 {
  ip4_addr_t ip_in;
  u8_t netif_index;
-  u8_t i;
+  size_t i;

  /* check if incoming OID length and if values are in plausible range */
  if (!snmp_oid_in_range(row_oid, row_oid_len, ip_NetToMediaTable_oid_ranges, LWIP_ARRAYSIZE(ip_NetToMediaTable_oid_ranges))) {
@@ -561,7 +549,7 @@ ip_NetToMediaTable_get_cell_value(const u32_t* column, const u32_t* row_oid, u8_
 static snmp_err_t
 ip_NetToMediaTable_get_next_cell_instance_and_value(const u32_t *column, struct snmp_obj_id *row_oid, union snmp_variant_value *value, u32_t *value_len)
 {
-  u8_t i;
+  size_t i;
  struct snmp_next_oid_state state;
  u32_t result_temp[LWIP_ARRAYSIZE(ip_NetToMediaTable_oid_ranges)];

@@ -581,7 +569,7 @@ ip_NetToMediaTable_get_next_cell_instance_and_value(const u32_t* column, struct
      snmp_ip4_to_oid(ip, &test_oid[1]);

      /* check generated OID: is it a candidate for the next one? */
-      snmp_next_oid_check(&state, test_oid, LWIP_ARRAYSIZE(ip_NetToMediaTable_oid_ranges), (void*)(size_t)i);
+      snmp_next_oid_check(&state, test_oid, LWIP_ARRAYSIZE(ip_NetToMediaTable_oid_ranges), LWIP_PTR_NUMERIC_CAST(void *, i));
    }
  }

@@ -589,7 +577,7 @@ ip_NetToMediaTable_get_next_cell_instance_and_value(const u32_t* column, struct
  if (state.status == SNMP_NEXT_OID_STATUS_SUCCESS) {
    snmp_oid_assign(row_oid, state.next_oid, state.next_oid_len);
    /* fill in object properties */
-    return ip_NetToMediaTable_get_cell_value_core((u8_t)(size_t)state.reference, column, value, value_len);
+    return ip_NetToMediaTable_get_cell_value_core(LWIP_PTR_NUMERIC_CAST(size_t, state.reference), column, value, value_len);
  }

  /* not found */
--- a/src/apps/snmp/snmp_mib2_system.c
+++ b/src/apps/snmp/snmp_mib2_system.c
@@ -238,8 +238,7 @@ system_get_value(const struct snmp_scalar_array_node_def *node, void *value)
      var     = sysdescr;
      var_len = (const s16_t *)sysdescr_len;
      break;
-  case 2: /* sysObjectID */
-    {
+    case 2: { /* sysObjectID */
      const struct snmp_obj_id *dev_enterprise_oid = snmp_get_device_enterprise_oid();
      MEMCPY(value, dev_enterprise_oid->id, dev_enterprise_oid->len * sizeof(u32_t));
      return dev_enterprise_oid->len * sizeof(u32_t);
--- a/src/apps/snmp/snmp_mib2_tcp.c
+++ b/src/apps/snmp/snmp_mib2_tcp.c
@@ -93,8 +93,7 @@ tcp_get_value(struct snmp_node_instance* instance, void* value)
    case 8: /* tcpEstabResets */
      *uint_ptr = STATS_GET(mib2.tcpestabresets);
      return sizeof(*uint_ptr);
-  case 9: /* tcpCurrEstab */
-    {
+    case 9: { /* tcpCurrEstab */
      u16_t tcpcurrestab = 0;
      struct tcp_pcb *pcb = tcp_active_pcbs;
      while (pcb != NULL) {
@@ -122,12 +121,20 @@ tcp_get_value(struct snmp_node_instance* instance, void* value)
    case 15: /* tcpOutRsts */
      *uint_ptr = STATS_GET(mib2.tcpoutrsts);
      return sizeof(*uint_ptr);
-  case 17: /* tcpHCInSegs */
-    memset(value, 0, 2*sizeof(u32_t)); /* not supported */
-    return 2*sizeof(u32_t);
-  case 18: /* tcpHCOutSegs */
-    memset(value, 0, 2*sizeof(u32_t)); /* not supported */
-    return 2*sizeof(u32_t);
+#if LWIP_HAVE_INT64
+    case 17: { /* tcpHCInSegs */
+      /* use the 32 bit counter for now... */
+      u64_t val64 = STATS_GET(mib2.tcpinsegs);
+      *((u64_t *)value) = val64;
+    }
+    return sizeof(u64_t);
+    case 18: { /* tcpHCOutSegs */
+      /* use the 32 bit counter for now... */
+      u64_t val64 = STATS_GET(mib2.tcpoutsegs);
+      *((u64_t *)value) = val64;
+    }
+    return sizeof(u64_t);
+#endif
    default:
      LWIP_DEBUGF(SNMP_MIB_DEBUG, ("tcp_get_value(): unknown id: %"S32_F"\n", instance->node->oid));
      break;
@@ -512,8 +519,10 @@ static const struct snmp_scalar_node tcp_OutSegs       = SNMP_SCALAR_CREATE_NODE
 static const struct snmp_scalar_node tcp_RetransSegs   = SNMP_SCALAR_CREATE_NODE_READONLY(12, SNMP_ASN1_TYPE_COUNTER, tcp_get_value);
 static const struct snmp_scalar_node tcp_InErrs        = SNMP_SCALAR_CREATE_NODE_READONLY(14, SNMP_ASN1_TYPE_COUNTER, tcp_get_value);
 static const struct snmp_scalar_node tcp_OutRsts       = SNMP_SCALAR_CREATE_NODE_READONLY(15, SNMP_ASN1_TYPE_COUNTER, tcp_get_value);
+#if LWIP_HAVE_INT64
 static const struct snmp_scalar_node tcp_HCInSegs      = SNMP_SCALAR_CREATE_NODE_READONLY(17, SNMP_ASN1_TYPE_COUNTER64, tcp_get_value);
 static const struct snmp_scalar_node tcp_HCOutSegs     = SNMP_SCALAR_CREATE_NODE_READONLY(18, SNMP_ASN1_TYPE_COUNTER64, tcp_get_value);
+#endif

 #if LWIP_IPV4
 static const struct snmp_table_simple_col_def tcp_ConnTable_columns[] = {
@@ -561,8 +570,10 @@ CREATE_LWIP_SYNC_NODE(13, tcp_ConnTable)
 #endif /* LWIP_IPV4 */
 CREATE_LWIP_SYNC_NODE(14, tcp_InErrs)
 CREATE_LWIP_SYNC_NODE(15, tcp_OutRsts)
+#if LWIP_HAVE_INT64
 CREATE_LWIP_SYNC_NODE(17, tcp_HCInSegs)
 CREATE_LWIP_SYNC_NODE(18, tcp_HCOutSegs)
+#endif
 CREATE_LWIP_SYNC_NODE(19, tcp_ConnectionTable)
 CREATE_LWIP_SYNC_NODE(20, tcp_ListenerTable)

@@ -585,8 +596,10 @@ static const struct snmp_node* const tcp_nodes[] = {
  &SYNC_NODE_NAME(tcp_InErrs).node.node,
  &SYNC_NODE_NAME(tcp_OutRsts).node.node,
  &SYNC_NODE_NAME(tcp_HCInSegs).node.node,
+#if LWIP_HAVE_INT64
  &SYNC_NODE_NAME(tcp_HCOutSegs).node.node,
  &SYNC_NODE_NAME(tcp_ConnectionTable).node.node,
+#endif
  &SYNC_NODE_NAME(tcp_ListenerTable).node.node
 };

--- a/src/apps/snmp/snmp_mib2_udp.c
+++ b/src/apps/snmp/snmp_mib2_udp.c
@@ -75,12 +75,20 @@ udp_get_value(struct snmp_node_instance* instance, void* value)
    case 4: /* udpOutDatagrams */
      *uint_ptr = STATS_GET(mib2.udpoutdatagrams);
      return sizeof(*uint_ptr);
-  case 8: /* udpHCInDatagrams */
-    memset(value, 0, 2*sizeof(u32_t)); /* not supported */
-    return 2*sizeof(u32_t);
-  case 9: /* udpHCOutDatagrams */
-    memset(value, 0, 2*sizeof(u32_t)); /* not supported */
-    return 2*sizeof(u32_t);
+#if LWIP_HAVE_INT64
+    case 8: { /* udpHCInDatagrams */
+      /* use the 32 bit counter for now... */
+      u64_t val64 = STATS_GET(mib2.udpindatagrams);
+      *((u64_t *)value) = val64;
+    }
+    return sizeof(u64_t);
+    case 9: { /* udpHCOutDatagrams */
+      /* use the 32 bit counter for now... */
+      u64_t val64 = STATS_GET(mib2.udpoutdatagrams);
+      *((u64_t *)value) = val64;
+    }
+    return sizeof(u64_t);
+#endif
    default:
      LWIP_DEBUGF(SNMP_MIB_DEBUG, ("udp_get_value(): unknown id: %"S32_F"\n", instance->node->oid));
      break;
@@ -310,8 +318,10 @@ static const struct snmp_scalar_node udp_inDatagrams    = SNMP_SCALAR_CREATE_NOD
 static const struct snmp_scalar_node udp_noPorts        = SNMP_SCALAR_CREATE_NODE_READONLY(2, SNMP_ASN1_TYPE_COUNTER,   udp_get_value);
 static const struct snmp_scalar_node udp_inErrors       = SNMP_SCALAR_CREATE_NODE_READONLY(3, SNMP_ASN1_TYPE_COUNTER,   udp_get_value);
 static const struct snmp_scalar_node udp_outDatagrams   = SNMP_SCALAR_CREATE_NODE_READONLY(4, SNMP_ASN1_TYPE_COUNTER,   udp_get_value);
+#if LWIP_HAVE_INT64
 static const struct snmp_scalar_node udp_HCInDatagrams  = SNMP_SCALAR_CREATE_NODE_READONLY(8, SNMP_ASN1_TYPE_COUNTER64, udp_get_value);
 static const struct snmp_scalar_node udp_HCOutDatagrams = SNMP_SCALAR_CREATE_NODE_READONLY(9, SNMP_ASN1_TYPE_COUNTER64, udp_get_value);
+#endif

 #if LWIP_IPV4
 static const struct snmp_table_simple_col_def udp_Table_columns[] = {
@@ -337,8 +347,10 @@ CREATE_LWIP_SYNC_NODE(4, udp_outDatagrams)
 CREATE_LWIP_SYNC_NODE(5, udp_Table)
 #endif /* LWIP_IPV4 */
 CREATE_LWIP_SYNC_NODE(7, udp_endpointTable)
+#if LWIP_HAVE_INT64
 CREATE_LWIP_SYNC_NODE(8, udp_HCInDatagrams)
 CREATE_LWIP_SYNC_NODE(9, udp_HCOutDatagrams)
+#endif

 static const struct snmp_node *const udp_nodes[] = {
  &SYNC_NODE_NAME(udp_inDatagrams).node.node,
@@ -348,9 +360,12 @@ static const struct snmp_node* const udp_nodes[] = {
 #if LWIP_IPV4
  &SYNC_NODE_NAME(udp_Table).node.node,
 #endif /* LWIP_IPV4 */
-  &SYNC_NODE_NAME(udp_endpointTable).node.node,
+  &SYNC_NODE_NAME(udp_endpointTable).node.node
+#if LWIP_HAVE_INT64
+  ,
  &SYNC_NODE_NAME(udp_HCInDatagrams).node.node,
  &SYNC_NODE_NAME(udp_HCOutDatagrams).node.node
+#endif
 };

 const struct snmp_tree_node snmp_mib2_udp_root = SNMP_CREATE_TREE_NODE(7, udp_nodes);
--- a/src/apps/snmp/snmp_msg.c
+++ b/src/apps/snmp/snmp_msg.c
@@ -48,13 +48,21 @@
 #if LWIP_SNMP_V3
 #include "lwip/apps/snmpv3.h"
 #include "snmpv3_priv.h"
-#ifdef LWIP_SNMPV3_INCLUDE_ENGINE
-#include LWIP_SNMPV3_INCLUDE_ENGINE
+#ifdef LWIP_HOOK_FILENAME
+#include LWIP_HOOK_FILENAME
 #endif
 #endif

 #include <string.h>

+#define SNMP_V3_AUTH_FLAG      0x01
+#define SNMP_V3_PRIV_FLAG      0x02
+
+/* Security levels */
+#define SNMP_V3_NOAUTHNOPRIV   0x00
+#define SNMP_V3_AUTHNOPRIV     SNMP_V3_AUTH_FLAG
+#define SNMP_V3_AUTHPRIV       (SNMP_V3_AUTH_FLAG | SNMP_V3_PRIV_FLAG)
+
 /* public (non-static) constants */
 /** SNMP community string */
 const char *snmp_community = SNMP_COMMUNITY;
@@ -66,6 +74,87 @@ const char *snmp_community_trap = SNMP_COMMUNITY_TRAP;
 snmp_write_callback_fct snmp_write_callback     = NULL;
 void                   *snmp_write_callback_arg = NULL;

+#if LWIP_SNMP_CONFIGURE_VERSIONS
+
+static u8_t v1_enabled = 1;
+static u8_t v2c_enabled = 1;
+static u8_t v3_enabled = 1;
+
+static u8_t
+snmp_version_enabled(u8_t version)
+{
+  if (version == SNMP_VERSION_1) {
+    return v1_enabled;
+  } else if (version == SNMP_VERSION_2c) {
+    return v2c_enabled;
+  }
+#if LWIP_SNMP_V3
+  else if (version == SNMP_VERSION_3) {
+    return v3_enabled;
+  }
+#endif
+  else {
+    LWIP_ASSERT("Invalid SNMP version", 0);
+    return 0;
+  }
+}
+
+u8_t
+snmp_v1_enabled(void)
+{
+  return snmp_version_enabled(SNMP_VERSION_1);
+}
+
+u8_t
+snmp_v2c_enabled(void)
+{
+  return snmp_version_enabled(SNMP_VERSION_2c);
+}
+
+u8_t
+snmp_v3_enabled(void)
+{
+  return snmp_version_enabled(SNMP_VERSION_3);
+}
+
+static void
+snmp_version_enable(u8_t version, u8_t enable)
+{
+  if (version == SNMP_VERSION_1) {
+    v1_enabled = enable;
+  } else if (version == SNMP_VERSION_2c) {
+    v2c_enabled = enable;
+  }
+#if LWIP_SNMP_V3
+  else if (version == SNMP_VERSION_3) {
+    v3_enabled = enable;
+  }
+#endif
+  else {
+    LWIP_ASSERT("Invalid SNMP version", 0);
+  }
+}
+
+void
+snmp_v1_enable(u8_t enable)
+{
+  snmp_version_enable(SNMP_VERSION_1, enable);
+}
+
+void
+snmp_v2c_enable(u8_t enable)
+{
+  snmp_version_enable(SNMP_VERSION_2c, enable);
+}
+
+void
+snmp_v3_enable(u8_t enable)
+{
+  snmp_version_enable(SNMP_VERSION_3, enable);
+}
+
+#endif
+
 /**
 * @ingroup snmp_core
 * Returns current SNMP community string.
@@ -88,6 +177,7 @@ snmp_get_community(void)
 void
 snmp_set_community(const char *const community)
 {
+  LWIP_ASSERT_CORE_LOCKED();
  LWIP_ASSERT("community string is too long!", strlen(community) <= SNMP_MAX_COMMUNITY_STR_LEN);
  snmp_community = community;
 }
@@ -125,6 +215,7 @@ snmp_get_community_trap(void)
 void
 snmp_set_community_write(const char *const community)
 {
+  LWIP_ASSERT_CORE_LOCKED();
  LWIP_ASSERT("community string must not be NULL", community != NULL);
  LWIP_ASSERT("community string is too long!", strlen(community) <= SNMP_MAX_COMMUNITY_STR_LEN);
  snmp_community_write = community;
@@ -141,6 +232,7 @@ snmp_set_community_write(const char * const community)
 void
 snmp_set_community_trap(const char *const community)
 {
+  LWIP_ASSERT_CORE_LOCKED();
  LWIP_ASSERT("community string is too long!", strlen(community) <= SNMP_MAX_COMMUNITY_STR_LEN);
  snmp_community_trap = community;
 }
@@ -152,6 +244,7 @@ snmp_set_community_trap(const char * const community)
 void
 snmp_set_write_callback(snmp_write_callback_fct write_callback, void *callback_arg)
 {
+  LWIP_ASSERT_CORE_LOCKED();
  snmp_write_callback     = write_callback;
  snmp_write_callback_arg = callback_arg;
 }
@@ -206,6 +299,66 @@ snmp_receive(void *handle, struct pbuf *p, const ip_addr_t *source_ip, u16_t por
          err = snmp_process_set_request(&request);
        }
      }
+#if LWIP_SNMP_V3
+      else {
+        struct snmp_varbind vb;
+
+        vb.next = NULL;
+        vb.prev = NULL;
+        vb.type = SNMP_ASN1_TYPE_COUNTER32;
+        vb.value_len = sizeof(u32_t);
+
+        switch (request.error_status) {
+          case SNMP_ERR_AUTHORIZATIONERROR: {
+            static const u32_t oid[] = { 1, 3, 6, 1, 6, 3, 15, 1, 1, 5, 0 };
+            snmp_oid_assign(&vb.oid, oid, LWIP_ARRAYSIZE(oid));
+            vb.value = &snmp_stats.wrongdigests;
+          }
+          break;
+          case SNMP_ERR_UNKNOWN_ENGINEID: {
+            static const u32_t oid[] = { 1, 3, 6, 1, 6, 3, 15, 1, 1, 4, 0 };
+            snmp_oid_assign(&vb.oid, oid, LWIP_ARRAYSIZE(oid));
+            vb.value = &snmp_stats.unknownengineids;
+          }
+          break;
+          case SNMP_ERR_UNKNOWN_SECURITYNAME: {
+            static const u32_t oid[] = { 1, 3, 6, 1, 6, 3, 15, 1, 1, 3, 0 };
+            snmp_oid_assign(&vb.oid, oid, LWIP_ARRAYSIZE(oid));
+            vb.value = &snmp_stats.unknownusernames;
+          }
+          break;
+          case SNMP_ERR_UNSUPPORTED_SECLEVEL: {
+            static const u32_t oid[] = { 1, 3, 6, 1, 6, 3, 15, 1, 1, 1, 0 };
+            snmp_oid_assign(&vb.oid, oid, LWIP_ARRAYSIZE(oid));
+            vb.value = &snmp_stats.unsupportedseclevels;
+          }
+          break;
+          case SNMP_ERR_NOTINTIMEWINDOW: {
+            static const u32_t oid[] = { 1, 3, 6, 1, 6, 3, 15, 1, 1, 2, 0 };
+            snmp_oid_assign(&vb.oid, oid, LWIP_ARRAYSIZE(oid));
+            vb.value = &snmp_stats.notintimewindows;
+          }
+          break;
+          case SNMP_ERR_DECRYIPTION_ERROR: {
+            static const u32_t oid[] = { 1, 3, 6, 1, 6, 3, 15, 1, 1, 6, 0 };
+            snmp_oid_assign(&vb.oid, oid, LWIP_ARRAYSIZE(oid));
+            vb.value = &snmp_stats.decryptionerrors;
+          }
+          break;
+          default:
+            /* Unknown or unhandled error_status */
+            err = ERR_ARG;
+        }
+
+        if (err == ERR_OK) {
+          snmp_append_outbound_varbind(&(request.outbound_pbuf_stream), &vb);
+          request.error_status = SNMP_ERR_NOERROR;
+        }
+
+        request.request_out_type = (SNMP_ASN1_CLASS_CONTEXT | SNMP_ASN1_CONTENTTYPE_CONSTRUCTED | SNMP_ASN1_CONTEXT_PDU_REPORT);
+        request.request_id = request.msg_id;
+      }
+#endif

      if (err == ERR_OK) {
        err = snmp_complete_outbound_frame(&request);
@@ -236,10 +389,12 @@ snmp_msg_getnext_validate_node_inst(struct snmp_node_instance* node_instance, vo
    return SNMP_ERR_NOSUCHINSTANCE;
  }

+#if LWIP_HAVE_INT64
  if ((node_instance->asn1_type == SNMP_ASN1_TYPE_COUNTER64) && (((struct snmp_request *)validate_arg)->version == SNMP_VERSION_1)) {
    /* according to RFC 2089 skip Counter64 objects in GetNext requests from v1 clients */
    return SNMP_ERR_NOSUCHINSTANCE;
  }
+#endif

  return SNMP_ERR_NOERROR;
 }
@@ -296,10 +451,10 @@ snmp_process_varbind(struct snmp_request *request, struct snmp_varbind *vb, u8_t
    }
  } else {
    s16_t len = node_instance.get_value(&node_instance, vb->value);
-    vb->type = node_instance.asn1_type;

    if (len >= 0) {
      vb->value_len = (u16_t)len; /* cast is OK because we checked >= 0 above */
+      vb->type = node_instance.asn1_type;

      LWIP_ASSERT("SNMP_MAX_VALUE_SIZE is configured too low", (vb->value_len & ~SNMP_GET_VALUE_RAW_DATA) <= SNMP_MAX_VALUE_SIZE);
      err = snmp_append_outbound_varbind(&request->outbound_pbuf_stream, vb);
@@ -615,6 +770,10 @@ snmp_parse_inbound_frame(struct snmp_request *request)
  s32_t parent_tlv_value_len;
  s32_t s32_value;
  err_t err;
+#if LWIP_SNMP_V3
+  snmpv3_auth_algo_t auth;
+  snmpv3_priv_algo_t priv;
+#endif

  IF_PARSE_EXEC(snmp_pbuf_stream_init(&pbuf_stream, request->inbound_pbuf, 0, request->inbound_pbuf->tot_len));

@@ -630,13 +789,17 @@ snmp_parse_inbound_frame(struct snmp_request *request)
  IF_PARSE_ASSERT(parent_tlv_value_len > 0);

  IF_PARSE_EXEC(snmp_asn1_dec_s32t(&pbuf_stream, tlv.value_len, &s32_value));
-  if ((s32_value != SNMP_VERSION_1) &&
+
+  if (((s32_value != SNMP_VERSION_1) &&
       (s32_value != SNMP_VERSION_2c)
 #if LWIP_SNMP_V3
       && (s32_value != SNMP_VERSION_3)
 #endif
      )
-  {
+#if LWIP_SNMP_CONFIGURE_VERSIONS
+      || (!snmp_version_enabled(s32_value))
+#endif
+     ) {
    /* unsupported SNMP version */
    snmp_stats.inbadversions++;
    return ERR_ARG;
@@ -650,8 +813,9 @@ snmp_parse_inbound_frame(struct snmp_request *request)

    /* SNMPv3 doesn't use communities */
    /* @todo: Differentiate read/write access */
-    strcpy((char*)request->community, snmp_community);
-    request->community_strlen = (u16_t)strlen(snmp_community);
+    strncpy((char *)request->community, snmp_community, SNMP_MAX_COMMUNITY_STR_LEN);
+    request->community[SNMP_MAX_COMMUNITY_STR_LEN] = 0; /* ensure NULL termination (strncpy does NOT guarantee it!) */
+    request->community_strlen = (u16_t)strnlen((char *)request->community, SNMP_MAX_COMMUNITY_STR_LEN);

    /* RFC3414 globalData */
    IF_PARSE_EXEC(snmp_asn1_dec_tlv(&pbuf_stream, &tlv));
@@ -736,7 +900,6 @@ snmp_parse_inbound_frame(struct snmp_request *request)
    parent_tlv_value_len -= SNMP_ASN1_TLV_LENGTH(tlv);
    IF_PARSE_ASSERT(parent_tlv_value_len > 0);
    IF_PARSE_EXEC(snmp_asn1_dec_s32t(&pbuf_stream, tlv.value_len, &request->msg_authoritative_engine_time));
-    /* @todo: Implement time window checking */

    /* msgUserName */
    IF_PARSE_EXEC(snmp_asn1_dec_tlv(&pbuf_stream, &tlv));
@@ -747,8 +910,6 @@ snmp_parse_inbound_frame(struct snmp_request *request)
    IF_PARSE_EXEC(snmp_asn1_dec_raw(&pbuf_stream, tlv.value_len, request->msg_user_name,
                                    &u16_value, SNMP_V3_MAX_USER_LENGTH));
    request->msg_user_name_len = (u8_t)u16_value;
-    /* @todo: Implement unknown user error response */
-    IF_PARSE_EXEC(snmpv3_get_user((char*)request->msg_user_name, NULL, NULL, NULL, NULL));

    /* msgAuthenticationParameters */
    memset(request->msg_authentication_parameters, 0, SNMP_V3_MAX_AUTH_PARAM_LENGTH);
@@ -760,38 +921,10 @@ snmp_parse_inbound_frame(struct snmp_request *request)
    inbound_msgAuthenticationParameters_offset = pbuf_stream.offset;
    LWIP_UNUSED_ARG(inbound_msgAuthenticationParameters_offset);
    /* Read auth parameters */
-    IF_PARSE_ASSERT(tlv.value_len <= SNMP_V3_MAX_AUTH_PARAM_LENGTH);
+    /* IF_PARSE_ASSERT(tlv.value_len <= SNMP_V3_MAX_AUTH_PARAM_LENGTH); */
    IF_PARSE_EXEC(snmp_asn1_dec_raw(&pbuf_stream, tlv.value_len, request->msg_authentication_parameters,
                                    &u16_value, tlv.value_len));
-
-#if LWIP_SNMP_V3_CRYPTO
-    if (request->msg_flags & SNMP_V3_AUTH_FLAG) {
-      const u8_t zero_arr[SNMP_V3_MAX_AUTH_PARAM_LENGTH] = { 0 };
-      u8_t key[20];
-      u8_t algo;
-      u8_t hmac[LWIP_MAX(SNMP_V3_SHA_LEN, SNMP_V3_MD5_LEN)];
-      struct snmp_pbuf_stream auth_stream;
-
-      /* Rewind stream */
-      IF_PARSE_EXEC(snmp_pbuf_stream_init(&pbuf_stream, request->inbound_pbuf, 0, request->inbound_pbuf->tot_len));
-      IF_PARSE_EXEC(snmp_pbuf_stream_seek_abs(&pbuf_stream, inbound_msgAuthenticationParameters_offset));
-      /* Set auth parameters to zero for verification */
-      IF_PARSE_EXEC(snmp_asn1_enc_raw(&pbuf_stream, zero_arr, tlv.value_len));
-
-      /* Verify authentication */
-      IF_PARSE_EXEC(snmp_pbuf_stream_init(&auth_stream, request->inbound_pbuf, 0, request->inbound_pbuf->tot_len));
-
-      IF_PARSE_EXEC(snmpv3_get_user((char*)request->msg_user_name, &algo, key, NULL, NULL));
-      IF_PARSE_EXEC(snmpv3_auth(&auth_stream, request->inbound_pbuf->tot_len, key, algo, hmac));
-      /* @todo: Implement error response */
-      IF_PARSE_EXEC(memcmp(request->msg_authentication_parameters, hmac, SNMP_V3_MAX_AUTH_PARAM_LENGTH));
-    }
-#else
-    /* Ungraceful exit if we encounter cryptography and don't support it.
-     * @todo: Implement error response
-     */
-    IF_PARSE_ASSERT(!(request->msg_flags & (SNMP_V3_AUTH_FLAG | SNMP_V3_PRIV_FLAG)));
-#endif
+    request->msg_authentication_parameters_len = (u8_t)u16_value;

    /* msgPrivacyParameters */
    memset(request->msg_privacy_parameters, 0, SNMP_V3_MAX_PRIV_PARAM_LENGTH);
@@ -802,24 +935,167 @@ snmp_parse_inbound_frame(struct snmp_request *request)

    IF_PARSE_EXEC(snmp_asn1_dec_raw(&pbuf_stream, tlv.value_len, request->msg_privacy_parameters,
                                    &u16_value, SNMP_V3_MAX_PRIV_PARAM_LENGTH));
+    request->msg_privacy_parameters_len = (u8_t)u16_value;

+    /* validate securityParameters here (do this after decoding because we don't want to increase other counters for wrong frames)
+     * 1) securityParameters was correctly serialized if we reach here.
+     * 2) securityParameters are already cached.
+     * 3) if msgAuthoritativeEngineID is unknown, zero-length or too long:
+         b) https://tools.ietf.org/html/rfc3414#section-7
+     */
+    {
+      const char *eid;
+      u8_t eid_len;
+
+      snmpv3_get_engine_id(&eid, &eid_len);
+
+      if ((request->msg_authoritative_engine_id_len == 0) ||
+          (request->msg_authoritative_engine_id_len != eid_len) ||
+          (memcmp(eid, request->msg_authoritative_engine_id, eid_len) != 0)) {
+        snmp_stats.unknownengineids++;
+        request->msg_flags = 0; /* noauthnopriv */
+        request->error_status = SNMP_ERR_UNKNOWN_ENGINEID;
+        return ERR_OK;
+      }
+    }
+
+    /* 4) verify username */
+    if (snmpv3_get_user((char *)request->msg_user_name, &auth, NULL, &priv, NULL)) {
+      snmp_stats.unknownusernames++;
+      request->msg_flags = 0; /* noauthnopriv */
+      request->error_status = SNMP_ERR_UNKNOWN_SECURITYNAME;
+      return ERR_OK;
+    }
+
+    /* 5) verify security level */
+    switch (request->msg_flags & (SNMP_V3_AUTH_FLAG | SNMP_V3_PRIV_FLAG)) {
+      case SNMP_V3_NOAUTHNOPRIV:
+        if ((auth != SNMP_V3_AUTH_ALGO_INVAL) || (priv != SNMP_V3_PRIV_ALGO_INVAL)) {
+          /* Invalid security level for user */
+          snmp_stats.unsupportedseclevels++;
+          request->msg_flags = SNMP_V3_NOAUTHNOPRIV;
+          request->error_status = SNMP_ERR_UNSUPPORTED_SECLEVEL;
+          return ERR_OK;
+        }
+        break;
 #if LWIP_SNMP_V3_CRYPTO
-    /* Decrypt message */
-    if (request->msg_flags & SNMP_V3_PRIV_FLAG) {
+      case SNMP_V3_AUTHNOPRIV:
+        if ((auth == SNMP_V3_AUTH_ALGO_INVAL) || (priv != SNMP_V3_PRIV_ALGO_INVAL)) {
+          /* Invalid security level for user */
+          snmp_stats.unsupportedseclevels++;
+          request->msg_flags = SNMP_V3_NOAUTHNOPRIV;
+          request->error_status = SNMP_ERR_UNSUPPORTED_SECLEVEL;
+          return ERR_OK;
+        }
+        break;
+      case SNMP_V3_AUTHPRIV:
+        if ((auth == SNMP_V3_AUTH_ALGO_INVAL) || (priv == SNMP_V3_PRIV_ALGO_INVAL)) {
+          /* Invalid security level for user */
+          snmp_stats.unsupportedseclevels++;
+          request->msg_flags = SNMP_V3_NOAUTHNOPRIV;
+          request->error_status = SNMP_ERR_UNSUPPORTED_SECLEVEL;
+          return ERR_OK;
+        }
+        break;
+#endif
+      default:
+        snmp_stats.unsupportedseclevels++;
+        request->msg_flags = SNMP_V3_NOAUTHNOPRIV;
+        request->error_status = SNMP_ERR_UNSUPPORTED_SECLEVEL;
+        return ERR_OK;
+    }
+
+    /* 6) if securitylevel specifies authentication, authenticate message. */
+#if LWIP_SNMP_V3_CRYPTO
+    if (request->msg_flags & SNMP_V3_AUTH_FLAG) {
+      const u8_t zero_arr[SNMP_V3_MAX_AUTH_PARAM_LENGTH] = { 0 };
+      u8_t key[20];
+      u8_t hmac[LWIP_MAX(SNMP_V3_SHA_LEN, SNMP_V3_MD5_LEN)];
+      struct snmp_pbuf_stream auth_stream;
+
+      if (request->msg_authentication_parameters_len > SNMP_V3_MAX_AUTH_PARAM_LENGTH) {
+        snmp_stats.wrongdigests++;
+        request->msg_flags = SNMP_V3_NOAUTHNOPRIV;
+        request->error_status = SNMP_ERR_AUTHORIZATIONERROR;
+        return ERR_OK;
+      }
+
+      /* Rewind stream */
+      IF_PARSE_EXEC(snmp_pbuf_stream_init(&auth_stream, request->inbound_pbuf, 0, request->inbound_pbuf->tot_len));
+      IF_PARSE_EXEC(snmp_pbuf_stream_seek_abs(&auth_stream, inbound_msgAuthenticationParameters_offset));
+      /* Set auth parameters to zero for verification */
+      IF_PARSE_EXEC(snmp_asn1_enc_raw(&auth_stream, zero_arr, request->msg_authentication_parameters_len));
+
+      /* Verify authentication */
+      IF_PARSE_EXEC(snmp_pbuf_stream_init(&auth_stream, request->inbound_pbuf, 0, request->inbound_pbuf->tot_len));
+
+      IF_PARSE_EXEC(snmpv3_get_user((char *)request->msg_user_name, &auth, key, NULL, NULL));
+      IF_PARSE_EXEC(snmpv3_auth(&auth_stream, request->inbound_pbuf->tot_len, key, auth, hmac));
+
+      if (memcmp(request->msg_authentication_parameters, hmac, SNMP_V3_MAX_AUTH_PARAM_LENGTH)) {
+        snmp_stats.wrongdigests++;
+        request->msg_flags = SNMP_V3_NOAUTHNOPRIV;
+        request->error_status = SNMP_ERR_AUTHORIZATIONERROR;
+        return ERR_OK;
+      }
+
+      /* 7) if securitylevel specifies authentication, verify engineboots, enginetime and lastenginetime */
+      {
+        s32_t boots = snmpv3_get_engine_boots_internal();
+        if ((request->msg_authoritative_engine_boots != boots) || (boots == 2147483647UL)) {
+          snmp_stats.notintimewindows++;
+          request->msg_flags = SNMP_V3_AUTHNOPRIV;
+          request->error_status = SNMP_ERR_NOTINTIMEWINDOW;
+          return ERR_OK;
+        }
+      }
+      {
+        s32_t time = snmpv3_get_engine_time_internal();
+        if (request->msg_authoritative_engine_time > (time + 150)) {
+          snmp_stats.notintimewindows++;
+          request->msg_flags = SNMP_V3_AUTHNOPRIV;
+          request->error_status = SNMP_ERR_NOTINTIMEWINDOW;
+          return ERR_OK;
+        } else if (time > 150) {
+          if (request->msg_authoritative_engine_time < (time - 150)) {
+            snmp_stats.notintimewindows++;
+            request->msg_flags = SNMP_V3_AUTHNOPRIV;
+            request->error_status = SNMP_ERR_NOTINTIMEWINDOW;
+            return ERR_OK;
+          }
+        }
+      }
+    }
+#endif
+
+    /* 8) if securitylevel specifies privacy, decrypt message. */
+#if LWIP_SNMP_V3_CRYPTO
+    if (request->msg_flags & SNMP_V3_PRIV_FLAG) {
+      /* Decrypt message */
+
      u8_t key[20];
-      u8_t algo;

      IF_PARSE_EXEC(snmp_asn1_dec_tlv(&pbuf_stream, &tlv));
      IF_PARSE_ASSERT(tlv.type == SNMP_ASN1_TYPE_OCTET_STRING);
      parent_tlv_value_len -= SNMP_ASN1_TLV_HDR_LENGTH(tlv);
      IF_PARSE_ASSERT(parent_tlv_value_len > 0);

-      IF_PARSE_EXEC(snmpv3_get_user((char*)request->msg_user_name, NULL, NULL, &algo, key));
-      IF_PARSE_EXEC(snmpv3_crypt(&pbuf_stream, tlv.value_len, key,
+      IF_PARSE_EXEC(snmpv3_get_user((char *)request->msg_user_name, NULL, NULL, &priv, key));
+      if (snmpv3_crypt(&pbuf_stream, tlv.value_len, key,
                       request->msg_privacy_parameters, request->msg_authoritative_engine_boots,
-          request->msg_authoritative_engine_time, algo, SNMP_V3_PRIV_MODE_DECRYPT));
+                       request->msg_authoritative_engine_time, priv, SNMP_V3_PRIV_MODE_DECRYPT) != ERR_OK) {
+        snmp_stats.decryptionerrors++;
+        request->msg_flags = SNMP_V3_AUTHNOPRIV;
+        request->error_status = SNMP_ERR_DECRYIPTION_ERROR;
+        return ERR_OK;
+      }
    }
 #endif
+    /* 9) calculate max size of scoped pdu?
+     * 10) securityname for user is retrieved from usertable?
+     * 11) security data is cached?
+     * 12)
+     */

    /* Scoped PDU
     * Encryption context
@@ -838,6 +1114,7 @@ snmp_parse_inbound_frame(struct snmp_request *request)
    IF_PARSE_EXEC(snmp_asn1_dec_raw(&pbuf_stream, tlv.value_len, request->context_engine_id,
                                    &u16_value, SNMP_V3_MAX_ENGINE_ID_LENGTH));
    request->context_engine_id_len = (u8_t)u16_value;
+    /* TODO: do we need to verify this contextengineid too? */

    /* contextName */
    IF_PARSE_EXEC(snmp_asn1_dec_tlv(&pbuf_stream, &tlv));
@@ -848,6 +1125,7 @@ snmp_parse_inbound_frame(struct snmp_request *request)
    IF_PARSE_EXEC(snmp_asn1_dec_raw(&pbuf_stream, tlv.value_len, request->context_name,
                                    &u16_value, SNMP_V3_MAX_ENGINE_ID_LENGTH));
    request->context_name_len = (u8_t)u16_value;
+    /* TODO: do we need to verify this contextname too? */
  } else
 #endif
  {
@@ -900,9 +1178,9 @@ snmp_parse_inbound_frame(struct snmp_request *request)
      /* unsupported input PDU for this agent (no parse error) */
      LWIP_DEBUGF(SNMP_DEBUG, ("Unknown/Invalid SNMP PDU type received: %d", tlv.type)); \
      return ERR_ARG;
-      break;
  }
  request->request_type = tlv.type & SNMP_ASN1_DATATYPE_MASK;
+  request->request_out_type = (SNMP_ASN1_CLASS_CONTEXT | SNMP_ASN1_CONTENTTYPE_CONSTRUCTED | SNMP_ASN1_CONTEXT_PDU_GET_RESP);

  /* validate community (do this after decoding PDU type because we don't want to increase 'inbadcommunitynames' for wrong frame types */
  if (request->community_strlen == 0) {
@@ -1152,7 +1430,7 @@ snmp_prepare_outbound_frame(struct snmp_request *request)

  /* 'PDU' sequence */
  request->outbound_pdu_offset = pbuf_stream->offset;
-  SNMP_ASN1_SET_TLV_PARAMS(tlv, (SNMP_ASN1_CLASS_CONTEXT | SNMP_ASN1_CONTENTTYPE_CONSTRUCTED | SNMP_ASN1_CONTEXT_PDU_GET_RESP), 3, 0);
+  SNMP_ASN1_SET_TLV_PARAMS(tlv, request->request_out_type, 3, 0);
  OF_BUILD_EXEC( snmp_ans1_enc_tlv(pbuf_stream, &tlv) );

  /* request ID */
@@ -1227,12 +1505,14 @@ snmp_varbind_length(struct snmp_varbind *varbind, struct snmp_varbind_len *len)
        }
        snmp_asn1_enc_oid_cnt((u32_t *) varbind->value, varbind->value_len >> 2, &len->value_value_len);
        break;
+#if LWIP_HAVE_INT64
      case SNMP_ASN1_TYPE_COUNTER64:
-        if (varbind->value_len != (2 * sizeof (u32_t))) {
+        if (varbind->value_len != sizeof(u64_t)) {
          return ERR_VAL;
        }
-        snmp_asn1_enc_u64t_cnt((u32_t*) varbind->value, &len->value_value_len);
+        snmp_asn1_enc_u64t_cnt(*(u64_t *)varbind->value, &len->value_value_len);
        break;
+#endif
      default:
        /* unsupported type */
        return ERR_VAL;
@@ -1303,9 +1583,11 @@ snmp_append_outbound_varbind(struct snmp_pbuf_stream *pbuf_stream, struct snmp_v
        case SNMP_ASN1_TYPE_OBJECT_ID:
          OVB_BUILD_EXEC(snmp_asn1_enc_oid(pbuf_stream, (u32_t *) varbind->value, varbind->value_len / sizeof (u32_t)));
          break;
+#if LWIP_HAVE_INT64
        case SNMP_ASN1_TYPE_COUNTER64:
-          OVB_BUILD_EXEC(snmp_asn1_enc_u64t(pbuf_stream, len.value_value_len, (u32_t*) varbind->value));
+          OVB_BUILD_EXEC(snmp_asn1_enc_u64t(pbuf_stream, len.value_value_len, *(u64_t *) varbind->value));
          break;
+#endif
        default:
          LWIP_ASSERT("Unknown variable type", 0);
          break;
@@ -1384,7 +1666,7 @@ snmp_complete_outbound_frame(struct snmp_request *request)
    struct snmp_pbuf_stream inbound_stream;
    OF_BUILD_EXEC( snmp_pbuf_stream_init(&inbound_stream, request->inbound_pbuf, request->inbound_varbind_offset, request->inbound_varbind_len) );
    OF_BUILD_EXEC( snmp_pbuf_stream_init(&(request->outbound_pbuf_stream), request->outbound_pbuf, request->outbound_varbind_offset, request->outbound_pbuf->tot_len - request->outbound_varbind_offset) );
-    snmp_pbuf_stream_writeto(&inbound_stream, &(request->outbound_pbuf_stream), 0);
+    OF_BUILD_EXEC( snmp_pbuf_stream_writeto(&inbound_stream, &(request->outbound_pbuf_stream), 0) );
  }

  frame_size = request->outbound_pbuf_stream.offset;
@@ -1395,7 +1677,7 @@ snmp_complete_outbound_frame(struct snmp_request *request)
    u8_t i;
    outbound_padding = (8 - (u8_t)((frame_size - request->outbound_scoped_pdu_seq_offset) & 0x07)) & 0x07;
    for (i = 0; i < outbound_padding; i++) {
-      snmp_pbuf_stream_write(&request->outbound_pbuf_stream, 0);
+      OF_BUILD_EXEC( snmp_pbuf_stream_write(&request->outbound_pbuf_stream, 0) );
    }
  }
 #endif
@@ -1433,7 +1715,7 @@ snmp_complete_outbound_frame(struct snmp_request *request)
 #endif

  /* complete missing length in 'PDU' sequence */
-  SNMP_ASN1_SET_TLV_PARAMS(tlv, (SNMP_ASN1_CLASS_CONTEXT | SNMP_ASN1_CONTENTTYPE_CONSTRUCTED | SNMP_ASN1_CONTEXT_PDU_GET_RESP), 3,
+  SNMP_ASN1_SET_TLV_PARAMS(tlv, request->request_out_type, 3,
                           frame_size - request->outbound_pdu_offset - 1 - 3); /* - type - length_len(fixed, see snmp_prepare_outbound_frame()) */
  OF_BUILD_EXEC( snmp_pbuf_stream_seek_abs(&(request->outbound_pbuf_stream), request->outbound_pdu_offset) );
  OF_BUILD_EXEC( snmp_ans1_enc_tlv(&(request->outbound_pbuf_stream), &tlv) );
@@ -1502,7 +1784,7 @@ snmp_complete_outbound_frame(struct snmp_request *request)
  /* Encrypt response */
  if (request->version == SNMP_VERSION_3 && (request->msg_flags & SNMP_V3_PRIV_FLAG)) {
    u8_t key[20];
-    u8_t algo;
+    snmpv3_priv_algo_t algo;

    /* complete missing length in PDU sequence */
    OF_BUILD_EXEC(snmp_pbuf_stream_init(&request->outbound_pbuf_stream, request->outbound_pbuf, 0, request->outbound_pbuf->tot_len));
@@ -1520,7 +1802,7 @@ snmp_complete_outbound_frame(struct snmp_request *request)

  if (request->version == SNMP_VERSION_3 && (request->msg_flags & SNMP_V3_AUTH_FLAG)) {
    u8_t key[20];
-    u8_t algo;
+    snmpv3_auth_algo_t algo;
    u8_t hmac[20];

    OF_BUILD_EXEC(snmpv3_get_user((char *)request->msg_user_name, &algo, key, NULL, NULL));
@@ -1585,8 +1867,7 @@ snmp_vb_enumerator_get_next(struct snmp_varbind_enumerator* enumerator, struct s
  u16_t  varbind_len;
  err_t  err;

-  if (enumerator->pbuf_stream.length == 0)
-  {
+  if (enumerator->pbuf_stream.length == 0) {
    return SNMP_VB_ENUMERATOR_ERR_EOVB;
  }
  enumerator->varbind_count++;
@@ -1613,13 +1894,13 @@ snmp_vb_enumerator_get_next(struct snmp_varbind_enumerator* enumerator, struct s
    switch (varbind->type) {
      case SNMP_ASN1_TYPE_INTEGER:
        VB_PARSE_EXEC(snmp_asn1_dec_s32t(&(enumerator->pbuf_stream), tlv.value_len, (s32_t *)varbind->value));
-        varbind->value_len = sizeof(s32_t*);
+        varbind->value_len = sizeof(s32_t);
        break;
      case SNMP_ASN1_TYPE_COUNTER:
      case SNMP_ASN1_TYPE_GAUGE:
      case SNMP_ASN1_TYPE_TIMETICKS:
        VB_PARSE_EXEC(snmp_asn1_dec_u32t(&(enumerator->pbuf_stream), tlv.value_len, (u32_t *)varbind->value));
-        varbind->value_len = sizeof(u32_t*);
+        varbind->value_len = sizeof(u32_t);
        break;
      case SNMP_ASN1_TYPE_OCTET_STRING:
      case SNMP_ASN1_TYPE_OPAQUE:
@@ -1649,10 +1930,12 @@ snmp_vb_enumerator_get_next(struct snmp_varbind_enumerator* enumerator, struct s
          VB_PARSE_ASSERT(0);
        }
        break;
+#if LWIP_HAVE_INT64
      case SNMP_ASN1_TYPE_COUNTER64:
-        VB_PARSE_EXEC(snmp_asn1_dec_u64t(&(enumerator->pbuf_stream), tlv.value_len, (u32_t*)varbind->value));
-        varbind->value_len = 2 * sizeof(u32_t*);
+        VB_PARSE_EXEC(snmp_asn1_dec_u64t(&(enumerator->pbuf_stream), tlv.value_len, (u64_t *)varbind->value));
+        varbind->value_len = sizeof(u64_t);
        break;
+#endif
      default:
        VB_PARSE_ASSERT(0);
        break;
--- a/src/apps/snmp/snmp_msg.h
+++ b/src/apps/snmp/snmp_msg.h
@@ -57,24 +57,12 @@
 extern "C" {
 #endif

-/* The listen port of the SNMP agent. Clients have to make their requests to
-   this port. Most standard clients won't work if you change this! */
-#ifndef SNMP_IN_PORT
-#define SNMP_IN_PORT 161
-#endif
-/* The remote port the SNMP agent sends traps to. Most standard trap sinks won't
-   work if you change this! */
-#ifndef SNMP_TRAP_PORT
-#define SNMP_TRAP_PORT 162
-#endif
-
 /* version defines used in PDU */
 #define SNMP_VERSION_1  0
 #define SNMP_VERSION_2c 1
 #define SNMP_VERSION_3  3

-struct snmp_varbind_enumerator
-{
+struct snmp_varbind_enumerator {
  struct snmp_pbuf_stream pbuf_stream;
  u16_t varbind_count;
 };
@@ -89,8 +77,7 @@ typedef enum {
 void snmp_vb_enumerator_init(struct snmp_varbind_enumerator *enumerator, struct pbuf *p, u16_t offset, u16_t length);
 snmp_vb_enumerator_err_t snmp_vb_enumerator_get_next(struct snmp_varbind_enumerator *enumerator, struct snmp_varbind *varbind);

-struct snmp_request
-{
+struct snmp_request {
  /* Communication handle */
  void *handle;
  /* source IP address */
@@ -116,6 +103,9 @@ struct snmp_request
  /* max-repetitions (getBulkRequest (SNMPv2c)) */
  s32_t max_repetitions;

+  /* Usually response-pdu (2). When snmpv3 errors are detected report-pdu(8) */
+  u8_t request_out_type;
+
 #if LWIP_SNMP_V3
  s32_t msg_id;
  s32_t msg_max_size;
@@ -128,7 +118,9 @@ struct snmp_request
  u8_t  msg_user_name[SNMP_V3_MAX_USER_LENGTH];
  u8_t  msg_user_name_len;
  u8_t  msg_authentication_parameters[SNMP_V3_MAX_AUTH_PARAM_LENGTH];
+  u8_t  msg_authentication_parameters_len;
  u8_t  msg_privacy_parameters[SNMP_V3_MAX_PRIV_PARAM_LENGTH];
+  u8_t  msg_privacy_parameters_len;
  u8_t  context_engine_id[SNMP_V3_MAX_ENGINE_ID_LENGTH];
  u8_t  context_engine_id_len;
  u8_t  context_name[SNMP_V3_MAX_ENGINE_ID_LENGTH];
@@ -162,8 +154,7 @@ struct snmp_request
 };

 /** A helper struct keeping length information about varbinds */
-struct snmp_varbind_len
-{
+struct snmp_varbind_len {
  u8_t  vb_len_len;
  u16_t vb_value_len;
  u8_t  oid_len_len;
--- a/src/apps/snmp/snmp_netconn.c
+++ b/src/apps/snmp/snmp_netconn.c
@@ -36,11 +36,13 @@

 #if LWIP_SNMP && SNMP_USE_NETCONN

+#include <string.h>
 #include "lwip/api.h"
 #include "lwip/ip.h"
 #include "lwip/udp.h"
 #include "snmp_msg.h"
 #include "lwip/sys.h"
+#include "lwip/prot/iana.h"

 /** SNMP netconn API worker thread */
 static void
@@ -54,10 +56,10 @@ snmp_netconn_thread(void *arg)
  /* Bind to SNMP port with default IP address */
 #if LWIP_IPV6
  conn = netconn_new(NETCONN_UDP_IPV6);
-  netconn_bind(conn, IP6_ADDR_ANY, SNMP_IN_PORT);
+  netconn_bind(conn, IP6_ADDR_ANY, LWIP_IANA_PORT_SNMP);
 #else /* LWIP_IPV6 */
  conn = netconn_new(NETCONN_UDP);
-  netconn_bind(conn, IP4_ADDR_ANY, SNMP_IN_PORT);
+  netconn_bind(conn, IP4_ADDR_ANY, LWIP_IANA_PORT_SNMP);
 #endif /* LWIP_IPV6 */
  LWIP_ERROR("snmp_netconn: invalid conn", (conn != NULL), return;);

@@ -114,6 +116,7 @@ snmp_get_local_ip_for_dst(void* handle, const ip_addr_t *dst, ip_addr_t *result)
 void
 snmp_init(void)
 {
+  LWIP_ASSERT_CORE_LOCKED();
  sys_thread_new("snmp_netconn", snmp_netconn_thread, NULL, SNMP_STACK_SIZE, SNMP_THREAD_PRIO);
 }

--- a/src/apps/snmp/snmp_pbuf_stream.h
+++ b/src/apps/snmp/snmp_pbuf_stream.h
@@ -49,8 +49,7 @@
 extern "C" {
 #endif

-struct snmp_pbuf_stream
-{
+struct snmp_pbuf_stream {
  struct pbuf *pbuf;
  u16_t offset;
  u16_t length;
--- a/src/apps/snmp/snmp_raw.c
+++ b/src/apps/snmp/snmp_raw.c
@@ -39,6 +39,7 @@

 #include "lwip/udp.h"
 #include "lwip/ip.h"
+#include "lwip/prot/iana.h"
 #include "snmp_msg.h"

 /* lwIP UDP receive callback function */
@@ -90,10 +91,12 @@ snmp_init(void)
  struct udp_pcb *snmp_pcb = udp_new_ip_type(IPADDR_TYPE_ANY);
  LWIP_ERROR("snmp_raw: no PCB", (snmp_pcb != NULL), return;);

+  LWIP_ASSERT_CORE_LOCKED();
+
  snmp_traps_handle = snmp_pcb;

-  udp_recv(snmp_pcb, snmp_recv, (void *)SNMP_IN_PORT);
-  err = udp_bind(snmp_pcb, IP_ANY_TYPE, SNMP_IN_PORT);
+  udp_recv(snmp_pcb, snmp_recv, NULL);
+  err = udp_bind(snmp_pcb, IP_ANY_TYPE, LWIP_IANA_PORT_SNMP);
  LWIP_ERROR("snmp_raw: Unable to bind PCB", (err == ERR_OK), return;);
 }

--- a/src/apps/snmp/snmp_scalar.c
+++ b/src/apps/snmp/snmp_scalar.c
@@ -193,28 +193,40 @@ snmp_scalar_array_get_next_instance(const u32_t *root_oid, u8_t root_oid_len, st
 static s16_t
 snmp_scalar_array_get_value(struct snmp_node_instance *instance, void *value)
 {
+  s16_t result = -1;
  const struct snmp_scalar_array_node *array_node = (const struct snmp_scalar_array_node *)(const void *)instance->node;
  const struct snmp_scalar_array_node_def *array_node_def = (const struct snmp_scalar_array_node_def *)instance->reference.const_ptr;

-  return array_node->get_value(array_node_def, value);
+  if (array_node->get_value != NULL) {
+    result = array_node->get_value(array_node_def, value);
+  }
+  return result;
 }

 static snmp_err_t
 snmp_scalar_array_set_test(struct snmp_node_instance *instance, u16_t value_len, void *value)
 {
+  snmp_err_t result = SNMP_ERR_NOTWRITABLE;
  const struct snmp_scalar_array_node *array_node = (const struct snmp_scalar_array_node *)(const void *)instance->node;
  const struct snmp_scalar_array_node_def *array_node_def = (const struct snmp_scalar_array_node_def *)instance->reference.const_ptr;

-  return array_node->set_test(array_node_def, value_len, value);
+  if (array_node->set_test != NULL) {
+    result = array_node->set_test(array_node_def, value_len, value);
+  }
+  return result;
 }

 static snmp_err_t
 snmp_scalar_array_set_value(struct snmp_node_instance *instance, u16_t value_len, void *value)
 {
+  snmp_err_t result = SNMP_ERR_NOTWRITABLE;
  const struct snmp_scalar_array_node *array_node = (const struct snmp_scalar_array_node *)(const void *)instance->node;
  const struct snmp_scalar_array_node_def *array_node_def = (const struct snmp_scalar_array_node_def *)instance->reference.const_ptr;

-  return array_node->set_value(array_node_def, value_len, value);
+  if (array_node->set_value != NULL) {
+    result = array_node->set_value(array_node_def, value_len, value);
+  }
+  return result;
 }

 #endif /* LWIP_SNMP */
--- a/src/apps/snmp/snmp_snmpv2_framework.c
+++ b/src/apps/snmp/snmp_snmpv2_framework.c
@@ -0,0 +1,90 @@
+/*
+Generated by LwipMibCompiler
+*/
+
+#include "lwip/apps/snmp_opts.h"
+
+#if LWIP_SNMP && LWIP_SNMP_V3 /* don't build if not configured for use in lwipopts.h */
+
+#include "lwip/apps/snmp_snmpv2_framework.h"
+#include "lwip/apps/snmp.h"
+#include "lwip/apps/snmp_core.h"
+#include "lwip/apps/snmp_scalar.h"
+#include "lwip/apps/snmp_table.h"
+#include "lwip/apps/snmpv3.h"
+#include "snmpv3_priv.h"
+
+#include "lwip/sys.h"
+
+#include <string.h>
+
+const struct snmp_obj_id usmNoAuthProtocol      = { 10, { 1, 3, 6, 1, 6, 3, 10, 1, 1, 1 } };
+const struct snmp_obj_id usmHMACMD5AuthProtocol = { 10, { 1, 3, 6, 1, 6, 3, 10, 1, 1, 2 } };
+const struct snmp_obj_id usmHMACSHAAuthProtocol = { 10, { 1, 3, 6, 1, 6, 3, 10, 1, 1, 3 } };
+/* .4 sha-224
+ * .5 sha-256
+ * .6 sha-384
+ * .7 sha-512
+ */
+
+const struct snmp_obj_id usmNoPrivProtocol  = { 10, { 1, 3, 6, 1, 6, 3, 10, 1, 2, 1 } };
+const struct snmp_obj_id usmDESPrivProtocol = { 10, { 1, 3, 6, 1, 6, 3, 10, 1, 2, 2 } };
+/* .3 3des-ede */
+const struct snmp_obj_id usmAESPrivProtocol = { 10, { 1, 3, 6, 1, 6, 3, 10, 1, 2, 4 } };
+/* .5 unknown
+ * .6 unknown
+ * .7 unknown
+ */
+
+/* TODO: where should this value come from? */
+#define SNMP_FRAMEWORKMIB_SNMPENGINEMAXMESSAGESIZE 1500
+
+/* --- snmpFrameworkMIBObjects 1.3.6.1.6.3.10.2 ----------------------------------------------------- */
+static s16_t snmpengine_scalars_get_value(const struct snmp_scalar_array_node_def *node, void *value)
+{
+  const char *engineid;
+  u8_t engineid_len;
+
+  switch (node->oid) {
+    case 1: /* snmpEngineID */
+      snmpv3_get_engine_id(&engineid, &engineid_len);
+      MEMCPY(value, engineid, engineid_len);
+      return engineid_len;
+    case 2: /* snmpEngineBoots */
+      *(s32_t *)value = snmpv3_get_engine_boots_internal();
+      return sizeof(s32_t);
+    case 3: /* snmpEngineTime */
+      *(s32_t *)value = snmpv3_get_engine_time_internal();
+      return sizeof(s32_t);
+    case 4: /* snmpEngineMaxMessageSize */
+      *(s32_t *)value = SNMP_FRAMEWORKMIB_SNMPENGINEMAXMESSAGESIZE;
+      return sizeof(s32_t);
+    default:
+      LWIP_DEBUGF(SNMP_MIB_DEBUG, ("snmpengine_scalars_get_value(): unknown id: %"S32_F"\n", node->oid));
+      return 0;
+  }
+}
+
+static const struct snmp_scalar_array_node_def snmpengine_scalars_nodes[] = {
+  {1, SNMP_ASN1_TYPE_OCTET_STRING, SNMP_NODE_INSTANCE_READ_ONLY}, /* snmpEngineID */
+  {2, SNMP_ASN1_TYPE_INTEGER,      SNMP_NODE_INSTANCE_READ_ONLY}, /* snmpEngineBoots */
+  {3, SNMP_ASN1_TYPE_INTEGER,      SNMP_NODE_INSTANCE_READ_ONLY}, /* snmpEngineTime */
+  {4, SNMP_ASN1_TYPE_INTEGER,      SNMP_NODE_INSTANCE_READ_ONLY}, /* snmpEngineMaxMessageSize */
+};
+static const struct snmp_scalar_array_node snmpengine_scalars = SNMP_SCALAR_CREATE_ARRAY_NODE(1, snmpengine_scalars_nodes, snmpengine_scalars_get_value, NULL, NULL);
+
+static const struct snmp_node *const snmpframeworkmibobjects_subnodes[] = {
+  &snmpengine_scalars.node.node
+};
+static const struct snmp_tree_node snmpframeworkmibobjects_treenode = SNMP_CREATE_TREE_NODE(2, snmpframeworkmibobjects_subnodes);
+
+/* --- snmpFrameworkMIB  ----------------------------------------------------- */
+static const struct snmp_node *const snmpframeworkmib_subnodes[] = {
+  &snmpframeworkmibobjects_treenode.node
+};
+static const struct snmp_tree_node snmpframeworkmib_root = SNMP_CREATE_TREE_NODE(10, snmpframeworkmib_subnodes);
+static const u32_t snmpframeworkmib_base_oid[] = {1, 3, 6, 1, 6, 3, 10};
+const struct snmp_mib snmpframeworkmib = {snmpframeworkmib_base_oid, LWIP_ARRAYSIZE(snmpframeworkmib_base_oid), &snmpframeworkmib_root.node};
+
+/* --- snmpFrameworkMIB  ----------------------------------------------------- */
+#endif /* LWIP_SNMP */
--- a/src/apps/snmp/snmp_snmpv2_usm.c
+++ b/src/apps/snmp/snmp_snmpv2_usm.c
@@ -0,0 +1,410 @@
+/*
+Generated by LwipMibCompiler
+*/
+
+#include "lwip/apps/snmp_opts.h"
+#if LWIP_SNMP && LWIP_SNMP_V3
+
+#include "lwip/apps/snmp_snmpv2_usm.h"
+#include "lwip/apps/snmp.h"
+#include "lwip/apps/snmp_core.h"
+#include "lwip/apps/snmp_scalar.h"
+#include "lwip/apps/snmp_table.h"
+#include "lwip/apps/snmpv3.h"
+#include "snmpv3_priv.h"
+
+#include "lwip/apps/snmp_snmpv2_framework.h"
+
+#include <string.h>
+
+/* --- usmUser 1.3.6.1.6.3.15.1.2 ----------------------------------------------------- */
+
+static const struct snmp_oid_range usmUserTable_oid_ranges[] = {
+  { 0, 0xff }, { 0, 0xff }, { 0, 0xff }, { 0, 0xff },
+  { 0, 0xff }, { 0, 0xff }, { 0, 0xff }, { 0, 0xff },
+  { 0, 0xff }, { 0, 0xff }, { 0, 0xff }, { 0, 0xff },
+  { 0, 0xff }, { 0, 0xff }, { 0, 0xff }, { 0, 0xff },
+  { 0, 0xff }, { 0, 0xff }, { 0, 0xff }, { 0, 0xff },
+  { 0, 0xff }, { 0, 0xff }, { 0, 0xff }, { 0, 0xff },
+  { 0, 0xff }, { 0, 0xff }, { 0, 0xff }, { 0, 0xff },
+  { 0, 0xff }, { 0, 0xff }, { 0, 0xff }, { 0, 0xff }
+};
+
+static void snmp_engineid_to_oid(const char *engineid, u32_t *oid, u32_t len)
+{
+  u8_t i;
+
+  for (i = 0; i < len; i++) {
+    oid[i] = engineid[i];
+  }
+}
+
+static void snmp_oid_to_name(char *name, const u32_t *oid, size_t len)
+{
+  u8_t i;
+
+  for (i = 0; i < len; i++) {
+    name[i] = (char)oid[i];
+  }
+}
+
+static void snmp_name_to_oid(const char *name, u32_t *oid, size_t len)
+{
+  u8_t i;
+
+  for (i = 0; i < len; i++) {
+    oid[i] = name[i];
+  }
+}
+
+static const struct snmp_obj_id *snmp_auth_algo_to_oid(snmpv3_auth_algo_t algo)
+{
+  if (algo == SNMP_V3_AUTH_ALGO_MD5) {
+    return &usmHMACMD5AuthProtocol;
+  } else if (algo ==  SNMP_V3_AUTH_ALGO_SHA) {
+    return &usmHMACMD5AuthProtocol;
+  }
+
+  return &usmNoAuthProtocol;
+}
+
+static const struct snmp_obj_id *snmp_priv_algo_to_oid(snmpv3_priv_algo_t algo)
+{
+  if (algo == SNMP_V3_PRIV_ALGO_DES) {
+    return &usmDESPrivProtocol;
+  } else if (algo == SNMP_V3_PRIV_ALGO_AES) {
+    return &usmAESPrivProtocol;
+  }
+
+  return &usmNoPrivProtocol;
+}
+
+char username[32];
+
+static snmp_err_t usmusertable_get_instance(const u32_t *column, const u32_t *row_oid, u8_t row_oid_len, struct snmp_node_instance *cell_instance)
+{
+  const char *engineid;
+  u8_t eid_len;
+
+  u32_t engineid_oid[SNMP_V3_MAX_ENGINE_ID_LENGTH];
+
+  u8_t name_len;
+  u8_t engineid_len;
+
+  u8_t name_start;
+  u8_t engineid_start;
+
+  LWIP_UNUSED_ARG(column);
+
+  snmpv3_get_engine_id(&engineid, &eid_len);
+
+  engineid_len = (u8_t)row_oid[0];
+  engineid_start = 1;
+
+  if (engineid_len != eid_len) {
+    /* EngineID length does not match! */
+    return SNMP_ERR_NOSUCHINSTANCE;
+  }
+
+  if (engineid_len > row_oid_len) {
+    /* row OID doesn't contain enough data according to engineid_len.*/
+    return SNMP_ERR_NOSUCHINSTANCE;
+  }
+
+  /* check if incoming OID length and if values are in plausible range */
+  if (!snmp_oid_in_range(&row_oid[engineid_start], engineid_len, usmUserTable_oid_ranges, engineid_len)) {
+    return SNMP_ERR_NOSUCHINSTANCE;
+  }
+
+  snmp_engineid_to_oid(engineid, engineid_oid, engineid_len);
+
+  /* Verify EngineID */
+  if (snmp_oid_equal(&row_oid[engineid_start], engineid_len, engineid_oid, engineid_len)) {
+    return SNMP_ERR_NOSUCHINSTANCE;
+  }
+
+  name_len = (u8_t)row_oid[engineid_start + engineid_len];
+  name_start = engineid_start + engineid_len + 1;
+
+  if (name_len > SNMP_V3_MAX_USER_LENGTH) {
+    /* specified name is too long */
+    return SNMP_ERR_NOSUCHINSTANCE;
+  }
+
+  if (1 + engineid_len + 1 + name_len != row_oid_len) {
+    /* Length of EngineID and name does not match row oid length. (+2 for length fields)*/
+    return SNMP_ERR_NOSUCHINSTANCE;
+  }
+
+  /* check if incoming OID length and if values are in plausible range */
+  if (!snmp_oid_in_range(&row_oid[name_start], name_len, usmUserTable_oid_ranges, name_len)) {
+    return SNMP_ERR_NOSUCHINSTANCE;
+  }
+
+  /* Verify if user exists */
+  memset(username, 0, sizeof(username));
+  snmp_oid_to_name(username, &row_oid[name_start], name_len);
+  if (snmpv3_get_user(username, NULL, NULL, NULL, NULL) != ERR_OK) {
+    return SNMP_ERR_NOSUCHINSTANCE;
+  }
+
+  /* Save name in reference pointer to make it easier to handle later on */
+  cell_instance->reference.ptr = username;
+  cell_instance->reference_len = name_len;
+
+  /* user was found */
+  return SNMP_ERR_NOERROR;
+}
+
+/*
+ * valid oid options
+ * <oid>
+ * <oid>.<EngineID length>
+ * <oid>.<EngineID length>.<partial EngineID>
+ * <oid>.<EngineID length>.<EngineID>
+ * <oid>.<EngineID length>.<EngineID>.<UserName length>
+ * <oid>.<EngineID length>.<EngineID>.<UserName length>.<partial UserName>
+ * <oid>.<EngineID length>.<EngineID>.<UserName length>.<UserName>
+ *
+ */
+static snmp_err_t usmusertable_get_next_instance(const u32_t *column, struct snmp_obj_id *row_oid, struct snmp_node_instance *cell_instance)
+{
+  const char *engineid;
+  u8_t eid_len;
+
+  u32_t engineid_oid[SNMP_V3_MAX_ENGINE_ID_LENGTH];
+
+  u8_t name_len;
+  u8_t engineid_len;
+
+  u8_t name_start;
+  u8_t engineid_start = 1;
+  u8_t i;
+
+  struct snmp_next_oid_state state;
+
+  u32_t result_temp[LWIP_ARRAYSIZE(usmUserTable_oid_ranges)];
+
+  LWIP_UNUSED_ARG(column);
+
+  snmpv3_get_engine_id(&engineid, &eid_len);
+
+  /* If EngineID might be given */
+  if (row_oid->len > 0) {
+    engineid_len = (u8_t)row_oid->id[0];
+    engineid_start = 1;
+
+    if (engineid_len != eid_len) {
+      /* EngineID length does not match! */
+      return SNMP_ERR_NOSUCHINSTANCE;
+    }
+
+    if (engineid_len > row_oid->len) {
+      /* Verify partial EngineID */
+      snmp_engineid_to_oid(engineid, engineid_oid, row_oid->len - 1);
+      if (!snmp_oid_equal(&row_oid->id[engineid_start], row_oid->len - 1, engineid_oid, row_oid->len - 1)) {
+        return SNMP_ERR_NOSUCHINSTANCE;
+      }
+    } else {
+      /* Verify complete EngineID */
+      snmp_engineid_to_oid(engineid, engineid_oid, engineid_len);
+      if (!snmp_oid_equal(&row_oid->id[engineid_start], engineid_len, engineid_oid, engineid_len)) {
+        return SNMP_ERR_NOSUCHINSTANCE;
+      }
+    }
+
+    /* At this point, the given EngineID (partially) matches the local EngineID.*/
+
+    /* If name might also be given */
+    if (row_oid->len > engineid_start + engineid_len) {
+      name_len = (u8_t)row_oid->id[engineid_start + engineid_len];
+      name_start = engineid_start + engineid_len + 1;
+
+      if (name_len > SNMP_V3_MAX_USER_LENGTH) {
+        /* specified name is too long, max length is 32 according to mib file.*/
+        return SNMP_ERR_NOSUCHINSTANCE;
+      }
+
+      if (row_oid->len < engineid_len + name_len + 2) {
+        /* Partial name given according to oid.*/
+        u8_t tmplen = row_oid->len - engineid_len - 2;
+        if (!snmp_oid_in_range(&row_oid->id[name_start], tmplen, usmUserTable_oid_ranges, tmplen)) {
+          return SNMP_ERR_NOSUCHINSTANCE;
+        }
+      } else {
+        /* Full name given according to oid. Also test for too much data.*/
+        u8_t tmplen = row_oid->len - engineid_len - 2;
+        if (!snmp_oid_in_range(&row_oid->id[name_start], name_len, usmUserTable_oid_ranges, tmplen)) {
+          return SNMP_ERR_NOSUCHINSTANCE;
+        }
+      }
+
+      /* At this point the EngineID and (partial) UserName match the local EngineID and UserName.*/
+    }
+  }
+
+  /* init struct to search next oid */
+  snmp_next_oid_init(&state, row_oid->id, row_oid->len, result_temp, LWIP_ARRAYSIZE(usmUserTable_oid_ranges));
+
+  for (i = 0; i < snmpv3_get_amount_of_users(); i++) {
+    u32_t test_oid[LWIP_ARRAYSIZE(usmUserTable_oid_ranges)];
+
+    test_oid[0] = eid_len;
+    snmp_engineid_to_oid(engineid, &test_oid[1], eid_len);
+
+    snmpv3_get_username(username, i);
+
+    test_oid[1 + eid_len] = strlen(username);
+    snmp_name_to_oid(username, &test_oid[2 + eid_len], strlen(username));
+
+    /* check generated OID: is it a candidate for the next one? */
+    snmp_next_oid_check(&state, test_oid, (u8_t)(1 + eid_len + 1 + strlen(username)), LWIP_PTR_NUMERIC_CAST(void *, i));
+  }
+
+  /* did we find a next one? */
+  if (state.status == SNMP_NEXT_OID_STATUS_SUCCESS) {
+    snmp_oid_assign(row_oid, state.next_oid, state.next_oid_len);
+    /* store username for subsequent operations (get/test/set) */
+    memset(username, 0, sizeof(username));
+    snmpv3_get_username(username, LWIP_PTR_NUMERIC_CAST(u8_t, state.reference));
+    cell_instance->reference.ptr = username;
+    cell_instance->reference_len = strlen(username);
+    return SNMP_ERR_NOERROR;
+  }
+
+  /* not found */
+  return SNMP_ERR_NOSUCHINSTANCE;
+}
+
+static s16_t usmusertable_get_value(struct snmp_node_instance *cell_instance, void *value)
+{
+  snmpv3_user_storagetype_t storage_type;
+
+  switch (SNMP_TABLE_GET_COLUMN_FROM_OID(cell_instance->instance_oid.id)) {
+    case 3: /* usmUserSecurityName */
+      MEMCPY(value, cell_instance->reference.ptr, cell_instance->reference_len);
+      return (s16_t)cell_instance->reference_len;
+    case 4: /* usmUserCloneFrom */
+      MEMCPY(value, snmp_zero_dot_zero.id, snmp_zero_dot_zero.len * sizeof(u32_t));
+      return snmp_zero_dot_zero.len * sizeof(u32_t);
+    case 5: { /* usmUserAuthProtocol */
+      const struct snmp_obj_id *auth_algo;
+      snmpv3_auth_algo_t auth_algo_val;
+      snmpv3_get_user((const char *)cell_instance->reference.ptr, &auth_algo_val, NULL, NULL, NULL);
+      auth_algo = snmp_auth_algo_to_oid(auth_algo_val);
+      MEMCPY(value, auth_algo->id, auth_algo->len * sizeof(u32_t));
+      return auth_algo->len * sizeof(u32_t);
+    }
+    case 6: /* usmUserAuthKeyChange */
+      return 0;
+    case 7: /* usmUserOwnAuthKeyChange */
+      return 0;
+    case 8: { /* usmUserPrivProtocol */
+      const struct snmp_obj_id *priv_algo;
+      snmpv3_priv_algo_t priv_algo_val;
+      snmpv3_get_user((const char *)cell_instance->reference.ptr, NULL, NULL, &priv_algo_val, NULL);
+      priv_algo = snmp_priv_algo_to_oid(priv_algo_val);
+      MEMCPY(value, priv_algo->id, priv_algo->len * sizeof(u32_t));
+      return priv_algo->len * sizeof(u32_t);
+    }
+    case 9: /* usmUserPrivKeyChange */
+      return 0;
+    case 10: /* usmUserOwnPrivKeyChange */
+      return 0;
+    case 11: /* usmUserPublic */
+      /* TODO: Implement usmUserPublic */
+      return 0;
+    case 12: /* usmUserStorageType */
+      snmpv3_get_user_storagetype((const char *)cell_instance->reference.ptr, &storage_type);
+      *(s32_t *)value = storage_type;
+      return sizeof(s32_t);
+    case 13: /* usmUserStatus */
+      *(s32_t *)value = 1; /* active */
+      return sizeof(s32_t);
+    default:
+      LWIP_DEBUGF(SNMP_MIB_DEBUG, ("usmusertable_get_value(): unknown id: %"S32_F"\n", SNMP_TABLE_GET_COLUMN_FROM_OID(cell_instance->instance_oid.id)));
+      return 0;
+  }
+}
+
+/* --- usmMIBObjects 1.3.6.1.6.3.15.1 ----------------------------------------------------- */
+static s16_t usmstats_scalars_get_value(const struct snmp_scalar_array_node_def *node, void *value)
+{
+  u32_t *uint_ptr = (u32_t *)value;
+  switch (node->oid) {
+    case 1: /* usmStatsUnsupportedSecLevels */
+      *uint_ptr = snmp_stats.unsupportedseclevels;
+      break;
+    case 2: /* usmStatsNotInTimeWindows */
+      *uint_ptr = snmp_stats.notintimewindows;
+      break;
+    case 3: /* usmStatsUnknownUserNames */
+      *uint_ptr = snmp_stats.unknownusernames;
+      break;
+    case 4: /* usmStatsUnknownEngineIDs */
+      *uint_ptr = snmp_stats.unknownengineids;
+      break;
+    case 5: /* usmStatsWrongDigests */
+      *uint_ptr = snmp_stats.wrongdigests;
+      break;
+    case 6: /* usmStatsDecryptionErrors */
+      *uint_ptr = snmp_stats.decryptionerrors;
+      break;
+    default:
+      LWIP_DEBUGF(SNMP_MIB_DEBUG, ("usmstats_scalars_get_value(): unknown id: %"S32_F"\n", node->oid));
+      return 0;
+  }
+
+  return sizeof(*uint_ptr);
+}
+
+/* --- snmpUsmMIB  ----------------------------------------------------- */
+
+/* --- usmUser 1.3.6.1.6.3.15.1.2 ----------------------------------------------------- */
+
+static const struct snmp_table_col_def usmusertable_columns[] = {
+  {3,  SNMP_ASN1_TYPE_OCTET_STRING, SNMP_NODE_INSTANCE_READ_ONLY}, /* usmUserSecurityName */
+  {4,  SNMP_ASN1_TYPE_OBJECT_ID,    SNMP_NODE_INSTANCE_READ_ONLY}, /* usmUserCloneFrom */
+  {5,  SNMP_ASN1_TYPE_OBJECT_ID,    SNMP_NODE_INSTANCE_READ_ONLY}, /* usmUserAuthProtocol */
+  {6,  SNMP_ASN1_TYPE_OCTET_STRING, SNMP_NODE_INSTANCE_READ_ONLY}, /* usmUserAuthKeyChange */
+  {7,  SNMP_ASN1_TYPE_OCTET_STRING, SNMP_NODE_INSTANCE_READ_ONLY}, /* usmUserOwnAuthKeyChange */
+  {8,  SNMP_ASN1_TYPE_OBJECT_ID,    SNMP_NODE_INSTANCE_READ_ONLY}, /* usmUserPrivProtocol */
+  {9,  SNMP_ASN1_TYPE_OCTET_STRING, SNMP_NODE_INSTANCE_READ_ONLY}, /* usmUserPrivKeyChange */
+  {10, SNMP_ASN1_TYPE_OCTET_STRING, SNMP_NODE_INSTANCE_READ_ONLY}, /* usmUserOwnPrivKeyChange */
+  {11, SNMP_ASN1_TYPE_OCTET_STRING, SNMP_NODE_INSTANCE_READ_ONLY}, /* usmUserPublic */
+  {12, SNMP_ASN1_TYPE_INTEGER,      SNMP_NODE_INSTANCE_READ_ONLY}, /* usmUserStorageType */
+  {13, SNMP_ASN1_TYPE_INTEGER,      SNMP_NODE_INSTANCE_READ_ONLY}, /* usmUserStatus */
+};
+static const struct snmp_table_node usmusertable = SNMP_TABLE_CREATE(2, usmusertable_columns, usmusertable_get_instance, usmusertable_get_next_instance, usmusertable_get_value, NULL, NULL);
+
+static const struct snmp_node *const usmuser_subnodes[] = {
+  &usmusertable.node.node
+};
+static const struct snmp_tree_node usmuser_treenode = SNMP_CREATE_TREE_NODE(2, usmuser_subnodes);
+
+/* --- usmMIBObjects 1.3.6.1.6.3.15.1 ----------------------------------------------------- */
+static const struct snmp_scalar_array_node_def usmstats_scalars_nodes[] = {
+  {1, SNMP_ASN1_TYPE_COUNTER, SNMP_NODE_INSTANCE_READ_ONLY}, /* usmStatsUnsupportedSecLevels */
+  {2, SNMP_ASN1_TYPE_COUNTER, SNMP_NODE_INSTANCE_READ_ONLY}, /* usmStatsNotInTimeWindows */
+  {3, SNMP_ASN1_TYPE_COUNTER, SNMP_NODE_INSTANCE_READ_ONLY}, /* usmStatsUnknownUserNames */
+  {4, SNMP_ASN1_TYPE_COUNTER, SNMP_NODE_INSTANCE_READ_ONLY}, /* usmStatsUnknownEngineIDs */
+  {5, SNMP_ASN1_TYPE_COUNTER, SNMP_NODE_INSTANCE_READ_ONLY}, /* usmStatsWrongDigests */
+  {6, SNMP_ASN1_TYPE_COUNTER, SNMP_NODE_INSTANCE_READ_ONLY}, /* usmStatsDecryptionErrors */
+};
+static const struct snmp_scalar_array_node usmstats_scalars = SNMP_SCALAR_CREATE_ARRAY_NODE(1, usmstats_scalars_nodes, usmstats_scalars_get_value, NULL, NULL);
+
+static const struct snmp_node *const usmmibobjects_subnodes[] = {
+  &usmstats_scalars.node.node,
+  &usmuser_treenode.node
+};
+static const struct snmp_tree_node usmmibobjects_treenode = SNMP_CREATE_TREE_NODE(1, usmmibobjects_subnodes);
+
+/* --- snmpUsmMIB  ----------------------------------------------------- */
+static const struct snmp_node *const snmpusmmib_subnodes[] = {
+  &usmmibobjects_treenode.node
+};
+static const struct snmp_tree_node snmpusmmib_root = SNMP_CREATE_TREE_NODE(15, snmpusmmib_subnodes);
+static const u32_t snmpusmmib_base_oid[] = {1, 3, 6, 1, 6, 3, 15};
+const struct snmp_mib snmpusmmib = {snmpusmmib_base_oid, LWIP_ARRAYSIZE(snmpusmmib_base_oid), &snmpusmmib_root.node};
+
+#endif /* LWIP_SNMP */
--- a/src/apps/snmp/snmp_table.c
+++ b/src/apps/snmp/snmp_table.c
@@ -283,8 +283,7 @@ snmp_err_t snmp_table_simple_get_next_instance(const u32_t *root_oid, u8_t root_

    row_oid.len = 0; /* reset row_oid because we switch to next column and start with the first entry there */
    column = next_col_def->index + 1;
-  }
-  while (1);
+  } while (1);

  instance->asn1_type = col_def->asn1_type;
  instance->access    = SNMP_NODE_INSTANCE_READ_ONLY;
--- a/src/apps/snmp/snmp_threadsync.c
+++ b/src/apps/snmp/snmp_threadsync.c
@@ -55,7 +55,11 @@ threadsync_get_value_synced(void *ctx)
 {
  struct threadsync_data *call_data = (struct threadsync_data *)ctx;

+  if (call_data->proxy_instance.get_value != NULL) {
    call_data->retval.s16 = call_data->proxy_instance.get_value(&call_data->proxy_instance, call_data->arg1.value);
+  } else {
+    call_data->retval.s16 = -1;
+  }

  sys_sem_signal(&call_data->threadsync_node->instance->sem);
 }
@@ -76,7 +80,11 @@ threadsync_set_test_synced(void *ctx)
 {
  struct threadsync_data *call_data = (struct threadsync_data *)ctx;

+  if (call_data->proxy_instance.set_test != NULL) {
    call_data->retval.err = call_data->proxy_instance.set_test(&call_data->proxy_instance, call_data->arg2.len, call_data->arg1.value);
+  } else {
+    call_data->retval.err = SNMP_ERR_NOTWRITABLE;
+  }

  sys_sem_signal(&call_data->threadsync_node->instance->sem);
 }
@@ -98,7 +106,11 @@ threadsync_set_value_synced(void *ctx)
 {
  struct threadsync_data *call_data = (struct threadsync_data *)ctx;

+  if (call_data->proxy_instance.set_value != NULL) {
    call_data->retval.err = call_data->proxy_instance.set_value(&call_data->proxy_instance, call_data->arg2.len, call_data->arg1.value);
+  } else {
+    call_data->retval.err = SNMP_ERR_NOTWRITABLE;
+  }

  sys_sem_signal(&call_data->threadsync_node->instance->sem);
 }
@@ -211,6 +223,7 @@ void snmp_threadsync_init(struct snmp_threadsync_instance *instance, snmp_thread
  err_t err = sys_mutex_new(&instance->sem_usage_mutex);
  LWIP_ASSERT("Failed to set up mutex", err == ERR_OK);
  err = sys_sem_new(&instance->sem, 0);
+  LWIP_UNUSED_ARG(err); /* in case of LWIP_NOASSERT */
  LWIP_ASSERT("Failed to set up semaphore", err == ERR_OK);
  instance->sync_fn = sync_fn;
 }
--- a/src/apps/snmp/snmp_traps.c
+++ b/src/apps/snmp/snmp_traps.c
@@ -46,12 +46,12 @@
 #include "lwip/sys.h"
 #include "lwip/apps/snmp.h"
 #include "lwip/apps/snmp_core.h"
+#include "lwip/prot/iana.h"
 #include "snmp_msg.h"
 #include "snmp_asn1.h"
 #include "snmp_core_priv.h"

-struct snmp_msg_trap
-{
+struct snmp_msg_trap {
  /* source enterprise ID (sysObjectID) */
  const struct snmp_obj_id *enterprise;
  /* source IP address, raw network order format */
@@ -78,16 +78,21 @@ struct snmp_msg_trap

 static u16_t snmp_trap_varbind_sum(struct snmp_msg_trap *trap, struct snmp_varbind *varbinds);
 static u16_t snmp_trap_header_sum(struct snmp_msg_trap *trap, u16_t vb_len);
-static void snmp_trap_header_enc(struct snmp_msg_trap *trap, struct snmp_pbuf_stream *pbuf_stream);
-static void snmp_trap_varbind_enc(struct snmp_msg_trap *trap, struct snmp_pbuf_stream *pbuf_stream, struct snmp_varbind *varbinds);
+static err_t snmp_trap_header_enc(struct snmp_msg_trap *trap, struct snmp_pbuf_stream *pbuf_stream);
+static err_t snmp_trap_varbind_enc(struct snmp_msg_trap *trap, struct snmp_pbuf_stream *pbuf_stream, struct snmp_varbind *varbinds);
+
+#define BUILD_EXEC(code) \
+  if ((code) != ERR_OK) { \
+    LWIP_DEBUGF(SNMP_DEBUG, ("SNMP error during creation of outbound trap frame!")); \
+    return ERR_ARG; \
+  }

 /** Agent community string for sending traps */
 extern const char *snmp_community_trap;

 void *snmp_traps_handle;

-struct snmp_trap_dst
-{
+struct snmp_trap_dst {
  /* destination IP address in network order */
  ip_addr_t dip;
  /* set to 0 when disabled, >0 when enabled */
@@ -106,6 +111,7 @@ static u8_t snmp_auth_traps_enabled = 0;
 void
 snmp_trap_dst_enable(u8_t dst_idx, u8_t enable)
 {
+  LWIP_ASSERT_CORE_LOCKED();
  if (dst_idx < SNMP_TRAP_DESTINATIONS) {
    trap_dst[dst_idx].enable = enable;
  }
@@ -120,6 +126,7 @@ snmp_trap_dst_enable(u8_t dst_idx, u8_t enable)
 void
 snmp_trap_dst_ip_set(u8_t dst_idx, const ip_addr_t *dst)
 {
+  LWIP_ASSERT_CORE_LOCKED();
  if (dst_idx < SNMP_TRAP_DESTINATIONS) {
    ip_addr_set(&trap_dst[dst_idx].dip, dst);
  }
@@ -171,6 +178,8 @@ snmp_send_trap(const struct snmp_obj_id* eoid, s32_t generic_trap, s32_t specifi
  u16_t i, tot_len;
  err_t err = ERR_OK;

+  LWIP_ASSERT_CORE_LOCKED();
+
  trap_msg.snmp_version = 0;

  for (i = 0, td = &trap_dst[0]; i < SNMP_TRAP_DESTINATIONS; i++, td++) {
@@ -202,7 +211,7 @@ snmp_send_trap(const struct snmp_obj_id* eoid, s32_t generic_trap, s32_t specifi
          struct snmp_pbuf_stream pbuf_stream;
          snmp_pbuf_stream_init(&pbuf_stream, p, 0, tot_len);

-          /* pass 1, encode packet ino the pbuf(s) */
+          /* pass 1, encode packet into the pbuf(s) */
          snmp_trap_header_enc(&trap_msg, &pbuf_stream);
          snmp_trap_varbind_enc(&trap_msg, &pbuf_stream, varbinds);

@@ -210,7 +219,7 @@ snmp_send_trap(const struct snmp_obj_id* eoid, s32_t generic_trap, s32_t specifi
          snmp_stats.outpkts++;

          /** send to the TRAP destination */
-          snmp_sendto(snmp_traps_handle, p, &td->dip, SNMP_TRAP_PORT);
+          snmp_sendto(snmp_traps_handle, p, &td->dip, LWIP_IANA_PORT_SNMP_TRAP);
          pbuf_free(p);
        } else {
          err = ERR_MEM;
@@ -357,7 +366,7 @@ snmp_trap_header_sum(struct snmp_msg_trap *trap, u16_t vb_len)
  return tot_len;
 }

-static void
+static err_t
 snmp_trap_varbind_enc(struct snmp_msg_trap *trap, struct snmp_pbuf_stream *pbuf_stream, struct snmp_varbind *varbinds)
 {
  struct snmp_asn1_tlv tlv;
@@ -366,80 +375,84 @@ snmp_trap_varbind_enc(struct snmp_msg_trap *trap, struct snmp_pbuf_stream *pbuf_
  varbind = varbinds;

  SNMP_ASN1_SET_TLV_PARAMS(tlv, SNMP_ASN1_TYPE_SEQUENCE, 0, trap->vbseqlen);
-  snmp_ans1_enc_tlv(pbuf_stream, &tlv);
+  BUILD_EXEC( snmp_ans1_enc_tlv(pbuf_stream, &tlv) );

  while (varbind != NULL) {
-    snmp_append_outbound_varbind(pbuf_stream, varbind);
+    BUILD_EXEC( snmp_append_outbound_varbind(pbuf_stream, varbind) );

    varbind = varbind->next;
  }
+
+  return ERR_OK;
 }

 /**
 * Encodes trap header from head to tail.
 */
-static void
+static err_t
 snmp_trap_header_enc(struct snmp_msg_trap *trap, struct snmp_pbuf_stream *pbuf_stream)
 {
  struct snmp_asn1_tlv tlv;

  /* 'Message' sequence */
  SNMP_ASN1_SET_TLV_PARAMS(tlv, SNMP_ASN1_TYPE_SEQUENCE, 0, trap->seqlen);
-  snmp_ans1_enc_tlv(pbuf_stream, &tlv);
+  BUILD_EXEC( snmp_ans1_enc_tlv(pbuf_stream, &tlv) );

  /* version */
  SNMP_ASN1_SET_TLV_PARAMS(tlv, SNMP_ASN1_TYPE_INTEGER, 0, 0);
  snmp_asn1_enc_s32t_cnt(trap->snmp_version, &tlv.value_len);
-  snmp_ans1_enc_tlv(pbuf_stream, &tlv);
-  snmp_asn1_enc_s32t(pbuf_stream, tlv.value_len, trap->snmp_version);
+  BUILD_EXEC( snmp_ans1_enc_tlv(pbuf_stream, &tlv) );
+  BUILD_EXEC( snmp_asn1_enc_s32t(pbuf_stream, tlv.value_len, trap->snmp_version) );

  /* community */
  SNMP_ASN1_SET_TLV_PARAMS(tlv, SNMP_ASN1_TYPE_OCTET_STRING, 0, trap->comlen);
-  snmp_ans1_enc_tlv(pbuf_stream, &tlv);
-  snmp_asn1_enc_raw(pbuf_stream,  (const u8_t *)snmp_community_trap, trap->comlen);
+  BUILD_EXEC( snmp_ans1_enc_tlv(pbuf_stream, &tlv) );
+  BUILD_EXEC( snmp_asn1_enc_raw(pbuf_stream,  (const u8_t *)snmp_community_trap, trap->comlen) );

  /* 'PDU' sequence */
  SNMP_ASN1_SET_TLV_PARAMS(tlv, (SNMP_ASN1_CLASS_CONTEXT | SNMP_ASN1_CONTENTTYPE_CONSTRUCTED | SNMP_ASN1_CONTEXT_PDU_TRAP), 0, trap->pdulen);
-  snmp_ans1_enc_tlv(pbuf_stream, &tlv);
+  BUILD_EXEC( snmp_ans1_enc_tlv(pbuf_stream, &tlv) );

  /* object ID */
  SNMP_ASN1_SET_TLV_PARAMS(tlv, SNMP_ASN1_TYPE_OBJECT_ID, 0, 0);
  snmp_asn1_enc_oid_cnt(trap->enterprise->id, trap->enterprise->len, &tlv.value_len);
-  snmp_ans1_enc_tlv(pbuf_stream, &tlv);
-  snmp_asn1_enc_oid(pbuf_stream, trap->enterprise->id, trap->enterprise->len);
+  BUILD_EXEC( snmp_ans1_enc_tlv(pbuf_stream, &tlv) );
+  BUILD_EXEC( snmp_asn1_enc_oid(pbuf_stream, trap->enterprise->id, trap->enterprise->len) );

  /* IP addr */
  if (IP_IS_V6_VAL(trap->sip)) {
 #if LWIP_IPV6
    SNMP_ASN1_SET_TLV_PARAMS(tlv, SNMP_ASN1_TYPE_IPADDR, 0, sizeof(ip_2_ip6(&trap->sip)->addr));
-    snmp_ans1_enc_tlv(pbuf_stream, &tlv);
-    snmp_asn1_enc_raw(pbuf_stream, (const u8_t *)&ip_2_ip6(&trap->sip)->addr, sizeof(ip_2_ip6(&trap->sip)->addr));
+    BUILD_EXEC( snmp_ans1_enc_tlv(pbuf_stream, &tlv) );
+    BUILD_EXEC( snmp_asn1_enc_raw(pbuf_stream, (const u8_t *)&ip_2_ip6(&trap->sip)->addr, sizeof(ip_2_ip6(&trap->sip)->addr)) );
 #endif
  } else {
 #if LWIP_IPV4
    SNMP_ASN1_SET_TLV_PARAMS(tlv, SNMP_ASN1_TYPE_IPADDR, 0, sizeof(ip_2_ip4(&trap->sip)->addr));
-    snmp_ans1_enc_tlv(pbuf_stream, &tlv);
-    snmp_asn1_enc_raw(pbuf_stream, (const u8_t *)&ip_2_ip4(&trap->sip)->addr, sizeof(ip_2_ip4(&trap->sip)->addr));
+    BUILD_EXEC( snmp_ans1_enc_tlv(pbuf_stream, &tlv) );
+    BUILD_EXEC( snmp_asn1_enc_raw(pbuf_stream, (const u8_t *)&ip_2_ip4(&trap->sip)->addr, sizeof(ip_2_ip4(&trap->sip)->addr)) );
 #endif
  }

  /* trap length */
  SNMP_ASN1_SET_TLV_PARAMS(tlv, SNMP_ASN1_TYPE_INTEGER, 0, 0);
  snmp_asn1_enc_s32t_cnt(trap->gen_trap, &tlv.value_len);
-  snmp_ans1_enc_tlv(pbuf_stream, &tlv);
-  snmp_asn1_enc_s32t(pbuf_stream, tlv.value_len, trap->gen_trap);
+  BUILD_EXEC( snmp_ans1_enc_tlv(pbuf_stream, &tlv) );
+  BUILD_EXEC( snmp_asn1_enc_s32t(pbuf_stream, tlv.value_len, trap->gen_trap) );

  /* specific trap */
  SNMP_ASN1_SET_TLV_PARAMS(tlv, SNMP_ASN1_TYPE_INTEGER, 0, 0);
  snmp_asn1_enc_s32t_cnt(trap->spc_trap, &tlv.value_len);
-  snmp_ans1_enc_tlv(pbuf_stream, &tlv);
-  snmp_asn1_enc_s32t(pbuf_stream, tlv.value_len, trap->spc_trap);
+  BUILD_EXEC( snmp_ans1_enc_tlv(pbuf_stream, &tlv) );
+  BUILD_EXEC( snmp_asn1_enc_s32t(pbuf_stream, tlv.value_len, trap->spc_trap) );

  /* timestamp */
  SNMP_ASN1_SET_TLV_PARAMS(tlv, SNMP_ASN1_TYPE_TIMETICKS, 0, 0);
  snmp_asn1_enc_s32t_cnt(trap->ts, &tlv.value_len);
-  snmp_ans1_enc_tlv(pbuf_stream, &tlv);
-  snmp_asn1_enc_s32t(pbuf_stream, tlv.value_len, trap->ts);
+  BUILD_EXEC( snmp_ans1_enc_tlv(pbuf_stream, &tlv) );
+  BUILD_EXEC( snmp_asn1_enc_s32t(pbuf_stream, tlv.value_len, trap->ts) );
+
+  return ERR_OK;
 }

 #endif /* LWIP_SNMP */
--- a/src/apps/snmp/snmpv3.c
+++ b/src/apps/snmp/snmpv3.c
@@ -58,7 +58,7 @@ snmpv3_engine_id_changed(void)
 * (re-)initialized itself since snmpEngineID
 * was last configured.
 */
-u32_t
+s32_t
 snmpv3_get_engine_boots_internal(void)
 {
  if (snmpv3_get_engine_boots() == 0 ||
@@ -75,7 +75,7 @@ snmpv3_get_engine_boots_internal(void)
 * Once the timer reaches 2147483647 it gets reset to zero and the
 * engine boot ups get incremented.
 */
-u32_t
+s32_t
 snmpv3_get_engine_time_internal(void)
 {
  if (snmpv3_get_engine_time() >= SNMP_MAX_TIME_BOOT) {
@@ -124,7 +124,7 @@ snmpv3_build_priv_param(u8_t* priv_param)
  }
 #else /* Based on RFC3414 */
  static u32_t ctr;
-  u32_t boots = LWIP_SNMPV3_GET_ENGINE_BOOTS();
+  u32_t boots = snmpv3_get_engine_boots_internal();
  SMEMCPY(&priv_param[0], &boots, 4);
  SMEMCPY(&priv_param[4], &ctr, 4);
  ctr++;
--- a/src/apps/snmp/snmpv3_dummy.c
+++ b/src/apps/snmp/snmpv3_dummy.c
@@ -1,145 +0,0 @@
-/**
- * @file
- * Dummy SNMPv3 functions.
- */
-
-/*
- * Copyright (c) 2016 Elias Oenal.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without modification,
- * are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright notice,
- *    this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright notice,
- *    this list of conditions and the following disclaimer in the documentation
- *    and/or other materials provided with the distribution.
- * 3. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
- * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
- * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
- * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
- * OF SUCH DAMAGE.
- *
- * Author: Elias Oenal <lwip@eliasoenal.com>
- *         Dirk Ziegelmeier <dirk@ziegelmeier.net>
- */
-
-#include "lwip/apps/snmpv3.h"
-#include "snmpv3_priv.h"
-#include <string.h>
-#include "lwip/err.h"
-
-#if LWIP_SNMP && LWIP_SNMP_V3
-
-/**
- *  @param username is a pointer to a string.
- * @param auth_algo is a pointer to u8_t. The implementation has to set this if user was found.
- * @param auth_key is a pointer to a pointer to a string. Implementation has to set this if user was found.
- * @param priv_algo is a pointer to u8_t. The implementation has to set this if user was found.
- * @param priv_key is a pointer to a pointer to a string. Implementation has to set this if user was found.
- */
-err_t
-snmpv3_get_user(const char* username, u8_t *auth_algo, u8_t *auth_key, u8_t *priv_algo, u8_t *priv_key)
-{
-  const char* engine_id;
-  u8_t engine_id_len;
-  
-  if(strlen(username) == 0) {
-    return ERR_OK;
-  }
-  
-  if(memcmp(username, "lwip", 4) != 0) {
-    return ERR_VAL;
-  }
-  
-  snmpv3_get_engine_id(&engine_id, &engine_id_len);
-  
-  if(auth_key != NULL) {
-    snmpv3_password_to_key_sha((const u8_t*)"maplesyrup", 10,
-      (const u8_t*)engine_id, engine_id_len,
-      auth_key);
-    *auth_algo = SNMP_V3_AUTH_ALGO_SHA;
-  }
-  if(priv_key != NULL) {
-    snmpv3_password_to_key_sha((const u8_t*)"maplesyrup", 10,
-      (const u8_t*)engine_id, engine_id_len,
-      priv_key);
-    *priv_algo = SNMP_V3_PRIV_ALGO_DES;
-  }
-  return ERR_OK;
-}
-
-/**
- * Get engine ID from persistence
- * @param id
- * @param len
- */
-void
-snmpv3_get_engine_id(const char **id, u8_t *len)
-{
-  *id = "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02";
-  *len = 12;
-}
-
-/**
- * Store engine ID in persistence
- * @param id
- * @param len
- */
-err_t
-snmpv3_set_engine_id(const char *id, u8_t len)
-{
-  LWIP_UNUSED_ARG(id);
-  LWIP_UNUSED_ARG(len);
-  return ERR_OK;
-}
-
-/**
- * Get engine boots from persistence. Must be increased on each boot.
- * @return 
- */
-u32_t
-snmpv3_get_engine_boots(void)
-{
-  return 0;
-}
-
-/**
- * Store engine boots in persistence
- * @param boots
- */
-void 
-snmpv3_set_engine_boots(u32_t boots)
-{
-  LWIP_UNUSED_ARG(boots);
-}
-
-/**
- * RFC3414 2.2.2.
- * Once the timer reaches 2147483647 it gets reset to zero and the
- * engine boot ups get incremented.
- */
-u32_t
-snmpv3_get_engine_time(void)
-{
-  return 0;
-}
-
-/**
- * Reset current engine time to 0
- */
-void
-snmpv3_reset_engine_time(void)
-{
-}
-
-#endif /* LWIP_SNMP && LWIP_SNMP_V3 */
--- a/src/apps/snmp/snmpv3_mbedtls.c
+++ b/src/apps/snmp/snmpv3_mbedtls.c
@@ -50,7 +50,7 @@

 err_t
 snmpv3_auth(struct snmp_pbuf_stream *stream, u16_t length,
-    const u8_t* key, u8_t algo, u8_t* hmac_out)
+            const u8_t *key, snmpv3_auth_algo_t algo, u8_t *hmac_out)
 {
  u32_t i;
  u8_t key_len;
@@ -107,7 +107,7 @@ free_md:
 err_t
 snmpv3_crypt(struct snmp_pbuf_stream *stream, u16_t length,
             const u8_t *key, const u8_t *priv_param, const u32_t engine_boots,
-    const u32_t engine_time, u8_t algo, u8_t mode)
+             const u32_t engine_time, snmpv3_priv_algo_t algo, snmpv3_priv_mode_t mode)
 {
  size_t i;
  mbedtls_cipher_context_t ctx;
@@ -154,21 +154,28 @@ snmpv3_crypt(struct snmp_pbuf_stream* stream, u16_t length,
      out_len = LWIP_ARRAYSIZE(out_bytes) ;

      for (j = 0; j < LWIP_ARRAYSIZE(in_bytes); j++) {
-        snmp_pbuf_stream_read(&read_stream, &in_bytes[j]);
+        if (snmp_pbuf_stream_read(&read_stream, &in_bytes[j]) != ERR_OK) {
+          goto error;
+        }
      }

      if (mbedtls_cipher_update(&ctx, in_bytes, LWIP_ARRAYSIZE(in_bytes), out_bytes, &out_len) != 0) {
        goto error;
      }

-      snmp_pbuf_stream_writebuf(&write_stream, out_bytes, out_len);
+      if (snmp_pbuf_stream_writebuf(&write_stream, out_bytes, (u16_t)out_len) != ERR_OK) {
+        goto error;
+      }
    }

    out_len = LWIP_ARRAYSIZE(out_bytes);
    if (mbedtls_cipher_finish(&ctx, out_bytes, &out_len) != 0) {
      goto error;
    }
-    snmp_pbuf_stream_writebuf(&write_stream, out_bytes, out_len);
+
+    if (snmp_pbuf_stream_writebuf(&write_stream, out_bytes, (u16_t)out_len) != ERR_OK) {
+      goto error;
+    }
  } else if (algo == SNMP_V3_PRIV_ALGO_AES) {
    u8_t iv_local[16];

@@ -202,11 +209,15 @@ snmpv3_crypt(struct snmp_pbuf_stream* stream, u16_t length,
      u8_t out_byte;
      size_t out_len = sizeof(out_byte);

-      snmp_pbuf_stream_read(&read_stream, &in_byte);
+      if (snmp_pbuf_stream_read(&read_stream, &in_byte) != ERR_OK) {
+        goto error;
+      }
      if (mbedtls_cipher_update(&ctx, &in_byte, sizeof(in_byte), &out_byte, &out_len) != 0) {
        goto error;
      }
-      snmp_pbuf_stream_write(&write_stream, out_byte);
+      if (snmp_pbuf_stream_write(&write_stream, out_byte) != ERR_OK) {
+        goto error;
+      }
    }
  } else {
    return ERR_ARG;
@@ -226,7 +237,7 @@ error:
 void
 snmpv3_password_to_key_md5(
  const u8_t *password,    /* IN */
-    u8_t        passwordlen, /* IN */
+  size_t      passwordlen, /* IN */
  const u8_t *engineID,    /* IN  - pointer to snmpEngineID  */
  u8_t        engineLength,/* IN  - length of snmpEngineID */
  u8_t       *key)         /* OUT - pointer to caller 16-octet buffer */
@@ -279,7 +290,7 @@ snmpv3_password_to_key_md5(
 void
 snmpv3_password_to_key_sha(
  const u8_t *password,    /* IN */
-    u8_t        passwordlen, /* IN */
+  size_t      passwordlen, /* IN */
  const u8_t *engineID,    /* IN  - pointer to snmpEngineID  */
  u8_t        engineLength,/* IN  - length of snmpEngineID */
  u8_t       *key)         /* OUT - pointer to caller 20-octet buffer */
--- a/src/apps/snmp/snmpv3_priv.h
+++ b/src/apps/snmp/snmpv3_priv.h
@@ -39,6 +39,7 @@

 #if LWIP_SNMP && LWIP_SNMP_V3

+#include "lwip/apps/snmpv3.h"
 #include "snmp_pbuf_stream.h"

 /* According to RFC 3411 */
@@ -48,18 +49,20 @@
 #define SNMP_V3_MAX_AUTH_PARAM_LENGTH  12
 #define SNMP_V3_MAX_PRIV_PARAM_LENGTH  8

-#define SNMP_V3_AUTH_FLAG      0x01
-#define SNMP_V3_PRIV_FLAG      0x02
-
 #define SNMP_V3_MD5_LEN        16
 #define SNMP_V3_SHA_LEN        20

-u32_t snmpv3_get_engine_boots_internal(void);
-u32_t snmpv3_get_engine_time_internal(void);
-err_t snmpv3_auth(struct snmp_pbuf_stream* stream, u16_t length, const u8_t* key, u8_t algo, u8_t* hmac_out);
+typedef enum {
+  SNMP_V3_PRIV_MODE_DECRYPT = 0,
+  SNMP_V3_PRIV_MODE_ENCRYPT = 1
+} snmpv3_priv_mode_t;
+
+s32_t snmpv3_get_engine_boots_internal(void);
+err_t snmpv3_auth(struct snmp_pbuf_stream *stream, u16_t length, const u8_t *key, snmpv3_auth_algo_t algo, u8_t *hmac_out);
 err_t snmpv3_crypt(struct snmp_pbuf_stream *stream, u16_t length, const u8_t *key,
-    const u8_t* priv_param, const u32_t engine_boots, const u32_t engine_time, u8_t algo, u8_t mode);
+                   const u8_t *priv_param, const u32_t engine_boots, const u32_t engine_time, snmpv3_priv_algo_t algo, snmpv3_priv_mode_t mode);
 err_t snmpv3_build_priv_param(u8_t *priv_param);
+void snmpv3_enginetime_timer(void *arg);

 #endif

--- a/src/apps/sntp/sntp.c
+++ b/src/apps/sntp/sntp.c
@@ -46,7 +46,6 @@
 * http://support.ntp.org/bin/view/Servers/NTPPoolServers
 *
 * @todo:
- * - set/change servers at runtime
 * - complete SNTP_CHECK_RESPONSE checks 3 and 4
 */

@@ -72,21 +71,12 @@
 #define SNTP_SUPPORT_MULTIPLE_SERVERS 0
 #endif /* NTP_MAX_SERVERS > 1 */

-#if (SNTP_UPDATE_DELAY < 15000) && !defined(SNTP_SUPPRESS_DELAY_CHECK)
+#ifndef SNTP_SUPPRESS_DELAY_CHECK
+#if SNTP_UPDATE_DELAY < 15000
 #error "SNTPv4 RFC 4330 enforces a minimum update time of 15 seconds (define SNTP_SUPPRESS_DELAY_CHECK to disable this error)!"
 #endif
-
-/* Configure behaviour depending on microsecond or second precision */
-#ifdef SNTP_SET_SYSTEM_TIME_US
-#define SNTP_CALC_TIME_US           1
-#define SNTP_RECEIVE_TIME_SIZE      2
-#else
-#define SNTP_SET_SYSTEM_TIME_US(sec, us)
-#define SNTP_CALC_TIME_US           0
-#define SNTP_RECEIVE_TIME_SIZE      1
 #endif

-
 /* the various debug levels for this file */
 #define SNTP_DEBUG_TRACE        (SNTP_DEBUG | LWIP_DBG_TRACE)
 #define SNTP_DEBUG_STATE        (SNTP_DEBUG | LWIP_DBG_STATE)
@@ -101,10 +91,10 @@

 #define SNTP_OFFSET_LI_VN_MODE      0
 #define SNTP_LI_MASK                0xC0
-#define SNTP_LI_NO_WARNING          0x00
-#define SNTP_LI_LAST_MINUTE_61_SEC  0x01
-#define SNTP_LI_LAST_MINUTE_59_SEC  0x02
-#define SNTP_LI_ALARM_CONDITION     0x03 /* (clock not synchronized) */
+#define SNTP_LI_NO_WARNING          (0x00 << 6)
+#define SNTP_LI_LAST_MINUTE_61_SEC  (0x01 << 6)
+#define SNTP_LI_LAST_MINUTE_59_SEC  (0x02 << 6)
+#define SNTP_LI_ALARM_CONDITION     (0x03 << 6) /* (clock not synchronized) */

 #define SNTP_VERSION_MASK           0x38
 #define SNTP_VERSION                (4/* NTP Version 4*/<<3)
@@ -121,18 +111,89 @@
 #define SNTP_OFFSET_RECEIVE_TIME    32
 #define SNTP_OFFSET_TRANSMIT_TIME   40

-/* number of seconds between 1900 and 1970 (MSB=1)*/
-#define DIFF_SEC_1900_1970         (2208988800UL)
-/* number of seconds between 1970 and Feb 7, 2036 (6:28:16 UTC) (MSB=0) */
-#define DIFF_SEC_1970_2036         (2085978496UL)
+/* Number of seconds between 1970 and Feb 7, 2036 06:28:16 UTC (epoch 1) */
+#define DIFF_SEC_1970_2036          ((u32_t)2085978496L)
+
+/** Convert NTP timestamp fraction to microseconds.
+ */
+#ifndef SNTP_FRAC_TO_US
+# if LWIP_HAVE_INT64
+#  define SNTP_FRAC_TO_US(f)        ((u32_t)(((u64_t)(f) * 1000000UL) >> 32))
+# else
+#  define SNTP_FRAC_TO_US(f)        ((u32_t)(f) / 4295)
+# endif
+#endif /* !SNTP_FRAC_TO_US */
+
+/* Configure behaviour depending on native, microsecond or second precision.
+ * Treat NTP timestamps as signed two's-complement integers. This way,
+ * timestamps that have the MSB set simply become negative offsets from
+ * the epoch (Feb 7, 2036 06:28:16 UTC). Representable dates range from
+ * 1968 to 2104.
+ */
+#ifndef SNTP_SET_SYSTEM_TIME_NTP
+# ifdef SNTP_SET_SYSTEM_TIME_US
+#  define SNTP_SET_SYSTEM_TIME_NTP(s, f) \
+    SNTP_SET_SYSTEM_TIME_US((u32_t)((s) + DIFF_SEC_1970_2036), SNTP_FRAC_TO_US(f))
+# else
+#  define SNTP_SET_SYSTEM_TIME_NTP(s, f) \
+    SNTP_SET_SYSTEM_TIME((u32_t)((s) + DIFF_SEC_1970_2036))
+# endif
+#endif /* !SNTP_SET_SYSTEM_TIME_NTP */
+
+/* Get the system time either natively as NTP timestamp or convert from
+ * Unix time in seconds and microseconds. Take care to avoid overflow if the
+ * microsecond value is at the maximum of 999999. Also add 0.5 us fudge to
+ * avoid special values like 0, and to mask round-off errors that would
+ * otherwise break round-trip conversion identity.
+ */
+#ifndef SNTP_GET_SYSTEM_TIME_NTP
+# define SNTP_GET_SYSTEM_TIME_NTP(s, f) do { \
+    u32_t sec_, usec_; \
+    SNTP_GET_SYSTEM_TIME(sec_, usec_); \
+    (s) = (s32_t)(sec_ - DIFF_SEC_1970_2036); \
+    (f) = usec_ * 4295 - ((usec_ * 2143) >> 16) + 2147; \
+  } while (0)
+#endif /* !SNTP_GET_SYSTEM_TIME_NTP */
+
+/* Start offset of the timestamps to extract from the SNTP packet */
+#define SNTP_OFFSET_TIMESTAMPS \
+    (SNTP_OFFSET_TRANSMIT_TIME + 8 - sizeof(struct sntp_timestamps))
+
+/* Round-trip delay arithmetic helpers */
+#if SNTP_COMP_ROUNDTRIP
+# if !LWIP_HAVE_INT64
+#  error "SNTP round-trip delay compensation requires 64-bit arithmetic"
+# endif
+# define SNTP_SEC_FRAC_TO_S64(s, f) \
+    ((s64_t)(((u64_t)(s) << 32) | (u32_t)(f)))
+# define SNTP_TIMESTAMP_TO_S64(t) \
+    SNTP_SEC_FRAC_TO_S64(lwip_ntohl((t).sec), lwip_ntohl((t).frac))
+#endif /* SNTP_COMP_ROUNDTRIP */
+
+/**
+ * 64-bit NTP timestamp, in network byte order.
+ */
+struct sntp_time {
+  u32_t sec;
+  u32_t frac;
+};
+
+/**
+ * Timestamps to be extracted from the NTP header.
+ */
+struct sntp_timestamps {
+#if SNTP_COMP_ROUNDTRIP || SNTP_CHECK_RESPONSE >= 2
+  struct sntp_time orig;
+  struct sntp_time recv;
+#endif
+  struct sntp_time xmit;
+};

 /**
 * SNTP packet format (without optional fields)
 * Timestamps are coded as 64 bits:
- * - 32 bits seconds since Jan 01, 1970, 00:00
- * - 32 bits seconds fraction (0-padded)
- * For future use, if the MSB in the seconds part is set, seconds are based
- * on Feb 07, 2036, 06:28:16.
+ * - signed 32 bits seconds since Feb 07, 2036, 06:28:16 UTC (epoch 1)
+ * - unsigned 32 bits seconds fraction (2^32 = 1 second)
 */
 #ifdef PACK_STRUCT_USE_INCLUDES
 #  include "arch/bpstruct.h"
@@ -167,15 +228,19 @@ static struct udp_pcb* sntp_pcb;
 /** Names/Addresses of servers */
 struct sntp_server {
 #if SNTP_SERVER_DNS
-  char* name;
+  const char *name;
 #endif /* SNTP_SERVER_DNS */
  ip_addr_t addr;
+#if SNTP_MONITOR_SERVER_REACHABILITY
+  /** Reachability shift register as described in RFC 5905 */
+  u8_t reachability;
+#endif /* SNTP_MONITOR_SERVER_REACHABILITY */
 };
 static struct sntp_server sntp_servers[SNTP_MAX_SERVERS];

-#if SNTP_GET_SERVERS_FROM_DHCP
+#if SNTP_GET_SERVERS_FROM_DHCP || SNTP_GET_SERVERS_FROM_DHCPV6
 static u8_t sntp_set_servers_from_dhcp;
-#endif /* SNTP_GET_SERVERS_FROM_DHCP */
+#endif /* SNTP_GET_SERVERS_FROM_DHCP || SNTP_GET_SERVERS_FROM_DHCPV6 */
 #if SNTP_SUPPORT_MULTIPLE_SERVERS
 /** The currently used server (initialized to 0) */
 static u8_t sntp_current_server;
@@ -199,38 +264,69 @@ static ip_addr_t sntp_last_server_address;

 #if SNTP_CHECK_RESPONSE >= 2
 /** Saves the last timestamp sent (which is sent back by the server)
- * to compare against in response */
-static u32_t sntp_last_timestamp_sent[2];
+ * to compare against in response. Stored in network byte order. */
+static struct sntp_time sntp_last_timestamp_sent;
 #endif /* SNTP_CHECK_RESPONSE >= 2 */

+#if defined(LWIP_DEBUG) && !defined(sntp_format_time)
+/* Debug print helper. */
+static const char *
+sntp_format_time(s32_t sec)
+{
+  time_t ut;
+  ut = (u32_t)((u32_t)sec + DIFF_SEC_1970_2036);
+  return ctime(&ut);
+}
+#endif /* LWIP_DEBUG && !sntp_format_time */
+
 /**
 * SNTP processing of received timestamp
 */
 static void
-sntp_process(u32_t *receive_timestamp)
+sntp_process(const struct sntp_timestamps *timestamps)
 {
-  /* convert SNTP time (1900-based) to unix GMT time (1970-based)
-   * if MSB is 0, SNTP time is 2036-based!
-   */
-  u32_t rx_secs = lwip_ntohl(receive_timestamp[0]);
-  int is_1900_based = ((rx_secs & 0x80000000) != 0);
-  u32_t t = is_1900_based ? (rx_secs - DIFF_SEC_1900_1970) : (rx_secs + DIFF_SEC_1970_2036);
-  time_t tim = t;
+  s32_t sec;
+  u32_t frac;

-#if SNTP_CALC_TIME_US
-  u32_t us = lwip_ntohl(receive_timestamp[1]) / 4295;
-  SNTP_SET_SYSTEM_TIME_US(t, us);
-  /* display local time from GMT time */
-  LWIP_DEBUGF(SNTP_DEBUG_TRACE, ("sntp_process: %s, %"U32_F" us", ctime(&tim), us));
+  sec  = (s32_t)lwip_ntohl(timestamps->xmit.sec);
+  frac = lwip_ntohl(timestamps->xmit.frac);

-#else /* SNTP_CALC_TIME_US */
+#if SNTP_COMP_ROUNDTRIP
+# if SNTP_CHECK_RESPONSE >= 2
+  if (timestamps->recv.sec != 0 || timestamps->recv.frac != 0)
+# endif
+  {
+    s32_t dest_sec;
+    u32_t dest_frac;
+    u32_t step_sec;

-  /* change system time and/or the update the RTC clock */
-  SNTP_SET_SYSTEM_TIME(t);
-  /* display local time from GMT time */
-  LWIP_DEBUGF(SNTP_DEBUG_TRACE, ("sntp_process: %s", ctime(&tim)));
-#endif /* SNTP_CALC_TIME_US */
-  LWIP_UNUSED_ARG(tim);
+    /* Get the destination time stamp, i.e. the current system time */
+    SNTP_GET_SYSTEM_TIME_NTP(dest_sec, dest_frac);
+
+    step_sec = (dest_sec < sec) ? ((u32_t)sec - (u32_t)dest_sec)
+               : ((u32_t)dest_sec - (u32_t)sec);
+    /* In order to avoid overflows, skip the compensation if the clock step
+     * is larger than about 34 years. */
+    if ((step_sec >> 30) == 0) {
+      s64_t t1, t2, t3, t4;
+
+      t4 = SNTP_SEC_FRAC_TO_S64(dest_sec, dest_frac);
+      t3 = SNTP_SEC_FRAC_TO_S64(sec, frac);
+      t1 = SNTP_TIMESTAMP_TO_S64(timestamps->orig);
+      t2 = SNTP_TIMESTAMP_TO_S64(timestamps->recv);
+      /* Clock offset calculation according to RFC 4330 */
+      t4 += ((t2 - t1) + (t3 - t4)) / 2;
+
+      sec  = (s32_t)((u64_t)t4 >> 32);
+      frac = (u32_t)((u64_t)t4);
+    }
+  }
+#endif /* SNTP_COMP_ROUNDTRIP */
+
+  SNTP_SET_SYSTEM_TIME_NTP(sec, frac);
+  LWIP_UNUSED_ARG(frac); /* might be unused if only seconds are set */
+  LWIP_DEBUGF(SNTP_DEBUG_TRACE, ("sntp_process: %s, %" U32_F " us\n",
+                                 sntp_format_time(sec), SNTP_FRAC_TO_US(frac)));
 }

 /**
@@ -242,18 +338,23 @@ sntp_initialize_request(struct sntp_msg *req)
  memset(req, 0, SNTP_MSG_LEN);
  req->li_vn_mode = SNTP_LI_NO_WARNING | SNTP_VERSION | SNTP_MODE_CLIENT;

-#if SNTP_CHECK_RESPONSE >= 2
+#if SNTP_CHECK_RESPONSE >= 2 || SNTP_COMP_ROUNDTRIP
  {
-    u32_t sntp_time_sec, sntp_time_us;
-    /* fill in transmit timestamp and save it in 'sntp_last_timestamp_sent' */
-    SNTP_GET_SYSTEM_TIME(sntp_time_sec, sntp_time_us);
-    sntp_last_timestamp_sent[0] = lwip_htonl(sntp_time_sec + DIFF_SEC_1900_1970);
-    req->transmit_timestamp[0] = sntp_last_timestamp_sent[0];
-    /* we send/save us instead of fraction to be faster... */
-    sntp_last_timestamp_sent[1] = lwip_htonl(sntp_time_us);
-    req->transmit_timestamp[1] = sntp_last_timestamp_sent[1];
+    s32_t secs;
+    u32_t sec, frac;
+    /* Get the transmit timestamp */
+    SNTP_GET_SYSTEM_TIME_NTP(secs, frac);
+    sec  = lwip_htonl((u32_t)secs);
+    frac = lwip_htonl(frac);
+
+# if SNTP_CHECK_RESPONSE >= 2
+    sntp_last_timestamp_sent.sec  = sec;
+    sntp_last_timestamp_sent.frac = frac;
+# endif
+    req->transmit_timestamp[0] = sec;
+    req->transmit_timestamp[1] = frac;
  }
-#endif /* SNTP_CHECK_RESPONSE >= 2 */
+#endif /* SNTP_CHECK_RESPONSE >= 2 || SNTP_COMP_ROUNDTRIP */
 }

 /**
@@ -270,6 +371,7 @@ sntp_retry(void* arg)
                                 sntp_retry_timeout));

  /* set up a timer to send a retry and increase the retry delay */
+  sys_untimeout(sntp_request, NULL);
  sys_timeout(sntp_retry_timeout, sntp_request, NULL);

 #if SNTP_RETRY_TIMEOUT_EXP
@@ -281,6 +383,8 @@ sntp_retry(void* arg)
    if ((new_retry_timeout <= SNTP_RETRY_TIMEOUT_MAX) &&
        (new_retry_timeout > sntp_retry_timeout)) {
      sntp_retry_timeout = new_retry_timeout;
+    } else {
+      sntp_retry_timeout = SNTP_RETRY_TIMEOUT_MAX;
    }
  }
 #endif /* SNTP_RETRY_TIMEOUT_EXP */
@@ -334,18 +438,14 @@ sntp_try_next_server(void* arg)
 static void
 sntp_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port)
 {
+  struct sntp_timestamps timestamps;
  u8_t mode;
  u8_t stratum;
-  u32_t receive_timestamp[SNTP_RECEIVE_TIME_SIZE];
  err_t err;

  LWIP_UNUSED_ARG(arg);
  LWIP_UNUSED_ARG(pcb);

-  /* packet received: stop retry timeout  */
-  sys_untimeout(sntp_try_next_server, NULL);
-  sys_untimeout(sntp_request, NULL);
-
  err = ERR_ARG;
 #if SNTP_CHECK_RESPONSE >= 1
  /* check server address and port */
@@ -358,32 +458,30 @@ sntp_recv(void *arg, struct udp_pcb* pcb, struct pbuf *p, const ip_addr_t *addr,
  {
    /* process the response */
    if (p->tot_len == SNTP_MSG_LEN) {
-      pbuf_copy_partial(p, &mode, 1, SNTP_OFFSET_LI_VN_MODE);
-      mode &= SNTP_MODE_MASK;
+      mode = pbuf_get_at(p, SNTP_OFFSET_LI_VN_MODE) & SNTP_MODE_MASK;
      /* if this is a SNTP response... */
      if (((sntp_opmode == SNTP_OPMODE_POLL)       && (mode == SNTP_MODE_SERVER)) ||
          ((sntp_opmode == SNTP_OPMODE_LISTENONLY) && (mode == SNTP_MODE_BROADCAST))) {
-        pbuf_copy_partial(p, &stratum, 1, SNTP_OFFSET_STRATUM);
+        stratum = pbuf_get_at(p, SNTP_OFFSET_STRATUM);
+
        if (stratum == SNTP_STRATUM_KOD) {
          /* Kiss-of-death packet. Use another server or increase UPDATE_DELAY. */
          err = SNTP_ERR_KOD;
          LWIP_DEBUGF(SNTP_DEBUG_STATE, ("sntp_recv: Received Kiss-of-Death\n"));
        } else {
+          pbuf_copy_partial(p, &timestamps, sizeof(timestamps), SNTP_OFFSET_TIMESTAMPS);
 #if SNTP_CHECK_RESPONSE >= 2
          /* check originate_timetamp against sntp_last_timestamp_sent */
-          u32_t originate_timestamp[2];
-          pbuf_copy_partial(p, &originate_timestamp, 8, SNTP_OFFSET_ORIGINATE_TIME);
-          if ((originate_timestamp[0] != sntp_last_timestamp_sent[0]) ||
-              (originate_timestamp[1] != sntp_last_timestamp_sent[1]))
-          {
-            LWIP_DEBUGF(SNTP_DEBUG_WARN, ("sntp_recv: Invalid originate timestamp in response\n"));
+          if (timestamps.orig.sec != sntp_last_timestamp_sent.sec ||
+              timestamps.orig.frac != sntp_last_timestamp_sent.frac) {
+            LWIP_DEBUGF(SNTP_DEBUG_WARN,
+                        ("sntp_recv: Invalid originate timestamp in response\n"));
          } else
 #endif /* SNTP_CHECK_RESPONSE >= 2 */
            /* @todo: add code for SNTP_CHECK_RESPONSE >= 3 and >= 4 here */
          {
            /* correct answer */
            err = ERR_OK;
-            pbuf_copy_partial(p, &receive_timestamp, SNTP_RECEIVE_TIME_SIZE * 4, SNTP_OFFSET_TRANSMIT_TIME);
          }
        }
      } else {
@@ -401,30 +499,39 @@ sntp_recv(void *arg, struct udp_pcb* pcb, struct pbuf *p, const ip_addr_t *addr,
    err = ERR_TIMEOUT;
  }
 #endif /* SNTP_CHECK_RESPONSE >= 1 */
-  pbuf_free(p);
-  if (err == ERR_OK) {
-    sntp_process(receive_timestamp);

+  pbuf_free(p);
+
+  if (err == ERR_OK) {
+    /* correct packet received: process it it */
+    sntp_process(&timestamps);
+
+#if SNTP_MONITOR_SERVER_REACHABILITY
+    /* indicate that server responded */
+    sntp_servers[sntp_current_server].reachability |= 1;
+#endif /* SNTP_MONITOR_SERVER_REACHABILITY */
    /* Set up timeout for next request (only if poll response was received)*/
    if (sntp_opmode == SNTP_OPMODE_POLL) {
+      u32_t sntp_update_delay;
+      sys_untimeout(sntp_try_next_server, NULL);
+      sys_untimeout(sntp_request, NULL);
+
      /* Correct response, reset retry timeout */
      SNTP_RESET_RETRY_TIMEOUT();

-      sys_timeout((u32_t)SNTP_UPDATE_DELAY, sntp_request, NULL);
+      sntp_update_delay = (u32_t)SNTP_UPDATE_DELAY;
+      sys_timeout(sntp_update_delay, sntp_request, NULL);
      LWIP_DEBUGF(SNTP_DEBUG_STATE, ("sntp_recv: Scheduled next time request: %"U32_F" ms\n",
-        (u32_t)SNTP_UPDATE_DELAY));
+                                     sntp_update_delay));
    }
-  } else if (err != ERR_TIMEOUT) {
-    /* Errors are only processed in case of an explicit poll response */
+  } else if (err == SNTP_ERR_KOD) {
+    /* KOD errors are only processed in case of an explicit poll response */
    if (sntp_opmode == SNTP_OPMODE_POLL) {
-      if (err == SNTP_ERR_KOD) {
      /* Kiss-of-death packet. Use another server or increase UPDATE_DELAY. */
      sntp_try_next_server(NULL);
+    }
  } else {
-        /* another error, try the same server again */
-        sntp_retry(NULL);
-      }
-    }
+    /* ignore any broken packet, poll mode: retry after timeout to avoid flooding */
  }
 }

@@ -436,6 +543,9 @@ static void
 sntp_send_request(const ip_addr_t *server_addr)
 {
  struct pbuf *p;
+
+  LWIP_ASSERT("server_addr != NULL", server_addr != NULL);
+
  p = pbuf_alloc(PBUF_TRANSPORT, SNTP_MSG_LEN, PBUF_RAM);
  if (p != NULL) {
    struct sntp_msg *sntpmsg = (struct sntp_msg *)p->payload;
@@ -446,16 +556,22 @@ sntp_send_request(const ip_addr_t *server_addr)
    udp_sendto(sntp_pcb, p, server_addr, SNTP_PORT);
    /* free the pbuf after sending it */
    pbuf_free(p);
+#if SNTP_MONITOR_SERVER_REACHABILITY
+    /* indicate new packet has been sent */
+    sntp_servers[sntp_current_server].reachability <<= 1;
+#endif /* SNTP_MONITOR_SERVER_REACHABILITY */
    /* set up receive timeout: try next server or retry on timeout */
+    sys_untimeout(sntp_try_next_server, NULL);
    sys_timeout((u32_t)SNTP_RECV_TIMEOUT, sntp_try_next_server, NULL);
 #if SNTP_CHECK_RESPONSE >= 1
    /* save server address to verify it in sntp_recv */
-    ip_addr_set(&sntp_last_server_address, server_addr);
+    ip_addr_copy(sntp_last_server_address, *server_addr);
 #endif /* SNTP_CHECK_RESPONSE >= 1 */
  } else {
    LWIP_DEBUGF(SNTP_DEBUG_SERIOUS, ("sntp_send_request: Out of memory, trying again in %"U32_F" ms\n",
                                     (u32_t)SNTP_RETRY_TIMEOUT));
    /* out of memory: set up a timer to send a retry */
+    sys_untimeout(sntp_request, NULL);
    sys_timeout((u32_t)SNTP_RETRY_TIMEOUT, sntp_request, NULL);
  }
 }
@@ -473,6 +589,7 @@ sntp_dns_found(const char* hostname, const ip_addr_t *ipaddr, void *arg)
  if (ipaddr != NULL) {
    /* Address resolved, send request */
    LWIP_DEBUGF(SNTP_DEBUG_STATE, ("sntp_dns_found: Server address resolved, sending request\n"));
+    sntp_servers[sntp_current_server].addr = *ipaddr;
    sntp_send_request(ipaddr);
  } else {
    /* DNS resolving failed -> try another server */
@@ -523,6 +640,7 @@ sntp_request(void *arg)
  } else {
    /* address conversion failed, try another server */
    LWIP_DEBUGF(SNTP_DEBUG_WARN_STATE, ("sntp_request: Invalid server address, trying next server.\n"));
+    sys_untimeout(sntp_try_next_server, NULL);
    sys_timeout((u32_t)SNTP_RETRY_TIMEOUT, sntp_try_next_server, NULL);
  }
 }
@@ -535,6 +653,9 @@ sntp_request(void *arg)
 void
 sntp_init(void)
 {
+  /* LWIP_ASSERT_CORE_LOCKED(); is checked by udp_new() */
+  LWIP_DEBUGF(SNTP_DEBUG_TRACE, ("sntp_init: SNTP initialised\n"));
+
 #ifdef SNTP_SERVER_ADDRESS
 #if SNTP_SERVER_DNS
  sntp_setservername(0, SNTP_SERVER_ADDRESS);
@@ -571,8 +692,16 @@ sntp_init(void)
 void
 sntp_stop(void)
 {
+  LWIP_ASSERT_CORE_LOCKED();
  if (sntp_pcb != NULL) {
+#if SNTP_MONITOR_SERVER_REACHABILITY
+    u8_t i;
+    for (i = 0; i < SNTP_MAX_SERVERS; i++) {
+      sntp_servers[i].reachability = 0;
+    }
+#endif /* SNTP_MONITOR_SERVER_REACHABILITY */
    sys_untimeout(sntp_request, NULL);
+    sys_untimeout(sntp_try_next_server, NULL);
    udp_remove(sntp_pcb);
    sntp_pcb = NULL;
  }
@@ -595,6 +724,7 @@ u8_t sntp_enabled(void)
 void
 sntp_setoperatingmode(u8_t operating_mode)
 {
+  LWIP_ASSERT_CORE_LOCKED();
  LWIP_ASSERT("Invalid operating mode", operating_mode <= SNTP_OPMODE_LISTENONLY);
  LWIP_ASSERT("Operating mode must not be set while SNTP client is running", sntp_pcb == NULL);
  sntp_opmode = operating_mode;
@@ -610,7 +740,24 @@ sntp_getoperatingmode(void)
  return sntp_opmode;
 }

-#if SNTP_GET_SERVERS_FROM_DHCP
+#if SNTP_MONITOR_SERVER_REACHABILITY
+/**
+ * @ingroup sntp
+ * Gets the server reachability shift register as described in RFC 5905.
+ *
+ * @param idx the index of the NTP server
+ */
+u8_t
+sntp_getreachability(u8_t idx)
+{
+  if (idx < SNTP_MAX_SERVERS) {
+    return sntp_servers[idx].reachability;
+  }
+  return 0;
+}
+#endif /* SNTP_MONITOR_SERVER_REACHABILITY */
+
+#if SNTP_GET_SERVERS_FROM_DHCP || SNTP_GET_SERVERS_FROM_DHCPV6
 /**
 * Config SNTP server handling by IP address, name, or DHCP; clear table
 * @param set_servers_from_dhcp enable or disable getting server addresses from dhcp
@@ -619,11 +766,12 @@ void
 sntp_servermode_dhcp(int set_servers_from_dhcp)
 {
  u8_t new_mode = set_servers_from_dhcp ? 1 : 0;
+  LWIP_ASSERT_CORE_LOCKED();
  if (sntp_set_servers_from_dhcp != new_mode) {
    sntp_set_servers_from_dhcp = new_mode;
  }
 }
-#endif /* SNTP_GET_SERVERS_FROM_DHCP */
+#endif /* SNTP_GET_SERVERS_FROM_DHCP || SNTP_GET_SERVERS_FROM_DHCPV6 */

 /**
 * @ingroup sntp
@@ -635,6 +783,7 @@ sntp_servermode_dhcp(int set_servers_from_dhcp)
 void
 sntp_setserver(u8_t idx, const ip_addr_t *server)
 {
+  LWIP_ASSERT_CORE_LOCKED();
  if (idx < SNTP_MAX_SERVERS) {
    if (server != NULL) {
      sntp_servers[idx].addr = (*server);
@@ -651,8 +800,8 @@ sntp_setserver(u8_t idx, const ip_addr_t *server)
 /**
 * Initialize one of the NTP servers by IP address, required by DHCP
 *
- * @param numdns the index of the NTP server to set must be < SNTP_MAX_SERVERS
- * @param dnsserver IP address of the NTP server to set
+ * @param num the index of the NTP server to set must be < SNTP_MAX_SERVERS
+ * @param server IP address of the NTP server to set
 */
 void
 dhcp_set_ntp_servers(u8_t num, const ip4_addr_t *server)
@@ -674,6 +823,33 @@ dhcp_set_ntp_servers(u8_t num, const ip4_addr_t *server)
 }
 #endif /* LWIP_DHCP && SNTP_GET_SERVERS_FROM_DHCP */

+#if LWIP_IPV6_DHCP6 && SNTP_GET_SERVERS_FROM_DHCPV6
+/**
+ * Initialize one of the NTP servers by IP address, required by DHCPV6
+ *
+ * @param num the number of NTP server addresses to set must be < SNTP_MAX_SERVERS
+ * @param server array of IP address of the NTP servers to set
+ */
+void
+dhcp6_set_ntp_servers(u8_t num_ntp_servers, ip_addr_t* ntp_server_addrs)
+{
+  LWIP_DEBUGF(SNTP_DEBUG_TRACE, ("sntp: %s %u NTP server(s) via DHCPv6\n",
+                                 (sntp_set_servers_from_dhcp ? "Got" : "Rejected"),
+                                 num_ntp_servers));
+  if (sntp_set_servers_from_dhcp && num_ntp_servers) {
+    u8_t i;
+    for (i = 0; (i < num_ntp_servers) && (i < SNTP_MAX_SERVERS); i++) {
+      LWIP_DEBUGF(SNTP_DEBUG_TRACE, ("sntp: NTP server %u: %s\n",
+                                     i, ipaddr_ntoa(&ntp_server_addrs[i])));
+      sntp_setserver(i, &ntp_server_addrs[i]);
+    }
+    for (i = num_ntp_servers; i < SNTP_MAX_SERVERS; i++) {
+      sntp_setserver(i, NULL);
+    }
+  }
+}
+#endif /* LWIP_DHCPv6 && SNTP_GET_SERVERS_FROM_DHCPV6 */
+
 /**
 * @ingroup sntp
 * Obtain one of the currently configured by IP address (or DHCP) NTP servers
@@ -688,19 +864,20 @@ sntp_getserver(u8_t idx)
  if (idx < SNTP_MAX_SERVERS) {
    return &sntp_servers[idx].addr;
  }
-  return IP4_ADDR_ANY;
+  return IP_ADDR_ANY;
 }

 #if SNTP_SERVER_DNS
 /**
 * Initialize one of the NTP servers by name
 *
- * @param numdns the index of the NTP server to set must be < SNTP_MAX_SERVERS
- * @param dnsserver DNS name of the NTP server to set, to be resolved at contact time
+ * @param idx the index of the NTP server to set must be < SNTP_MAX_SERVERS
+ * @param server DNS name of the NTP server to set, to be resolved at contact time
 */
 void
-sntp_setservername(u8_t idx, char *server)
+sntp_setservername(u8_t idx, const char *server)
 {
+  LWIP_ASSERT_CORE_LOCKED();
  if (idx < SNTP_MAX_SERVERS) {
    sntp_servers[idx].name = server;
  }
@@ -709,11 +886,11 @@ sntp_setservername(u8_t idx, char *server)
 /**
 * Obtain one of the currently configured by name NTP servers.
 *
- * @param numdns the index of the NTP server
+ * @param idx the index of the NTP server
 * @return IP address of the indexed NTP server or NULL if the NTP
 *         server has not been configured by name (or at all)
 */
-char *
+const char *
 sntp_getservername(u8_t idx)
 {
  if (idx < SNTP_MAX_SERVERS) {
--- a/src/apps/tftp/tftp_server.c
+++ b/src/apps/tftp/tftp_server.c
@@ -1,4 +1,4 @@
-/****************************************************************//**
+/**
 *
 * @file tftp_server.c
 *
@@ -10,7 +10,7 @@
 * Copyright (c) Deltatee Enterprises Ltd. 2013
 * All rights reserved.
 *
- ********************************************************************/
+ */

 /*
 * Redistribution and use in source and binary forms, with or without
@@ -223,11 +223,10 @@ recv(void *arg, struct udp_pcb *upcb, struct pbuf *p, const ip_addr_t *addr, u16

  switch (opcode) {
    case PP_HTONS(TFTP_RRQ): /* fall through */
-    case PP_HTONS(TFTP_WRQ):
-    {
+    case PP_HTONS(TFTP_WRQ): {
      const char tftp_null = 0;
-      char filename[TFTP_MAX_FILENAME_LEN];
-      char mode[TFTP_MAX_MODE_LEN];
+      char filename[TFTP_MAX_FILENAME_LEN + 1];
+      char mode[TFTP_MAX_MODE_LEN + 1];
      u16_t filename_end_offset;
      u16_t mode_end_offset;

@@ -240,11 +239,11 @@ recv(void *arg, struct udp_pcb *upcb, struct pbuf *p, const ip_addr_t *addr, u16

      /* find \0 in pbuf -> end of filename string */
      filename_end_offset = pbuf_memfind(p, &tftp_null, sizeof(tftp_null), 2);
-      if((u16_t)(filename_end_offset-2) > sizeof(filename)) {
+      if ((u16_t)(filename_end_offset - 1) > sizeof(filename)) {
        send_error(addr, port, TFTP_ERROR_ACCESS_VIOLATION, "Filename too long/not NULL terminated");
        break;
      }
-      pbuf_copy_partial(p, filename, filename_end_offset-2, 2);
+      pbuf_copy_partial(p, filename, filename_end_offset - 1, 2);

      /* find \0 in pbuf -> end of mode string */
      mode_end_offset = pbuf_memfind(p, &tftp_null, sizeof(tftp_null), filename_end_offset + 1);
@@ -280,8 +279,7 @@ recv(void *arg, struct udp_pcb *upcb, struct pbuf *p, const ip_addr_t *addr, u16
      break;
    }

-    case PP_HTONS(TFTP_DATA):
-    {
+    case PP_HTONS(TFTP_DATA): {
      int ret;
      u16_t blknum;

@@ -296,7 +294,8 @@ recv(void *arg, struct udp_pcb *upcb, struct pbuf *p, const ip_addr_t *addr, u16
      }

      blknum = lwip_ntohs(sbuf[1]);
-      pbuf_header(p, -TFTP_HEADER_LENGTH);
+      if (blknum == tftp_state.blknum) {
+        pbuf_remove_header(p, TFTP_HEADER_LENGTH);

        ret = tftp_state.ctx->write(tftp_state.handle, p);
        if (ret < 0) {
@@ -308,12 +307,19 @@ recv(void *arg, struct udp_pcb *upcb, struct pbuf *p, const ip_addr_t *addr, u16

        if (p->tot_len < TFTP_MAX_PAYLOAD_SIZE) {
          close_handle();
+        } else {
+          tftp_state.blknum++;
+        }
+      } else if ((u16_t)(blknum + 1) == tftp_state.blknum) {
+        /* retransmit of previous block, ack again (casting to u16_t to care for overflow) */
+        send_ack(blknum);
+      } else {
+        send_error(addr, port, TFTP_ERROR_UNKNOWN_TRFR_ID, "Wrong block number");
      }
      break;
    }

-    case PP_HTONS(TFTP_ACK):
-    {
+    case PP_HTONS(TFTP_ACK): {
      u16_t blknum;
      int lastpkt;

@@ -391,6 +397,7 @@ tftp_init(const struct tftp_context *ctx)
 {
  err_t ret;

+  /* LWIP_ASSERT_CORE_LOCKED(); is checked by udp_new() */
  struct udp_pcb *pcb = udp_new_ip_type(IPADDR_TYPE_ANY);
  if (pcb == NULL) {
    return ERR_MEM;
@@ -414,4 +421,15 @@ tftp_init(const struct tftp_context *ctx)
  return ERR_OK;
 }

+/** @ingroup tftp
+ * Deinitialize ("turn off") TFTP server.
+ */
+void tftp_cleanup(void)
+{
+  LWIP_ASSERT("Cleanup called on non-initialized TFTP", tftp_state.upcb != NULL);
+  udp_remove(tftp_state.upcb);
+  close_handle();
+  memset(&tftp_state, 0, sizeof(tftp_state));
+}
+
 #endif /* LWIP_UDP */
--- a/src/core/altcp.c
+++ b/src/core/altcp.c
@@ -0,0 +1,717 @@
+/**
+ * @file
+ * @defgroup altcp Application layered TCP Functions
+ * @ingroup altcp_api
+ *
+ * This file contains the common functions for altcp to work.
+ * For more details see @ref altcp_api.
+ */
+
+/**
+ * @defgroup altcp_api Application layered TCP Introduction
+ * @ingroup callbackstyle_api
+ *
+ * Overview
+ * --------
+ * altcp (application layered TCP connection API; to be used from TCPIP thread)
+ * is an abstraction layer that prevents applications linking hard against the
+ * @ref tcp.h functions while providing the same functionality. It is used to
+ * e.g. add SSL/TLS (see LWIP_ALTCP_TLS) or proxy-connect support to an application
+ * written for the tcp callback API without that application knowing the
+ * protocol details.
+ *
+ * * This interface mimics the tcp callback API to the application while preventing
+ *   direct linking (much like virtual functions).
+ * * This way, an application can make use of other application layer protocols
+ *   on top of TCP without knowing the details (e.g. TLS, proxy connection).
+ * * This is achieved by simply including "lwip/altcp.h" instead of "lwip/tcp.h",
+ *   replacing "struct tcp_pcb" with "struct altcp_pcb" and prefixing all functions
+ *   with "altcp_" instead of "tcp_".
+ *
+ * With altcp support disabled (LWIP_ALTCP==0), applications written against the
+ * altcp API can still be compiled but are directly linked against the tcp.h
+ * callback API and then cannot use layered protocols. To minimize code changes
+ * in this case, the use of altcp_allocators is strongly suggested.
+ *
+ * Usage
+ * -----
+ * To make use of this API from an existing tcp raw API application:
+ * * Include "lwip/altcp.h" instead of "lwip/tcp.h"
+ * * Replace "struct tcp_pcb" with "struct altcp_pcb"
+ * * Prefix all called tcp API functions with "altcp_" instead of "tcp_" to link
+ *   against the altcp functions
+ * * @ref altcp_new (and @ref altcp_new_ip_type/@ref altcp_new_ip6) take
+ *   an @ref altcp_allocator_t as an argument, whereas the original tcp API
+ *   functions take no arguments.
+ * * An @ref altcp_allocator_t allocator is an object that holds a pointer to an
+ *   allocator object and a corresponding state (e.g. for TLS, the corresponding
+ *   state may hold certificates or keys). This way, the application does not
+ *   even need to know if it uses TLS or pure TCP, this is handled at runtime
+ *   by passing a specific allocator.
+ * * An application can alternatively bind hard to the altcp_tls API by calling
+ *   @ref altcp_tls_new or @ref altcp_tls_wrap.
+ * * The TLS layer is not directly implemented by lwIP, but a port to mbedTLS is
+ *   provided.
+ * * Another altcp layer is proxy-connect to use TLS behind a HTTP proxy (see
+ *   @ref altcp_proxyconnect.h)
+ *
+ * altcp_allocator_t
+ * -----------------
+ * An altcp allocator is created by the application by combining an allocator
+ * callback function and a corresponding state, e.g.:\code{.c}
+ * static const unsigned char cert[] = {0x2D, ... (see mbedTLS doc for how to create this)};
+ * struct altcp_tls_config * conf = altcp_tls_create_config_client(cert, sizeof(cert));
+ * altcp_allocator_t tls_allocator = {
+ *   altcp_tls_alloc, conf
+ * };
+ * \endcode
+ *
+ *
+ * struct altcp_tls_config
+ * -----------------------
+ * The struct altcp_tls_config holds state that is needed to create new TLS client
+ * or server connections (e.g. certificates and private keys).
+ *
+ * It is not defined by lwIP itself but by the TLS port (e.g. altcp_tls to mbedTLS
+ * adaption). However, the parameters used to create it are defined in @ref
+ * altcp_tls.h (see @ref altcp_tls_create_config_server_privkey_cert for servers
+ * and @ref altcp_tls_create_config_client/@ref altcp_tls_create_config_client_2wayauth
+ * for clients).
+ *
+ * For mbedTLS, ensure that certificates can be parsed by 'mbedtls_x509_crt_parse()' and
+ * private keys can be parsed by 'mbedtls_pk_parse_key()'.
+ */
+
+/*
+ * Copyright (c) 2017 Simon Goldschmidt
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ *
+ * Author: Simon Goldschmidt <goldsimon@gmx.de>
+ *
+ */
+
+#include "lwip/opt.h"
+
+#if LWIP_ALTCP /* don't build if not configured for use in lwipopts.h */
+
+#include "lwip/altcp.h"
+#include "lwip/priv/altcp_priv.h"
+#include "lwip/altcp_tcp.h"
+#include "lwip/tcp.h"
+#include "lwip/mem.h"
+
+#include <string.h>
+
+extern const struct altcp_functions altcp_tcp_functions;
+
+/**
+ * For altcp layer implementations only: allocate a new struct altcp_pcb from the pool
+ * and zero the memory
+ */
+struct altcp_pcb *
+altcp_alloc(void)
+{
+  struct altcp_pcb *ret = (struct altcp_pcb *)memp_malloc(MEMP_ALTCP_PCB);
+  if (ret != NULL) {
+    memset(ret, 0, sizeof(struct altcp_pcb));
+  }
+  return ret;
+}
+
+/**
+ * For altcp layer implementations only: return a struct altcp_pcb to the pool
+ */
+void
+altcp_free(struct altcp_pcb *conn)
+{
+  if (conn) {
+    if (conn->fns && conn->fns->dealloc) {
+      conn->fns->dealloc(conn);
+    }
+    memp_free(MEMP_ALTCP_PCB, conn);
+  }
+}
+
+/**
+ * @ingroup altcp
+ * altcp_new_ip6: @ref altcp_new for IPv6 
+ */
+struct altcp_pcb *
+altcp_new_ip6(altcp_allocator_t *allocator)
+{
+  return altcp_new_ip_type(allocator, IPADDR_TYPE_V6);
+}
+
+/** 
+ * @ingroup altcp
+ * altcp_new: @ref altcp_new for IPv4 
+ */
+struct altcp_pcb *
+altcp_new(altcp_allocator_t *allocator)
+{
+  return altcp_new_ip_type(allocator, IPADDR_TYPE_V4);
+}
+
+/**
+ * @ingroup altcp
+ * altcp_new_ip_type: called by applications to allocate a new pcb with the help of an
+ * allocator function.
+ *
+ * @param allocator allocator function and argument
+ * @param ip_type IP version of the pcb (@ref lwip_ip_addr_type)
+ * @return a new altcp_pcb or NULL on error
+ */
+struct altcp_pcb *
+altcp_new_ip_type(altcp_allocator_t *allocator, u8_t ip_type)
+{
+  struct altcp_pcb *conn;
+  if (allocator == NULL) {
+    /* no allocator given, create a simple TCP connection */
+    return altcp_tcp_new_ip_type(ip_type);
+  }
+  if (allocator->alloc == NULL) {
+    /* illegal allocator */
+    return NULL;
+  }
+  conn = allocator->alloc(allocator->arg, ip_type);
+  if (conn == NULL) {
+    /* allocation failed */
+    return NULL;
+  }
+  return conn;
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_arg()
+ */
+void
+altcp_arg(struct altcp_pcb *conn, void *arg)
+{
+  if (conn) {
+    conn->arg = arg;
+  }
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_accept()
+ */
+void
+altcp_accept(struct altcp_pcb *conn, altcp_accept_fn accept)
+{
+  if (conn != NULL) {
+    conn->accept = accept;
+  }
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_recv()
+ */
+void
+altcp_recv(struct altcp_pcb *conn, altcp_recv_fn recv)
+{
+  if (conn) {
+    conn->recv = recv;
+  }
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_sent()
+ */
+void
+altcp_sent(struct altcp_pcb *conn, altcp_sent_fn sent)
+{
+  if (conn) {
+    conn->sent = sent;
+  }
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_poll()
+ */
+void
+altcp_poll(struct altcp_pcb *conn, altcp_poll_fn poll, u8_t interval)
+{
+  if (conn) {
+    conn->poll = poll;
+    conn->pollinterval = interval;
+    if (conn->fns && conn->fns->set_poll) {
+      conn->fns->set_poll(conn, interval);
+    }
+  }
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_err()
+ */
+void
+altcp_err(struct altcp_pcb *conn, altcp_err_fn err)
+{
+  if (conn) {
+    conn->err = err;
+  }
+}
+
+/* Generic functions calling the "virtual" ones */
+
+/**
+ * @ingroup altcp
+ * @see tcp_recved()
+ */
+void
+altcp_recved(struct altcp_pcb *conn, u16_t len)
+{
+  if (conn && conn->fns && conn->fns->recved) {
+    conn->fns->recved(conn, len);
+  }
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_bind()
+ */
+err_t
+altcp_bind(struct altcp_pcb *conn, const ip_addr_t *ipaddr, u16_t port)
+{
+  if (conn && conn->fns && conn->fns->bind) {
+    return conn->fns->bind(conn, ipaddr, port);
+  }
+  return ERR_VAL;
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_connect()
+ */
+err_t
+altcp_connect(struct altcp_pcb *conn, const ip_addr_t *ipaddr, u16_t port, altcp_connected_fn connected)
+{
+  if (conn && conn->fns && conn->fns->connect) {
+    return conn->fns->connect(conn, ipaddr, port, connected);
+  }
+  return ERR_VAL;
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_listen_with_backlog_and_err()
+ */
+struct altcp_pcb *
+altcp_listen_with_backlog_and_err(struct altcp_pcb *conn, u8_t backlog, err_t *err)
+{
+  if (conn && conn->fns && conn->fns->listen) {
+    return conn->fns->listen(conn, backlog, err);
+  }
+  return NULL;
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_abort()
+ */
+void
+altcp_abort(struct altcp_pcb *conn)
+{
+  if (conn && conn->fns && conn->fns->abort) {
+    conn->fns->abort(conn);
+  }
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_close()
+ */
+err_t
+altcp_close(struct altcp_pcb *conn)
+{
+  if (conn && conn->fns && conn->fns->close) {
+    return conn->fns->close(conn);
+  }
+  return ERR_VAL;
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_shutdown()
+ */
+err_t
+altcp_shutdown(struct altcp_pcb *conn, int shut_rx, int shut_tx)
+{
+  if (conn && conn->fns && conn->fns->shutdown) {
+    return conn->fns->shutdown(conn, shut_rx, shut_tx);
+  }
+  return ERR_VAL;
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_write()
+ */
+err_t
+altcp_write(struct altcp_pcb *conn, const void *dataptr, u16_t len, u8_t apiflags)
+{
+  if (conn && conn->fns && conn->fns->write) {
+    return conn->fns->write(conn, dataptr, len, apiflags);
+  }
+  return ERR_VAL;
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_output()
+ */
+err_t
+altcp_output(struct altcp_pcb *conn)
+{
+  if (conn && conn->fns && conn->fns->output) {
+    return conn->fns->output(conn);
+  }
+  return ERR_VAL;
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_mss()
+ */
+u16_t
+altcp_mss(struct altcp_pcb *conn)
+{
+  if (conn && conn->fns && conn->fns->mss) {
+    return conn->fns->mss(conn);
+  }
+  return 0;
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_sndbuf()
+ */
+u16_t
+altcp_sndbuf(struct altcp_pcb *conn)
+{
+  if (conn && conn->fns && conn->fns->sndbuf) {
+    return conn->fns->sndbuf(conn);
+  }
+  return 0;
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_sndqueuelen()
+ */
+u16_t
+altcp_sndqueuelen(struct altcp_pcb *conn)
+{
+  if (conn && conn->fns && conn->fns->sndqueuelen) {
+    return conn->fns->sndqueuelen(conn);
+  }
+  return 0;
+}
+
+void
+altcp_nagle_disable(struct altcp_pcb *conn)
+{
+  if (conn && conn->fns && conn->fns->nagle_disable) {
+    conn->fns->nagle_disable(conn);
+  }
+}
+
+void
+altcp_nagle_enable(struct altcp_pcb *conn)
+{
+  if (conn && conn->fns && conn->fns->nagle_enable) {
+    conn->fns->nagle_enable(conn);
+  }
+}
+
+int
+altcp_nagle_disabled(struct altcp_pcb *conn)
+{
+  if (conn && conn->fns && conn->fns->nagle_disabled) {
+    return conn->fns->nagle_disabled(conn);
+  }
+  return 0;
+}
+
+/**
+ * @ingroup altcp
+ * @see tcp_setprio()
+ */
+void
+altcp_setprio(struct altcp_pcb *conn, u8_t prio)
+{
+  if (conn && conn->fns && conn->fns->setprio) {
+    conn->fns->setprio(conn, prio);
+  }
+}
+
+err_t
+altcp_get_tcp_addrinfo(struct altcp_pcb *conn, int local, ip_addr_t *addr, u16_t *port)
+{
+  if (conn && conn->fns && conn->fns->addrinfo) {
+    return conn->fns->addrinfo(conn, local, addr, port);
+  }
+  return ERR_VAL;
+}
+
+ip_addr_t *
+altcp_get_ip(struct altcp_pcb *conn, int local)
+{
+  if (conn && conn->fns && conn->fns->getip) {
+    return conn->fns->getip(conn, local);
+  }
+  return NULL;
+}
+
+u16_t
+altcp_get_port(struct altcp_pcb *conn, int local)
+{
+  if (conn && conn->fns && conn->fns->getport) {
+    return conn->fns->getport(conn, local);
+  }
+  return 0;
+}
+
+#if LWIP_TCP_KEEPALIVE
+void
+altcp_keepalive_disable(struct altcp_pcb *conn)
+{
+  if (conn && conn->fns && conn->fns->keepalive_disable) {
+    conn->fns->keepalive_disable(conn);
+  }
+}
+
+void
+altcp_keepalive_enable(struct altcp_pcb *conn, u32_t idle, u32_t intvl, u32_t count)
+{
+  if (conn && conn->fns && conn->fns->keepalive_enable) {
+      conn->fns->keepalive_enable(conn, idle, intvl, count);
+  }
+}
+#endif
+
+#ifdef LWIP_DEBUG
+enum tcp_state
+altcp_dbg_get_tcp_state(struct altcp_pcb *conn)
+{
+  if (conn && conn->fns && conn->fns->dbg_get_tcp_state) {
+    return conn->fns->dbg_get_tcp_state(conn);
+  }
+  return CLOSED;
+}
+#endif
+
+/* Default implementations for the "virtual" functions */
+
+void
+altcp_default_set_poll(struct altcp_pcb *conn, u8_t interval)
+{
+  if (conn && conn->inner_conn) {
+    altcp_poll(conn->inner_conn, conn->poll, interval);
+  }
+}
+
+void
+altcp_default_recved(struct altcp_pcb *conn, u16_t len)
+{
+  if (conn && conn->inner_conn) {
+    altcp_recved(conn->inner_conn, len);
+  }
+}
+
+err_t
+altcp_default_bind(struct altcp_pcb *conn, const ip_addr_t *ipaddr, u16_t port)
+{
+  if (conn && conn->inner_conn) {
+    return altcp_bind(conn->inner_conn, ipaddr, port);
+  }
+  return ERR_VAL;
+}
+
+err_t
+altcp_default_shutdown(struct altcp_pcb *conn, int shut_rx, int shut_tx)
+{
+  if (conn) {
+    if (shut_rx && shut_tx && conn->fns && conn->fns->close) {
+      /* default shutdown for both sides is close */
+      return conn->fns->close(conn);
+    }
+    if (conn->inner_conn) {
+      return altcp_shutdown(conn->inner_conn, shut_rx, shut_tx);
+    }
+  }
+  return ERR_VAL;
+}
+
+err_t
+altcp_default_write(struct altcp_pcb *conn, const void *dataptr, u16_t len, u8_t apiflags)
+{
+  if (conn && conn->inner_conn) {
+    return altcp_write(conn->inner_conn, dataptr, len, apiflags);
+  }
+  return ERR_VAL;
+}
+
+err_t
+altcp_default_output(struct altcp_pcb *conn)
+{
+  if (conn && conn->inner_conn) {
+    return altcp_output(conn->inner_conn);
+  }
+  return ERR_VAL;
+}
+
+u16_t
+altcp_default_mss(struct altcp_pcb *conn)
+{
+  if (conn && conn->inner_conn) {
+    return altcp_mss(conn->inner_conn);
+  }
+  return 0;
+}
+
+u16_t
+altcp_default_sndbuf(struct altcp_pcb *conn)
+{
+  if (conn && conn->inner_conn) {
+    return altcp_sndbuf(conn->inner_conn);
+  }
+  return 0;
+}
+
+u16_t
+altcp_default_sndqueuelen(struct altcp_pcb *conn)
+{
+  if (conn && conn->inner_conn) {
+    return altcp_sndqueuelen(conn->inner_conn);
+  }
+  return 0;
+}
+
+void
+altcp_default_nagle_disable(struct altcp_pcb *conn)
+{
+  if (conn && conn->inner_conn) {
+    altcp_nagle_disable(conn->inner_conn);
+  }
+}
+
+void
+altcp_default_nagle_enable(struct altcp_pcb *conn)
+{
+  if (conn && conn->inner_conn) {
+    altcp_nagle_enable(conn->inner_conn);
+  }
+}
+
+int
+altcp_default_nagle_disabled(struct altcp_pcb *conn)
+{
+  if (conn && conn->inner_conn) {
+    return altcp_nagle_disabled(conn->inner_conn);
+  }
+  return 0;
+}
+
+void
+altcp_default_setprio(struct altcp_pcb *conn, u8_t prio)
+{
+  if (conn && conn->inner_conn) {
+    altcp_setprio(conn->inner_conn, prio);
+  }
+}
+
+void
+altcp_default_dealloc(struct altcp_pcb *conn)
+{
+  LWIP_UNUSED_ARG(conn);
+  /* nothing to do */
+}
+
+err_t
+altcp_default_get_tcp_addrinfo(struct altcp_pcb *conn, int local, ip_addr_t *addr, u16_t *port)
+{
+  if (conn && conn->inner_conn) {
+    return altcp_get_tcp_addrinfo(conn->inner_conn, local, addr, port);
+  }
+  return ERR_VAL;
+}
+
+ip_addr_t *
+altcp_default_get_ip(struct altcp_pcb *conn, int local)
+{
+  if (conn && conn->inner_conn) {
+    return altcp_get_ip(conn->inner_conn, local);
+  }
+  return NULL;
+}
+
+u16_t
+altcp_default_get_port(struct altcp_pcb *conn, int local)
+{
+  if (conn && conn->inner_conn) {
+    return altcp_get_port(conn->inner_conn, local);
+  }
+  return 0;
+}
+
+#if LWIP_TCP_KEEPALIVE
+void
+altcp_default_keepalive_disable(struct altcp_pcb *conn)
+{
+  if (conn && conn->inner_conn) {
+    altcp_keepalive_disable(conn->inner_conn);
+  }
+}
+
+void
+altcp_default_keepalive_enable(struct altcp_pcb *conn, u32_t idle, u32_t intvl, u32_t count)
+{
+  if (conn && conn->inner_conn) {
+      altcp_keepalive_enable(conn->inner_conn, idle, intvl, count);
+  }
+}
+#endif
+
+#ifdef LWIP_DEBUG
+enum tcp_state
+altcp_default_dbg_get_tcp_state(struct altcp_pcb *conn)
+{
+  if (conn && conn->inner_conn) {
+    return altcp_dbg_get_tcp_state(conn->inner_conn);
+  }
+  return CLOSED;
+}
+#endif
+
+
+#endif /* LWIP_ALTCP */
--- a/src/core/altcp_alloc.c
+++ b/src/core/altcp_alloc.c
@@ -0,0 +1,87 @@
+/**
+ * @file
+ * Application layered TCP connection API (to be used from TCPIP thread)\n
+ * This interface mimics the tcp callback API to the application while preventing
+ * direct linking (much like virtual functions).
+ * This way, an application can make use of other application layer protocols
+ * on top of TCP without knowing the details (e.g. TLS, proxy connection).
+ *
+ * This file contains allocation implementation that combine several layers.
+ */
+
+/*
+ * Copyright (c) 2017 Simon Goldschmidt
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ *
+ * Author: Simon Goldschmidt <goldsimon@gmx.de>
+ *
+ */
+
+#include "lwip/opt.h"
+
+#if LWIP_ALTCP /* don't build if not configured for use in lwipopts.h */
+
+#include "lwip/altcp.h"
+#include "lwip/altcp_tcp.h"
+#include "lwip/altcp_tls.h"
+#include "lwip/priv/altcp_priv.h"
+#include "lwip/mem.h"
+
+#include <string.h>
+
+#if LWIP_ALTCP_TLS
+
+/** This standard allocator function creates an altcp pcb for
+ * TLS over TCP */
+struct altcp_pcb *
+altcp_tls_new(struct altcp_tls_config *config, u8_t ip_type)
+{
+  struct altcp_pcb *inner_conn, *ret;
+  LWIP_UNUSED_ARG(ip_type);
+
+  inner_conn = altcp_tcp_new_ip_type(ip_type);
+  if (inner_conn == NULL) {
+    return NULL;
+  }
+  ret = altcp_tls_wrap(config, inner_conn);
+  if (ret == NULL) {
+    altcp_close(inner_conn);
+  }
+  return ret;
+}
+
+/** This standard allocator function creates an altcp pcb for
+ * TLS over TCP */
+struct altcp_pcb *
+altcp_tls_alloc(void *arg, u8_t ip_type)
+{
+  return altcp_tls_new((struct altcp_tls_config *)arg, ip_type);
+}
+
+#endif /* LWIP_ALTCP_TLS */
+
+#endif /* LWIP_ALTCP */
--- a/src/core/altcp_tcp.c
+++ b/src/core/altcp_tcp.c
@@ -0,0 +1,577 @@
+/**
+ * @file
+ * Application layered TCP connection API (to be used from TCPIP thread)\n
+ * This interface mimics the tcp callback API to the application while preventing
+ * direct linking (much like virtual functions).
+ * This way, an application can make use of other application layer protocols
+ * on top of TCP without knowing the details (e.g. TLS, proxy connection).
+ *
+ * This file contains the base implementation calling into tcp.
+ */
+
+/*
+ * Copyright (c) 2017 Simon Goldschmidt
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
+ * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ * This file is part of the lwIP TCP/IP stack.
+ *
+ * Author: Simon Goldschmidt <goldsimon@gmx.de>
+ *
+ */
+
+#include "lwip/opt.h"
+
+#if LWIP_ALTCP /* don't build if not configured for use in lwipopts.h */
+
+#include "lwip/altcp.h"
+#include "lwip/altcp_tcp.h"
+#include "lwip/priv/altcp_priv.h"
+#include "lwip/tcp.h"
+#include "lwip/priv/tcp_priv.h"
+#include "lwip/mem.h"
+
+#include <string.h>
+
+#define ALTCP_TCP_ASSERT_CONN(conn) do { \
+  LWIP_ASSERT("conn->inner_conn == NULL", (conn)->inner_conn == NULL); \
+  LWIP_UNUSED_ARG(conn); /* for LWIP_NOASSERT */ } while(0)
+#define ALTCP_TCP_ASSERT_CONN_PCB(conn, tpcb) do { \
+  LWIP_ASSERT("pcb mismatch", (conn)->state == tpcb); \
+  LWIP_UNUSED_ARG(tpcb); /* for LWIP_NOASSERT */ \
+  ALTCP_TCP_ASSERT_CONN(conn); } while(0)
+
+
+/* Variable prototype, the actual declaration is at the end of this file
+   since it contains pointers to static functions declared here */
+extern const struct altcp_functions altcp_tcp_functions;
+
+static void altcp_tcp_setup(struct altcp_pcb *conn, struct tcp_pcb *tpcb);
+
+/* callback functions for TCP */
+static err_t
+altcp_tcp_accept(void *arg, struct tcp_pcb *new_tpcb, err_t err)
+{
+  struct altcp_pcb *listen_conn = (struct altcp_pcb *)arg;
+  if (listen_conn && listen_conn->accept) {
+    /* create a new altcp_conn to pass to the next 'accept' callback */
+    struct altcp_pcb *new_conn = altcp_alloc();
+    if (new_conn == NULL) {
+      return ERR_MEM;
+    }
+    altcp_tcp_setup(new_conn, new_tpcb);
+    return listen_conn->accept(listen_conn->arg, new_conn, err);
+  }
+  return ERR_ARG;
+}
+
+static err_t
+altcp_tcp_connected(void *arg, struct tcp_pcb *tpcb, err_t err)
+{
+  struct altcp_pcb *conn = (struct altcp_pcb *)arg;
+  if (conn) {
+    ALTCP_TCP_ASSERT_CONN_PCB(conn, tpcb);
+    if (conn->connected) {
+      return conn->connected(conn->arg, conn, err);
+    }
+  }
+  return ERR_OK;
+}
+
+static err_t
+altcp_tcp_recv(void *arg, struct tcp_pcb *tpcb, struct pbuf *p, err_t err)
+{
+  struct altcp_pcb *conn = (struct altcp_pcb *)arg;
+  if (conn) {
+    ALTCP_TCP_ASSERT_CONN_PCB(conn, tpcb);
+    if (conn->recv) {
+      return conn->recv(conn->arg, conn, p, err);
+    }
+  }
+  if (p != NULL) {
+    /* prevent memory leaks */
+    pbuf_free(p);
+  }
+  return ERR_OK;
+}
+
+static err_t
+altcp_tcp_sent(void *arg, struct tcp_pcb *tpcb, u16_t len)
+{
+  struct altcp_pcb *conn = (struct altcp_pcb *)arg;
+  if (conn) {
+    ALTCP_TCP_ASSERT_CONN_PCB(conn, tpcb);
+    if (conn->sent) {
+      return conn->sent(conn->arg, conn, len);
+    }
+  }
+  return ERR_OK;
+}
+
+static err_t
+altcp_tcp_poll(void *arg, struct tcp_pcb *tpcb)
+{
+  struct altcp_pcb *conn = (struct altcp_pcb *)arg;
+  if (conn) {
+    ALTCP_TCP_ASSERT_CONN_PCB(conn, tpcb);
+    if (conn->poll) {
+      return conn->poll(conn->arg, conn);
+    }
+  }
+  return ERR_OK;
+}
+
+static void
+altcp_tcp_err(void *arg, err_t err)
+{
+  struct altcp_pcb *conn = (struct altcp_pcb *)arg;
+  if (conn) {
+    conn->state = NULL; /* already freed */
+    if (conn->err) {
+      conn->err(conn->arg, err);
+    }
+    altcp_free(conn);
+  }
+}
+
+/* setup functions */
+
+static void
+altcp_tcp_remove_callbacks(struct tcp_pcb *tpcb)
+{
+  tcp_arg(tpcb, NULL);
+  if (tpcb->state != LISTEN) {
+    tcp_recv(tpcb, NULL);
+    tcp_sent(tpcb, NULL);
+    tcp_err(tpcb, NULL);
+    tcp_poll(tpcb, NULL, tpcb->pollinterval);
+  }
+}
+
+static void
+altcp_tcp_setup_callbacks(struct altcp_pcb *conn, struct tcp_pcb *tpcb)
+{
+  tcp_arg(tpcb, conn);
+  /* this might be called for LISTN when close fails... */
+  if (tpcb->state != LISTEN) {
+    tcp_recv(tpcb, altcp_tcp_recv);
+    tcp_sent(tpcb, altcp_tcp_sent);
+    tcp_err(tpcb, altcp_tcp_err);
+    /* tcp_poll is set when interval is set by application */
+  }
+}
+
+static void
+altcp_tcp_setup(struct altcp_pcb *conn, struct tcp_pcb *tpcb)
+{
+  altcp_tcp_setup_callbacks(conn, tpcb);
+  conn->state = tpcb;
+  conn->fns = &altcp_tcp_functions;
+}
+
+struct altcp_pcb *
+altcp_tcp_new_ip_type(u8_t ip_type)
+{
+  /* Allocate the tcp pcb first to invoke the priority handling code
+     if we're out of pcbs */
+  struct tcp_pcb *tpcb = tcp_new_ip_type(ip_type);
+  if (tpcb != NULL) {
+    struct altcp_pcb *ret = altcp_alloc();
+    if (ret != NULL) {
+      altcp_tcp_setup(ret, tpcb);
+      return ret;
+    } else {
+      /* altcp_pcb allocation failed -> free the tcp_pcb too */
+      tcp_close(tpcb);
+    }
+  }
+  return NULL;
+}
+
+/** altcp_tcp allocator function fitting to @ref altcp_allocator_t / @ref altcp_new.
+*
+* arg pointer is not used for TCP.
+*/
+struct altcp_pcb *
+altcp_tcp_alloc(void *arg, u8_t ip_type)
+{
+  LWIP_UNUSED_ARG(arg);
+  return altcp_tcp_new_ip_type(ip_type);
+}
+
+struct altcp_pcb *
+altcp_tcp_wrap(struct tcp_pcb *tpcb)
+{
+  if (tpcb != NULL) {
+    struct altcp_pcb *ret = altcp_alloc();
+    if (ret != NULL) {
+      altcp_tcp_setup(ret, tpcb);
+      return ret;
+    }
+  }
+  return NULL;
+}
+
+
+/* "virtual" functions calling into tcp */
+static void
+altcp_tcp_set_poll(struct altcp_pcb *conn, u8_t interval)
+{
+  if (conn != NULL) {
+    struct tcp_pcb *pcb = (struct tcp_pcb *)conn->state;
+    ALTCP_TCP_ASSERT_CONN(conn);
+    tcp_poll(pcb, altcp_tcp_poll, interval);
+  }
+}
+
+static void
+altcp_tcp_recved(struct altcp_pcb *conn, u16_t len)
+{
+  if (conn != NULL) {
+    struct tcp_pcb *pcb = (struct tcp_pcb *)conn->state;
+    ALTCP_TCP_ASSERT_CONN(conn);
+    tcp_recved(pcb, len);
+  }
+}
+
+static err_t
+altcp_tcp_bind(struct altcp_pcb *conn, const ip_addr_t *ipaddr, u16_t port)
+{
+  struct tcp_pcb *pcb;
+  if (conn == NULL) {
+    return ERR_VAL;
+  }
+  ALTCP_TCP_ASSERT_CONN(conn);
+  pcb = (struct tcp_pcb *)conn->state;
+  return tcp_bind(pcb, ipaddr, port);
+}
+
+static err_t
+altcp_tcp_connect(struct altcp_pcb *conn, const ip_addr_t *ipaddr, u16_t port, altcp_connected_fn connected)
+{
+  struct tcp_pcb *pcb;
+  if (conn == NULL) {
+    return ERR_VAL;
+  }
+  ALTCP_TCP_ASSERT_CONN(conn);
+  conn->connected = connected;
+  pcb = (struct tcp_pcb *)conn->state;
+  return tcp_connect(pcb, ipaddr, port, altcp_tcp_connected);
+}
+
+static struct altcp_pcb *
+altcp_tcp_listen(struct altcp_pcb *conn, u8_t backlog, err_t *err)
+{
+  struct tcp_pcb *pcb;
+  struct tcp_pcb *lpcb;
+  if (conn == NULL) {
+    return NULL;
+  }
+  ALTCP_TCP_ASSERT_CONN(conn);
+  pcb = (struct tcp_pcb *)conn->state;
+  lpcb = tcp_listen_with_backlog_and_err(pcb, backlog, err);
+  if (lpcb != NULL) {
+    conn->state = lpcb;
+    tcp_accept(lpcb, altcp_tcp_accept);
+    return conn;
+  }
+  return NULL;
+}
+
+static void
+altcp_tcp_abort(struct altcp_pcb *conn)
+{
+  if (conn != NULL) {
+    struct tcp_pcb *pcb = (struct tcp_pcb *)conn->state;
+    ALTCP_TCP_ASSERT_CONN(conn);
+    if (pcb) {
+      tcp_abort(pcb);
+    }
+  }
+}
+
+static err_t
+altcp_tcp_close(struct altcp_pcb *conn)
+{
+  struct tcp_pcb *pcb;
+  if (conn == NULL) {
+    return ERR_VAL;
+  }
+  ALTCP_TCP_ASSERT_CONN(conn);
+  pcb = (struct tcp_pcb *)conn->state;
+  if (pcb) {
+    err_t err;
+    tcp_poll_fn oldpoll = pcb->poll;
+    altcp_tcp_remove_callbacks(pcb);
+    err = tcp_close(pcb);
+    if (err != ERR_OK) {
+      /* not closed, set up all callbacks again */
+      altcp_tcp_setup_callbacks(conn, pcb);
+      /* poll callback is not included in the above */
+      tcp_poll(pcb, oldpoll, pcb->pollinterval);
+      return err;
+    }
+    conn->state = NULL; /* unsafe to reference pcb after tcp_close(). */
+  }
+  altcp_free(conn);
+  return ERR_OK;
+}
+
+static err_t
+altcp_tcp_shutdown(struct altcp_pcb *conn, int shut_rx, int shut_tx)
+{
+  struct tcp_pcb *pcb;
+  if (conn == NULL) {
+    return ERR_VAL;
+  }
+  ALTCP_TCP_ASSERT_CONN(conn);
+  pcb = (struct tcp_pcb *)conn->state;
+  return tcp_shutdown(pcb, shut_rx, shut_tx);
+}
+
+static err_t
+altcp_tcp_write(struct altcp_pcb *conn, const void *dataptr, u16_t len, u8_t apiflags)
+{
+  struct tcp_pcb *pcb;
+  if (conn == NULL) {
+    return ERR_VAL;
+  }
+  ALTCP_TCP_ASSERT_CONN(conn);
+  pcb = (struct tcp_pcb *)conn->state;
+  return tcp_write(pcb, dataptr, len, apiflags);
+}
+
+static err_t
+altcp_tcp_output(struct altcp_pcb *conn)
+{
+  struct tcp_pcb *pcb;
+  if (conn == NULL) {
+    return ERR_VAL;
+  }
+  ALTCP_TCP_ASSERT_CONN(conn);
+  pcb = (struct tcp_pcb *)conn->state;
+  return tcp_output(pcb);
+}
+
+static u16_t
+altcp_tcp_mss(struct altcp_pcb *conn)
+{
+  struct tcp_pcb *pcb;
+  if (conn == NULL) {
+    return 0;
+  }
+  ALTCP_TCP_ASSERT_CONN(conn);
+  pcb = (struct tcp_pcb *)conn->state;
+  return tcp_mss(pcb);
+}
+
+static u16_t
+altcp_tcp_sndbuf(struct altcp_pcb *conn)
+{
+  struct tcp_pcb *pcb;
+  if (conn == NULL) {
+    return 0;
+  }
+  ALTCP_TCP_ASSERT_CONN(conn);
+  pcb = (struct tcp_pcb *)conn->state;
+  return tcp_sndbuf(pcb);
+}
+
+static u16_t
+altcp_tcp_sndqueuelen(struct altcp_pcb *conn)
+{
+  struct tcp_pcb *pcb;
+  if (conn == NULL) {
+    return 0;
+  }
+  ALTCP_TCP_ASSERT_CONN(conn);
+  pcb = (struct tcp_pcb *)conn->state;
+  return tcp_sndqueuelen(pcb);
+}
+
+static void
+altcp_tcp_nagle_disable(struct altcp_pcb *conn)
+{
+  if (conn && conn->state) {
+    struct tcp_pcb *pcb = (struct tcp_pcb *)conn->state;
+    ALTCP_TCP_ASSERT_CONN(conn);
+    tcp_nagle_disable(pcb);
+  }
+}
+
+static void
+altcp_tcp_nagle_enable(struct altcp_pcb *conn)
+{
+  if (conn && conn->state) {
+    struct tcp_pcb *pcb = (struct tcp_pcb *)conn->state;
+    ALTCP_TCP_ASSERT_CONN(conn);
+    tcp_nagle_enable(pcb);
+  }
+}
+
+static int
+altcp_tcp_nagle_disabled(struct altcp_pcb *conn)
+{
+  if (conn && conn->state) {
+    struct tcp_pcb *pcb = (struct tcp_pcb *)conn->state;
+    ALTCP_TCP_ASSERT_CONN(conn);
+    return tcp_nagle_disabled(pcb);
+  }
+  return 0;
+}
+
+static void
+altcp_tcp_setprio(struct altcp_pcb *conn, u8_t prio)
+{
+  if (conn != NULL) {
+    struct tcp_pcb *pcb = (struct tcp_pcb *)conn->state;
+    ALTCP_TCP_ASSERT_CONN(conn);
+    tcp_setprio(pcb, prio);
+  }
+}
+
+#if LWIP_TCP_KEEPALIVE
+static void
+altcp_tcp_keepalive_disable(struct altcp_pcb *conn)
+{
+  if (conn && conn->state) {
+    struct tcp_pcb *pcb = (struct tcp_pcb *)conn->state;
+    ALTCP_TCP_ASSERT_CONN(conn);
+    ip_reset_option(pcb, SOF_KEEPALIVE);
+  }
+}
+
+static void
+altcp_tcp_keepalive_enable(struct altcp_pcb *conn, u32_t idle, u32_t intvl, u32_t cnt)
+{
+  if (conn && conn->state) {
+    struct tcp_pcb *pcb = (struct tcp_pcb *)conn->state;
+    ALTCP_TCP_ASSERT_CONN(conn);
+    ip_set_option(pcb, SOF_KEEPALIVE);
+    pcb->keep_idle = idle ? idle : TCP_KEEPIDLE_DEFAULT;
+    pcb->keep_intvl = intvl ? intvl : TCP_KEEPINTVL_DEFAULT;
+    pcb->keep_cnt = cnt ? cnt : TCP_KEEPCNT_DEFAULT;
+  }
+}
+#endif
+
+static void
+altcp_tcp_dealloc(struct altcp_pcb *conn)
+{
+  LWIP_UNUSED_ARG(conn);
+  ALTCP_TCP_ASSERT_CONN(conn);
+  /* no private state to clean up */
+}
+
+static err_t
+altcp_tcp_get_tcp_addrinfo(struct altcp_pcb *conn, int local, ip_addr_t *addr, u16_t *port)
+{
+  if (conn) {
+    struct tcp_pcb *pcb = (struct tcp_pcb *)conn->state;
+    ALTCP_TCP_ASSERT_CONN(conn);
+    return tcp_tcp_get_tcp_addrinfo(pcb, local, addr, port);
+  }
+  return ERR_VAL;
+}
+
+static ip_addr_t *
+altcp_tcp_get_ip(struct altcp_pcb *conn, int local)
+{
+  if (conn) {
+    struct tcp_pcb *pcb = (struct tcp_pcb *)conn->state;
+    ALTCP_TCP_ASSERT_CONN(conn);
+    if (pcb) {
+      if (local) {
+        return &pcb->local_ip;
+      } else {
+        return &pcb->remote_ip;
+      }
+    }
+  }
+  return NULL;
+}
+
+static u16_t
+altcp_tcp_get_port(struct altcp_pcb *conn, int local)
+{
+  if (conn) {
+    struct tcp_pcb *pcb = (struct tcp_pcb *)conn->state;
+    ALTCP_TCP_ASSERT_CONN(conn);
+    if (pcb) {
+      if (local) {
+        return pcb->local_port;
+      } else {
+        return pcb->remote_port;
+      }
+    }
+  }
+  return 0;
+}
+
+#ifdef LWIP_DEBUG
+static enum tcp_state
+altcp_tcp_dbg_get_tcp_state(struct altcp_pcb *conn)
+{
+  if (conn) {
+    struct tcp_pcb *pcb = (struct tcp_pcb *)conn->state;
+    ALTCP_TCP_ASSERT_CONN(conn);
+    if (pcb) {
+      return pcb->state;
+    }
+  }
+  return CLOSED;
+}
+#endif
+const struct altcp_functions altcp_tcp_functions = {
+  altcp_tcp_set_poll,
+  altcp_tcp_recved,
+  altcp_tcp_bind,
+  altcp_tcp_connect,
+  altcp_tcp_listen,
+  altcp_tcp_abort,
+  altcp_tcp_close,
+  altcp_tcp_shutdown,
+  altcp_tcp_write,
+  altcp_tcp_output,
+  altcp_tcp_mss,
+  altcp_tcp_sndbuf,
+  altcp_tcp_sndqueuelen,
+  altcp_tcp_nagle_disable,
+  altcp_tcp_nagle_enable,
+  altcp_tcp_nagle_disabled,
+  altcp_tcp_setprio,
+  altcp_tcp_dealloc,
+  altcp_tcp_get_tcp_addrinfo,
+  altcp_tcp_get_ip,
+  altcp_tcp_get_port
+#if LWIP_TCP_KEEPALIVE
+  , altcp_tcp_keepalive_disable
+  , altcp_tcp_keepalive_enable
+#endif
+#ifdef LWIP_DEBUG
+  , altcp_tcp_dbg_get_tcp_state
+#endif
+};
+
+#endif /* LWIP_ALTCP */
--- a/src/core/def.c
+++ b/src/core/def.c
@@ -20,6 +20,10 @@
 * @ingroup sys_layer
 * lwIP provides default implementations for non-standard functions.
 * These can be mapped to OS functions to reduce code footprint if desired.
+ * All defines related to this section must not be placed in lwipopts.h,
+ * but in arch/cc.h!
+ * These options cannot be \#defined in lwipopts.h since they are not options
+ * of lwIP itself, but options of the lwIP port to your system.
 */

 /*
@@ -71,7 +75,7 @@
 u16_t
 lwip_htons(u16_t n)
 {
-  return (u16_t)PP_HTONS(n);
+  return PP_HTONS(n);
 }
 #endif /* lwip_htons */

@@ -85,7 +89,7 @@ lwip_htons(u16_t n)
 u32_t
 lwip_htonl(u32_t n)
 {
-  return (u32_t)PP_HTONL(n);
+  return PP_HTONL(n);
 }
 #endif /* lwip_htonl */

@@ -101,13 +105,13 @@ char*
 lwip_strnstr(const char *buffer, const char *token, size_t n)
 {
  const char *p;
-  int tokenlen = (int)strlen(token);
+  size_t tokenlen = strlen(token);
  if (tokenlen == 0) {
-    return (char *)(size_t)buffer;
+    return LWIP_CONST_CAST(char *, buffer);
  }
  for (p = buffer; *p && (p + tokenlen <= buffer + n); p++) {
    if ((*p == *token) && (strncmp(p, token, tokenlen) == 0)) {
-      return (char *)(size_t)p;
+      return LWIP_CONST_CAST(char *, p);
    }
  }
  return NULL;
@@ -179,7 +183,8 @@ lwip_strnicmp(const char* str1, const char* str2, size_t len)
        return 1;
      }
    }
-  } while (len-- && c1 != 0);
+    len--;
+  } while ((len != 0) && (c1 != 0));
  return 0;
 }
 #endif
@@ -193,26 +198,43 @@ lwip_strnicmp(const char* str1, const char* str2, size_t len)
 void
 lwip_itoa(char *result, size_t bufsize, int number)
 {
-  const int base = 10;
-  char* ptr = result, *ptr1 = result, tmp_char;
-  int tmp_value;
-  LWIP_UNUSED_ARG(bufsize);
+  char *res = result;
+  char *tmp = result + bufsize - 1;
+  int n = (number >= 0) ? number : -number;

-  do {
-    tmp_value = number;
-    number /= base;
-    *ptr++ = "zyxwvutsrqponmlkjihgfedcba9876543210123456789abcdefghijklmnopqrstuvwxyz"[35 + (tmp_value - number * base)];
-  } while(number);
+  /* handle invalid bufsize */
+  if (bufsize < 2) {
+    if (bufsize == 1) {
+      *result = 0;
+    }
+    return;
+  }

-   /* Apply negative sign */
-  if (tmp_value < 0) {
-     *ptr++ = '-';
+  /* First, add sign */
+  if (number < 0) {
+    *res++ = '-';
  }
-  *ptr-- = '\0';
-  while(ptr1 < ptr) {
-    tmp_char = *ptr;
-    *ptr--= *ptr1;
-    *ptr1++ = tmp_char;
+  /* Then create the string from the end and stop if buffer full,
+     and ensure output string is zero terminated */
+  *tmp = 0;
+  while ((n != 0) && (tmp > res)) {
+    char val = (char)('0' + (n % 10));
+    tmp--;
+    *tmp = val;
+    n = n / 10;
  }
+  if (n) {
+    /* buffer is too small */
+    *result = 0;
+    return;
+  }
+  if (*tmp == 0) {
+    /* Nothing added? */
+    *res++ = '0';
+    *res++ = 0;
+    return;
+  }
+  /* move from temporary buffer to output buffer (sign is not moved) */
+  memmove(res, tmp, (size_t)((result + bufsize) - tmp));
 }
 #endif
--- a/src/core/dns.c
+++ b/src/core/dns.c
@@ -24,8 +24,15 @@
 * the resolver code calls a specified callback function (which
 * must be implemented by the module that uses the resolver).
 *
+ * Multicast DNS queries are supported for names ending on ".local".
+ * However, only "One-Shot Multicast DNS Queries" are supported (RFC 6762
+ * chapter 5.1), this is not a fully compliant implementation of continuous
+ * mDNS querying!
+ *
 * All functions must be called from TCPIP thread.
 *
+ * @see DNS_MAX_SERVERS
+ * @see LWIP_DHCP_MAX_DNS_SERVERS
 * @see @ref netconn_common for thread-safe access.
 */

@@ -71,6 +78,7 @@
 /** @todo: define good default values (rfc compliance) */
 /** @todo: improve answer parsing, more checkings... */
 /** @todo: check RFC1035 - 7.3. Processing responses */
+/** @todo: one-shot mDNS: dual-stack fallback to another IP version */

 /*-----------------------------------------------------------------------------
 * Includes
@@ -104,11 +112,6 @@ static u16_t dns_txid;
 #define DNS_PORT_ALLOWED(port) ((port) >= 1024)
 #endif

-/** DNS maximum number of retries when asking for a name, before "timeout". */
-#ifndef DNS_MAX_RETRIES
-#define DNS_MAX_RETRIES           4
-#endif
-
 /** DNS resource record max. TTL (one week as default) */
 #ifndef DNS_MAX_TTL
 #define DNS_MAX_TTL               604800
@@ -116,6 +119,13 @@ static u16_t dns_txid;
 #error DNS_MAX_TTL must be a positive 32-bit value
 #endif

+#if DNS_TABLE_SIZE > 255
+#error DNS_TABLE_SIZE must fit into an u8_t
+#endif
+#if DNS_MAX_SERVERS > 255
+#error DNS_MAX_SERVERS must fit into an u8_t
+#endif
+
 /* The number of parallel requests (i.e. calls to dns_gethostbyname
 * that cannot be answered from the DNS table.
 * This is set to the table size by default.
@@ -123,6 +133,10 @@ static u16_t dns_txid;
 #if ((LWIP_DNS_SECURE & LWIP_DNS_SECURE_NO_MULTIPLE_OUTSTANDING) != 0)
 #ifndef DNS_MAX_REQUESTS
 #define DNS_MAX_REQUESTS          DNS_TABLE_SIZE
+#else
+#if DNS_MAX_REQUESTS > 255
+#error DNS_MAX_REQUESTS must fit into an u8_t
+#endif
 #endif
 #else
 /* In this configuration, both arrays have to have the same size and are used
@@ -134,6 +148,10 @@ static u16_t dns_txid;
 #if ((LWIP_DNS_SECURE & LWIP_DNS_SECURE_RAND_SRC_PORT) != 0)
 #ifndef DNS_MAX_SOURCE_PORTS
 #define DNS_MAX_SOURCE_PORTS      DNS_MAX_REQUESTS
+#else
+#if DNS_MAX_SOURCE_PORTS > 255
+#error DNS_MAX_SOURCE_PORTS must fit into an u8_t
+#endif
 #endif
 #else
 #ifdef DNS_MAX_SOURCE_PORTS
@@ -160,6 +178,12 @@ static u16_t dns_txid;
 #define LWIP_DNS_SET_ADDRTYPE(x, y)
 #endif /* LWIP_IPV4 && LWIP_IPV6 */

+#if LWIP_DNS_SUPPORT_MDNS_QUERIES
+#define LWIP_DNS_ISMDNS_ARG(x) , x
+#else
+#define LWIP_DNS_ISMDNS_ARG(x)
+#endif
+
 /** DNS query message structure.
    No packing needed: only used locally on the stack. */
 struct dns_query {
@@ -209,6 +233,9 @@ struct dns_table_entry {
 #if LWIP_IPV4 && LWIP_IPV6
  u8_t reqaddrtype;
 #endif /* LWIP_IPV4 && LWIP_IPV6 */
+#if LWIP_DNS_SUPPORT_MDNS_QUERIES
+  u8_t is_mdns;
+#endif
 };

 /** DNS request table entry: used when dns_gehostbyname cannot answer the
@@ -250,6 +277,7 @@ DNS_LOCAL_HOSTLIST_STORAGE_PRE struct local_hostlist_entry local_hostlist_static
 #endif /* DNS_LOCAL_HOSTLIST_IS_DYNAMIC */

 static void dns_init_local(void);
+static err_t dns_lookup_local(const char *hostname, ip_addr_t *addr LWIP_DNS_ADDRTYPE_ARG(u8_t dns_addrtype));
 #endif /* DNS_LOCAL_HOSTLIST */


@@ -272,6 +300,13 @@ static struct dns_table_entry dns_table[DNS_TABLE_SIZE];
 static struct dns_req_entry   dns_requests[DNS_MAX_REQUESTS];
 static ip_addr_t              dns_servers[DNS_MAX_SERVERS];

+#if LWIP_IPV4
+const ip_addr_t dns_mquery_v4group = DNS_MQUERY_IPV4_GROUP_INIT;
+#endif /* LWIP_IPV4 */
+#if LWIP_IPV6
+const ip_addr_t dns_mquery_v6group = DNS_MQUERY_IPV6_GROUP_INIT;
+#endif /* LWIP_IPV6 */
+
 /**
 * Initialize the resolver: set up the UDP pcb and configure the default server
 * (if DNS_SERVER_ADDRESS is set).
@@ -329,7 +364,7 @@ dns_setserver(u8_t numdns, const ip_addr_t *dnsserver)
    if (dnsserver != NULL) {
      dns_servers[numdns] = (*dnsserver);
    } else {
-      dns_servers[numdns] = *IP4_ADDR_ANY;
+      dns_servers[numdns] = *IP_ADDR_ANY;
    }
  }
 }
@@ -348,7 +383,7 @@ dns_getserver(u8_t numdns)
  if (numdns < DNS_MAX_SERVERS) {
    return &dns_servers[numdns];
  } else {
-    return IP4_ADDR_ANY;
+    return IP_ADDR_ANY;
  }
 }

@@ -393,6 +428,38 @@ dns_init_local(void)
 #endif /* DNS_LOCAL_HOSTLIST_IS_DYNAMIC && defined(DNS_LOCAL_HOSTLIST_INIT) */
 }

+/**
+ * @ingroup dns
+ * Iterate the local host-list for a hostname.
+ *
+ * @param iterator_fn a function that is called for every entry in the local host-list
+ * @param iterator_arg 3rd argument passed to iterator_fn
+ * @return the number of entries in the local host-list
+ */
+size_t
+dns_local_iterate(dns_found_callback iterator_fn, void *iterator_arg)
+{
+  size_t i;
+#if DNS_LOCAL_HOSTLIST_IS_DYNAMIC
+  struct local_hostlist_entry *entry = local_hostlist_dynamic;
+  i = 0;
+  while (entry != NULL) {
+    if (iterator_fn != NULL) {
+      iterator_fn(entry->name, &entry->addr, iterator_arg);
+    }
+    i++;
+    entry = entry->next;
+  }
+#else /* DNS_LOCAL_HOSTLIST_IS_DYNAMIC */
+  for (i = 0; i < LWIP_ARRAYSIZE(local_hostlist_static); i++) {
+    if (iterator_fn != NULL) {
+      iterator_fn(local_hostlist_static[i].name, &local_hostlist_static[i].addr, iterator_arg);
+    }
+  }
+#endif /* DNS_LOCAL_HOSTLIST_IS_DYNAMIC */
+  return i;
+}
+
 /**
 * @ingroup dns
 * Scans the local host-list for a hostname.
@@ -400,8 +467,20 @@ dns_init_local(void)
 * @param hostname Hostname to look for in the local host-list
 * @param addr the first IP address for the hostname in the local host-list or
 *         IPADDR_NONE if not found.
+ * @param dns_addrtype - LWIP_DNS_ADDRTYPE_IPV4_IPV6: try to resolve IPv4 (ATTENTION: no fallback here!)
+ *                     - LWIP_DNS_ADDRTYPE_IPV6_IPV4: try to resolve IPv6 (ATTENTION: no fallback here!)
+ *                     - LWIP_DNS_ADDRTYPE_IPV4: try to resolve IPv4 only
+ *                     - LWIP_DNS_ADDRTYPE_IPV6: try to resolve IPv6 only
 * @return ERR_OK if found, ERR_ARG if not found
 */
+err_t
+dns_local_lookup(const char *hostname, ip_addr_t *addr, u8_t dns_addrtype)
+{
+  LWIP_UNUSED_ARG(dns_addrtype);
+  return dns_lookup_local(hostname, addr LWIP_DNS_ADDRTYPE_ARG(dns_addrtype));
+}
+
+/* Internal implementation for dns_local_lookup and dns_lookup */
 static err_t
 dns_lookup_local(const char *hostname, ip_addr_t *addr LWIP_DNS_ADDRTYPE_ARG(u8_t dns_addrtype))
 {
@@ -523,8 +602,6 @@ static err_t
 dns_lookup(const char *name, ip_addr_t *addr LWIP_DNS_ADDRTYPE_ARG(u8_t dns_addrtype))
 {
  u8_t i;
-#if DNS_LOCAL_HOSTLIST || defined(DNS_LOOKUP_LOCAL_EXTERN)
-#endif /* DNS_LOCAL_HOSTLIST || defined(DNS_LOOKUP_LOCAL_EXTERN) */
 #if DNS_LOCAL_HOSTLIST
  if (dns_lookup_local(name, addr LWIP_DNS_ADDRTYPE_ARG(dns_addrtype)) == ERR_OK) {
    return ERR_OK;
@@ -542,7 +619,7 @@ dns_lookup(const char *name, ip_addr_t *addr LWIP_DNS_ADDRTYPE_ARG(u8_t dns_addr
        (lwip_strnicmp(name, dns_table[i].name, sizeof(dns_table[i].name)) == 0) &&
        LWIP_DNS_ADDRTYPE_MATCH_IP(dns_addrtype, dns_table[i].ipaddr)) {
      LWIP_DEBUGF(DNS_DEBUG, ("dns_lookup: \"%s\": found = ", name));
-      ip_addr_debug_print(DNS_DEBUG, &(dns_table[i].ipaddr));
+      ip_addr_debug_print_val(DNS_DEBUG, dns_table[i].ipaddr);
      LWIP_DEBUGF(DNS_DEBUG, ("\n"));
      if (addr) {
        ip_addr_copy(*addr, dns_table[i].ipaddr);
@@ -560,6 +637,11 @@ dns_lookup(const char *name, ip_addr_t *addr LWIP_DNS_ADDRTYPE_ARG(u8_t dns_addr
 * entry (otherwise, answers might arrive late for hostname not on the list
 * any more).
 *
+ * For now, this function compares case-insensitive to cope with all kinds of
+ * servers. This also means that "dns 0x20 bit encoding" must be checked
+ * externally, if we want to implement it.
+ * Currently, the request is sent exactly as passed in by he user request.
+ *
 * @param query hostname (not encoded) from the dns_table
 * @param p pbuf containing the encoded hostname in the DNS response
 * @param start_offset offset into p where the name starts
@@ -572,10 +654,12 @@ dns_compare_name(const char *query, struct pbuf* p, u16_t start_offset)
  u16_t response_offset = start_offset;

  do {
-    n = pbuf_try_get_at(p, response_offset++);
-    if (n < 0) {
+    n = pbuf_try_get_at(p, response_offset);
+    if ((n < 0) || (response_offset == 0xFFFF)) {
+      /* error or overflow */
      return 0xFFFF;
    }
+    response_offset++;
    /** @see RFC 1035 - 4.1.4. Message compression */
    if ((n & 0xc0) == 0xc0) {
      /* Compressed name: cannot be equal since we don't send them */
@@ -587,10 +671,14 @@ dns_compare_name(const char *query, struct pbuf* p, u16_t start_offset)
        if (c < 0) {
          return 0xFFFF;
        }
-        if ((*query) != (u8_t)c) {
+        if (lwip_tolower((*query)) != lwip_tolower((u8_t)c)) {
          return 0xFFFF;
        }
-        ++response_offset;
+        if (response_offset == 0xFFFF) {
+          /* would overflow */
+          return 0xFFFF;
+        }
+        response_offset++;
        ++query;
        --n;
      }
@@ -602,7 +690,11 @@ dns_compare_name(const char *query, struct pbuf* p, u16_t start_offset)
    }
  } while (n != 0);

-  return response_offset + 1;
+  if (response_offset == 0xFFFF) {
+    /* would overflow */
+    return 0xFFFF;
+  }
+  return (u16_t)(response_offset + 1);
 }

 /**
@@ -620,7 +712,7 @@ dns_skip_name(struct pbuf* p, u16_t query_idx)

  do {
    n = pbuf_try_get_at(p, offset++);
-    if (n < 0) {
+    if ((n < 0) || (offset == 0)) {
      return 0xFFFF;
    }
    /** @see RFC 1035 - 4.1.4. Message compression */
@@ -640,7 +732,10 @@ dns_skip_name(struct pbuf* p, u16_t query_idx)
    }
  } while (n != 0);

-  return offset + 1;
+  if (offset == 0xFFFF) {
+    return 0xFFFF;
+  }
+  return (u16_t)(offset + 1);
 }

 /**
@@ -665,7 +760,11 @@ dns_send(u8_t idx)
  LWIP_DEBUGF(DNS_DEBUG, ("dns_send: dns_servers[%"U16_F"] \"%s\": request\n",
                          (u16_t)(entry->server_idx), entry->name));
  LWIP_ASSERT("dns server out of array", entry->server_idx < DNS_MAX_SERVERS);
-  if (ip_addr_isany_val(dns_servers[entry->server_idx])) {
+  if (ip_addr_isany_val(dns_servers[entry->server_idx])
+#if LWIP_DNS_SUPPORT_MDNS_QUERIES
+      && !entry->is_mdns
+#endif
+     ) {
    /* DNS server not valid anymore, e.g. PPP netif has been shut down */
    /* call specified callback function if provided */
    dns_call_found(idx, NULL);
@@ -678,6 +777,8 @@ dns_send(u8_t idx)
  p = pbuf_alloc(PBUF_TRANSPORT, (u16_t)(SIZEOF_DNS_HDR + strlen(entry->name) + 2 +
                                         SIZEOF_DNS_QUERY), PBUF_RAM);
  if (p != NULL) {
+    const ip_addr_t *dst;
+    u16_t dst_port;
    /* fill dns header */
    memset(&hdr, 0, SIZEOF_DNS_HDR);
    hdr.id = lwip_htons(entry->txid);
@@ -696,9 +797,13 @@ dns_send(u8_t idx)
        ++n;
      }
      copy_len = (u16_t)(hostname - hostname_part);
+      if (query_idx + n + 1 > 0xFFFF) {
+        /* u16_t overflow */
+        goto overflow_return;
+      }
      pbuf_put_at(p, query_idx, n);
-      pbuf_take_at(p, hostname_part, copy_len, query_idx + 1);
-      query_idx += n + 1;
+      pbuf_take_at(p, hostname_part, copy_len, (u16_t)(query_idx + 1));
+      query_idx = (u16_t)(query_idx + n + 1);
    } while (*hostname != 0);
    pbuf_put_at(p, query_idx, 0);
    query_idx++;
@@ -720,7 +825,29 @@ dns_send(u8_t idx)
    /* send dns packet */
    LWIP_DEBUGF(DNS_DEBUG, ("sending DNS request ID %d for name \"%s\" to server %d\r\n",
                            entry->txid, entry->name, entry->server_idx));
-    err = udp_sendto(dns_pcbs[pcb_idx], p, &dns_servers[entry->server_idx], DNS_SERVER_PORT);
+#if LWIP_DNS_SUPPORT_MDNS_QUERIES
+    if (entry->is_mdns) {
+      dst_port = DNS_MQUERY_PORT;
+#if LWIP_IPV6
+      if (LWIP_DNS_ADDRTYPE_IS_IPV6(entry->reqaddrtype)) {
+        dst = &dns_mquery_v6group;
+      }
+#endif
+#if LWIP_IPV4 && LWIP_IPV6
+      else
+#endif
+#if LWIP_IPV4
+      {
+        dst = &dns_mquery_v4group;
+      }
+#endif
+    } else
+#endif /* LWIP_DNS_SUPPORT_MDNS_QUERIES */
+    {
+      dst_port = DNS_SERVER_PORT;
+      dst = &dns_servers[entry->server_idx];
+    }
+    err = udp_sendto(dns_pcbs[pcb_idx], p, dst, dst_port);

    /* free pbuf */
    pbuf_free(p);
@@ -729,6 +856,9 @@ dns_send(u8_t idx)
  }

  return err;
+overflow_return:
+  pbuf_free(p);
+  return ERR_VAL;
 }

 #if ((LWIP_DNS_SECURE & LWIP_DNS_SECURE_RAND_SRC_PORT) != 0)
@@ -736,28 +866,28 @@ static struct udp_pcb*
 dns_alloc_random_port(void)
 {
  err_t err;
-  struct udp_pcb* ret;
+  struct udp_pcb *pcb;

-  ret = udp_new_ip_type(IPADDR_TYPE_ANY);
-  if (ret == NULL) {
+  pcb = udp_new_ip_type(IPADDR_TYPE_ANY);
+  if (pcb == NULL) {
    /* out of memory, have to reuse an existing pcb */
    return NULL;
  }
  do {
    u16_t port = (u16_t)DNS_RAND_TXID();
-    if (!DNS_PORT_ALLOWED(port)) {
+    if (DNS_PORT_ALLOWED(port)) {
+      err = udp_bind(pcb, IP_ANY_TYPE, port);
+    } else {
      /* this port is not allowed, try again */
      err = ERR_USE;
-      continue;
    }
-    err = udp_bind(ret, IP_ANY_TYPE, port);
  } while (err == ERR_USE);
  if (err != ERR_OK) {
-    udp_remove(ret);
+    udp_remove(pcb);
    return NULL;
  }
-  udp_recv(ret, dns_recv, NULL);
-  return ret;
+  udp_recv(pcb, dns_recv, NULL);
+  return pcb;
 }

 /**
@@ -786,8 +916,8 @@ dns_alloc_pcb(void)
    }
  }
  /* if we come here, creating a new UDP pcb failed, so we have to use
-     an already existing one */
-  for (i = 0, idx = dns_last_pcb_idx + 1; i < DNS_MAX_SOURCE_PORTS; i++, idx++) {
+     an already existing one (so overflow is no issue) */
+  for (i = 0, idx = (u8_t)(dns_last_pcb_idx + 1); i < DNS_MAX_SOURCE_PORTS; i++, idx++) {
    if (idx >= DNS_MAX_SOURCE_PORTS) {
      idx = 0;
    }
@@ -887,6 +1017,23 @@ again:
  return txid;
 }

+/**
+ * Check whether there are other backup DNS servers available to try
+ */
+static u8_t
+dns_backupserver_available(struct dns_table_entry *pentry)
+{
+  u8_t ret = 0;
+
+  if (pentry) {
+    if ((pentry->server_idx + 1 < DNS_MAX_SERVERS) && !ip_addr_isany_val(dns_servers[pentry->server_idx + 1])) {
+      ret = 1;
+    }
+  }
+
+  return ret;
+}
+
 /**
 * dns_check_entry() - see if entry has not yet been queried and, if so, sends out a query.
 * Check an entry in the dns_table:
@@ -923,7 +1070,11 @@ dns_check_entry(u8_t i)
    case DNS_STATE_ASKING:
      if (--entry->tmr == 0) {
        if (++entry->retries == DNS_MAX_RETRIES) {
-          if ((entry->server_idx + 1 < DNS_MAX_SERVERS) && !ip_addr_isany_val(dns_servers[entry->server_idx + 1])) {
+          if (dns_backupserver_available(entry)
+#if LWIP_DNS_SUPPORT_MDNS_QUERIES
+              && !entry->is_mdns
+#endif /* LWIP_DNS_SUPPORT_MDNS_QUERIES */
+             ) {
            /* change of server */
            entry->server_idx++;
            entry->tmr = 1;
@@ -979,6 +1130,27 @@ dns_check_entries(void)
  }
 }

+/**
+ * Call dns_answer_ip_validate to check the IP in DNS answer is valid or not
+ */
+static u8_t 
+dns_answer_ip_validate(char *ptr)
+{
+  ip_addr_t ipaddr;
+  u32_t ntohl_addr;
+  
+  /* read the IP address after answer resource record's header */
+  SMEMCPY(&ipaddr, (ptr + SIZEOF_DNS_ANSWER), sizeof(ip_addr_t));
+  ntohl_addr = PP_NTOHL(ipaddr.addr);
+  
+  LWIP_DEBUGF(DNS_DEBUG, ("dns_validate_ip: "));
+  ip_addr_debug_print(DNS_DEBUG, (&ipaddr));
+  LWIP_DEBUGF(DNS_DEBUG, (", n:%x, h:%x\n", ipaddr.addr, ntohl_addr));
+
+  return ((ntohl_addr == IPADDR_ANY) || (ntohl_addr == IPADDR_LOOPBACK) || (ntohl_addr == IPADDR_BROADCAST) || 
+    IP_MULTICAST(ntohl_addr) || IP_BADCLASS(ntohl_addr)) ? 0 : 1;
+}
+
 /**
 * Save TTL and call dns_call_found for correct response.
 */
@@ -990,7 +1162,7 @@ dns_correct_response(u8_t idx, u32_t ttl)
  entry->state = DNS_STATE_DONE;

  LWIP_DEBUGF(DNS_DEBUG, ("dns_recv: \"%s\": response = ", entry->name));
-  ip_addr_debug_print(DNS_DEBUG, (&(entry->ipaddr)));
+  ip_addr_debug_print_val(DNS_DEBUG, entry->ipaddr);
  LWIP_DEBUGF(DNS_DEBUG, ("\n"));

  /* read the answer resource record's TTL, and maximize it if needed */
@@ -1011,6 +1183,7 @@ dns_correct_response(u8_t idx, u32_t ttl)
    }
  }
 }
+
 /**
 * Receive input function for DNS response packets arriving for the dns UDP pcb.
 */
@@ -1033,7 +1206,7 @@ dns_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr,
  if (p->tot_len < (SIZEOF_DNS_HDR + SIZEOF_DNS_QUERY)) {
    LWIP_DEBUGF(DNS_DEBUG, ("dns_recv: pbuf too small\n"));
    /* free pbuf and return */
-    goto memerr;
+    goto ignore_packet;
  }

  /* copy dns payload inside static buffer for processing */
@@ -1041,7 +1214,7 @@ dns_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr,
    /* Match the ID in the DNS header with the name table. */
    txid = lwip_htons(hdr.id);
    for (i = 0; i < DNS_TABLE_SIZE; i++) {
-      const struct dns_table_entry *entry = &dns_table[i];
+      struct dns_table_entry *entry = &dns_table[i];
      if ((entry->state == DNS_STATE_ASKING) &&
          (entry->txid == txid)) {

@@ -1053,17 +1226,22 @@ dns_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr,
        /* Check for correct response. */
        if ((hdr.flags1 & DNS_FLAG1_RESPONSE) == 0) {
          LWIP_DEBUGF(DNS_DEBUG, ("dns_recv: \"%s\": not a response\n", entry->name));
-          goto memerr; /* ignore this packet */
+          goto ignore_packet; /* ignore this packet */
        }
        if (nquestions != 1) {
          LWIP_DEBUGF(DNS_DEBUG, ("dns_recv: \"%s\": response not match to query\n", entry->name));
-          goto memerr; /* ignore this packet */
+          goto ignore_packet; /* ignore this packet */
        }

+#if LWIP_DNS_SUPPORT_MDNS_QUERIES
+        if (!entry->is_mdns)
+#endif /* LWIP_DNS_SUPPORT_MDNS_QUERIES */
+        {
          /* Check whether response comes from the same network address to which the
             question was sent. (RFC 5452) */
          if (!ip_addr_cmp(addr, &dns_servers[entry->server_idx])) {
-          goto memerr; /* ignore this packet */
+            goto ignore_packet; /* ignore this packet */
+          }
        }

        /* Check if the name in the "question" part match with the name in the entry and
@@ -1071,40 +1249,60 @@ dns_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr,
        res_idx = dns_compare_name(entry->name, p, SIZEOF_DNS_HDR);
        if (res_idx == 0xFFFF) {
          LWIP_DEBUGF(DNS_DEBUG, ("dns_recv: \"%s\": response not match to query\n", entry->name));
-          goto memerr; /* ignore this packet */
+          goto ignore_packet; /* ignore this packet */
        }

        /* check if "question" part matches the request */
        if (pbuf_copy_partial(p, &qry, SIZEOF_DNS_QUERY, res_idx) != SIZEOF_DNS_QUERY) {
-          goto memerr; /* ignore this packet */
+          goto ignore_packet; /* ignore this packet */
        }
        if ((qry.cls != PP_HTONS(DNS_RRCLASS_IN)) ||
            (LWIP_DNS_ADDRTYPE_IS_IPV6(entry->reqaddrtype) && (qry.type != PP_HTONS(DNS_RRTYPE_AAAA))) ||
            (!LWIP_DNS_ADDRTYPE_IS_IPV6(entry->reqaddrtype) && (qry.type != PP_HTONS(DNS_RRTYPE_A)))) {
          LWIP_DEBUGF(DNS_DEBUG, ("dns_recv: \"%s\": response not match to query\n", entry->name));
-          goto memerr; /* ignore this packet */
+          goto ignore_packet; /* ignore this packet */
        }
        /* skip the rest of the "question" part */
-        res_idx += SIZEOF_DNS_QUERY;
+        if (res_idx + SIZEOF_DNS_QUERY > 0xFFFF) {
+          goto ignore_packet;
+        }
+        res_idx = (u16_t)(res_idx + SIZEOF_DNS_QUERY);

        /* Check for error. If so, call callback to inform. */
        if (hdr.flags2 & DNS_FLAG2_ERR_MASK) {
          LWIP_DEBUGF(DNS_DEBUG, ("dns_recv: \"%s\": error in flags\n", entry->name));
+
+          /* if there is another backup DNS server to try
+           * then don't stop the DNS request
+           */
+          if (dns_backupserver_available(entry)) {
+            /* avoid retrying the same server */
+            entry->retries = DNS_MAX_RETRIES-1;
+            entry->tmr     = 1;
+
+            /* contact next available server for this entry */
+            dns_check_entry(i);
+
+            goto ignore_packet;
+          }
        } else {
          while ((nanswers > 0) && (res_idx < p->tot_len)) {
            /* skip answer resource record's host name */
            res_idx = dns_skip_name(p, res_idx);
            if (res_idx == 0xFFFF) {
-              goto memerr; /* ignore this packet */
+              goto ignore_packet; /* ignore this packet */
            }

            /* Check for IP address type and Internet class. Others are discarded. */
            if (pbuf_copy_partial(p, &ans, SIZEOF_DNS_ANSWER, res_idx) != SIZEOF_DNS_ANSWER) {
-              goto memerr; /* ignore this packet */
+              goto ignore_packet; /* ignore this packet */
            }
-            res_idx += SIZEOF_DNS_ANSWER;
+            if (res_idx + SIZEOF_DNS_ANSWER > 0xFFFF) {
+              goto ignore_packet;
+            }
+            res_idx = (u16_t)(res_idx + SIZEOF_DNS_ANSWER);

-            if (ans.cls == PP_HTONS(DNS_RRCLASS_IN)) {
+            if (ans.cls == PP_HTONS(DNS_RRCLASS_IN) && dns_answer_ip_validate(p)) {
 #if LWIP_IPV4
              if ((ans.type == PP_HTONS(DNS_RRTYPE_A)) && (ans.len == PP_HTONS(sizeof(ip4_addr_t)))) {
 #if LWIP_IPV4 && LWIP_IPV6
@@ -1114,7 +1312,7 @@ dns_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr,
                  ip4_addr_t ip4addr;
                  /* read the IP address after answer resource record's header */
                  if (pbuf_copy_partial(p, &ip4addr, sizeof(ip4_addr_t), res_idx) != sizeof(ip4_addr_t)) {
-                    goto memerr; /* ignore this packet */
+                    goto ignore_packet; /* ignore this packet */
                  }
                  ip_addr_copy_from_ip4(dns_table[i].ipaddr, ip4addr);
                  pbuf_free(p);
@@ -1125,17 +1323,18 @@ dns_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr,
              }
 #endif /* LWIP_IPV4 */
 #if LWIP_IPV6
-              if ((ans.type == PP_HTONS(DNS_RRTYPE_AAAA)) && (ans.len == PP_HTONS(sizeof(ip6_addr_t)))) {
+              if ((ans.type == PP_HTONS(DNS_RRTYPE_AAAA)) && (ans.len == PP_HTONS(sizeof(ip6_addr_p_t)))) {
 #if LWIP_IPV4 && LWIP_IPV6
                if (LWIP_DNS_ADDRTYPE_IS_IPV6(entry->reqaddrtype))
 #endif /* LWIP_IPV4 && LWIP_IPV6 */
                {
-                  ip6_addr_t ip6addr;
+                  ip6_addr_p_t ip6addr;
                  /* read the IP address after answer resource record's header */
-                  if (pbuf_copy_partial(p, &ip6addr, sizeof(ip6_addr_t), res_idx) != sizeof(ip6_addr_t)) {
-                    goto memerr; /* ignore this packet */
+                  if (pbuf_copy_partial(p, &ip6addr, sizeof(ip6_addr_p_t), res_idx) != sizeof(ip6_addr_p_t)) {
+                    goto ignore_packet; /* ignore this packet */
                  }
-                  ip_addr_copy_from_ip6(dns_table[i].ipaddr, ip6addr);
+                  /* @todo: scope ip6addr? Might be required for link-local addresses at least? */
+                  ip_addr_copy_from_ip6_packed(dns_table[i].ipaddr, ip6addr);
                  pbuf_free(p);
                  /* handle correct response */
                  dns_correct_response(i, lwip_ntohl(ans.ttl));
@@ -1146,9 +1345,9 @@ dns_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr,
            }
            /* skip this answer */
            if ((int)(res_idx + lwip_htons(ans.len)) > 0xFFFF) {
-              goto memerr; /* ignore this packet */
+              goto ignore_packet; /* ignore this packet */
            }
-            res_idx += lwip_htons(ans.len);
+            res_idx = (u16_t)(res_idx + lwip_htons(ans.len));
            --nanswers;
          }
 #if LWIP_IPV4 && LWIP_IPV6
@@ -1178,7 +1377,7 @@ dns_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr,
    }
  }

-memerr:
+ignore_packet:
  /* deallocate memory and return */
  pbuf_free(p);
  return;
@@ -1195,7 +1394,7 @@ memerr:
 */
 static err_t
 dns_enqueue(const char *name, size_t hostnamelen, dns_found_callback found,
-            void *callback_arg LWIP_DNS_ADDRTYPE_ARG(u8_t dns_addrtype))
+            void *callback_arg LWIP_DNS_ADDRTYPE_ARG(u8_t dns_addrtype) LWIP_DNS_ISMDNS_ARG(u8_t is_mdns))
 {
  u8_t i;
  u8_t lseq, lseqi;
@@ -1244,8 +1443,9 @@ dns_enqueue(const char *name, size_t hostnamelen, dns_found_callback found,
    }
    /* check if this is the oldest completed entry */
    if (entry->state == DNS_STATE_DONE) {
-      if ((u8_t)(dns_seqno - entry->seqno) > lseq) {
-        lseq = dns_seqno - entry->seqno;
+      u8_t age = (u8_t)(dns_seqno - entry->seqno);
+      if (age > lseq) {
+        lseq = age;
        lseqi = i;
      }
    }
@@ -1310,6 +1510,10 @@ dns_enqueue(const char *name, size_t hostnamelen, dns_found_callback found,
  LWIP_DEBUGF(DNS_DEBUG, ("dns_enqueue: \"%s\": use DNS pcb %"U16_F"\n", name, (u16_t)(entry->pcb_idx)));
 #endif

+#if LWIP_DNS_SUPPORT_MDNS_QUERIES
+  entry->is_mdns = is_mdns;
+#endif
+
  dns_seqno++;

  /* force to send query without waiting timer */
@@ -1365,6 +1569,9 @@ dns_gethostbyname_addrtype(const char *hostname, ip_addr_t *addr, dns_found_call
                           void *callback_arg, u8_t dns_addrtype)
 {
  size_t hostnamelen;
+#if LWIP_DNS_SUPPORT_MDNS_QUERIES
+  u8_t is_mdns;
+#endif
  /* not initialized or no valid server yet, or invalid addr pointer
   * or invalid hostname or invalid hostname length */
  if ((addr == NULL) ||
@@ -1421,13 +1628,25 @@ dns_gethostbyname_addrtype(const char *hostname, ip_addr_t *addr, dns_found_call
  LWIP_UNUSED_ARG(dns_addrtype);
 #endif /* LWIP_IPV4 && LWIP_IPV6 */

+#if LWIP_DNS_SUPPORT_MDNS_QUERIES
+  if (strstr(hostname, ".local") == &hostname[hostnamelen] - 6) {
+    is_mdns = 1;
+  } else {
+    is_mdns = 0;
+  }
+
+  if (!is_mdns)
+#endif /* LWIP_DNS_SUPPORT_MDNS_QUERIES */
+  {
    /* prevent calling found callback if no server is set, return error instead */
    if (ip_addr_isany_val(dns_servers[0])) {
      return ERR_VAL;
    }
+  }

  /* queue query with specified callback */
-  return dns_enqueue(hostname, hostnamelen, found, callback_arg LWIP_DNS_ADDRTYPE_ARG(dns_addrtype));
+  return dns_enqueue(hostname, hostnamelen, found, callback_arg LWIP_DNS_ADDRTYPE_ARG(dns_addrtype)
+                     LWIP_DNS_ISMDNS_ARG(is_mdns));
 }

 #endif /* LWIP_DNS */
--- a/src/core/inet_chksum.c
+++ b/src/core/inet_chksum.c
@@ -1,6 +1,6 @@
 /**
 * @file
- * Incluse internet checksum functions.\n
+ * Internet checksum functions.\n
 *
 * These are some reference implementations of the checksum algorithm, with the
 * aim of being simple, correct and fully portable. Checksumming is the
@@ -51,7 +51,6 @@
 #include "lwip/def.h"
 #include "lwip/ip_addr.h"

-#include <stddef.h>
 #include <string.h>

 #ifndef LWIP_CHKSUM
@@ -261,7 +260,7 @@ static u16_t
 inet_cksum_pseudo_base(struct pbuf *p, u8_t proto, u16_t proto_len, u32_t acc)
 {
  struct pbuf *q;
-  u8_t swapped = 0;
+  int swapped = 0;

  /* iterate through all pbuf in chain */
  for (q = p; q != NULL; q = q->next) {
@@ -273,7 +272,7 @@ inet_cksum_pseudo_base(struct pbuf *p, u8_t proto, u16_t proto_len, u32_t acc)
       to check whether we really need to execute it, and does no harm */
    acc = FOLD_U32T(acc);
    if (q->len % 2 != 0) {
-      swapped = 1 - swapped;
+      swapped = !swapped;
      acc = SWAP_BYTES_IN_WORD(acc);
    }
    /*LWIP_DEBUGF(INET_DEBUG, ("inet_chksum_pseudo(): wrapped lwip_chksum()=%"X32_F" \n", acc));*/
@@ -316,10 +315,10 @@ inet_chksum_pseudo(struct pbuf *p, u8_t proto, u16_t proto_len,

  addr = ip4_addr_get_u32(src);
  acc = (addr & 0xffffUL);
-  acc += ((addr >> 16) & 0xffffUL);
+  acc = (u32_t)(acc + ((addr >> 16) & 0xffffUL));
  addr = ip4_addr_get_u32(dest);
-  acc += (addr & 0xffffUL);
-  acc += ((addr >> 16) & 0xffffUL);
+  acc = (u32_t)(acc + (addr & 0xffffUL));
+  acc = (u32_t)(acc + ((addr >> 16) & 0xffffUL));
  /* fold down to 16 bits */
  acc = FOLD_U32T(acc);
  acc = FOLD_U32T(acc);
@@ -350,11 +349,11 @@ ip6_chksum_pseudo(struct pbuf *p, u8_t proto, u16_t proto_len,

  for (addr_part = 0; addr_part < 4; addr_part++) {
    addr = src->addr[addr_part];
-    acc += (addr & 0xffffUL);
-    acc += ((addr >> 16) & 0xffffUL);
+    acc = (u32_t)(acc + (addr & 0xffffUL));
+    acc = (u32_t)(acc + ((addr >> 16) & 0xffffUL));
    addr = dest->addr[addr_part];
-    acc += (addr & 0xffffUL);
-    acc += ((addr >> 16) & 0xffffUL);
+    acc = (u32_t)(acc + (addr & 0xffffUL));
+    acc = (u32_t)(acc + ((addr >> 16) & 0xffffUL));
  }
  /* fold down to 16 bits */
  acc = FOLD_U32T(acc);
@@ -401,7 +400,7 @@ inet_cksum_pseudo_partial_base(struct pbuf *p, u8_t proto, u16_t proto_len,
                               u16_t chksum_len, u32_t acc)
 {
  struct pbuf *q;
-  u8_t swapped = 0;
+  int swapped = 0;
  u16_t chklen;

  /* iterate through all pbuf in chain */
@@ -413,13 +412,13 @@ inet_cksum_pseudo_partial_base(struct pbuf *p, u8_t proto, u16_t proto_len,
      chklen = chksum_len;
    }
    acc += LWIP_CHKSUM(q->payload, chklen);
-    chksum_len -= chklen;
+    chksum_len = (u16_t)(chksum_len - chklen);
    LWIP_ASSERT("delete me", chksum_len < 0x7fff);
    /*LWIP_DEBUGF(INET_DEBUG, ("inet_chksum_pseudo(): unwrapped lwip_chksum()=%"X32_F" \n", acc));*/
    /* fold the upper bit down */
    acc = FOLD_U32T(acc);
    if (q->len % 2 != 0) {
-      swapped = 1 - swapped;
+      swapped = !swapped;
      acc = SWAP_BYTES_IN_WORD(acc);
    }
    /*LWIP_DEBUGF(INET_DEBUG, ("inet_chksum_pseudo(): wrapped lwip_chksum()=%"X32_F" \n", acc));*/
@@ -462,10 +461,10 @@ inet_chksum_pseudo_partial(struct pbuf *p, u8_t proto, u16_t proto_len,

  addr = ip4_addr_get_u32(src);
  acc = (addr & 0xffffUL);
-  acc += ((addr >> 16) & 0xffffUL);
+  acc = (u32_t)(acc + ((addr >> 16) & 0xffffUL));
  addr = ip4_addr_get_u32(dest);
-  acc += (addr & 0xffffUL);
-  acc += ((addr >> 16) & 0xffffUL);
+  acc = (u32_t)(acc + (addr & 0xffffUL));
+  acc = (u32_t)(acc + ((addr >> 16) & 0xffffUL));
  /* fold down to 16 bits */
  acc = FOLD_U32T(acc);
  acc = FOLD_U32T(acc);
@@ -498,11 +497,11 @@ ip6_chksum_pseudo_partial(struct pbuf *p, u8_t proto, u16_t proto_len,

  for (addr_part = 0; addr_part < 4; addr_part++) {
    addr = src->addr[addr_part];
-    acc += (addr & 0xffffUL);
-    acc += ((addr >> 16) & 0xffffUL);
+    acc = (u32_t)(acc + (addr & 0xffffUL));
+    acc = (u32_t)(acc + ((addr >> 16) & 0xffffUL));
    addr = dest->addr[addr_part];
-    acc += (addr & 0xffffUL);
-    acc += ((addr >> 16) & 0xffffUL);
+    acc = (u32_t)(acc + (addr & 0xffffUL));
+    acc = (u32_t)(acc + ((addr >> 16) & 0xffffUL));
  }
  /* fold down to 16 bits */
  acc = FOLD_U32T(acc);
@@ -570,15 +569,14 @@ inet_chksum_pbuf(struct pbuf *p)
 {
  u32_t acc;
  struct pbuf *q;
-  u8_t swapped;
+  int swapped = 0;

  acc = 0;
-  swapped = 0;
  for (q = p; q != NULL; q = q->next) {
    acc += LWIP_CHKSUM(q->payload, q->len);
    acc = FOLD_U32T(acc);
    if (q->len % 2 != 0) {
-      swapped = 1 - swapped;
+      swapped = !swapped;
      acc = SWAP_BYTES_IN_WORD(acc);
    }
  }
--- a/src/core/init.c
+++ b/src/core/init.c
@@ -67,8 +67,7 @@
 #  include "arch/bpstruct.h"
 #endif
 PACK_STRUCT_BEGIN
-struct packed_struct_test
-{
+struct packed_struct_test {
  PACK_STRUCT_FLD_8(u8_t  dummy1);
  PACK_STRUCT_FIELD(u32_t dummy2);
 } PACK_STRUCT_STRUCT;
@@ -95,8 +94,8 @@ PACK_STRUCT_END
 #if (!LWIP_UDP && LWIP_DHCP)
 #error "If you want to use DHCP, you have to define LWIP_UDP=1 in your lwipopts.h"
 #endif
-#if (!LWIP_UDP && LWIP_MULTICAST_TX_OPTIONS)
-  #error "If you want to use IGMP/LWIP_MULTICAST_TX_OPTIONS, you have to define LWIP_UDP=1 in your lwipopts.h"
+#if (!LWIP_UDP && !LWIP_RAW && LWIP_MULTICAST_TX_OPTIONS)
+#error "If you want to use LWIP_MULTICAST_TX_OPTIONS, you have to define LWIP_UDP=1 and/or LWIP_RAW=1 in your lwipopts.h"
 #endif
 #if (!LWIP_UDP && LWIP_DNS)
 #error "If you want to use DNS, you have to define LWIP_UDP=1 in your lwipopts.h"
@@ -123,14 +122,11 @@ PACK_STRUCT_END
 #if (LWIP_IGMP && !LWIP_IPV4)
 #error "IGMP needs LWIP_IPV4 enabled in your lwipopts.h"
 #endif
-#if (LWIP_MULTICAST_TX_OPTIONS && !LWIP_IPV4)
-  #error "LWIP_MULTICAST_TX_OPTIONS needs LWIP_IPV4 enabled in your lwipopts.h"
-#endif
 #if ((LWIP_NETCONN || LWIP_SOCKET) && (MEMP_NUM_TCPIP_MSG_API<=0))
 #error "If you want to use Sequential API, you have to define MEMP_NUM_TCPIP_MSG_API>=1 in your lwipopts.h"
 #endif
 /* There must be sufficient timeouts, taking into account requirements of the subsystems. */
-#if LWIP_TIMERS && (MEMP_NUM_SYS_TIMEOUT < (LWIP_TCP + IP_REASSEMBLY + LWIP_ARP + (2*LWIP_DHCP) + LWIP_AUTOIP + LWIP_IGMP + LWIP_DNS + PPP_SUPPORT + (LWIP_IPV6 ? (1 + LWIP_IPV6_REASS + LWIP_IPV6_MLD) : 0)))
+#if LWIP_TIMERS && (MEMP_NUM_SYS_TIMEOUT < LWIP_NUM_SYS_TIMEOUT_INTERNAL)
 #error "MEMP_NUM_SYS_TIMEOUT is too low to accomodate all required timeouts"
 #endif
 #if (IP_REASSEMBLY && (MEMP_NUM_REASSDATA > IP_REASS_MAX_PBUFS))
@@ -141,7 +137,7 @@ PACK_STRUCT_END
 #if (LWIP_TCP && (TCP_WND > 0xffffffff))
 #error "If you want to use TCP, TCP_WND must fit in an u32_t, so, you have to reduce it in your lwipopts.h"
 #endif
-#if (LWIP_TCP && LWIP_WND_SCALE && (TCP_RCV_SCALE > 14))
+#if (LWIP_TCP && (TCP_RCV_SCALE > 14))
 #error "The maximum valid window scale value is 14!"
 #endif
 #if (LWIP_TCP && (TCP_WND > (0xFFFFU << TCP_RCV_SCALE)))
@@ -167,6 +163,12 @@ PACK_STRUCT_END
 #if (LWIP_TCP && TCP_LISTEN_BACKLOG && ((TCP_DEFAULT_LISTEN_BACKLOG < 0) || (TCP_DEFAULT_LISTEN_BACKLOG > 0xff)))
 #error "If you want to use TCP backlog, TCP_DEFAULT_LISTEN_BACKLOG must fit into an u8_t"
 #endif
+#if (LWIP_TCP && LWIP_TCP_SACK_OUT && !TCP_QUEUE_OOSEQ)
+#error "To use LWIP_TCP_SACK_OUT, TCP_QUEUE_OOSEQ needs to be enabled"
+#endif
+#if (LWIP_TCP && LWIP_TCP_SACK_OUT && (LWIP_TCP_MAX_SACK_NUM < 1))
+#error "LWIP_TCP_MAX_SACK_NUM must be greater than 0"
+#endif
 #if (LWIP_NETIF_API && (NO_SYS==1))
 #error "If you want to use NETIF API, you have to define NO_SYS=0 in your lwipopts.h"
 #endif
@@ -191,6 +193,9 @@ PACK_STRUCT_END
 #if (LWIP_TCP && ((LWIP_EVENT_API && LWIP_CALLBACK_API) || (!LWIP_EVENT_API && !LWIP_CALLBACK_API)))
 #error "One and exactly one of LWIP_EVENT_API and LWIP_CALLBACK_API has to be enabled in your lwipopts.h"
 #endif
+#if (LWIP_ALTCP && LWIP_EVENT_API)
+#error "The application layered tcp API does not work with LWIP_EVENT_API"
+#endif
 #if (MEM_LIBC_MALLOC && MEM_USE_POOLS)
 #error "MEM_LIBC_MALLOC and MEM_USE_POOLS may not both be simultaneously enabled in your lwipopts.h"
 #endif
@@ -218,9 +223,6 @@ PACK_STRUCT_END
 #if !LWIP_ETHERNET && (LWIP_ARP || PPPOE_SUPPORT)
 #error "LWIP_ETHERNET needs to be turned on for LWIP_ARP or PPPOE_SUPPORT"
 #endif
-#if (LWIP_IGMP || LWIP_IPV6) && !defined(LWIP_RAND)
-  #error "When using IGMP or IPv6, LWIP_RAND() needs to be defined to a random-function returning an u32_t random value (in arch/cc.h)"
-#endif
 #if LWIP_TCPIP_CORE_LOCKING_INPUT && !LWIP_TCPIP_CORE_LOCKING
 #error "When using LWIP_TCPIP_CORE_LOCKING_INPUT, LWIP_TCPIP_CORE_LOCKING must be enabled, too"
 #endif
@@ -235,18 +237,9 @@ PACK_STRUCT_END
 #error "NETCONN_MORE != TCP_WRITE_FLAG_MORE"
 #endif
 #endif /* LWIP_NETCONN && LWIP_TCP */
-#if LWIP_SOCKET
-/* Check that the SO_* socket options and SOF_* lwIP-internal flags match */
-#if SO_REUSEADDR != SOF_REUSEADDR
-  #error "WARNING: SO_REUSEADDR != SOF_REUSEADDR"
+#if LWIP_NETCONN_FULLDUPLEX && !LWIP_NETCONN_SEM_PER_THREAD
+#error "For LWIP_NETCONN_FULLDUPLEX to work, LWIP_NETCONN_SEM_PER_THREAD is required"
 #endif
-#if SO_KEEPALIVE != SOF_KEEPALIVE
-  #error "WARNING: SO_KEEPALIVE != SOF_KEEPALIVE"
-#endif
-#if SO_BROADCAST != SOF_BROADCAST
-  #error "WARNING: SO_BROADCAST != SOF_BROADCAST"
-#endif
-#endif /* LWIP_SOCKET */


 /* Compile-time checks for deprecated options.
@@ -339,6 +332,11 @@ PACK_STRUCT_END
 void
 lwip_init(void)
 {
+#ifndef LWIP_SKIP_CONST_CHECK
+  int a = 0;
+  LWIP_UNUSED_ARG(a);
+  LWIP_ASSERT("LWIP_CONST_CAST not implemented correctly. Check your lwIP port.", LWIP_CONST_CAST(void *, &a) == &a);
+#endif
 #ifndef LWIP_SKIP_PACKING_CHECK
  LWIP_ASSERT("Struct packing not implemented correctly. Check your lwIP port.", sizeof(struct packed_struct_test) == PACKED_STRUCT_TEST_EXPECTED_SIZE);
 #endif
--- a/src/core/ip.c
+++ b/src/core/ip.c
@@ -67,6 +67,49 @@ struct ip_globals ip_data;

 const ip_addr_t ip_addr_any_type = IPADDR_ANY_TYPE_INIT;

+/**
+ * @ingroup ipaddr
+ * Convert numeric IP address (both versions) into ASCII representation.
+ * returns ptr to static buffer; not reentrant!
+ *
+ * @param addr ip address in network order to convert
+ * @return pointer to a global static (!) buffer that holds the ASCII
+ *         representation of addr
+ */
+char *ipaddr_ntoa(const ip_addr_t *addr)
+{
+  if (addr == NULL) {
+    return NULL;
+  }
+  if (IP_IS_V6(addr)) {
+    return ip6addr_ntoa(ip_2_ip6(addr));
+  } else {
+    return ip4addr_ntoa(ip_2_ip4(addr));
+  }
+}
+
+/**
+ * @ingroup ipaddr
+ * Same as ipaddr_ntoa, but reentrant since a user-supplied buffer is used.
+ *
+ * @param addr ip address in network order to convert
+ * @param buf target buffer where the string is stored
+ * @param buflen length of buf
+ * @return either pointer to buf which now holds the ASCII
+ *         representation of addr or NULL if buf was too small
+ */
+char *ipaddr_ntoa_r(const ip_addr_t *addr, char *buf, int buflen)
+{
+  if (addr == NULL) {
+    return NULL;
+  }
+  if (IP_IS_V6(addr)) {
+    return ip6addr_ntoa_r(ip_2_ip6(addr), buf, buflen);
+  } else {
+    return ip4addr_ntoa_r(ip_2_ip4(addr), buf, buflen);
+  }
+}
+
 /**
 * @ingroup ipaddr
 * Convert IP address string (both versions) to numeric.
--- a/Show More
+++ b/Show More