diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 1b2d4db..4d2032e 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -20,67 +20,67 @@
  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
-#if !defined(POLARSSL_CONFIG_FILE)
+#if !defined(MBEDTLS_CONFIG_FILE)
 #include "mbedtls/config.h"
 #else
-#include POLARSSL_CONFIG_FILE
+#include MBEDTLS_CONFIG_FILE
 #endif
 
-#if defined(POLARSSL_SSL_SRV_C)
+#if defined(MBEDTLS_SSL_SRV_C)
 
 #include "mbedtls/debug.h"
 #include "mbedtls/ssl.h"
 
 #include <string.h>
 
-#if defined(POLARSSL_ECP_C)
+#if defined(MBEDTLS_ECP_C)
 #include "mbedtls/ecp.h"
 #endif
 
-#if defined(POLARSSL_PLATFORM_C)
+#if defined(MBEDTLS_PLATFORM_C)
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define polarssl_malloc     malloc
-#define polarssl_free       free
+#define mbedtls_malloc     malloc
+#define mbedtls_free       free
 #endif
 
-#if defined(POLARSSL_HAVE_TIME)
+#if defined(MBEDTLS_HAVE_TIME)
 #include <time.h>
 #endif
 
-#if defined(POLARSSL_SSL_SESSION_TICKETS)
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
 /* Implementation that should never be optimized out by the compiler */
-static void polarssl_zeroize( void *v, size_t n ) {
+static void mbedtls_zeroize( void *v, size_t n ) {
     volatile unsigned char *p = v; while( n-- ) *p++ = 0;
 }
 
 /*
  * Serialize a session in the following format:
- *  0   .   n-1     session structure, n = sizeof(ssl_session)
+ *  0   .   n-1     session structure, n = sizeof(mbedtls_ssl_session)
  *  n   .   n+2     peer_cert length = m (0 if no certificate)
  *  n+3 .   n+2+m   peer cert ASN.1
  *
  *  Assumes ticket is NULL (always true on server side).
  */
-static int ssl_save_session( const ssl_session *session,
+static int ssl_save_session( const mbedtls_ssl_session *session,
                              unsigned char *buf, size_t buf_len,
                              size_t *olen )
 {
     unsigned char *p = buf;
     size_t left = buf_len;
-#if defined(POLARSSL_X509_CRT_PARSE_C)
+#if defined(MBEDTLS_X509_CRT_PARSE_C)
     size_t cert_len;
-#endif /* POLARSSL_X509_CRT_PARSE_C */
+#endif /* MBEDTLS_X509_CRT_PARSE_C */
 
-    if( left < sizeof( ssl_session ) )
+    if( left < sizeof( mbedtls_ssl_session ) )
         return( -1 );
 
-    memcpy( p, session, sizeof( ssl_session ) );
-    p += sizeof( ssl_session );
-    left -= sizeof( ssl_session );
+    memcpy( p, session, sizeof( mbedtls_ssl_session ) );
+    p += sizeof( mbedtls_ssl_session );
+    left -= sizeof( mbedtls_ssl_session );
 
-#if defined(POLARSSL_X509_CRT_PARSE_C)
+#if defined(MBEDTLS_X509_CRT_PARSE_C)
     if( session->peer_cert == NULL )
         cert_len = 0;
     else
@@ -97,7 +97,7 @@
         memcpy( p, session->peer_cert->raw.p, cert_len );
 
     p += cert_len;
-#endif /* POLARSSL_X509_CRT_PARSE_C */
+#endif /* MBEDTLS_X509_CRT_PARSE_C */
 
     *olen = p - buf;
 
@@ -107,24 +107,24 @@
 /*
  * Unserialise session, see ssl_save_session()
  */
-static int ssl_load_session( ssl_session *session,
+static int ssl_load_session( mbedtls_ssl_session *session,
                              const unsigned char *buf, size_t len )
 {
     const unsigned char *p = buf;
     const unsigned char * const end = buf + len;
-#if defined(POLARSSL_X509_CRT_PARSE_C)
+#if defined(MBEDTLS_X509_CRT_PARSE_C)
     size_t cert_len;
-#endif /* POLARSSL_X509_CRT_PARSE_C */
+#endif /* MBEDTLS_X509_CRT_PARSE_C */
 
-    if( p + sizeof( ssl_session ) > end )
-        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+    if( p + sizeof( mbedtls_ssl_session ) > end )
+        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
-    memcpy( session, p, sizeof( ssl_session ) );
-    p += sizeof( ssl_session );
+    memcpy( session, p, sizeof( mbedtls_ssl_session ) );
+    p += sizeof( mbedtls_ssl_session );
 
-#if defined(POLARSSL_X509_CRT_PARSE_C)
+#if defined(MBEDTLS_X509_CRT_PARSE_C)
     if( p + 3 > end )
-        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
     cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
     p += 3;
@@ -138,30 +138,30 @@
         int ret;
 
         if( p + cert_len > end )
-            return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
-        session->peer_cert = polarssl_malloc( sizeof( x509_crt ) );
+        session->peer_cert = mbedtls_malloc( sizeof( mbedtls_x509_crt ) );
 
         if( session->peer_cert == NULL )
-            return( POLARSSL_ERR_SSL_MALLOC_FAILED );
+            return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
-        x509_crt_init( session->peer_cert );
+        mbedtls_x509_crt_init( session->peer_cert );
 
-        if( ( ret = x509_crt_parse_der( session->peer_cert,
+        if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
                                         p, cert_len ) ) != 0 )
         {
-            x509_crt_free( session->peer_cert );
-            polarssl_free( session->peer_cert );
+            mbedtls_x509_crt_free( session->peer_cert );
+            mbedtls_free( session->peer_cert );
             session->peer_cert = NULL;
             return( ret );
         }
 
         p += cert_len;
     }
-#endif /* POLARSSL_X509_CRT_PARSE_C */
+#endif /* MBEDTLS_X509_CRT_PARSE_C */
 
     if( p != end )
-        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
     return( 0 );
 }
@@ -178,7 +178,7 @@
  *
  * (the internal state structure differs, however).
  */
-static int ssl_write_ticket( ssl_context *ssl, size_t *tlen )
+static int ssl_write_ticket( mbedtls_ssl_context *ssl, size_t *tlen )
 {
     int ret;
     unsigned char * const start = ssl->out_msg + 10;
@@ -190,7 +190,7 @@
     *tlen = 0;
 
     if( ssl->ticket_keys == NULL )
-        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
     /* Write key name */
     memcpy( p, ssl->ticket_keys->key_name, 16 );
@@ -210,12 +210,12 @@
      */
     state = p + 2;
     if( ssl_save_session( ssl->session_negotiate, state,
-                          SSL_MAX_CONTENT_LEN - ( state - ssl->out_msg ) - 48,
+                          MBEDTLS_SSL_MAX_CONTENT_LEN - ( state - ssl->out_msg ) - 48,
                           &clear_len ) != 0 )
     {
-        return( POLARSSL_ERR_SSL_CERTIFICATE_TOO_LARGE );
+        return( MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE );
     }
-    SSL_DEBUG_BUF( 3, "session ticket cleartext", state, clear_len );
+    MBEDTLS_SSL_DEBUG_BUF( 3, "session ticket cleartext", state, clear_len );
 
     /* Apply PKCS padding */
     pad_len = 16 - clear_len % 16;
@@ -224,7 +224,7 @@
         state[i] = (unsigned char) pad_len;
 
     /* Encrypt */
-    if( ( ret = aes_crypt_cbc( &ssl->ticket_keys->enc, AES_ENCRYPT,
+    if( ( ret = mbedtls_aes_crypt_cbc( &ssl->ticket_keys->enc, MBEDTLS_AES_ENCRYPT,
                                enc_len, iv, state, state ) ) != 0 )
     {
         return( ret );
@@ -236,7 +236,7 @@
     p = state + enc_len;
 
     /* Compute and write MAC( key_name + iv + enc_state_len + enc_state ) */
-    if( ( ret = md_hmac( md_info_from_type( POLARSSL_MD_SHA256 ),
+    if( ( ret = mbedtls_md_hmac( mbedtls_md_info_from_type( MBEDTLS_MD_SHA256 ),
                          ssl->ticket_keys->mac_key, 16,
                          start, p - start, p ) ) != 0 )
     {
@@ -246,7 +246,7 @@
 
     *tlen = p - start;
 
-    SSL_DEBUG_BUF( 3, "session ticket structure", start, *tlen );
+    MBEDTLS_SSL_DEBUG_BUF( 3, "session ticket structure", start, *tlen );
 
     return( 0 );
 }
@@ -254,12 +254,12 @@
 /*
  * Load session ticket (see ssl_write_ticket for structure)
  */
-static int ssl_parse_ticket( ssl_context *ssl,
+static int ssl_parse_ticket( mbedtls_ssl_context *ssl,
                              unsigned char *buf,
                              size_t len )
 {
     int ret;
-    ssl_session session;
+    mbedtls_ssl_session session;
     unsigned char *key_name = buf;
     unsigned char *iv = buf + 16;
     unsigned char *enc_len_p = iv + 16;
@@ -269,16 +269,16 @@
     size_t enc_len, clear_len, i;
     unsigned char pad_len, diff;
 
-    SSL_DEBUG_BUF( 3, "session ticket structure", buf, len );
+    MBEDTLS_SSL_DEBUG_BUF( 3, "session ticket structure", buf, len );
 
     if( len < 34 || ssl->ticket_keys == NULL )
-        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
     enc_len = ( enc_len_p[0] << 8 ) | enc_len_p[1];
     mac = ticket + enc_len;
 
     if( len != enc_len + 66 )
-        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
     /* Check name, in constant time though it's not a big secret */
     diff = 0;
@@ -287,7 +287,7 @@
     /* don't return yet, check the MAC anyway */
 
     /* Check mac, with constant-time buffer comparison */
-    if( ( ret = md_hmac( md_info_from_type( POLARSSL_MD_SHA256 ),
+    if( ( ret = mbedtls_md_hmac( mbedtls_md_info_from_type( MBEDTLS_MD_SHA256 ),
                          ssl->ticket_keys->mac_key, 16,
                          buf, len - 32, computed_mac ) ) != 0 )
     {
@@ -300,10 +300,10 @@
     /* Now return if ticket is not authentic, since we want to avoid
      * decrypting arbitrary attacker-chosen data */
     if( diff != 0 )
-        return( POLARSSL_ERR_SSL_INVALID_MAC );
+        return( MBEDTLS_ERR_SSL_INVALID_MAC );
 
     /* Decrypt */
-    if( ( ret = aes_crypt_cbc( &ssl->ticket_keys->dec, AES_DECRYPT,
+    if( ( ret = mbedtls_aes_crypt_cbc( &ssl->ticket_keys->dec, MBEDTLS_AES_DECRYPT,
                                enc_len, iv, ticket, ticket ) ) != 0 )
     {
         return( ret );
@@ -315,29 +315,29 @@
     ret = 0;
     for( i = 2; i < pad_len; i++ )
         if( ticket[enc_len - i] != pad_len )
-            ret = POLARSSL_ERR_SSL_BAD_INPUT_DATA;
+            ret = MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
     if( ret != 0 )
         return( ret );
 
     clear_len = enc_len - pad_len;
 
-    SSL_DEBUG_BUF( 3, "session ticket cleartext", ticket, clear_len );
+    MBEDTLS_SSL_DEBUG_BUF( 3, "session ticket cleartext", ticket, clear_len );
 
     /* Actually load session */
     if( ( ret = ssl_load_session( &session, ticket, clear_len ) ) != 0 )
     {
-        SSL_DEBUG_MSG( 1, ( "failed to parse ticket content" ) );
-        ssl_session_free( &session );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to parse ticket content" ) );
+        mbedtls_ssl_session_free( &session );
         return( ret );
     }
 
-#if defined(POLARSSL_HAVE_TIME)
+#if defined(MBEDTLS_HAVE_TIME)
     /* Check if still valid */
     if( (int) ( time( NULL) - session.start ) > ssl->ticket_lifetime )
     {
-        SSL_DEBUG_MSG( 1, ( "session ticket expired" ) );
-        ssl_session_free( &session );
-        return( POLARSSL_ERR_SSL_SESSION_TICKET_EXPIRED );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "session ticket expired" ) );
+        mbedtls_ssl_session_free( &session );
+        return( MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED );
     }
 #endif
 
@@ -348,28 +348,28 @@
     session.length = ssl->session_negotiate->length;
     memcpy( &session.id, ssl->session_negotiate->id, session.length );
 
-    ssl_session_free( ssl->session_negotiate );
-    memcpy( ssl->session_negotiate, &session, sizeof( ssl_session ) );
+    mbedtls_ssl_session_free( ssl->session_negotiate );
+    memcpy( ssl->session_negotiate, &session, sizeof( mbedtls_ssl_session ) );
 
     /* Zeroize instead of free as we copied the content */
-    polarssl_zeroize( &session, sizeof( ssl_session ) );
+    mbedtls_zeroize( &session, sizeof( mbedtls_ssl_session ) );
 
     return( 0 );
 }
-#endif /* POLARSSL_SSL_SESSION_TICKETS */
+#endif /* MBEDTLS_SSL_SESSION_TICKETS */
 
-#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
-int ssl_set_client_transport_id( ssl_context *ssl,
+#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
+int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
                                  const unsigned char *info,
                                  size_t ilen )
 {
-    if( ssl->endpoint != SSL_IS_SERVER )
-        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+    if( ssl->endpoint != MBEDTLS_SSL_IS_SERVER )
+        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
-    polarssl_free( ssl->cli_id );
+    mbedtls_free( ssl->cli_id );
 
-    if( ( ssl->cli_id = polarssl_malloc( ilen ) ) == NULL )
-        return( POLARSSL_ERR_SSL_MALLOC_FAILED );
+    if( ( ssl->cli_id = mbedtls_malloc( ilen ) ) == NULL )
+        return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
     memcpy( ssl->cli_id, info, ilen );
     ssl->cli_id_len = ilen;
@@ -377,27 +377,27 @@
     return( 0 );
 }
 
-void ssl_set_dtls_cookies( ssl_context *ssl,
-                           ssl_cookie_write_t *f_cookie_write,
-                           ssl_cookie_check_t *f_cookie_check,
+void mbedtls_ssl_set_dtls_cookies( mbedtls_ssl_context *ssl,
+                           mbedtls_ssl_cookie_write_t *f_cookie_write,
+                           mbedtls_ssl_cookie_check_t *f_cookie_check,
                            void *p_cookie )
 {
     ssl->f_cookie_write = f_cookie_write;
     ssl->f_cookie_check = f_cookie_check;
     ssl->p_cookie       = p_cookie;
 }
-#endif /* POLARSSL_SSL_DTLS_HELLO_VERIFY */
+#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
 
-#if defined(POLARSSL_SSL_SERVER_NAME_INDICATION)
+#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
 /*
- * Wrapper around f_sni, allowing use of ssl_set_own_cert() but
+ * Wrapper around f_sni, allowing use of mbedtls_ssl_set_own_cert() but
  * making it act on ssl->handshake->sni_key_cert instead.
  */
-static int ssl_sni_wrapper( ssl_context *ssl,
+static int ssl_sni_wrapper( mbedtls_ssl_context *ssl,
                             const unsigned char* name, size_t len )
 {
     int ret;
-    ssl_key_cert *key_cert_ori = ssl->key_cert;
+    mbedtls_ssl_key_cert *key_cert_ori = ssl->key_cert;
 
     ssl->key_cert = NULL;
     ret = ssl->f_sni( ssl->p_sni, ssl, name, len );
@@ -408,7 +408,7 @@
     return( ret );
 }
 
-static int ssl_parse_servername_ext( ssl_context *ssl,
+static int ssl_parse_servername_ext( mbedtls_ssl_context *ssl,
                                      const unsigned char *buf,
                                      size_t len )
 {
@@ -416,13 +416,13 @@
     size_t servername_list_size, hostname_len;
     const unsigned char *p;
 
-    SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
 
     servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
     if( servername_list_size + 2 != len )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     p = buf + 2;
@@ -431,19 +431,19 @@
         hostname_len = ( ( p[1] << 8 ) | p[2] );
         if( hostname_len + 3 > servername_list_size )
         {
-            SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
         }
 
-        if( p[0] == TLS_EXT_SERVERNAME_HOSTNAME )
+        if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
         {
             ret = ssl_sni_wrapper( ssl, p + 3, hostname_len );
             if( ret != 0 )
             {
-                SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
-                ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
-                        SSL_ALERT_MSG_UNRECOGNIZED_NAME );
-                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+                MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
+                mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+                        MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME );
+                return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
             }
             return( 0 );
         }
@@ -454,59 +454,59 @@
 
     if( servername_list_size != 0 )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     return( 0 );
 }
-#endif /* POLARSSL_SSL_SERVER_NAME_INDICATION */
+#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
 
-static int ssl_parse_renegotiation_info( ssl_context *ssl,
+static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
                                          const unsigned char *buf,
                                          size_t len )
 {
     int ret;
 
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-    if( ssl->renego_status != SSL_INITIAL_HANDSHAKE )
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+    if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
     {
         /* Check verify-data in constant-time. The length OTOH is no secret */
         if( len    != 1 + ssl->verify_data_len ||
             buf[0] !=     ssl->verify_data_len ||
-            safer_memcmp( buf + 1, ssl->peer_verify_data,
+            mbedtls_ssl_safer_memcmp( buf + 1, ssl->peer_verify_data,
                           ssl->verify_data_len ) != 0 )
         {
-            SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
 
-            if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
+            if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
                 return( ret );
 
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
         }
     }
     else
-#endif /* POLARSSL_SSL_RENEGOTIATION */
+#endif /* MBEDTLS_SSL_RENEGOTIATION */
     {
         if( len != 1 || buf[0] != 0x0 )
         {
-            SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
 
-            if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
+            if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
                 return( ret );
 
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
         }
 
-        ssl->secure_renegotiation = SSL_SECURE_RENEGOTIATION;
+        ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
     }
 
     return( 0 );
 }
 
-#if defined(POLARSSL_SSL_PROTO_TLS1_2) && \
-    defined(POLARSSL_KEY_EXCHANGE__WITH_CERT__ENABLED)
-static int ssl_parse_signature_algorithms_ext( ssl_context *ssl,
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
+    defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
+static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl,
                                                const unsigned char *buf,
                                                size_t len )
 {
@@ -520,8 +520,8 @@
     if( sig_alg_list_size + 2 != len ||
         sig_alg_list_size % 2 != 0 )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     /*
@@ -530,9 +530,9 @@
      *
      * So, just look at the HashAlgorithm part.
      */
-    for( md_cur = md_list(); *md_cur != POLARSSL_MD_NONE; md_cur++ ) {
+    for( md_cur = mbedtls_md_list(); *md_cur != MBEDTLS_MD_NONE; md_cur++ ) {
         for( p = buf + 2; p < end; p += 2 ) {
-            if( *md_cur == (int) ssl_md_alg_from_hash( p[0] ) ) {
+            if( *md_cur == (int) mbedtls_ssl_md_alg_from_hash( p[0] ) ) {
                 ssl->handshake->sig_alg = p[0];
                 goto have_sig_alg;
             }
@@ -540,50 +540,50 @@
     }
 
     /* Some key echanges do not need signatures at all */
-    SSL_DEBUG_MSG( 3, ( "no signature_algorithm in common" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "no signature_algorithm in common" ) );
     return( 0 );
 
 have_sig_alg:
-    SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
                    ssl->handshake->sig_alg ) );
 
     return( 0 );
 }
-#endif /* POLARSSL_SSL_PROTO_TLS1_2 &&
-          POLARSSL_KEY_EXCHANGE__WITH_CERT__ENABLED */
+#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
+          MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
 
-#if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
-static int ssl_parse_supported_elliptic_curves( ssl_context *ssl,
+#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
+static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl,
                                                 const unsigned char *buf,
                                                 size_t len )
 {
     size_t list_size, our_size;
     const unsigned char *p;
-    const ecp_curve_info *curve_info, **curves;
+    const mbedtls_ecp_curve_info *curve_info, **curves;
 
     list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
     if( list_size + 2 != len ||
         list_size % 2 != 0 )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     /* Should never happen unless client duplicates the extension */
     if( ssl->handshake->curves != NULL )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     /* Don't allow our peer to make us allocate too much memory,
      * and leave room for a final 0 */
     our_size = list_size / 2 + 1;
-    if( our_size > POLARSSL_ECP_DP_MAX )
-        our_size = POLARSSL_ECP_DP_MAX;
+    if( our_size > MBEDTLS_ECP_DP_MAX )
+        our_size = MBEDTLS_ECP_DP_MAX;
 
-    if( ( curves = polarssl_malloc( our_size * sizeof( *curves ) ) ) == NULL )
-        return( POLARSSL_ERR_SSL_MALLOC_FAILED );
+    if( ( curves = mbedtls_malloc( our_size * sizeof( *curves ) ) ) == NULL )
+        return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
     /* explicit void pointer cast for buggy MS compiler */
     memset( (void *) curves, 0, our_size * sizeof( *curves ) );
@@ -592,7 +592,7 @@
     p = buf + 2;
     while( list_size > 0 && our_size > 1 )
     {
-        curve_info = ecp_curve_info_from_tls_id( ( p[0] << 8 ) | p[1] );
+        curve_info = mbedtls_ecp_curve_info_from_tls_id( ( p[0] << 8 ) | p[1] );
 
         if( curve_info != NULL )
         {
@@ -607,7 +607,7 @@
     return( 0 );
 }
 
-static int ssl_parse_supported_point_formats( ssl_context *ssl,
+static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl,
                                               const unsigned char *buf,
                                               size_t len )
 {
@@ -617,18 +617,18 @@
     list_size = buf[0];
     if( list_size + 1 != len )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     p = buf + 2;
     while( list_size > 0 )
     {
-        if( p[0] == POLARSSL_ECP_PF_UNCOMPRESSED ||
-            p[0] == POLARSSL_ECP_PF_COMPRESSED )
+        if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
+            p[0] == MBEDTLS_ECP_PF_COMPRESSED )
         {
             ssl->handshake->ecdh_ctx.point_format = p[0];
-            SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
+            MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
             return( 0 );
         }
 
@@ -638,127 +638,127 @@
 
     return( 0 );
 }
-#endif /* POLARSSL_ECDH_C || POLARSSL_ECDSA_C */
+#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
 
-#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
-static int ssl_parse_max_fragment_length_ext( ssl_context *ssl,
+#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
+static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
                                               const unsigned char *buf,
                                               size_t len )
 {
-    if( len != 1 || buf[0] >= SSL_MAX_FRAG_LEN_INVALID )
+    if( len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     ssl->session_negotiate->mfl_code = buf[0];
 
     return( 0 );
 }
-#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
+#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
 
-#if defined(POLARSSL_SSL_TRUNCATED_HMAC)
-static int ssl_parse_truncated_hmac_ext( ssl_context *ssl,
+#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
+static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
                                          const unsigned char *buf,
                                          size_t len )
 {
     if( len != 0 )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     ((void) buf);
 
-    if( ssl->trunc_hmac == SSL_TRUNC_HMAC_ENABLED )
-        ssl->session_negotiate->trunc_hmac = SSL_TRUNC_HMAC_ENABLED;
+    if( ssl->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
+        ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
 
     return( 0 );
 }
-#endif /* POLARSSL_SSL_TRUNCATED_HMAC */
+#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
 
-#if defined(POLARSSL_SSL_ENCRYPT_THEN_MAC)
-static int ssl_parse_encrypt_then_mac_ext( ssl_context *ssl,
+#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
+static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
                                       const unsigned char *buf,
                                       size_t len )
 {
     if( len != 0 )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     ((void) buf);
 
-    if( ssl->encrypt_then_mac == SSL_ETM_ENABLED &&
-        ssl->minor_ver != SSL_MINOR_VERSION_0 )
+    if( ssl->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
+        ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
     {
-        ssl->session_negotiate->encrypt_then_mac = SSL_ETM_ENABLED;
+        ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
     }
 
     return( 0 );
 }
-#endif /* POLARSSL_SSL_ENCRYPT_THEN_MAC */
+#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
 
-#if defined(POLARSSL_SSL_EXTENDED_MASTER_SECRET)
-static int ssl_parse_extended_ms_ext( ssl_context *ssl,
+#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
+static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
                                       const unsigned char *buf,
                                       size_t len )
 {
     if( len != 0 )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     ((void) buf);
 
-    if( ssl->extended_ms == SSL_EXTENDED_MS_ENABLED &&
-        ssl->minor_ver != SSL_MINOR_VERSION_0 )
+    if( ssl->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED &&
+        ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
     {
-        ssl->handshake->extended_ms = SSL_EXTENDED_MS_ENABLED;
+        ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
     }
 
     return( 0 );
 }
-#endif /* POLARSSL_SSL_EXTENDED_MASTER_SECRET */
+#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
 
-#if defined(POLARSSL_SSL_SESSION_TICKETS)
-static int ssl_parse_session_ticket_ext( ssl_context *ssl,
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
                                          unsigned char *buf,
                                          size_t len )
 {
     int ret;
 
-    if( ssl->session_tickets == SSL_SESSION_TICKETS_DISABLED )
+    if( ssl->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED )
         return( 0 );
 
     /* Remember the client asked us to send a new ticket */
     ssl->handshake->new_session_ticket = 1;
 
-    SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) );
 
     if( len == 0 )
         return( 0 );
 
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-    if( ssl->renego_status != SSL_INITIAL_HANDSHAKE )
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+    if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
     {
-        SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
         return( 0 );
     }
-#endif /* POLARSSL_SSL_RENEGOTIATION */
+#endif /* MBEDTLS_SSL_RENEGOTIATION */
 
     /*
      * Failures are ok: just ignore the ticket and proceed.
      */
     if( ( ret = ssl_parse_ticket( ssl, buf, len ) ) != 0 )
     {
-        SSL_DEBUG_RET( 1, "ssl_parse_ticket", ret );
+        MBEDTLS_SSL_DEBUG_RET( 1, "ssl_parse_ticket", ret );
         return( 0 );
     }
 
-    SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
 
     ssl->handshake->resume = 1;
 
@@ -767,10 +767,10 @@
 
     return( 0 );
 }
-#endif /* POLARSSL_SSL_SESSION_TICKETS */
+#endif /* MBEDTLS_SSL_SESSION_TICKETS */
 
-#if defined(POLARSSL_SSL_ALPN)
-static int ssl_parse_alpn_ext( ssl_context *ssl,
+#if defined(MBEDTLS_SSL_ALPN)
+static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
                                const unsigned char *buf, size_t len )
 {
     size_t list_len, cur_len, ours_len;
@@ -791,11 +791,11 @@
 
     /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
     if( len < 4 )
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
 
     list_len = ( buf[0] << 8 ) | buf[1];
     if( list_len != len - 2 )
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
 
     /*
      * Use our order of preference
@@ -809,13 +809,13 @@
         {
             /* If the list is well formed, we should get equality first */
             if( theirs > end )
-                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+                return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
 
             cur_len = *theirs++;
 
             /* Empty strings MUST NOT be included */
             if( cur_len == 0 )
-                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+                return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
 
             if( cur_len == ours_len &&
                 memcmp( theirs, *ours, cur_len ) == 0 )
@@ -827,26 +827,26 @@
     }
 
     /* If we get there, no match was found */
-    ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
-                            SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL );
-    return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+    mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+                            MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL );
+    return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
 }
-#endif /* POLARSSL_SSL_ALPN */
+#endif /* MBEDTLS_SSL_ALPN */
 
 /*
  * Auxiliary functions for ServerHello parsing and related actions
  */
 
-#if defined(POLARSSL_X509_CRT_PARSE_C)
+#if defined(MBEDTLS_X509_CRT_PARSE_C)
 /*
  * Return 0 if the given key uses one of the acceptable curves, -1 otherwise
  */
-#if defined(POLARSSL_ECDSA_C)
-static int ssl_check_key_curve( pk_context *pk,
-                                const ecp_curve_info **curves )
+#if defined(MBEDTLS_ECDSA_C)
+static int ssl_check_key_curve( mbedtls_pk_context *pk,
+                                const mbedtls_ecp_curve_info **curves )
 {
-    const ecp_curve_info **crv = curves;
-    ecp_group_id grp_id = pk_ec( *pk )->grp.id;
+    const mbedtls_ecp_curve_info **crv = curves;
+    mbedtls_ecp_group_id grp_id = mbedtls_pk_ec( *pk )->grp.id;
 
     while( *crv != NULL )
     {
@@ -857,38 +857,38 @@
 
     return( -1 );
 }
-#endif /* POLARSSL_ECDSA_C */
+#endif /* MBEDTLS_ECDSA_C */
 
 /*
  * Try picking a certificate for this ciphersuite,
  * return 0 on success and -1 on failure.
  */
-static int ssl_pick_cert( ssl_context *ssl,
-                          const ssl_ciphersuite_t * ciphersuite_info )
+static int ssl_pick_cert( mbedtls_ssl_context *ssl,
+                          const mbedtls_ssl_ciphersuite_t * ciphersuite_info )
 {
-    ssl_key_cert *cur, *list, *fallback = NULL;
-    pk_type_t pk_alg = ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
+    mbedtls_ssl_key_cert *cur, *list, *fallback = NULL;
+    mbedtls_pk_type_t pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
 
-#if defined(POLARSSL_SSL_SERVER_NAME_INDICATION)
+#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
     if( ssl->handshake->sni_key_cert != NULL )
         list = ssl->handshake->sni_key_cert;
     else
 #endif
         list = ssl->handshake->key_cert;
 
-    if( pk_alg == POLARSSL_PK_NONE )
+    if( pk_alg == MBEDTLS_PK_NONE )
         return( 0 );
 
-    SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) );
 
     for( cur = list; cur != NULL; cur = cur->next )
     {
-        SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate",
+        MBEDTLS_SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate",
                           cur->cert );
 
-        if( ! pk_can_do( cur->key, pk_alg ) )
+        if( ! mbedtls_pk_can_do( cur->key, pk_alg ) )
         {
-            SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) );
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) );
             continue;
         }
 
@@ -900,19 +900,19 @@
          * different uses based on keyUsage, eg if they want to avoid signing
          * and decrypting with the same RSA key.
          */
-        if( ssl_check_cert_usage( cur->cert, ciphersuite_info,
-                                  SSL_IS_SERVER ) != 0 )
+        if( mbedtls_ssl_check_cert_usage( cur->cert, ciphersuite_info,
+                                  MBEDTLS_SSL_IS_SERVER ) != 0 )
         {
-            SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
                                 "(extended) key usage extension" ) );
             continue;
         }
 
-#if defined(POLARSSL_ECDSA_C)
-        if( pk_alg == POLARSSL_PK_ECDSA &&
+#if defined(MBEDTLS_ECDSA_C)
+        if( pk_alg == MBEDTLS_PK_ECDSA &&
             ssl_check_key_curve( cur->key, ssl->handshake->curves ) != 0 )
         {
-            SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) );
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) );
             continue;
         }
 #endif
@@ -922,13 +922,13 @@
          * present them a SHA-higher cert rather than failing if it's the only
          * one we got that satisfies the other conditions.
          */
-        if( ssl->minor_ver < SSL_MINOR_VERSION_3 &&
-            cur->cert->sig_md != POLARSSL_MD_SHA1 )
+        if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 &&
+            cur->cert->sig_md != MBEDTLS_MD_SHA1 )
         {
             if( fallback == NULL )
                 fallback = cur;
             {
-                SSL_DEBUG_MSG( 3, ( "certificate not preferred: "
+                MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate not preferred: "
                                     "sha-2 with pre-TLS 1.2 client" ) );
             continue;
             }
@@ -946,78 +946,78 @@
     if( cur != NULL )
     {
         ssl->handshake->key_cert = cur;
-        SSL_DEBUG_CRT( 3, "selected certificate chain, certificate",
+        MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate",
                           ssl->handshake->key_cert->cert );
         return( 0 );
     }
 
     return( -1 );
 }
-#endif /* POLARSSL_X509_CRT_PARSE_C */
+#endif /* MBEDTLS_X509_CRT_PARSE_C */
 
 /*
  * Check if a given ciphersuite is suitable for use with our config/keys/etc
  * Sets ciphersuite_info only if the suite matches.
  */
-static int ssl_ciphersuite_match( ssl_context *ssl, int suite_id,
-                                  const ssl_ciphersuite_t **ciphersuite_info )
+static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id,
+                                  const mbedtls_ssl_ciphersuite_t **ciphersuite_info )
 {
-    const ssl_ciphersuite_t *suite_info;
+    const mbedtls_ssl_ciphersuite_t *suite_info;
 
-    suite_info = ssl_ciphersuite_from_id( suite_id );
+    suite_info = mbedtls_ssl_ciphersuite_from_id( suite_id );
     if( suite_info == NULL )
     {
-        SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
+        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
     }
 
-    SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %s", suite_info->name ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %s", suite_info->name ) );
 
     if( suite_info->min_minor_ver > ssl->minor_ver ||
         suite_info->max_minor_ver < ssl->minor_ver )
     {
-        SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) );
         return( 0 );
     }
 
-#if defined(POLARSSL_SSL_PROTO_DTLS)
-    if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
-        ( suite_info->flags & POLARSSL_CIPHERSUITE_NODTLS ) )
+#if defined(MBEDTLS_SSL_PROTO_DTLS)
+    if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
+        ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
         return( 0 );
 #endif
 
-    if( ssl->arc4_disabled == SSL_ARC4_DISABLED &&
-            suite_info->cipher == POLARSSL_CIPHER_ARC4_128 )
+    if( ssl->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
+            suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
     {
-        SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: rc4" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: rc4" ) );
         return( 0 );
     }
 
-#if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
-    if( ssl_ciphersuite_uses_ec( suite_info ) &&
+#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
+    if( mbedtls_ssl_ciphersuite_uses_ec( suite_info ) &&
         ( ssl->handshake->curves == NULL ||
           ssl->handshake->curves[0] == NULL ) )
     {
-        SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
+        MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
                             "no common elliptic curve" ) );
         return( 0 );
     }
 #endif
 
-#if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED)
+#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
     /* If the ciphersuite requires a pre-shared key and we don't
      * have one, skip it now rather than failing later */
-    if( ssl_ciphersuite_uses_psk( suite_info ) &&
+    if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
         ssl->f_psk == NULL &&
         ( ssl->psk == NULL || ssl->psk_identity == NULL ||
           ssl->psk_identity_len == 0 || ssl->psk_len == 0 ) )
     {
-        SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) );
         return( 0 );
     }
 #endif
 
-#if defined(POLARSSL_X509_CRT_PARSE_C)
+#if defined(MBEDTLS_X509_CRT_PARSE_C)
     /*
      * Final check: if ciphersuite requires us to have a
      * certificate/key of a particular type:
@@ -1027,7 +1027,7 @@
      */
     if( ssl_pick_cert( ssl, suite_info ) != 0 )
     {
-        SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
+        MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
                             "no suitable certificate" ) );
         return( 0 );
     }
@@ -1037,8 +1037,8 @@
     return( 0 );
 }
 
-#if defined(POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
-static int ssl_parse_client_hello_v2( ssl_context *ssl )
+#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
+static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl )
 {
     int ret, got_common_suite;
     unsigned int i, j;
@@ -1046,31 +1046,31 @@
     unsigned int ciph_len, sess_len, chal_len;
     unsigned char *buf, *p;
     const int *ciphersuites;
-    const ssl_ciphersuite_t *ciphersuite_info;
+    const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
 
-    SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) );
 
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-    if( ssl->renego_status != SSL_INITIAL_HANDSHAKE )
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+    if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
     {
-        SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) );
 
-        if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
+        if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
             return( ret );
 
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
-#endif /* POLARSSL_SSL_RENEGOTIATION */
+#endif /* MBEDTLS_SSL_RENEGOTIATION */
 
     buf = ssl->in_hdr;
 
-    SSL_DEBUG_BUF( 4, "record header", buf, 5 );
+    MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, 5 );
 
-    SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d",
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d",
                    buf[2] ) );
-    SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d",
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d",
                    ( ( buf[0] & 0x7F ) << 8 ) | buf[1] ) );
-    SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]",
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]",
                    buf[3], buf[4] ) );
 
     /*
@@ -1083,43 +1083,43 @@
      *     2  .   2   message type
      *     3  .   4   protocol version
      */
-    if( buf[2] != SSL_HS_CLIENT_HELLO ||
-        buf[3] != SSL_MAJOR_VERSION_3 )
+    if( buf[2] != MBEDTLS_SSL_HS_CLIENT_HELLO ||
+        buf[3] != MBEDTLS_SSL_MAJOR_VERSION_3 )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     n = ( ( buf[0] << 8 ) | buf[1] ) & 0x7FFF;
 
     if( n < 17 || n > 512 )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
-    ssl->major_ver = SSL_MAJOR_VERSION_3;
+    ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
     ssl->minor_ver = ( buf[4] <= ssl->max_minor_ver )
                      ? buf[4]  : ssl->max_minor_ver;
 
     if( ssl->minor_ver < ssl->min_minor_ver )
     {
-        SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
                             " [%d:%d] < [%d:%d]",
                             ssl->major_ver, ssl->minor_ver,
                             ssl->min_major_ver, ssl->min_minor_ver ) );
 
-        ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
-                                     SSL_ALERT_MSG_PROTOCOL_VERSION );
-        return( POLARSSL_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
+        mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+                                     MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
+        return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
     }
 
     ssl->handshake->max_major_ver = buf[3];
     ssl->handshake->max_minor_ver = buf[4];
 
-    if( ( ret = ssl_fetch_input( ssl, 2 + n ) ) != 0 )
+    if( ( ret = mbedtls_ssl_fetch_input( ssl, 2 + n ) ) != 0 )
     {
-        SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
+        MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
         return( ret );
     }
 
@@ -1136,13 +1136,13 @@
      *   ..  .  ..   session id
      *   ..  .  ..   challenge
      */
-    SSL_DEBUG_BUF( 4, "record contents", buf, n );
+    MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, n );
 
     ciph_len = ( buf[0] << 8 ) | buf[1];
     sess_len = ( buf[2] << 8 ) | buf[3];
     chal_len = ( buf[4] << 8 ) | buf[5];
 
-    SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d",
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d",
                    ciph_len, sess_len, chal_len ) );
 
     /*
@@ -1150,33 +1150,33 @@
      */
     if( ciph_len < 3 || ( ciph_len % 3 ) != 0 )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     if( sess_len > 32 )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     if( chal_len < 8 || chal_len > 32 )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     if( n != 6 + ciph_len + sess_len + chal_len )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
-    SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
+    MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
                    buf + 6, ciph_len );
-    SSL_DEBUG_BUF( 3, "client hello, session id",
+    MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id",
                    buf + 6 + ciph_len, sess_len );
-    SSL_DEBUG_BUF( 3, "client hello, challenge",
+    MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, challenge",
                    buf + 6 + ciph_len + sess_len, chal_len );
 
     p = buf + 6 + ciph_len;
@@ -1194,54 +1194,54 @@
      */
     for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
     {
-        if( p[0] == 0 && p[1] == 0 && p[2] == SSL_EMPTY_RENEGOTIATION_INFO )
+        if( p[0] == 0 && p[1] == 0 && p[2] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
         {
-            SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-            if( ssl->renego_status == SSL_RENEGOTIATION_IN_PROGRESS )
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+            if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
             {
-                SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
+                MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
                                     "during renegotiation" ) );
 
-                if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
+                if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
                     return( ret );
 
-                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+                return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
             }
-#endif /* POLARSSL_SSL_RENEGOTIATION */
-            ssl->secure_renegotiation = SSL_SECURE_RENEGOTIATION;
+#endif /* MBEDTLS_SSL_RENEGOTIATION */
+            ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
             break;
         }
     }
 
-#if defined(POLARSSL_SSL_FALLBACK_SCSV)
+#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
     for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
     {
         if( p[0] == 0 &&
-            p[1] == (unsigned char)( ( SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
-            p[2] == (unsigned char)( ( SSL_FALLBACK_SCSV_VALUE      ) & 0xff ) )
+            p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
+            p[2] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE      ) & 0xff ) )
         {
-            SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) );
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) );
 
             if( ssl->minor_ver < ssl->max_minor_ver )
             {
-                SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
+                MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
 
-                ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
-                                        SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
+                mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+                                        MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
 
-                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+                return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
             }
 
             break;
         }
     }
-#endif /* POLARSSL_SSL_FALLBACK_SCSV */
+#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
 
     got_common_suite = 0;
     ciphersuites = ssl->ciphersuite_list[ssl->minor_ver];
     ciphersuite_info = NULL;
-#if defined(POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
+#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
     for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
     {
         for( i = 0; ciphersuites[i] != 0; i++ )
@@ -1269,96 +1269,96 @@
 
     if( got_common_suite )
     {
-        SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
                             "but none of them usable" ) );
-        return( POLARSSL_ERR_SSL_NO_USABLE_CIPHERSUITE );
+        return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
     }
     else
     {
-        SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
-        return( POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
+        return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
     }
 
 have_ciphersuite_v2:
-    SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
 
     ssl->session_negotiate->ciphersuite = ciphersuites[i];
     ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
-    ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
+    mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
 
     /*
      * SSLv2 Client Hello relevant renegotiation security checks
      */
-    if( ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
-        ssl->allow_legacy_renegotiation == SSL_LEGACY_BREAK_HANDSHAKE )
+    if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
+        ssl->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
     {
-        SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
 
-        if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
+        if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
             return( ret );
 
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     ssl->in_left = 0;
     ssl->state++;
 
-    SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) );
 
     return( 0 );
 }
-#endif /* POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
+#endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
 
-static int ssl_parse_client_hello( ssl_context *ssl )
+static int ssl_parse_client_hello( mbedtls_ssl_context *ssl )
 {
     int ret, got_common_suite;
     unsigned int i, j;
     unsigned int ciph_offset, comp_offset, ext_offset;
     unsigned int msg_len, ciph_len, sess_len, comp_len, ext_len;
-#if defined(POLARSSL_SSL_PROTO_DTLS)
+#if defined(MBEDTLS_SSL_PROTO_DTLS)
     unsigned int cookie_offset, cookie_len;
 #endif
     unsigned char *buf, *p, *ext;
-#if defined(POLARSSL_SSL_RENEGOTIATION)
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
     int renegotiation_info_seen = 0;
 #endif
     int handshake_failure = 0;
     const int *ciphersuites;
-    const ssl_ciphersuite_t *ciphersuite_info;
+    const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
     int major, minor;
 
-    SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
 
-#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
 read_record_header:
 #endif
     /*
-     * If renegotiating, then the input was read with ssl_read_record(),
+     * If renegotiating, then the input was read with mbedtls_ssl_read_record(),
      * otherwise read it ourselves manually in order to support SSLv2
      * ClientHello, which doesn't use the same record layer format.
      */
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-    if( ssl->renego_status == SSL_INITIAL_HANDSHAKE )
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+    if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
 #endif
     {
-        if( ( ret = ssl_fetch_input( ssl, 5 ) ) != 0 )
+        if( ( ret = mbedtls_ssl_fetch_input( ssl, 5 ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
             return( ret );
         }
     }
 
     buf = ssl->in_hdr;
 
-#if defined(POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
-#if defined(POLARSSL_SSL_PROTO_DTLS)
-    if( ssl->transport == SSL_TRANSPORT_STREAM )
+#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
+#if defined(MBEDTLS_SSL_PROTO_DTLS)
+    if( ssl->transport == MBEDTLS_SSL_TRANSPORT_STREAM )
 #endif
         if( ( buf[0] & 0x80 ) != 0 )
             return ssl_parse_client_hello_v2( ssl );
 #endif
 
-    SSL_DEBUG_BUF( 4, "record header", buf, ssl_hdr_len( ssl ) );
+    MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, mbedtls_ssl_hdr_len( ssl ) );
 
     /*
      * SSLv3/TLS Client Hello
@@ -1369,93 +1369,93 @@
      *     3  .   11  DTLS: epoch + record sequence number
      *     3  .   4   message length
      */
-    SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
                    buf[0] ) );
 
-    if( buf[0] != SSL_MSG_HANDSHAKE )
+    if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
-    SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
                    ( ssl->in_len[0] << 8 ) | ssl->in_len[1] ) );
 
-    SSL_DEBUG_MSG( 3, ( "client hello v3, protocol version: [%d:%d]",
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, protocol version: [%d:%d]",
                    buf[1], buf[2] ) );
 
-    ssl_read_version( &major, &minor, ssl->transport, buf + 1 );
+    mbedtls_ssl_read_version( &major, &minor, ssl->transport, buf + 1 );
 
     /* According to RFC 5246 Appendix E.1, the version here is typically
      * "{03,00}, the lowest version number supported by the client, [or] the
      * value of ClientHello.client_version", so the only meaningful check here
      * is the major version shouldn't be less than 3 */
-    if( major < SSL_MAJOR_VERSION_3 )
+    if( major < MBEDTLS_SSL_MAJOR_VERSION_3 )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     /* For DTLS if this is the initial handshake, remember the client sequence
      * number to use it in our next message (RFC 6347 4.2.1) */
-#if defined(POLARSSL_SSL_PROTO_DTLS)
-    if( ssl->transport == SSL_TRANSPORT_DATAGRAM 
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-        && ssl->renego_status == SSL_INITIAL_HANDSHAKE
+#if defined(MBEDTLS_SSL_PROTO_DTLS)
+    if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM 
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+        && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
 #endif
         )
     {
         /* Epoch should be 0 for initial handshakes */
         if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 )
         {
-            SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
         }
 
         memcpy( ssl->out_ctr + 2, ssl->in_ctr + 2, 6 );
 
-#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
-        if( ssl_dtls_replay_check( ssl ) != 0 )
+#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
+        if( mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
         {
-            SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) );
             ssl->next_record_offset = 0;
             ssl->in_left = 0;
             goto read_record_header;
         }
 
         /* No MAC to check yet, so we can update right now */
-        ssl_dtls_replay_update( ssl );
+        mbedtls_ssl_dtls_replay_update( ssl );
 #endif
     }
-#endif /* POLARSSL_SSL_PROTO_DTLS */
+#endif /* MBEDTLS_SSL_PROTO_DTLS */
 
     msg_len = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
 
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-    if( ssl->renego_status != SSL_INITIAL_HANDSHAKE )
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+    if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
     {
-        /* Set by ssl_read_record() */
+        /* Set by mbedtls_ssl_read_record() */
         msg_len = ssl->in_hslen;
     }
     else
 #endif
     {
-        if( msg_len > SSL_MAX_CONTENT_LEN )
+        if( msg_len > MBEDTLS_SSL_MAX_CONTENT_LEN )
         {
-            SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
         }
 
-        if( ( ret = ssl_fetch_input( ssl, ssl_hdr_len( ssl ) + msg_len ) ) != 0 )
+        if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) + msg_len ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
             return( ret );
         }
 
     /* Done reading this record, get ready for the next one */
-#if defined(POLARSSL_SSL_PROTO_DTLS)
-        if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
-            ssl->next_record_offset = msg_len + ssl_hdr_len( ssl );
+#if defined(MBEDTLS_SSL_PROTO_DTLS)
+        if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+            ssl->next_record_offset = msg_len + mbedtls_ssl_hdr_len( ssl );
         else
 #endif
             ssl->in_left = 0;
@@ -1463,7 +1463,7 @@
 
     buf = ssl->in_msg;
 
-    SSL_DEBUG_BUF( 4, "record contents", buf, msg_len );
+    MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, msg_len );
 
     ssl->handshake->update_checksum( ssl, buf, msg_len );
 
@@ -1475,40 +1475,40 @@
      *     6  .   8   DTLS only: fragment offset
      *     9  .  11   DTLS only: fragment length
      */
-    if( msg_len < ssl_hs_hdr_len( ssl ) )
+    if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
-    SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) );
 
-    if( buf[0] != SSL_HS_CLIENT_HELLO )
+    if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
-    SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
                    ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) );
 
     /* We don't support fragmentation of ClientHello (yet?) */
     if( buf[1] != 0 ||
-        msg_len != ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) | buf[3] ) )
+        msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) | buf[3] ) )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
-#if defined(POLARSSL_SSL_PROTO_DTLS)
-    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+#if defined(MBEDTLS_SSL_PROTO_DTLS)
+    if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
     {
         /*
          * Copy the client's handshake message_seq on initial handshakes,
          * check sequence number on renego.
          */
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-        if( ssl->renego_status == SSL_RENEGOTIATION_IN_PROGRESS )
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+        if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
         {
             /* This couldn't be done in ssl_prepare_handshake_record() */
             unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
@@ -1516,10 +1516,10 @@
 
             if( cli_msg_seq != ssl->handshake->in_msg_seq )
             {
-                SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: "
+                MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: "
                                     "%d (expected %d)", cli_msg_seq,
                                     ssl->handshake->in_msg_seq ) );
-                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+                return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
             }
 
             ssl->handshake->in_msg_seq++;
@@ -1540,14 +1540,14 @@
         if( ssl->in_msg[6] != 0 || ssl->in_msg[7] != 0 || ssl->in_msg[8] != 0 ||
             memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 )
         {
-            SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) );
-            return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) );
+            return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
         }
     }
-#endif /* POLARSSL_SSL_PROTO_DTLS */
+#endif /* MBEDTLS_SSL_PROTO_DTLS */
 
-    buf += ssl_hs_hdr_len( ssl );
-    msg_len -= ssl_hs_hdr_len( ssl );
+    buf += mbedtls_ssl_hs_hdr_len( ssl );
+    msg_len -= mbedtls_ssl_hs_hdr_len( ssl );
 
     /*
      * ClientHello layer:
@@ -1572,16 +1572,16 @@
      */
     if( msg_len < 38 )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     /*
      * Check and save the protocol version
      */
-    SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 );
+    MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 );
 
-    ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
+    mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
                       ssl->transport, buf );
 
     ssl->handshake->max_major_ver = ssl->major_ver;
@@ -1590,15 +1590,15 @@
     if( ssl->major_ver < ssl->min_major_ver ||
         ssl->minor_ver < ssl->min_minor_ver )
     {
-        SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
                             " [%d:%d] < [%d:%d]",
                             ssl->major_ver, ssl->minor_ver,
                             ssl->min_major_ver, ssl->min_minor_ver ) );
 
-        ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
-                                     SSL_ALERT_MSG_PROTOCOL_VERSION );
+        mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+                                     MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
 
-        return( POLARSSL_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
+        return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
     }
 
     if( ssl->major_ver > ssl->max_major_ver )
@@ -1612,7 +1612,7 @@
     /*
      * Save client random (inc. Unix time)
      */
-    SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 );
+    MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 );
 
     memcpy( ssl->handshake->randbytes, buf + 2, 32 );
 
@@ -1624,11 +1624,11 @@
     if( sess_len > sizeof( ssl->session_negotiate->id ) ||
         sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
-    SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len );
+    MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len );
 
     ssl->session_negotiate->length = sess_len;
     memset( ssl->session_negotiate->id, 0,
@@ -1639,25 +1639,25 @@
     /*
      * Check the cookie length and content
      */
-#if defined(POLARSSL_SSL_PROTO_DTLS)
-    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
+#if defined(MBEDTLS_SSL_PROTO_DTLS)
+    if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
     {
         cookie_offset = 35 + sess_len;
         cookie_len = buf[cookie_offset];
 
         if( cookie_offset + 1 + cookie_len + 2 > msg_len )
         {
-            SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
         }
 
-        SSL_DEBUG_BUF( 3, "client hello, cookie",
+        MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
                        buf + cookie_offset + 1, cookie_len );
 
-#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
+#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
         if( ssl->f_cookie_check != NULL
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-            && ssl->renego_status == SSL_INITIAL_HANDSHAKE
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+            && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
 #endif
             )
         {
@@ -1665,26 +1665,26 @@
                                      buf + cookie_offset + 1, cookie_len,
                                      ssl->cli_id, ssl->cli_id_len ) != 0 )
             {
-                SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
+                MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
                 ssl->handshake->verify_cookie_len = 1;
             }
             else
             {
-                SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
+                MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
                 ssl->handshake->verify_cookie_len = 0;
             }
         }
         else
-#endif /* POLARSSL_SSL_DTLS_HELLO_VERIFY */
+#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
         {
             /* We know we didn't send a cookie, so it should be empty */
             if( cookie_len != 0 )
             {
-                SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+                MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+                return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
             }
 
-            SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
+            MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
         }
 
     /*
@@ -1693,7 +1693,7 @@
         ciph_offset = cookie_offset + 1 + cookie_len;
     }
     else
-#endif /* POLARSSL_SSL_PROTO_DTLS */
+#endif /* MBEDTLS_SSL_PROTO_DTLS */
         ciph_offset = 35 + sess_len;
 
     ciph_len = ( buf[ciph_offset + 0] << 8 )
@@ -1703,11 +1703,11 @@
         ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */
         ( ciph_len % 2 ) != 0 )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
-    SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
+    MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
                    buf + ciph_offset + 2,  ciph_len );
 
     /*
@@ -1721,29 +1721,29 @@
         comp_len > 16 ||
         comp_len + comp_offset + 1 > msg_len )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
-    SSL_DEBUG_BUF( 3, "client hello, compression",
+    MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression",
                       buf + comp_offset + 1, comp_len );
 
-    ssl->session_negotiate->compression = SSL_COMPRESS_NULL;
-#if defined(POLARSSL_ZLIB_SUPPORT)
+    ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
+#if defined(MBEDTLS_ZLIB_SUPPORT)
     for( i = 0; i < comp_len; ++i )
     {
-        if( buf[comp_offset + 1 + i] == SSL_COMPRESS_DEFLATE )
+        if( buf[comp_offset + 1 + i] == MBEDTLS_SSL_COMPRESS_DEFLATE )
         {
-            ssl->session_negotiate->compression = SSL_COMPRESS_DEFLATE;
+            ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_DEFLATE;
             break;
         }
     }
 #endif
 
     /* See comments in ssl_write_client_hello() */
-#if defined(POLARSSL_SSL_PROTO_DTLS)
-    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
-        ssl->session_negotiate->compression = SSL_COMPRESS_NULL;
+#if defined(MBEDTLS_SSL_PROTO_DTLS)
+    if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+        ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
 #endif
 
     /*
@@ -1754,8 +1754,8 @@
     {
         if( msg_len < ext_offset + 2 )
         {
-            SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
         }
 
         ext_len = ( buf[ext_offset + 0] << 8 )
@@ -1764,10 +1764,10 @@
         if( ( ext_len > 0 && ext_len < 4 ) ||
             msg_len != ext_offset + 2 + ext_len )
         {
-            SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-            SSL_DEBUG_BUF( 3, "client hello extensions",
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+            MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions",
                               buf + ext_offset + 2, ext_len );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
         }
     }
     else
@@ -1784,14 +1784,14 @@
 
         if( ext_size + 4 > ext_len )
         {
-            SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
         }
         switch( ext_id )
         {
-#if defined(POLARSSL_SSL_SERVER_NAME_INDICATION)
-        case TLS_EXT_SERVERNAME:
-            SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
+#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
+        case MBEDTLS_TLS_EXT_SERVERNAME:
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
             if( ssl->f_sni == NULL )
                 break;
 
@@ -1799,11 +1799,11 @@
             if( ret != 0 )
                 return( ret );
             break;
-#endif /* POLARSSL_SSL_SERVER_NAME_INDICATION */
+#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
 
-        case TLS_EXT_RENEGOTIATION_INFO:
-            SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
-#if defined(POLARSSL_SSL_RENEGOTIATION)
+        case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
             renegotiation_info_seen = 1;
 #endif
 
@@ -1812,12 +1812,12 @@
                 return( ret );
             break;
 
-#if defined(POLARSSL_SSL_PROTO_TLS1_2) && \
-    defined(POLARSSL_KEY_EXCHANGE__WITH_CERT__ENABLED)
-        case TLS_EXT_SIG_ALG:
-            SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-            if( ssl->renego_status == SSL_RENEGOTIATION_IN_PROGRESS )
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
+    defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
+        case MBEDTLS_TLS_EXT_SIG_ALG:
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+            if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
                 break;
 #endif
 
@@ -1825,90 +1825,90 @@
             if( ret != 0 )
                 return( ret );
             break;
-#endif /* POLARSSL_SSL_PROTO_TLS1_2 &&
-          POLARSSL_KEY_EXCHANGE__WITH_CERT__ENABLED */
+#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
+          MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
 
-#if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
-        case TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
-            SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
+#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
+        case MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
 
             ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size );
             if( ret != 0 )
                 return( ret );
             break;
 
-        case TLS_EXT_SUPPORTED_POINT_FORMATS:
-            SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
-            ssl->handshake->cli_exts |= TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
+        case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
+            ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
 
             ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
             if( ret != 0 )
                 return( ret );
             break;
-#endif /* POLARSSL_ECDH_C || POLARSSL_ECDSA_C */
+#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
 
-#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
-        case TLS_EXT_MAX_FRAGMENT_LENGTH:
-            SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
+#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
+        case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
 
             ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
             if( ret != 0 )
                 return( ret );
             break;
-#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
+#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
 
-#if defined(POLARSSL_SSL_TRUNCATED_HMAC)
-        case TLS_EXT_TRUNCATED_HMAC:
-            SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
+#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
+        case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
 
             ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size );
             if( ret != 0 )
                 return( ret );
             break;
-#endif /* POLARSSL_SSL_TRUNCATED_HMAC */
+#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
 
-#if defined(POLARSSL_SSL_ENCRYPT_THEN_MAC)
-        case TLS_EXT_ENCRYPT_THEN_MAC:
-            SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) );
+#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
+        case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) );
 
             ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size );
             if( ret != 0 )
                 return( ret );
             break;
-#endif /* POLARSSL_SSL_ENCRYPT_THEN_MAC */
+#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
 
-#if defined(POLARSSL_SSL_EXTENDED_MASTER_SECRET)
-        case TLS_EXT_EXTENDED_MASTER_SECRET:
-            SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) );
+#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
+        case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) );
 
             ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size );
             if( ret != 0 )
                 return( ret );
             break;
-#endif /* POLARSSL_SSL_EXTENDED_MASTER_SECRET */
+#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
 
-#if defined(POLARSSL_SSL_SESSION_TICKETS)
-        case TLS_EXT_SESSION_TICKET:
-            SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+        case MBEDTLS_TLS_EXT_SESSION_TICKET:
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
 
             ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
             if( ret != 0 )
                 return( ret );
             break;
-#endif /* POLARSSL_SSL_SESSION_TICKETS */
+#endif /* MBEDTLS_SSL_SESSION_TICKETS */
 
-#if defined(POLARSSL_SSL_ALPN)
-        case TLS_EXT_ALPN:
-            SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
+#if defined(MBEDTLS_SSL_ALPN)
+        case MBEDTLS_TLS_EXT_ALPN:
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
 
             ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size );
             if( ret != 0 )
                 return( ret );
             break;
-#endif /* POLARSSL_SSL_SESSION_TICKETS */
+#endif /* MBEDTLS_SSL_SESSION_TICKETS */
 
         default:
-            SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
                            ext_id ) );
         }
 
@@ -1917,54 +1917,54 @@
 
         if( ext_len > 0 && ext_len < 4 )
         {
-            SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
         }
     }
 
-#if defined(POLARSSL_SSL_FALLBACK_SCSV)
+#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
     for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 )
     {
-        if( p[0] == (unsigned char)( ( SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
-            p[1] == (unsigned char)( ( SSL_FALLBACK_SCSV_VALUE      ) & 0xff ) )
+        if( p[0] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
+            p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE      ) & 0xff ) )
         {
-            SSL_DEBUG_MSG( 0, ( "received FALLBACK_SCSV" ) );
+            MBEDTLS_SSL_DEBUG_MSG( 0, ( "received FALLBACK_SCSV" ) );
 
             if( ssl->minor_ver < ssl->max_minor_ver )
             {
-                SSL_DEBUG_MSG( 0, ( "inapropriate fallback" ) );
+                MBEDTLS_SSL_DEBUG_MSG( 0, ( "inapropriate fallback" ) );
 
-                ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
-                                        SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
+                mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+                                        MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
 
-                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+                return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
             }
 
             break;
         }
     }
-#endif /* POLARSSL_SSL_FALLBACK_SCSV */
+#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
 
     /*
      * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
      */
     for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
     {
-        if( p[0] == 0 && p[1] == SSL_EMPTY_RENEGOTIATION_INFO )
+        if( p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
         {
-            SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-            if( ssl->renego_status == SSL_RENEGOTIATION_IN_PROGRESS )
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+            if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
             {
-                SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
+                MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
 
-                if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
+                if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
                     return( ret );
 
-                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+                return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
             }
 #endif
-            ssl->secure_renegotiation = SSL_SECURE_RENEGOTIATION;
+            ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
             break;
         }
     }
@@ -1972,42 +1972,42 @@
     /*
      * Renegotiation security checks
      */
-    if( ssl->secure_renegotiation != SSL_SECURE_RENEGOTIATION &&
-        ssl->allow_legacy_renegotiation == SSL_LEGACY_BREAK_HANDSHAKE )
+    if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION &&
+        ssl->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
     {
-        SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
         handshake_failure = 1;
     }
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-    else if( ssl->renego_status == SSL_RENEGOTIATION_IN_PROGRESS &&
-             ssl->secure_renegotiation == SSL_SECURE_RENEGOTIATION &&
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+    else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
+             ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
              renegotiation_info_seen == 0 )
     {
-        SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
         handshake_failure = 1;
     }
-    else if( ssl->renego_status == SSL_RENEGOTIATION_IN_PROGRESS &&
-             ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
-             ssl->allow_legacy_renegotiation == SSL_LEGACY_NO_RENEGOTIATION )
+    else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
+             ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
+             ssl->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
     {
-        SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
         handshake_failure = 1;
     }
-    else if( ssl->renego_status == SSL_RENEGOTIATION_IN_PROGRESS &&
-             ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
+    else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
+             ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
              renegotiation_info_seen == 1 )
     {
-        SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
         handshake_failure = 1;
     }
-#endif /* POLARSSL_SSL_RENEGOTIATION */
+#endif /* MBEDTLS_SSL_RENEGOTIATION */
 
     if( handshake_failure == 1 )
     {
-        if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
+        if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
             return( ret );
 
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
     /*
@@ -2018,7 +2018,7 @@
     got_common_suite = 0;
     ciphersuites = ssl->ciphersuite_list[ssl->minor_ver];
     ciphersuite_info = NULL;
-#if defined(POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
+#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
     for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
     {
         for( i = 0; ciphersuites[i] != 0; i++ )
@@ -2045,73 +2045,73 @@
 
     if( got_common_suite )
     {
-        SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
                             "but none of them usable" ) );
-        ssl_send_fatal_handshake_failure( ssl );
-        return( POLARSSL_ERR_SSL_NO_USABLE_CIPHERSUITE );
+        mbedtls_ssl_send_fatal_handshake_failure( ssl );
+        return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
     }
     else
     {
-        SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
-        ssl_send_fatal_handshake_failure( ssl );
-        return( POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
+        mbedtls_ssl_send_fatal_handshake_failure( ssl );
+        return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
     }
 
 have_ciphersuite:
-    SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
 
     ssl->session_negotiate->ciphersuite = ciphersuites[i];
     ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
-    ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
+    mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
 
     ssl->state++;
 
-#if defined(POLARSSL_SSL_PROTO_DTLS)
-    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
-        ssl_recv_flight_completed( ssl );
+#if defined(MBEDTLS_SSL_PROTO_DTLS)
+    if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+        mbedtls_ssl_recv_flight_completed( ssl );
 #endif
 
-    SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
 
     return( 0 );
 }
 
-#if defined(POLARSSL_SSL_TRUNCATED_HMAC)
-static void ssl_write_truncated_hmac_ext( ssl_context *ssl,
+#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
+static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
                                           unsigned char *buf,
                                           size_t *olen )
 {
     unsigned char *p = buf;
 
-    if( ssl->session_negotiate->trunc_hmac == SSL_TRUNC_HMAC_DISABLED )
+    if( ssl->session_negotiate->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
     {
         *olen = 0;
         return;
     }
 
-    SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) );
 
-    *p++ = (unsigned char)( ( TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
-    *p++ = (unsigned char)( ( TLS_EXT_TRUNCATED_HMAC      ) & 0xFF );
+    *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
+    *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC      ) & 0xFF );
 
     *p++ = 0x00;
     *p++ = 0x00;
 
     *olen = 4;
 }
-#endif /* POLARSSL_SSL_TRUNCATED_HMAC */
+#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
 
-#if defined(POLARSSL_SSL_ENCRYPT_THEN_MAC)
-static void ssl_write_encrypt_then_mac_ext( ssl_context *ssl,
+#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
+static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
                                             unsigned char *buf,
                                             size_t *olen )
 {
     unsigned char *p = buf;
-    const ssl_ciphersuite_t *suite = NULL;
-    const cipher_info_t *cipher = NULL;
+    const mbedtls_ssl_ciphersuite_t *suite = NULL;
+    const mbedtls_cipher_info_t *cipher = NULL;
 
-    if( ssl->session_negotiate->encrypt_then_mac == SSL_EXTENDED_MS_DISABLED ||
-        ssl->minor_ver == SSL_MINOR_VERSION_0 )
+    if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
+        ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
     {
         *olen = 0;
         return;
@@ -2123,56 +2123,56 @@
      * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
      * encrypt-then-MAC response extension back to the client."
      */
-    if( ( suite = ssl_ciphersuite_from_id(
+    if( ( suite = mbedtls_ssl_ciphersuite_from_id(
                     ssl->session_negotiate->ciphersuite ) ) == NULL ||
-        ( cipher = cipher_info_from_type( suite->cipher ) ) == NULL ||
-        cipher->mode != POLARSSL_MODE_CBC )
+        ( cipher = mbedtls_cipher_info_from_type( suite->cipher ) ) == NULL ||
+        cipher->mode != MBEDTLS_MODE_CBC )
     {
         *olen = 0;
         return;
     }
 
-    SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
 
-    *p++ = (unsigned char)( ( TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
-    *p++ = (unsigned char)( ( TLS_EXT_ENCRYPT_THEN_MAC      ) & 0xFF );
+    *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
+    *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC      ) & 0xFF );
 
     *p++ = 0x00;
     *p++ = 0x00;
 
     *olen = 4;
 }
-#endif /* POLARSSL_SSL_ENCRYPT_THEN_MAC */
+#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
 
-#if defined(POLARSSL_SSL_EXTENDED_MASTER_SECRET)
-static void ssl_write_extended_ms_ext( ssl_context *ssl,
+#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
+static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
                                        unsigned char *buf,
                                        size_t *olen )
 {
     unsigned char *p = buf;
 
-    if( ssl->handshake->extended_ms == SSL_EXTENDED_MS_DISABLED ||
-        ssl->minor_ver == SSL_MINOR_VERSION_0 )
+    if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
+        ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
     {
         *olen = 0;
         return;
     }
 
-    SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret "
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret "
                         "extension" ) );
 
-    *p++ = (unsigned char)( ( TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
-    *p++ = (unsigned char)( ( TLS_EXT_EXTENDED_MASTER_SECRET      ) & 0xFF );
+    *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
+    *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET      ) & 0xFF );
 
     *p++ = 0x00;
     *p++ = 0x00;
 
     *olen = 4;
 }
-#endif /* POLARSSL_SSL_EXTENDED_MASTER_SECRET */
+#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
 
-#if defined(POLARSSL_SSL_SESSION_TICKETS)
-static void ssl_write_session_ticket_ext( ssl_context *ssl,
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
                                           unsigned char *buf,
                                           size_t *olen )
 {
@@ -2184,37 +2184,37 @@
         return;
     }
 
-    SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
 
-    *p++ = (unsigned char)( ( TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
-    *p++ = (unsigned char)( ( TLS_EXT_SESSION_TICKET      ) & 0xFF );
+    *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
+    *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET      ) & 0xFF );
 
     *p++ = 0x00;
     *p++ = 0x00;
 
     *olen = 4;
 }
-#endif /* POLARSSL_SSL_SESSION_TICKETS */
+#endif /* MBEDTLS_SSL_SESSION_TICKETS */
 
-static void ssl_write_renegotiation_ext( ssl_context *ssl,
+static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
                                          unsigned char *buf,
                                          size_t *olen )
 {
     unsigned char *p = buf;
 
-    if( ssl->secure_renegotiation != SSL_SECURE_RENEGOTIATION )
+    if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION )
     {
         *olen = 0;
         return;
     }
 
-    SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
 
-    *p++ = (unsigned char)( ( TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
-    *p++ = (unsigned char)( ( TLS_EXT_RENEGOTIATION_INFO      ) & 0xFF );
+    *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
+    *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO      ) & 0xFF );
 
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-    if( ssl->renego_status != SSL_INITIAL_HANDSHAKE )
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+    if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
     {
         *p++ = 0x00;
         *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF;
@@ -2228,7 +2228,7 @@
         *olen = 5 + ssl->verify_data_len * 2;
     }
     else
-#endif /* POLARSSL_SSL_RENEGOTIATION */
+#endif /* MBEDTLS_SSL_RENEGOTIATION */
     {
         *p++ = 0x00;
         *p++ = 0x01;
@@ -2238,23 +2238,23 @@
     }
 }
 
-#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
-static void ssl_write_max_fragment_length_ext( ssl_context *ssl,
+#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
+static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
                                                unsigned char *buf,
                                                size_t *olen )
 {
     unsigned char *p = buf;
 
-    if( ssl->session_negotiate->mfl_code == SSL_MAX_FRAG_LEN_NONE )
+    if( ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE )
     {
         *olen = 0;
         return;
     }
 
-    SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
 
-    *p++ = (unsigned char)( ( TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
-    *p++ = (unsigned char)( ( TLS_EXT_MAX_FRAGMENT_LENGTH      ) & 0xFF );
+    *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
+    *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH      ) & 0xFF );
 
     *p++ = 0x00;
     *p++ = 1;
@@ -2263,10 +2263,10 @@
 
     *olen = 5;
 }
-#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
+#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
 
-#if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
-static void ssl_write_supported_point_formats_ext( ssl_context *ssl,
+#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
+static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
                                                    unsigned char *buf,
                                                    size_t *olen )
 {
@@ -2274,29 +2274,29 @@
     ((void) ssl);
 
     if( ( ssl->handshake->cli_exts &
-          TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
+          MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
     {
         *olen = 0;
         return;
     }
 
-    SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
 
-    *p++ = (unsigned char)( ( TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
-    *p++ = (unsigned char)( ( TLS_EXT_SUPPORTED_POINT_FORMATS      ) & 0xFF );
+    *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
+    *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS      ) & 0xFF );
 
     *p++ = 0x00;
     *p++ = 2;
 
     *p++ = 1;
-    *p++ = POLARSSL_ECP_PF_UNCOMPRESSED;
+    *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
 
     *olen = 6;
 }
-#endif /* POLARSSL_ECDH_C || POLARSSL_ECDSA_C */
+#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
 
-#if defined(POLARSSL_SSL_ALPN )
-static void ssl_write_alpn_ext( ssl_context *ssl,
+#if defined(MBEDTLS_SSL_ALPN )
+static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
                                 unsigned char *buf, size_t *olen )
 {
     if( ssl->alpn_chosen == NULL )
@@ -2305,7 +2305,7 @@
         return;
     }
 
-    SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) );
 
     /*
      * 0 . 1    ext identifier
@@ -2314,8 +2314,8 @@
      * 6 . 6    protocol name length
      * 7 . 7+n  protocol name
      */
-    buf[0] = (unsigned char)( ( TLS_EXT_ALPN >> 8 ) & 0xFF );
-    buf[1] = (unsigned char)( ( TLS_EXT_ALPN      ) & 0xFF );
+    buf[0] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
+    buf[1] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN      ) & 0xFF );
 
     *olen = 7 + strlen( ssl->alpn_chosen );
 
@@ -2329,16 +2329,16 @@
 
     memcpy( buf + 7, ssl->alpn_chosen, *olen - 7 );
 }
-#endif /* POLARSSL_ECDH_C || POLARSSL_ECDSA_C */
+#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
 
-#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
-static int ssl_write_hello_verify_request( ssl_context *ssl )
+#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
+static int ssl_write_hello_verify_request( mbedtls_ssl_context *ssl )
 {
     int ret;
     unsigned char *p = ssl->out_msg + 4;
     unsigned char *cookie_len_byte;
 
-    SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) );
 
     /*
      * struct {
@@ -2349,77 +2349,77 @@
 
     /* The RFC is not clear on this point, but sending the actual negotiated
      * version looks like the most interoperable thing to do. */
-    ssl_write_version( ssl->major_ver, ssl->minor_ver,
+    mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
                        ssl->transport, p );
-    SSL_DEBUG_BUF( 3, "server version", p, 2 );
+    MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
     p += 2;
 
     /* If we get here, f_cookie_check is not null */
     if( ssl->f_cookie_write == NULL )
     {
-        SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
-        return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
+        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
     }
 
     /* Skip length byte until we know the length */
     cookie_len_byte = p++;
 
     if( ( ret = ssl->f_cookie_write( ssl->p_cookie,
-                                     &p, ssl->out_buf + SSL_BUFFER_LEN,
+                                     &p, ssl->out_buf + MBEDTLS_SSL_BUFFER_LEN,
                                      ssl->cli_id, ssl->cli_id_len ) ) != 0 )
     {
-        SSL_DEBUG_RET( 1, "f_cookie_write", ret );
+        MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret );
         return( ret );
     }
 
     *cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) );
 
-    SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte );
+    MBEDTLS_SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte );
 
     ssl->out_msglen  = p - ssl->out_msg;
-    ssl->out_msgtype = SSL_MSG_HANDSHAKE;
-    ssl->out_msg[0]  = SSL_HS_HELLO_VERIFY_REQUEST;
+    ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
+    ssl->out_msg[0]  = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
 
-    ssl->state = SSL_SERVER_HELLO_VERIFY_REQUEST_SENT;
+    ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT;
 
-    if( ( ret = ssl_write_record( ssl ) ) != 0 )
+    if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
     {
-        SSL_DEBUG_RET( 1, "ssl_write_record", ret );
+        MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
         return( ret );
     }
 
-    SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) );
 
     return( 0 );
 }
-#endif /* POLARSSL_SSL_DTLS_HELLO_VERIFY */
+#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
 
-static int ssl_write_server_hello( ssl_context *ssl )
+static int ssl_write_server_hello( mbedtls_ssl_context *ssl )
 {
-#if defined(POLARSSL_HAVE_TIME)
+#if defined(MBEDTLS_HAVE_TIME)
     time_t t;
 #endif
     int ret;
     size_t olen, ext_len = 0, n;
     unsigned char *buf, *p;
 
-    SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
 
-#if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
-    if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
+    if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
         ssl->handshake->verify_cookie_len != 0 )
     {
-        SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) );
-        SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
 
         return( ssl_write_hello_verify_request( ssl ) );
     }
-#endif /* POLARSSL_SSL_DTLS_HELLO_VERIFY */
+#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
 
     if( ssl->f_rng == NULL )
     {
-        SSL_DEBUG_MSG( 1, ( "no RNG provided") );
-        return( POLARSSL_ERR_SSL_NO_RNG );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
+        return( MBEDTLS_ERR_SSL_NO_RNG );
     }
 
     /*
@@ -2432,27 +2432,27 @@
     buf = ssl->out_msg;
     p = buf + 4;
 
-    ssl_write_version( ssl->major_ver, ssl->minor_ver,
+    mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
                        ssl->transport, p );
     p += 2;
 
-    SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
                         buf[4], buf[5] ) );
 
-#if defined(POLARSSL_HAVE_TIME)
+#if defined(MBEDTLS_HAVE_TIME)
     t = time( NULL );
     *p++ = (unsigned char)( t >> 24 );
     *p++ = (unsigned char)( t >> 16 );
     *p++ = (unsigned char)( t >>  8 );
     *p++ = (unsigned char)( t       );
 
-    SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
 #else
     if( ( ret = ssl->f_rng( ssl->p_rng, p, 4 ) ) != 0 )
         return( ret );
 
     p += 4;
-#endif /* POLARSSL_HAVE_TIME */
+#endif /* MBEDTLS_HAVE_TIME */
 
     if( ( ret = ssl->f_rng( ssl->p_rng, p, 28 ) ) != 0 )
         return( ret );
@@ -2461,7 +2461,7 @@
 
     memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
 
-    SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
+    MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
 
     /*
      * Resume is 0  by default, see ssl_handshake_init().
@@ -2469,14 +2469,14 @@
      * If not, try looking up session ID in our cache.
      */
     if( ssl->handshake->resume == 0 &&
-#if defined(POLARSSL_SSL_RENEGOTIATION)
-        ssl->renego_status == SSL_INITIAL_HANDSHAKE &&
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+        ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE &&
 #endif
         ssl->session_negotiate->length != 0 &&
         ssl->f_get_cache != NULL &&
         ssl->f_get_cache( ssl->p_get_cache, ssl->session_negotiate ) == 0 )
     {
-        SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) );
         ssl->handshake->resume = 1;
     }
 
@@ -2488,18 +2488,18 @@
          */
         ssl->state++;
 
-#if defined(POLARSSL_HAVE_TIME)
+#if defined(MBEDTLS_HAVE_TIME)
         ssl->session_negotiate->start = time( NULL );
 #endif
 
-#if defined(POLARSSL_SSL_SESSION_TICKETS)
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
         if( ssl->handshake->new_session_ticket != 0 )
         {
             ssl->session_negotiate->length = n = 0;
             memset( ssl->session_negotiate->id, 0, 32 );
         }
         else
-#endif /* POLARSSL_SSL_SESSION_TICKETS */
+#endif /* MBEDTLS_SSL_SESSION_TICKETS */
         {
             ssl->session_negotiate->length = n = 32;
             if( ( ret = ssl->f_rng( ssl->p_rng, ssl->session_negotiate->id,
@@ -2513,11 +2513,11 @@
          * Resuming a session
          */
         n = ssl->session_negotiate->length;
-        ssl->state = SSL_SERVER_CHANGE_CIPHER_SPEC;
+        ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
 
-        if( ( ret = ssl_derive_keys( ssl ) ) != 0 )
+        if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "ssl_derive_keys", ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
             return( ret );
         }
     }
@@ -2534,18 +2534,18 @@
     memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->length );
     p += ssl->session_negotiate->length;
 
-    SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
-    SSL_DEBUG_BUF( 3,   "server hello, session id", buf + 39, n );
-    SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
+    MBEDTLS_SSL_DEBUG_BUF( 3,   "server hello, session id", buf + 39, n );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
                    ssl->handshake->resume ? "a" : "no" ) );
 
     *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 );
     *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite      );
     *p++ = (unsigned char)( ssl->session_negotiate->compression      );
 
-    SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
-           ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
-    SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
+           mbedtls_ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
                    ssl->session_negotiate->compression ) );
 
     /*
@@ -2554,42 +2554,42 @@
     ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
     ext_len += olen;
 
-#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
+#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
     ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
     ext_len += olen;
 #endif
 
-#if defined(POLARSSL_SSL_TRUNCATED_HMAC)
+#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
     ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
     ext_len += olen;
 #endif
 
-#if defined(POLARSSL_SSL_ENCRYPT_THEN_MAC)
+#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
     ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
     ext_len += olen;
 #endif
 
-#if defined(POLARSSL_SSL_EXTENDED_MASTER_SECRET)
+#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
     ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
     ext_len += olen;
 #endif
 
-#if defined(POLARSSL_SSL_SESSION_TICKETS)
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
     ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
     ext_len += olen;
 #endif
 
-#if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
+#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
     ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
     ext_len += olen;
 #endif
 
-#if defined(POLARSSL_SSL_ALPN)
+#if defined(MBEDTLS_SSL_ALPN)
     ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
     ext_len += olen;
 #endif
 
-    SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) );
 
     if( ext_len > 0 )
     {
@@ -2599,60 +2599,60 @@
     }
 
     ssl->out_msglen  = p - buf;
-    ssl->out_msgtype = SSL_MSG_HANDSHAKE;
-    ssl->out_msg[0]  = SSL_HS_SERVER_HELLO;
+    ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
+    ssl->out_msg[0]  = MBEDTLS_SSL_HS_SERVER_HELLO;
 
-    ret = ssl_write_record( ssl );
+    ret = mbedtls_ssl_write_record( ssl );
 
-    SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
 
     return( ret );
 }
 
-#if !defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED)       && \
-    !defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED)   && \
-    !defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
-    !defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
-static int ssl_write_certificate_request( ssl_context *ssl )
+#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)       && \
+    !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)   && \
+    !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
+    !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
+static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
 {
-    const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
+    const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
 
-    SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
 
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
     {
-        SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
         ssl->state++;
         return( 0 );
     }
 
-    SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-    return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
+    MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
+    return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 }
 #else
-static int ssl_write_certificate_request( ssl_context *ssl )
+static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
 {
-    int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
-    const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
+    int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
+    const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
     size_t dn_size, total_dn_size; /* excluding length bytes */
     size_t ct_len, sa_len; /* including length bytes */
     unsigned char *buf, *p;
-    const x509_crt *crt;
+    const mbedtls_x509_crt *crt;
 
-    SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
 
     ssl->state++;
 
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK ||
-        ssl->authmode == SSL_VERIFY_NONE )
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
+        ssl->authmode == MBEDTLS_SSL_VERIFY_NONE )
     {
-        SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
         return( 0 );
     }
 
@@ -2679,18 +2679,18 @@
      */
     ct_len = 0;
 
-#if defined(POLARSSL_RSA_C)
-    p[1 + ct_len++] = SSL_CERT_TYPE_RSA_SIGN;
+#if defined(MBEDTLS_RSA_C)
+    p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN;
 #endif
-#if defined(POLARSSL_ECDSA_C)
-    p[1 + ct_len++] = SSL_CERT_TYPE_ECDSA_SIGN;
+#if defined(MBEDTLS_ECDSA_C)
+    p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN;
 #endif
 
     p[0] = (unsigned char) ct_len++;
     p += ct_len;
 
     sa_len = 0;
-#if defined(POLARSSL_SSL_PROTO_TLS1_2)
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
     /*
      * Add signature_algorithms for verify (TLS 1.2)
      *
@@ -2704,30 +2704,30 @@
      *     enum { (255) } HashAlgorithm;
      *     enum { (255) } SignatureAlgorithm;
      */
-    if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
+    if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
     {
         /*
          * Only use current running hash algorithm that is already required
          * for requested ciphersuite.
          */
-        ssl->handshake->verify_sig_alg = SSL_HASH_SHA256;
+        ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA256;
 
         if( ssl->transform_negotiate->ciphersuite_info->mac ==
-            POLARSSL_MD_SHA384 )
+            MBEDTLS_MD_SHA384 )
         {
-            ssl->handshake->verify_sig_alg = SSL_HASH_SHA384;
+            ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA384;
         }
 
         /*
          * Supported signature algorithms
          */
-#if defined(POLARSSL_RSA_C)
+#if defined(MBEDTLS_RSA_C)
         p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
-        p[2 + sa_len++] = SSL_SIG_RSA;
+        p[2 + sa_len++] = MBEDTLS_SSL_SIG_RSA;
 #endif
-#if defined(POLARSSL_ECDSA_C)
+#if defined(MBEDTLS_ECDSA_C)
         p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
-        p[2 + sa_len++] = SSL_SIG_ECDSA;
+        p[2 + sa_len++] = MBEDTLS_SSL_SIG_ECDSA;
 #endif
 
         p[0] = (unsigned char)( sa_len >> 8 );
@@ -2735,7 +2735,7 @@
         sa_len += 2;
         p += sa_len;
     }
-#endif /* POLARSSL_SSL_PROTO_TLS1_2 */
+#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
 
     /*
      * DistinguishedName certificate_authorities<0..2^16-1>;
@@ -2756,66 +2756,66 @@
         memcpy( p, crt->subject_raw.p, dn_size );
         p += dn_size;
 
-        SSL_DEBUG_BUF( 3, "requested DN", p, dn_size );
+        MBEDTLS_SSL_DEBUG_BUF( 3, "requested DN", p, dn_size );
 
         total_dn_size += 2 + dn_size;
         crt = crt->next;
     }
 
     ssl->out_msglen  = p - buf;
-    ssl->out_msgtype = SSL_MSG_HANDSHAKE;
-    ssl->out_msg[0]  = SSL_HS_CERTIFICATE_REQUEST;
+    ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
+    ssl->out_msg[0]  = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST;
     ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size  >> 8 );
     ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size       );
 
-    ret = ssl_write_record( ssl );
+    ret = mbedtls_ssl_write_record( ssl );
 
-    SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
 
     return( ret );
 }
-#endif /* !POLARSSL_KEY_EXCHANGE_RSA_ENABLED &&
-          !POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED &&
-          !POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
-          !POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
+#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
+          !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
+          !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
+          !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
 
-#if defined(POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
-    defined(POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
-static int ssl_get_ecdh_params_from_cert( ssl_context *ssl )
+#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
+    defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
+static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
 {
     int ret;
 
-    if( ! pk_can_do( ssl_own_key( ssl ), POLARSSL_PK_ECKEY ) )
+    if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECKEY ) )
     {
-        SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
-        return( POLARSSL_ERR_SSL_PK_TYPE_MISMATCH );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
+        return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
     }
 
-    if( ( ret = ecdh_get_params( &ssl->handshake->ecdh_ctx,
-                                 pk_ec( *ssl_own_key( ssl ) ),
-                                 POLARSSL_ECDH_OURS ) ) != 0 )
+    if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx,
+                                 mbedtls_pk_ec( *mbedtls_ssl_own_key( ssl ) ),
+                                 MBEDTLS_ECDH_OURS ) ) != 0 )
     {
-        SSL_DEBUG_RET( 1, ( "ecdh_get_params" ), ret );
+        MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
         return( ret );
     }
 
     return( 0 );
 }
-#endif /* POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
-          POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
+#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
+          MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
 
-static int ssl_write_server_key_exchange( ssl_context *ssl )
+static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl )
 {
     int ret;
     size_t n = 0;
-    const ssl_ciphersuite_t *ciphersuite_info =
+    const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
                             ssl->transform_negotiate->ciphersuite_info;
 
-#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) ||                       \
-    defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED) ||                       \
-    defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) ||                     \
-    defined(POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED) ||                     \
-    defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
+#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||                       \
+    defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) ||                       \
+    defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) ||                     \
+    defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) ||                     \
+    defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
     unsigned char *p = ssl->out_msg + 4;
     unsigned char *dig_signed = p;
     size_t dig_signed_len = 0, len;
@@ -2823,38 +2823,38 @@
     ((void) dig_signed_len);
 #endif
 
-    SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
 
-#if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) ||                           \
-    defined(POLARSSL_KEY_EXCHANGE_PSK_ENABLED) ||                           \
-    defined(POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED)
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK )
+#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) ||                           \
+    defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) ||                           \
+    defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
     {
-        SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
         ssl->state++;
         return( 0 );
     }
 #endif
 
-#if defined(POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
-    defined(POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDH_RSA ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDH_ECDSA )
+#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
+    defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
     {
         ssl_get_ecdh_params_from_cert( ssl );
 
-        SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
         ssl->state++;
         return( 0 );
     }
 #endif
 
-#if defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED) ||                       \
-    defined(POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
+#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) ||                       \
+    defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
     {
         /* TODO: Support identity hints */
         *(p++) = 0x00;
@@ -2862,13 +2862,13 @@
 
         n += 2;
     }
-#endif /* POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED ||
-          POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
+#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED ||
+          MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
 
-#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) ||                       \
-    defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED)
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_RSA ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
+#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||                       \
+    defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
     {
         /*
          * Ephemeral DH parameters:
@@ -2879,18 +2879,18 @@
          *     opaque dh_Ys<1..2^16-1>;
          * } ServerDHParams;
          */
-        if( ( ret = mpi_copy( &ssl->handshake->dhm_ctx.P, &ssl->dhm_P ) ) != 0 ||
-            ( ret = mpi_copy( &ssl->handshake->dhm_ctx.G, &ssl->dhm_G ) ) != 0 )
+        if( ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.P, &ssl->dhm_P ) ) != 0 ||
+            ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.G, &ssl->dhm_G ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "mpi_copy", ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_mpi_copy", ret );
             return( ret );
         }
 
-        if( ( ret = dhm_make_params( &ssl->handshake->dhm_ctx,
-                        (int) mpi_size( &ssl->handshake->dhm_ctx.P ),
+        if( ( ret = mbedtls_dhm_make_params( &ssl->handshake->dhm_ctx,
+                        (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
                         p, &len, ssl->f_rng, ssl->p_rng ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "dhm_make_params", ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret );
             return( ret );
         }
 
@@ -2900,18 +2900,18 @@
         p += len;
         n += len;
 
-        SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X  );
-        SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P  );
-        SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G  );
-        SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
+        MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X  );
+        MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P  );
+        MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G  );
+        MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
     }
-#endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED ||
-          POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED */
+#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
+          MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
 
-#if defined(POLARSSL_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_RSA ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
+#if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
     {
         /*
          * Ephemeral ECDH parameters:
@@ -2921,12 +2921,12 @@
          *     ECPoint      public;
          * } ServerECDHParams;
          */
-        const ecp_curve_info **curve = NULL;
-#if defined(POLARSSL_SSL_SET_CURVES)
-        const ecp_group_id *gid;
+        const mbedtls_ecp_curve_info **curve = NULL;
+#if defined(MBEDTLS_SSL_SET_CURVES)
+        const mbedtls_ecp_group_id *gid;
 
         /* Match our preference list against the offered curves */
-        for( gid = ssl->curve_list; *gid != POLARSSL_ECP_DP_NONE; gid++ )
+        for( gid = ssl->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
             for( curve = ssl->handshake->curves; *curve != NULL; curve++ )
                 if( (*curve)->grp_id == *gid )
                     goto curve_matching_done;
@@ -2938,24 +2938,24 @@
 
         if( *curve == NULL )
         {
-            SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) );
-            return( POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) );
+            return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
         }
 
-        SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) );
+        MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) );
 
-        if( ( ret = ecp_use_known_dp( &ssl->handshake->ecdh_ctx.grp,
+        if( ( ret = mbedtls_ecp_use_known_dp( &ssl->handshake->ecdh_ctx.grp,
                                        (*curve)->grp_id ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "ecp_use_known_dp", ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_use_known_dp", ret );
             return( ret );
         }
 
-        if( ( ret = ecdh_make_params( &ssl->handshake->ecdh_ctx, &len,
-                                      p, SSL_MAX_CONTENT_LEN - n,
+        if( ( ret = mbedtls_ecdh_make_params( &ssl->handshake->ecdh_ctx, &len,
+                                      p, MBEDTLS_SSL_MAX_CONTENT_LEN - n,
                                       ssl->f_rng, ssl->p_rng ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "ecdh_make_params", ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret );
             return( ret );
         }
 
@@ -2965,63 +2965,63 @@
         p += len;
         n += len;
 
-        SSL_DEBUG_ECP( 3, "ECDH: Q ", &ssl->handshake->ecdh_ctx.Q );
+        MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q ", &ssl->handshake->ecdh_ctx.Q );
     }
-#endif /* POLARSSL_KEY_EXCHANGE__SOME__ECDHE_ENABLED */
+#endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED */
 
-#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) ||                       \
-    defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) ||                     \
-    defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_RSA ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_RSA ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA )
+#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||                       \
+    defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) ||                     \
+    defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
     {
         size_t signature_len = 0;
         unsigned int hashlen = 0;
         unsigned char hash[64];
-        md_type_t md_alg = POLARSSL_MD_NONE;
+        mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
 
         /*
          * Choose hash algorithm. NONE means MD5 + SHA1 here.
          */
-#if defined(POLARSSL_SSL_PROTO_TLS1_2)
-        if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
+        if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
         {
-            md_alg = ssl_md_alg_from_hash( ssl->handshake->sig_alg );
+            md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->sig_alg );
 
-            if( md_alg == POLARSSL_MD_NONE )
+            if( md_alg == MBEDTLS_MD_NONE )
             {
-                SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-                return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
+                MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
+                return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
             }
         }
         else
-#endif /* POLARSSL_SSL_PROTO_TLS1_2 */
-#if defined(POLARSSL_SSL_PROTO_SSL3) || defined(POLARSSL_SSL_PROTO_TLS1) || \
-    defined(POLARSSL_SSL_PROTO_TLS1_1)
+#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
+#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
+    defined(MBEDTLS_SSL_PROTO_TLS1_1)
         if( ciphersuite_info->key_exchange ==
-                  POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA )
+                  MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
         {
-            md_alg = POLARSSL_MD_SHA1;
+            md_alg = MBEDTLS_MD_SHA1;
         }
         else
 #endif
         {
-            md_alg = POLARSSL_MD_NONE;
+            md_alg = MBEDTLS_MD_NONE;
         }
 
         /*
          * Compute the hash to be signed
          */
-#if defined(POLARSSL_SSL_PROTO_SSL3) || defined(POLARSSL_SSL_PROTO_TLS1) || \
-    defined(POLARSSL_SSL_PROTO_TLS1_1)
-        if( md_alg == POLARSSL_MD_NONE )
+#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
+    defined(MBEDTLS_SSL_PROTO_TLS1_1)
+        if( md_alg == MBEDTLS_MD_NONE )
         {
-            md5_context md5;
-            sha1_context sha1;
+            mbedtls_md5_context mbedtls_md5;
+            mbedtls_sha1_context mbedtls_sha1;
 
-            md5_init(  &md5  );
-            sha1_init( &sha1 );
+            mbedtls_md5_init(  &mbedtls_md5  );
+            mbedtls_sha1_init( &mbedtls_sha1 );
 
             /*
              * digitally-signed struct {
@@ -3036,32 +3036,32 @@
              *     SHA(ClientHello.random + ServerHello.random
              *                            + ServerParams);
              */
-            md5_starts( &md5 );
-            md5_update( &md5, ssl->handshake->randbytes,  64 );
-            md5_update( &md5, dig_signed, dig_signed_len );
-            md5_finish( &md5, hash );
+            mbedtls_md5_starts( &mbedtls_md5 );
+            mbedtls_md5_update( &mbedtls_md5, ssl->handshake->randbytes,  64 );
+            mbedtls_md5_update( &mbedtls_md5, dig_signed, dig_signed_len );
+            mbedtls_md5_finish( &mbedtls_md5, hash );
 
-            sha1_starts( &sha1 );
-            sha1_update( &sha1, ssl->handshake->randbytes,  64 );
-            sha1_update( &sha1, dig_signed, dig_signed_len );
-            sha1_finish( &sha1, hash + 16 );
+            mbedtls_sha1_starts( &mbedtls_sha1 );
+            mbedtls_sha1_update( &mbedtls_sha1, ssl->handshake->randbytes,  64 );
+            mbedtls_sha1_update( &mbedtls_sha1, dig_signed, dig_signed_len );
+            mbedtls_sha1_finish( &mbedtls_sha1, hash + 16 );
 
             hashlen = 36;
 
-            md5_free(  &md5  );
-            sha1_free( &sha1 );
+            mbedtls_md5_free(  &mbedtls_md5  );
+            mbedtls_sha1_free( &mbedtls_sha1 );
         }
         else
-#endif /* POLARSSL_SSL_PROTO_SSL3 || POLARSSL_SSL_PROTO_TLS1 || \
-          POLARSSL_SSL_PROTO_TLS1_1 */
-#if defined(POLARSSL_SSL_PROTO_TLS1) || defined(POLARSSL_SSL_PROTO_TLS1_1) || \
-    defined(POLARSSL_SSL_PROTO_TLS1_2)
-        if( md_alg != POLARSSL_MD_NONE )
+#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
+          MBEDTLS_SSL_PROTO_TLS1_1 */
+#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
+    defined(MBEDTLS_SSL_PROTO_TLS1_2)
+        if( md_alg != MBEDTLS_MD_NONE )
         {
-            md_context_t ctx;
-            const md_info_t *md_info = md_info_from_type( md_alg );
+            mbedtls_md_context_t ctx;
+            const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
 
-            md_init( &ctx );
+            mbedtls_md_init( &ctx );
 
             /* Info from md_alg will be used instead */
             hashlen = 0;
@@ -3073,53 +3073,53 @@
              *     ServerDHParams params;
              * };
              */
-            if( ( ret = md_setup( &ctx, md_info, 0 ) ) != 0 )
+            if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
             {
-                SSL_DEBUG_RET( 1, "md_setup", ret );
+                MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
                 return( ret );
             }
 
-            md_starts( &ctx );
-            md_update( &ctx, ssl->handshake->randbytes, 64 );
-            md_update( &ctx, dig_signed, dig_signed_len );
-            md_finish( &ctx, hash );
-            md_free( &ctx );
+            mbedtls_md_starts( &ctx );
+            mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 );
+            mbedtls_md_update( &ctx, dig_signed, dig_signed_len );
+            mbedtls_md_finish( &ctx, hash );
+            mbedtls_md_free( &ctx );
         }
         else
-#endif /* POLARSSL_SSL_PROTO_TLS1 || POLARSSL_SSL_PROTO_TLS1_1 || \
-          POLARSSL_SSL_PROTO_TLS1_2 */
+#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
+          MBEDTLS_SSL_PROTO_TLS1_2 */
         {
-            SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
+            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
         }
 
-        SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
-            (unsigned int) ( md_get_size( md_info_from_type( md_alg ) ) ) );
+        MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
+            (unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) );
 
         /*
          * Make the signature
          */
-        if( ssl_own_key( ssl ) == NULL )
+        if( mbedtls_ssl_own_key( ssl ) == NULL )
         {
-            SSL_DEBUG_MSG( 1, ( "got no private key" ) );
-            return( POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) );
+            return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
         }
 
-#if defined(POLARSSL_SSL_PROTO_TLS1_2)
-        if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
+        if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
         {
             *(p++) = ssl->handshake->sig_alg;
-            *(p++) = ssl_sig_from_pk( ssl_own_key( ssl ) );
+            *(p++) = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) );
 
             n += 2;
         }
-#endif /* POLARSSL_SSL_PROTO_TLS1_2 */
+#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
 
-        if( ( ret = pk_sign( ssl_own_key( ssl ), md_alg, hash, hashlen,
+        if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash, hashlen,
                         p + 2 , &signature_len,
                         ssl->f_rng, ssl->p_rng ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "pk_sign", ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
             return( ret );
         }
 
@@ -3127,66 +3127,66 @@
         *(p++) = (unsigned char)( signature_len      );
         n += 2;
 
-        SSL_DEBUG_BUF( 3, "my signature", p, signature_len );
+        MBEDTLS_SSL_DEBUG_BUF( 3, "my signature", p, signature_len );
 
         p += signature_len;
         n += signature_len;
     }
-#endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) ||
-          POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
-          POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
+#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||
+          MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
+          MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
 
     ssl->out_msglen  = 4 + n;
-    ssl->out_msgtype = SSL_MSG_HANDSHAKE;
-    ssl->out_msg[0]  = SSL_HS_SERVER_KEY_EXCHANGE;
+    ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
+    ssl->out_msg[0]  = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE;
 
     ssl->state++;
 
-    if( ( ret = ssl_write_record( ssl ) ) != 0 )
+    if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
     {
-        SSL_DEBUG_RET( 1, "ssl_write_record", ret );
+        MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
         return( ret );
     }
 
-    SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
 
     return( 0 );
 }
 
-static int ssl_write_server_hello_done( ssl_context *ssl )
+static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl )
 {
     int ret;
 
-    SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
 
     ssl->out_msglen  = 4;
-    ssl->out_msgtype = SSL_MSG_HANDSHAKE;
-    ssl->out_msg[0]  = SSL_HS_SERVER_HELLO_DONE;
+    ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
+    ssl->out_msg[0]  = MBEDTLS_SSL_HS_SERVER_HELLO_DONE;
 
     ssl->state++;
 
-#if defined(POLARSSL_SSL_PROTO_DTLS)
-    if( ssl->transport == SSL_TRANSPORT_DATAGRAM )
-        ssl_send_flight_completed( ssl );
+#if defined(MBEDTLS_SSL_PROTO_DTLS)
+    if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+        mbedtls_ssl_send_flight_completed( ssl );
 #endif
 
-    if( ( ret = ssl_write_record( ssl ) ) != 0 )
+    if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
     {
-        SSL_DEBUG_RET( 1, "ssl_write_record", ret );
+        MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
         return( ret );
     }
 
-    SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
 
     return( 0 );
 }
 
-#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) ||                       \
-    defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED)
-static int ssl_parse_client_dh_public( ssl_context *ssl, unsigned char **p,
+#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||                       \
+    defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
+static int ssl_parse_client_dh_public( mbedtls_ssl_context *ssl, unsigned char **p,
                                        const unsigned char *end )
 {
-    int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
+    int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
     size_t n;
 
     /*
@@ -3194,8 +3194,8 @@
      */
     if( *p + 2 > end )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
     }
 
     n = ( (*p)[0] << 8 ) | (*p)[1];
@@ -3203,69 +3203,69 @@
 
     if( *p + n > end )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
     }
 
-    if( ( ret = dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 )
+    if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 )
     {
-        SSL_DEBUG_RET( 1, "dhm_read_public", ret );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
+        MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
     }
 
     *p += n;
 
-    SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
+    MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
 
     return( ret );
 }
-#endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED ||
-          POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED */
+#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
+          MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
 
-#if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) ||                           \
-    defined(POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED)
-static int ssl_parse_encrypted_pms( ssl_context *ssl,
+#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) ||                           \
+    defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
+static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl,
                                     const unsigned char *p,
                                     const unsigned char *end,
                                     size_t pms_offset )
 {
     int ret;
-    size_t len = pk_get_len( ssl_own_key( ssl ) );
+    size_t len = mbedtls_pk_get_len( mbedtls_ssl_own_key( ssl ) );
     unsigned char *pms = ssl->handshake->premaster + pms_offset;
     unsigned char ver[2];
     unsigned char fake_pms[48], peer_pms[48];
     unsigned char mask;
     size_t i;
 
-    if( ! pk_can_do( ssl_own_key( ssl ), POLARSSL_PK_RSA ) )
+    if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_RSA ) )
     {
-        SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
-        return( POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
+        return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
     }
 
     /*
      * Decrypt the premaster using own private RSA key
      */
-#if defined(POLARSSL_SSL_PROTO_TLS1) || defined(POLARSSL_SSL_PROTO_TLS1_1) || \
-    defined(POLARSSL_SSL_PROTO_TLS1_2)
-    if( ssl->minor_ver != SSL_MINOR_VERSION_0 )
+#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
+    defined(MBEDTLS_SSL_PROTO_TLS1_2)
+    if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
     {
         if( *p++ != ( ( len >> 8 ) & 0xFF ) ||
             *p++ != ( ( len      ) & 0xFF ) )
         {
-            SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
         }
     }
 #endif
 
     if( p + len != end )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
     }
 
-    ssl_write_version( ssl->handshake->max_major_ver,
+    mbedtls_ssl_write_version( ssl->handshake->max_major_ver,
                        ssl->handshake->max_minor_ver,
                        ssl->transport, ver );
     /*
@@ -3279,7 +3279,7 @@
     if( ret != 0 )
         return( ret );
 
-    ret = pk_decrypt( ssl_own_key( ssl ), p, len,
+    ret = mbedtls_pk_decrypt( mbedtls_ssl_own_key( ssl ), p, len,
                       peer_pms, &ssl->handshake->pmslen,
                       sizeof( peer_pms ),
                       ssl->f_rng, ssl->p_rng );
@@ -3288,16 +3288,16 @@
     ret |= peer_pms[0] - ver[0];
     ret |= peer_pms[1] - ver[1];
 
-#if defined(POLARSSL_SSL_DEBUG_ALL)
+#if defined(MBEDTLS_SSL_DEBUG_ALL)
     if( ret != 0 )
-        SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
 #endif
 
     if( sizeof( ssl->handshake->premaster ) < pms_offset ||
         sizeof( ssl->handshake->premaster ) - pms_offset < 48 )
     {
-        SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
+        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
     }
     ssl->handshake->pmslen = 48;
 
@@ -3307,11 +3307,11 @@
 
     return( 0 );
 }
-#endif /* POLARSSL_KEY_EXCHANGE_RSA_ENABLED ||
-          POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED */
+#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
+          MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
 
-#if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED)
-static int ssl_parse_client_psk_identity( ssl_context *ssl, unsigned char **p,
+#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
+static int ssl_parse_client_psk_identity( mbedtls_ssl_context *ssl, unsigned char **p,
                                           const unsigned char *end )
 {
     int ret = 0;
@@ -3321,8 +3321,8 @@
         ( ssl->psk == NULL || ssl->psk_identity == NULL ||
           ssl->psk_identity_len == 0 || ssl->psk_len == 0 ) )
     {
-        SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
-        return( POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
+        return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
     }
 
     /*
@@ -3330,8 +3330,8 @@
      */
     if( *p + 2 > end )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
     }
 
     n = ( (*p)[0] << 8 ) | (*p)[1];
@@ -3339,320 +3339,320 @@
 
     if( n < 1 || n > 65535 || *p + n > end )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
     }
 
     if( ssl->f_psk != NULL )
     {
         if( ssl->f_psk( ssl->p_psk, ssl, *p, n ) != 0 )
-            ret = POLARSSL_ERR_SSL_UNKNOWN_IDENTITY;
+            ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
     }
     else
     {
         /* Identity is not a big secret since clients send it in the clear,
          * but treat it carefully anyway, just in case */
         if( n != ssl->psk_identity_len ||
-            safer_memcmp( ssl->psk_identity, *p, n ) != 0 )
+            mbedtls_ssl_safer_memcmp( ssl->psk_identity, *p, n ) != 0 )
         {
-            ret = POLARSSL_ERR_SSL_UNKNOWN_IDENTITY;
+            ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
         }
     }
 
-    if( ret == POLARSSL_ERR_SSL_UNKNOWN_IDENTITY )
+    if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY )
     {
-        SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
-        if( ( ret = ssl_send_alert_message( ssl,
-                              SSL_ALERT_LEVEL_FATAL,
-                              SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY ) ) != 0 )
+        MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
+        if( ( ret = mbedtls_ssl_send_alert_message( ssl,
+                              MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+                              MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY ) ) != 0 )
         {
             return( ret );
         }
 
-        return( POLARSSL_ERR_SSL_UNKNOWN_IDENTITY );
+        return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY );
     }
 
     *p += n;
 
     return( 0 );
 }
-#endif /* POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED */
+#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
 
-static int ssl_parse_client_key_exchange( ssl_context *ssl )
+static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
 {
     int ret;
-    const ssl_ciphersuite_t *ciphersuite_info;
+    const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
     unsigned char *p, *end;
 
     ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
 
-    SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
 
-    if( ( ret = ssl_read_record( ssl ) ) != 0 )
+    if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
     {
-        SSL_DEBUG_RET( 1, "ssl_read_record", ret );
+        MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
         return( ret );
     }
 
-    p = ssl->in_msg + ssl_hs_hdr_len( ssl );
+    p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
     end = ssl->in_msg + ssl->in_hslen;
 
-    if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
+    if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
     }
 
-    if( ssl->in_msg[0] != SSL_HS_CLIENT_KEY_EXCHANGE )
+    if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE )
     {
-        SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
     }
 
-#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED)
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_RSA )
+#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
     {
         if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
             return( ret );
         }
 
         if( p != end )
         {
-            SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
         }
 
-        ssl->handshake->pmslen = POLARSSL_PREMASTER_SIZE;
+        ssl->handshake->pmslen = MBEDTLS_PREMASTER_SIZE;
 
-        if( ( ret = dhm_calc_secret( &ssl->handshake->dhm_ctx,
+        if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
                                       ssl->handshake->premaster,
                                      &ssl->handshake->pmslen,
                                       ssl->f_rng, ssl->p_rng ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "dhm_calc_secret", ret );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
         }
 
-        SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K  );
+        MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K  );
     }
     else
-#endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED */
-#if defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) ||                     \
-    defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) ||                   \
-    defined(POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||                      \
-    defined(POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_RSA ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDH_RSA ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDH_ECDSA )
+#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
+#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) ||                     \
+    defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) ||                   \
+    defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||                      \
+    defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
     {
-        if( ( ret = ecdh_read_public( &ssl->handshake->ecdh_ctx,
+        if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
                                       p, end - p) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "ecdh_read_public", ret );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
         }
 
-        SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
+        MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
 
-        if( ( ret = ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
+        if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
                                       &ssl->handshake->pmslen,
                                        ssl->handshake->premaster,
-                                       POLARSSL_MPI_MAX_SIZE,
+                                       MBEDTLS_MPI_MAX_SIZE,
                                        ssl->f_rng, ssl->p_rng ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "ecdh_calc_secret", ret );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
         }
 
-        SSL_DEBUG_MPI( 3, "ECDH: z  ", &ssl->handshake->ecdh_ctx.z );
+        MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z  ", &ssl->handshake->ecdh_ctx.z );
     }
     else
-#endif /* POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
-          POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
-          POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
-          POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
-#if defined(POLARSSL_KEY_EXCHANGE_PSK_ENABLED)
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK )
+#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
+          MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
+          MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
+          MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
+#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
     {
         if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
             return( ret );
         }
 
         if( p != end )
         {
-            SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
         }
 
-        if( ( ret = ssl_psk_derive_premaster( ssl,
+        if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
                         ciphersuite_info->key_exchange ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
             return( ret );
         }
     }
     else
-#endif /* POLARSSL_KEY_EXCHANGE_PSK_ENABLED */
-#if defined(POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED)
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK )
+#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
+#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
     {
         if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
             return( ret );
         }
 
         if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
             return( ret );
         }
 
-        if( ( ret = ssl_psk_derive_premaster( ssl,
+        if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
                         ciphersuite_info->key_exchange ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
             return( ret );
         }
     }
     else
-#endif /* POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED */
-#if defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED)
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
+#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
+#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
     {
         if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
             return( ret );
         }
         if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
             return( ret );
         }
 
         if( p != end )
         {
-            SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
         }
 
-        if( ( ret = ssl_psk_derive_premaster( ssl,
+        if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
                         ciphersuite_info->key_exchange ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
             return( ret );
         }
     }
     else
-#endif /* POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED */
-#if defined(POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
+#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
+#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
     {
         if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
             return( ret );
         }
 
-        if( ( ret = ecdh_read_public( &ssl->handshake->ecdh_ctx,
+        if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
                                        p, end - p ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "ecdh_read_public", ret );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
         }
 
-        SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
+        MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
 
-        if( ( ret = ssl_psk_derive_premaster( ssl,
+        if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
                         ciphersuite_info->key_exchange ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
             return( ret );
         }
     }
     else
-#endif /* POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
-#if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED)
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA )
+#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
+#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
     {
         if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 )
         {
-            SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
+            MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
             return( ret );
         }
     }
     else
-#endif /* POLARSSL_KEY_EXCHANGE_RSA_ENABLED */
+#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
     {
-        SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
+        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
     }
 
-    if( ( ret = ssl_derive_keys( ssl ) ) != 0 )
+    if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
     {
-        SSL_DEBUG_RET( 1, "ssl_derive_keys", ret );
+        MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
         return( ret );
     }
 
     ssl->state++;
 
-    SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
 
     return( 0 );
 }
 
-#if !defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED)       && \
-    !defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED)   && \
-    !defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
-    !defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
-static int ssl_parse_certificate_verify( ssl_context *ssl )
+#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)       && \
+    !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)   && \
+    !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
+    !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
+static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
 {
-    const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
+    const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
 
-    SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
 
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
     {
-        SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
         ssl->state++;
         return( 0 );
     }
 
-    SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-    return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
+    MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
+    return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 }
 #else
-static int ssl_parse_certificate_verify( ssl_context *ssl )
+static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
 {
-    int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
+    int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
     size_t i, sig_len;
     unsigned char hash[48];
     unsigned char *hash_start = hash;
     size_t hashlen;
-#if defined(POLARSSL_SSL_PROTO_TLS1_2)
-    pk_type_t pk_alg;
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
+    mbedtls_pk_type_t pk_alg;
 #endif
-    md_type_t md_alg;
-    const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
+    mbedtls_md_type_t md_alg;
+    const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
 
-    SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
 
-    if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK ||
-        ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK ||
+    if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
+        ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
         ssl->session_negotiate->peer_cert == NULL )
     {
-        SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
         ssl->state++;
         return( 0 );
     }
@@ -3660,22 +3660,22 @@
     /* Needs to be done before read_record() to exclude current message */
     ssl->handshake->calc_verify( ssl, hash );
 
-    if( ( ret = ssl_read_record( ssl ) ) != 0 )
+    if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
     {
-        SSL_DEBUG_RET( 1, "ssl_read_record", ret );
+        MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
         return( ret );
     }
 
     ssl->state++;
 
-    if( ssl->in_msgtype != SSL_MSG_HANDSHAKE ||
-        ssl->in_msg[0] != SSL_HS_CERTIFICATE_VERIFY )
+    if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ||
+        ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY )
     {
-        SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
     }
 
-    i = ssl_hs_hdr_len( ssl );
+    i = mbedtls_ssl_hs_hdr_len( ssl );
 
     /*
      *  struct {
@@ -3683,32 +3683,32 @@
      *     opaque signature<0..2^16-1>;
      *  } DigitallySigned;
      */
-#if defined(POLARSSL_SSL_PROTO_SSL3) || defined(POLARSSL_SSL_PROTO_TLS1) || \
-    defined(POLARSSL_SSL_PROTO_TLS1_1)
-    if( ssl->minor_ver != SSL_MINOR_VERSION_3 )
+#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
+    defined(MBEDTLS_SSL_PROTO_TLS1_1)
+    if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
     {
-        md_alg = POLARSSL_MD_NONE;
+        md_alg = MBEDTLS_MD_NONE;
         hashlen = 36;
 
         /* For ECDSA, use SHA-1, not MD-5 + SHA-1 */
-        if( pk_can_do( &ssl->session_negotiate->peer_cert->pk,
-                        POLARSSL_PK_ECDSA ) )
+        if( mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
+                        MBEDTLS_PK_ECDSA ) )
         {
             hash_start += 16;
             hashlen -= 16;
-            md_alg = POLARSSL_MD_SHA1;
+            md_alg = MBEDTLS_MD_SHA1;
         }
     }
     else
-#endif /* POLARSSL_SSL_PROTO_SSL3 || POLARSSL_SSL_PROTO_TLS1 ||
-          POLARSSL_SSL_PROTO_TLS1_1 */
-#if defined(POLARSSL_SSL_PROTO_TLS1_2)
-    if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
+#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 ||
+          MBEDTLS_SSL_PROTO_TLS1_1 */
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
+    if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
     {
         if( i + 2 > ssl->in_hslen )
         {
-            SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
         }
 
         /*
@@ -3716,12 +3716,12 @@
          */
         if( ssl->in_msg[i] != ssl->handshake->verify_sig_alg )
         {
-            SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
                                 " for verify message" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
         }
 
-        md_alg = ssl_md_alg_from_hash( ssl->handshake->verify_sig_alg );
+        md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->verify_sig_alg );
 
         /* Info from md_alg will be used instead */
         hashlen = 0;
@@ -3731,36 +3731,36 @@
         /*
          * Signature
          */
-        if( ( pk_alg = ssl_pk_alg_from_sig( ssl->in_msg[i] ) )
-                        == POLARSSL_PK_NONE )
+        if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( ssl->in_msg[i] ) )
+                        == MBEDTLS_PK_NONE )
         {
-            SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
                                 " for verify message" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
         }
 
         /*
          * Check the certificate's key type matches the signature alg
          */
-        if( ! pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
+        if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
         {
-            SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
+            return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
         }
 
         i++;
     }
     else
-#endif /* POLARSSL_SSL_PROTO_TLS1_2 */
+#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
     {
-        SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
+        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
     }
 
     if( i + 2 > ssl->in_hslen )
     {
-        SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
     }
 
     sig_len = ( ssl->in_msg[i] << 8 ) | ssl->in_msg[i+1];
@@ -3768,37 +3768,37 @@
 
     if( i + sig_len != ssl->in_hslen )
     {
-        SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
-        return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
     }
 
-    if( ( ret = pk_verify( &ssl->session_negotiate->peer_cert->pk,
+    if( ( ret = mbedtls_pk_verify( &ssl->session_negotiate->peer_cert->pk,
                            md_alg, hash_start, hashlen,
                            ssl->in_msg + i, sig_len ) ) != 0 )
     {
-        SSL_DEBUG_RET( 1, "pk_verify", ret );
+        MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
         return( ret );
     }
 
-    SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
 
     return( ret );
 }
-#endif /* !POLARSSL_KEY_EXCHANGE_RSA_ENABLED &&
-          !POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED &&
-          !POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED */
+#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
+          !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
+          !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED */
 
-#if defined(POLARSSL_SSL_SESSION_TICKETS)
-static int ssl_write_new_session_ticket( ssl_context *ssl )
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl )
 {
     int ret;
     size_t tlen;
     uint32_t lifetime = (uint32_t) ssl->ticket_lifetime;
 
-    SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
 
-    ssl->out_msgtype = SSL_MSG_HANDSHAKE;
-    ssl->out_msg[0]  = SSL_HS_NEW_SESSION_TICKET;
+    ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
+    ssl->out_msg[0]  = MBEDTLS_SSL_HS_NEW_SESSION_TICKET;
 
     /*
      * struct {
@@ -3818,7 +3818,7 @@
 
     if( ( ret = ssl_write_ticket( ssl, &tlen ) ) != 0 )
     {
-        SSL_DEBUG_RET( 1, "ssl_write_ticket", ret );
+        MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_ticket", ret );
         tlen = 0;
     }
 
@@ -3833,59 +3833,59 @@
      */
     ssl->handshake->new_session_ticket = 0;
 
-    if( ( ret = ssl_write_record( ssl ) ) != 0 )
+    if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
     {
-        SSL_DEBUG_RET( 1, "ssl_write_record", ret );
+        MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
         return( ret );
     }
 
-    SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
 
     return( 0 );
 }
-#endif /* POLARSSL_SSL_SESSION_TICKETS */
+#endif /* MBEDTLS_SSL_SESSION_TICKETS */
 
 /*
  * SSL handshake -- server side -- single step
  */
-int ssl_handshake_server_step( ssl_context *ssl )
+int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl )
 {
     int ret = 0;
 
-    if( ssl->state == SSL_HANDSHAKE_OVER )
-        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+    if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
+        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
-    SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
 
-    if( ( ret = ssl_flush_output( ssl ) ) != 0 )
+    if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
         return( ret );
 
-#if defined(POLARSSL_SSL_PROTO_DTLS)
-    if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
+#if defined(MBEDTLS_SSL_PROTO_DTLS)
+    if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
         ssl->handshake != NULL &&
-        ssl->handshake->retransmit_state == SSL_RETRANS_SENDING )
+        ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
     {
-        if( ( ret = ssl_resend( ssl ) ) != 0 )
+        if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
             return( ret );
     }
 #endif
 
     switch( ssl->state )
     {
-        case SSL_HELLO_REQUEST:
-            ssl->state = SSL_CLIENT_HELLO;
+        case MBEDTLS_SSL_HELLO_REQUEST:
+            ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
             break;
 
         /*
          *  <==   ClientHello
          */
-        case SSL_CLIENT_HELLO:
+        case MBEDTLS_SSL_CLIENT_HELLO:
             ret = ssl_parse_client_hello( ssl );
             break;
 
-#if defined(POLARSSL_SSL_PROTO_DTLS)
-        case SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
-            return( POLARSSL_ERR_SSL_HELLO_VERIFY_REQUIRED );
+#if defined(MBEDTLS_SSL_PROTO_DTLS)
+        case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
+            return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
 #endif
 
         /*
@@ -3895,23 +3895,23 @@
          *      ( CertificateRequest )
          *        ServerHelloDone
          */
-        case SSL_SERVER_HELLO:
+        case MBEDTLS_SSL_SERVER_HELLO:
             ret = ssl_write_server_hello( ssl );
             break;
 
-        case SSL_SERVER_CERTIFICATE:
-            ret = ssl_write_certificate( ssl );
+        case MBEDTLS_SSL_SERVER_CERTIFICATE:
+            ret = mbedtls_ssl_write_certificate( ssl );
             break;
 
-        case SSL_SERVER_KEY_EXCHANGE:
+        case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
             ret = ssl_write_server_key_exchange( ssl );
             break;
 
-        case SSL_CERTIFICATE_REQUEST:
+        case MBEDTLS_SSL_CERTIFICATE_REQUEST:
             ret = ssl_write_certificate_request( ssl );
             break;
 
-        case SSL_SERVER_HELLO_DONE:
+        case MBEDTLS_SSL_SERVER_HELLO_DONE:
             ret = ssl_write_server_hello_done( ssl );
             break;
 
@@ -3922,24 +3922,24 @@
          *        ChangeCipherSpec
          *        Finished
          */
-        case SSL_CLIENT_CERTIFICATE:
-            ret = ssl_parse_certificate( ssl );
+        case MBEDTLS_SSL_CLIENT_CERTIFICATE:
+            ret = mbedtls_ssl_parse_certificate( ssl );
             break;
 
-        case SSL_CLIENT_KEY_EXCHANGE:
+        case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
             ret = ssl_parse_client_key_exchange( ssl );
             break;
 
-        case SSL_CERTIFICATE_VERIFY:
+        case MBEDTLS_SSL_CERTIFICATE_VERIFY:
             ret = ssl_parse_certificate_verify( ssl );
             break;
 
-        case SSL_CLIENT_CHANGE_CIPHER_SPEC:
-            ret = ssl_parse_change_cipher_spec( ssl );
+        case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
+            ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
             break;
 
-        case SSL_CLIENT_FINISHED:
-            ret = ssl_parse_finished( ssl );
+        case MBEDTLS_SSL_CLIENT_FINISHED:
+            ret = mbedtls_ssl_parse_finished( ssl );
             break;
 
         /*
@@ -3947,33 +3947,33 @@
          *        ChangeCipherSpec
          *        Finished
          */
-        case SSL_SERVER_CHANGE_CIPHER_SPEC:
-#if defined(POLARSSL_SSL_SESSION_TICKETS)
+        case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
             if( ssl->handshake->new_session_ticket != 0 )
                 ret = ssl_write_new_session_ticket( ssl );
             else
 #endif
-                ret = ssl_write_change_cipher_spec( ssl );
+                ret = mbedtls_ssl_write_change_cipher_spec( ssl );
             break;
 
-        case SSL_SERVER_FINISHED:
-            ret = ssl_write_finished( ssl );
+        case MBEDTLS_SSL_SERVER_FINISHED:
+            ret = mbedtls_ssl_write_finished( ssl );
             break;
 
-        case SSL_FLUSH_BUFFERS:
-            SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
-            ssl->state = SSL_HANDSHAKE_WRAPUP;
+        case MBEDTLS_SSL_FLUSH_BUFFERS:
+            MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
+            ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
             break;
 
-        case SSL_HANDSHAKE_WRAPUP:
-            ssl_handshake_wrapup( ssl );
+        case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
+            mbedtls_ssl_handshake_wrapup( ssl );
             break;
 
         default:
-            SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
-            return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
+            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
     }
 
     return( ret );
 }
-#endif /* POLARSSL_SSL_SRV_C */
+#endif /* MBEDTLS_SSL_SRV_C */