Adding upstream version 4.5.upstream/4.5

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

31 files changed, 5980 insertions, 0 deletions

diff --git a/test/unit/Makefile.in b/test/unit/Makefile.in
new file mode 100644
index 0000000..9979840
--- /dev/null
+++ b/test/unit/Makefile.in
@@ -0,0 +1,48 @@
+TEST_WRAPPER =
+CHRONY_SRCDIR = ../..
+
+CC = @CC@
+CFLAGS = @CFLAGS@
+CPPFLAGS = -I$(CHRONY_SRCDIR) @CPPFLAGS@
+LDFLAGS = @LDFLAGS@ @LIBS@ @EXTRA_LIBS@
+
+SHARED_OBJS = test.o
+
+TEST_OBJS := $(sort $(patsubst %.c,%.o,$(wildcard *.c)))
+TESTS := $(patsubst %.o,%.test,$(filter-out $(SHARED_OBJS),$(TEST_OBJS)))
+
+CHRONYD_OBJS := $(patsubst %.o,$(CHRONY_SRCDIR)/%.o,$(filter-out main.o,\
+		  $(filter %.o,$(shell $(MAKE) -f $(CHRONY_SRCDIR)/Makefile \
+					print-chronyd-objects NODEPS=1))))
+
+all: $(TESTS)
+
+$(CHRONYD_OBJS): ;
+
+%.test: %.o $(SHARED_OBJS) $(CHRONYD_OBJS)
+	$(CC) $(CFLAGS) -o $@ $(filter-out $(CHRONY_SRCDIR)/$<,$^) $(LDFLAGS)
+
+%.o: %.c
+	$(CC) $(CPPFLAGS) $(CFLAGS) -c $<
+
+check: $(TESTS)
+	@ret=0; \
+	for t in $^; do \
+	  $(TEST_WRAPPER) ./$$t || ret=1; \
+	done; \
+	exit $$ret
+
+clean:
+	rm -f *.o *.gcda *.gcno core.* $(TESTS)
+	rm -rf .deps
+
+distclean: clean
+	rm -f Makefile
+
+.deps:
+	@mkdir .deps
+
+.deps/%.d: %.c | .deps
+	@$(CC) -MM $(CPPFLAGS) -MT '$(<:%.c=%.o) $@' $< -o $@
+
+-include $(TEST_OBJS:%.o=.deps/%.d)
diff --git a/test/unit/addrfilt.c b/test/unit/addrfilt.c
new file mode 100644
index 0000000..b236073
--- /dev/null
+++ b/test/unit/addrfilt.c
@@ -0,0 +1,83 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2016
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <addrfilt.c>
+#include <logging.h>
+#include <util.h>
+#include "test.h"
+
+void
+test_unit(void)
+{
+  int i, j, sub, maxsub;
+  IPAddr ip;
+  ADF_AuthTable table;
+
+  table = ADF_CreateTable();
+
+  for (i = 0; i < 100; i++) {
+    for (j = 0; j < 1000; j++) {
+      if (j % 2) {
+        maxsub = 32;
+        TST_GetRandomAddress(&ip, IPADDR_INET4, -1);
+      } else {
+        maxsub = 128;
+        TST_GetRandomAddress(&ip, IPADDR_INET6, -1);
+      }
+
+      DEBUG_LOG("address %s", UTI_IPToString(&ip));
+
+      sub = random() % (maxsub + 1);
+
+      TEST_CHECK(!ADF_IsAllowed(table, &ip));
+      ADF_Allow(table, &ip, sub);
+      TEST_CHECK(ADF_IsAllowed(table, &ip));
+
+      if (sub < maxsub) {
+        TST_SwapAddressBit(&ip, sub);
+        TEST_CHECK(ADF_IsAllowed(table, &ip));
+      }
+
+      if (sub > 0) {
+        TST_SwapAddressBit(&ip, sub - 1);
+        TEST_CHECK(!ADF_IsAllowed(table, &ip));
+        if (sub % 4 != 1) {
+          ADF_Deny(table, &ip, sub - 1);
+          TST_SwapAddressBit(&ip, sub - 1);
+          TEST_CHECK(!ADF_IsAllowed(table, &ip));
+        }
+      }
+
+      if (sub > 4) {
+        ADF_AllowAll(table, &ip, sub - 4);
+        TEST_CHECK(ADF_IsAllowed(table, &ip));
+      }
+
+      ADF_DenyAll(table, &ip, 0);
+    }
+
+    ip.family = IPADDR_INET4;
+    ADF_DenyAll(table, &ip, 0);
+    ip.family = IPADDR_INET6;
+    ADF_DenyAll(table, &ip, 0);
+  }
+
+  ADF_DestroyTable(table);
+}
diff --git a/test/unit/array.c b/test/unit/array.c
new file mode 100644
index 0000000..65ad1d8
--- /dev/null
+++ b/test/unit/array.c
@@ -0,0 +1,97 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2023
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <array.c>
+#include <util.h>
+#include "test.h"
+
+void
+test_unit(void)
+{
+  unsigned int i, j, k, k2, l, es, s;
+  unsigned char *el1, el2[20];
+  ARR_Instance a;
+
+  for (i = 0; i < 1000; i++) {
+    es = random() % sizeof (el2) + 1;
+
+    a = ARR_CreateInstance(es);
+
+    TEST_CHECK(ARR_GetSize(a) == 0);
+
+    for (j = 0; j < 100; j++) {
+      s = ARR_GetSize(a);
+
+      switch (random() % 6) {
+        case 0:
+          el1 = ARR_GetNewElement(a);
+          TEST_CHECK(ARR_GetSize(a) == s + 1);
+          memset(el1, s % 256, es);
+          TEST_CHECK(ARR_GetElement(a, s) == el1);
+          break;
+        case 1:
+          for (k = 0; k < s; k++) {
+            el1 = ARR_GetElement(a, k);
+            for (l = 0; l < es; l++)
+              TEST_CHECK(el1[l] == k % 256);
+          }
+          break;
+        case 2:
+          if (s == 0)
+            break;
+          TEST_CHECK(ARR_GetElements(a) == ARR_GetElement(a, 0));
+          break;
+        case 3:
+          memset(el2, s % 256, es);
+          ARR_AppendElement(a, el2);
+          TEST_CHECK(ARR_GetSize(a) == s + 1);
+          break;
+        case 4:
+          if (s == 0)
+            break;
+          k2 = random() % s;
+          ARR_RemoveElement(a, k2);
+          TEST_CHECK(ARR_GetSize(a) == s - 1);
+          for (k = k2; k < s - 1; k++) {
+            el1 = ARR_GetElement(a, k);
+            for (l = 0; l < es; l++) {
+              TEST_CHECK(el1[l] == (k + 1) % 256);
+              el1[l] = k % 256;
+            }
+          }
+          break;
+        case 5:
+          k2 = random() % 1000;
+          ARR_SetSize(a, k2);
+          TEST_CHECK(ARR_GetSize(a) == k2);
+          for (k = s; k < k2; k++) {
+            el1 = ARR_GetElement(a, k);
+            for (l = 0; l < es; l++)
+              el1[l] = k % 256;
+          }
+          break;
+        default:
+          assert(0);
+      }
+    }
+
+    ARR_DestroyInstance(a);
+  }
+}
diff --git a/test/unit/clientlog.c b/test/unit/clientlog.c
new file mode 100644
index 0000000..e5bf1f4
--- /dev/null
+++ b/test/unit/clientlog.c
@@ -0,0 +1,298 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2016, 2021
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include "test.h"
+
+#if defined(FEAT_NTP) || defined(FEAT_CMDMON)
+
+#include <clientlog.c>
+
+static uint64_t
+get_random64(void)
+{
+  return ((uint64_t)random() << 40) ^ ((uint64_t)random() << 20) ^ random();
+}
+
+void
+test_unit(void)
+{
+  uint64_t ts64, prev_first_ts64, prev_last_ts64, max_step;
+  uint32_t index2, prev_first, prev_size;
+  NTP_Timestamp_Source ts_src, ts_src2;
+  struct timespec ts, ts2;
+  int i, j, k, index, shift;
+  CLG_Service s;
+  NTP_int64 ntp_ts;
+  IPAddr ip;
+  char conf[][100] = {
+    "clientloglimit 20000",
+    "ratelimit interval 3 burst 4 leak 3",
+    "cmdratelimit interval 3 burst 4 leak 3",
+    "ntsratelimit interval 6 burst 8 leak 3",
+  };
+
+  CNF_Initialise(0, 0);
+  for (i = 0; i < sizeof conf / sizeof conf[0]; i++)
+    CNF_ParseLine(NULL, i + 1, conf[i]);
+
+  LCL_Initialise();
+  CLG_Initialise();
+
+  TEST_CHECK(ARR_GetSize(records) == 16);
+
+  for (i = 0; i < 500; i++) {
+    DEBUG_LOG("iteration %d", i);
+
+    ts.tv_sec = (time_t)random() & 0x0fffffff;
+    ts.tv_nsec = 0;
+
+    for (j = 0; j < 1000; j++) {
+      TST_GetRandomAddress(&ip, IPADDR_UNSPEC, i % 8 ? -1 : i / 8 % 9);
+      DEBUG_LOG("address %s", UTI_IPToString(&ip));
+
+      s = random() % MAX_SERVICES;
+      index = CLG_LogServiceAccess(s, &ip, &ts);
+      TEST_CHECK(index >= 0);
+      CLG_LimitServiceRate(s, index);
+
+      UTI_AddDoubleToTimespec(&ts, (1 << random() % 14) / 100.0, &ts);
+    }
+  }
+
+  DEBUG_LOG("records %u", ARR_GetSize(records));
+  TEST_CHECK(ARR_GetSize(records) == 128);
+
+  s = CLG_NTP;
+
+  for (i = j = 0; i < 10000; i++) {
+    ts.tv_sec += 1;
+    index = CLG_LogServiceAccess(s, &ip, &ts);
+    TEST_CHECK(index >= 0);
+    if (!CLG_LimitServiceRate(s, index))
+      j++;
+  }
+
+  DEBUG_LOG("requests %d responses %d", i, j);
+  TEST_CHECK(j * 4 < i && j * 6 > i);
+
+  TEST_CHECK(!ntp_ts_map.timestamps);
+
+  UTI_ZeroNtp64(&ntp_ts);
+  CLG_SaveNtpTimestamps(&ntp_ts, NULL, 0);
+  TEST_CHECK(ntp_ts_map.timestamps);
+  TEST_CHECK(ntp_ts_map.first == 0);
+  TEST_CHECK(ntp_ts_map.size == 0);
+  TEST_CHECK(ntp_ts_map.max_size == 128);
+  TEST_CHECK(ARR_GetSize(ntp_ts_map.timestamps) == ntp_ts_map.max_size);
+
+  TEST_CHECK(ntp_ts_map.max_size > NTPTS_INSERT_LIMIT);
+
+  for (i = 0; i < 200; i++) {
+    DEBUG_LOG("iteration %d", i);
+
+    max_step = (1ULL << (i % 50));
+    ts64 = 0ULL - 100 * max_step;
+
+    if (i > 150)
+      ntp_ts_map.max_size = 1U << (i % 8);
+    assert(ntp_ts_map.max_size <= 128);
+    ntp_ts_map.first = i % ntp_ts_map.max_size;
+    ntp_ts_map.size = 0;
+    ntp_ts_map.cached_rx_ts = 0ULL;
+    ntp_ts_map.slew_epoch = i * 400;
+
+    for (j = 0; j < 500; j++) {
+      do {
+        ts64 += get_random64() % max_step + 1;
+      } while (ts64 == 0ULL);
+
+      int64_to_ntp64(ts64, &ntp_ts);
+
+      if (random() % 10) {
+        UTI_Ntp64ToTimespec(&ntp_ts, &ts);
+        UTI_AddDoubleToTimespec(&ts, TST_GetRandomDouble(-1.999, 1.999), &ts);
+      } else {
+        UTI_ZeroTimespec(&ts);
+      }
+
+      ts_src = random() % (MAX_NTP_TS + 1);
+      CLG_SaveNtpTimestamps(&ntp_ts,
+                            UTI_IsZeroTimespec(&ts) ? (random() % 2 ? &ts : NULL) : &ts,
+                            ts_src);
+
+      if (j < ntp_ts_map.max_size) {
+        TEST_CHECK(ntp_ts_map.size == j + 1);
+        TEST_CHECK(ntp_ts_map.first == i % ntp_ts_map.max_size);
+      } else {
+        TEST_CHECK(ntp_ts_map.size == ntp_ts_map.max_size);
+        TEST_CHECK(ntp_ts_map.first == (i + j + ntp_ts_map.size + 1) % ntp_ts_map.max_size);
+      }
+      TEST_CHECK(ntp_ts_map.cached_index == ntp_ts_map.size - 1);
+      TEST_CHECK(get_ntp_tss(ntp_ts_map.size - 1)->slew_epoch == ntp_ts_map.slew_epoch);
+      TEST_CHECK(CLG_GetNtpTxTimestamp(&ntp_ts, &ts2, &ts_src2));
+      TEST_CHECK(UTI_CompareTimespecs(&ts, &ts2) == 0);
+      TEST_CHECK(UTI_IsZeroTimespec(&ts) || ts_src == ts_src2);
+
+      for (k = random() % 4; k > 0; k--) {
+        index2 = random() % ntp_ts_map.size;
+        int64_to_ntp64(get_ntp_tss(index2)->rx_ts, &ntp_ts);
+        if (random() % 2)
+          TEST_CHECK(CLG_GetNtpTxTimestamp(&ntp_ts, &ts, &ts_src2));
+
+        UTI_Ntp64ToTimespec(&ntp_ts, &ts);
+        UTI_AddDoubleToTimespec(&ts, TST_GetRandomDouble(-1.999, 1.999), &ts);
+
+        ts2 = ts;
+        CLG_UndoNtpTxTimestampSlew(&ntp_ts, &ts);
+        if ((get_ntp_tss(index2)->slew_epoch + 1) % (1U << 16) != ntp_ts_map.slew_epoch) {
+          TEST_CHECK(UTI_CompareTimespecs(&ts, &ts2) == 0);
+        } else {
+          TEST_CHECK(fabs(UTI_DiffTimespecsToDouble(&ts, &ts2) - ntp_ts_map.slew_offset) <
+                     1.0e-9);
+        }
+
+        ts_src = random() % (MAX_NTP_TS + 1);
+        CLG_UpdateNtpTxTimestamp(&ntp_ts, &ts, ts_src);
+
+        TEST_CHECK(CLG_GetNtpTxTimestamp(&ntp_ts, &ts2, &ts_src2));
+        TEST_CHECK(UTI_CompareTimespecs(&ts, &ts2) == 0);
+        TEST_CHECK(ts_src == ts_src2);
+
+        if (random() % 2) {
+          uint16_t prev_epoch = ntp_ts_map.slew_epoch;
+          handle_slew(NULL, NULL, 0.0, TST_GetRandomDouble(-1.0e-5, 1.0e-5),
+                      LCL_ChangeAdjust, NULL);
+          TEST_CHECK((prev_epoch + 1) % (1U << 16) == ntp_ts_map.slew_epoch);
+        }
+
+        if (ntp_ts_map.size > 1) {
+          index = random() % (ntp_ts_map.size - 1);
+          if (get_ntp_tss(index)->rx_ts + 1 != get_ntp_tss(index + 1)->rx_ts) {
+            int64_to_ntp64(get_ntp_tss(index)->rx_ts + 1, &ntp_ts);
+            TEST_CHECK(!CLG_GetNtpTxTimestamp(&ntp_ts, &ts, &ts_src2));
+            int64_to_ntp64(get_ntp_tss(index + 1)->rx_ts - 1, &ntp_ts);
+            TEST_CHECK(!CLG_GetNtpTxTimestamp(&ntp_ts, &ts, &ts_src2));
+            CLG_UpdateNtpTxTimestamp(&ntp_ts, &ts, ts_src);
+            CLG_UndoNtpTxTimestampSlew(&ntp_ts, &ts);
+          }
+        }
+
+        if (random() % 2) {
+          int64_to_ntp64(get_ntp_tss(0)->rx_ts - 1, &ntp_ts);
+          TEST_CHECK(!CLG_GetNtpTxTimestamp(&ntp_ts, &ts, &ts_src2));
+          int64_to_ntp64(get_ntp_tss(ntp_ts_map.size - 1)->rx_ts + 1, &ntp_ts);
+          TEST_CHECK(!CLG_GetNtpTxTimestamp(&ntp_ts, &ts, &ts_src2));
+          CLG_UpdateNtpTxTimestamp(&ntp_ts, &ts, ts_src);
+          CLG_UndoNtpTxTimestampSlew(&ntp_ts, &ts);
+        }
+      }
+    }
+
+    for (j = 0; j < 500; j++) {
+      shift = (i % 3) * 26;
+
+      if (i % 7 == 0) {
+        while (ntp_ts_map.size < ntp_ts_map.max_size) {
+          ts64 += get_random64() >> (shift + 8);
+          int64_to_ntp64(ts64, &ntp_ts);
+          CLG_SaveNtpTimestamps(&ntp_ts, NULL, 0);
+          if (ntp_ts_map.cached_index + NTPTS_INSERT_LIMIT < ntp_ts_map.size)
+            ts64 = get_ntp_tss(ntp_ts_map.size - 1)->rx_ts;
+        }
+      }
+      do {
+        if (ntp_ts_map.size > 1 && random() % 2) {
+          k = random() % (ntp_ts_map.size - 1);
+          ts64 = get_ntp_tss(k)->rx_ts +
+                 (get_ntp_tss(k + 1)->rx_ts - get_ntp_tss(k)->rx_ts) / 2;
+        } else {
+          ts64 = get_random64() >> shift;
+        }
+      } while (ts64 == 0ULL);
+
+      int64_to_ntp64(ts64, &ntp_ts);
+
+      prev_first = ntp_ts_map.first;
+      prev_size = ntp_ts_map.size;
+      prev_first_ts64 = get_ntp_tss(0)->rx_ts;
+      prev_last_ts64 = get_ntp_tss(prev_size - 1)->rx_ts;
+      CLG_SaveNtpTimestamps(&ntp_ts, NULL, 0);
+
+      TEST_CHECK(find_ntp_rx_ts(ts64, &index2));
+
+      if (ntp_ts_map.size > 1) {
+        TEST_CHECK(ntp_ts_map.size > 0 && ntp_ts_map.size <= ntp_ts_map.max_size);
+        if (get_ntp_tss(index2)->flags & NTPTS_DISABLED)
+          continue;
+
+        TEST_CHECK(get_ntp_tss(ntp_ts_map.size - 1)->rx_ts - ts64 <= NTPTS_FUTURE_LIMIT);
+
+        if ((int64_t)(prev_last_ts64 - ts64) <= NTPTS_FUTURE_LIMIT) {
+          TEST_CHECK(prev_size + 1 >= ntp_ts_map.size);
+          if (index2 + NTPTS_INSERT_LIMIT + 1 >= ntp_ts_map.size &&
+              !(index2 == 0 && NTPTS_INSERT_LIMIT < ntp_ts_map.max_size &&
+                ((NTPTS_INSERT_LIMIT == prev_size && (int64_t)(ts64 - prev_first_ts64) > 0) ||
+                 (NTPTS_INSERT_LIMIT + 1 == prev_size && (int64_t)(ts64 - prev_first_ts64) < 0))))
+            TEST_CHECK((prev_first + prev_size + 1) % ntp_ts_map.max_size ==
+                       (ntp_ts_map.first + ntp_ts_map.size) % ntp_ts_map.max_size);
+          else
+            TEST_CHECK(prev_first + prev_size == ntp_ts_map.first + ntp_ts_map.size);
+        }
+
+        TEST_CHECK((int64_t)(get_ntp_tss(ntp_ts_map.size - 1)->rx_ts -
+                             get_ntp_tss(0)->rx_ts) > 0);
+        for (k = 0; k + 1 < ntp_ts_map.size; k++)
+          TEST_CHECK((int64_t)(get_ntp_tss(k + 1)->rx_ts - get_ntp_tss(k)->rx_ts) > 0);
+      }
+
+      if (random() % 10 == 0) {
+        CLG_DisableNtpTimestamps(&ntp_ts);
+        TEST_CHECK(!CLG_GetNtpTxTimestamp(&ntp_ts, &ts, &ts_src2));
+      }
+
+      for (k = random() % 10; k > 0; k--) {
+        ts64 = get_random64() >> shift;
+        int64_to_ntp64(ts64, &ntp_ts);
+        CLG_GetNtpTxTimestamp(&ntp_ts, &ts, &ts_src2);
+      }
+    }
+
+    if (random() % 2) {
+      handle_slew(NULL, NULL, 0.0, TST_GetRandomDouble(-1.0e9, 1.0e9),
+                  LCL_ChangeUnknownStep, NULL);
+      TEST_CHECK(ntp_ts_map.size == 0);
+      TEST_CHECK(ntp_ts_map.cached_rx_ts == 0ULL);
+      TEST_CHECK(!CLG_GetNtpTxTimestamp(&ntp_ts, &ts, &ts_src2));
+      CLG_UpdateNtpTxTimestamp(&ntp_ts, &ts, ts_src);
+    }
+  }
+
+  CLG_Finalise();
+  LCL_Finalise();
+  CNF_Finalise();
+}
+#else
+void
+test_unit(void)
+{
+  TEST_REQUIRE(0);
+}
+#endif
diff --git a/test/unit/cmac.c b/test/unit/cmac.c
new file mode 100644
index 0000000..be4ffbb
--- /dev/null
+++ b/test/unit/cmac.c
@@ -0,0 +1,109 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2019
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include <sysincl.h>
+#include <cmac.h>
+#include <logging.h>
+#include <util.h>
+#include "test.h"
+
+#define MAX_KEY_LENGTH 64
+#define MAX_HASH_LENGTH 64
+
+struct cmac_test {
+  const char *name;
+  const unsigned char key[MAX_KEY_LENGTH];
+  int key_length;
+  const unsigned char hash[MAX_HASH_LENGTH];
+  int hash_length;
+};
+
+void
+test_unit(void)
+{
+  unsigned char data[] = "abcdefghijklmnopqrstuvwxyz0123456789";
+  unsigned char hash[MAX_HASH_LENGTH];
+  struct cmac_test tests[] = {
+    { "AES128", "\xfc\x24\x97\x1b\x52\x66\xdc\x46\xef\xe0\xe8\x08\x46\x89\xb6\x88", 16,
+                "\xaf\x3c\xfe\xc2\x66\x71\x08\x04\xd4\xaf\x5b\x16\x2b\x11\xf4\x85", 16 },
+    { "AES256", "\x14\x02\x8e\x7d\x17\x3c\x2f\x4e\x17\x0f\x37\x96\xc3\x2c\xc5\x99"
+                "\x18\xdd\x55\x23\xb7\xd7\x9b\xc5\x76\x36\x88\x3f\xc5\x82\xb5\x83", 32,
+                "\xfe\xf7\x94\x96\x14\x04\x11\x0b\x87\xe4\xd4\x3f\x81\xb3\xb2\x2d", 16 },
+    { "", "", 0, "", 0 }
+  };
+
+  CMC_Algorithm algorithm;
+  CMC_Instance inst;
+  int i, j, length;
+
+#ifndef HAVE_CMAC
+  TEST_REQUIRE(0);
+#endif
+
+  TEST_CHECK(CMC_INVALID == 0);
+
+  for (i = 0; tests[i].name[0] != '\0'; i++) {
+    algorithm = UTI_CmacNameToAlgorithm(tests[i].name);
+    TEST_CHECK(algorithm != 0);
+    TEST_CHECK(CMC_GetKeyLength(algorithm) == tests[i].key_length);
+
+    DEBUG_LOG("testing %s", tests[i].name);
+
+    for (j = -1; j <= 128; j++) {
+      if (j == tests[i].key_length)
+        continue;
+      TEST_CHECK(!CMC_CreateInstance(algorithm, tests[i].key, j));
+    }
+
+    inst = CMC_CreateInstance(algorithm, tests[i].key, tests[i].key_length);
+    TEST_CHECK(inst);
+
+    TEST_CHECK(!CMC_CreateInstance(0, tests[i].key, tests[i].key_length));
+
+    TEST_CHECK(CMC_Hash(inst, data, -1, hash, sizeof (hash)) == 0);
+    TEST_CHECK(CMC_Hash(inst, data, sizeof (data) - 1, hash, -1) == 0);
+
+    for (j = 0; j <= sizeof (hash); j++) {
+      memset(hash, 0, sizeof (hash));
+      length = CMC_Hash(inst, data, sizeof (data) - 1, hash, j);
+
+#if 0
+      for (int k = 0; k < length; k++)
+        printf("\\x%02x", hash[k]);
+      printf("\n");
+#endif
+
+      if (j >= tests[i].hash_length)
+        TEST_CHECK(length == tests[i].hash_length);
+      else
+        TEST_CHECK(length == j);
+
+      TEST_CHECK(!memcmp(hash, tests[i].hash, length));
+    }
+
+    for (j = 0; j < sizeof (data); j++) {
+      length = CMC_Hash(inst, data, j, hash, sizeof (hash));
+      TEST_CHECK(length == tests[i].hash_length);
+    }
+
+    CMC_DestroyInstance(inst);
+  }
+}
diff --git a/test/unit/hash.c b/test/unit/hash.c
new file mode 100644
index 0000000..2f9ffef
--- /dev/null
+++ b/test/unit/hash.c
@@ -0,0 +1,131 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2018
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include <sysincl.h>
+#include <hash.h>
+#include <logging.h>
+#include <util.h>
+#include "test.h"
+
+struct hash_test {
+  const char *name;
+  const unsigned char out[MAX_HASH_LENGTH];
+  int length;
+};
+
+void
+test_unit(void)
+{
+  unsigned char data1[] = "abcdefghijklmnopqrstuvwxyz";
+  unsigned char data2[] = "12345678910";
+  unsigned char out[MAX_HASH_LENGTH];
+  struct hash_test tests[] = {
+    { "MD5-NC",    "\xfc\x24\x97\x1b\x52\x66\xdc\x46\xef\xe0\xe8\x08\x46\x89\xb6\x88", 16 },
+    { "MD5",       "\xfc\x24\x97\x1b\x52\x66\xdc\x46\xef\xe0\xe8\x08\x46\x89\xb6\x88", 16 },
+    { "SHA1",      "\xd8\x85\xb3\x86\xce\xea\x93\xeb\x92\xcd\x7b\x94\xb9\x8d\xc2\x8e"
+                   "\x3e\x31\x13\xdd", 20},
+    { "SHA256",    "\x0e\x35\x14\xe7\x15\x7a\x1d\xdd\xea\x11\x78\xd3\x41\xf6\xb9\x3e"
+                   "\xa0\x42\x96\x73\x3c\x54\x74\x0b\xfa\x6b\x9e\x29\x59\xad\x69\xd3", 32 },
+    { "SHA384",    "\x2c\xeb\xbd\x4d\x95\xed\xad\x03\xed\x80\xc4\xf3\xa6\x10\x21\xde"
+                   "\x40\x69\x54\xed\x42\x70\xb8\x95\xb0\x6f\x01\x1d\x04\xdf\x57\xbc"
+                   "\x1d\xb5\x85\xbf\x4f\x03\x88\xd5\x83\x93\xbc\x81\x90\xb0\xa9\x9b", 48 },
+    { "SHA512",    "\x20\xba\xec\xcb\x68\x98\x33\x5b\x70\x26\x63\x13\xe2\xf7\x0e\x67"
+                   "\x08\xf3\x77\x4f\xbd\xeb\xc4\xa8\xc5\x94\xe2\x39\x40\x7e\xed\x0b"
+                   "\x69\x0e\x18\xa5\xa2\x03\x73\xe7\x1d\x20\x7d\x3f\xc8\x70\x2d\x64"
+                   "\x9e\x89\x6d\x20\x6a\x4a\x5a\x46\xe7\x4f\x2c\xf9\x0f\x0a\x54\xdc", 64 },
+    { "SHA3-224",  "\x3b\xa2\x22\x28\xdd\x26\x18\xec\x3b\xb9\x25\x39\x5e\xbd\x94\x25"
+                   "\xd4\x20\x8a\x76\x76\xc0\x3c\x5d\x9e\x0a\x06\x46", 28},
+    { "SHA3-256",  "\x26\xd1\x19\xb2\xc1\x64\xc8\xb8\x10\xd8\xa8\x1c\xb6\xa4\x0d\x29"
+                   "\x09\xc9\x8e\x2e\x2d\xde\x7a\x74\x8c\x43\x70\xb8\xaa\x0f\x09\x17", 32 },
+    { "SHA3-384",  "\x6a\x64\xb9\x89\x08\x29\xd0\xa7\x4b\x84\xba\xa6\x65\xf5\xe7\x54"
+                   "\xe2\x18\x12\xc3\x63\x34\xc6\xba\x26\xf5\x6e\x99\xe2\x54\xcc\x9d"
+                   "\x01\x10\x9d\xee\x35\x38\x04\x83\xe5\x71\x70\xd8\xc8\x99\x96\xd8", 48 },
+    { "SHA3-512",  "\xa8\xe3\x2b\x65\x1f\x87\x90\x73\x19\xc8\xa0\x3f\xe3\x85\x60\x3c"
+                   "\x39\xfc\xcb\xc1\x29\xe1\x23\x7d\x8b\x56\x54\xe3\x08\x9d\xf9\x74"
+                   "\x78\x69\x2e\x3c\x7e\x51\x1e\x9d\xab\x09\xbe\xe7\x6b\x1a\xa1\x22"
+                   "\x93\xb1\x2b\x82\x9d\x1e\xcf\xa8\x99\xc5\xec\x7b\x1d\x89\x07\x2b", 64 },
+    { "TIGER",     "\x1c\xcd\x68\x74\xca\xd6\xd5\x17\xba\x3e\x82\xaf\xbd\x70\xdc\x66"
+                   "\x99\xaa\xae\x16\x72\x59\xd1\x64", 24},
+    { "WHIRLPOOL", "\xe3\xcd\xe6\xbf\xe1\x8c\xe4\x4d\xc8\xb4\xa5\x7c\x36\x8d\xc8\x8a"
+                   "\x8b\xad\x52\x24\xc0\x4e\x99\x5b\x7e\x86\x94\x2d\x10\x56\x12\xa3"
+                   "\x29\x2a\x65\x0f\x9e\x07\xbc\x15\x21\x14\xe6\x07\xfc\xe6\xb9\x2f"
+                   "\x13\xe2\x57\xe9\x0a\xb0\xd2\xf4\xa3\x20\x36\x9c\x88\x92\x8e\xc9", 64 },
+    { "", "", 0 }
+  };
+
+  HSH_Algorithm algorithm;
+  int i, j, hash_id, length;
+
+  TEST_CHECK(HSH_INVALID == 0);
+
+  for (i = 0; tests[i].name[0] != '\0'; i++) {
+    algorithm = UTI_HashNameToAlgorithm(tests[i].name);
+    if (strcmp(tests[i].name, "MD5-NC") == 0) {
+      TEST_CHECK(algorithm == 0);
+      algorithm = HSH_MD5_NONCRYPTO;
+    } else {
+      TEST_CHECK(algorithm != 0);
+    }
+    hash_id = HSH_GetHashId(algorithm);
+    if (hash_id < 0) {
+      TEST_CHECK(algorithm != HSH_MD5_NONCRYPTO);
+      TEST_CHECK(algorithm != HSH_MD5);
+#ifdef FEAT_SECHASH
+      TEST_CHECK(algorithm != HSH_SHA1);
+      TEST_CHECK(algorithm != HSH_SHA256);
+      TEST_CHECK(algorithm != HSH_SHA384);
+      TEST_CHECK(algorithm != HSH_SHA512);
+#endif
+      continue;
+    }
+
+    DEBUG_LOG("testing %s", tests[i].name);
+
+    TEST_CHECK(HSH_Hash(hash_id, data1, -1, NULL, 0, out, sizeof (out)) == 0);
+    TEST_CHECK(HSH_Hash(hash_id, data1, sizeof (data1) - 1, data2, -1, out, sizeof (out)) == 0);
+    TEST_CHECK(HSH_Hash(hash_id, data1, sizeof (data1) - 1, NULL, 0, out, -1) == 0);
+
+    for (j = 0; j <= sizeof (out); j++) {
+      TEST_CHECK(HSH_GetHashId(algorithm) == hash_id);
+      TEST_CHECK(HSH_GetHashId(0) < 0);
+
+      memset(out, 0, sizeof (out));
+      length = HSH_Hash(hash_id, data1, sizeof (data1) - 1, data2, sizeof (data2) - 1,
+                        out, j);
+
+      if (j >= tests[i].length)
+        TEST_CHECK(length == tests[i].length);
+      else
+        TEST_CHECK(length == j);
+
+      TEST_CHECK(!memcmp(out, tests[i].out, length));
+    }
+
+    for (j = 0; j < 10000; j++) {
+      length = HSH_Hash(hash_id, data1, random() % sizeof (data1),
+                        random() % 2 ? data2 : NULL, random() % sizeof (data2),
+                        out, sizeof (out));
+      TEST_CHECK(length == tests[i].length);
+    }
+  }
+
+  HSH_Finalise();
+}
diff --git a/test/unit/hwclock.c b/test/unit/hwclock.c
new file mode 100644
index 0000000..79c0879
--- /dev/null
+++ b/test/unit/hwclock.c
@@ -0,0 +1,117 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2016-2018, 2022
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include "test.h"
+
+#if defined(FEAT_PHC) || defined(HAVE_LINUX_TIMESTAMPING)
+
+#include <hwclock.c>
+
+#define MAX_READINGS 20
+
+void
+test_unit(void)
+{
+  struct timespec start_hw_ts, start_local_ts, hw_ts, local_ts, ts;
+  struct timespec readings[MAX_READINGS][3];
+  HCL_Instance clock;
+  double freq, jitter, interval, dj, err, sum;
+  int i, j, k, l, new_sample, n_readings, count;
+
+  LCL_Initialise();
+  TST_RegisterDummyDrivers();
+
+  for (i = 1; i <= 8; i++) {
+    clock = HCL_CreateInstance(random() % (1 << i), 1 << i, 1.0, 1e-9);
+
+    for (j = 0, count = 0, sum = 0.0; j < 100; j++) {
+      UTI_ZeroTimespec(&start_hw_ts);
+      UTI_ZeroTimespec(&start_local_ts);
+      UTI_AddDoubleToTimespec(&start_hw_ts, TST_GetRandomDouble(0.0, 1e9), &start_hw_ts);
+      UTI_AddDoubleToTimespec(&start_local_ts, TST_GetRandomDouble(0.0, 1e9), &start_local_ts);
+
+      DEBUG_LOG("iteration %d", j);
+
+      freq = TST_GetRandomDouble(0.9, 1.1);
+      jitter = TST_GetRandomDouble(10.0e-9, 1000.0e-9);
+      interval = TST_GetRandomDouble(0.1, 10.0);
+
+      clock->n_samples = 0;
+      clock->valid_coefs = 0;
+      QNT_Reset(clock->delay_quants);
+
+      new_sample = 0;
+
+      for (k = 0; k < 100; k++) {
+        UTI_AddDoubleToTimespec(&start_hw_ts, k * interval * freq, &hw_ts);
+        UTI_AddDoubleToTimespec(&start_local_ts, k * interval, &local_ts);
+        if (HCL_CookTime(clock, &hw_ts, &ts, NULL) && new_sample) {
+          dj = fabs(UTI_DiffTimespecsToDouble(&ts, &local_ts) / jitter);
+          DEBUG_LOG("delta/jitter %f", dj);
+          if (clock->n_samples >= clock->max_samples / 2)
+            sum += dj, count++;
+          TEST_CHECK(clock->n_samples < 4 || dj <= 4.0);
+          TEST_CHECK(clock->n_samples < 8 || dj <= 3.0);
+        }
+
+        UTI_AddDoubleToTimespec(&start_hw_ts, k * interval * freq + TST_GetRandomDouble(-jitter, jitter), &hw_ts);
+
+        if (HCL_NeedsNewSample(clock, &local_ts)) {
+          n_readings = random() % MAX_READINGS + 1;
+          for (l = 0; l < n_readings; l++) {
+            UTI_AddDoubleToTimespec(&local_ts, -TST_GetRandomDouble(0.0, jitter / 10.0), &readings[l][0]);
+            readings[l][1] = hw_ts;
+            UTI_AddDoubleToTimespec(&local_ts, TST_GetRandomDouble(0.0, jitter / 10.0), &readings[l][2]);
+          }
+
+          UTI_ZeroTimespec(&hw_ts);
+          UTI_ZeroTimespec(&local_ts);
+          if (HCL_ProcessReadings(clock, n_readings, readings, &hw_ts, &local_ts, &err)) {
+            HCL_AccumulateSample(clock, &hw_ts, &local_ts, 2.0 * jitter);
+            new_sample = 1;
+          } else {
+            new_sample = 0;
+          }
+        }
+
+        TEST_CHECK(clock->valid_coefs == (clock->n_samples >= 2));
+
+        if (!clock->valid_coefs)
+          continue;
+
+        TEST_CHECK(fabs(clock->offset) <= 2.0 * jitter);
+      }
+    }
+
+    TEST_CHECK(sum / count < 2.4 / sqrt(clock->max_samples));
+
+    HCL_DestroyInstance(clock);
+  }
+
+  LCL_Finalise();
+}
+#else
+void
+test_unit(void)
+{
+  TEST_REQUIRE(0);
+}
+#endif
diff --git a/test/unit/keys.c b/test/unit/keys.c
new file mode 100644
index 0000000..aa5e649
--- /dev/null
+++ b/test/unit/keys.c
@@ -0,0 +1,173 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2017
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include "test.h"
+
+#if defined(FEAT_NTP) || defined(FEAT_CMDMON)
+
+#include <keys.c>
+
+#define KEYS 100
+#define KEYFILE "keys.test-keys"
+
+static
+uint32_t write_random_key(FILE *f)
+{
+  const char *type, *prefix;
+  char key[128];
+  uint32_t id;
+  int i, length;
+
+  length = random() % sizeof (key) + 1;
+  length = MAX(length, 4);
+  prefix = random() % 2 ? "HEX:" : "";
+
+  switch (random() % 8) {
+#ifdef FEAT_SECHASH
+    case 0:
+      type = "SHA1";
+      break;
+    case 1:
+      type = "SHA256";
+      break;
+    case 2:
+      type = "SHA384";
+      break;
+    case 3:
+      type = "SHA512";
+      break;
+#endif
+#ifdef HAVE_CMAC
+    case 4:
+      type = "AES128";
+      length = prefix[0] == '\0' ? 8 : 16;
+      break;
+    case 5:
+      type = "AES256";
+      length = prefix[0] == '\0' ? 16 : 32;
+      break;
+#endif
+    case 6:
+      type = "MD5";
+      break;
+    default:
+      type = "";
+  }
+
+  UTI_GetRandomBytes(&id, sizeof (id));
+  UTI_GetRandomBytes(key, length);
+
+  fprintf(f, "%u %s %s", id, type, prefix);
+  for (i = 0; i < length; i++)
+    fprintf(f, "%02hhX", key[i]);
+  fprintf(f, "\n");
+
+  return id;
+}
+
+static void
+generate_key_file(const char *name, uint32_t *keys)
+{
+  FILE *f;
+  int i;
+
+  f = fopen(name, "w");
+  TEST_CHECK(f);
+  for (i = 0; i < KEYS; i++)
+    keys[i] = write_random_key(f);
+  fclose(f);
+}
+
+void
+test_unit(void)
+{
+  int i, j, data_len, auth_len, type, bits;
+  uint32_t keys[KEYS], key;
+  unsigned char data[100], auth[MAX_HASH_LENGTH];
+  char conf[][100] = {
+    "keyfile "KEYFILE
+  };
+
+  CNF_Initialise(0, 0);
+  for (i = 0; i < sizeof conf / sizeof conf[0]; i++)
+    CNF_ParseLine(NULL, i + 1, conf[i]);
+
+  generate_key_file(KEYFILE, keys);
+  KEY_Initialise();
+
+  for (i = 0; i < 100; i++) {
+    DEBUG_LOG("iteration %d", i);
+
+    if (i) {
+      generate_key_file(KEYFILE, keys);
+      KEY_Reload();
+    }
+
+    UTI_GetRandomBytes(data, sizeof (data));
+
+    for (j = 0; j < KEYS; j++) {
+      TEST_CHECK(KEY_KeyKnown(keys[j]));
+      TEST_CHECK(KEY_GetAuthLength(keys[j]) >= 16);
+
+      data_len = random() % (sizeof (data) + 1);
+      auth_len = KEY_GenerateAuth(keys[j], data, data_len, auth, sizeof (auth));
+      TEST_CHECK(auth_len >= 16);
+
+      TEST_CHECK(KEY_CheckAuth(keys[j], data, data_len, auth, auth_len, auth_len));
+
+      if (j > 0 && keys[j - 1] != keys[j])
+        TEST_CHECK(!KEY_CheckAuth(keys[j - 1], data, data_len, auth, auth_len, auth_len));
+
+      auth_len = random() % auth_len + 1;
+      if (auth_len < MAX_HASH_LENGTH)
+        auth[auth_len]++;
+      TEST_CHECK(KEY_CheckAuth(keys[j], data, data_len, auth, auth_len, auth_len));
+
+      auth[auth_len - 1]++;
+      TEST_CHECK(!KEY_CheckAuth(keys[j], data, data_len, auth, auth_len, auth_len));
+
+      TEST_CHECK(KEY_GetKeyInfo(keys[j], &type, &bits));
+      TEST_CHECK(type > 0 && bits > 0);
+    }
+
+    for (j = 0; j < 1000; j++) {
+      UTI_GetRandomBytes(&key, sizeof (key));
+      if (KEY_KeyKnown(key))
+        continue;
+      TEST_CHECK(!KEY_GetKeyInfo(key, &type, &bits));
+      TEST_CHECK(!KEY_GenerateAuth(key, data, data_len, auth, sizeof (auth)));
+      TEST_CHECK(!KEY_CheckAuth(key, data, data_len, auth, auth_len, auth_len));
+    }
+  }
+
+  unlink(KEYFILE);
+
+  KEY_Finalise();
+  CNF_Finalise();
+  HSH_Finalise();
+}
+#else
+void
+test_unit(void)
+{
+  TEST_REQUIRE(0);
+}
+#endif
diff --git a/test/unit/ntp_auth.c b/test/unit/ntp_auth.c
new file mode 100644
index 0000000..5f2a9bc
--- /dev/null
+++ b/test/unit/ntp_auth.c
@@ -0,0 +1,289 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2020
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ *
+ **********************************************************************
+ */
+
+#include <config.h>
+#include <sysincl.h>
+#include <conf.h>
+#include <keys.h>
+#include <local.h>
+#include <ntp_ext.h>
+#include <ntp_signd.h>
+#include <nts_ntp_server.h>
+#include <socket.h>
+#include "test.h"
+
+#ifdef FEAT_NTP
+
+#include <ntp_auth.c>
+
+static void
+prepare_packet(NTP_AuthMode auth_mode, NTP_Packet *packet, NTP_PacketInfo *info, int req)
+{
+  unsigned char buf[64];
+  int i, version;
+  NTP_Mode mode;
+
+  switch (auth_mode) {
+    case NTP_AUTH_MSSNTP:
+    case NTP_AUTH_MSSNTP_EXT:
+      version = 3;
+      mode = random() % 2 ? (req ? MODE_CLIENT : MODE_SERVER) :
+                            (req ? MODE_ACTIVE : MODE_PASSIVE);
+      break;
+    case NTP_AUTH_NTS:
+      version = 4;
+      mode = req ? MODE_CLIENT : MODE_SERVER;
+      break;
+    default:
+      version = 3 + random() % 2;
+      mode = random() % 2 ? (req ? MODE_CLIENT : MODE_SERVER) :
+                            (req ? MODE_ACTIVE : MODE_PASSIVE);
+      break;
+  }
+
+  memset(packet, 0, sizeof (*packet));
+  memset(info, 0, sizeof (*info));
+  packet->lvm = NTP_LVM(LEAP_Normal, version, mode);
+  info->length = NTP_HEADER_LENGTH;
+  info->version = version;
+  info->mode = mode;
+
+  if (version == 4) {
+    memset(buf, 0, sizeof (buf));
+    for (i = random() % 5; i > 0; i--)
+      TEST_CHECK(NEF_AddField(packet, info, 0, buf, sizeof (buf)));
+  }
+}
+
+static void
+add_dummy_auth(NTP_AuthMode auth_mode, uint32_t key_id, NTP_Packet *packet, NTP_PacketInfo *info)
+{
+  unsigned char buf[64];
+  int len, fill;
+
+  info->auth.mode = auth_mode;
+
+  switch (auth_mode) {
+    case NTP_AUTH_NONE:
+      break;
+    case NTP_AUTH_SYMMETRIC:
+    case NTP_AUTH_MSSNTP:
+    case NTP_AUTH_MSSNTP_EXT:
+      switch (auth_mode) {
+        case NTP_AUTH_SYMMETRIC:
+          len = 16 + random() % 2 * 4;
+          fill = 1 + random() % 255;
+          break;
+        case NTP_AUTH_MSSNTP:
+          len = 16;
+          fill = 0;
+          break;
+        case NTP_AUTH_MSSNTP_EXT:
+          len = 68;
+          fill = 0;
+          break;
+        default:
+          assert(0);
+      }
+
+      assert(info->length + 4 + len <= sizeof (*packet));
+
+      *(uint32_t *)((unsigned char *)packet + info->length) = htonl(key_id);
+      info->auth.mac.key_id = key_id;
+      info->length += 4;
+
+      memset((unsigned char *)packet + info->length, fill, len);
+      info->length += len;
+      break;
+    case NTP_AUTH_NTS:
+      memset(buf, 0, sizeof (buf));
+      TEST_CHECK(NEF_AddField(packet, info, NTP_EF_NTS_AUTH_AND_EEF, buf, sizeof (buf)));
+      break;
+    default:
+      assert(0);
+  }
+}
+
+void
+test_unit(void)
+{
+  int i, j, can_auth_req, can_auth_res;
+  NTP_PacketInfo req_info, res_info;
+  NTP_Packet req, res;
+  NAU_Instance inst;
+  RPT_AuthReport report;
+  NTP_AuthMode mode;
+  IPSockAddr nts_addr;
+  uint32_t key_id, kod;
+  char conf[][100] = {
+    "keyfile ntp_core.keys"
+  };
+
+  CNF_Initialise(0, 0);
+  for (i = 0; i < sizeof conf / sizeof conf[0]; i++)
+    CNF_ParseLine(NULL, i + 1, conf[i]);
+
+  LCL_Initialise();
+  KEY_Initialise();
+  NSD_Initialise();
+  NNS_Initialise();
+
+  SCK_GetAnyLocalIPAddress(IPADDR_INET4, &nts_addr.ip_addr);
+  nts_addr.port = 0;
+
+  for (i = 0; i < 1000; i++) {
+    key_id = INACTIVE_AUTHKEY;
+
+    switch (i % 5) {
+      case 0:
+        inst = NAU_CreateNoneInstance();
+        TEST_CHECK(!NAU_IsAuthEnabled(inst));
+        TEST_CHECK(NAU_GetSuggestedNtpVersion(inst) == 4);
+        mode = NTP_AUTH_NONE;
+        can_auth_req = 1;
+        can_auth_res = 1;
+        break;
+      case 1:
+        key_id = random() % 7 + 2;
+        inst = NAU_CreateSymmetricInstance(key_id);
+        TEST_CHECK(NAU_IsAuthEnabled(inst));
+        TEST_CHECK(NAU_GetSuggestedNtpVersion(inst) ==
+                   (KEY_KeyKnown(inst->key_id) && KEY_GetAuthLength(inst->key_id) > 20 ? 3 : 4));
+        mode = NTP_AUTH_SYMMETRIC;
+        can_auth_req = KEY_KeyKnown(key_id);
+        can_auth_res = can_auth_req;
+        break;
+      case 2:
+        inst = NAU_CreateNtsInstance(&nts_addr, "test", 0, 0);
+        TEST_CHECK(NAU_IsAuthEnabled(inst));
+        TEST_CHECK(NAU_GetSuggestedNtpVersion(inst) == 4);
+        mode = NTP_AUTH_NTS;
+        can_auth_req = 0;
+        can_auth_res = 0;
+        break;
+      case 3:
+        key_id = 1 + random() % 100;
+        inst = NULL;
+        mode = NTP_AUTH_MSSNTP;
+        can_auth_req = 1;
+        can_auth_res = 0;
+        break;
+      case 4:
+        key_id = 1 + random() % 100;
+        inst = NULL;
+        mode = NTP_AUTH_MSSNTP_EXT;
+        can_auth_req = 0;
+        can_auth_res = 0;
+        break;
+      default:
+        assert(0);
+    }
+
+    DEBUG_LOG("iteration %d auth=%d key_id=%d", i, (int)mode, (int)key_id);
+
+    prepare_packet(mode, &req, &req_info, 1);
+
+    if (inst) {
+      TEST_CHECK(inst->mode == mode);
+      TEST_CHECK(inst->key_id == key_id);
+
+      NAU_DumpData(inst);
+      NAU_GetReport(inst, &report);
+      if (random() % 2)
+        NAU_ChangeAddress(inst, &nts_addr.ip_addr);
+
+      if (inst->mode == NTP_AUTH_NTS) {
+        for (j = random() % 5; j > 0; j--)
+#ifdef FEAT_NTS
+          TEST_CHECK(!NAU_PrepareRequestAuth(inst));
+#else
+          TEST_CHECK(NAU_PrepareRequestAuth(inst));
+#endif
+        TEST_CHECK(!NAU_GenerateRequestAuth(inst, &req, &req_info));
+      } else if (can_auth_req) {
+        TEST_CHECK(NAU_PrepareRequestAuth(inst));
+        TEST_CHECK(NAU_GenerateRequestAuth(inst, &req, &req_info));
+      } else {
+        TEST_CHECK(NAU_PrepareRequestAuth(inst));
+        TEST_CHECK(!NAU_GenerateRequestAuth(inst, &req, &req_info));
+      }
+    }
+
+    if (!inst || !can_auth_req)
+      add_dummy_auth(mode, key_id, &req, &req_info);
+
+    assert(req_info.auth.mode == mode);
+    assert(req_info.auth.mac.key_id == key_id);
+
+    kod = 1;
+    TEST_CHECK(NAU_CheckRequestAuth(&req, &req_info, &kod) == can_auth_req);
+    TEST_CHECK(kod == 0);
+
+    if (inst) {
+      for (j = NTP_AUTH_NONE; j <= NTP_AUTH_NTS; j++) {
+        if (j == mode && j == NTP_AUTH_NONE)
+          continue;
+
+        prepare_packet(j, &res, &res_info, 0);
+        add_dummy_auth(j, key_id ? key_id : 1, &res, &res_info);
+
+        TEST_CHECK(res_info.auth.mode == j);
+        TEST_CHECK(!NAU_CheckResponseAuth(inst, &res, &res_info));
+      }
+    }
+
+    prepare_packet(mode, &res, &res_info, 0);
+    TEST_CHECK(NAU_GenerateResponseAuth(&req, &req_info, &res, &res_info, NULL, NULL, kod) ==
+               can_auth_res);
+    if (!can_auth_res)
+      add_dummy_auth(mode, key_id, &res, &res_info);
+
+    assert(res_info.auth.mode == mode);
+    assert(res_info.auth.mac.key_id == key_id);
+
+    if (inst) {
+      if (mode == NTP_AUTH_SYMMETRIC) {
+        res_info.auth.mac.key_id ^= 1;
+        TEST_CHECK(!NAU_CheckResponseAuth(inst, &res, &res_info));
+        res_info.auth.mac.key_id ^= 1;
+      }
+
+      TEST_CHECK(NAU_CheckResponseAuth(inst, &res, &res_info) == can_auth_res);
+
+      NAU_GetReport(inst, &report);
+      NAU_DestroyInstance(inst);
+    }
+  }
+
+  NNS_Finalise();
+  NSD_Finalise();
+  KEY_Finalise();
+  LCL_Finalise();
+  CNF_Finalise();
+  HSH_Finalise();
+}
+
+#else
+void
+test_unit(void)
+{
+  TEST_REQUIRE(0);
+}
+#endif
diff --git a/test/unit/ntp_core.c b/test/unit/ntp_core.c
new file mode 100644
index 0000000..989b294
--- /dev/null
+++ b/test/unit/ntp_core.c
@@ -0,0 +1,648 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2017-2018, 2023
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include <sysincl.h>
+#include <cmdparse.h>
+#include <conf.h>
+#include <keys.h>
+#include <ntp_ext.h>
+#include <ntp_io.h>
+#include <sched.h>
+#include <local.h>
+#include "test.h"
+
+#ifdef FEAT_NTP
+
+static struct timespec current_time;
+static NTP_Packet req_buffer, res_buffer;
+static int req_length, res_length;
+
+#define NIO_IsHwTsEnabled() 1
+#define NIO_OpenServerSocket(addr) ((addr)->ip_addr.family != IPADDR_UNSPEC ? 100 : 0)
+#define NIO_CloseServerSocket(fd) assert(fd == 100)
+#define NIO_OpenClientSocket(addr) ((addr)->ip_addr.family != IPADDR_UNSPEC ? 101 : 0)
+#define NIO_CloseClientSocket(fd) assert(fd == 101)
+#define NIO_IsServerSocket(fd) (fd == 100)
+#define NIO_IsServerSocketOpen() 1
+#define NIO_SendPacket(msg, to, from, len, process_tx) (memcpy(&req_buffer, msg, len), req_length = len, 1)
+#define SCH_AddTimeoutByDelay(delay, handler, arg) (1 ? 102 : (handler(arg), 1))
+#define SCH_AddTimeoutInClass(delay, separation, randomness, class, handler, arg) \
+  add_timeout_in_class(delay, separation, randomness, class, handler, arg)
+#define SCH_RemoveTimeout(id) assert(!id || id == 102)
+#define LCL_ReadRawTime(ts) (*ts = current_time)
+#define LCL_ReadCookedTime(ts, err) do {double *p = err; *ts = current_time; if (p) *p = 0.0;} while (0)
+#define LCL_GetSysPrecisionAsLog() (random() % 10 - 30)
+#define SRC_UpdateReachability(inst, reach)
+#define SRC_ResetReachability(inst)
+
+static SCH_TimeoutID
+add_timeout_in_class(double min_delay, double separation, double randomness,
+                     SCH_TimeoutClass class, SCH_TimeoutHandler handler, SCH_ArbitraryArgument arg)
+{
+  return 102;
+}
+
+#include <ntp_core.c>
+
+static void
+advance_time(double x)
+{
+  UTI_AddDoubleToTimespec(&current_time, x, &current_time);
+}
+
+static uint32_t
+get_random_key_id(void)
+{
+  uint32_t id;
+
+  do {
+    id = random() % 8 + 2;
+  } while (!KEY_KeyKnown(id));
+
+  return id;
+}
+
+static void
+send_request(NCR_Instance inst, int late_hwts)
+{
+  NTP_Local_Address local_addr;
+  NTP_Local_Timestamp local_ts;
+  uint32_t prev_tx_count;
+
+  prev_tx_count = inst->report.total_tx_count;
+
+  transmit_timeout(inst);
+  TEST_CHECK(!inst->valid_rx);
+  TEST_CHECK(prev_tx_count + 1 == inst->report.total_tx_count);
+
+  advance_time(1e-5);
+
+  if (random() % 2) {
+    local_addr.ip_addr.family = IPADDR_UNSPEC;
+    local_addr.if_index = INVALID_IF_INDEX;
+    local_addr.sock_fd = 101;
+    zero_local_timestamp(&local_ts);
+    local_ts.ts = current_time;
+    local_ts.source = NTP_TS_KERNEL;
+
+    NCR_ProcessTxKnown(inst, &local_addr, &local_ts, &req_buffer, req_length);
+  }
+
+  if (late_hwts) {
+    inst->report.total_good_count++;
+  } else {
+    inst->report.total_good_count = 0;
+  }
+}
+
+static void
+process_request(NTP_Remote_Address *remote_addr)
+{
+  NTP_Local_Address local_addr;
+  NTP_Local_Timestamp local_ts;
+
+  local_addr.ip_addr.family = IPADDR_UNSPEC;
+  local_addr.if_index = INVALID_IF_INDEX;
+  local_addr.sock_fd = 100;
+  zero_local_timestamp(&local_ts);
+  local_ts.ts = current_time;
+  local_ts.source = NTP_TS_KERNEL;
+
+  res_length = 0;
+  NCR_ProcessRxUnknown(remote_addr, &local_addr, &local_ts,
+                       &req_buffer, req_length);
+  res_length = req_length;
+  res_buffer = req_buffer;
+
+  advance_time(1e-5);
+
+  if (random() % 2) {
+    local_ts.ts = current_time;
+    NCR_ProcessTxUnknown(remote_addr, &local_addr, &local_ts,
+                         &res_buffer, res_length);
+  }
+}
+
+static void
+send_response(int interleaved, int authenticated, int allow_update, int valid_ts, int valid_auth)
+{
+  NTP_Packet *req, *res;
+  uint32_t key_id = 0;
+  int i, auth_len = 0, ef_len, efs;
+
+  req = &req_buffer;
+  res = &res_buffer;
+
+  TEST_CHECK(req_length >= NTP_HEADER_LENGTH);
+
+  res->lvm = NTP_LVM(LEAP_Normal, NTP_LVM_TO_VERSION(req->lvm),
+                     NTP_LVM_TO_MODE(req->lvm) == MODE_CLIENT ? MODE_SERVER : MODE_ACTIVE);
+  res->stratum = 1;
+  res->poll = req->poll;
+  res->precision = -20;
+  res->root_delay = UTI_DoubleToNtp32(0.1);
+  res->root_dispersion = UTI_DoubleToNtp32(0.1);
+  res->reference_id = 0;
+  UTI_ZeroNtp64(&res->reference_ts);
+  res->originate_ts = interleaved ? req->receive_ts : req->transmit_ts;
+
+  advance_time(TST_GetRandomDouble(1e-4, 1e-2));
+  UTI_TimespecToNtp64(&current_time, &res->receive_ts, NULL);
+  advance_time(TST_GetRandomDouble(-1e-4, 1e-3));
+  UTI_TimespecToNtp64(&current_time, &res->transmit_ts, NULL);
+  advance_time(TST_GetRandomDouble(1e-4, 1e-2));
+
+  if (!valid_ts) {
+    switch (random() % (allow_update ? 4 : 5)) {
+      case 0:
+        res->originate_ts.hi = random();
+        break;
+      case 1:
+        res->originate_ts.lo = random();
+        break;
+      case 2:
+        UTI_ZeroNtp64(&res->originate_ts);
+        break;
+      case 3:
+        UTI_ZeroNtp64(&res->receive_ts);
+        break;
+      case 4:
+        UTI_ZeroNtp64(&res->transmit_ts);
+        break;
+      default:
+        assert(0);
+    }
+  }
+
+  res_length = NTP_HEADER_LENGTH;
+
+  if (NTP_LVM_TO_VERSION(res->lvm) == 4 && random() % 2) {
+    unsigned char buf[128];
+
+    memset(buf, 0, sizeof (buf));
+    efs = random() % 5;
+
+    for (i = 0; i < efs; i++) {
+      ef_len = (i + 1 == efs ? NTP_MAX_V4_MAC_LENGTH + 4 : NTP_MIN_EF_LENGTH) +
+               4 * (random() % 10);
+      TEST_CHECK(NEF_SetField((unsigned char *)res, sizeof (*res), res_length, 0,
+                              buf, ef_len - 4, &ef_len));
+      res_length += ef_len;
+    }
+  }
+
+  if (authenticated) {
+    key_id = ntohl(*(uint32_t *)req->extensions);
+    if (key_id == 0)
+      key_id = get_random_key_id();
+    auth_len = KEY_GetAuthLength(key_id);
+    assert(auth_len);
+    if (NTP_LVM_TO_VERSION(res->lvm) == 4)
+      auth_len = MIN(auth_len, NTP_MAX_V4_MAC_LENGTH - 4);
+
+    if (KEY_GenerateAuth(key_id, res, res_length,
+                         (unsigned char *)res + res_length + 4, auth_len) != auth_len)
+      assert(0);
+    res_length += 4 + auth_len;
+  }
+
+  if (!valid_auth && authenticated) {
+    assert(auth_len);
+
+    switch (random() % 5) {
+      case 0:
+        key_id++;
+        break;
+      case 1:
+        key_id ^= 1;
+        if (KEY_GenerateAuth(key_id, res, res_length - auth_len - 4,
+                             (unsigned char *)res + res_length - auth_len, auth_len) != auth_len)
+          assert(0);
+        break;
+      case 2:
+        ((unsigned char *)res)[res_length - auth_len + random() % auth_len]++;
+        break;
+      case 3:
+        res_length -= 4 + auth_len;
+        auth_len = 4 * (random() % (auth_len / 4));
+        res_length += 4 + auth_len;
+        break;
+      case 4:
+        if (NTP_LVM_TO_VERSION(res->lvm) == 4 && random() % 2 &&
+            KEY_GetAuthLength(key_id) > NTP_MAX_V4_MAC_LENGTH - 4) {
+          res_length -= 4 + auth_len;
+          auth_len += 4 + 4 * (random() %
+                               ((KEY_GetAuthLength(key_id) - NTP_MAX_V4_MAC_LENGTH - 4) / 4));
+          if (KEY_GenerateAuth(key_id, res, res_length,
+                               (unsigned char *)res + res_length + 4, auth_len) != auth_len)
+              assert(0);
+          res_length += 4 + auth_len;
+        } else {
+          memset((unsigned char *)res + res_length, 0, 4);
+          auth_len += 4;
+          res_length += 4;
+        }
+        break;
+      default:
+        assert(0);
+    }
+  }
+
+  assert(res_length <= sizeof (*res));
+  assert(res_length >= NTP_HEADER_LENGTH + auth_len);
+
+  if (authenticated)
+    *(uint32_t *)((unsigned char *)res + res_length - auth_len - 4) = htonl(key_id);
+}
+
+static void
+proc_response(NCR_Instance inst, int good, int valid, int updated_sync,
+              int updated_init, int save)
+{
+  NTP_Local_Address local_addr;
+  NTP_Local_Timestamp local_ts;
+  NTP_Packet *res;
+  uint32_t prev_rx_count, prev_valid_count;
+  struct timespec prev_rx_ts, prev_init_rx_ts;
+  int ret;
+
+  res = &res_buffer;
+
+  local_addr.ip_addr.family = IPADDR_UNSPEC;
+  local_addr.if_index = INVALID_IF_INDEX;
+  local_addr.sock_fd = NTP_LVM_TO_MODE(res->lvm) != MODE_SERVER ? 100 : 101;
+  zero_local_timestamp(&local_ts);
+  local_ts.ts = current_time;
+  local_ts.source = NTP_TS_KERNEL;
+
+  prev_rx_count = inst->report.total_rx_count;
+  prev_valid_count = inst->report.total_valid_count;
+  prev_rx_ts = inst->local_rx.ts;
+  prev_init_rx_ts = inst->init_local_rx.ts;
+
+  ret = NCR_ProcessRxKnown(inst, &local_addr, &local_ts, res, res_length);
+
+  if (save) {
+    TEST_CHECK(ret);
+    TEST_CHECK(inst->saved_response);
+    TEST_CHECK(inst->saved_response->timeout_id != 0);
+    TEST_CHECK(has_saved_response(inst));
+    if (random() % 2)
+      saved_response_timeout(inst);
+    else
+      transmit_timeout(inst);
+    TEST_CHECK(inst->saved_response->timeout_id == 0);
+    TEST_CHECK(!has_saved_response(inst));
+  }
+
+  if (good > 0)
+    TEST_CHECK(ret);
+  else if (!good)
+    TEST_CHECK(!ret);
+
+  TEST_CHECK(prev_rx_count + 1 == inst->report.total_rx_count);
+
+  if (valid)
+    TEST_CHECK(prev_valid_count + 1 == inst->report.total_valid_count);
+  else
+    TEST_CHECK(prev_valid_count == inst->report.total_valid_count);
+
+  if (updated_sync)
+    TEST_CHECK(UTI_CompareTimespecs(&inst->local_rx.ts, &prev_rx_ts));
+  else
+    TEST_CHECK(!UTI_CompareTimespecs(&inst->local_rx.ts, &prev_rx_ts));
+
+  if (updated_init > 0)
+    TEST_CHECK(UTI_CompareTimespecs(&inst->init_local_rx.ts, &prev_init_rx_ts));
+  else if (!updated_init)
+    TEST_CHECK(!UTI_CompareTimespecs(&inst->init_local_rx.ts, &prev_init_rx_ts));
+
+  if (valid) {
+    TEST_CHECK(UTI_IsZeroTimespec(&inst->init_local_rx.ts));
+    TEST_CHECK(UTI_IsZeroNtp64(&inst->init_remote_ntp_tx));
+  }
+}
+
+static void
+process_replay(NCR_Instance inst, NTP_Packet *packet_queue,
+               int queue_length, int updated_init)
+{
+  do {
+    res_buffer = packet_queue[random() % queue_length];
+  } while (!UTI_CompareNtp64(&res_buffer.transmit_ts, &inst->remote_ntp_tx));
+  proc_response(inst, 0, 0, 0, updated_init, 0);
+  advance_time(1e-6);
+}
+
+static void
+add_dummy_auth(NTP_AuthMode auth_mode, uint32_t key_id, NTP_Packet *packet, NTP_PacketInfo *info)
+{
+  unsigned char buf[64];
+  int len, fill;
+
+  info->auth.mode = auth_mode;
+
+  switch (auth_mode) {
+    case NTP_AUTH_NONE:
+      break;
+    case NTP_AUTH_SYMMETRIC:
+    case NTP_AUTH_MSSNTP:
+    case NTP_AUTH_MSSNTP_EXT:
+      switch (auth_mode) {
+        case NTP_AUTH_SYMMETRIC:
+          len = 16 + random() % 2 * 4;
+          fill = 1 + random() % 255;
+          break;
+        case NTP_AUTH_MSSNTP:
+          len = 16;
+          fill = 0;
+          break;
+        case NTP_AUTH_MSSNTP_EXT:
+          len = 68;
+          fill = 0;
+          break;
+        default:
+          assert(0);
+      }
+
+      assert(info->length + 4 + len <= sizeof (*packet));
+
+      *(uint32_t *)((unsigned char *)packet + info->length) = htonl(key_id);
+      info->auth.mac.key_id = key_id;
+      info->length += 4;
+
+      memset((unsigned char *)packet + info->length, fill, len);
+      info->length += len;
+      break;
+    case NTP_AUTH_NTS:
+      memset(buf, 0, sizeof (buf));
+      TEST_CHECK(NEF_AddField(packet, info, NTP_EF_NTS_AUTH_AND_EEF, buf, sizeof (buf)));
+      break;
+    default:
+      assert(0);
+  }
+}
+
+#define PACKET_QUEUE_LENGTH 10
+
+void
+test_unit(void)
+{
+  char source_line[] = "127.0.0.1 maxdelaydevratio 1e6 noselect";
+  char conf[][100] = {
+    "allow",
+    "port 0",
+    "local",
+    "keyfile ntp_core.keys"
+  };
+  int i, j, k, interleaved, authenticated, valid, updated, has_updated, late_hwts;
+  CPS_NTP_Source source;
+  NTP_Remote_Address remote_addr;
+  NCR_Instance inst1, inst2;
+  NTP_Packet packet_queue[PACKET_QUEUE_LENGTH], packet;
+  NTP_PacketInfo info;
+
+  CNF_Initialise(0, 0);
+  for (i = 0; i < sizeof conf / sizeof conf[0]; i++)
+    CNF_ParseLine(NULL, i + 1, conf[i]);
+
+  LCL_Initialise();
+  TST_RegisterDummyDrivers();
+  SCH_Initialise();
+  SRC_Initialise();
+  NIO_Initialise();
+  NCR_Initialise();
+  REF_Initialise();
+  KEY_Initialise();
+  CLG_Initialise();
+
+  CNF_SetupAccessRestrictions();
+
+  CPS_ParseNTPSourceAdd(source_line, &source);
+
+  for (i = 0; i < 1000; i++) {
+    source.params.interleaved = random() % 2;
+    source.params.authkey = random() % 2 ? get_random_key_id() : INACTIVE_AUTHKEY;
+    source.params.version = random() % 4 + 1;
+
+    UTI_ZeroTimespec(&current_time);
+#if HAVE_LONG_TIME_T
+    advance_time(NTP_ERA_SPLIT);
+#endif
+    advance_time(TST_GetRandomDouble(1.0, 1e9));
+
+    TST_GetRandomAddress(&remote_addr.ip_addr, IPADDR_UNSPEC, -1);
+    remote_addr.port = 123;
+
+    inst1 = NCR_CreateInstance(&remote_addr, random() % 2 ? NTP_SERVER : NTP_PEER,
+                               &source.params, NULL);
+    NCR_StartInstance(inst1);
+    has_updated = 0;
+
+    for (j = 0; j < 50; j++) {
+      DEBUG_LOG("client/peer test iteration %d/%d", i, j);
+
+      late_hwts = random() % 2;
+      authenticated = random() % 2;
+      interleaved = random() % 2 && (inst1->mode != MODE_CLIENT ||
+                                     inst1->tx_count < MAX_CLIENT_INTERLEAVED_TX);
+      authenticated = random() % 2;
+      valid = (!interleaved || (source.params.interleaved && has_updated)) &&
+              ((source.params.authkey == INACTIVE_AUTHKEY) == !authenticated);
+      updated = (valid || inst1->mode == MODE_ACTIVE) &&
+                ((source.params.authkey == INACTIVE_AUTHKEY) == !authenticated);
+      has_updated = has_updated || updated;
+      if (inst1->mode == MODE_CLIENT)
+        updated = 0;
+
+      DEBUG_LOG("authkey=%d version=%d interleaved=%d authenticated=%d valid=%d updated=%d has_updated=%d",
+                (int)source.params.authkey, source.params.version,
+                interleaved, authenticated, valid, updated, has_updated);
+
+      send_request(inst1, late_hwts);
+
+      send_response(interleaved, authenticated, 1, 0, 1);
+      DEBUG_LOG("response 1");
+      proc_response(inst1, 0, 0, 0, updated, 0);
+
+      if (source.params.authkey) {
+        send_response(interleaved, authenticated, 1, 1, 0);
+        DEBUG_LOG("response 2");
+        proc_response(inst1, 0, 0, 0, 0, 0);
+      }
+
+      send_response(interleaved, authenticated, 1, 1, 1);
+      DEBUG_LOG("response 3");
+      proc_response(inst1, -1, valid, valid, updated, valid && late_hwts);
+      DEBUG_LOG("response 4");
+      proc_response(inst1, 0, 0, 0, 0, 0);
+
+      advance_time(-1.0);
+
+      send_response(interleaved, authenticated, 1, 1, 1);
+      DEBUG_LOG("response 5");
+      proc_response(inst1, 0, 0, 0, updated && valid, 0);
+
+      advance_time(1.0);
+
+      send_response(interleaved, authenticated, 1, 1, 1);
+      DEBUG_LOG("response 6");
+      proc_response(inst1, 0, 0, valid && updated, updated, 0);
+    }
+
+    NCR_DestroyInstance(inst1);
+
+    inst1 = NCR_CreateInstance(&remote_addr, random() % 2 ? NTP_SERVER : NTP_PEER,
+                               &source.params, NULL);
+    NCR_StartInstance(inst1);
+
+    for (j = 0; j < 20; j++) {
+      DEBUG_LOG("server test iteration %d/%d", i, j);
+
+      send_request(inst1, 0);
+      process_request(&remote_addr);
+      proc_response(inst1,
+                    !source.params.interleaved || source.params.version != 4 ||
+                      inst1->mode == MODE_ACTIVE || j != 2,
+                    1, 1, 0, 0);
+      advance_time(1 << inst1->local_poll);
+    }
+
+    NCR_DestroyInstance(inst1);
+
+    inst1 = NCR_CreateInstance(&remote_addr, NTP_PEER, &source.params, NULL);
+    NCR_StartInstance(inst1);
+    inst2 = NCR_CreateInstance(&remote_addr, NTP_PEER, &source.params, NULL);
+    NCR_StartInstance(inst2);
+
+    res_length = req_length = 0;
+
+    for (j = 0; j < 20; j++) {
+      DEBUG_LOG("peer replay test iteration %d/%d", i, j);
+
+      late_hwts = random() % 2;
+
+      send_request(inst1, late_hwts);
+      res_buffer = req_buffer;
+      assert(!res_length || res_length == req_length);
+      res_length = req_length;
+
+      TEST_CHECK(inst1->valid_timestamps == (j > 0));
+
+      DEBUG_LOG("response 1->2");
+      proc_response(inst2, j > source.params.interleaved, j > 0, j > 0, 1, 0);
+
+      packet_queue[(j * 2) % PACKET_QUEUE_LENGTH] = res_buffer;
+
+      for (k = 0; k < j % 4 + 1; k++) {
+        DEBUG_LOG("replay ?->1 %d", k);
+        process_replay(inst1, packet_queue, MIN(j * 2 + 1, PACKET_QUEUE_LENGTH), k ? -1 : 1);
+        DEBUG_LOG("replay ?->2 %d", k);
+        process_replay(inst2, packet_queue, MIN(j * 2 + 1, PACKET_QUEUE_LENGTH), -1);
+      }
+
+      advance_time(1 << (source.params.minpoll - 1));
+
+      send_request(inst2, 0);
+      res_buffer = req_buffer;
+      assert(res_length == req_length);
+
+      TEST_CHECK(inst2->valid_timestamps == (j > 0));
+
+      DEBUG_LOG("response 2->1");
+      proc_response(inst1, 1, 1, 1, 1, late_hwts);
+
+      packet_queue[(j * 2 + 1) % PACKET_QUEUE_LENGTH] = res_buffer;
+
+      for (k = 0; k < j % 4 + 1; k++) {
+        DEBUG_LOG("replay ?->1 %d", k);
+        process_replay(inst1, packet_queue, MIN(j * 2 + 2, PACKET_QUEUE_LENGTH), k ? -1 : 1);
+        DEBUG_LOG("replay ?->2 %d", k);
+        process_replay(inst2, packet_queue, MIN(j * 2 + 2, PACKET_QUEUE_LENGTH), -1);
+      }
+
+      advance_time(1 << (source.params.minpoll - 1));
+    }
+
+    NCR_DestroyInstance(inst1);
+    NCR_DestroyInstance(inst2);
+  }
+
+  memset(&packet, 0, sizeof (packet));
+  packet.lvm = NTP_LVM(LEAP_Normal, NTP_VERSION, MODE_CLIENT);
+
+  TEST_CHECK(parse_packet(&packet, NTP_HEADER_LENGTH, &info));
+  TEST_CHECK(info.auth.mode == NTP_AUTH_NONE);
+
+  TEST_CHECK(parse_packet(&packet, NTP_HEADER_LENGTH, &info));
+  add_dummy_auth(NTP_AUTH_SYMMETRIC, 100, &packet, &info);
+  memset(&info.auth, 0, sizeof (info.auth));
+  TEST_CHECK(parse_packet(&packet, info.length, &info));
+  TEST_CHECK(info.auth.mode == NTP_AUTH_SYMMETRIC);
+  TEST_CHECK(info.auth.mac.start == NTP_HEADER_LENGTH);
+  TEST_CHECK(info.auth.mac.length == info.length - NTP_HEADER_LENGTH);
+  TEST_CHECK(info.auth.mac.key_id == 100);
+
+  TEST_CHECK(parse_packet(&packet, NTP_HEADER_LENGTH, &info));
+  add_dummy_auth(NTP_AUTH_NTS, 0, &packet, &info);
+  memset(&info.auth, 0, sizeof (info.auth));
+  TEST_CHECK(parse_packet(&packet, info.length, &info));
+  TEST_CHECK(info.auth.mode == NTP_AUTH_NTS);
+
+  packet.lvm = NTP_LVM(LEAP_Normal, 3, MODE_CLIENT);
+
+  TEST_CHECK(parse_packet(&packet, NTP_HEADER_LENGTH, &info));
+  add_dummy_auth(NTP_AUTH_MSSNTP, 200, &packet, &info);
+  memset(&info.auth, 0, sizeof (info.auth));
+  TEST_CHECK(parse_packet(&packet, info.length, &info));
+  TEST_CHECK(info.auth.mode == NTP_AUTH_MSSNTP);
+  TEST_CHECK(info.auth.mac.start == NTP_HEADER_LENGTH);
+  TEST_CHECK(info.auth.mac.length == 20);
+  TEST_CHECK(info.auth.mac.key_id == 200);
+
+  TEST_CHECK(parse_packet(&packet, NTP_HEADER_LENGTH, &info));
+  add_dummy_auth(NTP_AUTH_MSSNTP_EXT, 300, &packet, &info);
+  memset(&info.auth, 0, sizeof (info.auth));
+  TEST_CHECK(parse_packet(&packet, info.length, &info));
+  TEST_CHECK(info.auth.mode == NTP_AUTH_MSSNTP_EXT);
+  TEST_CHECK(info.auth.mac.start == NTP_HEADER_LENGTH);
+  TEST_CHECK(info.auth.mac.length == 72);
+  TEST_CHECK(info.auth.mac.key_id == 300);
+
+  CLG_Finalise();
+  KEY_Finalise();
+  REF_Finalise();
+  NCR_Finalise();
+  NIO_Finalise();
+  SRC_Finalise();
+  SCH_Finalise();
+  LCL_Finalise();
+  CNF_Finalise();
+  HSH_Finalise();
+}
+
+#else
+void
+test_unit(void)
+{
+  TEST_REQUIRE(0);
+}
+#endif
diff --git a/test/unit/ntp_core.keys b/test/unit/ntp_core.keys
new file mode 100644
index 0000000..a3e4f6c
--- /dev/null
+++ b/test/unit/ntp_core.keys
@@ -0,0 +1,8 @@
+2 MD5 HEX:38979C567358C0896F4D9D459A3C8B8478654579
+3 MD5 HEX:38979C567358C0896F4D9D459A3C8B8478654579
+4 SHA1 HEX:B71744EA01FBF01CA30D173ECDDF901952AE356A
+5 SHA1 HEX:B71744EA01FBF01CA30D173ECDDF901952AE356A
+6 SHA512 HEX:DE027482F22B201FC20863F58C74095E7906089F
+7 SHA512 HEX:DE027482F22B201FC20863F58C74095E7906089F
+8 AES128 HEX:5D5E8A31D4B459A66D445259E147CFB5
+9 AES128 HEX:5D5E8A31D4B459A66D445259E147CFB5
diff --git a/test/unit/ntp_ext.c b/test/unit/ntp_ext.c
new file mode 100644
index 0000000..c37e702
--- /dev/null
+++ b/test/unit/ntp_ext.c
@@ -0,0 +1,167 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2020
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include "test.h"
+
+#ifdef FEAT_NTP
+
+#include <util.h>
+#include <logging.h>
+
+#include <ntp_ext.c>
+
+void
+test_unit(void)
+{
+  unsigned char *buffer, body[NTP_MAX_EXTENSIONS_LENGTH];
+  void *bodyp;
+  NTP_PacketInfo info;
+  NTP_Packet packet;
+  int i, j, start, length, type, type2, body_length, body_length2;
+
+  assert(sizeof (uint16_t) == 2);
+  assert(sizeof (body) == sizeof (packet.extensions));
+
+  buffer = (unsigned char *)packet.extensions;
+
+  for (i = 0; i < 10000; i++) {
+    body_length = random() % (sizeof (body) - 4 + 1) / 4 * 4;
+    start = random() % (sizeof (packet.extensions) - body_length - 4 + 1) / 4 * 4;
+    type = random() % 0x10000;
+
+    DEBUG_LOG("body_length=%d start=%d type=%d", body_length, start, type);
+    assert(body_length + start <= sizeof (packet.extensions));
+
+    UTI_GetRandomBytes(body, body_length);
+
+    TEST_CHECK(!NEF_SetField(buffer, body_length + start + 4, start,
+                             type, body, body_length + 4, &length));
+    TEST_CHECK(!NEF_SetField(buffer, body_length + start + 4, start + 4,
+                             type, body, body_length, &length));
+    TEST_CHECK(!NEF_SetField(buffer, body_length + start + 4, start,
+                             type, body, body_length - 1, &length));
+    TEST_CHECK(!NEF_SetField(buffer, body_length + start + 4, start,
+                             type, body, body_length - 2, &length));
+    TEST_CHECK(!NEF_SetField(buffer, body_length + start + 4, start,
+                             type, body, body_length - 3, &length));
+    TEST_CHECK(!NEF_SetField(buffer, body_length + start + 3, start,
+                             type, body, body_length, &length));
+    TEST_CHECK(!NEF_SetField(buffer, body_length + start + 5, start + 1,
+                             type, body, body_length, &length));
+
+    TEST_CHECK(NEF_SetField(buffer, body_length + start + 4, start,
+                            type, body, body_length, &length));
+    TEST_CHECK(length == body_length + 4);
+    TEST_CHECK(((uint16_t *)buffer)[start / 2] == htons(type));
+    TEST_CHECK(((uint16_t *)buffer)[start / 2 + 1] == htons(length));
+    TEST_CHECK(memcmp(buffer + start + 4, body, body_length) == 0);
+
+    memset(&packet, 0, sizeof (packet));
+    packet.lvm = NTP_LVM(0, 4, MODE_CLIENT);
+    memset(&info, 0, sizeof (info));
+
+    info.version = 3;
+    info.length = NTP_HEADER_LENGTH;
+    TEST_CHECK(!NEF_AddBlankField(&packet, &info, type, body_length, &bodyp));
+
+    info.version = 4;
+    info.length = NTP_HEADER_LENGTH - 4;
+    TEST_CHECK(!NEF_AddBlankField(&packet, &info, type, body_length, &bodyp));
+
+    info.length = sizeof (packet) - body_length;
+    TEST_CHECK(!NEF_AddBlankField(&packet, &info, type, body_length, &bodyp));
+
+    info.length = NTP_HEADER_LENGTH + start;
+
+    if (body_length < 12) {
+      TEST_CHECK(!NEF_AddBlankField(&packet, &info, type, body_length, &bodyp));
+      continue;
+    }
+
+    TEST_CHECK(NEF_AddBlankField(&packet, &info, type, body_length, &bodyp));
+    TEST_CHECK(info.length == NTP_HEADER_LENGTH + start + body_length + 4);
+    TEST_CHECK(((uint16_t *)buffer)[start / 2] == htons(type));
+    TEST_CHECK(((uint16_t *)buffer)[start / 2 + 1] == htons(length));
+    TEST_CHECK(bodyp == buffer + start + 4);
+    TEST_CHECK(info.ext_fields == 1);
+
+    memset(buffer, 0, sizeof (packet.extensions));
+    info.length = NTP_HEADER_LENGTH + start;
+    info.ext_fields = 0;
+
+    TEST_CHECK(NEF_AddField(&packet, &info, type, body, body_length));
+    TEST_CHECK(info.length == NTP_HEADER_LENGTH + start + body_length + 4);
+    TEST_CHECK(((uint16_t *)buffer)[start / 2] == htons(type));
+    TEST_CHECK(((uint16_t *)buffer)[start / 2 + 1] == htons(length));
+    TEST_CHECK(memcmp(buffer + start + 4, body, body_length) == 0);
+    TEST_CHECK(info.ext_fields == 1);
+
+    for (j = 1; j <= 4; j++) {
+      TEST_CHECK(((uint16_t *)buffer)[start / 2 + 1] = htons(length + j));
+      TEST_CHECK(!NEF_ParseSingleField(buffer, start + body_length + 4, start,
+                                       &length, &type2, &bodyp, &body_length2));
+    }
+
+    TEST_CHECK(((uint16_t *)buffer)[start / 2 + 1] = htons(length));
+
+    TEST_CHECK(NEF_ParseSingleField(buffer, sizeof (packet.extensions), start,
+                                    &length, &type2, &bodyp, &body_length2));
+    TEST_CHECK(length == body_length + 4);
+    TEST_CHECK(type2 == type);
+    TEST_CHECK(bodyp == buffer + start + 4);
+    TEST_CHECK(body_length2 == body_length);
+
+    TEST_CHECK(!NEF_ParseField(&packet, sizeof (packet) + 4,
+                               NTP_HEADER_LENGTH + start,
+                               &length, &type2, &bodyp, &body_length2));
+
+    if (body_length < 24) {
+      TEST_CHECK(!NEF_ParseField(&packet, NTP_HEADER_LENGTH + start + length, 
+                                 NTP_HEADER_LENGTH + start,
+                                 &length, &type2, &bodyp, &body_length2));
+      if (sizeof (packet.extensions) - start <= 24) {
+        TEST_CHECK(!NEF_ParseField(&packet, sizeof (packet), NTP_HEADER_LENGTH + start,
+                                   &length, &type2, &bodyp, &body_length2));
+        continue;
+      } else {
+        TEST_CHECK(NEF_ParseField(&packet, sizeof (packet), NTP_HEADER_LENGTH + start,
+                                  &length, &type2, &bodyp, &body_length2));
+      }
+    } else {
+      TEST_CHECK(NEF_ParseField(&packet, NTP_HEADER_LENGTH + start + length, 
+                                NTP_HEADER_LENGTH + start,
+                                &length, &type2, &bodyp, &body_length2));
+    }
+    TEST_CHECK(length == body_length + 4);
+    TEST_CHECK(type2 == type);
+    TEST_CHECK(bodyp == buffer + start + 4);
+    TEST_CHECK(body_length2 == body_length);
+
+  }
+}
+
+#else
+void
+test_unit(void)
+{
+  TEST_REQUIRE(0);
+}
+#endif
diff --git a/test/unit/ntp_sources.c b/test/unit/ntp_sources.c
new file mode 100644
index 0000000..e3d7c4d
--- /dev/null
+++ b/test/unit/ntp_sources.c
@@ -0,0 +1,378 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2016, 2021
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include "test.h"
+
+#ifdef FEAT_NTP
+
+#include <conf.h>
+#include <cmdparse.h>
+#include <nameserv_async.h>
+#include <ntp_core.h>
+#include <ntp_io.h>
+#include <sched.h>
+
+static char *requested_name = NULL;
+static DNS_NameResolveHandler resolve_handler = NULL;
+static void *resolve_handler_arg = NULL;
+
+#define DNS_Name2IPAddressAsync(name, handler, arg) \
+  requested_name = (name), \
+  resolve_handler = (handler), \
+  resolve_handler_arg = (arg)
+#define NCR_ChangeRemoteAddress(inst, remote_addr, ntp_only) \
+  change_remote_address(inst, remote_addr, ntp_only)
+#define NCR_ProcessRxKnown(remote_addr, local_addr, ts, msg, len) (random() % 2)
+#define NIO_IsServerConnectable(addr) (random() % 2)
+#define SCH_GetLastEventMonoTime() get_mono_time()
+
+static void change_remote_address(NCR_Instance inst, NTP_Remote_Address *remote_addr,
+                                  int ntp_only);
+static double get_mono_time(void);
+
+#include <ntp_sources.c>
+
+#undef NCR_ChangeRemoteAddress
+
+static void
+resolve_random_address(DNS_Status status, int rand_bits)
+{
+  IPAddr ip_addrs[DNS_MAX_ADDRESSES];
+  int i, n_addrs;
+
+  TEST_CHECK(requested_name);
+  requested_name = NULL;
+
+  if (status == DNS_Success) {
+    n_addrs = random() % DNS_MAX_ADDRESSES + 1;
+    for (i = 0; i < n_addrs; i++)
+      TST_GetRandomAddress(&ip_addrs[i], IPADDR_UNSPEC, rand_bits);
+  } else {
+    n_addrs = 0;
+  }
+
+  (resolve_handler)(status, n_addrs, ip_addrs, resolve_handler_arg);
+}
+
+static int
+update_random_address(NTP_Remote_Address *addr, int rand_bits)
+{
+  NTP_Remote_Address new_addr;
+  NSR_Status status;
+
+  TST_GetRandomAddress(&new_addr.ip_addr, IPADDR_UNSPEC, rand_bits);
+  new_addr.port = random() % 1024;
+
+  status = NSR_UpdateSourceNtpAddress(addr, &new_addr);
+  if (status == NSR_InvalidAF) {
+    TEST_CHECK(!UTI_IsIPReal(&addr->ip_addr));
+  } else {
+    TEST_CHECK(status == NSR_Success || status == NSR_AlreadyInUse);
+  }
+
+  TEST_CHECK(strlen(NSR_StatusToString(status)) > 0);
+
+  return status == NSR_Success;
+}
+
+static void
+change_remote_address(NCR_Instance inst, NTP_Remote_Address *remote_addr, int ntp_only)
+{
+  int update = !ntp_only && random() % 4 == 0, update_pos = random() % 2, r = 0;
+
+  TEST_CHECK(record_lock);
+
+  if (update && update_pos == 0)
+    r = update_random_address(random() % 2 ? remote_addr : NCR_GetRemoteAddress(inst), 4);
+
+  NCR_ChangeRemoteAddress(inst, remote_addr, ntp_only);
+
+  if (update && update_pos == 1)
+    r = update_random_address(random() % 2 ? remote_addr : NCR_GetRemoteAddress(inst), 4);
+
+  if (r)
+    TEST_CHECK(UTI_IsIPReal(&saved_address_update.old_address.ip_addr));
+}
+
+static double get_mono_time(void) {
+  static double t = 0.0;
+
+  if (random() % 2)
+    t += TST_GetRandomDouble(0.0, 100.0);
+
+  return t;
+}
+
+void
+test_unit(void)
+{
+  char source_line[] = "127.0.0.1 offline", conf[] = "port 0", name[64];
+  int i, j, k, slot, found, pool, prev_n;
+  uint32_t hash = 0, conf_id;
+  NTP_Remote_Address addrs[256], addr;
+  NTP_Local_Address local_addr;
+  NTP_Local_Timestamp local_ts;
+  struct UnresolvedSource *us;
+  RPT_ActivityReport report;
+  CPS_NTP_Source source;
+  NSR_Status status;
+  NTP_Packet msg;
+
+  CNF_Initialise(0, 0);
+  CNF_ParseLine(NULL, 1, conf);
+
+  PRV_Initialise();
+  LCL_Initialise();
+  TST_RegisterDummyDrivers();
+  SCH_Initialise();
+  SRC_Initialise();
+  NIO_Initialise();
+  NCR_Initialise();
+  REF_Initialise();
+  NSR_Initialise();
+
+  CPS_ParseNTPSourceAdd(source_line, &source);
+
+  TEST_CHECK(n_sources == 0);
+
+  for (i = 0; i < 6; i++) {
+    TEST_CHECK(ARR_GetSize(records) == 1);
+
+    DEBUG_LOG("collision mod %u", 1U << i);
+
+    for (j = 0; j < sizeof (addrs) / sizeof (addrs[0]); j++) {
+      while (1) {
+        do {
+          TST_GetRandomAddress(&addrs[j].ip_addr, IPADDR_UNSPEC, -1);
+        } while (UTI_IPToHash(&addrs[j].ip_addr) % (1U << i) != hash % (1U << i));
+
+        for (k = 0; k < j; k++)
+          if (UTI_CompareIPs(&addrs[k].ip_addr, &addrs[j].ip_addr, NULL) == 0)
+            break;
+        if (k == j)
+          break;
+      }
+
+      addrs[j].port = random() % 1024;
+
+      if (!j)
+        hash = UTI_IPToHash(&addrs[j].ip_addr);
+
+      DEBUG_LOG("adding source %s hash %"PRIu32, UTI_IPToString(&addrs[j].ip_addr),
+                UTI_IPToHash(&addrs[j].ip_addr) % (1U << i));
+
+      status = NSR_AddSource(&addrs[j], random() % 2 ? NTP_SERVER : NTP_PEER,
+                             &source.params, NULL);
+      TEST_CHECK(status == NSR_Success);
+      TEST_CHECK(n_sources == j + 1);
+
+      TEST_CHECK(strcmp(NSR_GetName(&addrs[j].ip_addr), UTI_IPToString(&addrs[j].ip_addr)) == 0);
+
+      for (k = 0; k <= j; k++) {
+        addr = addrs[k];
+        found = find_slot2(&addr, &slot);
+        TEST_CHECK(found == 2);
+        TEST_CHECK(!UTI_CompareIPs(&get_record(slot)->remote_addr->ip_addr,
+                                   &addr.ip_addr, NULL));
+        addr.port++;
+        found = find_slot2(&addr, &slot);
+        TEST_CHECK(found == 1);
+        TEST_CHECK(!UTI_CompareIPs(&get_record(slot)->remote_addr->ip_addr,
+                                   &addr.ip_addr, NULL));
+      }
+
+      status = NSR_AddSource(&addrs[j], NTP_SERVER, &source.params, &conf_id);
+      TEST_CHECK(status == NSR_AlreadyInUse);
+    }
+
+    for (j = 0; j < sizeof (addrs) / sizeof (addrs[0]); j++) {
+      DEBUG_LOG("removing source %s", UTI_IPToString(&addrs[j].ip_addr));
+      NSR_RemoveSource(&addrs[j].ip_addr);
+
+      for (k = 0; k < sizeof (addrs) / sizeof (addrs[0]); k++) {
+        found = find_slot2(&addrs[k], &slot);
+        TEST_CHECK(found == (k <= j ? 0 : 2));
+      }
+    }
+  }
+
+  TEST_CHECK(n_sources == 0);
+
+  status = NSR_AddSourceByName("a b", 0, 0, 0, &source.params, &conf_id);
+  TEST_CHECK(status == NSR_InvalidName);
+
+  local_addr.ip_addr.family = IPADDR_INET4;
+  local_addr.ip_addr.addr.in4 = 0;
+  local_addr.if_index = -1;
+  local_addr.sock_fd = 0;
+  memset(&local_ts, 0, sizeof (local_ts));
+
+  for (i = 0; i < 500; i++) {
+    for (j = 0; j < 20; j++) {
+      snprintf(name, sizeof (name), "ntp%d.example.net", (int)(random() % 10));
+      pool = random() % 2;
+      prev_n = n_sources;
+
+      DEBUG_LOG("%d/%d adding source %s pool=%d", i, j, name, pool);
+      status = NSR_AddSourceByName(name, 0, pool, random() % 2 ? NTP_SERVER : NTP_PEER,
+                                   &source.params, &conf_id);
+      TEST_CHECK(status == NSR_UnresolvedName);
+
+      TEST_CHECK(n_sources == prev_n + (pool ? source.params.max_sources * 2 : 1));
+      TEST_CHECK(unresolved_sources);
+
+      for (us = unresolved_sources; us->next; us = us->next)
+        ;
+      TEST_CHECK(strcmp(us->name, name) == 0);
+      if (pool) {
+        TEST_CHECK(us->address.ip_addr.family == IPADDR_UNSPEC && us->pool_id >= 0);
+      } else {
+        TEST_CHECK(strcmp(NSR_GetName(&us->address.ip_addr), name) == 0);
+        TEST_CHECK(find_slot2(&us->address, &slot) == 2);
+      }
+
+      if (random() % 2) {
+        if (!resolving_id || random() % 2) {
+          NSR_ResolveSources();
+        } else {
+          SCH_RemoveTimeout(resolving_id);
+          resolve_sources_timeout(NULL);
+          TEST_CHECK(resolving_id == 0);
+          TEST_CHECK(requested_name);
+        }
+
+        TEST_CHECK(!!unresolved_sources == (resolving_id != 0) || requested_name);
+      }
+
+      while (requested_name && random() % 2) {
+        TEST_CHECK(resolving_source);
+        TEST_CHECK(strcmp(requested_name, resolving_source->name) == 0);
+        TEST_CHECK(!record_lock);
+
+        switch (random() % 3) {
+          case 0:
+            resolve_random_address(DNS_Success, 4);
+            break;
+          case 1:
+            resolve_random_address(DNS_TryAgain, 0);
+            break;
+          case 2:
+            resolve_random_address(DNS_Failure, 0);
+            break;
+        }
+      }
+
+      while (random() % 8 > 0) {
+        slot = random() % ARR_GetSize(records);
+        if (!get_record(slot)->remote_addr)
+          continue;
+
+        switch (random() % 5) {
+          case 0:
+            msg.lvm = NTP_LVM(0, NTP_VERSION, random() % 2 ? MODE_CLIENT : MODE_SERVER);
+            NSR_ProcessTx(get_record(slot)->remote_addr, &local_addr,
+                          &local_ts, &msg, 0);
+            break;
+          case 1:
+            msg.lvm = NTP_LVM(0, NTP_VERSION, random() % 2 ? MODE_CLIENT : MODE_SERVER);
+            NSR_ProcessRx(get_record(slot)->remote_addr, &local_addr,
+                          &local_ts, &msg, 0);
+            break;
+          case 2:
+            NSR_HandleBadSource(&get_record(slot)->remote_addr->ip_addr);
+            break;
+          case 3:
+            NSR_SetConnectivity(NULL, &get_record(slot)->remote_addr->ip_addr, SRC_OFFLINE);
+            break;
+          case 4:
+            update_random_address(get_record(slot)->remote_addr, 4);
+            TEST_CHECK(!UTI_IsIPReal(&saved_address_update.old_address.ip_addr));
+            break;
+        }
+
+        TEST_CHECK(!record_lock);
+      }
+
+      NSR_GetActivityReport(&report);
+      TEST_CHECK(report.online == 0);
+      TEST_CHECK(report.offline >= 0);
+      TEST_CHECK(report.burst_online == 0);
+      TEST_CHECK(report.burst_offline == 0);
+      TEST_CHECK(report.unresolved >= 0);
+
+      if (random() % 4 == 0) {
+        NSR_RemoveSourcesById(conf_id);
+        TEST_CHECK(n_sources <= prev_n);
+      } else if (random() % 8 == 0) {
+        NSR_RefreshAddresses();
+        TEST_CHECK(unresolved_sources);
+      }
+    }
+
+    NSR_RemoveAllSources();
+    TEST_CHECK(n_sources == 0);
+
+    for (j = 0; j < ARR_GetSize(pools); j++) {
+      TEST_CHECK(get_pool(j)->sources == 0);
+      TEST_CHECK(get_pool(j)->unresolved_sources == 0);
+      TEST_CHECK(get_pool(j)->confirmed_sources == 0);
+      TEST_CHECK(get_pool(j)->max_sources == 0);
+    }
+
+    while (requested_name) {
+      TEST_CHECK(resolving_source);
+      resolve_random_address(random() % 2 ? DNS_Success : DNS_TryAgain, 4);
+    }
+
+    if (unresolved_sources && resolving_id == 0)
+      NSR_ResolveSources();
+
+    TEST_CHECK(!!unresolved_sources == (resolving_id != 0));
+
+    if (resolving_id) {
+      SCH_RemoveTimeout(resolving_id);
+      resolve_sources_timeout(NULL);
+    }
+
+    TEST_CHECK(resolving_id == 0);
+    TEST_CHECK(!requested_name);
+    TEST_CHECK(!unresolved_sources);
+  }
+
+  NSR_Finalise();
+  REF_Finalise();
+  NCR_Finalise();
+  NIO_Finalise();
+  SRC_Finalise();
+  SCH_Finalise();
+  LCL_Finalise();
+  PRV_Finalise();
+  CNF_Finalise();
+  HSH_Finalise();
+}
+
+#else
+void
+test_unit(void)
+{
+  TEST_REQUIRE(0);
+}
+#endif
diff --git a/test/unit/nts_ke.crt b/test/unit/nts_ke.crt
new file mode 100644
index 0000000..8165287
--- /dev/null
+++ b/test/unit/nts_ke.crt
@@ -0,0 +1,8 @@
+-----BEGIN CERTIFICATE-----
+MIIBDjCBwaADAgECAgEBMAUGAytlcDAPMQ0wCwYDVQQDEwR0ZXN0MCAXDTcwMDEw
+MTAwMDAwMFoYDzIxMDAwMTAyMDAwMDAwWjAPMQ0wCwYDVQQDEwR0ZXN0MCowBQYD
+K2VwAyEA3oh/FZeOxRYvJVLfCDEwGI6Oe23gTgLHx8a87tvwgfyjQDA+MAwGA1Ud
+EwEB/wQCMAAwDwYDVR0PAQH/BAUDAweAADAdBgNVHQ4EFgQUYwAqF9q3jxUk68m1
+cuz8DueOHeMwBQYDK2VwA0EAne0dCRXb0dW8bn2v3RhVTqeTJWXfl74x8MTQMTM7
+/uGTqoYOA0YJffypd+p27pvx2BEoNQWRYM6pqBg55KbwDw==
+-----END CERTIFICATE-----
diff --git a/test/unit/nts_ke.key b/test/unit/nts_ke.key
new file mode 100644
index 0000000..6414c64
--- /dev/null
+++ b/test/unit/nts_ke.key
@@ -0,0 +1,25 @@
+Public Key Info:
+	Public Key Algorithm: EdDSA (Ed25519)
+	Key Security Level: High (256 bits)
+
+curve:	Ed25519
+private key:
+	01:d9:75:42:7c:52:cc:29:9e:90:01:f3:da:26:f6:d7
+	ad:af:a5:2a:82:36:1d:86:c6:57:a7:b4:99:9b:6c:6d
+	
+
+x:
+	de:88:7f:15:97:8e:c5:16:2f:25:52:df:08:31:30:18
+	8e:8e:7b:6d:e0:4e:02:c7:c7:c6:bc:ee:db:f0:81:fc
+	
+
+
+Public Key PIN:
+	pin-sha256:C4LBJP2cRxvLcZ6pjowcOEQhcW3ZPMVTpLgRGsBDeMw=
+Public Key ID:
+	sha256:0b82c124fd9c471bcb719ea98e8c1c384421716dd93cc553a4b8111ac04378cc
+	sha1:63002a17dab78f1524ebc9b572ecfc0ee78e1de3
+
+-----BEGIN PRIVATE KEY-----
+MC4CAQAwBQYDK2VwBCIEIAHZdUJ8UswpnpAB89om9tetr6UqgjYdhsZXp7SZm2xt
+-----END PRIVATE KEY-----
diff --git a/test/unit/nts_ke_client.c b/test/unit/nts_ke_client.c
new file mode 100644
index 0000000..3100d1d
--- /dev/null
+++ b/test/unit/nts_ke_client.c
@@ -0,0 +1,147 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2020
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include "test.h"
+
+#ifdef FEAT_NTS
+
+#include <nts_ke_client.c>
+#include <local.h>
+
+static void
+prepare_response(NKSN_Instance session, int valid)
+{
+  uint16_t data[16];
+  int i, index, length;
+
+  if (valid)
+    index = -1;
+  else
+    index = random() % 10;
+  DEBUG_LOG("index=%d", index);
+
+  NKSN_BeginMessage(session);
+
+  memset(data, 0, sizeof (data));
+  length = 2;
+  assert(sizeof (data[0]) == 2);
+
+  if (index == 0) {
+    data[0] = htons(random() % 100);
+    TEST_CHECK(NKSN_AddRecord(session, 1, random() % 2 ? NKE_RECORD_ERROR : NKE_RECORD_WARNING,
+                              data, length));
+  } else if (index == 1) {
+    TEST_CHECK(NKSN_AddRecord(session, 1, NKE_RECORD_ERROR + 1000, data, length));
+  }
+
+  if (index != 2) {
+    if (index == 3)
+      data[0] = htons(NKE_NEXT_PROTOCOL_NTPV4 + random() % 10 + 1);
+    else
+      data[0] = htons(NKE_NEXT_PROTOCOL_NTPV4);
+    if (index == 4)
+      length = 3 + random() % 10;
+    TEST_CHECK(NKSN_AddRecord(session, 1, NKE_RECORD_NEXT_PROTOCOL, data, length));
+  }
+
+  if (index != 5) {
+    if (index == 6)
+      do {
+        data[0] = htons(random() % 100);
+      } while (SIV_GetKeyLength(ntohs(data[0])) > 0);
+    else
+      data[0] = htons(random() % 2 && SIV_GetKeyLength(AEAD_AES_128_GCM_SIV) > 0 ?
+                                      AEAD_AES_128_GCM_SIV : AEAD_AES_SIV_CMAC_256);
+    if (index == 7)
+      length = 3 + random() % 10;
+    TEST_CHECK(NKSN_AddRecord(session, 1, NKE_RECORD_AEAD_ALGORITHM, data, length));
+  }
+
+  if (random() % 2) {
+    const char server[] = "127.0.0.1";
+    TEST_CHECK(NKSN_AddRecord(session, 1, NKE_RECORD_NTPV4_SERVER_NEGOTIATION,
+                              server, sizeof (server) - 1));
+  }
+
+  if (random() % 2) {
+    data[0] = htons(123);
+    TEST_CHECK(NKSN_AddRecord(session, 1, NKE_RECORD_NTPV4_PORT_NEGOTIATION, data, length));
+  }
+
+  if (random() % 2) {
+    length = random() % (sizeof (data) + 1);
+    TEST_CHECK(NKSN_AddRecord(session, 0, 1000 + random() % 1000, data, length));
+  }
+
+  if (index != 8) {
+    for (i = 0; i < NKE_MAX_COOKIES; i++) {
+      length = (random() % sizeof (data) + 1) / 4 * 4;
+      if (index == 9)
+        length += (length < sizeof (data) ? 1 : -1) * (random() % 3 + 1);
+      TEST_CHECK(NKSN_AddRecord(session, 0, NKE_RECORD_COOKIE, data, length));
+    }
+  }
+
+  TEST_CHECK(NKSN_EndMessage(session));
+}
+
+void
+test_unit(void)
+{
+  NKC_Instance inst;
+  IPSockAddr addr;
+  int i, r, valid;
+
+  char conf[][100] = {
+    "nosystemcert",
+  };
+
+  CNF_Initialise(0, 0);
+  for (i = 0; i < sizeof conf / sizeof conf[0]; i++)
+    CNF_ParseLine(NULL, i + 1, conf[i]);
+
+  LCL_Initialise();
+
+  SCK_GetLoopbackIPAddress(AF_INET, &addr.ip_addr);
+  addr.port = 0;
+
+  inst = NKC_CreateInstance(&addr, "test", 0);
+  TEST_CHECK(inst);
+
+  for (i = 0; i < 10000; i++) {
+    valid = random() % 2;
+    prepare_response(inst->session, valid);
+    r = process_response(inst);
+    TEST_CHECK(r == valid);
+  }
+
+  NKC_DestroyInstance(inst);
+
+  LCL_Finalise();
+  CNF_Finalise();
+}
+#else
+void
+test_unit(void)
+{
+  TEST_REQUIRE(0);
+}
+#endif
diff --git a/test/unit/nts_ke_server.c b/test/unit/nts_ke_server.c
new file mode 100644
index 0000000..3d2f295
--- /dev/null
+++ b/test/unit/nts_ke_server.c
@@ -0,0 +1,235 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2020
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include "test.h"
+
+#ifdef FEAT_NTS
+
+#include <local.h>
+#include <nts_ke_session.h>
+#include <util.h>
+
+#define NKSN_GetKeys get_keys
+
+static int
+get_keys(NKSN_Instance session, SIV_Algorithm siv, NKE_Key *c2s, NKE_Key *s2c)
+{
+  c2s->length = SIV_GetKeyLength(siv);
+  UTI_GetRandomBytes(c2s->key, c2s->length);
+  s2c->length = SIV_GetKeyLength(siv);
+  UTI_GetRandomBytes(s2c->key, s2c->length);
+  return 1;
+}
+
+#include <nts_ke_server.c>
+
+static void
+prepare_request(NKSN_Instance session, int valid)
+{
+  uint16_t data[16];
+  int index, length;
+
+  if (valid)
+    index = -1;
+  else
+    index = random() % 9;
+  DEBUG_LOG("index=%d", index);
+
+  NKSN_BeginMessage(session);
+
+  memset(data, 0, sizeof (data));
+  length = 2;
+  assert(sizeof (data[0]) == 2);
+
+  if (index != 0) {
+    memset(data, NKE_NEXT_PROTOCOL_NTPV4 + 1, sizeof (data));
+    data[0] = htons(NKE_NEXT_PROTOCOL_NTPV4);
+    if (index == 1)
+      length = 0;
+    else if (index == 2)
+      length = 3 + random() % 15 * 2;
+    else
+      length = 2 + random() % 16 * 2;
+    TEST_CHECK(NKSN_AddRecord(session, 1, NKE_RECORD_NEXT_PROTOCOL, data, length));
+  }
+
+  if (index == 3)
+    TEST_CHECK(NKSN_AddRecord(session, 1, NKE_RECORD_NEXT_PROTOCOL, data, length));
+
+  if (index != 4) {
+    data[0] = htons(random() % 2 && SIV_GetKeyLength(AEAD_AES_128_GCM_SIV) > 0 ?
+                    AEAD_AES_128_GCM_SIV : AEAD_AES_SIV_CMAC_256);
+    if (index == 5)
+      length = 0;
+    else if (index == 6)
+      length = 3 + random() % 15 * 2;
+    else
+      length = 2 + random() % 16 * 2;
+    TEST_CHECK(NKSN_AddRecord(session, 1, NKE_RECORD_AEAD_ALGORITHM, data, length));
+  }
+
+  if (index == 7)
+    TEST_CHECK(NKSN_AddRecord(session, 1, NKE_RECORD_AEAD_ALGORITHM, data, length));
+
+  if (index == 8) {
+    length = random() % (sizeof (data) + 1);
+    TEST_CHECK(NKSN_AddRecord(session, 1, 1000 + random() % 1000, data, length));
+  }
+
+  if (random() % 2) {
+    const char server[] = "127.0.0.1";
+    TEST_CHECK(NKSN_AddRecord(session, 0, NKE_RECORD_NTPV4_SERVER_NEGOTIATION,
+                              server, sizeof (server) - 1));
+  }
+
+  if (random() % 2) {
+    data[0] = htons(123);
+    TEST_CHECK(NKSN_AddRecord(session, 0, NKE_RECORD_NTPV4_PORT_NEGOTIATION, data, length));
+  }
+
+  if (random() % 2) {
+    length = random() % (sizeof (data) + 1);
+    TEST_CHECK(NKSN_AddRecord(session, 0, 1000 + random() % 1000, data, length));
+  }
+
+  TEST_CHECK(NKSN_EndMessage(session));
+}
+
+static void
+process_response(NKSN_Instance session, int valid)
+{
+  int records, errors, critical, type, length;
+
+  for (records = errors = 0; ; records++) {
+    if (!NKSN_GetRecord(session, &critical, &type, &length, NULL, 0))
+      break;
+    if (type == NKE_RECORD_ERROR)
+      errors++;
+  }
+
+  if (valid) {
+    TEST_CHECK(records >= 2);
+  } else {
+    TEST_CHECK(records == 1);
+    TEST_CHECK(errors == 1);
+  }
+}
+
+void
+test_unit(void)
+{
+  NKSN_Instance session;
+  NKE_Context context, context2;
+  NKE_Cookie cookie;
+  int i, j, valid, l;
+  uint32_t sum, sum2;
+
+  char conf[][100] = {
+    "ntsdumpdir .",
+    "ntsport 0",
+    "ntsprocesses 0",
+    "ntsserverkey nts_ke.key",
+    "ntsservercert nts_ke.crt",
+  };
+
+  CNF_Initialise(0, 0);
+  for (i = 0; i < sizeof conf / sizeof conf[0]; i++)
+    CNF_ParseLine(NULL, i + 1, conf[i]);
+
+  LCL_Initialise();
+  TST_RegisterDummyDrivers();
+  SCH_Initialise();
+
+  unlink("ntskeys");
+  NKS_PreInitialise(0, 0, 0);
+  NKS_Initialise();
+
+  session = NKSN_CreateInstance(1, NULL, handle_message, NULL);
+
+  for (i = 0; i < 10000; i++) {
+    valid = random() % 2;
+    prepare_request(session, valid);
+    TEST_CHECK(process_request(session));
+    process_response(session, valid);
+  }
+
+
+  for (i = 0; i < 10000; i++) {
+    context.algorithm = AEAD_AES_SIV_CMAC_256;
+    get_keys(session, context.algorithm, &context.c2s, &context.s2c);
+    memset(&cookie, 0, sizeof (cookie));
+    TEST_CHECK(NKS_GenerateCookie(&context, &cookie));
+    TEST_CHECK(NKS_DecodeCookie(&cookie, &context2));
+    TEST_CHECK(context.algorithm == context2.algorithm);
+    TEST_CHECK(context.c2s.length == context2.c2s.length);
+    TEST_CHECK(context.s2c.length == context2.s2c.length);
+    TEST_CHECK(memcmp(context.c2s.key, context2.c2s.key, context.c2s.length) == 0);
+    TEST_CHECK(memcmp(context.s2c.key, context2.s2c.key, context.s2c.length) == 0);
+
+    if (random() % 4) {
+      cookie.cookie[random() % (cookie.length)]++;
+    } else if (random() % 4) {
+      generate_key(current_server_key);
+    } else {
+      l = cookie.length;
+      while (l == cookie.length)
+        cookie.length = random() % (sizeof (cookie.cookie) + 1);
+    }
+    TEST_CHECK(!NKS_DecodeCookie(&cookie, &context2));
+  }
+
+  unlink("ntskeys");
+  save_keys();
+
+  for (i = 0, sum = 0; i < MAX_SERVER_KEYS; i++) {
+    sum += server_keys[i].id;
+    for (j = 0; j < sizeof (server_keys[i].key); j++)
+      sum += server_keys[i].key[j];
+    generate_key(i);
+  }
+
+  load_keys();
+  TEST_CHECK(unlink("ntskeys") == 0);
+
+  for (i = 0, sum2 = 0; i < MAX_SERVER_KEYS; i++) {
+    sum2 += server_keys[i].id;
+    for (j = 0; j < sizeof (server_keys[i].key); j++)
+      sum2 += server_keys[i].key[j];
+  }
+
+  TEST_CHECK(sum == sum2);
+
+  NKSN_DestroyInstance(session);
+
+  NKS_Finalise();
+  TEST_CHECK(unlink("ntskeys") == 0);
+
+  SCH_Finalise();
+  LCL_Finalise();
+  CNF_Finalise();
+}
+#else
+void
+test_unit(void)
+{
+  TEST_REQUIRE(0);
+}
+#endif
diff --git a/test/unit/nts_ke_session.c b/test/unit/nts_ke_session.c
new file mode 100644
index 0000000..d0e72c7
--- /dev/null
+++ b/test/unit/nts_ke_session.c
@@ -0,0 +1,224 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2020
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include "test.h"
+
+#ifdef FEAT_NTS
+
+#include <nts_ke_session.c>
+
+#include <local.h>
+#include <socket.h>
+#include <sched.h>
+
+static NKSN_Instance client, server;
+static unsigned char record[NKE_MAX_MESSAGE_LENGTH];
+static int record_length, critical, type_start, records;
+static int request_received;
+static int response_received;
+
+static void
+send_message(NKSN_Instance inst)
+{
+  int i;
+
+  record_length = random() % (NKE_MAX_MESSAGE_LENGTH - 4 + 1);
+  for (i = 0; i < record_length; i++)
+    record[i] = random() % 256;
+  critical = random() % 2;
+  type_start = random() % 30000 + 1;
+  assert(sizeof (struct RecordHeader) == 4);
+  records = random() % ((NKE_MAX_MESSAGE_LENGTH - 4) / (4 + record_length) + 1);
+
+  DEBUG_LOG("critical=%d type_start=%d records=%d*%d",
+            critical, type_start, records, record_length);
+
+  NKSN_BeginMessage(inst);
+
+  TEST_CHECK(check_message_format(&inst->message, 0));
+  TEST_CHECK(!check_message_format(&inst->message, 1));
+
+  TEST_CHECK(!NKSN_AddRecord(inst, 0, 1, record, NKE_MAX_MESSAGE_LENGTH - 4 + 1));
+
+  TEST_CHECK(check_message_format(&inst->message, 0));
+  TEST_CHECK(!check_message_format(&inst->message, 1));
+
+  for (i = 0; i < records; i++) {
+    TEST_CHECK(NKSN_AddRecord(inst, critical, type_start + i, record, record_length));
+    TEST_CHECK(!NKSN_AddRecord(inst, 0, 1, &record,
+                               NKE_MAX_MESSAGE_LENGTH - inst->message.length - 4 + 1));
+
+    TEST_CHECK(check_message_format(&inst->message, 0));
+    TEST_CHECK(!check_message_format(&inst->message, 1));
+  }
+
+  TEST_CHECK(NKSN_EndMessage(inst));
+
+  TEST_CHECK(check_message_format(&inst->message, 0));
+  TEST_CHECK(check_message_format(&inst->message, 1));
+}
+
+static void
+verify_message(NKSN_Instance inst)
+{
+  unsigned char buffer[NKE_MAX_MESSAGE_LENGTH];
+  int i, c, t, length, buffer_length, msg_length, prev_parsed;
+  NKE_Key c2s, s2c;
+
+  for (i = 0; i < records; i++) {
+    memset(buffer, 0, sizeof (buffer));
+    buffer_length = random() % (record_length + 1);
+    assert(buffer_length <= sizeof (buffer));
+
+    prev_parsed = inst->message.parsed;
+    msg_length = inst->message.length;
+
+    TEST_CHECK(NKSN_GetRecord(inst, &c, &t, &length, buffer, buffer_length));
+    TEST_CHECK(c == critical);
+    TEST_CHECK(t == type_start + i);
+    TEST_CHECK(length == record_length);
+    TEST_CHECK(memcmp(record, buffer, buffer_length) == 0);
+    if (buffer_length < record_length)
+      TEST_CHECK(buffer[buffer_length] == 0);
+
+    inst->message.length = inst->message.parsed - 1;
+    inst->message.parsed = prev_parsed;
+    TEST_CHECK(!get_record(&inst->message, NULL, NULL, NULL, buffer, buffer_length));
+    TEST_CHECK(inst->message.parsed == prev_parsed);
+    inst->message.length = msg_length;
+    if (msg_length < 0x8000) {
+      inst->message.data[prev_parsed + 2] ^= 0x80;
+      TEST_CHECK(!get_record(&inst->message, NULL, NULL, NULL, buffer, buffer_length));
+      TEST_CHECK(inst->message.parsed == prev_parsed);
+      inst->message.data[prev_parsed + 2] ^= 0x80;
+    }
+    TEST_CHECK(get_record(&inst->message, NULL, NULL, NULL, buffer, buffer_length));
+    TEST_CHECK(inst->message.parsed > prev_parsed);
+  }
+
+  TEST_CHECK(!NKSN_GetRecord(inst, &critical, &t, &length, buffer, sizeof (buffer)));
+
+  TEST_CHECK(NKSN_GetKeys(inst, AEAD_AES_SIV_CMAC_256, &c2s, &s2c));
+  TEST_CHECK(c2s.length == SIV_GetKeyLength(AEAD_AES_SIV_CMAC_256));
+  TEST_CHECK(s2c.length == SIV_GetKeyLength(AEAD_AES_SIV_CMAC_256));
+}
+
+static int
+handle_request(void *arg)
+{
+  NKSN_Instance server = arg;
+
+  verify_message(server);
+
+  request_received = 1;
+
+  send_message(server);
+
+  return 1;
+}
+
+static int
+handle_response(void *arg)
+{
+  NKSN_Instance client = arg;
+
+  response_received = 1;
+
+  verify_message(client);
+
+  return 1;
+}
+
+static void
+check_finished(void *arg)
+{
+  DEBUG_LOG("checking for stopped sessions");
+  if (!NKSN_IsStopped(server) || !NKSN_IsStopped(client)) {
+    SCH_AddTimeoutByDelay(0.001, check_finished, NULL);
+    return;
+  }
+
+  SCH_QuitProgram();
+}
+
+void
+test_unit(void)
+{
+  NKSN_Credentials client_cred, server_cred;
+  const char *cert, *key;
+  int sock_fds[2], i;
+  uint32_t cert_id;
+
+  LCL_Initialise();
+  TST_RegisterDummyDrivers();
+
+  cert = "nts_ke.crt";
+  key = "nts_ke.key";
+  cert_id = 0;
+
+  for (i = 0; i < 50; i++) {
+    SCH_Initialise();
+
+    server = NKSN_CreateInstance(1, NULL, handle_request, NULL);
+    client = NKSN_CreateInstance(0, "test", handle_response, NULL);
+
+    server_cred = NKSN_CreateServerCertCredentials(&cert, &key, 1);
+    client_cred = NKSN_CreateClientCertCredentials(&cert, &cert_id, 1, 0);
+
+    TEST_CHECK(socketpair(AF_UNIX, SOCK_STREAM, 0, sock_fds) == 0);
+    TEST_CHECK(fcntl(sock_fds[0], F_SETFL, O_NONBLOCK) == 0);
+    TEST_CHECK(fcntl(sock_fds[1], F_SETFL, O_NONBLOCK) == 0);
+
+    TEST_CHECK(NKSN_StartSession(server, sock_fds[0], "client", server_cred, 4.0));
+    TEST_CHECK(NKSN_StartSession(client, sock_fds[1], "server", client_cred, 4.0));
+
+    send_message(client);
+
+    request_received = response_received = 0;
+
+    check_finished(NULL);
+
+    SCH_MainLoop();
+
+    TEST_CHECK(NKSN_IsStopped(server));
+    TEST_CHECK(NKSN_IsStopped(client));
+
+    TEST_CHECK(request_received);
+    TEST_CHECK(response_received);
+
+    NKSN_DestroyInstance(server);
+    NKSN_DestroyInstance(client);
+
+    NKSN_DestroyCertCredentials(server_cred);
+    NKSN_DestroyCertCredentials(client_cred);
+
+    SCH_Finalise();
+  }
+
+  LCL_Finalise();
+}
+#else
+void
+test_unit(void)
+{
+  TEST_REQUIRE(0);
+}
+#endif
diff --git a/test/unit/nts_ntp_auth.c b/test/unit/nts_ntp_auth.c
new file mode 100644
index 0000000..c3a7432
--- /dev/null
+++ b/test/unit/nts_ntp_auth.c
@@ -0,0 +1,135 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2020
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include "test.h"
+
+#ifdef FEAT_NTS
+
+#include <nts_ntp_auth.c>
+
+#include "ntp_ext.h"
+#include "siv.h"
+
+void
+test_unit(void)
+{
+  unsigned char key[SIV_MAX_KEY_LENGTH], nonce[256], plaintext[256], plaintext2[256];
+  NTP_PacketInfo info;
+  NTP_Packet packet;
+  SIV_Algorithm algo;
+  SIV_Instance siv;
+  int i, j, r, packet_length, nonce_length, key_length;
+  int plaintext_length, plaintext2_length, min_ef_length;
+
+  for (algo = 1; algo < 100; algo++) {
+    siv = SIV_CreateInstance(algo);
+    if (!siv) {
+      TEST_CHECK(algo != AEAD_AES_SIV_CMAC_256);
+      continue;
+    }
+
+    DEBUG_LOG("algo=%d", (int)algo);
+
+    for (i = 0; i < 10000; i++) {
+      key_length = SIV_GetKeyLength(algo);
+      for (j = 0; j < key_length; j++)
+        key[j] = random() % 256;
+      TEST_CHECK(SIV_SetKey(siv, key, key_length));
+
+      assert(sizeof (nonce) >= SIV_GetMinNonceLength(siv));
+      nonce_length = SIV_GetMinNonceLength(siv) +
+                     random() % (MIN(sizeof (nonce), SIV_GetMaxNonceLength(siv)) -
+                                 SIV_GetMinNonceLength(siv) + 1);
+      for (j = 0; j < nonce_length; j++)
+        nonce[j] = random() % 256;
+
+      plaintext_length = random() % (sizeof (plaintext) + 1);
+      for (j = 0; j < plaintext_length; j++)
+        plaintext[j] = random() % 256;
+
+      packet_length = NTP_HEADER_LENGTH + random() % 100 * 4;
+      min_ef_length = random() % (sizeof (packet) - packet_length);
+
+      memset(&packet, 0, sizeof (packet));
+      packet.lvm = NTP_LVM(0, 4, 0);
+      memset(&info, 0, sizeof (info));
+      info.version = 4;
+      info.length = packet_length;
+
+      DEBUG_LOG("packet_length=%d nonce_length=%d plaintext_length=%d min_ef_length=%d",
+                packet_length, nonce_length, plaintext_length, min_ef_length);
+
+      r = NNA_GenerateAuthEF(&packet, &info, siv, nonce, nonce_length, plaintext,
+                             -1, 0);
+      TEST_CHECK(!r);
+      r = NNA_GenerateAuthEF(&packet, &info, siv, nonce, 0, plaintext,
+                             plaintext_length, 0);
+      TEST_CHECK(!r);
+      if (SIV_GetMinNonceLength(siv) > 1) {
+        r = NNA_GenerateAuthEF(&packet, &info, siv, nonce, SIV_GetMinNonceLength(siv) - 1,
+                               plaintext, plaintext_length, 0);
+        TEST_CHECK(!r);
+        TEST_CHECK(info.ext_fields == 0);
+      }
+      if (SIV_GetMaxNonceLength(siv) <= sizeof (nonce)) {
+        r = NNA_GenerateAuthEF(&packet, &info, siv, nonce, SIV_GetMaxNonceLength(siv) - 1,
+                               plaintext, plaintext_length, 0);
+        TEST_CHECK(!r);
+        TEST_CHECK(info.ext_fields == 0);
+      }
+      r = NNA_GenerateAuthEF(&packet, &info, siv, nonce, nonce_length, plaintext,
+                             plaintext_length, sizeof (packet) - info.length + 1);
+      TEST_CHECK(!r);
+
+      r = NNA_GenerateAuthEF(&packet, &info, siv, nonce, nonce_length, plaintext,
+                             plaintext_length, min_ef_length);
+      TEST_CHECK(r);
+      TEST_CHECK(info.length - packet_length >= min_ef_length);
+
+      r = NNA_DecryptAuthEF(&packet, &info, siv, packet_length, plaintext2,
+                            -1, &plaintext2_length);
+      TEST_CHECK(!r);
+
+      r = NNA_DecryptAuthEF(&packet, &info, siv, packet_length, plaintext2,
+                            sizeof (plaintext2), &plaintext2_length);
+      TEST_CHECK(r);
+      TEST_CHECK(plaintext_length == plaintext2_length);
+      TEST_CHECK(memcmp(plaintext, plaintext2, plaintext_length) == 0);
+
+      j = random() % (packet_length + plaintext_length +
+                      nonce_length + SIV_GetTagLength(siv) + 8) / 4 * 4;
+      ((unsigned char *)&packet)[j]++;
+      r = NNA_DecryptAuthEF(&packet, &info, siv, packet_length, plaintext2,
+                            sizeof (plaintext2), &plaintext2_length);
+      TEST_CHECK(!r);
+      ((unsigned char *)&packet)[j]--;
+    }
+
+    SIV_DestroyInstance(siv);
+  }
+}
+#else
+void
+test_unit(void)
+{
+  TEST_REQUIRE(0);
+}
+#endif
diff --git a/test/unit/nts_ntp_client.c b/test/unit/nts_ntp_client.c
new file mode 100644
index 0000000..7953413
--- /dev/null
+++ b/test/unit/nts_ntp_client.c
@@ -0,0 +1,302 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2020
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include "test.h"
+
+#ifdef FEAT_NTS
+
+#include "socket.h"
+#include "ntp.h"
+#include "nts_ke_client.h"
+
+#define NKC_CreateInstance(address, name, cert_set) Malloc(1)
+#define NKC_DestroyInstance(inst) Free(inst)
+#define NKC_Start(inst) (random() % 2)
+#define NKC_IsActive(inst) (random() % 2)
+#define NKC_GetRetryFactor(inst) (1)
+
+static int get_nts_data(NKC_Instance inst, NKE_Context *context,
+                        NKE_Cookie *cookies, int *num_cookies, int max_cookies,
+                        IPSockAddr *ntp_address);
+#define NKC_GetNtsData get_nts_data
+
+#include <nts_ntp_client.c>
+
+static int
+get_nts_data(NKC_Instance inst, NKE_Context *context,
+             NKE_Cookie *cookies, int *num_cookies, int max_cookies,
+             IPSockAddr *ntp_address)
+{
+  int i;
+
+  if (random() % 2)
+    return 0;
+
+  do {
+    context->algorithm = AEAD_AES_SIV_CMAC_256 + random() %
+                         (AEAD_AES_256_GCM_SIV - AEAD_AES_SIV_CMAC_256 + 10);
+  } while (SIV_GetKeyLength(context->algorithm) <= 0);
+
+  context->c2s.length = SIV_GetKeyLength(context->algorithm);
+  UTI_GetRandomBytes(context->c2s.key, context->c2s.length);
+  context->s2c.length = SIV_GetKeyLength(context->algorithm);
+  UTI_GetRandomBytes(context->s2c.key, context->s2c.length);
+
+  *num_cookies = random() % max_cookies + 1;
+  for (i = 0; i < *num_cookies; i++) {
+    cookies[i].length = random() % (sizeof (cookies[i].cookie) + 1);
+    if (random() % 4 != 0)
+      cookies[i].length = cookies[i].length / 4 * 4;
+    memset(cookies[i].cookie, random(), cookies[i].length);
+  }
+
+  ntp_address->ip_addr.family = IPADDR_UNSPEC;
+  ntp_address->port = 0;
+
+  return 1;
+}
+
+static int
+get_request(NNC_Instance inst)
+{
+  unsigned char nonce[NTS_MIN_UNPADDED_NONCE_LENGTH], uniq_id[NTS_MIN_UNIQ_ID_LENGTH];
+  int nonce_length, expected_length, req_cookies;
+  NTP_PacketInfo info;
+  NTP_Packet packet;
+
+  memset(&packet, 0, sizeof (packet));
+  memset(&info, 0, sizeof (info));
+  info.version = 4;
+  info.mode = MODE_CLIENT;
+  info.length = random() % (sizeof (packet) + 1);
+  if (random() % 4 != 0)
+    info.length = info.length / 4 * 4;
+
+  if (inst->num_cookies > 0 && random() % 2) {
+    inst->num_cookies = 0;
+
+    TEST_CHECK(!NNC_GenerateRequestAuth(inst, &packet, &info));
+  }
+
+  while (!NNC_PrepareForAuth(inst)) {
+    inst->next_nke_attempt = SCH_GetLastEventMonoTime() + random() % 10 - 7;
+  }
+
+  TEST_CHECK(inst->num_cookies > 0);
+  TEST_CHECK(inst->siv);
+
+  switch (inst->context.algorithm) {
+    case AEAD_AES_SIV_CMAC_256:
+      nonce_length = 16;
+      break;
+    case AEAD_AES_128_GCM_SIV:
+      nonce_length = 12;
+      break;
+    default:
+      assert(0);
+  }
+
+  memcpy(nonce, inst->nonce, sizeof (nonce));
+  memcpy(uniq_id, inst->uniq_id, sizeof (uniq_id));
+  TEST_CHECK(NNC_PrepareForAuth(inst));
+  TEST_CHECK(memcmp(nonce, inst->nonce, sizeof (nonce)) != 0);
+  TEST_CHECK(memcmp(uniq_id, inst->uniq_id, sizeof (uniq_id)) != 0);
+
+  req_cookies = MIN(NTS_MAX_COOKIES - inst->num_cookies + 1,
+                    MAX_TOTAL_COOKIE_LENGTH /
+                      (inst->cookies[inst->cookie_index].length + 4));
+  expected_length = info.length + 4 + sizeof (inst->uniq_id) +
+                    req_cookies * (4 + inst->cookies[inst->cookie_index].length) +
+                    4 + 4 + nonce_length + SIV_GetTagLength(inst->siv);
+  DEBUG_LOG("algo=%d length=%d cookie_length=%d expected_length=%d",
+            (int)inst->context.algorithm, info.length,
+            inst->cookies[inst->cookie_index].length, expected_length);
+
+  if (info.length % 4 == 0 && info.length >= NTP_HEADER_LENGTH &&
+      inst->cookies[inst->cookie_index].length % 4 == 0 &&
+      inst->cookies[inst->cookie_index].length >= (NTP_MIN_EF_LENGTH - 4) &&
+      expected_length <= sizeof (packet)) {
+    TEST_CHECK(NNC_GenerateRequestAuth(inst, &packet, &info));
+    TEST_CHECK(info.length == expected_length);
+    return 1;
+  } else {
+    TEST_CHECK(!NNC_GenerateRequestAuth(inst, &packet, &info));
+    return 0;
+  }
+}
+
+static void
+prepare_response(NNC_Instance inst, NTP_Packet *packet, NTP_PacketInfo *info, int valid, int nak)
+{
+  unsigned char cookie[508], plaintext[528], nonce[448];
+  int nonce_length, ef_length, cookie_length, plaintext_length, min_auth_length;
+  int i, index, auth_start;
+  SIV_Instance siv;
+
+  memset(packet, 0, sizeof (*packet));
+  packet->lvm = NTP_LVM(0, 4, MODE_SERVER);
+  memset(info, 0, sizeof (*info));
+  info->version = 4;
+  info->mode = MODE_SERVER;
+  info->length = NTP_HEADER_LENGTH;
+
+  if (valid)
+    index = -1;
+  else
+    index = random() % (nak ? 2 : 8);
+
+  DEBUG_LOG("index=%d nak=%d", index, nak);
+
+  if (index != 0)
+    TEST_CHECK(NEF_AddField(packet, info, NTP_EF_NTS_UNIQUE_IDENTIFIER, inst->uniq_id,
+                            sizeof (inst->uniq_id)));
+  if (index == 1)
+    ((unsigned char *)packet)[NTP_HEADER_LENGTH + 4]++;
+
+  if (nak) {
+    packet->stratum = NTP_INVALID_STRATUM;
+    packet->reference_id = htonl(NTP_KOD_NTS_NAK);
+    return;
+  }
+
+  nonce_length = SIV_GetMinNonceLength(inst->siv) + random() %
+                 (MIN(SIV_GetMaxNonceLength(inst->siv), sizeof (nonce)) -
+                  SIV_GetMinNonceLength(inst->siv) + 1);
+  assert(nonce_length >= 1 && nonce_length <= sizeof (nonce));
+
+  do {
+    cookie_length = random() % (sizeof (cookie) + 1);
+  } while (cookie_length % 4 != 0 ||
+           ((index != 2) == (cookie_length < NTP_MIN_EF_LENGTH - 4 ||
+                             cookie_length > NKE_MAX_COOKIE_LENGTH)));
+
+  min_auth_length = random() % (512 + 1);
+
+  DEBUG_LOG("nonce_length=%d cookie_length=%d min_auth_length=%d",
+            nonce_length, cookie_length, min_auth_length);
+
+  UTI_GetRandomBytes(nonce, nonce_length);
+  UTI_GetRandomBytes(cookie, cookie_length);
+
+  if (cookie_length >= 12 && cookie_length <= 32 && random() % 2 == 0)
+    TEST_CHECK(NEF_AddField(packet, info, NTP_EF_NTS_COOKIE, cookie, cookie_length));
+
+  plaintext_length = 0;
+  if (index != 3) {
+    for (i = random() % ((sizeof (plaintext) - 16) / (cookie_length + 4)); i >= 0; i--) {
+      TEST_CHECK(NEF_SetField(plaintext, sizeof (plaintext), plaintext_length,
+                              NTP_EF_NTS_COOKIE, cookie,
+                              i == 0 ? cookie_length : random() % (cookie_length + 1) / 4 * 4,
+                              &ef_length));
+      plaintext_length += ef_length;
+    }
+  }
+  auth_start = info->length;
+  if (index != 4) {
+    if (index == 5) {
+      assert(plaintext_length + 16 <= sizeof (plaintext));
+      memset(plaintext + plaintext_length, 0, 16);
+      plaintext_length += 16;
+    }
+    siv = SIV_CreateInstance(inst->context.algorithm);
+    TEST_CHECK(siv);
+    TEST_CHECK(SIV_SetKey(siv, inst->context.s2c.key, inst->context.s2c.length));
+    TEST_CHECK(NNA_GenerateAuthEF(packet, info, siv,
+                                  nonce, nonce_length, plaintext, plaintext_length,
+                                  min_auth_length));
+    SIV_DestroyInstance(siv);
+  }
+  if (index == 6)
+    ((unsigned char *)packet)[auth_start + 8]++;
+  if (index == 7)
+    TEST_CHECK(NEF_AddField(packet, info, 0x7000, inst->uniq_id, sizeof (inst->uniq_id)));
+}
+
+void
+test_unit(void)
+{
+  NNC_Instance inst;
+  NTP_PacketInfo info;
+  NTP_Packet packet;
+  IPSockAddr addr;
+  IPAddr ip_addr;
+  int i, j, prev_num_cookies, valid;
+
+  TEST_CHECK(SIV_GetKeyLength(AEAD_AES_SIV_CMAC_256) > 0);
+
+  SCK_GetLoopbackIPAddress(AF_INET, &addr.ip_addr);
+  addr.port = 0;
+
+  inst = NNC_CreateInstance(&addr, "test", 0, 0);
+  TEST_CHECK(inst);
+
+  for (i = 0; i < 100000; i++) {
+    if (!get_request(inst))
+      continue;
+
+    valid = random() % 2;
+
+    TEST_CHECK(!inst->nak_response);
+    TEST_CHECK(!inst->ok_response);
+
+    if (random() % 2) {
+      prepare_response(inst, &packet, &info, 0, 1);
+      TEST_CHECK(!NNC_CheckResponseAuth(inst, &packet, &info));
+      TEST_CHECK(!inst->nak_response);
+      TEST_CHECK(!inst->ok_response);
+      for (j = random() % 3; j > 0; j--) {
+        prepare_response(inst, &packet, &info, 1, 1);
+        TEST_CHECK(!NNC_CheckResponseAuth(inst, &packet, &info));
+        TEST_CHECK(inst->nak_response);
+        TEST_CHECK(!inst->ok_response);
+      }
+    }
+
+    prev_num_cookies = inst->num_cookies;
+    prepare_response(inst, &packet, &info, valid, 0);
+
+    if (valid) {
+      TEST_CHECK(NNC_CheckResponseAuth(inst, &packet, &info));
+      TEST_CHECK(inst->num_cookies >= MIN(NTS_MAX_COOKIES, prev_num_cookies + 1));
+      TEST_CHECK(inst->ok_response);
+    }
+
+    prev_num_cookies = inst->num_cookies;
+    TEST_CHECK(!NNC_CheckResponseAuth(inst, &packet, &info));
+    TEST_CHECK(inst->num_cookies == prev_num_cookies);
+    TEST_CHECK(inst->ok_response == valid);
+
+    if (random() % 10 == 0) {
+      TST_GetRandomAddress(&ip_addr, IPADDR_INET4, 32);
+      NNC_ChangeAddress(inst, &ip_addr);
+      TEST_CHECK(UTI_CompareIPs(&inst->nts_address.ip_addr, &ip_addr, NULL) == 0);
+    }
+  }
+
+  NNC_DestroyInstance(inst);
+}
+#else
+void
+test_unit(void)
+{
+  TEST_REQUIRE(0);
+}
+#endif
diff --git a/test/unit/nts_ntp_server.c b/test/unit/nts_ntp_server.c
new file mode 100644
index 0000000..2777942
--- /dev/null
+++ b/test/unit/nts_ntp_server.c
@@ -0,0 +1,180 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2020
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include "test.h"
+
+#ifdef FEAT_NTS
+
+#include <local.h>
+#include <sched.h>
+
+#include <nts_ntp_server.c>
+
+static void
+prepare_request(NTP_Packet *packet, NTP_PacketInfo *info, int valid, int nak)
+{
+  unsigned char uniq_id[NTS_MIN_UNIQ_ID_LENGTH], nonce[NTS_MIN_UNPADDED_NONCE_LENGTH];
+  SIV_Instance siv;
+  NKE_Context context;
+  NKE_Cookie cookie;
+  int i, index, cookie_start, auth_start;
+
+  context.algorithm = random() % 2 && SIV_GetKeyLength(AEAD_AES_128_GCM_SIV) > 0 ?
+                      AEAD_AES_128_GCM_SIV : AEAD_AES_SIV_CMAC_256;
+  context.c2s.length = SIV_GetKeyLength(context.algorithm);
+  assert(context.c2s.length <= sizeof (context.c2s.key));
+  UTI_GetRandomBytes(&context.c2s.key, context.c2s.length);
+  context.s2c.length = SIV_GetKeyLength(context.algorithm);
+  assert(context.s2c.length <= sizeof (context.s2c.key));
+  UTI_GetRandomBytes(&context.s2c.key, context.s2c.length);
+
+  TEST_CHECK(NKS_GenerateCookie(&context, &cookie));
+
+  UTI_GetRandomBytes(uniq_id, sizeof (uniq_id));
+  UTI_GetRandomBytes(nonce, sizeof (nonce));
+
+  memset(packet, 0, sizeof (*packet));
+  packet->lvm = NTP_LVM(0, 4, MODE_CLIENT);
+  memset(info, 0, sizeof (*info));
+  info->version = 4;
+  info->mode = MODE_CLIENT;
+  info->length = NTP_HEADER_LENGTH;
+
+  if (valid)
+    index = -1;
+  else
+    index = random() % 3;
+
+  DEBUG_LOG("valid=%d nak=%d index=%d", valid, nak, index);
+
+  if (index != 0)
+    TEST_CHECK(NEF_AddField(packet, info, NTP_EF_NTS_UNIQUE_IDENTIFIER,
+                            uniq_id, sizeof (uniq_id)));
+
+  cookie_start = info->length;
+
+  if (index != 1)
+    TEST_CHECK(NEF_AddField(packet, info, NTP_EF_NTS_COOKIE,
+                            cookie.cookie, cookie.length));
+
+  for (i = random() % 4; i > 0; i--)
+    TEST_CHECK(NEF_AddField(packet, info, NTP_EF_NTS_COOKIE_PLACEHOLDER,
+                            cookie.cookie, cookie.length));
+
+  auth_start = info->length;
+
+  if (index != 2) {
+    siv = SIV_CreateInstance(context.algorithm);
+    TEST_CHECK(siv);
+    TEST_CHECK(SIV_SetKey(siv, context.c2s.key, context.c2s.length));
+    TEST_CHECK(NNA_GenerateAuthEF(packet, info, siv, nonce, sizeof (nonce),
+                                  (const unsigned char *)"", 0, 0));
+    SIV_DestroyInstance(siv);
+  }
+
+  if (nak)
+    ((unsigned char *)packet)[(index == 2 ? cookie_start :
+                               (index == 1 ? auth_start :
+                                (random() % 2 ? cookie_start : auth_start))) +
+                              4 + random() % 16]++;
+}
+
+static void
+init_response(NTP_Packet *packet, NTP_PacketInfo *info)
+{
+  memset(packet, 0, sizeof (*packet));
+  packet->lvm = NTP_LVM(0, 4, MODE_SERVER);
+  memset(info, 0, sizeof (*info));
+  info->version = 4;
+  info->mode = MODE_SERVER;
+  info->length = NTP_HEADER_LENGTH;
+}
+
+void
+test_unit(void)
+{
+  NTP_PacketInfo req_info, res_info;
+  NTP_Packet request, response;
+  int i, valid, nak;
+  uint32_t kod;
+
+  char conf[][100] = {
+    "ntsport 0",
+    "ntsprocesses 0",
+    "ntsserverkey nts_ke.key",
+    "ntsservercert nts_ke.crt",
+  };
+
+  CNF_Initialise(0, 0);
+  for (i = 0; i < sizeof conf / sizeof conf[0]; i++)
+    CNF_ParseLine(NULL, i + 1, conf[i]);
+
+  LCL_Initialise();
+  TST_RegisterDummyDrivers();
+  SCH_Initialise();
+  NKS_PreInitialise(0, 0, 0);
+  NKS_Initialise();
+  NNS_Initialise();
+
+  for (i = 0; i < 50000; i++) {
+    valid = random() % 2;
+    nak = random() % 2;
+    prepare_request(&request, &req_info, valid, nak);
+
+    TEST_CHECK(NNS_CheckRequestAuth(&request, &req_info, &kod) == (valid && !nak));
+
+    if (valid && !nak) {
+      TEST_CHECK(kod == 0);
+      TEST_CHECK(server->num_cookies > 0);
+
+      init_response(&response, &res_info);
+      TEST_CHECK(NNS_GenerateResponseAuth(&request, &req_info, &response, &res_info, kod));
+
+      TEST_CHECK(res_info.ext_fields == 2);
+      TEST_CHECK(server->num_cookies == 0);
+    } else if (valid && nak) {
+      TEST_CHECK(kod == NTP_KOD_NTS_NAK);
+      TEST_CHECK(server->num_cookies == 0);
+
+      init_response(&response, &res_info);
+      TEST_CHECK(NNS_GenerateResponseAuth(&request, &req_info, &response, &res_info, kod));
+
+      TEST_CHECK(res_info.ext_fields == 1);
+      TEST_CHECK(server->num_cookies == 0);
+    } else {
+      TEST_CHECK(kod == 0);
+      TEST_CHECK(server->num_cookies == 0);
+    }
+  }
+
+  NNS_Finalise();
+  NKS_Finalise();
+  SCH_Finalise();
+  LCL_Finalise();
+  CNF_Finalise();
+}
+#else
+void
+test_unit(void)
+{
+  TEST_REQUIRE(0);
+}
+#endif
diff --git a/test/unit/quantiles.c b/test/unit/quantiles.c
new file mode 100644
index 0000000..5d97df6
--- /dev/null
+++ b/test/unit/quantiles.c
@@ -0,0 +1,68 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2022
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ *
+ **********************************************************************
+ */
+
+#include <local.h>
+#include "test.h"
+
+#include <quantiles.c>
+
+void
+test_unit(void)
+{
+  int i, j, k, min_k, max_k, q, r, in_order, out_order;
+  QNT_Instance inst;
+  double x;
+
+  in_order = out_order = 0;
+
+  for (i = 0; i < 100; i++) {
+    r = random() % 10 + 1;
+    q = random() % 20 + 2;
+    do {
+      min_k = random() % (q - 1) + 1;
+      max_k = random() % (q - 1) + 1;
+    } while (min_k > max_k);
+
+    inst = QNT_CreateInstance(min_k, max_k, q, r, 1e-9);
+
+    TEST_CHECK(min_k == QNT_GetMinK(inst));
+
+    for (j = 0; j < 3000; j++) {
+      x = TST_GetRandomDouble(0.0, 2e-6);
+      QNT_Accumulate(inst, x);
+      for (k = min_k; k < max_k; k++)
+        if (j < max_k - min_k) {
+          TEST_CHECK(QNT_GetQuantile(inst, k) <= QNT_GetQuantile(inst, k + 1));
+        } else if (j > 1000) {
+          if (QNT_GetQuantile(inst, k) <= QNT_GetQuantile(inst, k + 1))
+            in_order++;
+          else
+            out_order++;
+        }
+    }
+
+    QNT_Reset(inst);
+    TEST_CHECK(inst->n_set == 0);
+
+    QNT_DestroyInstance(inst);
+  }
+
+  TEST_CHECK(in_order > 100 * out_order);
+}
diff --git a/test/unit/regress.c b/test/unit/regress.c
new file mode 100644
index 0000000..f47d1c4
--- /dev/null
+++ b/test/unit/regress.c
@@ -0,0 +1,119 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2017
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+#include <regress.c>
+#include "test.h"
+
+#define POINTS 64
+
+void
+test_unit(void)
+{
+  double x[POINTS], x2[POINTS], y[POINTS], w[POINTS];
+  double b0, b1, b2, s2, sb0, sb1, slope, slope2, intercept, sd, median;
+  double xrange, yrange, wrange, x2range;
+  int i, j, n, m, c1, c2, c3, runs, best_start, dof;
+
+  for (n = 3; n <= POINTS; n++) {
+    for (i = 0; i < 200; i++) {
+      slope = TST_GetRandomDouble(-0.1, 0.1);
+      intercept = TST_GetRandomDouble(-1.0, 1.0);
+      sd = TST_GetRandomDouble(1e-6, 1e-4);
+      slope2 = (random() % 2 ? 1 : -1) * TST_GetRandomDouble(0.1, 0.5);
+
+      DEBUG_LOG("iteration %d n=%d intercept=%e slope=%e sd=%e",
+                i, n, intercept, slope, sd);
+
+      for (j = 0; j < n; j++) {
+        x[j] = -j;
+        y[j] = intercept + slope * x[j] + (j % 2 ? 1 : -1) * TST_GetRandomDouble(1e-6, sd);
+        w[j] = TST_GetRandomDouble(1.0, 2.0);
+        x2[j] = (y[j] - intercept - slope * x[j]) / slope2;
+      }
+
+      RGR_WeightedRegression(x, y, w, n, &b0, &b1, &s2, &sb0, &sb1);
+      DEBUG_LOG("WR b0=%e b1=%e s2=%e sb0=%e sb1=%e", b0, b1, s2, sb0, sb1);
+      TEST_CHECK(fabs(b0 - intercept) < sd + 1e-3);
+      TEST_CHECK(fabs(b1 - slope) < sd);
+
+      if (RGR_FindBestRegression(x, y, w, n, 0, 3, &b0, &b1, &s2, &sb0, &sb1,
+                                 &best_start, &runs, &dof)) {
+        DEBUG_LOG("BR b0=%e b1=%e s2=%e sb0=%e sb1=%e runs=%d bs=%d dof=%d",
+                  b0, b1, s2, sb0, sb1, runs, best_start, dof);
+
+        TEST_CHECK(fabs(b0 - intercept) < sd + 1e-3);
+        TEST_CHECK(fabs(b1 - slope) < sd);
+      }
+
+      if (RGR_MultipleRegress(x, x2, y, n, &b2)) {
+        DEBUG_LOG("MR b2=%e", b2);
+        TEST_CHECK(fabs(b2 - slope2) < 1e-6);
+      }
+
+      for (j = 0; j < n / 7; j++)
+        y[random() % n] += 100 * sd;
+
+      if (RGR_FindBestRobustRegression(x, y, n, 1e-8, &b0, &b1, &runs, &best_start)) {
+        DEBUG_LOG("BRR b0=%e b1=%e runs=%d bs=%d", b0, b1, runs, best_start);
+
+        TEST_CHECK(fabs(b0 - intercept) < sd + 1e-2);
+        TEST_CHECK(fabs(b1 - slope) < 5.0 * sd);
+      }
+
+      for (j = 0; j < n; j++)
+        x[j] = random() % 4 * TST_GetRandomDouble(-1000, 1000);
+
+      median = RGR_FindMedian(x, n);
+
+      for (j = c1 = c2 = c3 = 0; j < n; j++) {
+        if (x[j] < median)
+          c1++;
+        if (x[j] > median)
+          c3++;
+        else
+          c2++;
+      }
+
+      TEST_CHECK(c1 + c2 >= c3 && c1 <= c2 + c3);
+
+      xrange = TST_GetRandomDouble(1e-6, pow(10.0, random() % 10));
+      yrange = random() % 3 * TST_GetRandomDouble(0.0, pow(10.0, random() % 10));
+      wrange = random() % 3 * TST_GetRandomDouble(0.0, pow(10.0, random() % 10));
+      x2range = random() % 3 * TST_GetRandomDouble(0.0, pow(10.0, random() % 10));
+      m = random() % n;
+
+      for (j = 0; j < n; j++) {
+        x[j] = (j ? x[j - 1] : 0.0) + TST_GetRandomDouble(1e-6, xrange);
+        y[j] = TST_GetRandomDouble(-yrange, yrange);
+        w[j] = 1.0 + TST_GetRandomDouble(0.0, wrange);
+        x2[j] = TST_GetRandomDouble(-x2range, x2range);
+      }
+
+      RGR_WeightedRegression(x, y, w, n, &b0, &b1, &s2, &sb0, &sb1);
+
+      if (RGR_FindBestRegression(x + m, y + m, w, n - m, m, 3, &b0, &b1, &s2, &sb0, &sb1,
+                                 &best_start, &runs, &dof))
+        ;
+      if (RGR_MultipleRegress(x, x2, y, n, &b2))
+        ;
+      if (RGR_FindBestRobustRegression(x, y, n, 1e-8, &b0, &b1, &runs, &best_start))
+        ;
+    }
+  }
+}
diff --git a/test/unit/samplefilt.c b/test/unit/samplefilt.c
new file mode 100644
index 0000000..19d2f70
--- /dev/null
+++ b/test/unit/samplefilt.c
@@ -0,0 +1,120 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2018
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <local.h>
+#include "test.h"
+
+#define LCL_GetSysPrecisionAsQuantum() (1.0e-6)
+
+#include <samplefilt.c>
+
+void
+test_unit(void)
+{
+  NTP_Sample sample_in, sample_out;
+  SPF_Instance filter;
+  int i, j, k, sum_count, min_samples, max_samples;
+  double mean, combine_ratio, sum_err;
+
+  LCL_Initialise();
+
+  memset(&sample_in, 0, sizeof (sample_in));
+  memset(&sample_out, 0, sizeof (sample_out));
+
+  for (i = 0; i <= 100; i++) {
+    max_samples = random() % 20 + 1;
+    min_samples = random() % (max_samples) + 1;
+    combine_ratio = TST_GetRandomDouble(0.0, 1.0);
+
+    filter = SPF_CreateInstance(min_samples, max_samples, 2.0, combine_ratio);
+
+    TEST_CHECK(max_samples == SPF_GetMaxSamples(filter));
+
+    for (j = 0, sum_count = 0, sum_err = 0.0; j < 100; j++) {
+      DEBUG_LOG("iteration %d/%d", i, j);
+
+      mean = TST_GetRandomDouble(-1.0e3, 1.0e3);
+      UTI_ZeroTimespec(&sample_in.time);
+
+      for (k = 0; k < 100; k++) {
+        UTI_AddDoubleToTimespec(&sample_in.time, TST_GetRandomDouble(1.0e-1, 1.0e2),
+                                &sample_in.time);
+        sample_in.offset = mean + TST_GetRandomDouble(-1.0, 1.0);
+        sample_in.peer_dispersion = TST_GetRandomDouble(1.0e-4, 2.0e-4);
+        sample_in.root_dispersion = TST_GetRandomDouble(1.0e-3, 2.0e-3);
+        sample_in.peer_delay = TST_GetRandomDouble(1.0e-2, 2.0e-2);
+        sample_in.root_delay = TST_GetRandomDouble(1.0e-1, 2.0e-1);
+
+        TEST_CHECK(SPF_AccumulateSample(filter, &sample_in));
+        TEST_CHECK(!SPF_AccumulateSample(filter, &sample_in));
+
+        TEST_CHECK(SPF_GetNumberOfSamples(filter) == MIN(k + 1, max_samples));
+
+        SPF_GetLastSample(filter, &sample_out);
+        TEST_CHECK(!memcmp(&sample_in, &sample_out, sizeof (sample_in)));
+
+        SPF_SlewSamples(filter, &sample_in.time, 0.0, 0.0);
+        SPF_CorrectOffset(filter, 0.0);
+        SPF_AddDispersion(filter, 0.0);
+
+        if (k + 1 < min_samples)
+          TEST_CHECK(!SPF_GetFilteredSample(filter, &sample_out));
+
+        TEST_CHECK(SPF_GetNumberOfSamples(filter) == MIN(k + 1, max_samples));
+      }
+
+      if (random() % 10) {
+        TEST_CHECK(SPF_GetFilteredSample(filter, &sample_out));
+
+        TEST_CHECK(SPF_GetAvgSampleDispersion(filter) <= 2.0);
+
+        sum_err += sample_out.offset - mean;
+        sum_count++;
+
+        TEST_CHECK(UTI_CompareTimespecs(&sample_out.time, &sample_in.time) <= 0 &&
+                   sample_out.time.tv_sec >= 0);
+        TEST_CHECK(fabs(sample_out.offset - mean) <= 1.0);
+        TEST_CHECK(sample_out.peer_dispersion >= 1.0e-4 &&
+                   (sample_out.peer_dispersion <= 2.0e-4 || filter->max_samples > 1));
+        TEST_CHECK(sample_out.root_dispersion >= 1.0e-3 &&
+                   (sample_out.root_dispersion <= 2.0e-3 || filter->max_samples > 1));
+        TEST_CHECK(sample_out.peer_delay >= 1.0e-2 &&
+                   sample_out.peer_delay <= 2.0e-2);
+        TEST_CHECK(sample_out.root_delay >= 1.0e-1 &&
+                   sample_out.root_delay <= 2.0e-1);
+
+        if (max_samples == 1)
+          TEST_CHECK(!memcmp(&sample_in, &sample_out, sizeof (sample_in)));
+
+      } else {
+        SPF_DropSamples(filter);
+        TEST_CHECK(filter->last < 0);
+      }
+
+      TEST_CHECK(SPF_GetNumberOfSamples(filter) == 0);
+    }
+
+    TEST_CHECK(fabs(sum_err / sum_count) < 0.3);
+
+    SPF_DestroyInstance(filter);
+  }
+
+  LCL_Finalise();
+}
diff --git a/test/unit/siv.c b/test/unit/siv.c
new file mode 100644
index 0000000..54f435d
--- /dev/null
+++ b/test/unit/siv.c
@@ -0,0 +1,423 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2019
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include <sysincl.h>
+#include <logging.h>
+#include <siv.h>
+#include "test.h"
+
+#ifdef HAVE_SIV
+
+struct siv_test {
+  SIV_Algorithm algorithm;
+  const unsigned char key[64];
+  int key_length;
+  const unsigned char nonce[128];
+  int nonce_length;
+  const unsigned char assoc[128];
+  int assoc_length;
+  const unsigned char plaintext[128];
+  int plaintext_length;
+  const unsigned char ciphertext[128];
+  int ciphertext_length;
+};
+
+void
+test_unit(void)
+{
+  struct siv_test tests[] = {
+    { AEAD_AES_SIV_CMAC_256,
+      "\x01\x23\x45\x67\x89\xab\xcd\xef\xf0\x12\x34\x56\x78\x9a\xbc\xde"
+      "\xef\x01\x23\x45\x67\x89\xab\xcd\xde\xf0\x12\x34\x56\x78\x9a\xbc", 32,
+      "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f", 16,
+      "", 0,
+      "", 0,
+      "\x22\x3e\xb5\x94\xe0\xe0\x25\x4b\x00\x25\x8e\x21\x9a\x1c\xa4\x21", 16
+    },
+    { AEAD_AES_SIV_CMAC_256,
+      "\x01\x23\x45\x67\x89\xab\xcd\xef\xf0\x12\x34\x56\x78\x9a\xbc\xde"
+      "\xef\x01\x23\x45\x67\x89\xab\xcd\xde\xf0\x12\x34\x56\x78\x9a\xbc", 32,
+      "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f", 16,
+      "\x4c\x9d\x4f\xca\xed\x8a\xe2\xba\xad\x3f\x3e\xa6\xe9\x3c\x8c\x8b", 16,
+      "", 0,
+      "\xd7\x20\x19\x89\xc6\xdb\xc6\xd6\x61\xfc\x62\xbc\x86\x5e\xee\xef", 16
+    },
+    { AEAD_AES_SIV_CMAC_256,
+      "\x01\x23\x45\x67\x89\xab\xcd\xef\xf0\x12\x34\x56\x78\x9a\xbc\xde"
+      "\xef\x01\x23\x45\x67\x89\xab\xcd\xde\xf0\x12\x34\x56\x78\x9a\xbc", 32,
+      "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f", 16,
+      "", 0,
+      "\x4c\x9d\x4f\xca\xed\x8a\xe2\xba\xad\x3f\x3e\xa6\xe9\x3c\x8c\x8b", 16,
+      "\xb6\xc1\x60\xe9\xc2\xfd\x2a\xe8\xde\xc5\x36\x8b\x2a\x33\xed\xe1"
+      "\x14\xff\xb3\x97\x34\x5c\xcb\xe4\x4a\xa4\xde\xac\xd9\x36\x90\x46", 32
+    },
+    { AEAD_AES_SIV_CMAC_256,
+      "\x01\x23\x45\x67\x89\xab\xcd\xef\xf0\x12\x34\x56\x78\x9a\xbc\xde"
+      "\xef\x01\x23\x45\x67\x89\xab\xcd\xde\xf0\x12\x34\x56\x78\x9a\xbc", 32,
+      "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e", 15,
+      "\x4c\x9d\x4f\xca\xed\x8a\xe2\xba\xad\x3f\x3e\xa6\xe9\x3c\x8c", 15,
+      "\xba\x99\x79\x31\x23\x7e\x3c\x53\x58\x7e\xd4\x93\x02\xab\xe4", 15,
+      "\x03\x8c\x41\x51\xba\x7a\x8f\x77\x6e\x56\x31\x99\x42\x0b\xc7\x03"
+      "\xe7\x6c\x67\xc9\xda\xb7\x0d\x5b\x44\x06\x26\x5a\xd0\xd2\x3b", 31
+    },
+    { AEAD_AES_SIV_CMAC_256,
+      "\x01\x23\x45\x67\x89\xab\xcd\xef\xf0\x12\x34\x56\x78\x9a\xbc\xde"
+      "\xef\x01\x23\x45\x67\x89\xab\xcd\xde\xf0\x12\x34\x56\x78\x9a\xbc", 32,
+      "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f", 16,
+      "\x4c\x9d\x4f\xca\xed\x8a\xe2\xba\xad\x3f\x3e\xa6\xe9\x3c\x8c\x8b", 16,
+      "\xba\x99\x79\x31\x23\x7e\x3c\x53\x58\x7e\xd4\x93\x02\xab\xe4\xa7", 16,
+      "\x5c\x05\x23\x65\xf4\x57\x0a\xa0\xfb\x38\x3e\xce\x9b\x75\x85\xeb"
+      "\x68\x85\x19\x36\x0c\x7c\x48\x11\x40\xcb\x9b\x57\x9a\x0e\x65\x32", 32
+    },
+    { AEAD_AES_SIV_CMAC_256,
+      "\x01\x23\x45\x67\x89\xab\xcd\xef\xf0\x12\x34\x56\x78\x9a\xbc\xde"
+      "\xef\x01\x23\x45\x67\x89\xab\xcd\xde\xf0\x12\x34\x56\x78\x9a\xbc", 32,
+      "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+      "\xd5", 17,
+      "\x4c\x9d\x4f\xca\xed\x8a\xe2\xba\xad\x3f\x3e\xa6\xe9\x3c\x8c\x8b"
+      "\xa0", 17,
+      "\xba\x99\x79\x31\x23\x7e\x3c\x53\x58\x7e\xd4\x93\x02\xab\xe4\xa7"
+      "\x08", 17,
+      "\xaf\x58\x4b\xe7\x82\x1e\x96\x19\x29\x91\x25\xe0\xdd\x80\x3b\x49"
+      "\xa5\x11\xcd\xb6\x08\xf3\x76\xa0\xb6\xfa\x15\x82\xf3\x95\xe1\xeb"
+      "\xbd", 33
+    },
+    { AEAD_AES_SIV_CMAC_256,
+      "\x01\x23\x45\x67\x89\xab\xcd\xef\xf0\x12\x34\x56\x78\x9a\xbc\xde"
+      "\xef\x01\x23\x45\x67\x89\xab\xcd\xde\xf0\x12\x34\x56\x78\x9a\xbc", 32,
+      "\xb0\x5a\x1b\xc7\x56\xe7\xb6\x2c\xb4\x85\xe5\x56\xa5\x28\xc0\x6c"
+      "\x2f\x3b\x0b\x9d\x1a\x0c\xdf\x69\x47\xe0\xcc\xc0\x87\xaa\x5c\x09"
+      "\x98\x48\x8d\x6a\x8e\x1e\x05\xd7\x8b\x68\x74\x83\xb5\x1d\xf1\x2c", 48,
+      "\xe5\x8b\xd2\x6a\x30\xc5\xc5\x61\xcc\xbd\x7c\x27\xbf\xfe\xf9\x06"
+      "\x00\x5b\xd7\xfc\x11\x0b\xcf\x16\x61\xef\xac\x05\xa7\xaf\xec\x27"
+      "\x41\xc8\x5e\x9e\x0d\xf9\x2f\xaf\x20\x79\x17\xe5\x17\x91\x2a\x27"
+      "\x34\x1c\xbc\xaf\xeb\xef\x7f\x52\xe7\x1e\x4c\x2a\xca\xbd\x2b\xbe"
+      "\x34\xd6\xfb\x69\xd3\x3e\x49\x59\x60\xb4\x26\xc9\xb8\xce\xba", 79,
+      "\x6c\xe7\xcf\x7e\xab\x7b\xa0\xe1\xa7\x22\xcb\x88\xde\x5e\x42\xd2"
+      "\xec\x79\xe0\xa2\xcf\x5f\x0f\x6f\x6b\x89\x57\xcd\xae\x17\xd4\xc2"
+      "\xf3\x1b\xa2\xa8\x13\x78\x23\x2f\x83\xa8\xd4\x0c\xc0\xd2\xf3\x99"
+      "\xae\x81\xa1\xca\x5b\x5f\x45\xa6\x6f\x0c\x8a\xf3\xd4\x67\x40\x81"
+      "\x26\xe2\x01\x86\xe8\x5a\xd5\xf8\x58\x80\x9f\x56\xaa\x76\x96\xbf"
+      "\x31", 81,
+      "\x9a\x06\x33\xe0\xee\x00\x6a\x9b\xc8\x20\xd5\xe2\xc2\xed\xb5\x75"
+      "\xfa\x9e\x42\x2a\x31\x6b\xda\xca\xaa\x7d\x31\x8b\x84\x7a\xb8\xd7"
+      "\x8a\x81\x25\x64\xed\x41\x9b\xa9\x77\x10\xbd\x05\x0c\x4e\xc5\x31"
+      "\x0c\xa2\x86\xec\x8a\x94\xc8\x24\x23\x3c\x13\xee\xa5\x51\xc9\xdf"
+      "\x48\xc9\x55\xc5\x2f\x40\x73\x3f\x98\xbb\x8d\x69\x78\x46\x64\x17"
+      "\x8d\x49\x2f\x14\x62\xa4\x7c\x2a\x57\x38\x87\xce\xc6\x72\xd3\x5c"
+      "\xa1", 97
+    },
+    { AEAD_AES_128_GCM_SIV,
+      "\x01\x23\x45\x67\x89\xab\xcd\xef\xf0\x12\x34\x56\x78\x9a\xbc\xde", 16,
+      "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b", 12,
+      "", 0,
+      "", 0,
+      "\xba\x05\x1c\x40\xeb\x7e\x5f\xa2\x3f\x6c\xe5\xbe\xfe\x5b\x04\xad", 16
+    },
+    { AEAD_AES_128_GCM_SIV,
+      "\x01\x23\x45\x67\x89\xab\xcd\xef\xf0\x12\x34\x56\x78\x9a\xbc\xde", 16,
+      "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b", 12,
+      "\x4c\x9d\x4f\xca\xed\x8a\xe2\xba\xad\x3f\x3e\xa6\xe9\x3c\x8c\x8b", 16,
+      "", 0,
+      "\x8f\x47\xfe\x1f\x26\x4e\xe2\x99\x5f\x35\x3d\x26\x74\x14\xd4\x3b", 16
+    },
+    { AEAD_AES_128_GCM_SIV,
+      "\x01\x23\x45\x67\x89\xab\xcd\xef\xf0\x12\x34\x56\x78\x9a\xbc\xde", 16,
+      "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b", 12,
+      "", 0,
+      "\xba\x05\x1c\x40\xeb\x7e\x5f\xa2\x3f\x6c\xe5\xbe\xfe\x5b\x04\xad", 16,
+      "\xa1\xc6\x1b\xf7\x32\x39\x93\x0e\x10\xf8\xa6\x21\x6c\x6e\x26\x83"
+      "\x5c\xa9\xb0\xdd\x91\x0f\x81\xa6\xf0\x3b\x45\xda\xa6\x9a\x2b\x24", 32,
+    },
+    { AEAD_AES_128_GCM_SIV,
+      "\x01\x23\x45\x67\x89\xab\xcd\xef\xf0\x12\x34\x56\x78\x9a\xbc\xde", 16,
+      "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b", 12,
+      "\x4c\x9d\x4f\xca\xed\x8a\xe2\xba\xad\x3f\x3e\xa6\xe9\x3c\x8c", 15,
+      "\xba\x99\x79\x31\x23\x7e\x3c\x53\x58\x7e\xd4\x93\x02\xab\xe4", 15,
+      "\x7a\x23\xa7\x35\x8d\x34\x5b\xf6\x0d\xa7\x6d\x3b\x58\x8c\x4c\x65"
+      "\xd9\x85\x4e\x17\xb7\x52\x48\xf7\x91\xb4\xdd\xd6\x8b\xec\x02", 31
+    },
+    { AEAD_AES_128_GCM_SIV,
+      "\x01\x23\x45\x67\x89\xab\xcd\xef\xf0\x12\x34\x56\x78\x9a\xbc\xde", 16,
+      "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b", 12,
+      "\x4c\x9d\x4f\xca\xed\x8a\xe2\xba\xad\x3f\x3e\xa6\xe9\x3c\x8c\x8b", 16,
+      "\xba\x99\x79\x31\x23\x7e\x3c\x53\x58\x7e\xd4\x93\x02\xab\xe4\xa7", 16,
+      "\xa3\x10\xae\x5f\x26\xd9\x90\xfa\xab\x30\x29\x80\x7f\x93\x62\x23"
+      "\x83\x8f\xc9\x57\x90\xbb\x05\x87\x02\x11\x57\xd6\x13\x9b\x82\x4d", 32
+    },
+    { AEAD_AES_128_GCM_SIV,
+      "\x01\x23\x45\x67\x89\xab\xcd\xef\xf0\x12\x34\x56\x78\x9a\xbc\xde", 16,
+      "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b", 12,
+      "\x4c\x9d\x4f\xca\xed\x8a\xe2\xba\xad\x3f\x3e\xa6\xe9\x3c\x8c\x8b"
+      "\xa0", 17,
+      "\xba\x99\x79\x31\x23\x7e\x3c\x53\x58\x7e\xd4\x93\x02\xab\xe4\xa7"
+      "\x08", 17,
+      "\x4c\x48\x67\x48\xce\x8b\x14\x7b\x70\xac\x71\xe8\x7b\x4e\x4a\x6a"
+      "\xb4\x3d\xb5\x8e\x58\x81\xfc\x3e\x97\xcd\xdf\xef\x67\x1e\xf4\x4f"
+      "\x0d", 33
+    },
+    { AEAD_AES_128_GCM_SIV,
+      "\x01\x23\x45\x67\x89\xab\xcd\xef\xf0\x12\x34\x56\x78\x9a\xbc\xde", 16,
+      "\xb0\x5a\x1b\xc7\x56\xe7\xb6\x2c\xb4\x85\xe5\x56", 12,
+      "\xe5\x8b\xd2\x6a\x30\xc5\xc5\x61\xcc\xbd\x7c\x27\xbf\xfe\xf9\x06"
+      "\x00\x5b\xd7\xfc\x11\x0b\xcf\x16\x61\xef\xac\x05\xa7\xaf\xec\x27"
+      "\x41\xc8\x5e\x9e\x0d\xf9\x2f\xaf\x20\x79\x17\xe5\x17\x91\x2a\x27"
+      "\x34\x1c\xbc\xaf\xeb\xef\x7f\x52\xe7\x1e\x4c\x2a\xca\xbd\x2b\xbe"
+      "\x34\xd6\xfb\x69\xd3\x3e\x49\x59\x60\xb4\x26\xc9\xb8\xce\xba", 79,
+      "\x6c\xe7\xcf\x7e\xab\x7b\xa0\xe1\xa7\x22\xcb\x88\xde\x5e\x42\xd2"
+      "\xec\x79\xe0\xa2\xcf\x5f\x0f\x6f\x6b\x89\x57\xcd\xae\x17\xd4\xc2"
+      "\xf3\x1b\xa2\xa8\x13\x78\x23\x2f\x83\xa8\xd4\x0c\xc0\xd2\xf3\x99"
+      "\xae\x81\xa1\xca\x5b\x5f\x45\xa6\x6f\x0c\x8a\xf3\xd4\x67\x40\x81"
+      "\x26\xe2\x01\x86\xe8\x5a\xd5\xf8\x58\x80\x9f\x56\xaa\x76\x96\xbf"
+      "\x31", 81,
+      "\xf6\xa0\x1a\xf3\x4f\xe9\x36\xde\x5c\xbd\xb6\x0a\x26\x9d\x60\x1d"
+      "\xe6\xc9\x6d\xb8\xf2\x5f\xcd\xce\x26\xf4\x0d\x86\xec\xdd\x84\x25"
+      "\xaf\xec\x72\x10\x2d\x74\x2d\xde\x95\x84\xac\xce\xbf\x8a\x52\x9f"
+      "\x10\x6f\xc2\xa8\x1f\xed\x47\xff\xeb\x28\x57\x54\xb3\x45\x45\x56"
+      "\xbb\xcf\x7d\x9b\x99\x68\xbd\x36\x75\xe3\xf7\x8c\x09\x25\x01\xbe"
+      "\xe1\xe2\x3d\x19\x4f\x15\x64\x12\x6e\xea\x67\x6c\x42\x2f\xc1\x91"
+      "\xff", 97
+    },
+    { 0, "", 0 }
+  };
+
+  unsigned char plaintext[sizeof (((struct siv_test *)NULL)->plaintext)];
+  unsigned char ciphertext[sizeof (((struct siv_test *)NULL)->ciphertext)];
+  SIV_Instance siv;
+  int i, j, r, fixed_nonce_length;
+
+  for (i = 0; i < AEAD_AES_256_GCM_SIV + 10; i++) {
+    switch (i) {
+      case AEAD_AES_SIV_CMAC_256:
+      case AEAD_AES_128_GCM_SIV:
+        continue;
+    }
+    TEST_CHECK(SIV_GetKeyLength(i) == 0);
+    TEST_CHECK(SIV_CreateInstance(i) == NULL);
+  }
+
+  for (i = 0; tests[i].algorithm != 0; i++) {
+    DEBUG_LOG("testing %d (%d)", (int)tests[i].algorithm, i);
+
+    assert(tests[i].key_length <= sizeof (tests[i].key));
+    assert(tests[i].nonce_length <= sizeof (tests[i].nonce));
+    assert(tests[i].assoc_length <= sizeof (tests[i].assoc));
+    assert(tests[i].plaintext_length <= sizeof (tests[i].plaintext));
+    assert(tests[i].ciphertext_length <= sizeof (tests[i].ciphertext));
+
+    siv = SIV_CreateInstance(tests[i].algorithm);
+
+    switch (tests[i].algorithm) {
+      case AEAD_AES_SIV_CMAC_256:
+        TEST_CHECK(siv != NULL);
+        fixed_nonce_length = 0;
+        break;
+      case AEAD_AES_128_GCM_SIV:
+        fixed_nonce_length = 1;
+        break;
+      default:
+        assert(0);
+    }
+
+    if (!siv) {
+      DEBUG_LOG("missing %d support", (int)tests[i].algorithm);
+      TEST_CHECK(SIV_GetKeyLength(tests[i].algorithm) == 0);
+      continue;
+    }
+
+    TEST_CHECK(SIV_GetKeyLength(tests[i].algorithm) == tests[i].key_length);
+    TEST_CHECK(SIV_GetMinNonceLength(siv) >= 1);
+    TEST_CHECK(SIV_GetMinNonceLength(siv) <= 12);
+    TEST_CHECK(SIV_GetMaxNonceLength(siv) >= 12);
+    TEST_CHECK(SIV_GetMinNonceLength(siv) <= SIV_GetMaxNonceLength(siv));
+    if (fixed_nonce_length)
+      TEST_CHECK(SIV_GetMinNonceLength(siv) == SIV_GetMaxNonceLength(siv));
+
+    r = SIV_Encrypt(siv, tests[i].nonce, tests[i].nonce_length,
+                    tests[i].assoc, tests[i].assoc_length,
+                    tests[i].plaintext, tests[i].plaintext_length,
+                    ciphertext, tests[i].ciphertext_length);
+    TEST_CHECK(!r);
+    r = SIV_Decrypt(siv, tests[i].nonce, tests[i].nonce_length,
+                    tests[i].assoc, tests[i].assoc_length,
+                    tests[i].ciphertext, tests[i].ciphertext_length,
+                    plaintext, tests[i].plaintext_length);
+    TEST_CHECK(!r);
+
+    for (j = -1; j < 1024; j++) {
+      r = SIV_SetKey(siv, tests[i].key, j);
+      TEST_CHECK(r == (j == tests[i].key_length));
+    }
+
+    TEST_CHECK(SIV_GetTagLength(siv) == tests[i].ciphertext_length - tests[i].plaintext_length);
+
+    r = SIV_Encrypt(siv, tests[i].nonce, tests[i].nonce_length,
+                    tests[i].assoc, tests[i].assoc_length,
+                    tests[i].plaintext, tests[i].plaintext_length,
+                    ciphertext, tests[i].ciphertext_length);
+    TEST_CHECK(r);
+
+#if 0
+    for (j = 0; j < tests[i].ciphertext_length; j++) {
+      printf("\\x%02x", ciphertext[j]);
+      if (j % 16 == 15)
+        printf("\n");
+    }
+    printf("\n");
+#endif
+    TEST_CHECK(memcmp(ciphertext, tests[i].ciphertext, tests[i].ciphertext_length) == 0);
+
+    for (j = -1; j < tests[i].nonce_length; j++) {
+      r = SIV_Encrypt(siv, tests[i].nonce, j,
+                      tests[i].assoc, tests[i].assoc_length,
+                      tests[i].plaintext, tests[i].plaintext_length,
+                      ciphertext, tests[i].ciphertext_length);
+      if (j > 0 && (j == tests[i].nonce_length || !fixed_nonce_length)) {
+        TEST_CHECK(r);
+        TEST_CHECK(memcmp(ciphertext, tests[i].ciphertext, tests[i].ciphertext_length) != 0);
+      } else {
+        TEST_CHECK(!r);
+      }
+    }
+
+    for (j = -1; j < tests[i].assoc_length; j++) {
+      r = SIV_Encrypt(siv, tests[i].nonce, tests[i].nonce_length,
+                      tests[i].assoc, j,
+                      tests[i].plaintext, tests[i].plaintext_length,
+                      ciphertext, tests[i].ciphertext_length);
+      if (j >= 0) {
+        TEST_CHECK(r);
+        TEST_CHECK(memcmp(ciphertext, tests[i].ciphertext, tests[i].ciphertext_length) != 0);
+      } else {
+        TEST_CHECK(!r);
+      }
+    }
+
+    for (j = -1; j < tests[i].plaintext_length; j++) {
+      r = SIV_Encrypt(siv, tests[i].nonce, tests[i].nonce_length,
+                      tests[i].assoc, tests[i].assoc_length,
+                      tests[i].plaintext, j,
+                      ciphertext, j + SIV_GetTagLength(siv));
+      if (j >= 0) {
+        TEST_CHECK(r);
+        TEST_CHECK(memcmp(ciphertext, tests[i].ciphertext, j + SIV_GetTagLength(siv)) != 0);
+      } else {
+        TEST_CHECK(!r);
+      }
+    }
+
+    for (j = -1; j < 2 * tests[i].plaintext_length; j++) {
+      if (j == tests[i].plaintext_length)
+        continue;
+      r = SIV_Encrypt(siv, tests[i].nonce, tests[i].nonce_length,
+                      tests[i].assoc, tests[i].assoc_length,
+                      tests[i].plaintext, j,
+                      ciphertext, tests[i].ciphertext_length);
+      TEST_CHECK(!r);
+    }
+
+    for (j = -1; j < 2 * tests[i].ciphertext_length; j++) {
+      if (j == tests[i].ciphertext_length)
+        continue;
+      r = SIV_Encrypt(siv, tests[i].nonce, tests[i].nonce_length,
+                      tests[i].assoc, tests[i].assoc_length,
+                      tests[i].plaintext, tests[i].plaintext_length,
+                      ciphertext, j);
+      TEST_CHECK(!r);
+    }
+
+    r = SIV_Decrypt(siv, tests[i].nonce, tests[i].nonce_length,
+                    tests[i].assoc, tests[i].assoc_length,
+                    tests[i].ciphertext, tests[i].ciphertext_length,
+                    plaintext, tests[i].plaintext_length);
+    TEST_CHECK(r);
+    TEST_CHECK(memcmp(plaintext, tests[i].plaintext, tests[i].plaintext_length) == 0);
+
+    for (j = -1; j < tests[i].nonce_length; j++) {
+      r = SIV_Decrypt(siv, tests[i].nonce, j,
+                      tests[i].assoc, tests[i].assoc_length,
+                      tests[i].ciphertext, tests[i].ciphertext_length,
+                      plaintext, tests[i].plaintext_length);
+      TEST_CHECK(!r);
+    }
+
+    for (j = -1; j < tests[i].assoc_length; j++) {
+      r = SIV_Decrypt(siv, tests[i].nonce, tests[i].nonce_length,
+                      tests[i].assoc, j,
+                      tests[i].ciphertext, tests[i].ciphertext_length,
+                      plaintext, tests[i].plaintext_length);
+      TEST_CHECK(!r);
+    }
+
+    for (j = -1; j < 2 * tests[i].ciphertext_length; j++) {
+      if (j == tests[i].ciphertext_length)
+        continue;
+
+      r = SIV_Decrypt(siv, tests[i].nonce, tests[i].nonce_length,
+                      tests[i].assoc, tests[i].assoc_length,
+                      tests[i].ciphertext, j,
+                      plaintext, tests[i].plaintext_length);
+      TEST_CHECK(!r);
+    }
+
+    for (j = -1; j < tests[i].plaintext_length; j++) {
+      r = SIV_Decrypt(siv, tests[i].nonce, tests[i].nonce_length,
+                      tests[i].assoc, tests[i].assoc_length,
+                      tests[i].ciphertext, tests[i].ciphertext_length,
+                      plaintext, j);
+      TEST_CHECK(!r);
+
+      r = SIV_Decrypt(siv, tests[i].nonce, tests[i].nonce_length,
+                      tests[i].assoc, tests[i].assoc_length,
+                      tests[i].ciphertext, j + SIV_GetTagLength(siv),
+                      plaintext, j);
+      TEST_CHECK(!r);
+    }
+
+    SIV_DestroyInstance(siv);
+  }
+
+  siv = SIV_CreateInstance(tests[0].algorithm);
+  for (i = 0; i < 1000; i++) {
+    for (j = 0; tests[j].algorithm == tests[0].algorithm; j++) {
+      r = SIV_SetKey(siv, tests[j].key, tests[j].key_length);
+      TEST_CHECK(r);
+      r = SIV_Encrypt(siv, tests[j].nonce, tests[j].nonce_length,
+                      tests[j].assoc, tests[j].assoc_length,
+                      tests[j].plaintext, tests[j].plaintext_length,
+                      ciphertext, tests[j].ciphertext_length);
+      TEST_CHECK(r);
+      r = SIV_Decrypt(siv, tests[j].nonce, tests[j].nonce_length,
+                      tests[j].assoc, tests[j].assoc_length,
+                      tests[j].ciphertext, tests[j].ciphertext_length,
+                      plaintext, tests[j].plaintext_length);
+      TEST_CHECK(r);
+    }
+  }
+  SIV_DestroyInstance(siv);
+}
+#else
+void
+test_unit(void)
+{
+  TEST_REQUIRE(0);
+}
+#endif
diff --git a/test/unit/smooth.c b/test/unit/smooth.c
new file mode 100644
index 0000000..998a4d1
--- /dev/null
+++ b/test/unit/smooth.c
@@ -0,0 +1,63 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2016
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <smooth.c>
+#include "test.h"
+
+void
+test_unit(void)
+{
+  int i, j;
+  struct timespec ts;
+  double offset, freq, wander;
+  char conf[] = "smoothtime 300 0.01";
+
+  CNF_Initialise(0, 0);
+  CNF_ParseLine(NULL, 1, conf);
+
+  LCL_Initialise();
+  SMT_Initialise();
+  locked = 0;
+
+  for (i = 0; i < 500; i++) {
+    UTI_ZeroTimespec(&ts);
+    SMT_Reset(&ts);
+
+    DEBUG_LOG("iteration %d", i);
+
+    offset = (random() % 1000000 - 500000) / 1.0e6;
+    freq = (random() % 1000000 - 500000) / 1.0e9;
+    update_smoothing(&ts, offset, freq);
+
+    for (j = 0; j < 10000; j++) {
+      update_smoothing(&ts, 0.0, 0.0);
+      UTI_AddDoubleToTimespec(&ts, 16.0, &ts);
+      get_smoothing(&ts, &offset, &freq, &wander);
+    }
+
+    TEST_CHECK(fabs(offset) < 1e-12);
+    TEST_CHECK(fabs(freq) < 1e-12);
+    TEST_CHECK(fabs(wander) < 1e-12);
+  }
+
+  SMT_Finalise();
+  LCL_Finalise();
+  CNF_Finalise();
+}
diff --git a/test/unit/socket.c b/test/unit/socket.c
new file mode 100644
index 0000000..c4edea0
--- /dev/null
+++ b/test/unit/socket.c
@@ -0,0 +1,61 @@
+/*
+ **********************************************************************
+ * Copyright (C) Luke Valenta  2023
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <socket.c>
+#include "test.h"
+
+static void
+test_preinitialise(void)
+{
+#ifdef LINUX
+  /* Test LISTEN_FDS environment variable parsing */
+
+  /* normal */
+  putenv("LISTEN_FDS=2");
+  SCK_PreInitialise();
+  TEST_CHECK(reusable_fds == 2);
+
+  /* negative */
+  putenv("LISTEN_FDS=-2");
+  SCK_PreInitialise();
+  TEST_CHECK(reusable_fds == 0);
+
+  /* trailing characters */
+  putenv("LISTEN_FDS=2a");
+  SCK_PreInitialise();
+  TEST_CHECK(reusable_fds == 0);
+
+  /* non-integer */
+  putenv("LISTEN_FDS=a2");
+  SCK_PreInitialise();
+  TEST_CHECK(reusable_fds == 0);
+
+  /* not set */
+  unsetenv("LISTEN_FDS");
+  SCK_PreInitialise();
+  TEST_CHECK(reusable_fds == 0);
+#endif
+}
+
+void
+test_unit(void)
+{
+  test_preinitialise();
+}
diff --git a/test/unit/sources.c b/test/unit/sources.c
new file mode 100644
index 0000000..155e819
--- /dev/null
+++ b/test/unit/sources.c
@@ -0,0 +1,289 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2016, 2018, 2022
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <sources.c>
+#include "test.h"
+
+static SRC_Instance
+create_source(SRC_Type type, IPAddr *addr, int authenticated, int sel_options)
+{
+  TST_GetRandomAddress(addr, IPADDR_UNSPEC, -1);
+
+  return SRC_CreateNewInstance(UTI_IPToRefid(addr), type, authenticated, sel_options,
+                               type == SRC_NTP ? addr : NULL,
+                               SRC_DEFAULT_MINSAMPLES, SRC_DEFAULT_MAXSAMPLES, 0.0, 1.0);
+}
+
+void
+test_unit(void)
+{
+  SRC_AuthSelectMode sel_mode;
+  SRC_Instance srcs[16];
+  IPAddr addrs[16];
+  RPT_SourceReport report;
+  NTP_Sample sample;
+  int i, j, k, l, n1, n2, n3, n4, samples, sel_options;
+  char conf[128];
+
+  CNF_Initialise(0, 0);
+  LCL_Initialise();
+  TST_RegisterDummyDrivers();
+  SCH_Initialise();
+  SRC_Initialise();
+  REF_Initialise();
+  NSR_Initialise();
+
+  REF_SetMode(REF_ModeIgnore);
+
+  for (i = 0; i < 1000; i++) {
+    DEBUG_LOG("iteration %d", i);
+
+    for (j = 0; j < sizeof (srcs) / sizeof (srcs[0]); j++) {
+      TEST_CHECK(n_sources == j);
+
+      sel_options = i & random() & (SRC_SELECT_NOSELECT | SRC_SELECT_PREFER |
+                                    SRC_SELECT_TRUST | SRC_SELECT_REQUIRE);
+
+      DEBUG_LOG("added source %d options %d", j, sel_options);
+      srcs[j] = create_source(SRC_NTP, &addrs[j], 0, sel_options);
+      SRC_UpdateReachability(srcs[j], 1);
+
+      samples = (i + j) % 5 + 3;
+
+      sample.offset = TST_GetRandomDouble(-1.0, 1.0);
+
+      for (k = 0; k < samples; k++) {
+        SCH_GetLastEventTime(&sample.time, NULL, NULL);
+        UTI_AddDoubleToTimespec(&sample.time, TST_GetRandomDouble(k - samples, k - samples + 1),
+                                &sample.time);
+
+        sample.offset += TST_GetRandomDouble(-1.0e-2, 1.0e-2);
+        sample.peer_delay = TST_GetRandomDouble(1.0e-6, 1.0e-1);
+        sample.peer_dispersion = TST_GetRandomDouble(1.0e-6, 1.0e-1);
+        sample.root_delay = sample.peer_delay;
+        sample.root_dispersion = sample.peer_dispersion;
+
+        if (random() % 2)
+          SRC_UpdateStatus(srcs[j], 1, random() % 4);
+
+        DEBUG_LOG("source %d sample %d offset %f delay %f disp %f", j, k,
+                  sample.offset, sample.peer_delay, sample.peer_dispersion);
+
+        SRC_AccumulateSample(srcs[j], &sample);
+      }
+
+      for (k = 0; k <= j; k++) {
+        int passed = 0, trusted = 0, trusted_passed = 0, required = 0, required_passed = 0;
+        double trusted_lo = DBL_MAX, trusted_hi = DBL_MIN;
+        double passed_lo = DBL_MAX, passed_hi = DBL_MIN;
+
+        SRC_SelectSource(srcs[k]);
+        DEBUG_LOG("source %d status %c", k, get_status_char(sources[k]->status));
+
+        for (l = 0; l <= j; l++) {
+          TEST_CHECK(sources[l]->status > SRC_OK && sources[l]->status <= SRC_SELECTED);
+          if (sources[l]->sel_options & SRC_SELECT_NOSELECT) {
+            TEST_CHECK(sources[l]->status == SRC_UNSELECTABLE);
+          } else if (sources[l]->leap == LEAP_Unsynchronised) {
+            TEST_CHECK(sources[l]->status == SRC_UNSYNCHRONISED);
+          } else if (sources[l]->status != SRC_BAD_DISTANCE) {
+            if (sources[l]->status >= SRC_NONPREFERRED) {
+              passed++;
+              if (passed_lo > sources[l]->sel_info.lo_limit)
+                passed_lo = sources[l]->sel_info.lo_limit;
+              if (passed_hi < sources[l]->sel_info.hi_limit)
+                passed_hi = sources[l]->sel_info.hi_limit;
+            }
+            if (sources[l]->sel_options & SRC_SELECT_TRUST) {
+              trusted++;
+              if (trusted_lo > sources[l]->sel_info.lo_limit)
+                trusted_lo = sources[l]->sel_info.lo_limit;
+              if (trusted_hi < sources[l]->sel_info.hi_limit)
+                trusted_hi = sources[l]->sel_info.hi_limit;
+              if (sources[l]->status >= SRC_NONPREFERRED)
+                trusted_passed++;
+            }
+            if (sources[l]->sel_options & SRC_SELECT_REQUIRE) {
+              required++;
+              if (sources[l]->status >= SRC_NONPREFERRED)
+                required_passed++;
+            }
+            if (sources[l]->sel_options & SRC_SELECT_PREFER)
+              TEST_CHECK(sources[l]->status != SRC_NONPREFERRED);
+          }
+        }
+
+        DEBUG_LOG("sources %d passed %d trusted %d/%d required %d/%d", j + 1, passed,
+                  trusted_passed, trusted, required_passed, required);
+
+        TEST_CHECK(!trusted || !passed || (passed_lo >= trusted_lo && passed_hi <= trusted_hi));
+        TEST_CHECK(!passed || !trusted || trusted_passed >= 1);
+        TEST_CHECK(!passed || !required || required_passed > 0);
+
+        for (l = 0; l <= j; l++) {
+          TEST_CHECK(sources[l]->leap_vote ==
+                     (sources[l]->status >= SRC_NONPREFERRED &&
+                      (!trusted || sources[l]->sel_options & SRC_SELECT_TRUST)));
+        }
+      }
+    }
+
+    for (j = 0; j < sizeof (srcs) / sizeof (srcs[0]); j++) {
+      SRC_ReportSource(j, &report, &sample.time);
+      SRC_DestroyInstance(srcs[j]);
+    }
+  }
+
+  for (i = 0; i < 16; i++) {
+    DEBUG_LOG("iteration %d", i);
+
+    for (j = 0; j < sizeof (srcs) / sizeof (srcs[0]); j++) {
+      TEST_CHECK(n_sources == j);
+
+      srcs[j] = create_source(SRC_NTP, &addrs[j], 0, 0);
+      SRC_UpdateReachability(srcs[j], 1);
+
+      samples = 8;
+      for (k = 0; k < samples; k++) {
+        SCH_GetLastEventTime(&sample.time, NULL, NULL);
+        UTI_AddDoubleToTimespec(&sample.time, k - samples, &sample.time);
+        if (j != 0)
+          UTI_AddDoubleToTimespec(&sample.time, -i * (1.0e-3 / LCL_GetMaxClockError()), &sample.time);
+
+        sample.offset = (k % 2) * 1e-8;
+        sample.peer_delay = sample.root_delay = 2.0e-3 * (j + 1);
+        sample.peer_dispersion = sample.root_dispersion = 4.0e-3;
+
+        SRC_AccumulateSample(srcs[j], &sample);
+        SRC_UpdateStatus(srcs[j], 1, LEAP_Normal);
+      }
+    }
+
+    SRC_SelectSource(srcs[0]);
+
+    for (j = 0; j < sizeof (srcs) / sizeof (srcs[0]); j++) {
+      DEBUG_LOG("%d %c %f", j, get_status_char(srcs[j]->status),
+                srcs[j]->sel_info.root_distance);
+      if (j == 0)
+        TEST_CHECK(sources[j]->status == SRC_SELECTED);
+      else if (j < 11 - i)
+        TEST_CHECK(sources[j]->status == SRC_UNSELECTED);
+      else
+        TEST_CHECK(sources[j]->status == SRC_DISTANT);
+    }
+
+    for (j = 0; j < sizeof (srcs) / sizeof (srcs[0]); j++) {
+      SCH_GetLastEventTime(&sample.time, NULL, NULL);
+      SRC_ReportSource(j, &report, &sample.time);
+      SRC_DestroyInstance(srcs[j]);
+    }
+  }
+
+  TEST_CHECK(CNF_GetAuthSelectMode() == SRC_AUTHSELECT_MIX);
+
+  for (i = 0; i < 1000; i++) {
+    DEBUG_LOG("iteration %d", i);
+
+    switch (i % 4) {
+      case 0:
+        snprintf(conf, sizeof (conf), "authselectmode require");
+        sel_mode = SRC_AUTHSELECT_REQUIRE;
+        break;
+      case 1:
+        snprintf(conf, sizeof (conf), "authselectmode prefer");
+        sel_mode = SRC_AUTHSELECT_PREFER;
+        break;
+      case 2:
+        snprintf(conf, sizeof (conf), "authselectmode mix");
+        sel_mode = SRC_AUTHSELECT_MIX;
+        break;
+      case 3:
+        snprintf(conf, sizeof (conf), "authselectmode ignore");
+        sel_mode = SRC_AUTHSELECT_IGNORE;
+        break;
+    }
+
+    CNF_ParseLine(NULL, 0, conf);
+    TEST_CHECK(CNF_GetAuthSelectMode() == sel_mode);
+
+    sel_options = random() & (SRC_SELECT_PREFER | SRC_SELECT_TRUST | SRC_SELECT_REQUIRE);
+
+    n1 = random() % 3;
+    n2 = random() % 3;
+    n3 = random() % 3;
+    n4 = random() % 3;
+    assert(n1 + n2 + n3 < sizeof (srcs) / sizeof (srcs[0]));
+
+    for (j = 0; j < n1; j++)
+      srcs[j] = create_source(SRC_REFCLOCK, &addrs[j], random() % 2, sel_options);
+    for (; j < n1 + n2; j++)
+      srcs[j] = create_source(SRC_NTP, &addrs[j], 1, sel_options);
+    for (; j < n1 + n2 + n3; j++)
+      srcs[j] = create_source(SRC_NTP, &addrs[j], 0, sel_options);
+    for (; j < n1 + n2 + n3 + n4; j++)
+      srcs[j] = create_source(random() % 2 ? SRC_REFCLOCK : SRC_NTP, &addrs[j],
+                              random() % 2, sel_options | SRC_SELECT_NOSELECT);
+
+    switch (sel_mode) {
+      case SRC_AUTHSELECT_IGNORE:
+        for (j = 0; j < n1 + n2 + n3; j++)
+          TEST_CHECK(srcs[j]->sel_options == sel_options);
+        break;
+      case SRC_AUTHSELECT_MIX:
+        for (j = 0; j < n1 + n2; j++)
+          TEST_CHECK(srcs[j]->sel_options ==
+                     (sel_options | (n2 > 0 && n3 > 0 ? SRC_SELECT_REQUIRE | SRC_SELECT_TRUST : 0)));
+        for (; j < n1 + n2 + n3; j++)
+          TEST_CHECK(srcs[j]->sel_options == sel_options);
+        break;
+      case SRC_AUTHSELECT_PREFER:
+        for (j = 0; j < n1 + n2; j++)
+          TEST_CHECK(srcs[j]->sel_options == sel_options);
+        for (; j < n1 + n2 + n3; j++)
+          TEST_CHECK(srcs[j]->sel_options == (sel_options | (n2 > 0 ? SRC_SELECT_NOSELECT : 0)));
+        break;
+      case SRC_AUTHSELECT_REQUIRE:
+        for (j = 0; j < n1 + n2; j++)
+          TEST_CHECK(srcs[j]->sel_options == sel_options);
+        for (; j < n1 + n2 + n3; j++)
+          TEST_CHECK(srcs[j]->sel_options == (sel_options | SRC_SELECT_NOSELECT));
+        break;
+      default:
+        assert(0);
+    }
+
+    for (j = n1 + n2 + n3; j < n1 + n2 + n3 + n4; j++)
+      TEST_CHECK(srcs[j]->sel_options == (sel_options | SRC_SELECT_NOSELECT));
+
+    for (j = n1 + n2 + n3 + n4 - 1; j >= 0; j--) {
+      if (j < n1 + n2)
+        TEST_CHECK(srcs[j]->sel_options == sel_options);
+      SRC_DestroyInstance(srcs[j]);
+    }
+  }
+
+  NSR_Finalise();
+  REF_Finalise();
+  SRC_Finalise();
+  SCH_Finalise();
+  LCL_Finalise();
+  CNF_Finalise();
+  HSH_Finalise();
+}
diff --git a/test/unit/test.c b/test/unit/test.c
new file mode 100644
index 0000000..1ebb11a
--- /dev/null
+++ b/test/unit/test.c
@@ -0,0 +1,182 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2016
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <config.h>
+#include <sysincl.h>
+#include <logging.h>
+#include <localp.h>
+#include <util.h>
+
+#include "test.h"
+
+void
+TST_Fail(int line)
+{
+  printf("FAIL (on line %d)\n", line);
+  exit(1);
+}
+
+void
+TST_Skip(int line)
+{
+  printf("SKIP (on line %d)\n", line);
+  exit(0);
+}
+
+int
+main(int argc, char **argv)
+{
+  LOG_Severity log_severity;
+  char *test_name, *s;
+  int i, seed = 0;
+  struct timeval tv;
+
+  test_name = argv[0];
+  s = strrchr(test_name, '.');
+  if (s)
+    *s = '\0';
+  s = strrchr(test_name, '/');
+  if (s)
+    test_name = s + 1;
+
+  log_severity = LOGS_FATAL;
+
+  for (i = 1; i < argc; i++) {
+    if (!strcmp(argv[i], "-d")) {
+      log_severity = LOGS_DEBUG;
+    } else if (!strcmp(argv[i], "-s") && i + 1 < argc) {
+      seed = atoi(argv[++i]);
+    } else {
+      fprintf(stderr, "Unknown option\n");
+      exit(1);
+    }
+  }
+
+  gettimeofday(&tv, NULL);
+  srandom(seed ? seed : tv.tv_sec ^ (tv.tv_usec << 10));
+
+  printf("Testing %-30s ", test_name);
+  fflush(stdout);
+
+  LOG_Initialise();
+  LOG_SetMinSeverity(log_severity);
+
+  test_unit();
+
+  UTI_ResetGetRandomFunctions();
+  LOG_Finalise();
+
+  printf("PASS\n");
+
+  return 0;
+}
+
+double
+TST_GetRandomDouble(double min, double max)
+{
+  return min + random() / 2147483647.0 * (max - min);
+}
+
+void
+TST_GetRandomAddress(IPAddr *ip, int family, int bits)
+{
+  if (family != IPADDR_INET4 && family != IPADDR_INET6)
+    family = random() % 2 ? IPADDR_INET4 : IPADDR_INET6;
+
+  ip->family = family;
+
+  if (family == IPADDR_INET4) {
+    if (bits < 0)
+      bits = 32;
+    assert(bits <= 32);
+
+    if (bits > 16)
+      ip->addr.in4 = (uint32_t)random() % (1U << (bits - 16)) << 16 |
+                     (uint32_t)random() % (1U << 16);
+    else
+      ip->addr.in4 = (uint32_t)random() % (1U << bits);
+  } else {
+    int i, b;
+
+    if (bits < 0)
+      bits = 128;
+    assert(bits <= 128);
+
+    for (i = 0, b = 120; i < 16; i++, b -= 8) {
+      if (b >= bits) {
+        ip->addr.in6[i] = 0;
+      } else {
+        ip->addr.in6[i] = random() % (1U << MIN(bits - b, 8));
+      }
+    }
+  }
+}
+
+void
+TST_SwapAddressBit(IPAddr *ip, unsigned int b)
+{
+  if (ip->family == IPADDR_INET4) {
+    assert(b < 32);
+    ip->addr.in4 ^= 1U << (31 - b);
+  } else if (ip->family == IPADDR_INET6) {
+    assert(b < 128);
+    ip->addr.in6[b / 8] ^= 1U << (7 - b % 8);
+  } else {
+    assert(0);
+  }
+}
+
+static double
+read_frequency(void)
+{
+  return 0.0;
+}
+
+static double
+set_frequency(double freq_ppm)
+{
+  return 0.0;
+}
+
+static void
+accrue_offset(double offset, double corr_rate)
+{
+}
+
+static int
+apply_step_offset(double offset)
+{
+  return 0;
+}
+
+static void
+offset_convert(struct timespec *raw, double *corr, double *err)
+{
+  *corr = 0.0;
+  if (err)
+    *err = 0.0;
+}
+
+void
+TST_RegisterDummyDrivers(void)
+{
+  lcl_RegisterSystemDrivers(read_frequency, set_frequency, accrue_offset,
+                            apply_step_offset, offset_convert, NULL, NULL);
+}
diff --git a/test/unit/test.h b/test/unit/test.h
new file mode 100644
index 0000000..00d261d
--- /dev/null
+++ b/test/unit/test.h
@@ -0,0 +1,52 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2016
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#ifndef GOT_TEST_H
+#define GOT_TEST_H
+
+#include <addressing.h>
+
+extern void test_unit(void);
+
+#define TEST_CHECK(expr) \
+  do { \
+    if (!(expr)) { \
+      TST_Fail(__LINE__); \
+      exit(1); \
+    } \
+  } while (0)
+
+#define TEST_REQUIRE(expr) \
+  do { \
+    if (!(expr)) { \
+      TST_Skip(__LINE__); \
+      exit(0); \
+    } \
+  } while (0)
+
+extern void TST_Fail(int line);
+extern void TST_Skip(int line);
+
+extern double TST_GetRandomDouble(double min, double max);
+extern void TST_GetRandomAddress(IPAddr *ip, int family, int bits);
+extern void TST_SwapAddressBit(IPAddr *ip, unsigned int b);
+extern void TST_RegisterDummyDrivers(void);
+
+#endif
diff --git a/test/unit/util.c b/test/unit/util.c
new file mode 100644
index 0000000..d52a268
--- /dev/null
+++ b/test/unit/util.c
@@ -0,0 +1,801 @@
+/*
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2017-2018, 2021, 2023
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <util.c>
+#include "test.h"
+
+static volatile int handled_signal = 0;
+
+static void
+handle_signal(int signal)
+{
+  handled_signal = signal;
+}
+
+void
+test_unit(void)
+{
+  struct timespec ts, ts2, ts3, ts4;
+  char buf[16], *s, *s2, *words[3];
+  NTP_int64 ntp_ts, ntp_ts2, ntp_fuzz;
+  NTP_int32 ntp32_ts;
+  struct timeval tv;
+  double x, y, nan, inf;
+  IPAddr ip, ip2, ip3;
+  IPSockAddr ip_saddr;
+  Integer64 integer64;
+  Timespec tspec;
+  Float f;
+  int i, j, c;
+  uid_t uid;
+  gid_t gid;
+  struct stat st;
+  FILE *file;
+
+  for (i = -31; i < 31; i++) {
+    x = pow(2.0, i);
+    y = UTI_Log2ToDouble(i);
+    TEST_CHECK(y / x > 0.99999 && y / x < 1.00001);
+  }
+
+  for (i = -89; i < 63; i++) {
+    x = pow(2.0, i);
+    y = UTI_FloatNetworkToHost(UTI_FloatHostToNetwork(x));
+    TEST_CHECK(y / x > 0.99999 && y / x < 1.00001);
+  }
+
+  for (i = 0; i < 100000; i++) {
+    x = TST_GetRandomDouble(-1000.0, 1000.0);
+    y = UTI_FloatNetworkToHost(UTI_FloatHostToNetwork(x));
+    TEST_CHECK(y / x > 0.99999 && y / x < 1.00001);
+
+    UTI_GetRandomBytes(&f, sizeof (f));
+    x = UTI_FloatNetworkToHost(f);
+    TEST_CHECK(x > 0.0 || x <= 0.0);
+  }
+
+  TEST_CHECK(UTI_DoubleToNtp32(1.0) == htonl(65536));
+  TEST_CHECK(UTI_DoubleToNtp32(0.0) == htonl(0));
+  TEST_CHECK(UTI_DoubleToNtp32(1.0 / (65536.0)) == htonl(1));
+  TEST_CHECK(UTI_DoubleToNtp32(1.000001 / (65536.0)) == htonl(2));
+  TEST_CHECK(UTI_DoubleToNtp32(1.000001) == htonl(65537));
+  TEST_CHECK(UTI_DoubleToNtp32(1000000) == htonl(0xffffffff));
+  TEST_CHECK(UTI_DoubleToNtp32(-1.0) == htonl(0));
+
+  UTI_DoubleToTimeval(0.4e-6, &tv);
+  TEST_CHECK(tv.tv_sec == 0);
+  TEST_CHECK(tv.tv_usec == 0);
+  UTI_DoubleToTimeval(-0.4e-6, &tv);
+  TEST_CHECK(tv.tv_sec == 0);
+  TEST_CHECK(tv.tv_usec == 0);
+  UTI_DoubleToTimeval(0.5e-6, &tv);
+  TEST_CHECK(tv.tv_sec == 0);
+  TEST_CHECK(tv.tv_usec == 1);
+  UTI_DoubleToTimeval(-0.5e-6, &tv);
+  TEST_CHECK(tv.tv_sec == -1);
+  TEST_CHECK(tv.tv_usec == 999999);
+
+  UTI_DoubleToTimespec(0.9e-9, &ts);
+  TEST_CHECK(ts.tv_sec == 0);
+  TEST_CHECK(ts.tv_nsec == 0);
+  UTI_DoubleToTimespec(1.0e-9, &ts);
+  TEST_CHECK(ts.tv_sec == 0);
+  TEST_CHECK(ts.tv_nsec == 1);
+  UTI_DoubleToTimespec(-0.9e-9, &ts);
+  TEST_CHECK(ts.tv_sec == 0);
+  TEST_CHECK(ts.tv_nsec == 0);
+  UTI_DoubleToTimespec(-1.0e-9, &ts);
+  TEST_CHECK(ts.tv_sec == -1);
+  TEST_CHECK(ts.tv_nsec == 999999999);
+
+  ntp_ts.hi = htonl(JAN_1970);
+  ntp_ts.lo = 0xffffffff;
+  UTI_Ntp64ToTimespec(&ntp_ts, &ts);
+#if defined(HAVE_LONG_TIME_T) && NTP_ERA_SPLIT > 0
+  TEST_CHECK(ts.tv_sec == 0x100000000LL * (1 + (NTP_ERA_SPLIT - 1) / 0x100000000LL));
+#else
+  TEST_CHECK(ts.tv_sec == 0);
+#endif
+  TEST_CHECK(ts.tv_nsec == 999999999);
+
+  ntp_ts.hi = htonl(JAN_1970 - 1);
+  ntp_ts.lo = htonl(0xffffffff);
+  ntp_ts2.hi = htonl(JAN_1970 + 1);
+  ntp_ts2.lo = htonl(0x80000000);
+  TEST_CHECK(fabs(UTI_DiffNtp64ToDouble(&ntp_ts, &ntp_ts2) + 1.5) < 1e-9);
+  TEST_CHECK(fabs(UTI_DiffNtp64ToDouble(&ntp_ts2, &ntp_ts) - 1.5) < 1e-9);
+
+  UTI_AddDoubleToTimespec(&ts, 1e-9, &ts);
+#if defined(HAVE_LONG_TIME_T) && NTP_ERA_SPLIT > 0
+  TEST_CHECK(ts.tv_sec == 1 + 0x100000000LL * (1 + (NTP_ERA_SPLIT - 1) / 0x100000000LL));
+#else
+  TEST_CHECK(ts.tv_sec == 1);
+#endif
+  TEST_CHECK(ts.tv_nsec == 0);
+
+  ntp_fuzz.hi = 0;
+  ntp_fuzz.lo = htonl(0xff1234ff);
+
+  UTI_TimespecToNtp64(&ts, &ntp_ts, &ntp_fuzz);
+  TEST_CHECK(ntp_ts.hi == htonl(JAN_1970 + 1));
+  TEST_CHECK(ntp_ts.lo == ntp_fuzz.lo);
+
+  ts.tv_sec = ts.tv_nsec = 1;
+  UTI_ZeroTimespec(&ts);
+  TEST_CHECK(ts.tv_sec == 0);
+  TEST_CHECK(ts.tv_nsec == 0);
+  TEST_CHECK(UTI_IsZeroTimespec(&ts));
+
+  ntp_ts.hi = ntp_ts.lo == 1;
+  UTI_ZeroNtp64(&ntp_ts);
+  TEST_CHECK(ntp_ts.hi == 0);
+  TEST_CHECK(ntp_ts.lo == 0);
+
+  tv.tv_sec = tv.tv_usec = 1;
+  UTI_TimevalToTimespec(&tv, &ts);
+  TEST_CHECK(ts.tv_sec == 1);
+  TEST_CHECK(ts.tv_nsec == 1000);
+
+  UTI_TimespecToTimeval(&ts, &tv);
+  TEST_CHECK(tv.tv_sec == 1);
+  TEST_CHECK(tv.tv_usec == 1);
+
+  ts.tv_sec = 1;
+  ts.tv_nsec = 500000000;
+  TEST_CHECK(fabs(UTI_TimespecToDouble(&ts) - 1.5) < 1.0e-15);
+
+  UTI_DoubleToTimespec(2.75, &ts);
+  TEST_CHECK(ts.tv_sec == 2);
+  TEST_CHECK(ts.tv_nsec == 750000000);
+
+  ts.tv_sec = 1;
+  ts.tv_nsec = 1200000000;
+  UTI_NormaliseTimespec(&ts);
+  TEST_CHECK(ts.tv_sec == 2);
+  TEST_CHECK(ts.tv_nsec == 200000000);
+
+  ts.tv_sec = 1;
+  ts.tv_nsec = -200000000;
+  UTI_NormaliseTimespec(&ts);
+  TEST_CHECK(ts.tv_sec == 0);
+  TEST_CHECK(ts.tv_nsec == 800000000);
+
+  tv.tv_sec = 1;
+  tv.tv_usec = 500000;
+  TEST_CHECK(fabs(UTI_TimevalToDouble(&tv) - 1.5) < 1.0e-15);
+
+  UTI_DoubleToTimeval(2.75, &tv);
+  TEST_CHECK(tv.tv_sec == 2);
+  TEST_CHECK(tv.tv_usec == 750000);
+
+  tv.tv_sec = 1;
+  tv.tv_usec = 1200000;
+  UTI_NormaliseTimeval(&tv);
+  TEST_CHECK(tv.tv_sec == 2);
+  TEST_CHECK(tv.tv_usec == 200000);
+
+  tv.tv_sec = 1;
+  tv.tv_usec = -200000;
+  UTI_NormaliseTimeval(&tv);
+  TEST_CHECK(tv.tv_sec == 0);
+  TEST_CHECK(tv.tv_usec == 800000);
+
+  UTI_ZeroTimespec(&ts);
+  UTI_TimespecToNtp64(&ts, &ntp_ts, &ntp_fuzz);
+  TEST_CHECK(ntp_ts.hi == 0);
+  TEST_CHECK(ntp_ts.lo == 0);
+
+  TEST_CHECK(UTI_IsZeroNtp64(&ntp_ts));
+
+  ts.tv_sec = 1;
+  ntp_ts.hi = htonl(1);
+
+  TEST_CHECK(!UTI_IsZeroTimespec(&ts));
+  TEST_CHECK(!UTI_IsZeroNtp64(&ntp_ts));
+
+  ts.tv_sec = 0;
+  ntp_ts.hi = 0;
+  ts.tv_nsec = 1;
+  ntp_ts.lo = htonl(1);
+
+  TEST_CHECK(!UTI_IsZeroTimespec(&ts));
+  TEST_CHECK(!UTI_IsZeroNtp64(&ntp_ts));
+
+  ntp_ts.hi = 0;
+  ntp_ts.lo = 0;
+
+  UTI_Ntp64ToTimespec(&ntp_ts, &ts);
+  TEST_CHECK(UTI_IsZeroTimespec(&ts));
+  UTI_TimespecToNtp64(&ts, &ntp_ts, NULL);
+  TEST_CHECK(UTI_IsZeroNtp64(&ntp_ts));
+
+  ntp_fuzz.hi = htonl(1);
+  ntp_fuzz.lo = htonl(3);
+  ntp_ts.hi = htonl(1);
+  ntp_ts.lo = htonl(2);
+
+  TEST_CHECK(UTI_CompareNtp64(&ntp_ts, &ntp_ts) == 0);
+  TEST_CHECK(UTI_CompareNtp64(&ntp_ts, &ntp_fuzz) < 0);
+  TEST_CHECK(UTI_CompareNtp64(&ntp_fuzz, &ntp_ts) > 0);
+
+  ntp_ts.hi = htonl(0x80000002);
+  ntp_ts.lo = htonl(2);
+
+  TEST_CHECK(UTI_CompareNtp64(&ntp_ts, &ntp_ts) == 0);
+  TEST_CHECK(UTI_CompareNtp64(&ntp_ts, &ntp_fuzz) < 0);
+  TEST_CHECK(UTI_CompareNtp64(&ntp_fuzz, &ntp_ts) > 0);
+
+  ntp_fuzz.hi = htonl(0x90000001);
+
+  TEST_CHECK(UTI_CompareNtp64(&ntp_ts, &ntp_ts) == 0);
+  TEST_CHECK(UTI_CompareNtp64(&ntp_ts, &ntp_fuzz) < 0);
+  TEST_CHECK(UTI_CompareNtp64(&ntp_fuzz, &ntp_ts) > 0);
+
+  TEST_CHECK(UTI_IsEqualAnyNtp64(&ntp_ts, &ntp_ts, NULL, NULL));
+  TEST_CHECK(UTI_IsEqualAnyNtp64(&ntp_ts, NULL, &ntp_ts, NULL));
+  TEST_CHECK(UTI_IsEqualAnyNtp64(&ntp_ts, NULL, NULL, &ntp_ts));
+  TEST_CHECK(!UTI_IsEqualAnyNtp64(&ntp_ts, &ntp_fuzz, &ntp_fuzz, &ntp_fuzz));
+
+  ntp_ts.hi = htonl(0);
+  ntp_ts.lo = htonl(0);
+  x = UTI_Ntp64ToDouble(&ntp_ts);
+  TEST_CHECK(fabs(x) < 1e-10);
+  UTI_DoubleToNtp64(x, &ntp_ts2);
+  TEST_CHECK(UTI_CompareNtp64(&ntp_ts, &ntp_ts2) == 0);
+
+  ntp_ts.hi = htonl(0);
+  ntp_ts.lo = htonl(0xffffffff);
+  x = UTI_Ntp64ToDouble(&ntp_ts);
+  TEST_CHECK(fabs(x - 1.0 + 0.23e-9) < 1e-10);
+  UTI_DoubleToNtp64(x, &ntp_ts2);
+  TEST_CHECK(fabs(UTI_DiffNtp64ToDouble(&ntp_ts, &ntp_ts2)) < 0.3e-9);
+
+  ntp_ts.hi = htonl(0xffffffff);
+  ntp_ts.lo = htonl(0xffffffff);
+  x = UTI_Ntp64ToDouble(&ntp_ts);
+  TEST_CHECK(fabs(x + 0.23e-9) < 1e-10);
+  UTI_DoubleToNtp64(x, &ntp_ts2);
+  TEST_CHECK(fabs(UTI_DiffNtp64ToDouble(&ntp_ts, &ntp_ts2)) < 0.3e-9);
+
+  ntp_ts.hi = htonl(0x80000000);
+  ntp_ts.lo = htonl(0);
+  x = UTI_Ntp64ToDouble(&ntp_ts);
+  TEST_CHECK(fabs(x + 0x80000000) < 1e-10);
+  UTI_DoubleToNtp64(x, &ntp_ts2);
+  TEST_CHECK(fabs(UTI_DiffNtp64ToDouble(&ntp_ts, &ntp_ts2)) < 0.3e-9);
+
+  ntp_ts.hi = htonl(0x7fffffff);
+  ntp_ts.lo = htonl(0xffffffff);
+  x = UTI_Ntp64ToDouble(&ntp_ts);
+  TEST_CHECK(fabs(x - 2147483648) < 1.0);
+
+  ntp_ts.lo = htonl(0);
+  ntp_ts.hi = htonl(0x7fffffff);
+  UTI_DoubleToNtp64(0x7fffffff + 0.1, &ntp_ts2);
+  TEST_CHECK(UTI_CompareNtp64(&ntp_ts, &ntp_ts2) == 0);
+  ntp_ts.hi = htonl(0x80000000);
+  UTI_DoubleToNtp64(0x80000000 - 0.1, &ntp_ts);
+  TEST_CHECK(UTI_CompareNtp64(&ntp_ts, &ntp_ts2) == 0);
+
+  ts.tv_sec = 1;
+  ts.tv_nsec = 2;
+  ts2.tv_sec = 1;
+  ts2.tv_nsec = 3;
+
+  TEST_CHECK(UTI_CompareTimespecs(&ts, &ts) == 0);
+  TEST_CHECK(UTI_CompareTimespecs(&ts, &ts2) < 0);
+  TEST_CHECK(UTI_CompareTimespecs(&ts2, &ts) > 0);
+
+  ts2.tv_sec = 2;
+
+  TEST_CHECK(UTI_CompareTimespecs(&ts, &ts) == 0);
+  TEST_CHECK(UTI_CompareTimespecs(&ts, &ts2) < 0);
+  TEST_CHECK(UTI_CompareTimespecs(&ts2, &ts) > 0);
+
+  ts.tv_sec = 2;
+  ts.tv_nsec = 250000000;
+  ts2.tv_sec = 1;
+  ts2.tv_nsec = 750000000;
+  UTI_DiffTimespecs(&ts3, &ts, &ts2);
+  TEST_CHECK(ts3.tv_sec == 0);
+  TEST_CHECK(ts3.tv_nsec == 500000000);
+  TEST_CHECK(fabs(UTI_DiffTimespecsToDouble(&ts, &ts2) - 0.5) < 1.0e-15);
+
+  ts.tv_sec = 2;
+  ts.tv_nsec = 250000000;
+  ts2.tv_sec = 3;
+  ts2.tv_nsec = 750000000;
+  UTI_DiffTimespecs(&ts3, &ts, &ts2);
+  TEST_CHECK(ts3.tv_sec == -2);
+  TEST_CHECK(ts3.tv_nsec == 500000000);
+  TEST_CHECK(fabs(UTI_DiffTimespecsToDouble(&ts, &ts2) - -1.5) < 1.0e-15);
+
+  ts.tv_sec = 2;
+  ts.tv_nsec = 250000000;
+  UTI_AddDoubleToTimespec(&ts, 2.5, &ts2);
+  TEST_CHECK(ts2.tv_sec == 4);
+  TEST_CHECK(ts2.tv_nsec == 750000000);
+
+  ts.tv_sec = 4;
+  ts.tv_nsec = 500000000;
+  ts2.tv_sec = 1;
+  ts2.tv_nsec = 750000000;
+  UTI_AverageDiffTimespecs(&ts, &ts2, &ts3, &x);
+  TEST_CHECK(ts3.tv_sec == 3);
+  TEST_CHECK(ts3.tv_nsec == 125000000);
+  TEST_CHECK(x == -2.75);
+
+  ts.tv_sec = 4;
+  ts.tv_nsec = 500000000;
+  ts2.tv_sec = 1;
+  ts2.tv_nsec = 750000000;
+  ts3.tv_sec = 5;
+  ts3.tv_nsec = 250000000;
+  UTI_AddDiffToTimespec(&ts, &ts2, &ts3, &ts4);
+  TEST_CHECK(ts4.tv_sec == 8);
+  TEST_CHECK(ts4.tv_nsec == 0);
+
+  ts.tv_sec = 1600000000;
+  ts.tv_nsec = 123;
+  s = UTI_TimespecToString(&ts);
+  TEST_CHECK(strcmp(s, "1600000000.000000123") == 0);
+
+  ntp_ts.hi = 1;
+  ntp_ts.hi = 2;
+  UTI_Ntp64ToTimespec(&ntp_ts, &ts);
+  s = UTI_Ntp64ToString(&ntp_ts);
+  s2 = UTI_TimespecToString(&ts);
+  TEST_CHECK(strcmp(s, s2) == 0);
+
+  s = UTI_RefidToString(0x41424344);
+  TEST_CHECK(strcmp(s, "ABCD") == 0);
+
+  ip.family = IPADDR_UNSPEC;
+  s = UTI_IPToString(&ip);
+  TEST_CHECK(strcmp(s, "[UNSPEC]") == 0);
+  TEST_CHECK(UTI_IPToRefid(&ip) == 0);
+  TEST_CHECK(UTI_IPToHash(&ip) == UTI_IPToHash(&ip));
+
+  ip.family = IPADDR_INET4;
+  ip.addr.in4 = 0x7f010203;
+  s = UTI_IPToString(&ip);
+  TEST_CHECK(strcmp(s, "127.1.2.3") == 0);
+  TEST_CHECK(UTI_IPToRefid(&ip) == 0x7f010203);
+  TEST_CHECK(UTI_IPToHash(&ip) == UTI_IPToHash(&ip));
+
+  ip.family = IPADDR_INET6;
+  memset(&ip.addr.in6, 0, sizeof (ip.addr.in6));
+  ip.addr.in6[0] = 0xab;
+  ip.addr.in6[15] = 0xcd;
+  s = UTI_IPToString(&ip);
+#ifdef FEAT_IPV6
+  TEST_CHECK(strcmp(s, "ab00::cd") == 0);
+#else
+  TEST_CHECK(strcmp(s, "ab00:0000:0000:0000:0000:0000:0000:00cd") == 0);
+#endif
+  TEST_CHECK(UTI_IPToRefid(&ip) == 0x5f9aa602);
+  TEST_CHECK(UTI_IPToHash(&ip) == UTI_IPToHash(&ip));
+
+  ip.family = IPADDR_ID;
+  ip.addr.id = 12345;
+  s = UTI_IPToString(&ip);
+  TEST_CHECK(strcmp(s, "ID#0000012345") == 0);
+  TEST_CHECK(UTI_IPToRefid(&ip) == 0);
+  TEST_CHECK(UTI_IPToHash(&ip) == UTI_IPToHash(&ip));
+
+  ip.family = IPADDR_UNSPEC + 10;
+  s = UTI_IPToString(&ip);
+  TEST_CHECK(strcmp(s, "[UNKNOWN]") == 0);
+  TEST_CHECK(UTI_IPToRefid(&ip) == 0);
+  TEST_CHECK(UTI_IPToHash(&ip) == UTI_IPToHash(&ip));
+
+  TEST_CHECK(UTI_StringToIP("200.4.5.6", &ip));
+  TEST_CHECK(ip.family == IPADDR_INET4);
+  TEST_CHECK(ip.addr.in4 == 0xc8040506);
+
+#ifdef FEAT_IPV6
+  TEST_CHECK(UTI_StringToIP("1234::7890", &ip));
+  TEST_CHECK(ip.family == IPADDR_INET6);
+  TEST_CHECK(ip.addr.in6[0] == 0x12 && ip.addr.in6[1] == 0x34);
+  TEST_CHECK(ip.addr.in6[2] == 0x00 && ip.addr.in6[13] == 0x00);
+  TEST_CHECK(ip.addr.in6[14] == 0x78 && ip.addr.in6[15] == 0x90);
+#else
+  TEST_CHECK(!UTI_StringToIP("1234::7890", &ip));
+#endif
+
+  TEST_CHECK(!UTI_StringToIP("ID#0000012345", &ip));
+
+  TEST_CHECK(UTI_IsStringIP("1.2.3.4"));
+  TEST_CHECK(!UTI_IsStringIP("127.3.3"));
+  TEST_CHECK(!UTI_IsStringIP("127.3"));
+  TEST_CHECK(!UTI_IsStringIP("127"));
+#ifdef FEAT_IPV6
+  TEST_CHECK(UTI_IsStringIP("1234:5678::aaaa"));
+#else
+  TEST_CHECK(!UTI_IsStringIP("1234:5678::aaaa"));
+#endif
+  TEST_CHECK(!UTI_StringToIP("ID#0000012345", &ip));
+
+  TEST_CHECK(!UTI_StringToIdIP("1.2.3.4", &ip));
+  TEST_CHECK(UTI_StringToIdIP("ID#0000056789", &ip));
+  TEST_CHECK(ip.family == IPADDR_ID);
+  TEST_CHECK(ip.addr.id == 56789);
+
+  for (i = IPADDR_UNSPEC; i <= IPADDR_ID + 1; i++) {
+    ip.family = i;
+    TEST_CHECK(UTI_IsIPReal(&ip) == (i == IPADDR_INET4 || i == IPADDR_INET6));
+  }
+
+  ip.family = IPADDR_UNSPEC;
+  UTI_IPHostToNetwork(&ip, &ip2);
+  TEST_CHECK(ip2.family == htons(IPADDR_UNSPEC));
+  UTI_IPNetworkToHost(&ip2, &ip3);
+  TEST_CHECK(ip3.family == IPADDR_UNSPEC);
+
+  ip.family = IPADDR_INET4;
+  ip.addr.in4 = 0x12345678;
+  UTI_IPHostToNetwork(&ip, &ip2);
+  TEST_CHECK(ip2.family == htons(IPADDR_INET4));
+  TEST_CHECK(ip2.addr.in4 == htonl(0x12345678));
+  UTI_IPNetworkToHost(&ip2, &ip3);
+  TEST_CHECK(ip3.family == IPADDR_INET4);
+  TEST_CHECK(ip3.addr.in4 == 0x12345678);
+
+  ip.family = IPADDR_INET6;
+  for (i = 0; i < 16; i++)
+    ip.addr.in6[i] = i;
+  UTI_IPHostToNetwork(&ip, &ip2);
+  TEST_CHECK(ip2.family == htons(IPADDR_INET6));
+  for (i = 0; i < 16; i++)
+    TEST_CHECK(ip.addr.in6[i] == i);
+  UTI_IPNetworkToHost(&ip2, &ip3);
+  TEST_CHECK(ip3.family == IPADDR_INET6);
+  for (i = 0; i < 16; i++)
+    TEST_CHECK(ip.addr.in6[i] == i);
+
+  ip.family = IPADDR_ID;
+  ip.addr.in4 = 0x87654321;
+  UTI_IPHostToNetwork(&ip, &ip2);
+  TEST_CHECK(ip2.family == htons(IPADDR_ID));
+  TEST_CHECK(ip2.addr.in4 == htonl(0x87654321));
+  UTI_IPNetworkToHost(&ip2, &ip3);
+  TEST_CHECK(ip3.family == IPADDR_ID);
+  TEST_CHECK(ip3.addr.in4 == 0x87654321);
+
+  for (i = 0; i < 16; i++)
+    ip.addr.in6[i] = 0x80;
+  ip2 = ip;
+
+  for (i = IPADDR_UNSPEC; i <= IPADDR_ID; i++) {
+    ip.family = i;
+    ip2.family = i + 1;
+    TEST_CHECK(UTI_CompareIPs(&ip, &ip2, NULL) < 0);
+    TEST_CHECK(UTI_CompareIPs(&ip2, &ip, NULL) > 0);
+    ip2 = ip;
+    ip2.addr.in4++;
+    if (i == IPADDR_UNSPEC) {
+      TEST_CHECK(UTI_CompareIPs(&ip, &ip2, NULL) == 0);
+      TEST_CHECK(UTI_CompareIPs(&ip, &ip2, &ip) == 0);
+    } else {
+      TEST_CHECK(UTI_CompareIPs(&ip, &ip2, NULL) < 0);
+      TEST_CHECK(UTI_CompareIPs(&ip2, &ip, NULL) > 0);
+      if (i == IPADDR_ID) {
+        TEST_CHECK(UTI_CompareIPs(&ip, &ip2, &ip) < 0);
+        TEST_CHECK(UTI_CompareIPs(&ip, &ip2, &ip2) < 0);
+      } else {
+        TEST_CHECK(UTI_CompareIPs(&ip, &ip2, &ip) == 0);
+        TEST_CHECK(UTI_CompareIPs(&ip, &ip2, &ip2) < 0);
+      }
+    }
+  }
+
+  ip_saddr.ip_addr.family = IPADDR_INET4;
+  ip_saddr.ip_addr.addr.in4 = 0x01020304;
+  ip_saddr.port = 12345;
+  s = UTI_IPSockAddrToString(&ip_saddr);
+  TEST_CHECK(strcmp(s, "1.2.3.4:12345") == 0);
+
+  ip = ip_saddr.ip_addr;
+  s = UTI_IPSubnetToString(&ip, 10);
+  TEST_CHECK(strcmp(s, "1.2.3.4/10") == 0);
+  s = UTI_IPSubnetToString(&ip, 32);
+  TEST_CHECK(strcmp(s, "1.2.3.4") == 0);
+  ip.family = IPADDR_UNSPEC;
+  s = UTI_IPSubnetToString(&ip, 0);
+  TEST_CHECK(strcmp(s, "any address") == 0);
+
+  s = UTI_TimeToLogForm(2000000000);
+  TEST_CHECK(strcmp(s, "2033-05-18 03:33:20") == 0);
+
+  ts.tv_sec = 3;
+  ts.tv_nsec = 500000000;
+  ts2.tv_sec = 4;
+  ts2.tv_nsec = 250000000;
+  UTI_AdjustTimespec(&ts, &ts2, &ts3, &x, 2.0, -5.0);
+  TEST_CHECK(fabs(x - 6.5) < 1.0e-15);
+  TEST_CHECK((ts3.tv_sec == 10 && ts3.tv_nsec == 0) ||
+             (ts3.tv_sec == 9 && ts3.tv_nsec == 999999999));
+
+  for (i = -32; i <= 32; i++) {
+    for (j = c = 0; j < 1000; j++) {
+      UTI_GetNtp64Fuzz(&ntp_fuzz, i);
+      if (i <= 0)
+        TEST_CHECK(ntp_fuzz.hi == 0);
+      if (i < 0)
+        TEST_CHECK(ntohl(ntp_fuzz.lo) < 1U << (32 + i));
+      else if (i < 32)
+        TEST_CHECK(ntohl(ntp_fuzz.hi) < 1U << i);
+      if (ntohl(ntp_fuzz.lo) >= 1U << (31 + CLAMP(-31, i, 0)))
+        c++;
+    }
+
+    if (i == -32)
+      TEST_CHECK(c == 0);
+    else
+      TEST_CHECK(c > 400 && c < 600);
+  }
+
+  TEST_CHECK(UTI_DoubleToNtp32(-1.0) == htonl(0));
+  TEST_CHECK(UTI_DoubleToNtp32(0.0) == htonl(0));
+  TEST_CHECK(UTI_DoubleToNtp32(1e-9) == htonl(1));
+  TEST_CHECK(UTI_DoubleToNtp32(32768.0) == htonl(0x80000000));
+  TEST_CHECK(UTI_DoubleToNtp32(65536.0) == htonl(0xffffffff));
+  TEST_CHECK(UTI_DoubleToNtp32(65537.0) == htonl(0xffffffff));
+
+  TEST_CHECK(UTI_DoubleToNtp32f28(-1.0) == htonl(0));
+  TEST_CHECK(UTI_DoubleToNtp32f28(0.0) == htonl(0));
+  TEST_CHECK(UTI_DoubleToNtp32f28(1e-9) == htonl(1));
+  TEST_CHECK(UTI_DoubleToNtp32f28(4e-9) == htonl(2));
+  TEST_CHECK(UTI_DoubleToNtp32f28(8.0) == htonl(0x80000000));
+  TEST_CHECK(UTI_DoubleToNtp32f28(16.0) == htonl(0xffffffff));
+  TEST_CHECK(UTI_DoubleToNtp32f28(16.1) == htonl(0xffffffff));
+  TEST_CHECK(UTI_DoubleToNtp32f28(16.1) == htonl(0xffffffff));
+
+  TEST_CHECK(UTI_Ntp32f28ToDouble(htonl(0xffffffff)) >= 65535.999);
+  for (i = 0; i < 100000; i++) {
+    UTI_GetRandomBytes(&ntp32_ts, sizeof (ntp32_ts));
+    TEST_CHECK(UTI_DoubleToNtp32(UTI_Ntp32ToDouble(ntp32_ts)) == ntp32_ts);
+    TEST_CHECK(UTI_DoubleToNtp32f28(UTI_Ntp32f28ToDouble(ntp32_ts)) == ntp32_ts);
+  }
+
+  ts.tv_nsec = 0;
+
+  ts.tv_sec = 10;
+  TEST_CHECK(!UTI_IsTimeOffsetSane(&ts, -20.0));
+
+#ifdef HAVE_LONG_TIME_T
+  ts.tv_sec = NTP_ERA_SPLIT + (1LL << 32);
+#else
+  ts.tv_sec = 0x7fffffff - MIN_ENDOFTIME_DISTANCE;
+#endif
+  TEST_CHECK(!UTI_IsTimeOffsetSane(&ts, 10.0));
+  TEST_CHECK(UTI_IsTimeOffsetSane(&ts, -20.0));
+
+  TEST_CHECK(UTI_Log2ToDouble(-1) == 0.5);
+  TEST_CHECK(UTI_Log2ToDouble(0) == 1.0);
+  TEST_CHECK(UTI_Log2ToDouble(1) == 2.0);
+  TEST_CHECK(UTI_Log2ToDouble(-31) < UTI_Log2ToDouble(-30));
+  TEST_CHECK(UTI_Log2ToDouble(-32) == UTI_Log2ToDouble(-31));
+  TEST_CHECK(UTI_Log2ToDouble(30) < UTI_Log2ToDouble(32));
+  TEST_CHECK(UTI_Log2ToDouble(31) == UTI_Log2ToDouble(32));
+
+  UTI_TimespecHostToNetwork(&ts, &tspec);
+#ifdef HAVE_LONG_TIME_T
+  TEST_CHECK(tspec.tv_sec_high == htonl(ts.tv_sec >> 32));
+#else
+  TEST_CHECK(tspec.tv_sec_high == htonl(TV_NOHIGHSEC));
+#endif
+  TEST_CHECK(tspec.tv_sec_low == htonl(ts.tv_sec));
+  TEST_CHECK(tspec.tv_nsec == htonl(ts.tv_nsec));
+  UTI_TimespecNetworkToHost(&tspec, &ts2);
+  TEST_CHECK(!UTI_CompareTimespecs(&ts, &ts2));
+
+  integer64 = UTI_Integer64HostToNetwork(0x1234567890ABCDEFULL);
+  TEST_CHECK(memcmp(&integer64, "\x12\x34\x56\x78\x90\xab\xcd\xef", 8) == 0);
+  TEST_CHECK(UTI_Integer64NetworkToHost(integer64) == 0x1234567890ABCDEFULL);
+
+  TEST_CHECK(UTI_CmacNameToAlgorithm("AES128") == CMC_AES128);
+  TEST_CHECK(UTI_CmacNameToAlgorithm("AES256") == CMC_AES256);
+  TEST_CHECK(UTI_CmacNameToAlgorithm("NOSUCHCMAC") == CMC_INVALID);
+
+  TEST_CHECK(UTI_HashNameToAlgorithm("MD5") == HSH_MD5);
+  TEST_CHECK(UTI_HashNameToAlgorithm("SHA1") == HSH_SHA1);
+  TEST_CHECK(UTI_HashNameToAlgorithm("SHA256") == HSH_SHA256);
+  TEST_CHECK(UTI_HashNameToAlgorithm("SHA384") == HSH_SHA384);
+  TEST_CHECK(UTI_HashNameToAlgorithm("SHA512") == HSH_SHA512);
+  TEST_CHECK(UTI_HashNameToAlgorithm("SHA3-224") == HSH_SHA3_224);
+  TEST_CHECK(UTI_HashNameToAlgorithm("SHA3-256") == HSH_SHA3_256);
+  TEST_CHECK(UTI_HashNameToAlgorithm("SHA3-384") == HSH_SHA3_384);
+  TEST_CHECK(UTI_HashNameToAlgorithm("SHA3-512") == HSH_SHA3_512);
+  TEST_CHECK(UTI_HashNameToAlgorithm("TIGER") == HSH_TIGER);
+  TEST_CHECK(UTI_HashNameToAlgorithm("WHIRLPOOL") == HSH_WHIRLPOOL);
+  TEST_CHECK(UTI_HashNameToAlgorithm("NOSUCHHASH") == HSH_INVALID);
+
+  i = open("/dev/null", 0);
+  TEST_CHECK(UTI_FdSetCloexec(i));
+  j = fcntl(i, F_GETFD);
+  TEST_CHECK(j & F_GETFD);
+  close(i);
+
+  UTI_SetQuitSignalsHandler(handle_signal, 0);
+  TEST_CHECK(handled_signal == 0);
+  kill(getpid(), SIGPIPE);
+  while (handled_signal == 0)
+    ;
+  TEST_CHECK(handled_signal == SIGPIPE);
+
+  s = UTI_PathToDir("/aaa/bbb/ccc/ddd");
+  TEST_CHECK(!strcmp(s, "/aaa/bbb/ccc"));
+  Free(s);
+  s = UTI_PathToDir("aaa");
+  TEST_CHECK(!strcmp(s, "."));
+  Free(s);
+  s = UTI_PathToDir("/aaaa");
+  TEST_CHECK(!strcmp(s, "/"));
+  Free(s);
+
+  nan = strtod("nan", NULL);
+  inf = strtod("inf", NULL);
+
+  TEST_CHECK(MIN(2.0, -1.0) == -1.0);
+  TEST_CHECK(MIN(-1.0, 2.0) == -1.0);
+  TEST_CHECK(MIN(inf, 2.0) == 2.0);
+
+  TEST_CHECK(MAX(2.0, -1.0) == 2.0);
+  TEST_CHECK(MAX(-1.0, 2.0) == 2.0);
+  TEST_CHECK(MAX(inf, 2.0) == inf);
+
+  TEST_CHECK(CLAMP(1.0, -1.0, 2.0) == 1.0);
+  TEST_CHECK(CLAMP(1.0, 3.0, 2.0) == 2.0);
+  TEST_CHECK(CLAMP(1.0, inf, 2.0) == 2.0);
+  TEST_CHECK(CLAMP(1.0, nan, 2.0) == 2.0);
+
+  TEST_CHECK(SQUARE(3.0) == 3.0 * 3.0);
+
+  rmdir("testdir");
+
+  uid = geteuid();
+  gid = getegid();
+
+  TEST_CHECK(UTI_CreateDirAndParents("testdir", 0700, uid, gid));
+
+  TEST_CHECK(UTI_CheckDirPermissions("testdir", 0700, uid, gid));
+  TEST_CHECK(!UTI_CheckDirPermissions("testdir", 0300, uid, gid));
+  TEST_CHECK(!UTI_CheckDirPermissions("testdir", 0700, uid + 1, gid));
+  TEST_CHECK(!UTI_CheckDirPermissions("testdir", 0700, uid, gid + 1));
+
+  umask(0);
+
+  unlink("testfile");
+  file = UTI_OpenFile(NULL, "testfile", NULL, 'r', 0);
+  TEST_CHECK(!file);
+  TEST_CHECK(stat("testfile", &st) < 0);
+
+  file = UTI_OpenFile(NULL, "testfile", NULL, 'w', 0644);
+  TEST_CHECK(file);
+  TEST_CHECK(stat("testfile", &st) == 0);
+  TEST_CHECK((st.st_mode & 0777) == 0644);
+  fclose(file);
+
+  file = UTI_OpenFile(".", "test", "file", 'W', 0640);
+  TEST_CHECK(file);
+  TEST_CHECK(stat("testfile", &st) == 0);
+  TEST_CHECK((st.st_mode & 0777) == 0640);
+  fclose(file);
+
+  file = UTI_OpenFile(NULL, "test", "file", 'r', 0);
+  TEST_CHECK(file);
+  fclose(file);
+
+  TEST_CHECK(UTI_RenameTempFile(NULL, "testfil", "e", NULL));
+  TEST_CHECK(stat("testfil", &st) == 0);
+  file = UTI_OpenFile(NULL, "testfil", NULL, 'R', 0);
+  TEST_CHECK(file);
+  fclose(file);
+
+  TEST_CHECK(UTI_RenameTempFile(NULL, "test", "fil", "file"));
+  TEST_CHECK(stat("testfile", &st) == 0);
+  file = UTI_OpenFile(NULL, "testfile", NULL, 'R', 0);
+  TEST_CHECK(file);
+  fclose(file);
+
+  TEST_CHECK(UTI_RemoveFile(NULL, "testfile", NULL));
+  TEST_CHECK(stat("testfile", &st) < 0);
+  TEST_CHECK(!UTI_RemoveFile(NULL, "testfile", NULL));
+
+  for (i = c = 0; i < 100000; i++) {
+    j = random() % (sizeof (buf) + 1);
+    UTI_GetRandomBytesUrandom(buf, j);
+    if (j && buf[j - 1] % 2)
+      c++;
+    if (random() % 10000 == 0) {
+      UTI_ResetGetRandomFunctions();
+      TEST_CHECK(!urandom_file);
+    }
+  }
+  TEST_CHECK(c > 46000 && c < 48000);
+
+  for (i = c = 0; i < 100000; i++) {
+    j = random() % (sizeof (buf) + 1);
+    UTI_GetRandomBytes(buf, j);
+    if (j && buf[j - 1] % 2)
+      c++;
+    if (random() % 10000 == 0) {
+      UTI_ResetGetRandomFunctions();
+#if HAVE_GETRANDOM
+      TEST_CHECK(getrandom_buf_available == 0);
+#endif
+    }
+  }
+  TEST_CHECK(c > 46000 && c < 48000);
+
+  assert(sizeof (buf) >= 16);
+  TEST_CHECK(UTI_HexToBytes("", buf, sizeof (buf)) == 0);
+  TEST_CHECK(UTI_HexToBytes("0", buf, sizeof (buf)) == 0);
+  TEST_CHECK(UTI_HexToBytes("00123456789ABCDEF", buf, sizeof (buf)) == 0);
+  TEST_CHECK(UTI_HexToBytes("00123456789ABCDEF0", buf, 8) == 0);
+  TEST_CHECK(UTI_HexToBytes("00123456789ABCDEF0", buf, sizeof (buf)) == 9);
+  TEST_CHECK(memcmp(buf, "\x00\x12\x34\x56\x78\x9A\xBC\xDE\xF0", 9) == 0);
+  memcpy(buf, "AB123456780001", 15);
+  TEST_CHECK(UTI_HexToBytes(buf, buf, sizeof (buf)) == 7);
+  TEST_CHECK(memcmp(buf, "\xAB\x12\x34\x56\x78\x00\x01", 7) == 0);
+
+  TEST_CHECK(UTI_BytesToHex("", 0, buf, 0) == 0);
+  TEST_CHECK(UTI_BytesToHex("\xAB\x12\x34\x56\x78\x00\x01", 7, buf, 14) == 0);
+  TEST_CHECK(UTI_BytesToHex("\xAB\x12\x34\x56\x78\x00\x01", 7, buf, 15) == 1);
+  TEST_CHECK(strcmp(buf, "AB123456780001") == 0);
+  TEST_CHECK(UTI_BytesToHex("\xAB\x12\x34\x56\x78\x00\x01", 0, buf, 15) == 1);
+  TEST_CHECK(strcmp(buf, "") == 0);
+
+  TEST_CHECK(snprintf(buf, sizeof (buf), "%s", "") < sizeof (buf));
+  TEST_CHECK(UTI_SplitString(buf, words, 3) == 0);
+  TEST_CHECK(!words[0]);
+  TEST_CHECK(snprintf(buf, sizeof (buf), "%s", "     ") < sizeof (buf));
+  TEST_CHECK(UTI_SplitString(buf, words, 3) == 0);
+  TEST_CHECK(!words[0]);
+  TEST_CHECK(snprintf(buf, sizeof (buf), "%s", "a  \n ") < sizeof (buf));
+  TEST_CHECK(UTI_SplitString(buf, words, 3) == 1);
+  TEST_CHECK(words[0] == buf + 0);
+  TEST_CHECK(strcmp(words[0], "a") == 0);
+  TEST_CHECK(snprintf(buf, sizeof (buf), "%s", "  a  ") < sizeof (buf));
+  TEST_CHECK(UTI_SplitString(buf, words, 3) == 1);
+  TEST_CHECK(words[0] == buf + 2);
+  TEST_CHECK(strcmp(words[0], "a") == 0);
+  TEST_CHECK(snprintf(buf, sizeof (buf), "%s", " \n  a") < sizeof (buf));
+  TEST_CHECK(UTI_SplitString(buf, words, 3) == 1);
+  TEST_CHECK(words[0] == buf + 4);
+  TEST_CHECK(strcmp(words[0], "a") == 0);
+  TEST_CHECK(snprintf(buf, sizeof (buf), "%s", "a   b") < sizeof (buf));
+  TEST_CHECK(UTI_SplitString(buf, words, 1) == 2);
+  TEST_CHECK(snprintf(buf, sizeof (buf), "%s", "a   b") < sizeof (buf));
+  TEST_CHECK(UTI_SplitString(buf, words, 2) == 2);
+  TEST_CHECK(words[0] == buf + 0);
+  TEST_CHECK(words[1] == buf + 4);
+  TEST_CHECK(strcmp(words[0], "a") == 0);
+  TEST_CHECK(strcmp(words[1], "b") == 0);
+  TEST_CHECK(snprintf(buf, sizeof (buf), "%s", " a b ") < sizeof (buf));
+  TEST_CHECK(UTI_SplitString(buf, words, 3) == 2);
+  TEST_CHECK(words[0] == buf + 1);
+  TEST_CHECK(words[1] == buf + 3);
+  TEST_CHECK(strcmp(words[0], "a") == 0);
+  TEST_CHECK(strcmp(words[1], "b") == 0);
+
+  HSH_Finalise();
+}