n_network.c

Go to the documentation of this file.

/*
 * Nilorea Library
 * Copyright (C) 2005-2026 Castagnier Mickael
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
 * implied. See the License for the specific language governing
 * permissions and limitations under the License.
 *
 * SPDX-License-Identifier: Apache-2.0
 */
 
#include <errno.h>
#include <limits.h>
#include <stdarg.h>
#include <pthread.h>
#include <unistd.h>
#include <string.h>
#include <ctype.h>
#include <sys/types.h>
 
#include "nilorea/n_network.h"
#include "nilorea/n_network_msg.h"
#include "nilorea/n_reactor.h"
#include "nilorea/n_log.h"
#include "nilorea/n_hash.h"
#include "nilorea/n_base64.h"
#include "nilorea/n_zlib.h"
#include "nilorea/n_lz4.h"
#include "nilorea/n_time.h"
 
/* Opportunistic payload compression. Threshold and ratio knobs live
 * in nilorea/n_network.h so the reactor send path shares them. */
 
/* MinGW does not provide strndup */
#ifdef __windows__
static char* _n_strndup(const char* s, size_t n) {
    size_t len = strlen(s);
    if (n < len) len = n;
    char* p = (char*)malloc(len + 1);
    if (p) {
        memcpy(p, s, len);
        p[len] = '\0';
    }
    return p;
}
#define strndup _n_strndup
#endif
 
#ifdef HAVE_OPENSSL
#include <openssl/sha.h>
#include <openssl/rand.h>
#include <openssl/x509v3.h>
#endif
 
/* error capture infrastructure */
 
#ifndef _Thread_local
#define _Thread_local __thread
#endif
static _Thread_local char s_connect_errors[8][512];
static _Thread_local int s_connect_err_count = 0;
static _Thread_local int s_connect_err_next = 0;
 
static void _netw_capture_error(NETWORK* netw, const char* fmt, ...) {
    if (!netw) return;
    va_list ap;
    va_start(ap, fmt);
    vsnprintf(netw->netw_errors[netw->netw_err_next], 512, fmt, ap);
    va_end(ap);
    netw->netw_err_next = (netw->netw_err_next + 1) % 8;
    if (netw->netw_err_count < 8) netw->netw_err_count++;
}
 
static void _netw_capture_connect_error(const char* fmt, ...) {
    va_list ap;
    va_start(ap, fmt);
    vsnprintf(s_connect_errors[s_connect_err_next], 512, fmt, ap);
    va_end(ap);
    s_connect_err_next = (s_connect_err_next + 1) % 8;
    if (s_connect_err_count < 8) s_connect_err_count++;
}
 
/* public error accessors */
 
int n_netw_get_error_count(const NETWORK* netw) {
    return netw ? netw->netw_err_count : 0;
}
 
const char* n_netw_get_error(const NETWORK* netw, int index) {
    if (!netw || index < 0 || index >= netw->netw_err_count) return NULL;
    int oldest = (netw->netw_err_next - netw->netw_err_count + 8) % 8;
    return netw->netw_errors[(oldest + index) % 8];
}
 
void n_netw_clear_errors(NETWORK* netw) {
    if (!netw) return;
    netw->netw_err_count = 0;
    netw->netw_err_next = 0;
}
 
int n_netw_get_connect_error_count(void) {
    return s_connect_err_count;
}
 
const char* n_netw_get_connect_error(int index) {
    if (index < 0 || index >= s_connect_err_count) return NULL;
    int oldest = (s_connect_err_next - s_connect_err_count + 8) % 8;
    return s_connect_errors[(oldest + index) % 8];
}
 
void n_netw_clear_connect_errors(void) {
    s_connect_err_count = 0;
    s_connect_err_next = 0;
}
 
N_ENUM_DEFINE(N_ENUM_netw_code_type, __netw_code_type)
 
 
size_t htonst(size_t value) {
#if __BYTE_ORDER == __LITTLE_ENDIAN
    if (sizeof(size_t) == 4) {
        return (size_t)htonl((uint32_t)value);
    } else if (sizeof(size_t) == 8) {
        return ((size_t)htonl((uint32_t)(value >> 32)) |
                ((size_t)htonl((uint32_t)value) << 32));
    }
#endif
    return value;  // No conversion needed for big-endian
}
 
size_t ntohst(size_t value) {
#if __BYTE_ORDER == __LITTLE_ENDIAN
    if (sizeof(size_t) == 4) {
        return (size_t)ntohl((uint32_t)value);
    } else if (sizeof(size_t) == 8) {
        return ((size_t)ntohl((uint32_t)(value >> 32)) |
                ((size_t)ntohl((uint32_t)value) << 32));
    }
#endif
    return value;  // No conversion needed for big-endian
}
 
#ifdef __windows__
 
char* wchar_to_char(const wchar_t* pwchar) {
    __n_assert(pwchar, return NULL);
 
    // get the number of characters in the string.
    int currentCharIndex = 0;
    char currentChar = (char)pwchar[currentCharIndex];
    char* filePathC = NULL;
 
    while (currentChar != '\0') {
        currentCharIndex++;
        currentChar = (char)pwchar[currentCharIndex];
    }
 
    const int charCount = currentCharIndex + 1;
 
    // allocate a new block of memory size char (1 byte) instead of wide char (2 bytes)
    Malloc(filePathC, char, (size_t)charCount);
    __n_assert(filePathC, return NULL);
 
    for (int i = 0; i < charCount; i++) {
        // convert to char (1 byte)
        char character = (char)pwchar[i];
 
        *filePathC = character;
 
        filePathC += sizeof(char);
    }
    filePathC += '\0';
 
    filePathC -= (sizeof(char) * (size_t)charCount);
 
    return filePathC;
}
 
#define NETW_CALL_RETRY(__retvar, __expression, __max_tries)                                                                                \
    do {                                                                                                                                    \
        int __nb_retries = 0;                                                                                                               \
        do {                                                                                                                                \
            __retvar = (__expression);                                                                                                      \
            __nb_retries++;                                                                                                                 \
        } while (__retvar == -1 && (WSAGetLastError() == WSAEINTR || WSAGetLastError() == WSAEWOULDBLOCK) && __nb_retries < (__max_tries)); \
        if (__retvar == -1 && __nb_retries >= (__max_tries)) __retvar = -2;                                                                 \
    } while (0)
 
#define neterrno WSAGetLastError()
 
static char* netstrerror(int code) {
    wchar_t* ws = NULL;
    FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
                   NULL, (DWORD)code,
                   MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
                   (LPWSTR)&ws, 0, NULL);
    char* netstr = wchar_to_char(ws);
    LocalFree(ws);
    return netstr;
}
 
#if __GNUC__ <= 6 && __GNUC_MINOR__ <= 3
 
/*--------------------------------------------------------------------------------------
  By Marco Ladino - mladinox.. jan/2016
  MinGW 3.45 thru 4.5 versions, don't have the socket functions:
  --> inet_ntop(..)
  --> inet_pton(..)
  But with this adapted code using the original functions from FreeBSD,
  one can to use it in the C/C++ Applications, without problem..!
  This implementation, include tests for IPV4 and IPV6 addresses,
  and is full C/C++ compatible..
  --------------------------------------------------------------------------------------*/
/*              OpenBSD: strlcpy.c,v 1.11 2006/05/05 15:27:38 millert Exp       */
/*-
 * Copyright (c) 1998 Todd C. Miller <Todd.Miller at courtesan.com>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
 
size_t strlcpy(char* dst, const char* src, size_t siz) {
    char* d = dst;
    const char* s = src;
    size_t n = siz;
 
    /* Copy as many bytes as will fit */
    if (n != 0) {
        while (--n != 0) {
            if ((*d++ = *s++) == '\0')
                break;
        }
    }
 
    /* Not enough room in dst, add NUL and traverse rest of src */
    if (n == 0) {
        if (siz != 0)
            *d = '\0'; /* NUL-terminate dst */
        while (*s++);
    }
 
    return (s - src - 1); /* count does not include NUL */
}
 
/*
 * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
 * Copyright (c) 1996-1999 by Internet Software Consortium.
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
 
/*
 * WARNING: Don't even consider trying to compile this on a system where
 * sizeof(int) < 4.  sizeof(int) > 4 is fine; all the world's not a VAX.
 */
 
static char* inet_ntop4(const unsigned char* src, char* dst, socklen_t size);
static char* inet_ntop6(const unsigned char* src, char* dst, socklen_t size);
 
char* inet_ntop(int af, const void* src, char* dst, socklen_t size) {
    switch (af) {
        case AF_INET:
            return (inet_ntop4((const unsigned char*)src, dst, size));
        case AF_INET6:
            return (inet_ntop6((const unsigned char*)src, dst, size));
        default:
            return (NULL);
    }
    /* NOTREACHED */
}
 
/* const char *
 * inet_ntop4(src, dst, size)
 *              format an IPv4 address
 * return:
 *              `dst' (as a const)
 * notes:
 *              (1) uses no statics
 *              (2) takes a u_char* not an in_addr as input
 * author:
 *              Paul Vixie, 1996.
 */
static char* inet_ntop4(const unsigned char* src, char* dst, socklen_t size) {
    static const char fmt[] = "%u.%u.%u.%u";
    char tmp[sizeof "255.255.255.255"];
    int l;
 
    l = snprintf(tmp, sizeof(tmp), fmt, src[0], src[1], src[2], src[3]);
    if (l <= 0 || (socklen_t)l >= size) {
        return (NULL);
    }
    strlcpy(dst, tmp, size);
    return (dst);
}
 
/* const char *
 * inet_ntop6(src, dst, size)
 *              convert IPv6 binary address into presentation (printable) format
 * author:
 *              Paul Vixie, 1996.
 */
static char* inet_ntop6(const unsigned char* src, char* dst, socklen_t size) {
    /*
     * Note that int32_t and int16_t need only be "at least" large enough
     * to contain a value of the specified size.  On some systems, like
     * Crays, there is no such thing as an integer variable with 16 bits.
     * Keep this in mind if you think this function should have been coded
     * to use pointer overlays.  All the world's not a VAX.
     */
    char tmp[sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"], *tp;
    struct
    {
        int base, len;
    } best, cur;
#define NS_IN6ADDRSZ 16
#define NS_INT16SZ 2
    u_int words[NS_IN6ADDRSZ / NS_INT16SZ];
    int i;
 
    /*
     * Preprocess:
     *          Copy the input (bytewise) array into a wordwise array.
     *          Find the longest run of 0x00's in src[] for :: shorthanding.
     */
    memset(words, '\0', sizeof words);
    for (i = 0; i < NS_IN6ADDRSZ; i++)
        words[i / 2] |= (src[i] << ((1 - (i % 2)) << 3));
    best.base = -1;
    best.len = 0;
    cur.base = -1;
    cur.len = 0;
    for (i = 0; i < (NS_IN6ADDRSZ / NS_INT16SZ); i++) {
        if (words[i] == 0) {
            if (cur.base == -1)
                cur.base = i, cur.len = 1;
            else
                cur.len++;
        } else {
            if (cur.base != -1) {
                if (best.base == -1 || cur.len > best.len)
                    best = cur;
                cur.base = -1;
            }
        }
    }
    if (cur.base != -1) {
        if (best.base == -1 || cur.len > best.len)
            best = cur;
    }
    if (best.base != -1 && best.len < 2)
        best.base = -1;
 
    /*
     * Format the result.
     */
    tp = tmp;
    for (i = 0; i < (NS_IN6ADDRSZ / NS_INT16SZ); i++) {
        /* Are we inside the best run of 0x00's? */
        if (best.base != -1 && i >= best.base &&
            i < (best.base + best.len)) {
            if (i == best.base)
                *tp++ = ':';
            continue;
        }
        /* Are we following an initial run of 0x00s or any real hex? */
        if (i != 0)
            *tp++ = ':';
        /* Is this address an encapsulated IPv4? */
        if (i == 6 && best.base == 0 && (best.len == 6 || (best.len == 7 && words[7] != 0x0001) || (best.len == 5 && words[5] == 0xffff))) {
            if (!inet_ntop4(src + 12, tp, sizeof tmp - (tp - tmp)))
                return (NULL);
            tp += strlen(tp);
            break;
        }
        tp += sprintf(tp, "%x", words[i]);
    }
    /* Was it a trailing run of 0x00's? */
    if (best.base != -1 && (best.base + best.len) ==
                               (NS_IN6ADDRSZ / NS_INT16SZ))
        *tp++ = ':';
    *tp++ = '\0';
 
    /*
     * Check for overflow, copy, and we're done.
     */
    if ((socklen_t)(tp - tmp) > size) {
        return (NULL);
    }
    strcpy(dst, tmp);
    return (dst);
}
 
/*
 * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
 * Copyright (c) 1996,1999 by Internet Software Consortium.
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
 
/*
 * WARNING: Don't even consider trying to compile this on a system where
 * sizeof(int) < 4.  sizeof(int) > 4 is fine; all the world's not a VAX.
 */
 
static int inet_pton4(const char* src, u_char* dst);
static int inet_pton6(const char* src, u_char* dst);
 
int inet_pton(int af, const char* src, void* dst) {
    switch (af) {
        case AF_INET:
            return (inet_pton4(src, (unsigned char*)dst));
        case AF_INET6:
            return (inet_pton6(src, (unsigned char*)dst));
        default:
            return (-1);
    }
    /* NOTREACHED */
}
 
/* int
 * inet_pton4(src, dst)
 *              like inet_aton() but without all the hexadecimal and shorthand.
 * return:
 *              1 if `src' is a valid dotted quad, else 0.
 * notice:
 *              does not touch `dst' unless it's returning 1.
 * author:
 *              Paul Vixie, 1996.
 */
static int inet_pton4(const char* src, u_char* dst) {
    static const char digits[] = "0123456789";
    int saw_digit, octets, ch;
#define NS_INADDRSZ 4
    /* Zero-initialise: the octets are filled through the `tp` alias
     * below, which cppcheck's data flow can't follow, so it cannot
     * prove tmp is fully written before the trailing memcpy. The
     * init is harmless and removes the false uninitvar diagnostic. */
    u_char tmp[NS_INADDRSZ] = {0}, *tp;
 
    saw_digit = 0;
    octets = 0;
    tp = tmp;
    while ((ch = *src++) != '\0') {
        const char* pch;
 
        if ((pch = strchr(digits, ch)) != NULL) {
            u_int uiNew = *tp * 10 + (pch - digits);
 
            if (saw_digit && *tp == 0)
                return (0);
            if (uiNew > 255)
                return (0);
            *tp = uiNew;
            if (!saw_digit) {
                if (++octets > 4)
                    return (0);
                saw_digit = 1;
            }
        } else if (ch == '.' && saw_digit) {
            if (octets == 4)
                return (0);
            *++tp = 0;
            saw_digit = 0;
        } else
            return (0);
    }
    if (octets < 4)
        return (0);
    memcpy(dst, tmp, NS_INADDRSZ);
    return (1);
}
 
/* int
 * inet_pton6(src, dst)
 *              convert presentation level address to network order binary form.
 * return:
 *              1 if `src' is a valid [RFC1884 2.2] address, else 0.
 * notice:
 *              (1) does not touch `dst' unless it's returning 1.
 *              (2) :: in a full address is silently ignored.
 * credit:
 *              inspired by Mark Andrews.
 * author:
 *              Paul Vixie, 1996.
 */
static int inet_pton6(const char* src, u_char* dst) {
    static const char xdigits_l[] = "0123456789abcdef",
                      xdigits_u[] = "0123456789ABCDEF";
#define NS_IN6ADDRSZ 16
#define NS_INT16SZ 2
    u_char tmp[NS_IN6ADDRSZ], *tp, *endp, *colonp;
    const char* curtok;
    int ch, seen_xdigits;
    u_int val;
 
    memset((tp = tmp), '\0', NS_IN6ADDRSZ);
    endp = tp + NS_IN6ADDRSZ;
    colonp = NULL;
    /* Leading :: requires some special handling. */
    if (*src == ':')
        if (*++src != ':')
            return (0);
    curtok = src;
    seen_xdigits = 0;
    val = 0;
    while ((ch = *src++) != '\0') {
        const char* xdigits : const char* pch;
 
        if ((pch = strchr((xdigits = xdigits_l), ch)) == NULL)
            pch = strchr((xdigits = xdigits_u), ch);
        if (pch != NULL) {
            val <<= 4;
            val |= (pch - xdigits);
            if (++seen_xdigits > 4)
                return (0);
            continue;
        }
        if (ch == ':') {
            curtok = src;
            if (!seen_xdigits) {
                if (colonp)
                    return (0);
                colonp = tp;
                continue;
            } else if (*src == '\0') {
                return (0);
            }
            if (tp + NS_INT16SZ > endp)
                return (0);
            *tp++ = (u_char)(val >> 8) & 0xff;
            *tp++ = (u_char)val & 0xff;
            seen_xdigits = 0;
            val = 0;
            continue;
        }
        if (ch == '.' && ((tp + NS_INADDRSZ) <= endp) &&
            inet_pton4(curtok, tp) > 0) {
            tp += NS_INADDRSZ;
            seen_xdigits = 0;
            break; /* '\\0' was seen by inet_pton4(). */
        }
        return (0);
    }
    if (seen_xdigits) {
        if (tp + NS_INT16SZ > endp)
            return (0);
        *tp++ = (u_char)(val >> 8) & 0xff;
        *tp++ = (u_char)val & 0xff;
    }
    if (colonp != NULL) {
        /*
         * Since some memmove()'s erroneously fail to handle
         * overlapping regions, we'll do the shift by hand.
         */
        const int n = tp - colonp;
        int i;
 
        if (tp == endp)
            return (0);
        for (i = 1; i <= n; i++) {
            endp[-i] = colonp[n - i];
            colonp[n - i] = 0;
        }
        tp = endp;
    }
    if (tp != endp)
        return (0);
    memcpy(dst, tmp, NS_IN6ADDRSZ);
    return (1);
}
 
#endif /* if GCC_VERSION <= 4.5 */
 
#else /* not __windows__ */
 
#include <sys/types.h>
#include <sys/wait.h>
 
#define NETW_CALL_RETRY(__retvar, __expression, __max_tries)                                                                     \
    do {                                                                                                                         \
        int __nb_retries = 0;                                                                                                    \
        do {                                                                                                                     \
            __retvar = (__expression);                                                                                           \
            __nb_retries++;                                                                                                      \
        } while (__retvar == -1 && (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK) && __nb_retries < (__max_tries)); \
        if (__retvar == -1 && __nb_retries >= (__max_tries)) __retvar = -2;                                                      \
    } while (0)
 
#define neterrno errno
 
/* #define netstrerror( code )({ \
   size_t errmsglen = 512 ; // strerrorlen_s( code ) + 1  ; \
   char *errmsg = NULL ; \
   Malloc( errmsg , char , errmsglen ); \
   if( errmsg ) \
   { \
   strerror_s( errmsg , errmsglen , code ); \
   } \
   errmsg ; \
   }) */
 
static char* netstrerror(int code) {
    /* strdup returns NULL and sets errno=ENOMEM on allocation failure;
     * propagate that NULL to the caller, who treats it as "no message". */
    return strdup(strerror(code));
}
 
#endif /* if not def windows */
 
NETWORK* netw_new(size_t send_list_limit, size_t recv_list_limit) {
    NETWORK* netw = NULL;
 
    Malloc(netw, NETWORK, 1);
    __n_assert(netw, return NULL);
 
    /* netw itself */
    netw->nb_pending = -1;
    netw->mode = -1;
    netw->user_id = -1;
    netw->nb_running_threads = 0;
    netw_atomic_write_state(netw, NETW_EXITED);
    netw->threaded_engine_status = NETW_THR_ENGINE_STOPPED;
    /* Default to zlib for back-compat with the first compression
     * pass that shipped before LZ4 support landed. Callers can
     * switch to NONE or LZ4 via netw_set_compression_mode(). */
    netw->compress_mode = NETW_COMPRESS_ZLIB;
 
    /* netw -> link */
    netw->link.sock = INVALID_SOCKET;
    netw->link.port =
        netw->link.ip = NULL;
    memset(&netw->link.hints, 0, sizeof(struct addrinfo));
    memset(&netw->link.raddr, 0, sizeof(struct sockaddr_storage));
 
    /*initiliaze mutexs*/
    if (pthread_mutex_init(&netw->sendbolt, NULL) != 0) {
        n_log(LOG_ERR, "Error initializing netw -> sendbolt");
        Free(netw);
        return NULL;
    }
    /*initiliaze mutexs*/
    if (pthread_mutex_init(&netw->recvbolt, NULL) != 0) {
        n_log(LOG_ERR, "Error initializing netw -> recvbolt");
        pthread_mutex_destroy(&netw->sendbolt);
        Free(netw);
        return NULL;
    }
    /*initiliaze mutexs*/
    if (pthread_mutex_init(&netw->eventbolt, NULL) != 0) {
        n_log(LOG_ERR, "Error initializing netw -> eventbolt");
        pthread_mutex_destroy(&netw->sendbolt);
        pthread_mutex_destroy(&netw->recvbolt);
        Free(netw);
        return NULL;
    }
    /* initialize send sem bolt */
    if (sem_init(&netw->send_blocker, 0, 0) != 0) {
        n_log(LOG_ERR, "Error initializing netw -> eventbolt");
        pthread_mutex_destroy(&netw->eventbolt);
        pthread_mutex_destroy(&netw->sendbolt);
        pthread_mutex_destroy(&netw->recvbolt);
        Free(netw);
        return NULL;
    }
    /*initialize queues */
    netw->recv_buf = new_generic_list(recv_list_limit);
    if (!netw->recv_buf) {
        n_log(LOG_ERR, "Error when creating receive list with %d item limit", recv_list_limit);
        netw_close(&netw);
        return NULL;
    }
    netw->send_buf = new_generic_list(send_list_limit);
    if (!netw->send_buf) {
        n_log(LOG_ERR, "Error when creating send list with %d item limit", send_list_limit);
        netw_close(&netw);
        return NULL;
    }
    netw->pools = new_generic_list(MAX_LIST_ITEMS);
    if (!netw->pools) {
        n_log(LOG_ERR, "Error when creating pools list");
        netw_close(&netw);
        return NULL;
    }
    netw->addr_infos_loaded = 0;
    netw->send_queue_consecutive_wait = 0;
    netw->so_reuseaddr = -1;
    // netw -> so_reuseport = -1 ;
    netw->so_keepalive = -1;
    netw->tcpnodelay = -1;
    netw->so_sndbuf = -1;
    netw->so_rcvbuf = -1;
    netw->so_rcvtimeo = -1;
    netw->so_sndtimeo = -1;
    netw->so_linger = -1;
    netw->deplete_socket_timeout = -1;
    netw->deplete_queues_timeout = -1;
    netw->wait_close_timeout = -1;
    netw->transport_type = NETWORK_TCP;
    netw->crypto_algo = NETW_ENCRYPT_NONE;
 
    netw->send_data = &send_data;
    netw->recv_data = &recv_data;
    netw->send_data_once = &send_data_once;
    netw->recv_data_once = &recv_data_once;
 
#ifdef HAVE_OPENSSL
    netw->method = NULL;
    netw->ctx = NULL;
    netw->ssl = NULL;
    netw->key = NULL;
    netw->certificate = NULL;
#endif
 
    netw->link.is_blocking = 1;
    return netw;
 
} /* netw_new() */
 
char* get_in_addr(struct sockaddr* sa) {
    return sa->sa_family == AF_INET
               ? (char*)&(((struct sockaddr_in*)sa)->sin_addr)
               : (char*)&(((struct sockaddr_in6*)sa)->sin6_addr);
}
 
int netw_init_wsa(int mode, int v1, int v2) {
    int compiler_warning_suppressor = 0;
#if !defined(__linux__) && !defined(__sun) && !defined(_AIX)
    static WSADATA WSAdata;            /*WSA world*/
    static int WSA_IS_INITIALIZED = 0; /*status checking*/
 
    switch (mode) {
        default:
            /*returning WSA status*/
        case 2:
            return WSA_IS_INITIALIZED;
            break;
            /*loading WSA dll*/
        case 1:
            if (WSA_IS_INITIALIZED == 1)
                return TRUE; /*already loaded*/
            if ((WSAStartup(MAKEWORD(v1, v2), &WSAdata)) != 0) {
                WSA_IS_INITIALIZED = 0;
                return FALSE;
            } else {
                WSA_IS_INITIALIZED = 1;
                return TRUE;
            }
            break;
            /*unloading (closing) WSA */
        case 0:
            if (WSA_IS_INITIALIZED == 0)
                return TRUE; /*already CLEANED or not loaded */
            if (WSACleanup() == 0) {
                WSA_IS_INITIALIZED = 0;
                return TRUE;
            }
            break;
    } /*switch(...)*/
#endif /* ifndef __linux__ __sun _AIX */
    compiler_warning_suppressor = mode + v1 + v2;
    (void)compiler_warning_suppressor;
    compiler_warning_suppressor = TRUE;
    return compiler_warning_suppressor;
} /*netw_init_wsa(...)*/
 
int netw_set_compression_mode(NETWORK* netw, int mode) {
    __n_assert(netw, return FALSE);
    if (mode != NETW_COMPRESS_NONE &&
        mode != NETW_COMPRESS_ZLIB &&
        mode != NETW_COMPRESS_LZ4) {
        n_log(LOG_ERR, "netw_set_compression_mode: unknown mode %d", mode);
        return FALSE;
    }
    netw->compress_mode = mode;
    return TRUE;
} /* netw_set_compression_mode */
 
int netw_set_blocking(NETWORK* netw, unsigned long int is_blocking) {
    __n_assert(netw, return FALSE);
 
    int error = 0;
    (void)error;
    char* errmsg = NULL;
 
#if defined(__linux__) || defined(__sun)
    int flags = 0;
    flags = fcntl(netw->link.sock, F_GETFL, 0);
    if (netw->link.is_blocking != 0 && !is_blocking) {
        if (flags & O_NONBLOCK) {
            n_log(LOG_DEBUG, "socket %d was already in non-blocking mode", netw->link.sock);
            /* in case we missed it, let's update the link mode */
            netw->link.is_blocking = 0;
            return TRUE;
        }
    } else if (netw->link.is_blocking != 1 && is_blocking) {
        if (!(flags & O_NONBLOCK)) {
            n_log(LOG_DEBUG, "socket %d was already in blocking mode", netw->link.sock);
            /* in case we missed it, let's update the link mode */
            netw->link.is_blocking = 1;
            return TRUE;
        }
    }
    if (fcntl(netw->link.sock, F_SETFL, is_blocking ? flags & ~O_NONBLOCK : flags | O_NONBLOCK) == -1) {
        error = neterrno;
        errmsg = netstrerror(error);
        _netw_capture_error(netw, "couldn't set blocking mode %lu on %d: %s", is_blocking, netw->link.sock, _str(errmsg));
        n_log(LOG_ERR, "couldn't set blocking mode %lu on %d: %s", is_blocking, netw->link.sock, _str(errmsg));
        FreeNoLog(errmsg);
        return FALSE;
    }
#else
    unsigned long int blocking = 1 - is_blocking;
    int res = ioctlsocket(netw->link.sock, (long)FIONBIO, &blocking);
    error = neterrno;
    if (res != NO_ERROR) {
        errmsg = netstrerror(error);
        _netw_capture_error(netw, "ioctlsocket failed with error: %ld , neterrno: %s", res, _str(errmsg));
        n_log(LOG_ERR, "ioctlsocket failed with error: %ld , neterrno: %s", res, _str(errmsg));
        FreeNoLog(errmsg);
        netw_close(&netw);
        return FALSE;
    }
#endif
    netw->link.is_blocking = is_blocking;
    return TRUE;
} /* netw_set_blocking */
 
int netw_setsockopt(NETWORK* netw, int optname, int value) {
    __n_assert(netw, return FALSE);
 
    int error = 0;
    char* errmsg = NULL;
 
    switch (optname) {
        case TCP_NODELAY:
            if (value >= 0) {
                /* disable naggle algorithm */
                if (setsockopt(netw->link.sock, IPPROTO_TCP, TCP_NODELAY, (const char*)&value, sizeof(value)) == -1) {
                    error = neterrno;
                    errmsg = netstrerror(error);
                    _netw_capture_error(netw, "Error from setsockopt(TCP_NODELAY) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                    n_log(LOG_ERR, "Error from setsockopt(TCP_NODELAY) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                    FreeNoLog(errmsg);
                    return FALSE;
                }
            }
            netw->tcpnodelay = value;
            break;
        case SO_SNDBUF:
            /* socket sending buffer size */
            if (value >= 0) {
                if (setsockopt(netw->link.sock, SOL_SOCKET, SO_SNDBUF, (const char*)&value, sizeof(value)) == -1) {
                    error = neterrno;
                    errmsg = netstrerror(error);
                    _netw_capture_error(netw, "Error from setsockopt(SO_SNDBUF) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                    n_log(LOG_ERR, "Error from setsockopt(SO_SNDBUF) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                    FreeNoLog(errmsg);
                    return FALSE;
                }
            }
            netw->so_sndbuf = value;
            break;
        case SO_RCVBUF:
            /* socket receiving buffer */
            if (value >= 0) {
                if (setsockopt(netw->link.sock, SOL_SOCKET, SO_RCVBUF, (const char*)&value, sizeof(value)) == -1) {
                    error = neterrno;
                    errmsg = netstrerror(error);
                    _netw_capture_error(netw, "Error from setsockopt(SO_RCVBUF) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                    n_log(LOG_ERR, "Error from setsockopt(SO_RCVBUF) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                    FreeNoLog(errmsg);
                    return FALSE;
                }
            }
            netw->so_rcvbuf = value;
            break;
        case SO_REUSEADDR:
            /* lose the pesky "Address already in use" error message*/
            if (setsockopt(netw->link.sock, SOL_SOCKET, SO_REUSEADDR, (char*)&value, sizeof(value)) == -1) {
                error = neterrno;
                errmsg = netstrerror(error);
                _netw_capture_error(netw, "Error from setsockopt(SO_REUSEADDR) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                n_log(LOG_ERR, "Error from setsockopt(SO_REUSEADDR) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                FreeNoLog(errmsg);
                return FALSE;
            }
            netw->so_reuseaddr = value;
            break;
            /*case SO_REUSEPORT :
            // lose the pesky "port already in use" error message
            if ( setsockopt( netw -> link . sock, SOL_SOCKET, SO_REUSEPORT, (char *)&value, sizeof( value  ) ) == -1 )
            {
            error=neterrno ;
            errmsg = netstrerror( error );
            n_log( LOG_ERR, "Error from setsockopt(SO_REUSEPORT) on socket %d. neterrno: %s", netw -> link . sock, _str( errmsg ) );
            FreeNoLog( errmsg );
            return FALSE ;
            }
            netw -> so_reuseport = value ;
            break ;*/
        case SO_LINGER: {
            struct linger ling;
            if (value < 0) {
                ling.l_onoff = 0;
                ling.l_linger = 0;
            } else if (value == 0) {
                ling.l_onoff = 1;
                ling.l_linger = 0;
            } else {
                ling.l_onoff = 1;
#ifdef __windows__
                ling.l_linger = (u_short)value;
#else
                ling.l_linger = value;
#endif
            }
#ifndef __windows__
            if (setsockopt(netw->link.sock, SOL_SOCKET, SO_LINGER, &ling, sizeof(ling)) == -1) {
                error = neterrno;
                errmsg = netstrerror(error);
                _netw_capture_error(netw, "Error from setsockopt(SO_LINGER) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                n_log(LOG_ERR, "Error from setsockopt(SO_LINGER) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                FreeNoLog(errmsg);
                return FALSE;
            }
#else
            if (setsockopt(netw->link.sock, SOL_SOCKET, SO_LINGER, (const char*)&ling, sizeof(ling)) == -1) {
                error = neterrno;
                errmsg = netstrerror(error);
                _netw_capture_error(netw, "Error from setsockopt(SO_LINGER) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                n_log(LOG_ERR, "Error from setsockopt(SO_LINGER) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                FreeNoLog(errmsg);
                return FALSE;
            }
#endif  // __windows__
            netw->so_linger = value;
        } break;
        case SO_RCVTIMEO:
            if (value >= 0) {
#ifndef __windows__
                {
                    struct timeval tv;
                    tv.tv_sec = value;
                    tv.tv_usec = 0;
                    if (setsockopt(netw->link.sock, SOL_SOCKET, SO_RCVTIMEO, (const char*)&tv, sizeof tv) == -1) {
                        error = neterrno;
                        errmsg = netstrerror(error);
                        _netw_capture_error(netw, "Error from setsockopt(SO_RCVTIMEO) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                        n_log(LOG_ERR, "Error from setsockopt(SO_RCVTIMEO) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                        FreeNoLog(errmsg);
                        return FALSE;
                    }
                }
#else
                if (setsockopt(netw->link.sock, SOL_SOCKET, SO_RCVTIMEO, (const char*)&value, sizeof value) == -1) {
                    error = neterrno;
                    errmsg = netstrerror(error);
                    _netw_capture_error(netw, "Error from setsockopt(SO_RCVTIMEO) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                    n_log(LOG_ERR, "Error from setsockopt(SO_RCVTIMEO) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                    FreeNoLog(errmsg);
                    return FALSE;
                }
#endif
            }
            netw->so_rcvtimeo = value;
            break;
        case SO_SNDTIMEO:
            if (value >= 0) {
#ifndef __windows__
                {
                    struct timeval tv;
                    tv.tv_sec = value;
                    tv.tv_usec = 0;
 
                    if (setsockopt(netw->link.sock, SOL_SOCKET, SO_SNDTIMEO, (const char*)&tv, sizeof tv) == -1) {
                        error = neterrno;
                        errmsg = netstrerror(error);
                        _netw_capture_error(netw, "Error from setsockopt(SO_SNDTIMEO) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                        n_log(LOG_ERR, "Error from setsockopt(SO_SNDTIMEO) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                        FreeNoLog(errmsg);
                        return FALSE;
                    }
                }
#else
                if (setsockopt(netw->link.sock, SOL_SOCKET, SO_SNDTIMEO, (const char*)&value, sizeof value) == -1) {
                    error = neterrno;
                    errmsg = netstrerror(error);
                    _netw_capture_error(netw, "Error from setsockopt(SO_SNDTIMEO) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                    n_log(LOG_ERR, "Error from setsockopt(SO_SNDTIMEO) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                    FreeNoLog(errmsg);
                    return FALSE;
                }
#endif
            }
            netw->so_sndtimeo = value;
            break;
        case NETWORK_DEPLETE_SOCKET_TIMEOUT:
            netw->deplete_socket_timeout = value;
            break;
        case NETWORK_DEPLETE_QUEUES_TIMEOUT:
            netw->deplete_queues_timeout = value;
            break;
        case NETWORK_WAIT_CLOSE_TIMEOUT:
            netw->wait_close_timeout = value;
            break;
        case NETWORK_CONSECUTIVE_SEND_WAIT:
            netw->send_queue_consecutive_wait = value;
            break;
#ifdef __linux__
        case TCP_USER_TIMEOUT:
            if (value >= 0) {
                if (setsockopt(netw->link.sock, IPPROTO_TCP, TCP_USER_TIMEOUT, (const char*)&value, sizeof value) == -1) {
                    error = neterrno;
                    errmsg = netstrerror(error);
                    _netw_capture_error(netw, "Error from setsockopt(TCP_USER_TIMEOUT) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                    n_log(LOG_ERR, "Error from setsockopt(TCP_USER_TIMEOUT) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                    FreeNoLog(errmsg);
                    return FALSE;
                }
            }
            break;
        case TCP_QUICKACK:
            if (setsockopt(netw->link.sock, IPPROTO_TCP, TCP_QUICKACK, &value, sizeof(value)) < 0) {
                error = neterrno;
                errmsg = netstrerror(error);
                _netw_capture_error(netw, "Error setting setsockopt(TCP_QUICKACK) to %d on sock %d. neterrno: %s", value, netw->link.sock, _str(errmsg));
                n_log(LOG_ERR, "Error setting setsockopt(TCP_QUICKACK) to %d on sock %d. neterrno: %s", value, netw->link.sock, _str(errmsg));
                FreeNoLog(errmsg);
                return FALSE;
            }
            break;
#endif
        case SO_KEEPALIVE:
            if (setsockopt(netw->link.sock, SOL_SOCKET, SO_KEEPALIVE, (const char*)&value, sizeof value) == -1) {
                error = neterrno;
                errmsg = netstrerror(error);
                _netw_capture_error(netw, "Error from setsockopt(SO_KEEPALIVE) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                n_log(LOG_ERR, "Error from setsockopt(SO_KEEPALIVE) on socket %d. neterrno: %s", netw->link.sock, _str(errmsg));
                FreeNoLog(errmsg);
                return FALSE;
            }
            netw->so_keepalive = value;
            break;
 
        default:
            _netw_capture_error(netw, "%d is not a supported setsockopt", optname);
            n_log(LOG_ERR, "%d is not a supported setsockopt", optname);
            return FALSE;
    }
    return TRUE;
} /* netw_set_sock_opt */
 
#ifdef HAVE_OPENSSL
 
char* netw_get_openssl_error_string() {
    BIO* bio = BIO_new(BIO_s_mem());
    if (!bio) {
        return NULL;
    }
 
    ERR_print_errors(bio);  // Write errors to the BIO
 
    char* buf;
    size_t len = (size_t)BIO_get_mem_data(bio, &buf);  // Get data from the BIO. Can return 0 if empty of failled
 
    // Allocate memory for the error string and copy it
    char* error_str = malloc(len + 1);
    if (error_str) {
        memcpy(error_str, buf, len);
        error_str[len] = '\0';  // Null-terminate the string
    }
 
    BIO_free(bio);  // Free the BIO
 
    return error_str;
}
 
void netw_ssl_print_errors(SOCKET socket) {
    unsigned long error = 0;
    while ((error = ERR_get_error())) {
        int level = LOG_ERR;
#ifdef SSL_R_UNEXPECTED_EOF_WHILE_READING
        /* A peer that closes the TCP connection without a TLS close_notify makes
           OpenSSL 3.x queue "unexpected eof while reading". Clients (web browsers
           especially, on speculative/preconnect sockets) do this routinely, so it
           is expected disconnect noise rather than an error: log it at DEBUG so it
           does not drown a real TLS failure, which keeps its own reason code and
           LOG_ERR level. */
        if (ERR_GET_REASON(error) == SSL_R_UNEXPECTED_EOF_WHILE_READING)
            level = LOG_DEBUG;
#endif
        n_log(level, "socket %d: %s", socket, ERR_reason_error_string(error));
    }
}
 
/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel at haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
 * are also available at https://curl.haxx.se/docs/copyright.html.
 *
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 * copies of the Software, and permit persons to whom the Software is
 * furnished to do so, under the terms of the COPYING file.
 *
 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
 * KIND, either express or implied.
 *
 ***************************************************************************/
/* <DESC>
 * Show the required mutex callback setups for GnuTLS and OpenSSL when using
 * libcurl multi-threaded.
 * </DESC>
 */
/* A multi-threaded example that uses pthreads and fetches 4 remote files at
 * once over HTTPS. The lock callbacks and stuff assume OpenSSL <1.1 or GnuTLS
 * (libgcrypt) so far.
 *
 * OpenSSL docs for this:
 *   https://www.openssl.org/docs/man1.0.2/man3/CRYPTO_num_locks.html
 * gcrypt docs for this:
 *   https://gnupg.org/documentation/manuals/gcrypt/Multi_002dThreading.html
 */
 
/* we have this global to let the callback get easy access to it */
static pthread_mutex_t* netw_ssl_lockarray;
 
__attribute__((unused)) static void netw_ssl_lock_callback(int mode, int type, char* file, int line) {
    (void)file;
    (void)line;
    if (mode & CRYPTO_LOCK) {
        pthread_mutex_lock(&(netw_ssl_lockarray[type]));
    } else {
        pthread_mutex_unlock(&(netw_ssl_lockarray[type]));
    }
}
 
__attribute__((unused)) static unsigned long thread_id(void) {
    unsigned long ret;
 
    ret = (unsigned long)pthread_self();
    return ret;
}
 
static void netw_init_locks(void) {
    int i;
 
    size_t lock_count = (size_t)CRYPTO_num_locks();
    netw_ssl_lockarray = (pthread_mutex_t*)OPENSSL_malloc((size_t)(lock_count * sizeof(pthread_mutex_t)));
 
    for (i = 0; i < CRYPTO_num_locks(); i++) {
        pthread_mutex_init(&(netw_ssl_lockarray[i]), NULL);
    }
 
    CRYPTO_set_id_callback((unsigned long (*)())thread_id);
    CRYPTO_set_locking_callback((void (*)())netw_ssl_lock_callback);
}
 
static void netw_kill_locks(void) {
    int i;
 
    CRYPTO_set_locking_callback(NULL);
    for (i = 0; i < CRYPTO_num_locks(); i++)
        pthread_mutex_destroy(&(netw_ssl_lockarray[i]));
 
    OPENSSL_free(netw_ssl_lockarray);
}
 
static int OPENSSL_IS_INITIALIZED = 0;
 
int netw_init_openssl(void) {
    if (OPENSSL_IS_INITIALIZED == 1)
        return TRUE; /*already loaded*/
 
    SSL_library_init();
    SSL_load_error_strings();
    // Before OpenSSL 1.1.0 (< 0x10100000L): ERR_load_BIO_strings(); was required to load error messages for BIO functions
#if OPENSSL_VERSION_NUMBER < 0x10100000L
    ERR_load_BIO_strings();
#endif
    OpenSSL_add_all_algorithms();
    netw_init_locks();
 
#ifndef __windows__
    /* The raw send paths pass MSG_NOSIGNAL (NETFLAGS),
     * but OpenSSL's internal write(2) does not: a TLS peer that
     * disconnects mid-SSL_write delivers SIGPIPE and kills the whole
     * process (server, client, or test alike). Ignoring it here turns
     * that into the EPIPE errno the SSL error paths already handle.
     * Standard practice for OpenSSL applications; scoped to TLS users
     * since this only runs from netw_init_openssl. */
    signal(SIGPIPE, SIG_IGN);
#endif
 
    OPENSSL_IS_INITIALIZED = 1;
 
    return TRUE;
} /*netw_init_openssl(...)*/
 
int netw_unload_openssl(void) {
    if (OPENSSL_IS_INITIALIZED == 0)
        return TRUE; /*already unloaded*/
 
    netw_kill_locks();
    EVP_cleanup();
 
    OPENSSL_IS_INITIALIZED = 0;
 
    return TRUE;
} /*netw_unload_openssl(...)*/
 
int netw_set_crypto(NETWORK* netw, char* key, char* certificate) {
    __n_assert(netw, return FALSE);
 
    char* tmp_key = NULL;
    char* tmp_cert = NULL;
    if (key && strlen(key) > 0) {
        tmp_key = strdup(key);
        if (!tmp_key) {
            n_log(LOG_ERR, "strdup failed for key in netw_set_crypto");
            return FALSE;
        }
    }
    if (certificate && strlen(certificate) > 0) {
        tmp_cert = strdup(certificate);
        if (!tmp_cert) {
            n_log(LOG_ERR, "strdup failed for certificate in netw_set_crypto");
            FreeNoLog(tmp_key);
            return FALSE;
        }
    }
    if (tmp_key) {
        FreeNoLog(netw->key);
        netw->key = tmp_key;
    }
    if (tmp_cert) {
        FreeNoLog(netw->certificate);
        netw->certificate = tmp_cert;
    }
    if (key && certificate) {
        netw_init_openssl();
#if OPENSSL_VERSION_NUMBER >= 0x10100000L  // OpenSSL 1.1.0 or later
        netw->method = TLS_method();       // create new server-method instance
#else
        netw->method = TLSv1_2_method();  // create new server-method instance
#endif
        netw->ctx = SSL_CTX_new(netw->method);  // create new context from method
                                                // SSL_CTX_set_verify(netw -> ctx, SSL_VERIFY_PEER, NULL); // Enable certificate verification
 
        if (netw->ctx == NULL) {
            netw_ssl_print_errors(netw->link.sock);
            return FALSE;
        }
        /* PARTIAL_WRITE: a short SSL_write can be resumed from the
         * caller's buffer+offset (required by the reactor's
         * single-attempt send path); MOVING_WRITE_BUFFER: tolerate the
         * resume pointer not being the original one. No-op for the
         * blocking thread engine. */
        SSL_CTX_set_mode(netw->ctx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
 
#if OPENSSL_VERSION_NUMBER >= 0x10101000L
        /* 2026-07-18 — send ZERO TLS 1.3 session tickets. The threaded
         * client engine runs SSL_read (recv thread) and SSL_write (send
         * thread) on the same SSL*; OpenSSL does not support concurrent
         * use, and the one window where the read path MUTATES shared
         * session state is post-handshake NewSessionTicket processing —
         * which lands at the exact moment the client fires its first
         * application write (HELLO). On low-RTT links (loopback / LAN)
         * the overlap corrupts the client's outbound record stream and
         * the server dies with "decryption failed or bad record mac" on
         * its FIRST read (torn records can also sit unreadable for
         * seconds until more bytes complete them). Nothing here uses TLS
         * session resumption, so tickets are pure race surface — drop
         * them at the source. Higher-RTT links (the 8 ms VPS) rarely hit
         * the window, which is why this only surfaced on local servers. */
        SSL_CTX_set_num_tickets(netw->ctx, 0);
#endif
 
        // Load default system certs
        if (SSL_CTX_load_verify_locations(netw->ctx, NULL, "/etc/ssl/certs/") != 1) {
            netw_ssl_print_errors(netw->link.sock);
            return FALSE;
        }
 
        if (SSL_CTX_use_certificate_file(netw->ctx, certificate, SSL_FILETYPE_PEM) <= 0) {
            netw_ssl_print_errors(netw->link.sock);
            return FALSE;
        }
        if (SSL_CTX_use_PrivateKey_file(netw->ctx, key, SSL_FILETYPE_PEM) <= 0) {
            netw_ssl_print_errors(netw->link.sock);
            return FALSE;
        }
 
        netw->send_data = &send_ssl_data;
        netw->recv_data = &recv_ssl_data;
        netw->send_data_once = &send_ssl_data_once;
        netw->recv_data_once = &recv_ssl_data_once;
 
        netw->crypto_algo = NETW_ENCRYPT_OPENSSL;
    }
 
    return TRUE;
} /* netw_set_crypto */
 
int netw_set_crypto_pem(NETWORK* netw, const char* key_pem, const char* cert_pem) {
    __n_assert(netw, return FALSE);
    __n_assert(key_pem, return FALSE);
    __n_assert(cert_pem, return FALSE);
 
    netw_init_openssl();
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
    netw->method = TLS_method();
#else
    netw->method = TLSv1_2_method();
#endif
    netw->ctx = SSL_CTX_new(netw->method);
    if (netw->ctx == NULL) {
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
    /* PARTIAL_WRITE: a short SSL_write can be resumed from the
     * caller's buffer+offset (required by the reactor's
     * single-attempt send path); MOVING_WRITE_BUFFER: tolerate the
     * resume pointer not being the original one. No-op for the
     * blocking thread engine. */
    SSL_CTX_set_mode(netw->ctx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
 
#if OPENSSL_VERSION_NUMBER >= 0x10101000L
    /* 2026-07-18 — zero TLS 1.3 session tickets; see the twin comment in
     * netw_set_crypto: post-handshake NewSessionTicket processing in the
     * client's recv thread races the send thread's first SSL_write on the
     * shared SSL* ("bad record mac" at connect on low-RTT links). No
     * consumer uses session resumption. */
    SSL_CTX_set_num_tickets(netw->ctx, 0);
#endif
 
    /* Load certificate from PEM string */
    BIO* cert_bio = BIO_new_mem_buf(cert_pem, -1);
    if (!cert_bio) {
        n_log(LOG_ERR, "Failed to create BIO for certificate PEM");
        return FALSE;
    }
    X509* cert = PEM_read_bio_X509(cert_bio, NULL, NULL, NULL);
    BIO_free(cert_bio);
    if (!cert) {
        n_log(LOG_ERR, "Failed to parse certificate PEM");
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
    if (SSL_CTX_use_certificate(netw->ctx, cert) <= 0) {
        X509_free(cert);
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
    X509_free(cert);
 
    /* Load private key from PEM string */
    BIO* key_bio = BIO_new_mem_buf(key_pem, -1);
    if (!key_bio) {
        n_log(LOG_ERR, "Failed to create BIO for key PEM");
        return FALSE;
    }
    EVP_PKEY* pkey = PEM_read_bio_PrivateKey(key_bio, NULL, NULL, NULL);
    BIO_free(key_bio);
    if (!pkey) {
        n_log(LOG_ERR, "Failed to parse private key PEM");
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
    if (SSL_CTX_use_PrivateKey(netw->ctx, pkey) <= 0) {
        EVP_PKEY_free(pkey);
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
    EVP_PKEY_free(pkey);
 
    /* Verify that key matches certificate */
    if (!SSL_CTX_check_private_key(netw->ctx)) {
        n_log(LOG_ERR, "Private key does not match the certificate");
        return FALSE;
    }
 
    netw->send_data = &send_ssl_data;
    netw->recv_data = &recv_ssl_data;
    netw->send_data_once = &send_ssl_data_once;
    netw->recv_data_once = &recv_ssl_data_once;
    netw->crypto_algo = NETW_ENCRYPT_OPENSSL;
 
    return TRUE;
} /* netw_set_crypto_pem */
 
int netw_set_crypto_chain(NETWORK* netw, char* key, char* certificate, char* ca_file) {
    __n_assert(netw, return FALSE);
    __n_assert(key, return FALSE);
    __n_assert(certificate, return FALSE);
    __n_assert(ca_file, return FALSE);
 
    if (netw_set_crypto(netw, key, certificate) == FALSE) {
        return FALSE;
    }
 
    /* Load the full certificate chain */
    if (SSL_CTX_use_certificate_chain_file(netw->ctx, certificate) <= 0) {
        n_log(LOG_ERR, "Failed to load certificate chain from %s", certificate);
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
 
    /* Load CA file for verification */
    if (SSL_CTX_load_verify_locations(netw->ctx, ca_file, NULL) != 1) {
        n_log(LOG_ERR, "Failed to load CA file %s", ca_file);
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
 
    return TRUE;
} /* netw_set_crypto_chain */
 
int netw_set_crypto_chain_pem(NETWORK* netw, const char* key_pem, const char* cert_pem, const char* ca_pem) {
    __n_assert(netw, return FALSE);
    __n_assert(key_pem, return FALSE);
    __n_assert(cert_pem, return FALSE);
    __n_assert(ca_pem, return FALSE);
 
    if (netw_set_crypto_pem(netw, key_pem, cert_pem) == FALSE) {
        return FALSE;
    }
 
    /* Load CA certificate from PEM string into the trust store */
    BIO* ca_bio = BIO_new_mem_buf(ca_pem, -1);
    if (!ca_bio) {
        n_log(LOG_ERR, "Failed to create BIO for CA PEM");
        return FALSE;
    }
 
    X509_STORE* store = SSL_CTX_get_cert_store(netw->ctx);
    if (!store) {
        BIO_free(ca_bio);
        n_log(LOG_ERR, "Failed to get certificate store from SSL context");
        return FALSE;
    }
 
    X509* ca_cert = NULL;
    int ca_loaded = 0;
    while ((ca_cert = PEM_read_bio_X509(ca_bio, NULL, NULL, NULL)) != NULL) {
        if (X509_STORE_add_cert(store, ca_cert) != 1) {
            n_log(LOG_ERR, "Failed to add CA certificate to store");
            X509_free(ca_cert);
            BIO_free(ca_bio);
            return FALSE;
        }
        X509_free(ca_cert);
        ca_loaded++;
    }
    BIO_free(ca_bio);
 
    if (ca_loaded == 0) {
        n_log(LOG_ERR, "No CA certificates were loaded from PEM string");
        return FALSE;
    }
 
    /* Also load any extra chain certificates from the cert PEM */
    BIO* chain_bio = BIO_new_mem_buf(cert_pem, -1);
    if (chain_bio) {
        /* Skip the first certificate (already loaded as the leaf) */
        X509* skip_cert = PEM_read_bio_X509(chain_bio, NULL, NULL, NULL);
        if (skip_cert) {
            X509_free(skip_cert);
        }
        /* Load remaining certificates as chain intermediates */
        X509* chain_cert = NULL;
        while ((chain_cert = PEM_read_bio_X509(chain_bio, NULL, NULL, NULL)) != NULL) {
            if (SSL_CTX_add_extra_chain_cert(netw->ctx, chain_cert) != 1) {
                n_log(LOG_ERR, "Failed to add chain certificate");
                X509_free(chain_cert);
            }
            /* Note: SSL_CTX_add_extra_chain_cert takes ownership, so no X509_free on success */
        }
        BIO_free(chain_bio);
    }
 
    return TRUE;
} /* netw_set_crypto_chain_pem */
 
/* Install an in-memory certificate and key on a single SSL connection. Shared
 * by netw_set_crypto_pem_ctx and the SNI accept callback. Returns 0 on success,
 * -1 on error. */
static int _ssl_use_pem(SSL* ssl, const char* key_pem, const char* cert_pem) {
    BIO* cbio = BIO_new_mem_buf(cert_pem, -1);
    X509* cert = NULL;
    int rc = -1;
    if (!cbio)
        return -1;
    cert = PEM_read_bio_X509(cbio, NULL, NULL, NULL);
    BIO_free(cbio);
    if (!cert)
        return -1;
    if (SSL_use_certificate(ssl, cert) == 1) {
        BIO* kbio = BIO_new_mem_buf(key_pem, -1);
        if (kbio) {
            EVP_PKEY* pkey = PEM_read_bio_PrivateKey(kbio, NULL, NULL, NULL);
            BIO_free(kbio);
            if (pkey) {
                if (SSL_use_PrivateKey(ssl, pkey) == 1 && SSL_check_private_key(ssl) == 1)
                    rc = 0;
                EVP_PKEY_free(pkey);
            }
        }
    }
    X509_free(cert);
    return rc;
}
 
const char* netw_ssl_get_sni(NETWORK* netw) {
    __n_assert(netw, return NULL);
    if (!netw->ssl)
        return NULL;
    return SSL_get_servername(netw->ssl, TLSEXT_NAMETYPE_host_name);
}
 
int netw_set_crypto_pem_ctx(NETWORK* netw, const N_STR* key_pem, const N_STR* cert_pem) {
    __n_assert(netw, return FALSE);
    __n_assert(netw->ssl, return FALSE);
    __n_assert(key_pem && key_pem->data, return FALSE);
    __n_assert(cert_pem && cert_pem->data, return FALSE);
    if (_ssl_use_pem(netw->ssl, key_pem->data, cert_pem->data) != 0) {
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
    return TRUE;
}
 
/* Arg handed (by stack pointer) to the servername callback for the duration of
 * a single netw_accept_ssl_with_sni_cb call. */
typedef struct NETW_SNI_ARG {
    netw_sni_pick_cb pick;
    void* user_data;
} NETW_SNI_ARG;
 
/* OpenSSL servername callback: fires during SSL_accept once the ClientHello is
 * parsed. Picks a per-host certificate via the caller's pick() and installs it
 * on the current SSL so the handshake completes with a host-matching leaf. */
static int _netw_sni_servername_cb(SSL* ssl, int* al, void* arg) {
    NETW_SNI_ARG* a = (NETW_SNI_ARG*)arg;
    const char* sni;
    N_STR* cert_pem = NULL;
    N_STR* key_pem = NULL;
    int ok;
    (void)al;
    if (!a || !a->pick)
        return SSL_TLSEXT_ERR_OK;
    sni = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name);
    if (a->pick(sni, &cert_pem, &key_pem, a->user_data) != 0 || !cert_pem || !key_pem) {
        if (cert_pem)
            free_nstr(&cert_pem);
        if (key_pem)
            free_nstr(&key_pem);
        return SSL_TLSEXT_ERR_ALERT_FATAL;
    }
    ok = (_ssl_use_pem(ssl, key_pem->data, cert_pem->data) == 0);
    free_nstr(&cert_pem);
    free_nstr(&key_pem);
    return ok ? SSL_TLSEXT_ERR_OK : SSL_TLSEXT_ERR_ALERT_FATAL;
}
 
int netw_ssl_server_handshake(NETWORK* netw, netw_sni_pick_cb pick, void* user_data) {
    NETW_SNI_ARG arg;
    __n_assert(netw, return FALSE);
    __n_assert(pick, return FALSE);
 
    netw_init_openssl();
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
    netw->method = TLS_method();
#else
    netw->method = TLSv1_2_method();
#endif
    netw->ctx = SSL_CTX_new(netw->method);
    if (!netw->ctx) {
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
    SSL_CTX_set_mode(netw->ctx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
    SSL_CTX_set_tlsext_servername_callback(netw->ctx, _netw_sni_servername_cb);
 
    /* The callback runs synchronously inside the blocking SSL_accept below, so a
     * stack-scoped arg is valid for its whole lifetime and needs no heap/free. */
    arg.pick = pick;
    arg.user_data = user_data;
    SSL_CTX_set_tlsext_servername_arg(netw->ctx, &arg);
 
    netw->ssl = SSL_new(netw->ctx);
    if (!netw->ssl) {
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
    SSL_set_fd(netw->ssl, (int)netw->link.sock);
    netw->send_data = &send_ssl_data;
    netw->recv_data = &recv_ssl_data;
    netw->send_data_once = &send_ssl_data_once;
    netw->recv_data_once = &recv_ssl_data_once;
    netw->crypto_algo = NETW_ENCRYPT_OPENSSL;
 
    if (SSL_accept(netw->ssl) <= 0) {
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
    return TRUE;
}
 
NETWORK* netw_accept_ssl_with_sni_cb(NETWORK* listen, netw_sni_pick_cb pick, void* user_data) {
    NETWORK* client;
    __n_assert(listen, return NULL);
    __n_assert(pick, return NULL);
    client = netw_accept_from(listen);
    if (!client)
        return NULL;
    if (netw_ssl_server_handshake(client, pick, user_data) != TRUE) {
        netw_close(&client);
        return NULL;
    }
    return client;
}
 
int netw_ssl_set_ca(NETWORK* netw, const char* ca_file, const char* ca_path) {
    __n_assert(netw, return FALSE);
    __n_assert(netw->ctx, n_log(LOG_ERR, "SSL context not initialized, call netw_set_crypto first"); return FALSE);
 
    if (!ca_file && !ca_path) {
        n_log(LOG_ERR, "At least one of ca_file or ca_path must be specified");
        return FALSE;
    }
 
    if (SSL_CTX_load_verify_locations(netw->ctx, ca_file, ca_path) != 1) {
        n_log(LOG_ERR, "Failed to load CA from file=%s path=%s", _str(ca_file), _str(ca_path));
        _netw_capture_error(netw, "Failed to load CA from file=%s path=%s", _str(ca_file), _str(ca_path));
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
 
    return TRUE;
} /* netw_ssl_set_ca */
 
int netw_ssl_set_verify(NETWORK* netw, int enable) {
    __n_assert(netw, return FALSE);
    __n_assert(netw->ctx, n_log(LOG_ERR, "SSL context not initialized, call netw_set_crypto first"); return FALSE);
 
    if (enable) {
        SSL_CTX_set_verify(netw->ctx, SSL_VERIFY_PEER, NULL);
    } else {
        SSL_CTX_set_verify(netw->ctx, SSL_VERIFY_NONE, NULL);
    }
 
    return TRUE;
} /* netw_ssl_set_verify */
 
int netw_ssl_get_verify_result(NETWORK* netw, const char* expected_host, char* errbuf, size_t errsz) {
    X509* cert = NULL;
    STACK_OF(X509)* chain = NULL;
    X509_STORE* store = NULL;
    X509_STORE_CTX* store_ctx = NULL;
    int chain_ok = 0;
    int host_ok = 1;
    int result = FALSE;
 
    if (errbuf && errsz > 0)
        errbuf[0] = '\0';
    __n_assert(netw, return FALSE);
    __n_assert(netw->ssl, return FALSE);
 
    cert = SSL_get_peer_certificate(netw->ssl);
    if (!cert) {
        if (errbuf && errsz > 0)
            snprintf(errbuf, errsz, "no peer certificate");
        return FALSE;
    }
    chain = SSL_get_peer_cert_chain(netw->ssl);
 
    store = X509_STORE_new();
    store_ctx = X509_STORE_CTX_new();
    if (!store || !store_ctx) {
        if (errbuf && errsz > 0)
            snprintf(errbuf, errsz, "out of memory");
        goto cleanup;
    }
    X509_STORE_set_default_paths(store);
    if (X509_STORE_CTX_init(store_ctx, store, cert, chain) != 1) {
        if (errbuf && errsz > 0)
            snprintf(errbuf, errsz, "verify init failed");
        goto cleanup;
    }
    if (X509_verify_cert(store_ctx) == 1) {
        chain_ok = 1;
    } else {
        int verr = X509_STORE_CTX_get_error(store_ctx);
        if (errbuf && errsz > 0)
            snprintf(errbuf, errsz, "%s", X509_verify_cert_error_string(verr));
    }
    if (expected_host && expected_host[0]) {
        if (X509_check_host(cert, expected_host, 0, 0, NULL) != 1) {
            host_ok = 0;
            if (errbuf && errsz > 0 && chain_ok)
                snprintf(errbuf, errsz, "hostname mismatch for %s", expected_host);
        }
    }
    result = (chain_ok && host_ok) ? TRUE : FALSE;
 
cleanup:
    if (store_ctx)
        X509_STORE_CTX_free(store_ctx);
    if (store)
        X509_STORE_free(store);
    X509_free(cert);
    return result;
} /* netw_ssl_get_verify_result */
 
int netw_ssl_set_client_cert(NETWORK* netw, const char* cert_file, const char* key_file) {
    __n_assert(netw, return FALSE);
    __n_assert(netw->ctx, n_log(LOG_ERR, "SSL context not initialized"); return FALSE);
    __n_assert(cert_file, return FALSE);
 
    if (SSL_CTX_use_certificate_file(netw->ctx, cert_file, SSL_FILETYPE_PEM) != 1) {
        n_log(LOG_ERR, "Failed to load client certificate from %s", cert_file);
        _netw_capture_error(netw, "Failed to load client certificate from %s", cert_file);
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
 
    const char* kf = key_file ? key_file : cert_file;
    if (SSL_CTX_use_PrivateKey_file(netw->ctx, kf, SSL_FILETYPE_PEM) != 1) {
        n_log(LOG_ERR, "Failed to load client private key from %s", kf);
        _netw_capture_error(netw, "Failed to load client private key from %s", kf);
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
 
    if (SSL_CTX_check_private_key(netw->ctx) != 1) {
        n_log(LOG_ERR, "Client certificate and private key do not match");
        _netw_capture_error(netw, "Client certificate and private key do not match");
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
 
    return TRUE;
} /* netw_ssl_set_client_cert */
 
#endif /* HAVE_OPENSSL */
 
#define NETW_CONNECT_ABORT_POLL_MS 100
 
static int (*_netw_connect_abort_cb)(void*) = NULL;
static void* _netw_connect_abort_ctx = NULL;
 
static int _netw_timed_connect(NETWORK* netw, SOCKET sock, struct addrinfo* rp, int connect_timeout_ms) {
    if (connect_timeout_ms <= 0) {
        return connect(sock, rp->ai_addr, (socklen_t)rp->ai_addrlen);
    }
 
    if (netw_set_blocking(netw, 0) == FALSE) {
        /* could not switch modes: fall back to a blocking connect */
        return connect(sock, rp->ai_addr, (socklen_t)rp->ai_addrlen);
    }
 
    int rc = connect(sock, rp->ai_addr, (socklen_t)rp->ai_addrlen);
    if (rc == 0) {
        netw_set_blocking(netw, 1);
        return 0;
    }
 
    int in_progress = 0;
#ifdef __windows__
    if (neterrno == WSAEWOULDBLOCK || neterrno == WSAEINPROGRESS) in_progress = 1;
#else
    if (neterrno == EINPROGRESS) in_progress = 1;
#endif
    if (!in_progress) {
        netw_set_blocking(netw, 1);
        return -1;
    }
 
    /* select() blocks the thread in the kernel (no busy-wait). If a signal
       interrupts it (EINTR) we retry with the remaining time so the total
       wait still honours connect_timeout_ms. select() only rewrites the
       timeval argument on Linux, so the remaining time is tracked
       explicitly with N_TIME for portability (Windows/MinGW included).
       When a connect-abort callback is registered the per-select wait is
       capped to NETW_CONNECT_ABORT_POLL_MS so the loop wakes periodically to
       poll it, letting a caller interrupt a connect to an unresponsive host
       without waiting out the whole connect timeout. */
    N_TIME timer;
    start_HiTimer(&timer);
    time_t remaining_us = (time_t)connect_timeout_ms * 1000;
    time_t poll_us = _netw_connect_abort_cb ? (time_t)NETW_CONNECT_ABORT_POLL_MS * 1000 : 0;
    int connected = 0;
    int aborted = 0;
    for (;;) {
        if (_netw_connect_abort_cb && _netw_connect_abort_cb(_netw_connect_abort_ctx)) {
            aborted = 1;
            break;
        }
        /* Watch both the write set and the exception set: a completed
           connect signals writefds, but on Winsock a *failed* connect
           signals exceptfds (not writefds). Watching only writefds there
           would miss the failure and wait out the whole timeout. The
           SO_ERROR check after the loop is the final arbiter on both. */
        fd_set wset, eset;
        FD_ZERO(&wset);
        FD_SET(sock, &wset);
        FD_ZERO(&eset);
        FD_SET(sock, &eset);
        time_t wait_us = remaining_us;
        if (poll_us > 0 && wait_us > poll_us)
            wait_us = poll_us;
        struct timeval tv;
        tv.tv_sec = (long)(wait_us / 1000000);
        tv.tv_usec = (long)(wait_us % 1000000);
 
        int sel = select((int)sock + 1, NULL, &wset, &eset, &tv);
        if (sel > 0) {
            connected = 1; /* socket signalled; SO_ERROR check decides below */
            break;
        }
        if (sel == 0) {
            /* the select() wait expired: subtract it from the remaining budget.
               If this was only a poll slice (an abort callback is registered) and
               time is left, loop to re-check the callback; otherwise the connect
               timeout has been reached. */
            remaining_us -= get_usec(&timer);
            if (remaining_us <= 0)
                break; /* connect timed out */
            continue;
        }
        /* sel < 0 */
#ifdef __windows__
        int interrupted = (neterrno == WSAEINTR);
#else
        int interrupted = (neterrno == EINTR);
#endif
        if (!interrupted) {
            break; /* genuine select() error */
        }
        /* interrupted by a signal: subtract the time already spent and
           retry only if some of the budget is left. */
        remaining_us -= get_usec(&timer);
        if (remaining_us <= 0) {
            break; /* budget exhausted while interrupted */
        }
    }
 
    if (aborted || !connected) {
        netw_set_blocking(netw, 1);
        return -1;
    }
 
    int so_error = 0;
    socklen_t slen = sizeof(so_error);
    if (getsockopt(sock, SOL_SOCKET, SO_ERROR, (char*)&so_error, &slen) == -1 || so_error != 0) {
        netw_set_blocking(netw, 1);
        return -1;
    }
 
    netw_set_blocking(netw, 1);
    return 0;
} /* _netw_timed_connect */
 
void netw_set_connect_abort_cb(int (*cb)(void* ctx), void* ctx) {
    _netw_connect_abort_cb = cb;
    _netw_connect_abort_ctx = ctx;
} /* netw_set_connect_abort_cb(...) */
 
int netw_connect_ex_to(NETWORK** netw, char* host, char* port, size_t send_list_limit, size_t recv_list_limit, int ip_version, char* ssl_key_file, char* ssl_cert_file, int connect_timeout_ms) {
    // kill compilation warning when there is no openssl
    (void)ssl_key_file;
    (void)ssl_cert_file;
    int error = 0, net_status = 0;
    char* errmsg = NULL;
 
    /*do not work over an already used netw*/
    if ((*netw)) {
        n_log(LOG_ERR, "Unable to allocate (*netw), already existing. You must use empty NETWORK *structs.");
        return FALSE;
    }
 
    /*creating array*/
    (*netw) = netw_new(send_list_limit, recv_list_limit);
    __n_assert(netw && (*netw), return FALSE);
 
    /*checking WSA when under windows*/
    if (netw_init_wsa(1, 2, 2) == FALSE) {
        n_log(LOG_ERR, "Unable to load WSA dll's");
        netw_close(netw);
        return FALSE;
    }
 
    /* choose ip version */
    if (ip_version == NETWORK_IPV4) {
        (*netw)->link.hints.ai_family = AF_INET; /* Allow IPv4 */
    } else if (ip_version == NETWORK_IPV6) {
        (*netw)->link.hints.ai_family = AF_INET6; /* Allow IPv6 */
    } else {
        /* NETWORK_ALL or unknown value */
        (*netw)->link.hints.ai_family = AF_UNSPEC; /* Allow IPv4 or IPv6 */
    }
 
    (*netw)->link.hints.ai_socktype = SOCK_STREAM;
    (*netw)->link.hints.ai_protocol = IPPROTO_TCP;
    (*netw)->link.hints.ai_flags = AI_PASSIVE;
    (*netw)->link.hints.ai_canonname = NULL;
    (*netw)->link.hints.ai_next = NULL;
 
    /* Time the resolve and connect phases so callers can present a
       connect-timing breakdown. get_usec returns the delta since the
       previous call, so the first reads the DNS phase and the second
       reads the TCP-connect phase. */
    N_TIME connect_timer;
    start_HiTimer(&connect_timer);
 
    /* Note: on some system, i.e Solaris, it WILL show leak in getaddrinfo.
     * Testing it inside a 1,100 loop showed not effect on the amount of leaked
     * memory */
    error = getaddrinfo(host, port, &(*netw)->link.hints, &(*netw)->link.rhost);
    if (error != 0) {
        _netw_capture_error(*netw, "Error when resolving %s:%s getaddrinfo: %s", host, port, gai_strerror(error));
        n_log(LOG_ERR, "Error when resolving %s:%s getaddrinfo: %s", host, port, gai_strerror(error));
        _netw_capture_connect_error("DNS resolution failed for %s:%s: %s", host, port, gai_strerror(error));
        netw_close(netw);
        return FALSE;
    }
    (*netw)->addr_infos_loaded = 1;
    (*netw)->connect_dns_usec = (long long)get_usec(&connect_timer);
    Malloc((*netw)->link.ip, char, 64);
    __n_assert((*netw)->link.ip, netw_close(netw); return FALSE);
 
    /* getaddrinfo() returns a list of address structures. Try each address until we successfully connect. If socket or connect fails, we close the socket and try the next address. */
    struct addrinfo* rp = NULL;
    for (rp = (*netw)->link.rhost; rp != NULL; rp = rp->ai_next) {
        SOCKET sock = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
        if (sock == INVALID_SOCKET) {
            error = neterrno;
            errmsg = netstrerror(error);
            n_log(LOG_ERR, "Error while trying to make a socket: %s", _str(errmsg));
            FreeNoLog(errmsg);
            continue;
        }
 
        (*netw)->link.sock = sock;
 
        net_status = _netw_timed_connect(*netw, sock, rp, connect_timeout_ms);
        if (net_status == -1) {
            error = neterrno;
            errmsg = netstrerror(error);
            n_log(LOG_INFO, "connecting to %s:%s : %s", host, port, _str(errmsg));
            FreeNoLog(errmsg);
            closesocket(sock);
            (*netw)->link.sock = INVALID_SOCKET;
            continue;
        } else {
            /*storing connected port and ip address*/
            if (!inet_ntop(rp->ai_family, get_in_addr(rp->ai_addr), (*netw)->link.ip, 64)) {
                error = neterrno;
                errmsg = netstrerror(error);
                n_log(LOG_ERR, "inet_ntop: %p , %s", rp, _str(errmsg));
                FreeNoLog(errmsg);
            }
            break; /* Success */
        }
    }
    if (rp == NULL) {
        /* No address succeeded */
        _netw_capture_error(*netw, "Couldn't connect to %s:%s : no address succeeded", host, port);
        n_log(LOG_ERR, "Couldn't connect to %s:%s : no address succeeded", host, port);
        _netw_capture_connect_error("TCP connect failed for %s:%s: no address succeeded", host, port);
        netw_close(netw);
        return FALSE;
    }
    (*netw)->connect_tcp_usec = (long long)get_usec(&connect_timer);
 
    (*netw)->link.port = strdup(port);
    __n_assert((*netw)->link.port, netw_close(netw); return FALSE);
 
    if (ssl_key_file && ssl_cert_file) {
#ifdef HAVE_OPENSSL
        if (netw_set_crypto((*netw), ssl_key_file, ssl_cert_file) == FALSE) {
            /* could not initialize SSL */
            n_log(LOG_ERR, "couldn't initialize SSL !");
            _netw_capture_error(*netw, "SSL initialization failed");
            netw_close(netw);
            return FALSE;
        }
 
        (*netw)->ssl = SSL_new((*netw)->ctx);
        SSL_set_fd((*netw)->ssl, (int)(*netw)->link.sock);
 
        // Perform SSL Handshake
        if (SSL_connect((*netw)->ssl) <= 0) {
            /* could not connect with SSL */
            n_log(LOG_ERR, "SSL Handshake error !");
            _netw_capture_error(*netw, "SSL handshake failed for %s:%s", (*netw)->link.ip, (*netw)->link.port);
            netw_close(netw);
            return FALSE;
        }
        n_log(LOG_DEBUG, "SSL-Connected to %s:%s", (*netw)->link.ip, (*netw)->link.port);
#else
        _netw_capture_error(*netw, "%s:%s trying to configure SSL but application was compiled without SSL support !", (*netw)->link.ip, (*netw)->link.port);
        n_log(LOG_ERR, "%s:%s trying to configure SSL but application was compiled without SSL support !", (*netw)->link.ip, (*netw)->link.port);
#endif
    } else {
        n_log(LOG_DEBUG, "Connected to %s:%s", (*netw)->link.ip, (*netw)->link.port);
    }
 
    netw_set((*netw), NETW_CLIENT | NETW_RUN | NETW_THR_ENGINE_STOPPED);
 
    return TRUE;
} /* netw_connect_ex_to(...)*/
 
int netw_connect_ex(NETWORK** netw, char* host, char* port, size_t send_list_limit, size_t recv_list_limit, int ip_version, char* ssl_key_file, char* ssl_cert_file) {
    return netw_connect_ex_to(netw, host, port, send_list_limit, recv_list_limit, ip_version, ssl_key_file, ssl_cert_file, 0);
} /* netw_connect_ex(...)*/
 
int netw_connect(NETWORK** netw, char* host, char* port, int ip_version) {
    n_log(LOG_INFO, "Trying to connect to %s : %s", _str(host), _str(port));
    return netw_connect_ex(netw, host, port, MAX_LIST_ITEMS, MAX_LIST_ITEMS, ip_version, NULL, NULL);
} /* netw_connect() */
 
int netw_connect_to(NETWORK** netw, char* host, char* port, int ip_version, int connect_timeout_ms) {
    n_log(LOG_INFO, "Trying to connect to %s : %s (connect timeout %d ms)", _str(host), _str(port), connect_timeout_ms);
    return netw_connect_ex_to(netw, host, port, MAX_LIST_ITEMS, MAX_LIST_ITEMS, ip_version, NULL, NULL, connect_timeout_ms);
} /* netw_connect_to() */
 
#ifdef HAVE_OPENSSL
int netw_ssl_connect(NETWORK** netw, char* host, char* port, int ip_version, char* ssl_key_file, char* ssl_cert_file) {
    n_log(LOG_INFO, "Trying to connect to %s : %s", _str(host), _str(port));
    return netw_connect_ex(netw, host, port, MAX_LIST_ITEMS, MAX_LIST_ITEMS, ip_version, ssl_key_file, ssl_cert_file);
} /* netw_connect() */
 
int netw_ssl_connect_client_to(NETWORK** netw, char* host, char* port, int ip_version, int connect_timeout_ms) {
    __n_assert(netw, return FALSE);
    /* TCP connect first (no SSL params) */
    if (netw_connect_ex_to(netw, host, port, MAX_LIST_ITEMS, MAX_LIST_ITEMS, ip_version, NULL, NULL, connect_timeout_ms) == FALSE) {
        return FALSE;
    }
    if (netw_ssl_start_client(*netw) == FALSE) {
        netw_close(netw);
        return FALSE;
    }
    return TRUE;
} /* netw_ssl_connect_client_to */
 
int netw_ssl_start_client(NETWORK* netw) {
    __n_assert(netw, return FALSE);
    /* Create SSL context for client */
    netw_init_openssl();
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
    netw->method = TLS_client_method();
#else
    netw->method = TLSv1_2_client_method();
#endif
    netw->ctx = SSL_CTX_new(netw->method);
    if (!netw->ctx) {
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
    /* PARTIAL_WRITE: a short SSL_write can be resumed from the
     * caller's buffer+offset (required by the reactor's
     * single-attempt send path); MOVING_WRITE_BUFFER: tolerate the
     * resume pointer not being the original one. No-op for the
     * blocking thread engine. */
    SSL_CTX_set_mode(netw->ctx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
    /* Load default system CA paths */
    SSL_CTX_set_default_verify_paths(netw->ctx);
    /* Set send/recv to SSL variants */
    netw->send_data = &send_ssl_data;
    netw->recv_data = &recv_ssl_data;
    netw->send_data_once = &send_ssl_data_once;
    netw->recv_data_once = &recv_ssl_data_once;
    netw->crypto_algo = NETW_ENCRYPT_OPENSSL;
    return TRUE;
} /* netw_ssl_start_client */
 
int netw_ssl_connect_client(NETWORK** netw, char* host, char* port, int ip_version) {
    return netw_ssl_connect_client_to(netw, host, port, ip_version, 0);
} /* netw_ssl_connect_client */
 
int netw_ssl_do_handshake(NETWORK* netw, const char* sni_hostname) {
    __n_assert(netw, return FALSE);
    __n_assert(netw->ctx, n_log(LOG_ERR, "netw_ssl_do_handshake: no SSL context"); return FALSE);
 
    netw->ssl = SSL_new(netw->ctx);
    if (!netw->ssl) {
        _netw_capture_error(netw, "SSL_new failed");
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
    SSL_set_fd(netw->ssl, (int)netw->link.sock);
    if (sni_hostname) {
        SSL_set_tlsext_host_name(netw->ssl, sni_hostname);
    }
    if (SSL_connect(netw->ssl) <= 0) {
        n_log(LOG_ERR, "SSL handshake failed");
        unsigned long err = ERR_peek_error();
        _netw_capture_error(netw, "SSL handshake failed for %s:%s: %s",
                            _str(netw->link.ip), _str(netw->link.port),
                            err ? ERR_reason_error_string(err) : "unknown error");
        netw_ssl_print_errors(netw->link.sock);
        return FALSE;
    }
    n_log(LOG_DEBUG, "SSL handshake completed with %s:%s", _str(netw->link.ip), _str(netw->link.port));
    return TRUE;
} /* netw_ssl_do_handshake */
 
#endif
 
int netw_get_state(NETWORK* netw, uint32_t* state, int* thr_engine_status) {
    if (netw) {
        /* use eventbolt: netw_set() writes state/threaded_engine_status under eventbolt */
        pthread_mutex_lock(&netw->eventbolt);
        if (state)
            (*state) = netw_atomic_read_state(netw);
        if (thr_engine_status)
            (*thr_engine_status) = netw->threaded_engine_status;
        pthread_mutex_unlock(&netw->eventbolt);
        return TRUE;
    } else {
        n_log(LOG_ERR, "Can't get status of a NULL network");
    }
    return FALSE;
} /*netw_get_state() */
 
int netw_set(NETWORK* netw, int flag) {
    __n_assert(netw, return FALSE);
    if (flag & NETW_EMPTY_SENDBUF) {
        pthread_mutex_lock(&netw->sendbolt);
        if (netw->send_buf)
            list_empty(netw->send_buf);
        pthread_mutex_unlock(&netw->sendbolt);
    };
    if (flag & NETW_EMPTY_RECVBUF) {
        pthread_mutex_lock(&netw->recvbolt);
        if (netw->recv_buf)
            list_empty(netw->recv_buf);
        pthread_mutex_unlock(&netw->recvbolt);
    }
    if (flag & NETW_DESTROY_SENDBUF) {
        pthread_mutex_lock(&netw->sendbolt);
        if (netw->send_buf)
            list_destroy(&netw->send_buf);
        pthread_mutex_unlock(&netw->sendbolt);
    };
    if (flag & NETW_DESTROY_RECVBUF) {
        pthread_mutex_lock(&netw->recvbolt);
        if (netw->recv_buf)
            list_destroy(&netw->recv_buf);
        pthread_mutex_unlock(&netw->recvbolt);
    }
    pthread_mutex_lock(&netw->eventbolt);
    if (flag & NETW_CLIENT) {
        netw->mode = NETW_CLIENT;
    }
    if (flag & NETW_SERVER) {
        netw->mode = NETW_SERVER;
    }
    if (flag & NETW_RUN) {
        netw_atomic_write_state(netw, NETW_RUN);
    }
    if (flag & NETW_EXITED) {
        netw_atomic_write_state(netw, NETW_EXITED);
    }
    if (flag & NETW_ERROR) {
        netw_atomic_write_state(netw, NETW_ERROR);
    }
    if (flag & NETW_EXIT_ASKED) {
        netw_atomic_write_state(netw, NETW_EXIT_ASKED);
    }
    if (flag & NETW_THR_ENGINE_STARTED) {
        netw->threaded_engine_status = NETW_THR_ENGINE_STARTED;
    }
    if (flag & NETW_THR_ENGINE_STOPPED) {
        netw->threaded_engine_status = NETW_THR_ENGINE_STOPPED;
    }
    pthread_mutex_unlock(&netw->eventbolt);
 
    /* Only wake the send thread for state changes it actually cares
     * about. The inner loop in netw_send_func branches on NETW_ERROR,
     * NETW_EXITED, and NETW_EXIT_ASKED; every other flag (mode /
     * thread-engine-status / buffer maintenance) is invisible to it,
     * and posting unconditionally creates a spurious wakeup that,
     * paired with an empty send_buf, produces the classic
     * "offset-by-one semaphore" bug where every subsequent real
     * list_push leaves one extra post in the semaphore for the next
     * sem_wait to consume on a drained list. Avoiding the spurious
     * post here is the root cause fix and removes the need for a
     * defensive branch in the common path. */
    if (flag & (NETW_ERROR | NETW_EXITED | NETW_EXIT_ASKED)) {
        sem_post(&netw->send_blocker);
    }
 
    return TRUE;
} /* netw_set(...) */
 
int deplete_send_buffer(int fd, int timeout) {
#if defined(__linux__)
    int outstanding = 0;
    if (timeout <= 0) {
        return 0;
    }
    for (int it = 0; it < timeout; it += 100) {
        outstanding = 0;
        if (ioctl(fd, SIOCOUTQ, &outstanding) == -1) {
            int error = errno;
            n_log(LOG_ERR, "ioctl SIOCOUTQ returned -1: %s for socket %d", strerror(error), fd);
            return -1;
        }
        if (!outstanding) {
            break;
        }
        usleep(100000);
    }
    return outstanding;
#else
    (void)fd;
    (void)timeout;
    return 0;
#endif
}
 
int netw_close(NETWORK** netw) {
    __n_assert(netw && (*netw), return FALSE);
    uint32_t state = 0;
    int thr_engine_status = 0;
    int nb_running = 0;
 
    /* Reactor close handshake. Synchronously wait for the reactor to
     * finish with this connection (drains pending sends best-effort,
     * shutdown(SHUT_WR) so the peer sees EOF, removes the fd from the
     * epoll set, publishes the close ack) before any of the existing
     * close logic runs. After this returns the reactor will never touch
     * the NETWORK again, so the rest of netw_close (and the final Free)
     * proceeds exactly like the thread-mode path.
     *
     * Keyed on reactor_registered, NOT the live reactor_mode: the reactor
     * clears reactor_mode partway through unregister (peer EOF / hard
     * error) and keeps touching the NETWORK for a few more lines before
     * acking. Gating on reactor_mode would let a clear that lands just
     * before this read send us straight to Free() while the reactor is
     * still mid-unregister (use-after-free). reactor_registered is set
     * once at register time and never cleared, so this is race-free.
     *
     * Compile-time gated on N_REACTOR_AVAILABLE so non-Linux/Android
     * builds (Windows MinGW, Solaris) don't pull in n_reactor.o just
     * to satisfy this symbol, the reactor is unavailable there anyway
     * and reactor_registered can never be set. */
#if N_REACTOR_AVAILABLE
    if (__atomic_load_n(&(*netw)->reactor_registered, __ATOMIC_ACQUIRE)) {
        n_reactor_close_netw_sync(*netw);
    }
#endif
 
    if ((*netw)->deplete_queues_timeout > 0) {
        /* use iteration count to avoid integer overflow with large timeouts */
        int max_iterations = (*netw)->deplete_queues_timeout * 10; /* each iteration ~100ms */
        netw_get_state((*netw), &state, &thr_engine_status);
        if (thr_engine_status == NETW_THR_ENGINE_STARTED) {
            int it = 0;
            do {
                pthread_mutex_lock(&(*netw)->eventbolt);
                nb_running = (*netw)->nb_running_threads;
                pthread_mutex_unlock(&(*netw)->eventbolt);
                usleep(100000);
                it++;
            } while (nb_running > 0 && it < max_iterations);
            netw_get_state((*netw), &state, &thr_engine_status);
            if (it >= max_iterations && nb_running > 0) {
                n_log(LOG_ERR, "netw %d: %d threads are still running after %d seconds, netw is in state %s (%" PRIu32 ")", (*netw)->link.sock, nb_running, (*netw)->deplete_queues_timeout, N_ENUM_ENTRY(__netw_code_type, toString)(state), state);
            }
        }
    }
 
    if ((*netw)->link.sock != INVALID_SOCKET) {
        int remaining = deplete_send_buffer((int)(*netw)->link.sock, (*netw)->deplete_socket_timeout);
        // cppcheck-suppress knownConditionTrueFalse ; remaining can be > 0 on Linux (SIOCOUTQ)
        if (remaining > 0) {
            n_log(LOG_ERR, "socket %d (%s:%s) %d octets still in send buffer before closing after a wait of %d msecs", (*netw)->link.sock, (*netw)->link.ip, (*netw)->link.port, remaining, (*netw)->deplete_socket_timeout);
        }
    }
 
    list_foreach(node, (*netw)->pools) {
        NETWORK_POOL* pool = (NETWORK_POOL*)node->ptr;
        netw_pool_remove(pool, (*netw));
    }
    list_destroy(&(*netw)->pools);
 
    netw_get_state((*netw), &state, &thr_engine_status);
    if (thr_engine_status == NETW_THR_ENGINE_STARTED) {
        netw_stop_thr_engine((*netw));
    }
 
    /* recompute nb_running after joining threads so the SSL_shutdown
     * decision reflects the actual post-join state */
    pthread_mutex_lock(&(*netw)->eventbolt);
    nb_running = (*netw)->nb_running_threads;
    pthread_mutex_unlock(&(*netw)->eventbolt);
 
    if ((*netw)->link.sock != INVALID_SOCKET) {
#ifdef HAVE_OPENSSL
        if ((*netw)->crypto_algo == NETW_ENCRYPT_OPENSSL) {
            if ((*netw)->ssl) {
                /* only attempt SSL_shutdown if threads have fully stopped,
                 * otherwise SSL operations may race with send/recv threads */
                if (nb_running == 0) {
                    int shutdown_res = SSL_shutdown((*netw)->ssl);
                    if (shutdown_res == 0) {
                        /* try again to complete bidirectional shutdown;
                         * peer may have already closed (common for HTTP),
                         * so SYSCALL/SSL errors are non-fatal here */
                        shutdown_res = SSL_shutdown((*netw)->ssl);
                    }
                    if (shutdown_res < 0) {
                        int err = SSL_get_error((*netw)->ssl, shutdown_res);
                        if (err != SSL_ERROR_SYSCALL && err != SSL_ERROR_SSL) {
                            n_log(LOG_ERR, "SSL_shutdown() failed: %d", err);
                        } else {
                            n_log(LOG_DEBUG, "SSL_shutdown() peer already closed: %d", err);
                        }
                    }
                } else {
                    n_log(LOG_WARNING, "netw %d: forcing bidirectional SSL_shutdown with %d threads still running", (*netw)->link.sock, nb_running);
                    int shutdown_res = SSL_shutdown((*netw)->ssl);
                    if (shutdown_res == 0) {
                        /* send close_notify and wait for peer's close_notify */
                        shutdown_res = SSL_shutdown((*netw)->ssl);
                    }
                    if (shutdown_res < 0) {
                        int err = SSL_get_error((*netw)->ssl, shutdown_res);
                        n_log(LOG_ERR, "netw %d: SSL_shutdown() failed with %d threads still running: %d", (*netw)->link.sock, nb_running, err);
                    }
                }
                SSL_free((*netw)->ssl);
            } else {
                if ((*netw)->mode != NETW_SERVER) {
                    n_log(LOG_ERR, "SSL handle of socket %d was already NULL", (*netw)->link.sock);
                } else {
                    n_log(LOG_DEBUG, "listening socket %d has no SSL handle (expected)", (*netw)->link.sock);
                }
            }
        }
#endif
 
        /* inform peer that we have finished */
        shutdown((*netw)->link.sock, SHUT_WR);
 
        if ((*netw)->wait_close_timeout > 0) {
            /* wait for fin ack using select() to avoid busy-waiting.
             * Use iteration count to avoid integer overflow. */
            char buffer[4096] = "";
            int max_iters = (*netw)->wait_close_timeout * 10; /* each iteration ~100ms */
            for (int it = 0; it < max_iters; it++) {
                fd_set rfds;
                struct timeval tv;
                FD_ZERO(&rfds);
#pragma GCC diagnostic push
#pragma GCC diagnostic ignored "-Wsign-conversion"
                FD_SET((*netw)->link.sock, &rfds);
#pragma GCC diagnostic pop
                tv.tv_sec = 0;
                tv.tv_usec = 100000; /* 100ms */
                int sel = select((int)(*netw)->link.sock + 1, &rfds, NULL, NULL, &tv);
                if (sel > 0) {
                    ssize_t res = recv((*netw)->link.sock, buffer, 4096, NETFLAGS);
                    if (!res)
                        break;
                    if (res < 0) {
                        int error = neterrno;
                        if (error != ENOTCONN && error != EINTR && error != ECONNRESET
#ifdef __windows__
                            && error != WSAENOTCONN && error != WSAECONNRESET && error != WSAESHUTDOWN && error != WSAEWOULDBLOCK && error != WSAEINTR
#endif
                        ) {
                            char* errmsg = netstrerror(error);
                            n_log(LOG_ERR, "read returned error %d when closing socket %d (%s:%s): %s", error, (*netw)->link.sock, _str((*netw)->link.ip), (*netw)->link.port, _str(errmsg));
                            FreeNoLog(errmsg);
                        } else {
                            n_log(LOG_DEBUG, "wait close: connection gracefully closed on socket %d (%s:%s)", (*netw)->link.sock, _str((*netw)->link.ip), (*netw)->link.port);
                        }
                        break;
                    }
                } else if (sel < 0) {
                    /* select error, bail out */
                    int error = neterrno;
                    if (error != EINTR
#ifdef __windows__
                        && error != WSAEINTR
#endif
                    ) {
                        char* errmsg = netstrerror(error);
                        n_log(LOG_ERR, "select() error on socket %d during close: %s", (*netw)->link.sock, _str(errmsg));
                        FreeNoLog(errmsg);
                        break;
                    }
                }
                /* sel == 0: timeout, continue waiting */
            }
        }
 
        /* effectively close socket */
        closesocket((*netw)->link.sock);
 
#ifdef HAVE_OPENSSL
        /* clean openssl state. Accepted server-side SSL connections borrow
         * ctx from the listener (their ctx is NULL by design), so a NULL
         * ctx here is not an error, only the owner frees it. */
        if ((*netw)->crypto_algo == NETW_ENCRYPT_OPENSSL && (*netw)->ctx) {
            SSL_CTX_free((*netw)->ctx);
        }
        n_log(LOG_DEBUG, "socket %d closed", (*netw)->link.sock);
        FreeNoLog((*netw)->key);
        FreeNoLog((*netw)->certificate);
#endif
    }
 
    FreeNoLog((*netw)->link.ip);
    FreeNoLog((*netw)->link.port);
 
    if ((*netw)->link.rhost) {
        freeaddrinfo((*netw)->link.rhost);
    }
 
    /*list freeing*/
    netw_set((*netw), NETW_DESTROY_SENDBUF | NETW_DESTROY_RECVBUF);
 
    pthread_mutex_destroy(&(*netw)->recvbolt);
    pthread_mutex_destroy(&(*netw)->sendbolt);
    pthread_mutex_destroy(&(*netw)->eventbolt);
    sem_destroy(&(*netw)->send_blocker);
 
    Free((*netw));
 
    return TRUE;
} /* netw_close(...)*/
 
int netw_make_listening(NETWORK** netw, char* addr, char* port, int nbpending, int ip_version) {
    __n_assert(port, return FALSE);
 
    int error = 0;
    char* errmsg = NULL;
 
    if (*netw) {
        n_log(LOG_ERR, "Cannot use an allocated network. Please pass a NULL network to modify");
        return FALSE;
    }
 
    /*checking WSA when under windows*/
    if (netw_init_wsa(1, 2, 2) == FALSE) {
        n_log(LOG_ERR, "Unable to load WSA dll's");
        return FALSE;
    }
 
    (*netw) = netw_new(MAX_LIST_ITEMS, MAX_LIST_ITEMS);
    __n_assert((*netw), return FALSE);
    (*netw)->link.port = strdup(port);
    /*creating array*/
    if (ip_version == NETWORK_IPV4) {
        (*netw)->link.hints.ai_family = AF_INET; /* Allow IPv4 */
    } else if (ip_version == NETWORK_IPV6) {
        (*netw)->link.hints.ai_family = AF_INET6; /* Allow IPv6 */
    } else {
        /* NETWORK_ALL or unknown value */
        (*netw)->link.hints.ai_family = AF_UNSPEC; /* Allow IPv4 or IPv6 */
    }
    if (!addr) {
        (*netw)->link.hints.ai_flags = AI_PASSIVE; /* For wildcard IP address */
    }
    (*netw)->link.hints.ai_socktype = SOCK_STREAM;
    (*netw)->link.hints.ai_protocol = IPPROTO_TCP;
    (*netw)->link.hints.ai_canonname = NULL;
    (*netw)->link.hints.ai_next = NULL;
 
    error = getaddrinfo(addr, port, &(*netw)->link.hints, &(*netw)->link.rhost);
    if (error != 0) {
        _netw_capture_error(*netw, "Error when resolving %s:%s getaddrinfo: %s", _str(addr), port, gai_strerror(error));
        n_log(LOG_ERR, "Error when resolving %s:%s getaddrinfo: %s", _str(addr), port, gai_strerror(error));
        netw_close(netw);
        return FALSE;
    }
    (*netw)->addr_infos_loaded = 1;
 
    /* getaddrinfo() returns a list of address structures.
       Try each address until we successfully connect(2).
       If socket(2) (or connect(2)) fails, we (close the socket
       and) try the next address. */
    struct addrinfo* rp = NULL;
    for (rp = (*netw)->link.rhost; rp != NULL; rp = rp->ai_next) {
        (*netw)->link.sock = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
        if ((*netw)->link.sock == INVALID_SOCKET) {
            error = neterrno;
            errmsg = netstrerror(error);
            n_log(LOG_ERR, "Error while trying to make a socket: %s", _str(errmsg));
            FreeNoLog(errmsg);
            continue;
        }
        netw_setsockopt((*netw), SO_REUSEADDR, 1);
        // netw_setsockopt( (*netw), SO_REUSEPORT, 1 );
        if (bind((*netw)->link.sock, rp->ai_addr, (socklen_t)rp->ai_addrlen) == 0) {
            char* ip = NULL;
            Malloc(ip, char, 64);
            if (!ip) {
                n_log(LOG_ERR, "Error allocating 64 bytes for ip");
                netw_close(netw);
                return FALSE;
            }
            if (!inet_ntop(rp->ai_family, get_in_addr(rp->ai_addr), ip, 64)) {
                error = neterrno;
                errmsg = netstrerror(error);
                n_log(LOG_ERR, "inet_ntop: %p , %s", (*netw)->link.raddr, _str(errmsg));
                FreeNoLog(errmsg);
            }
            /*n_log( LOG_DEBUG, "Socket %d successfully binded to %s %s",  (*netw) -> link . sock, _str( ip ) , _str( port ) );*/
            (*netw)->link.ip = ip;
            break; /* Success */
        }
        error = neterrno;
        errmsg = netstrerror(error);
        _netw_capture_error(*netw, "Error from bind() on port %s neterrno: %s", port, errmsg);
        n_log(LOG_ERR, "Error from bind() on port %s neterrno: %s", port, errmsg);
        FreeNoLog(errmsg);
        closesocket((*netw)->link.sock);
    }
    if (rp == NULL) {
        /* No address succeeded */
        _netw_capture_error(*netw, "Couldn't get a socket for listening on port %s", port);
        n_log(LOG_ERR, "Couldn't get a socket for listening on port %s", port);
        netw_close(netw);
        return FALSE;
    }
 
    /* nb_pending connections*/
    (*netw)->nb_pending = nbpending;
    if (listen((*netw)->link.sock, (*netw)->nb_pending) != 0) {
        error = neterrno;
        errmsg = netstrerror(error);
        _netw_capture_error(*netw, "listen() failed on port %s: %s", port, _str(errmsg));
        n_log(LOG_ERR, "listen() failed on port %s: %s", port, _str(errmsg));
        FreeNoLog(errmsg);
        netw_close(netw);
        return FALSE;
    }
 
    netw_set((*netw), NETW_SERVER | NETW_RUN | NETW_THR_ENGINE_STOPPED);
 
    return TRUE;
} /* netw_make_listening(...)*/
 
int netw_bind_udp(NETWORK** netw, char* addr, char* port, int ip_version) {
    __n_assert(port, return FALSE);
 
    int error = 0;
    char* errmsg = NULL;
 
    if (*netw) {
        n_log(LOG_ERR, "Cannot use an allocated network. Please pass a NULL network to modify");
        return FALSE;
    }
 
    /*checking WSA when under windows*/
    if (netw_init_wsa(1, 2, 2) == FALSE) {
        n_log(LOG_ERR, "Unable to load WSA dll's");
        return FALSE;
    }
 
    (*netw) = netw_new(MAX_LIST_ITEMS, MAX_LIST_ITEMS);
    __n_assert((*netw), return FALSE);
    (*netw)->link.port = strdup(port);
    (*netw)->transport_type = NETWORK_UDP;
 
    /* choose ip version */
    if (ip_version == NETWORK_IPV4) {
        (*netw)->link.hints.ai_family = AF_INET;
    } else if (ip_version == NETWORK_IPV6) {
        (*netw)->link.hints.ai_family = AF_INET6;
    } else {
        (*netw)->link.hints.ai_family = AF_UNSPEC;
    }
    if (!addr) {
        (*netw)->link.hints.ai_flags = AI_PASSIVE;
    }
    (*netw)->link.hints.ai_socktype = SOCK_DGRAM;
    (*netw)->link.hints.ai_protocol = IPPROTO_UDP;
    (*netw)->link.hints.ai_canonname = NULL;
    (*netw)->link.hints.ai_next = NULL;
 
    error = getaddrinfo(addr, port, &(*netw)->link.hints, &(*netw)->link.rhost);
    if (error != 0) {
        _netw_capture_error(*netw, "Error when resolving %s:%s getaddrinfo: %s", _str(addr), port, gai_strerror(error));
        n_log(LOG_ERR, "Error when resolving %s:%s getaddrinfo: %s", _str(addr), port, gai_strerror(error));
        netw_close(netw);
        return FALSE;
    }
    (*netw)->addr_infos_loaded = 1;
 
    struct addrinfo* rp = NULL;
    for (rp = (*netw)->link.rhost; rp != NULL; rp = rp->ai_next) {
        (*netw)->link.sock = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
        if ((*netw)->link.sock == INVALID_SOCKET) {
            error = neterrno;
            errmsg = netstrerror(error);
            n_log(LOG_ERR, "Error while trying to make a UDP socket: %s", _str(errmsg));
            FreeNoLog(errmsg);
            continue;
        }
        netw_setsockopt((*netw), SO_REUSEADDR, 1);
        if (bind((*netw)->link.sock, rp->ai_addr, (socklen_t)rp->ai_addrlen) == 0) {
            char* ip = NULL;
            Malloc(ip, char, 64);
            if (!ip) {
                n_log(LOG_ERR, "Error allocating 64 bytes for ip");
                netw_close(netw);
                return FALSE;
            }
            if (!inet_ntop(rp->ai_family, get_in_addr(rp->ai_addr), ip, 64)) {
                error = neterrno;
                errmsg = netstrerror(error);
                n_log(LOG_ERR, "inet_ntop: %p , %s", (*netw)->link.raddr, _str(errmsg));
                FreeNoLog(errmsg);
            }
            (*netw)->link.ip = ip;
            break; /* Success */
        }
        error = neterrno;
        errmsg = netstrerror(error);
        _netw_capture_error(*netw, "Error from bind() on UDP port %s neterrno: %s", port, errmsg);
        n_log(LOG_ERR, "Error from bind() on UDP port %s neterrno: %s", port, errmsg);
        FreeNoLog(errmsg);
        closesocket((*netw)->link.sock);
    }
    if (rp == NULL) {
        _netw_capture_error(*netw, "Couldn't get a socket for UDP binding on port %s", port);
        n_log(LOG_ERR, "Couldn't get a socket for UDP binding on port %s", port);
        netw_close(netw);
        return FALSE;
    }
 
    /* set send/recv to UDP functions */
    (*netw)->send_data = &send_udp_data;
    (*netw)->recv_data = &recv_udp_data;
 
    netw_set((*netw), NETW_SERVER | NETW_RUN | NETW_THR_ENGINE_STOPPED);
 
    n_log(LOG_DEBUG, "UDP socket bound to %s:%s", _str((*netw)->link.ip), port);
 
    return TRUE;
} /* netw_bind_udp(...)*/
 
int netw_connect_udp(NETWORK** netw, char* host, char* port, int ip_version) {
    int error = 0;
    char* errmsg = NULL;
 
    if ((*netw)) {
        n_log(LOG_ERR, "Unable to allocate (*netw), already existing. You must use empty NETWORK *structs.");
        return FALSE;
    }
 
    (*netw) = netw_new(MAX_LIST_ITEMS, MAX_LIST_ITEMS);
    __n_assert(netw && (*netw), return FALSE);
    (*netw)->transport_type = NETWORK_UDP;
 
    if (netw_init_wsa(1, 2, 2) == FALSE) {
        n_log(LOG_ERR, "Unable to load WSA dll's");
        netw_close(netw);
        return FALSE;
    }
 
    /* choose ip version */
    if (ip_version == NETWORK_IPV4) {
        (*netw)->link.hints.ai_family = AF_INET;
    } else if (ip_version == NETWORK_IPV6) {
        (*netw)->link.hints.ai_family = AF_INET6;
    } else {
        (*netw)->link.hints.ai_family = AF_UNSPEC;
    }
 
    (*netw)->link.hints.ai_socktype = SOCK_DGRAM;
    (*netw)->link.hints.ai_protocol = IPPROTO_UDP;
    (*netw)->link.hints.ai_flags = AI_PASSIVE;
    (*netw)->link.hints.ai_canonname = NULL;
    (*netw)->link.hints.ai_next = NULL;
 
    error = getaddrinfo(host, port, &(*netw)->link.hints, &(*netw)->link.rhost);
    if (error != 0) {
        _netw_capture_error(*netw, "Error when resolving %s:%s getaddrinfo: %s", host, port, gai_strerror(error));
        n_log(LOG_ERR, "Error when resolving %s:%s getaddrinfo: %s", host, port, gai_strerror(error));
        netw_close(netw);
        return FALSE;
    }
    (*netw)->addr_infos_loaded = 1;
    Malloc((*netw)->link.ip, char, 64);
    __n_assert((*netw)->link.ip, netw_close(netw); return FALSE);
 
    struct addrinfo* rp = NULL;
    for (rp = (*netw)->link.rhost; rp != NULL; rp = rp->ai_next) {
        SOCKET sock = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
        if (sock == INVALID_SOCKET) {
            error = neterrno;
            errmsg = netstrerror(error);
            n_log(LOG_ERR, "Error while trying to make a UDP socket: %s", _str(errmsg));
            FreeNoLog(errmsg);
            continue;
        }
 
        (*netw)->link.sock = sock;
 
        /* connect() on UDP sets the default destination for send/recv */
        if (connect(sock, rp->ai_addr, (socklen_t)rp->ai_addrlen) == -1) {
            error = neterrno;
            errmsg = netstrerror(error);
            n_log(LOG_INFO, "UDP connecting to %s:%s : %s", host, port, _str(errmsg));
            FreeNoLog(errmsg);
            closesocket(sock);
            (*netw)->link.sock = INVALID_SOCKET;
            continue;
        } else {
            if (!inet_ntop(rp->ai_family, get_in_addr(rp->ai_addr), (*netw)->link.ip, 64)) {
                error = neterrno;
                errmsg = netstrerror(error);
                n_log(LOG_ERR, "inet_ntop: %p , %s", rp, _str(errmsg));
                FreeNoLog(errmsg);
            }
            break; /* Success */
        }
    }
    if (rp == NULL) {
        _netw_capture_error(*netw, "Couldn't connect UDP to %s:%s : no address succeeded", host, port);
        n_log(LOG_ERR, "Couldn't connect UDP to %s:%s : no address succeeded", host, port);
        netw_close(netw);
        return FALSE;
    }
 
    (*netw)->link.port = strdup(port);
    __n_assert((*netw)->link.port, netw_close(netw); return FALSE);
 
    /* set send/recv to UDP functions */
    (*netw)->send_data = &send_udp_data;
    (*netw)->recv_data = &recv_udp_data;
 
    netw_set((*netw), NETW_CLIENT | NETW_RUN | NETW_THR_ENGINE_STOPPED);
 
    n_log(LOG_DEBUG, "UDP-Connected to %s:%s", (*netw)->link.ip, (*netw)->link.port);
 
    return TRUE;
} /* netw_connect_udp(...)*/
 
ssize_t send_udp_data(void* netw, char* buf, uint32_t n) {
    __n_assert(netw, return NETW_SOCKET_ERROR);
    __n_assert(buf, return NETW_SOCKET_ERROR);
 
    SOCKET s = ((NETWORK*)netw)->link.sock;
    int error = 0;
    char* errmsg = NULL;
 
    if (n == 0) {
        _netw_capture_error((NETWORK*)netw, "Send of 0 is unsupported.");
        n_log(LOG_ERR, "Send of 0 is unsupported.");
        return NETW_SOCKET_ERROR;
    }
 
    ssize_t bs = send(s, buf, NETW_BUFLEN_CAST(n), NETFLAGS);
    error = neterrno;
    if (bs < 0) {
        if (error == ECONNRESET || error == ENOTCONN
#ifdef __windows__
            || error == WSAECONNRESET || error == WSAENOTCONN
#endif
        ) {
            n_log(LOG_DEBUG, "UDP socket %d disconnected !", s);
            return NETW_SOCKET_DISCONNECTED;
        }
        errmsg = netstrerror(error);
        _netw_capture_error((NETWORK*)netw, "UDP Socket %d send Error: %zd , %s", s, bs, _str(errmsg));
        n_log(LOG_ERR, "UDP Socket %d send Error: %zd , %s", s, bs, _str(errmsg));
        FreeNoLog(errmsg);
        return NETW_SOCKET_ERROR;
    }
    return bs;
} /*send_udp_data(...)*/
 
ssize_t recv_udp_data(void* netw, char* buf, uint32_t n) {
    __n_assert(netw, return NETW_SOCKET_ERROR);
    __n_assert(buf, return NETW_SOCKET_ERROR);
 
    SOCKET s = ((NETWORK*)netw)->link.sock;
 
    if (n == 0) {
        _netw_capture_error((NETWORK*)netw, "Recv of 0 is unsupported.");
        n_log(LOG_ERR, "Recv of 0 is unsupported.");
        return NETW_SOCKET_ERROR;
    }
 
    ssize_t br = recv(s, buf, NETW_BUFLEN_CAST(n), NETFLAGS);
    int error = neterrno;
    if (br < 0) {
        char* errmsg = netstrerror(error);
        _netw_capture_error((NETWORK*)netw, "UDP socket %d recv returned %zd, error: %s", s, br, _str(errmsg));
        n_log(LOG_ERR, "UDP socket %d recv returned %zd, error: %s", s, br, _str(errmsg));
        FreeNoLog(errmsg);
        return NETW_SOCKET_ERROR;
    }
    if (br == 0) {
        n_log(LOG_DEBUG, "UDP socket %d: zero-length recv", s);
    }
    return br;
} /*recv_udp_data(...)*/
 
ssize_t netw_udp_sendto(NETWORK* netw, char* buf, uint32_t n, struct sockaddr* dest_addr, socklen_t dest_len) {
    __n_assert(netw, return NETW_SOCKET_ERROR);
    __n_assert(buf, return NETW_SOCKET_ERROR);
    __n_assert(dest_addr, return NETW_SOCKET_ERROR);
 
    if (n == 0) {
        _netw_capture_error(netw, "Sendto of 0 is unsupported.");
        n_log(LOG_ERR, "Sendto of 0 is unsupported.");
        return NETW_SOCKET_ERROR;
    }
 
    ssize_t bs = sendto(netw->link.sock, buf, NETW_BUFLEN_CAST(n), NETFLAGS, dest_addr, dest_len);
    if (bs < 0) {
        int error = neterrno;
        char* errmsg = netstrerror(error);
        _netw_capture_error(netw, "UDP socket %d sendto Error: %zd , %s", netw->link.sock, bs, _str(errmsg));
        n_log(LOG_ERR, "UDP socket %d sendto Error: %zd , %s", netw->link.sock, bs, _str(errmsg));
        FreeNoLog(errmsg);
        return NETW_SOCKET_ERROR;
    }
    return bs;
} /*netw_udp_sendto(...)*/
 
ssize_t netw_udp_recvfrom(NETWORK* netw, char* buf, uint32_t n, struct sockaddr* src_addr, socklen_t* src_len) {
    __n_assert(netw, return NETW_SOCKET_ERROR);
    __n_assert(buf, return NETW_SOCKET_ERROR);
 
    if (n == 0) {
        _netw_capture_error(netw, "Recvfrom of 0 is unsupported.");
        n_log(LOG_ERR, "Recvfrom of 0 is unsupported.");
        return NETW_SOCKET_ERROR;
    }
 
    ssize_t br = recvfrom(netw->link.sock, buf, NETW_BUFLEN_CAST(n), NETFLAGS, src_addr, src_len);
    if (br < 0) {
        int error = neterrno;
        char* errmsg = netstrerror(error);
        _netw_capture_error(netw, "UDP socket %d recvfrom returned %zd, error: %s", netw->link.sock, br, _str(errmsg));
        n_log(LOG_ERR, "UDP socket %d recvfrom returned %zd, error: %s", netw->link.sock, br, _str(errmsg));
        FreeNoLog(errmsg);
        return NETW_SOCKET_ERROR;
    }
    return br;
} /*netw_udp_recvfrom(...)*/
 
NETWORK* netw_accept_from_ex(NETWORK* from, size_t send_list_limit, size_t recv_list_limit, int blocking, int* retval) {
    SOCKET tmp = INVALID_SOCKET;
    int error;
    char* errmsg = NULL;
 
#if defined(__linux__) || defined(__sun) || defined(_AIX)
    socklen_t sin_size = 0;
#else
    int sin_size = 0;
#endif
 
    NETWORK* netw = NULL;
 
    /*checking WSA when under windows*/
    if (netw_init_wsa(1, 2, 2) == FALSE) {
        n_log(LOG_ERR, "Unable to load WSA dll's");
        return NULL;
    }
 
    __n_assert(from, return NULL);
 
    netw = netw_new(send_list_limit, recv_list_limit);
 
    sin_size = sizeof(netw->link.raddr);
 
    if (blocking > 0) {
        int secs = blocking / 1000;
        int usecs = (blocking % 1000) * 1000;
        struct timeval select_timeout = {secs, usecs};
 
        fd_set accept_set;
        FD_ZERO(&accept_set);
#pragma GCC diagnostic push
#pragma GCC diagnostic ignored "-Wsign-conversion"
        FD_SET(from->link.sock, &accept_set);
#pragma GCC diagnostic pop
 
        int ret = select((int)(from->link.sock + 1), &accept_set, NULL, NULL, &select_timeout);
        if (ret == -1) {
            error = neterrno;
            errmsg = netstrerror(error);
            if (retval != NULL)
                (*retval) = error;
            n_log(LOG_DEBUG, "error on select with timeout %ds (%d.%ds), neterrno: %s", blocking, secs, usecs, _str(errmsg));
            FreeNoLog(errmsg);
            netw_close(&netw);
            return NULL;
        } else if (ret == 0) {
            /* that one produce waaaay too much logs under a lot of cases */
            n_log(LOG_DEBUG, "No connection waiting on %d", from->link.sock);
            netw_close(&netw);
            return NULL;
        }
#pragma GCC diagnostic push
#pragma GCC diagnostic ignored "-Wsign-conversion"
        if (FD_ISSET(from->link.sock, &accept_set)) {
#pragma GCC diagnostic pop
            // n_log( LOG_DEBUG, "select accept call on %d", from -> link . sock );
            tmp = accept(from->link.sock, (struct sockaddr*)&netw->link.raddr, &sin_size);
            if (tmp == INVALID_SOCKET) {
                error = neterrno;
                errmsg = netstrerror(error);
                if (retval != NULL)
                    (*retval) = error;
                n_log(LOG_DEBUG, "error accepting on %d, %s", netw->link.sock, _str(errmsg));
                FreeNoLog(errmsg);
                netw_close(&netw);
                return NULL;
            }
        } else {
            _netw_capture_error(from, "FD_ISSET returned false on %d", from->link.sock);
            n_log(LOG_ERR, "FD_ISSET returned false on %d", from->link.sock);
            netw_close(&netw);
            return NULL;
        }
        netw->link.is_blocking = 0;
    } else if (blocking == -1) {
        if (from->link.is_blocking != 0) {
            netw_set_blocking(from, 0);
        }
        tmp = accept(from->link.sock, (struct sockaddr*)&netw->link.raddr, &sin_size);
        error = neterrno;
        if (retval != NULL)
            (*retval) = error;
        if (tmp == INVALID_SOCKET) {
            if (error != EINTR && error != EAGAIN
#ifdef __windows__
                && error != WSAEWOULDBLOCK
#endif
            ) {
                char* errmsg_nb = netstrerror(error);
                // cppcheck-suppress unknownMacro ; SOCKET_SIZE_FORMAT is a platform-specific printf format macro
                n_log(LOG_ERR, "accept returned an invalid socket (" SOCKET_SIZE_FORMAT "), neterrno: %s", tmp, _str(errmsg_nb));
                FreeNoLog(errmsg_nb);
            }
            netw_close(&netw);
            return NULL;
        }
        netw->link.is_blocking = 0;
    } else {
        if (from->link.is_blocking == 0) {
            netw_set_blocking(from, 1);
            n_log(LOG_DEBUG, "(default) blocking accept call on socket %d", from->link.sock);
        }
        tmp = accept(from->link.sock, (struct sockaddr*)&netw->link.raddr, &sin_size);
        if (tmp == INVALID_SOCKET) {
            error = neterrno;
            errmsg = netstrerror(error);
            if (retval != NULL)
                (*retval) = error;
            n_log(LOG_DEBUG, "error accepting on socket %d, %s", netw->link.sock, _str(errmsg));
            FreeNoLog(errmsg);
            netw_close(&netw);
            return NULL;
        }
        netw->link.is_blocking = 1;
    }
    netw->link.sock = tmp;
 
    /* On Windows and Solaris, the accepted socket inherits the non-blocking
     * mode from the listening socket.  The send/recv engine expects a
     * blocking socket, so force it to blocking here.  On Linux this is a
     * harmless no-op since accept() always returns a blocking socket. */
    netw_set_blocking(netw, 1);
    netw->link.is_blocking = 1;
 
    netw->link.port = strdup(from->link.port);
    Malloc(netw->link.ip, char, 64);
    if (!netw->link.ip) {
        n_log(LOG_ERR, "Error allocating 64 bytes for ip");
        netw_close(&netw);
        return NULL;
    }
    if (!inet_ntop(netw->link.raddr.ss_family, get_in_addr(((struct sockaddr*)&netw->link.raddr)), netw->link.ip, 64)) {
        error = neterrno;
        errmsg = netstrerror(error);
        n_log(LOG_ERR, "inet_ntop: %p , %s", netw->link.raddr, _str(errmsg));
        FreeNoLog(errmsg);
        netw_close(&netw);
        return NULL;
    }
 
    netw_setsockopt(netw, SO_REUSEADDR, 1);
    // netw_setsockopt( netw, SO_REUSEPORT, 1 );
    netw_setsockopt(netw, SO_KEEPALIVE, 1);
    netw_set(netw, NETW_SERVER | NETW_RUN | NETW_THR_ENGINE_STOPPED);
    // netw_set_blocking(netw, 1);
 
    n_log(LOG_DEBUG, "Connection accepted from %s:%s socket %d", netw->link.ip, netw->link.port, netw->link.sock);
 
#ifdef HAVE_OPENSSL
    if (from->crypto_algo == NETW_ENCRYPT_OPENSSL) {
        netw->ssl = SSL_new(from->ctx);
        SSL_set_fd(netw->ssl, (int)netw->link.sock);
 
        netw->send_data = &send_ssl_data;
        netw->recv_data = &recv_ssl_data;
        netw->send_data_once = &send_ssl_data_once;
        netw->recv_data_once = &recv_ssl_data_once;
        /* mark accepted netw as SSL so netw_close() runs SSL_free on its ssl;
         * ctx stays NULL, it is borrowed from the listener and freed there */
        netw->crypto_algo = NETW_ENCRYPT_OPENSSL;
 
        if (SSL_accept(netw->ssl) <= 0) {
            error = errno;
            _netw_capture_error(netw, "SSL error on %d", netw->link.sock);
            n_log(LOG_ERR, "SSL error on %d", netw->link.sock);
            if (retval != NULL)
                (*retval) = error;
            netw_ssl_print_errors(netw->link.sock);
            netw_close(&netw);
            return NULL;
        } else {
            n_log(LOG_DEBUG, " socket %d: SSL connection established", netw->link.sock);
        }
    }
#endif
 
    return netw;
} /* netw_accept_from_ex(...) */
 
NETWORK* netw_accept_from(NETWORK* from) {
    return netw_accept_from_ex(from, MAX_LIST_ITEMS, MAX_LIST_ITEMS, 0, NULL);
} /* network_accept_from( ... ) */
 
NETWORK* netw_accept_nonblock_from(NETWORK* from, int blocking) {
    return netw_accept_from_ex(from, MAX_LIST_ITEMS, MAX_LIST_ITEMS, blocking, NULL);
} /* network_accept_from( ... ) */
 
/* Process-wide byte counters. See netw_bytes_stats_get in
 * n_network_msg.c. Advisory telemetry; no atomic guarantee. */
long long g_netw_bytes_sent = 0;
long long g_netw_bytes_recv = 0;
 
int netw_add_msg(NETWORK* netw, N_STR* msg) {
    __n_assert(netw, return FALSE);
    __n_assert(msg, return FALSE);
    __n_assert(msg->data, return FALSE);
 
    if (msg->length == 0) {
        _netw_capture_error(netw, "Empty messages are not supported. msg(%p)->length=%zu", msg, msg->length);
        n_log(LOG_ERR, "Empty messages are not supported. msg(%p)->length=%zu", msg, msg->length);
        return FALSE;
    }
 
    /* Capture msg->written for the byte counter before the push:
     * list_push transfers ownership to send_buf with free_nstr_ptr
     * as the destructor, so once we release sendbolt the consumer
     * (send thread or reactor) can shift, send, and free `msg`,
     * making any post-unlock `msg->written` read a use-after-free.
     * The race is mostly latent in thread mode (send thread blocks
     * on the syscall before freeing) but the reactor consumes within
     * microseconds and TSan flags it consistently. */
    long long bytes_for_counter = (long long)msg->written;
 
    pthread_mutex_lock(&netw->sendbolt);
 
    if (list_push(netw->send_buf, msg, free_nstr_ptr) == FALSE) {
        pthread_mutex_unlock(&netw->sendbolt);
        return FALSE;
    }
 
    pthread_mutex_unlock(&netw->sendbolt);
 
    /* Reactor mode: wake the reactor's epoll_wait via its
     * wake-eventfd so it picks up the new send_buf entry. The
     * thread engine's sem_post path stays as the default; the wake
     * call is a single non-blocking eventfd write when reactor_mode
     * is set. Forward declared in n_reactor.h to avoid a circular
     * include with this header, the function pointer dispatch
     * happens through netw->reactor_handle.
     *
     * Compile-time gated on N_REACTOR_AVAILABLE: on Windows / Solaris
     * the reactor is unavailable, reactor_mode is always 0, and we
     * never want this TU to reference n_reactor_notify_send (which
     * would force linking n_reactor.o for a code path that can never
     * fire). The unconditional sem_post fallback matches the
     * non-reactor branch of the gated form. */
#if N_REACTOR_AVAILABLE
    if (netw_atomic_read_reactor_mode(netw) && netw_atomic_read_reactor_handle(netw)) {
        extern void n_reactor_notify_send(NETWORK*);
        n_reactor_notify_send(netw);
    } else {
        sem_post(&netw->send_blocker);
    }
#else
    sem_post(&netw->send_blocker);
#endif
 
    g_netw_bytes_sent += bytes_for_counter;
    return TRUE;
} /* netw_add_msg(...) */
 
int netw_add_msg_ex(NETWORK* netw, char* str, unsigned int length) {
    __n_assert(netw, return FALSE);
    __n_assert(str, return FALSE);
    if (length == 0) {
        return FALSE;
    }
 
    N_STR* nstr = NULL;
    Malloc(nstr, N_STR, 1);
    __n_assert(nstr, return FALSE);
 
    nstr->data = str;
    nstr->written = nstr->length = length;
 
    pthread_mutex_lock(&netw->sendbolt);
    if (list_push(netw->send_buf, nstr, free_nstr_ptr) == FALSE) {
        pthread_mutex_unlock(&netw->sendbolt);
        return FALSE;
    }
    pthread_mutex_unlock(&netw->sendbolt);
 
    sem_post(&netw->send_blocker);
 
    return TRUE;
} /* netw_add_msg_ex(...) */
 
N_STR* netw_get_msg(NETWORK* netw) {
    N_STR* ptr = NULL;
 
    __n_assert(netw, return NULL);
 
    pthread_mutex_lock(&netw->recvbolt);
 
    ptr = list_shift(netw->recv_buf, N_STR);
 
    pthread_mutex_unlock(&netw->recvbolt);
 
    if (ptr) g_netw_bytes_recv += (long long)ptr->written;
    return ptr;
} /* netw_get_msg(...)*/
 
N_STR* netw_wait_msg(NETWORK* netw, unsigned int refresh, size_t timeout) {
    size_t timed = 0;
    unsigned int secs = 0;
    unsigned int usecs = 0;
 
    __n_assert(netw, return NULL);
 
    usecs = refresh;
    if (refresh > 999999) {
        secs = refresh / 1000000;
        usecs = refresh % 1000000;
    }
 
    if (timeout > 0)
        timed = timeout;
 
    n_log(LOG_DEBUG, "wait from socket %d, refresh: %zu usec (%zu secs, %zu usecs), timeout %zu usec", netw->link.sock, refresh, secs, usecs, timeout);
    uint32_t state = NETW_RUN;
    int thr_state = 0;
    do {
        N_STR* nstrptr = netw_get_msg(netw);
        if (nstrptr)
            return nstrptr;
 
        if (timeout > 0) {
            if (timed >= refresh)
                timed -= refresh;
            if (timed == 0 || timed < refresh) {
                _netw_capture_error(netw, "netw %d, status: %s (%" PRIu32 "), timeouted after waiting %zu msecs", netw->link.sock, N_ENUM_ENTRY(__netw_code_type, toString)(state), state, timeout);
                n_log(LOG_ERR, "netw %d, status: %s (%" PRIu32 "), timeouted after waiting %zu msecs", netw->link.sock, N_ENUM_ENTRY(__netw_code_type, toString)(state), state, timeout);
                return NULL;
            }
        }
        if (secs > 0)
            sleep(secs);
        if (usecs > 0)
            u_sleep(usecs);
 
        netw_get_state(netw, &state, &thr_state);
    } while (state != NETW_EXITED && state != NETW_ERROR);
 
    _netw_capture_error(netw, "got no answer and netw %d is no more running, state: %s (%" PRIu32 ")", netw->link.sock, N_ENUM_ENTRY(__netw_code_type, toString)(state), state);
    n_log(LOG_ERR, "got no answer and netw %d is no more running, state: %s (%" PRIu32 ")", netw->link.sock, N_ENUM_ENTRY(__netw_code_type, toString)(state), state);
 
    return NULL;
} /* netw_wait_msg(...) */
 
int netw_start_thr_engine(NETWORK* netw) {
    __n_assert(netw, return FALSE);
 
    pthread_mutex_lock(&netw->eventbolt);
    if (netw->threaded_engine_status == NETW_THR_ENGINE_STARTED) {
        _netw_capture_error(netw, "THR Engine already started for network %p (%s)", netw, _str(netw->link.ip));
        n_log(LOG_ERR, "THR Engine already started for network %p (%s)", netw, _str(netw->link.ip));
        pthread_mutex_unlock(&netw->eventbolt);
        return FALSE;
    }
 
    if (pthread_create(&netw->recv_thr, NULL, netw_recv_func, (void*)netw) != 0) {
        _netw_capture_error(netw, "Unable to create recv_thread for network %p (%s)", netw, _str(netw->link.ip));
        n_log(LOG_ERR, "Unable to create recv_thread for network %p (%s)", netw, _str(netw->link.ip));
        pthread_mutex_unlock(&netw->eventbolt);
        return FALSE;
    }
    netw->nb_running_threads++;
    if (pthread_create(&netw->send_thr, NULL, netw_send_func, (void*)netw) != 0) {
        _netw_capture_error(netw, "Unable to create send_thread for network %p (%s)", netw, _str(netw->link.ip));
        n_log(LOG_ERR, "Unable to create send_thread for network %p (%s)", netw, _str(netw->link.ip));
        pthread_cancel(netw->recv_thr);
        pthread_join(netw->recv_thr, NULL);
        netw->nb_running_threads--;
        pthread_mutex_unlock(&netw->eventbolt);
        return FALSE;
    }
    netw->nb_running_threads++;
 
    netw->threaded_engine_status = NETW_THR_ENGINE_STARTED;
 
    pthread_mutex_unlock(&netw->eventbolt);
 
    return TRUE;
} /* netw_create_recv_thread(....) */
 
void* netw_send_func(void* NET) {
    int DONE = 0;
 
    ssize_t net_status = 0;
 
    uint32_t state;
    uint32_t nboctet;
 
    char nboct[5] = "";
 
    N_STR* ptr = NULL;
 
    NETWORK* netw = (NETWORK*)NET;
    __n_assert(netw, return NULL);
 
    do {
        /* do not consume cpu for nothing, reduce delay */
        sem_wait(&netw->send_blocker);
        int message_sent = 0;
        while (message_sent == 0 && !DONE) {
            state = netw_atomic_read_state(netw);
            if (state & NETW_ERROR) {
                DONE = NETW_THR_EXIT_ERROR;
            } else if (state & NETW_EXITED) {
                DONE = NETW_THR_EXIT_OK;
            } else if (state & NETW_EXIT_ASKED) {
                DONE = NETW_THR_EXIT_OK;
                /* sending state */
                nboctet = htonl(NETW_EXIT_ASKED);
                memcpy(nboct, &nboctet, sizeof(uint32_t));
                n_log(LOG_DEBUG, "%d Sending Quit !", netw->link.sock);
                net_status = netw->send_data(netw, nboct, sizeof(int32_t));
                /* Peer disconnect during QUIT send is the expected
                 * end of the handshake; only a real socket error
                 * deserves the DONE=4 error path. */
                if (net_status < 0 && net_status != NETW_SOCKET_DISCONNECTED)
                    DONE = 4;
                n_log(LOG_DEBUG, "%d Quit sent!", netw->link.sock);
            } else {
                pthread_mutex_lock(&netw->sendbolt);
                ptr = list_shift(netw->send_buf, N_STR);
                pthread_mutex_unlock(&netw->sendbolt);
                if (ptr && ptr->length > 0 && ptr->data) {
                    /* Headroom for the 8-byte state+length header so
                     * frame_len below cannot overflow the uint32 the
                     * send_data API takes. */
                    if (ptr->written <= UINT_MAX - 2 * sizeof(uint32_t)) {
                        n_log(LOG_DEBUG, "Sending ptr size %zu written %zu...", ptr->length, ptr->written);
 
                        /* Opportunistic compression. Gated on threshold
                         * + ratio so small packets and incompressible
                         * binary snapshots don't pay the codec cost.
                         * Algorithm picked per-connection via
                         * netw_set_compression_mode(); NONE skips the
                         * entire attempt. */
                        uint32_t pkt_state = state;
                        if (netw->compress_mode != NETW_COMPRESS_NONE &&
                            ptr->written >= NETW_COMPRESS_THRESHOLD) {
                            N_STR* zipped = NULL;
                            uint32_t flag_bit = 0;
                            if (netw->compress_mode == NETW_COMPRESS_LZ4) {
                                zipped = zip4_nstr(ptr);
                                flag_bit = NETW_COMPRESSED_LZ4;
                            } else {
                                zipped = zip_nstr(ptr);
                                flag_bit = NETW_COMPRESSED_ZLIB;
                            }
                            if (zipped && zipped->written > 0 &&
                                zipped->written * 100u <=
                                    ptr->written * (100u - NETW_COMPRESS_MIN_RATIO)) {
                                /* Good enough shrink, swap. */
                                free_nstr(&ptr);
                                ptr = zipped;
                                pkt_state |= flag_bit;
                            } else if (zipped) {
                                free_nstr(&zipped);
                            }
                        }
 
                        /* Single-write framing. The frame
                         * used to go out as three separate send_data
                         * calls (4B state, 4B length, payload): three
                         * syscalls, and three TLS records on crypto
                         * sockets, per message, with the two 4-byte
                         * writes interacting badly with Nagle +
                         * delayed-ACK on small-message streams (game
                         * inputs, snapshots). Build the contiguous
                         * frame and hand the kernel one write.
                         * Peer disconnect (NETW_SOCKET_DISCONNECTED)
                         * during the send is a normal end-of-life: the
                         * connection is over, nothing to log. Only a
                         * real socket error trips the DONE=1 error
                         * path so the tail logger emits LOG_ERR. */
                        size_t frame_len = 2 * sizeof(uint32_t) + ptr->written;
                        char* frame = NULL;
                        Malloc(frame, char, frame_len);
                        if (frame) {
                            nboctet = htonl(pkt_state);
                            memcpy(frame, &nboctet, sizeof(uint32_t));
                            nboctet = htonl((uint32_t)ptr->written);
                            memcpy(frame + sizeof(uint32_t), &nboctet, sizeof(uint32_t));
                            memcpy(frame + 2 * sizeof(uint32_t), ptr->data, ptr->written);
                            net_status = netw->send_data(netw, frame, (uint32_t)frame_len);
                            if (net_status < 0)
                                DONE = (net_status == NETW_SOCKET_DISCONNECTED) ? NETW_THR_EXIT_OK : 1;
                            Free(frame);
                        } else {
                            /* OOM building the frame: drop the message
                             * (stream alignment is preserved, nothing
                             * was written) and keep the connection up,
                             * mirroring the oversize-discard branch. */
                            _netw_capture_error(netw, "could not allocate %zu byte send frame, packet dropped", frame_len);
                            n_log(LOG_ERR, "could not allocate %zu byte send frame, packet dropped", frame_len);
                        }
                        if (netw->send_queue_consecutive_wait >= 0) {
                            u_sleep((unsigned int)netw->send_queue_consecutive_wait);
                        }
                        message_sent = 1;
                        free_nstr(&ptr);
                    } else {
                        _netw_capture_error(netw, "discarded packet of size %zu which is greater than %" PRIu32, ptr->written, UINT_MAX);
                        n_log(LOG_ERR, "discarded packet of size %zu which is greater than %" PRIu32, ptr->written, UINT_MAX);
                        message_sent = 1;
                        free_nstr(&ptr);
                    }
                } else {
                    /* Empty send_buf or malformed head entry: the
                     * producer-consumer contract means sem_post was
                     * called without a usable list_push, or a state
                     * transition posted without a real message. Break
                     * out of the inner loop and block on sem_wait
                     * rather than spinning, spinning grabs sendbolt
                     * at MHz rates and creates main-thread contention
                     * in netw_add_msg. */
                    if (ptr) free_nstr(&ptr);
                    message_sent = 1;
                }
            }
        }
    } while (!DONE);
 
    if (DONE == 1) {
        _netw_capture_error(netw, "Error when sending state %" PRIu32 " on socket %d (%s), network: %s", netw_atomic_read_state(netw), netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
        n_log(LOG_ERR, "Error when sending state %" PRIu32 " on socket %d (%s), network: %s", netw_atomic_read_state(netw), netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
    } else if (DONE == 2) {
        _netw_capture_error(netw, "Error when sending number of octet to socket %d (%s), network: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
        n_log(LOG_ERR, "Error when sending number of octet to socket %d (%s), network: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
    } else if (DONE == 3)
        n_log(LOG_DEBUG, "Error when sending data on socket %d (%s), network: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
    else if (DONE == 4) {
        _netw_capture_error(netw, "Error when sending state QUIT on socket %d (%s), network: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
        n_log(LOG_ERR, "Error when sending state QUIT on socket %d (%s), network: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
    } else if (DONE == 5) {
        _netw_capture_error(netw, "Error when sending state QUIT number of octet (0) on socket %d (%s), network: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
        n_log(LOG_ERR, "Error when sending state QUIT number of octet (0) on socket %d (%s), network: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
    }
 
    if (DONE == NETW_THR_EXIT_OK) {
        n_log(LOG_DEBUG, "Socket %d: Sending thread exiting correctly", netw->link.sock);
        netw_set(netw, NETW_EXIT_ASKED);
    } else {
        _netw_capture_error(netw, "Socket %d (%s): Sending thread exiting with error %d !", netw->link.sock, _str(netw->link.ip), DONE);
        n_log(LOG_ERR, "Socket %d (%s): Sending thread exiting with error %d !", netw->link.sock, _str(netw->link.ip), DONE);
        netw_set(netw, NETW_ERROR);
    }
 
    pthread_mutex_lock(&netw->eventbolt);
    netw->nb_running_threads--;
    pthread_mutex_unlock(&netw->eventbolt);
 
    pthread_exit(0);
 
    /* suppress compiler warning */
#if !defined(__linux__)
    return NULL;
#endif
} /* netw_send_func(...) */
 
void* netw_recv_func(void* NET) {
    int DONE = 0;
    ssize_t net_status = 0;
 
    uint32_t nboctet;
    uint32_t tmpstate;
    uint32_t state;
 
    char nboct[5] = "";
 
    N_STR* recvdmsg = NULL;
 
    NETWORK* netw = (NETWORK*)NET;
 
    __n_assert(netw, return NULL);
 
    do {
        state = netw_atomic_read_state(netw);
        if (state & NETW_EXIT_ASKED || state & NETW_EXITED) {
            DONE = NETW_THR_EXIT_OK;
        }
        if (state & NETW_ERROR) {
            DONE = NETW_THR_EXIT_ERROR;
        }
        if (!DONE) {
            n_log(LOG_DEBUG, "socket %d : waiting to receive status", netw->link.sock);
            /* receiving state */
            net_status = netw->recv_data(netw, nboct, sizeof(uint32_t));
            if (net_status < 0) {
                /* Peer disconnect (NETW_SOCKET_DISCONNECTED) is the
                 * normal end of a connection, no log noise, exit
                 * via the clean NETW_THR_EXIT_OK path so the
                 * application observes NETW_EXIT_ASKED, not
                 * NETW_ERROR. Only NETW_SOCKET_ERROR routes through
                 * the DONE=N error tail logger. */
                DONE = (net_status == NETW_SOCKET_DISCONNECTED) ? NETW_THR_EXIT_OK : 1;
            } else {
                memcpy(&nboctet, nboct, sizeof(uint32_t));
                tmpstate = ntohl(nboctet);
                nboctet = tmpstate;
                /* Freeze the per-packet state word before the next
                 * recv_data call reuses tmpstate for the payload
                 * length, the NETW_COMPRESSED_* flag check below
                 * reads pkt_state, not tmpstate. */
                uint32_t pkt_state = tmpstate;
                if (tmpstate == NETW_EXIT_ASKED) {
                    n_log(LOG_DEBUG, "socket %d : receiving order to QUIT !", netw->link.sock);
                    DONE = NETW_THR_EXIT_OK;
                } else {
                    n_log(LOG_DEBUG, "socket %d : waiting to receive next message nboctets", netw->link.sock);
                    /* receiving nboctet */
                    net_status = netw->recv_data(netw, nboct, sizeof(uint32_t));
                    if (net_status < 0) {
                        DONE = (net_status == NETW_SOCKET_DISCONNECTED) ? NETW_THR_EXIT_OK : 2;
                    } else {
                        memcpy(&nboctet, nboct, sizeof(uint32_t));
                        tmpstate = ntohl(nboctet);
                        nboctet = tmpstate;
 
                        Malloc(recvdmsg, N_STR, 1);
                        if (!recvdmsg) {
                            DONE = 3;
                        } else {
                            n_log(LOG_DEBUG, "socket %d : %" PRIu32 " octets to receive...", netw->link.sock, nboctet);
                            Malloc(recvdmsg->data, char, nboctet + 1);
                            if (!recvdmsg->data) {
                                free_nstr(&recvdmsg);
                                DONE = 4;
                            } else {
                                recvdmsg->length = nboctet + 1;
                                recvdmsg->written = nboctet;
 
                                /* receiving the data itself */
                                net_status = netw->recv_data(netw, recvdmsg->data, nboctet);
                                if (net_status < 0) {
                                    free_nstr(&recvdmsg);
                                    DONE = (net_status == NETW_SOCKET_DISCONNECTED) ? NETW_THR_EXIT_OK : 5;
                                } else {
                                    /* Inverse of the compression step on
                                     * the send side. Each NETW_COMPRESSED_*
                                     * bit identifies the codec the sender
                                     * chose; we decode regardless of our
                                     * own compress_mode so two peers
                                     * running different algorithms still
                                     * interop. */
                                    int want_zlib = (pkt_state & NETW_COMPRESSED_ZLIB) != 0;
                                    int want_lz4 = (pkt_state & NETW_COMPRESSED_LZ4) != 0;
                                    if (want_zlib || want_lz4) {
                                        recvdmsg->data[nboctet] = '\0';
                                        N_STR* plain = want_lz4
                                                           ? unzip4_nstr(recvdmsg)
                                                           : unzip_nstr(recvdmsg);
                                        if (plain) {
                                            free_nstr(&recvdmsg);
                                            recvdmsg = plain;
                                        } else {
                                            n_log(LOG_ERR,
                                                  "socket %d : failed to decompress payload (%" PRIu32 " bytes, codec=%s); dropping",
                                                  netw->link.sock, nboctet,
                                                  want_lz4 ? "lz4" : "zlib");
                                            free_nstr(&recvdmsg);
                                            DONE = 7;
                                        }
                                    }
                                    if (!DONE) {
                                        pthread_mutex_lock(&netw->recvbolt);
                                        if (list_push(netw->recv_buf, recvdmsg, free_nstr_ptr) == FALSE)
                                            DONE = 6;
                                        pthread_mutex_unlock(&netw->recvbolt);
                                        n_log(LOG_DEBUG, "socket %d : %" PRIu32 " octets received !", netw->link.sock, nboctet);
                                    }
                                } /* recv data */
                            } /* recv data allocation */
                        } /* recv struct allocation */
                    } /* recv nb octet*/
                } /* exit asked */
            } /* recv state */
        } /* if( !done) */
    } while (!DONE);
 
    if (DONE == 1) {
        _netw_capture_error(netw, "Error when receiving state from socket %d (%s), net_status: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
        n_log(LOG_ERR, "Error when receiving state from socket %d (%s), net_status: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
    } else if (DONE == 2) {
        _netw_capture_error(netw, "Error when receiving nboctet from socket %d (%s), net_status: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
        n_log(LOG_ERR, "Error when receiving nboctet from socket %d (%s), net_status: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
    } else if (DONE == 3) {
        _netw_capture_error(netw, "Error when receiving data from socket %d (%s), net_status: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
        n_log(LOG_ERR, "Error when receiving data from socket %d (%s), net_status: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
    } else if (DONE == 4) {
        _netw_capture_error(netw, "Error allocating received message struct from socket %d (%s), net_status: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
        n_log(LOG_ERR, "Error allocating received message struct from socket %d (%s), net_status: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
    } else if (DONE == 5) {
        _netw_capture_error(netw, "Error allocating received messages data array from socket %d (%s), net_status: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
        n_log(LOG_ERR, "Error allocating received messages data array from socket %d (%s), net_status: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
    } else if (DONE == 6) {
        _netw_capture_error(netw, "Error adding receved message from socket %d (%s), net_status: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
        n_log(LOG_ERR, "Error adding receved message from socket %d (%s), net_status: %s", netw->link.sock, _str(netw->link.ip), (net_status == NETW_SOCKET_DISCONNECTED) ? "disconnected" : "socket error");
    }
 
    if (DONE == NETW_THR_EXIT_OK) {
        n_log(LOG_DEBUG, "Socket %d (%s): Receive thread exiting correctly", netw->link.sock, _str(netw->link.ip));
        netw_set(netw, NETW_EXIT_ASKED);
    } else {
        _netw_capture_error(netw, "Socket %d (%s): Receive thread exiting with code %d !", netw->link.sock, _str(netw->link.ip), DONE);
        n_log(LOG_ERR, "Socket %d (%s): Receive thread exiting with code %d !", netw->link.sock, _str(netw->link.ip), DONE);
        netw_set(netw, NETW_ERROR);
    }
 
    pthread_mutex_lock(&netw->eventbolt);
    netw->nb_running_threads--;
    pthread_mutex_unlock(&netw->eventbolt);
 
    pthread_exit(0);
 
    /* suppress compiler warning */
#if !defined(__linux__)
    return NULL;
#endif
} /* netw_recv_func(...) */
 
int netw_stop_thr_engine(NETWORK* netw) {
    __n_assert(netw, return FALSE);
    uint32_t state = 0;
    int thr_engine_status = 0;
 
    n_log(LOG_DEBUG, "Network %d stop threads event", netw->link.sock);
 
    netw_get_state(netw, &state, &thr_engine_status);
 
    if (thr_engine_status != NETW_THR_ENGINE_STARTED) {
        _netw_capture_error(netw, "Thread engine status already stopped for network %p", netw);
        n_log(LOG_ERR, "Thread engine status already stopped for network %p", netw);
        return FALSE;
    }
 
    netw_set(netw, NETW_EXIT_ASKED);
 
    n_log(LOG_DEBUG, "Network %d waits for send threads to stop", netw->link.sock);
    for (int it = 0; it < 10; it++) {
        sem_post(&netw->send_blocker);
        usleep(1000);
    }
    pthread_join(netw->send_thr, NULL);
    n_log(LOG_DEBUG, "Network %d waits for recv threads to stop", netw->link.sock);
    pthread_join(netw->recv_thr, NULL);
 
    netw_set(netw, NETW_EXITED | NETW_THR_ENGINE_STOPPED);
 
    n_log(LOG_DEBUG, "Network %d threads Stopped !", netw->link.sock);
 
    return TRUE;
} /* Stop_Network( ... ) */
 
ssize_t send_data(void* netw, char* buf, uint32_t n) {
    __n_assert(netw, return NETW_SOCKET_ERROR);
    __n_assert(buf, return NETW_SOCKET_ERROR);
 
    SOCKET s = ((NETWORK*)netw)->link.sock;
    ssize_t bcount = 0; /* counts bytes sent */
    int error;
    char* errmsg = NULL;
 
    if (n == 0) {
        _netw_capture_error((NETWORK*)netw, "Send of 0 is unsupported.");
        n_log(LOG_ERR, "Send of 0 is unsupported.");
        return NETW_SOCKET_ERROR;
    }
 
    char* tmp_buf = buf;
    while (bcount < n) /* loop until all sent */
    {
        ssize_t bs = 0; /* bytes sent this pass */
 
        NETW_CALL_RETRY(bs, send(s, tmp_buf, NETW_BUFLEN_CAST(n - bcount), NETFLAGS), NETW_MAX_RETRIES);
        error = neterrno;
 
        if (bs > 0) {
            bcount += bs;  /* increment byte counter */
            tmp_buf += bs; /* move buffer ptr for next send */
        } else if (error == ECONNRESET || error == ENOTCONN || error == EPIPE
#ifdef __windows__
                   || error == WSAECONNRESET || error == WSAENOTCONN || error == WSAESHUTDOWN
#endif
        ) {
            n_log(LOG_DEBUG, "socket %d disconnected !", s);
            return NETW_SOCKET_DISCONNECTED;
        } else if (bs == -1) {
            /* real network error */
            errmsg = netstrerror(error);
            _netw_capture_error((NETWORK*)netw, "Socket %d send error: %zd, %s", s, bs, _str(errmsg));
            n_log(LOG_ERR, "Socket %d send error: %zd, %s", s, bs, _str(errmsg));
            FreeNoLog(errmsg);
            return NETW_SOCKET_ERROR;
        } else if (bs == -2) {
            /* EINTR/WOULDBLOCK retries exhausted */
            _netw_capture_error((NETWORK*)netw, "Socket %d : retry storm on send (%d retries)", s, NETW_MAX_RETRIES);
            n_log(LOG_ERR, "Socket %d : retry storm on send (%d retries)", s, NETW_MAX_RETRIES);
            return NETW_SOCKET_ERROR;
        } else if (bs == 0) {
            /* should never happen on send() */
            n_log(LOG_DEBUG, "socket %d : send returned 0", s);
            return NETW_SOCKET_DISCONNECTED;
        }
    }
    return bcount;
} /*send_data(...)*/
 
ssize_t recv_data(void* netw, char* buf, uint32_t n) {
    __n_assert(netw, return NETW_SOCKET_ERROR);
    __n_assert(buf, return NETW_SOCKET_ERROR);
 
    SOCKET s = ((NETWORK*)netw)->link.sock;
    ssize_t bcount = 0; /* counts bytes read */
    int error;
    char* errmsg = NULL;
 
#if defined(NETWORK_DISABLE_ZERO_LENGTH_RECV) && (NETWORK_DISABLE_ZERO_LENGTH_RECV == TRUE)
    if (n == 0) {
        _netw_capture_error((NETWORK*)netw, "Recv of 0 is unsupported.");
        n_log(LOG_ERR, "Recv of 0 is unsupported.");
        return NETW_SOCKET_ERROR;
    }
#endif
 
    char* tmp_buf = buf;
    while (bcount < n) /* loop until all received */
    {
        ssize_t br = 0; /* bytes received this pass */
 
        NETW_CALL_RETRY(br, recv(s, tmp_buf, NETW_BUFLEN_CAST(n - bcount), NETFLAGS), NETW_MAX_RETRIES);
        error = neterrno;
 
        if (br > 0) {
            bcount += br;  /* increment byte counter */
            tmp_buf += br; /* move buffer ptr for next recv */
        } else if (br == 0) {
            /* clean shutdown from peer */
            n_log(LOG_DEBUG, "socket %d : peer closed connection", s);
            return NETW_SOCKET_DISCONNECTED;
        } else if (error == ECONNRESET || error == ENOTCONN
#ifdef __windows__
                   || error == WSAECONNRESET || error == WSAENOTCONN || error == WSAESHUTDOWN
#endif
        ) {
            /* connection reset or not connected */
            n_log(LOG_DEBUG, "socket %d disconnected !", s);
            return NETW_SOCKET_DISCONNECTED;
        } else if (br == -1) {
            /* real network error */
            errmsg = netstrerror(error);
            _netw_capture_error((NETWORK*)netw, "Socket %d recv error: %zd, %s", s, br, _str(errmsg));
            n_log(LOG_ERR, "Socket %d recv error: %zd, %s", s, br, _str(errmsg));
            FreeNoLog(errmsg);
            return NETW_SOCKET_ERROR;
        } else if (br == -2) {
            /* EINTR/WOULDBLOCK retries exhausted */
            _netw_capture_error((NETWORK*)netw, "Socket %d : retry storm on recv (%d retries)", s, NETW_MAX_RETRIES);
            n_log(LOG_ERR, "Socket %d : retry storm on recv (%d retries)", s, NETW_MAX_RETRIES);
            return NETW_SOCKET_ERROR;
        }
    }
    return bcount;
} /*recv_data(...)*/
 
ssize_t send_data_once(void* netw, char* buf, uint32_t n) {
    __n_assert(netw, return NETW_SOCKET_ERROR);
    __n_assert(buf, return NETW_SOCKET_ERROR);
 
    SOCKET s = ((NETWORK*)netw)->link.sock;
    if (n == 0) {
        _netw_capture_error((NETWORK*)netw, "Send of 0 is unsupported.");
        n_log(LOG_ERR, "Send of 0 is unsupported.");
        return NETW_SOCKET_ERROR;
    }
    for (;;) {
        ssize_t bs = send(s, buf, NETW_BUFLEN_CAST(n), NETFLAGS);
        int error = neterrno;
        if (bs > 0) return bs;
        if (bs == 0) {
            /* should never happen on send() */
            n_log(LOG_DEBUG, "socket %d : send returned 0", s);
            return NETW_SOCKET_DISCONNECTED;
        }
        if (error == EINTR
#ifdef __windows__
            || error == WSAEINTR
#endif
        )
            continue;
        if (error == EAGAIN || error == EWOULDBLOCK
#ifdef __windows__
            || error == WSAEWOULDBLOCK
#endif
        )
            return NETW_IO_WANT_WRITE;
        if (error == ECONNRESET || error == ENOTCONN || error == EPIPE
#ifdef __windows__
            || error == WSAECONNRESET || error == WSAENOTCONN || error == WSAESHUTDOWN
#endif
        ) {
            n_log(LOG_DEBUG, "socket %d disconnected !", s);
            return NETW_SOCKET_DISCONNECTED;
        }
        char* errmsg = netstrerror(error);
        _netw_capture_error((NETWORK*)netw, "Socket %d send_once error: %s", s, _str(errmsg));
        n_log(LOG_ERR, "Socket %d send_once error: %s", s, _str(errmsg));
        FreeNoLog(errmsg);
        return NETW_SOCKET_ERROR;
    }
} /*send_data_once(...)*/
 
ssize_t recv_data_once(void* netw, char* buf, uint32_t n) {
    __n_assert(netw, return NETW_SOCKET_ERROR);
    __n_assert(buf, return NETW_SOCKET_ERROR);
 
    SOCKET s = ((NETWORK*)netw)->link.sock;
    if (n == 0) {
        _netw_capture_error((NETWORK*)netw, "Recv of 0 is unsupported.");
        n_log(LOG_ERR, "Recv of 0 is unsupported.");
        return NETW_SOCKET_ERROR;
    }
    for (;;) {
        ssize_t br = recv(s, buf, NETW_BUFLEN_CAST(n), NETFLAGS);
        int error = neterrno;
        if (br > 0) return br;
        if (br == 0) {
            /* orderly shutdown by peer */
            n_log(LOG_DEBUG, "socket %d disconnected !", s);
            return NETW_SOCKET_DISCONNECTED;
        }
        if (error == EINTR
#ifdef __windows__
            || error == WSAEINTR
#endif
        )
            continue;
        if (error == EAGAIN || error == EWOULDBLOCK
#ifdef __windows__
            || error == WSAEWOULDBLOCK
#endif
        )
            return NETW_IO_WANT_READ;
        if (error == ECONNRESET || error == ENOTCONN
#ifdef __windows__
            || error == WSAECONNRESET || error == WSAENOTCONN
#endif
        ) {
            n_log(LOG_DEBUG, "socket %d disconnected !", s);
            return NETW_SOCKET_DISCONNECTED;
        }
        char* errmsg = netstrerror(error);
        _netw_capture_error((NETWORK*)netw, "Socket %d recv_once error: %s", s, _str(errmsg));
        n_log(LOG_ERR, "Socket %d recv_once error: %s", s, _str(errmsg));
        FreeNoLog(errmsg);
        return NETW_SOCKET_ERROR;
    }
} /*recv_data_once(...)*/
 
#ifdef HAVE_OPENSSL
ssize_t send_ssl_data(void* netw, char* buf, uint32_t n) {
    __n_assert(netw, return -1);
    __n_assert(buf, return -1);
 
    SSL* ssl = ((NETWORK*)netw)->ssl;
    __n_assert(ssl, return -1);
 
    SOCKET s = ((NETWORK*)netw)->link.sock;
 
    ssize_t bcount = 0;  // counts bytes sent
    int error;
    char* errmsg = NULL;
 
    if (n == 0) {
        _netw_capture_error((NETWORK*)netw, "Send of 0 is unsupported.");
        n_log(LOG_ERR, "Send of 0 is unsupported.");
        return -1;
    }
 
    while (bcount < n)  // loop until full buffer
    {
        size_t bs = 0;  // bytes sent this pass
#if OPENSSL_VERSION_NUMBER < 0x1010107fL
        int status = SSL_write(ssl, buf, (int)(n - bcount));  // OpenSSL < 1.1.1
        bs = (status > 0) ? (size_t)status : 0;
#else
        int status = SSL_write_ex(ssl, buf, (size_t)(n - bcount), &bs);  // OpenSSL >= 1.1.1
#endif
        error = neterrno;
        if (status > 0) {
            bcount += (ssize_t)bs;  // increment byte counter
            buf += bs;              // move buffer ptr for next read
        } else {
            int ssl_error = SSL_get_error(ssl, status);
            if (ssl_error == SSL_ERROR_WANT_READ || ssl_error == SSL_ERROR_WANT_WRITE) {
                /* Rare on the blocking sockets the thread engine uses
                 * (renegotiation / partial record). usleep(0) was a
                 * pure busy-yield, burn a bounded 1 ms instead so a
                 * stuck WANT state can't peg a core. */
                u_sleep(1000);
                continue;
            }
            /* Peer-closed connection is a normal end-of-life, not a
             * protocol error. SSL_ERROR_ZERO_RETURN is a clean TLS
             * close_notify; SSL_ERROR_SYSCALL with errno EPIPE /
             * ECONNRESET / ENOTCONN (or errno 0, OpenSSL's "unexpected
             * EOF" signal) means the socket went away under us. Mirror
             * the plaintext send_data() path: log at DEBUG and return
             * NETW_SOCKET_DISCONNECTED so the send thread's QUIT / normal
             * branches treat it as a graceful exit instead of an error.
             * Without this, a TLS client quitting after the server has
             * already dropped the link logs three spurious LOG_ERR lines
             * (SSL_write syscall error / state QUIT / thread exit err 4). */
            if (ssl_error == SSL_ERROR_ZERO_RETURN ||
                (ssl_error == SSL_ERROR_SYSCALL &&
                 (error == 0 || error == EPIPE || error == ECONNRESET || error == ENOTCONN
#ifdef __windows__
                  || error == WSAECONNRESET || error == WSAENOTCONN || error == WSAESHUTDOWN
#endif
                  ))) {
                n_log(LOG_DEBUG, "socket %d disconnected during SSL_write !", s);
                return NETW_SOCKET_DISCONNECTED;
            }
            errmsg = netstrerror(error);
            switch (ssl_error) {
                case SSL_ERROR_SYSCALL:
                    // Real, unexpected syscall failure (errno set to something other than a peer close)
                    _netw_capture_error((NETWORK*)netw, "socket %d SSL_write syscall error: %s", s, _str(errmsg));
                    n_log(LOG_ERR, "socket %d SSL_write syscall error: %s", s, _str(errmsg));
                    break;
                case SSL_ERROR_SSL:
                    // Handle SSL protocol failure
                    _netw_capture_error((NETWORK*)netw, "socket %d SSL_write returned %zu, error: %s", s, bs, ERR_reason_error_string(ERR_get_error()));
                    n_log(LOG_ERR, "socket %d SSL_write returned %zu, error: %s", s, bs, ERR_reason_error_string(ERR_get_error()));
                    break;
                default:
                    // Other errors
                    _netw_capture_error((NETWORK*)netw, "socket %d SSL_write returned %zu, errno: %s", s, bs, _str(errmsg));
                    n_log(LOG_ERR, "socket %d SSL_write returned %zu, errno: %s", s, bs, _str(errmsg));
                    break;
            }
            FreeNoLog(errmsg);
            return NETW_SOCKET_ERROR;
        }
    }
    return bcount;
} /*send_ssl_data(...)*/
 
ssize_t recv_ssl_data(void* netw, char* buf, uint32_t n) {
    __n_assert(netw, return -1);
    __n_assert(buf, return -1);
 
    SSL* ssl = ((NETWORK*)netw)->ssl;
    __n_assert(ssl, return -1);
 
    SOCKET s = ((NETWORK*)netw)->link.sock;
    ssize_t bcount = 0;  // counts bytes read
    int error;
    char* errmsg = NULL;
 
    if (n == 0) {
        _netw_capture_error((NETWORK*)netw, "Recv of 0 is unsupported.");
        n_log(LOG_ERR, "Recv of 0 is unsupported.");
        return -1;
    }
 
    while (bcount < n) {
        size_t br = 0;  // bytes read this pass
                        // loop until full buffer
#if OPENSSL_VERSION_NUMBER < 0x10101000L
        int status = SSL_read(ssl, buf, (int)(n - bcount));  // OpenSSL < 1.1.1
        br = (status > 0) ? (size_t)status : 0;
#else
        int status = SSL_read_ex(ssl, buf, (size_t)(n - bcount), &br);  // OpenSSL >= 1.1.1
#endif
        error = neterrno;
        if (status > 0) {
            bcount += (ssize_t)br;  // increment byte counter
            buf += br;              // move buffer ptr for next read
        } else {
            int ssl_error = SSL_get_error(ssl, status);
            if (ssl_error == SSL_ERROR_WANT_READ || ssl_error == SSL_ERROR_WANT_WRITE) {
                /* Same bounded back-off as send_ssl_data, usleep(0)
                 * was a busy-yield that could peg a core on a stuck
                 * WANT state. */
                u_sleep(1000);
                continue;
            }
            /* Connection teardown is the normal end of a session, not an
             * error. Mirror the plaintext recv_data() and the
             * non-blocking recv_ssl_data_once() paths: return
             * NETW_SOCKET_DISCONNECTED so netw_recv_func() exits via the
             * clean NETW_THR_EXIT_OK path with no LOG_ERR noise -- and so
             * the recv thread does not flip the NETWORK into NETW_ERROR,
             * which is what was tripping the send thread into the
             * "exiting with error 666" (NETW_THR_EXIT_ERROR) tail on a
             * normal client exit. */
            if (ssl_error == SSL_ERROR_ZERO_RETURN) {
                /* peer sent a clean close_notify */
                n_log(LOG_DEBUG, "socket %d : TLS session closed by peer (close_notify)", s);
                return NETW_SOCKET_DISCONNECTED;
            }
            if (ssl_error == SSL_ERROR_SYSCALL && (error == 0 || error == ECONNRESET || error == ENOTCONN
#ifdef __windows__
                                                   || error == WSAECONNRESET || error == WSAENOTCONN || error == WSAESHUTDOWN
#endif
                                                   )) {
                /* peer vanished without close_notify (TCP FIN/RST) */
                n_log(LOG_DEBUG, "socket %d : peer closed connection (TLS, no close_notify)", s);
                return NETW_SOCKET_DISCONNECTED;
            }
            /* Pop the queued reason exactly ONCE and reuse it below;
             * calling ERR_get_error() twice (capture + log) cleared the
             * queue between calls, so the second read always printed
             * "(null)" instead of the real reason. */
            unsigned long ssl_reason = ERR_get_error();
#ifdef SSL_R_UNEXPECTED_EOF_WHILE_READING
            if (ssl_error == SSL_ERROR_SSL && ERR_GET_REASON(ssl_reason) == SSL_R_UNEXPECTED_EOF_WHILE_READING) {
                /* OpenSSL >= 3.0 reports an unclean TCP close as an
                 * SSL_ERROR_SSL/UNEXPECTED_EOF rather than the
                 * SSL_ERROR_SYSCALL/errno-0 of 1.1.1; still a disconnect. */
                n_log(LOG_DEBUG, "socket %d : peer closed connection (TLS unexpected EOF)", s);
                return NETW_SOCKET_DISCONNECTED;
            }
#endif
            errmsg = netstrerror(error);
            switch (ssl_error) {
                case SSL_ERROR_SYSCALL:
                    // Genuine syscall-level failure (not a peer close)
                    _netw_capture_error((NETWORK*)netw, "socket %d SSL_read syscall error: %s", s, _str(errmsg));
                    n_log(LOG_ERR, "socket %d SSL_read syscall error: %s", s, _str(errmsg));
                    break;
                case SSL_ERROR_SSL:
                    // Genuine TLS protocol failure
                    _netw_capture_error((NETWORK*)netw, "socket %d SSL_read protocol error: %s", s, _str((char*)ERR_reason_error_string(ssl_reason)));
                    n_log(LOG_ERR, "socket %d SSL_read protocol error: %s", s, _str((char*)ERR_reason_error_string(ssl_reason)));
                    break;
                default:
                    // Other errors
                    _netw_capture_error((NETWORK*)netw, "socket %d SSL_read returned %zu, errno: %s", s, br, _str(errmsg));
                    n_log(LOG_ERR, "socket %d SSL_read returned %zu, errno: %s", s, br, _str(errmsg));
                    break;
            }
            FreeNoLog(errmsg);
            return NETW_SOCKET_ERROR;
        }
    }
    return bcount;
} /*recv_ssl_data(...)*/
 
ssize_t send_ssl_data_once(void* netw, char* buf, uint32_t n) {
    __n_assert(netw, return NETW_SOCKET_ERROR);
    __n_assert(buf, return NETW_SOCKET_ERROR);
 
    SSL* ssl = ((NETWORK*)netw)->ssl;
    __n_assert(ssl, return NETW_SOCKET_ERROR);
    SOCKET s = ((NETWORK*)netw)->link.sock;
 
    if (n == 0) {
        _netw_capture_error((NETWORK*)netw, "Send of 0 is unsupported.");
        n_log(LOG_ERR, "Send of 0 is unsupported.");
        return NETW_SOCKET_ERROR;
    }
 
    size_t bs = 0;
#if OPENSSL_VERSION_NUMBER < 0x1010107fL
    int status = SSL_write(ssl, buf, (int)n);
    bs = (status > 0) ? (size_t)status : 0;
#else
    int status = SSL_write_ex(ssl, buf, (size_t)n, &bs);
#endif
    int error = neterrno;
    if (status > 0) return (ssize_t)bs;
 
    int ssl_error = SSL_get_error(ssl, status);
    switch (ssl_error) {
        case SSL_ERROR_WANT_READ:
            return NETW_IO_WANT_READ;
        case SSL_ERROR_WANT_WRITE:
            return NETW_IO_WANT_WRITE;
        case SSL_ERROR_ZERO_RETURN:
            n_log(LOG_DEBUG, "socket %d TLS session closed by peer", s);
            return NETW_SOCKET_DISCONNECTED;
        case SSL_ERROR_SYSCALL:
            if (error == 0 || error == ECONNRESET || error == EPIPE || error == ENOTCONN
#ifdef __windows__
                || error == WSAECONNRESET || error == WSAENOTCONN
#endif
            ) {
                n_log(LOG_DEBUG, "socket %d SSL_write syscall: connection closed by peer", s);
                return NETW_SOCKET_DISCONNECTED;
            }
            if (error == EINTR || error == EAGAIN || error == EWOULDBLOCK
#ifdef __windows__
                || error == WSAEINTR || error == WSAEWOULDBLOCK
#endif
            )
                return NETW_IO_WANT_WRITE;
            {
                char* errmsg = netstrerror(error);
                _netw_capture_error((NETWORK*)netw, "socket %d SSL_write_once syscall error: %s", s, _str(errmsg));
                n_log(LOG_ERR, "socket %d SSL_write_once syscall error: %s", s, _str(errmsg));
                FreeNoLog(errmsg);
            }
            return NETW_SOCKET_ERROR;
        default:
            _netw_capture_error((NETWORK*)netw, "socket %d SSL_write_once error: %s", s, ERR_reason_error_string(ERR_get_error()));
            n_log(LOG_ERR, "socket %d SSL_write_once error: %s", s, ERR_reason_error_string(ERR_get_error()));
            return NETW_SOCKET_ERROR;
    }
} /*send_ssl_data_once(...)*/
 
ssize_t recv_ssl_data_once(void* netw, char* buf, uint32_t n) {
    __n_assert(netw, return NETW_SOCKET_ERROR);
    __n_assert(buf, return NETW_SOCKET_ERROR);
 
    SSL* ssl = ((NETWORK*)netw)->ssl;
    __n_assert(ssl, return NETW_SOCKET_ERROR);
    SOCKET s = ((NETWORK*)netw)->link.sock;
 
    if (n == 0) {
        _netw_capture_error((NETWORK*)netw, "Recv of 0 is unsupported.");
        n_log(LOG_ERR, "Recv of 0 is unsupported.");
        return NETW_SOCKET_ERROR;
    }
 
    size_t br = 0;
#if OPENSSL_VERSION_NUMBER < 0x10101000L
    int status = SSL_read(ssl, buf, (int)n);
    br = (status > 0) ? (size_t)status : 0;
#else
    int status = SSL_read_ex(ssl, buf, (size_t)n, &br);
#endif
    int error = neterrno;
    if (status > 0) return (ssize_t)br;
 
    int ssl_error = SSL_get_error(ssl, status);
    switch (ssl_error) {
        case SSL_ERROR_WANT_READ:
            return NETW_IO_WANT_READ;
        case SSL_ERROR_WANT_WRITE:
            return NETW_IO_WANT_WRITE;
        case SSL_ERROR_ZERO_RETURN:
            n_log(LOG_DEBUG, "socket %d TLS session closed by peer", s);
            return NETW_SOCKET_DISCONNECTED;
        case SSL_ERROR_SYSCALL:
            if (error == 0 || error == ECONNRESET || error == ENOTCONN
#ifdef __windows__
                || error == WSAECONNRESET || error == WSAENOTCONN
#endif
            ) {
                n_log(LOG_DEBUG, "socket %d SSL_read syscall: connection closed by peer", s);
                return NETW_SOCKET_DISCONNECTED;
            }
            if (error == EINTR || error == EAGAIN || error == EWOULDBLOCK
#ifdef __windows__
                || error == WSAEINTR || error == WSAEWOULDBLOCK
#endif
            )
                return NETW_IO_WANT_READ;
            {
                char* errmsg = netstrerror(error);
                _netw_capture_error((NETWORK*)netw, "socket %d SSL_read_once syscall error: %s", s, _str(errmsg));
                n_log(LOG_ERR, "socket %d SSL_read_once syscall error: %s", s, _str(errmsg));
                FreeNoLog(errmsg);
            }
            return NETW_SOCKET_ERROR;
        default: {
            /* Pop the reason once (a second ERR_get_error() would clear
             * the queue and print "(null)"). OpenSSL >= 3.0 reports an
             * unclean TCP close here as SSL_ERROR_SSL/UNEXPECTED_EOF --
             * a disconnect, not a protocol error. */
            unsigned long ssl_reason = ERR_get_error();
#ifdef SSL_R_UNEXPECTED_EOF_WHILE_READING
            if (ssl_error == SSL_ERROR_SSL && ERR_GET_REASON(ssl_reason) == SSL_R_UNEXPECTED_EOF_WHILE_READING) {
                n_log(LOG_DEBUG, "socket %d : peer closed connection (TLS unexpected EOF)", s);
                return NETW_SOCKET_DISCONNECTED;
            }
#endif
            _netw_capture_error((NETWORK*)netw, "socket %d SSL_read_once error: %s", s, _str((char*)ERR_reason_error_string(ssl_reason)));
            n_log(LOG_ERR, "socket %d SSL_read_once error: %s", s, _str((char*)ERR_reason_error_string(ssl_reason)));
            return NETW_SOCKET_ERROR;
        }
    }
} /*recv_ssl_data_once(...)*/
#endif
 
ssize_t send_php(SOCKET s, int _code, char* buf, int n) {
    ssize_t bcount = 0; /* counts bytes read */
    ssize_t bs;         /* bytes read this pass */
 
    int error;
    char* errmsg = NULL;
 
    char* ptr = NULL; /* temp char ptr ;-) */
    char head[HEAD_SIZE + 1] = "";
    char code[HEAD_CODE + 1] = "";
 
    // Format and assign to head
    snprintf(head, HEAD_SIZE + 1, "%0*d", HEAD_SIZE, n);
    // Format and assign to code
    snprintf(code, HEAD_CODE + 1, "%0*d", HEAD_CODE, _code);
 
    /* sending head */
    bcount = 0;
    ptr = head;
    while (bcount < HEAD_SIZE) /* loop until full buffer */
    {
        bs = send(s, ptr, NETW_BUFLEN_CAST(HEAD_SIZE - bcount), NETFLAGS);
        error = neterrno;
        if (bs > 0) {
            bcount += bs; /* increment byte counter */
            ptr += bs;    /* move buffer ptr for next read */
        } else {
            /* signal an error to the caller */
            errmsg = netstrerror(error);
            n_log(LOG_ERR, "Socket %d sending Error %d when sending head size, neterrno: %s", s, bs, _str(errmsg));
            FreeNoLog(errmsg);
            return -1;
        }
    }
 
    /* sending code */
    bcount = 0;
    ptr = code;
    while (bcount < HEAD_CODE) /* loop until full buffer */
    {
        bs = send(s, ptr, NETW_BUFLEN_CAST(HEAD_CODE - bcount), NETFLAGS);
        error = neterrno;
        if (bs > 0) {
            bcount += bs; /* increment byte counter */
            ptr += bs;    /* move buffer ptr for next read */
        } else {
            errmsg = netstrerror(error);
            n_log(LOG_ERR, "Socket %d sending Error %d when sending head code, neterrno: %s", s, bs, _str(errmsg));
            FreeNoLog(errmsg);
            return -1;
        }
    }
 
    /* sending buf */
    bcount = 0;
    while (bcount < n) /* loop until full buffer */
    {
        bs = send(s, buf, NETW_BUFLEN_CAST(n - bcount), NETFLAGS);
        error = neterrno;
        if (bs > 0) {
            bcount += bs; /* increment byte counter */
            buf += bs;    /* move buffer ptr for next read */
        } else {
            /* signal an error to the caller */
            errmsg = netstrerror(error);
            n_log(LOG_ERR, "Socket %d sending Error %d when sending message of size %d, neterrno: %s", s, bs, n, _str(errmsg));
            FreeNoLog(errmsg);
            return -1;
        }
    }
 
    return bcount;
 
} /*send_php(...)*/
 
ssize_t recv_php(SOCKET s, int* _code, char** buf) {
    ssize_t bcount = 0;           /* counts bytes read */
    ssize_t br;                   /* bytes read this pass */
    long int tmpnb = 0, size = 0; /* size of message to receive */
    char* ptr = NULL;
 
    int error;
    char* errmsg = NULL;
 
    char head[HEAD_SIZE + 1] = "";
    char code[HEAD_CODE + 1] = "";
 
    /* Receiving total message size */
    bcount = 0;
    ptr = head;
    while (bcount < HEAD_SIZE) {
        /* loop until full buffer */
        br = recv(s, ptr, NETW_BUFLEN_CAST(HEAD_SIZE - bcount), NETFLAGS);
        error = neterrno;
        if (br > 0) {
            bcount += br; /* increment byte counter */
            ptr += br;    /* move buffer ptr for next read */
        } else {
            /* signal an error to the caller */
            errmsg = netstrerror(error);
            n_log(LOG_ERR, "Socket %d receive %d Error %s", s, br, _str(errmsg));
            FreeNoLog(errmsg);
            return FALSE;
        }
    }
 
    tmpnb = strtol(head, NULL, 10);
    if (tmpnb == LONG_MIN || tmpnb == LONG_MAX) {
        n_log(LOG_ERR, "Size received ( %ld ) can not be determined on socket %d", tmpnb, s);
        return FALSE;
    }
 
    size = tmpnb;
 
    /* receiving request code */
    bcount = 0;
    ptr = code;
    while (bcount < HEAD_CODE) {
        /* loop until full buffer */
        br = recv(s, ptr, NETW_BUFLEN_CAST(HEAD_CODE - bcount), NETFLAGS);
        error = neterrno;
        if (br > 0) {
            bcount += br; /* increment byte counter */
            ptr += br;    /* move buffer ptr for next read */
        } else {
            /* signal an error to the caller */
            errmsg = netstrerror(error);
            n_log(LOG_ERR, "Socket %d receive %d Error , neterrno: %s", s, br, _str(errmsg));
            FreeNoLog(errmsg);
            return FALSE;
        }
    }
 
    tmpnb = strtol(code, NULL, 10);
    if (tmpnb <= INT_MIN || tmpnb >= INT_MAX) {
        n_log(LOG_ERR, "Code received ( %ld ) too big or too little to be  valid code on socket %d", tmpnb, s);
        return FALSE;
    }
 
    (*_code) = (int)tmpnb;
 
    /* receving message */
    if ((*buf)) {
        // cppcheck-suppress identicalInnerCondition ; Free() macro rechecks pointer internally
        Free((*buf));
    }
    Malloc((*buf), char, (size_t)(size + 1));
    if (!(*buf)) {
        n_log(LOG_ERR, "Could not allocate PHP receive buf");
        return FALSE;
    }
 
    bcount = 0;
    ptr = (*buf);
    while (bcount < size) {
        /* loop until full buffer */
        br = recv(s, ptr, NETW_BUFLEN_CAST(size - bcount), NETFLAGS);
        error = neterrno;
        if (br > 0) {
            bcount += br; /* increment byte counter */
            ptr += br;    /* move buffer ptr for next read */
        } else {
            /* signal an error to the caller */
            errmsg = netstrerror(error);
            n_log(LOG_ERR, "Socket %d receive %d Error neterrno: %s", s, br, _str(errmsg));
            FreeNoLog(errmsg);
            return FALSE;
        }
    }
    return size;
} /*recv_php(...)*/
 
int netw_get_queue_status(NETWORK* netw, size_t* nb_to_send, size_t* nb_to_read) {
    __n_assert(netw, return FALSE);
 
    pthread_mutex_lock(&netw->sendbolt);
    (*nb_to_send) = netw->send_buf->nb_items;
    pthread_mutex_unlock(&netw->sendbolt);
 
    pthread_mutex_lock(&netw->recvbolt);
    (*nb_to_read) = netw->recv_buf->nb_items;
    pthread_mutex_unlock(&netw->recvbolt);
 
    return TRUE;
} /* get queue states */
 
NETWORK_POOL* netw_new_pool(size_t nb_min_element) {
    NETWORK_POOL* netw_pool = NULL;
 
    Malloc(netw_pool, NETWORK_POOL, 1);
    __n_assert(netw_pool, return NULL);
 
    netw_pool->pool = new_ht(nb_min_element);
    __n_assert(netw_pool->pool, Free(netw_pool); return NULL);
 
    init_lock(netw_pool->rwlock);
 
    return netw_pool;
} /* netw_new_pool() */
 
int netw_destroy_pool(NETWORK_POOL** netw_pool) {
    __n_assert(netw_pool && (*netw_pool), return FALSE);
 
    write_lock((*netw_pool)->rwlock);
    if ((*netw_pool)->pool)
        destroy_ht(&(*netw_pool)->pool);
    unlock((*netw_pool)->rwlock);
 
    rw_lock_destroy((*netw_pool)->rwlock);
 
    Free((*netw_pool));
 
    return TRUE;
} /* netw_destroy_pool() */
 
void netw_pool_netw_close(void* netw_ptr) {
    NETWORK* netw = (NETWORK*)netw_ptr;
    __n_assert(netw, return);
    n_log(LOG_DEBUG, "Network pool %p: network id %d still active !!", netw, netw->link.sock);
    return;
} /* netw_pool_netw_close() */
 
int netw_pool_add(NETWORK_POOL* netw_pool, NETWORK* netw) {
    __n_assert(netw_pool, return FALSE);
    __n_assert(netw, return FALSE);
 
    n_log(LOG_DEBUG, "Trying to add %lld to %p", (unsigned long long)netw->link.sock, netw_pool->pool);
 
    /* write lock the pool */
    write_lock(netw_pool->rwlock);
    /* test if not already added */
    N_STR* key = NULL;
    nstrprintf(key, "%lld", (unsigned long long)netw->link.sock);
    HASH_NODE* node = NULL;
    if (ht_get_ptr(netw_pool->pool, _nstr(key), (void*)&node) == TRUE) {
        _netw_capture_error(netw, "Network id %d already added !", netw->link.sock);
        n_log(LOG_ERR, "Network id %d already added !", netw->link.sock);
        free_nstr(&key);
        unlock(netw_pool->rwlock);
        return FALSE;
    }
    int retval;
    /* add it */
    if ((retval = ht_put_ptr(netw_pool->pool, _nstr(key), netw, &netw_pool_netw_close, NULL)) == TRUE) {
        if ((retval = list_push(netw->pools, netw_pool, NULL)) == TRUE) {
            n_log(LOG_DEBUG, "added netw %d to pool %p", netw->link.sock, netw_pool);
        } else {
            _netw_capture_error(netw, "could not add netw %d to pool %p", netw->link.sock, netw_pool);
            n_log(LOG_ERR, "could not add netw %d to pool %p", netw->link.sock, netw_pool);
        }
    } else {
        _netw_capture_error(netw, "could not add netw %d to pool %p", netw->link.sock, netw_pool);
        n_log(LOG_ERR, "could not add netw %d to pool %p", netw->link.sock, netw_pool);
    }
    free_nstr(&key);
 
    /* unlock the pool */
    unlock(netw_pool->rwlock);
 
    return retval;
} /* netw_pool_add() */
 
int netw_pool_remove(NETWORK_POOL* netw_pool, NETWORK* netw) {
    __n_assert(netw_pool, return FALSE);
    __n_assert(netw, return FALSE);
 
    /* write lock the pool */
    write_lock(netw_pool->rwlock);
    /* test if present */
    N_STR* key = NULL;
    nstrprintf(key, "%lld", (unsigned long long int)netw->link.sock);
    if (ht_remove(netw_pool->pool, _nstr(key)) == TRUE) {
        LIST_NODE* node = list_search(netw->pools, netw_pool);
        if (node) {
            if (!remove_list_node(netw->pools, node, NETWORK_POOL)) {
                _netw_capture_error(netw, "Network id %d could not be removed !", netw->link.sock);
                n_log(LOG_ERR, "Network id %d could not be removed !", netw->link.sock);
            }
        }
        unlock(netw_pool->rwlock);
        n_log(LOG_DEBUG, "Network id %d removed !", netw->link.sock);
        free_nstr(&key);
        return TRUE;
    }
    free_nstr(&key);
    _netw_capture_error(netw, "Network id %d already removed !", netw->link.sock);
    n_log(LOG_ERR, "Network id %d already removed !", netw->link.sock);
    /* unlock the pool */
    unlock(netw_pool->rwlock);
    return FALSE;
} /* netw_pool_remove */
 
int netw_pool_broadcast(NETWORK_POOL* netw_pool, const NETWORK* from, N_STR* net_msg) {
    __n_assert(netw_pool, return FALSE);
    __n_assert(net_msg, return FALSE);
 
    /* write lock the pool */
    read_lock(netw_pool->rwlock);
    ht_foreach(node, netw_pool->pool) {
        NETWORK* netw = hash_val(node, NETWORK);
        if (from) {
            if (netw->link.sock != from->link.sock)
                netw_add_msg(netw, nstrdup(net_msg));
        } else {
            netw_add_msg(netw, nstrdup(net_msg));
        }
    }
    unlock(netw_pool->rwlock);
    return TRUE;
} /* netw_pool_broadcast */
 
size_t netw_pool_nbclients(NETWORK_POOL* netw_pool) {
    __n_assert(netw_pool, return 0);
 
    size_t nb = 0;
    read_lock(netw_pool->rwlock);
    nb = netw_pool->pool->nb_keys;
    unlock(netw_pool->rwlock);
 
    return nb;
} /* netw_pool_nbclients() */
 
int netw_set_user_id(NETWORK* netw, int id) {
    __n_assert(netw, return FALSE);
    netw->user_id = id;
    return TRUE;
} /* netw_set_user_id() */
 
int netw_send_ping(NETWORK* netw, int type, int id_from, int id_to, int time) {
    N_STR* tmpstr = NULL;
    __n_assert(netw, return FALSE);
 
    tmpstr = netmsg_make_ping(type, id_from, id_to, time);
    __n_assert(tmpstr, return FALSE);
 
    return netw_add_msg(netw, tmpstr);
} /* netw_send_ping( ... ) */
 
int netw_send_ident(NETWORK* netw, int type, int id, N_STR* name, N_STR* passwd) {
    N_STR* tmpstr = NULL;
 
    __n_assert(netw, return FALSE);
 
    tmpstr = netmsg_make_ident(type, id, name, passwd);
    __n_assert(tmpstr, return FALSE);
 
    return netw_add_msg(netw, tmpstr);
} /* netw_send_ident( ... ) */
 
int netw_send_position(NETWORK* netw, int id, double X, double Y, double vx, double vy, double acc_x, double acc_y, int time_stamp) {
    N_STR* tmpstr = NULL;
 
    __n_assert(netw, return FALSE);
 
    tmpstr = netmsg_make_position_msg(id, X, Y, vx, vy, acc_x, acc_y, time_stamp);
 
    __n_assert(tmpstr, return FALSE);
 
    return netw_add_msg(netw, tmpstr);
} /* netw_send_position( ... ) */
 
int netw_send_string_to(NETWORK* netw, int id_to, N_STR* name, N_STR* chan, N_STR* txt, int color) {
    N_STR* tmpstr = NULL;
 
    __n_assert(netw, return FALSE);
 
    tmpstr = netmsg_make_string_msg(netw->user_id, id_to, name, chan, txt, color);
    __n_assert(tmpstr, return FALSE);
 
    return netw_add_msg(netw, tmpstr);
} /* netw_send_string_to( ... ) */
 
int netw_send_string_to_all(NETWORK* netw, N_STR* name, N_STR* chan, N_STR* txt, int color) {
    N_STR* tmpstr = NULL;
 
    __n_assert(netw, return FALSE);
 
    tmpstr = netmsg_make_string_msg(netw->user_id, -1, name, chan, txt, color);
    __n_assert(tmpstr, return FALSE);
 
    return netw_add_msg(netw, tmpstr);
} /* netw_send_string_to_all( ... ) */
 
int netw_send_quit(NETWORK* netw) {
    __n_assert(netw, return FALSE);
 
    N_STR* tmpstr = NULL;
 
    tmpstr = netmsg_make_quit_msg();
    __n_assert(tmpstr, return FALSE);
 
    return netw_add_msg(netw, tmpstr);
} /* netw_send_quit( ... ) */
 
size_t netw_calculate_urlencoded_size(const char* str, size_t len) {
    __n_assert(str, return 0);
 
    size_t encoded_size = 0;
 
    for (size_t i = 0; i < len; i++) {
        unsigned char c = (unsigned char)str[i];
        if (isalnum(c) || c == '-' || c == '_' || c == '.' || c == '~') {
            encoded_size += 1;  // Safe character, no encoding needed
        } else {
            encoded_size += 3;  // Unsafe character, will be encoded as %XX
        }
    }
 
    return encoded_size;
}
 
char* netw_urlencode(const char* str, size_t len) {
    __n_assert(str, return NULL);
 
    static const char* hex = "0123456789ABCDEF";
    size_t encoded_size = netw_calculate_urlencoded_size(str, len);
    char* encoded = (char*)malloc(encoded_size + 1);  // Allocate memory for the encoded string (+1 for the null terminator)
 
    if (!encoded) {
        return NULL;  // Return NULL if memory allocation fails
    }
 
    char* pbuf = encoded;
 
    for (size_t i = 0; i < len; i++) {
        unsigned char c = (unsigned char)str[i];
        if (isalnum(c) || c == '-' || c == '_' || c == '.' || c == '~') {
            *pbuf++ = (char)c;  // Copy safe characters directly
        } else {
            *pbuf++ = '%';  // Encode unsafe characters as %XX
            *pbuf++ = hex[c >> 4];
            *pbuf++ = hex[c & 0xF];
        }
    }
 
    *pbuf = '\0';  // Null-terminate the encoded string
    return encoded;
}
 
char* netw_extract_http_request_type(const char* request) {
    __n_assert(request, return NULL);
    // Find the first space in the request string
    const char* space = strchr(request, ' ');
 
    if (space == NULL) {
        // No space found, invalid request format
        return NULL;
    }
 
    // Calculate the length of the request type
    size_t method_length = (size_t)(space - request);
 
    // Allocate memory for the method string (+1 for the null terminator)
    char* method = (char*)malloc(method_length + 1);
 
    if (method == NULL) {
        // Memory allocation failed
        return NULL;
    }
 
    // Copy the request method to the allocated memory
    strncpy(method, request, method_length);
    method[method_length] = '\0';  // Null-terminate the string
 
    return method;
}
 
NETWORK_HTTP_INFO netw_extract_http_info(char* request) {
    NETWORK_HTTP_INFO info = {.content_length = 0, .body = NULL, .type = NULL, .content_type = {0}};
 
    __n_assert(request, return info);
 
    // Hold the request-type allocation in a local until just before return.
    // The clang static analyzer's unix.Malloc checker mis-tracks ownership
    // when a malloc'd pointer is parked in a returned-by-value struct member
    // early in the function; keeping it local until the final assignment
    // makes the escape via the returned struct unambiguous to the analyzer.
    char* request_type = netw_extract_http_request_type(request);
 
    // Find Content-Type header (Optional)
    const char* content_type_header = strstr(request, "Content-Type:");
    if (content_type_header) {
        const char* start = content_type_header + strlen("Content-Type: ");
        const char* end = strstr(start, "\r\n");
        if (end) {
            size_t length = (size_t)(end - start);
            if (length > 255) length = 255;
            strncpy(info.content_type, start, length);
            info.content_type[length] = '\0';
        }
    } else {
        // If no Content-Type header found, set default
        strncpy(info.content_type, "text/plain", sizeof(info.content_type) - 1);
    }
 
    // Find Content-Length header (Optional)
    const char* content_length_header = strstr(request, "Content-Length:");
    if (content_length_header) {
        const char* start = content_length_header + strlen("Content-Length: ");
        errno = 0;
        unsigned long tmp_cl = strtoul(start, NULL, 10); /* parse once */
        int error = errno;
        // Handle out-of-range error (e.g., set a safe default or return an error)
        // Only when ULONG_MAX is larger than SIZE_MAX, to prevent a constant false comparison warning
#if ULONG_MAX > SIZE_MAX
        if (error == ERANGE || tmp_cl > SIZE_MAX) {
#else
        if (error == ERANGE) {
#endif
            n_log(LOG_ERR, "could not get content_length for request %p, returned %s", request, strerror(error));
            info.content_length = SIZE_MAX; /* clamp to the maximum supported value */
        } else {
            info.content_length = (size_t)tmp_cl;
        }
    }
 
    // Find the start of the body (after \r\n\r\n)
    const char* body_start = strstr(request, "\r\n\r\n");
    if (body_start) {
        body_start += 4;  // Skip the \r\n\r\n
 
        // If there is a Content-Length, and it's greater than 0, copy the body
        if (info.content_length > 0 && info.content_length < SIZE_MAX) {
            info.body = malloc(info.content_length + 1);  // Allocate memory for body
            if (info.body) {
                strncpy(info.body, body_start, info.content_length);
                info.body[info.content_length] = '\0';  // Null-terminate the body
            }
        }
    }
 
    info.type = request_type;
    return info;
}
 
int netw_info_destroy(NETWORK_HTTP_INFO http_request) {
    FreeNoLog(http_request.body);
    FreeNoLog(http_request.type);
    return TRUE;
}
 
int netw_get_url_from_http_request(const char* request, char* url, size_t size) {
    __n_assert(request && strlen(request) > 0, return FALSE);
    __n_assert(url && size > 1, return FALSE);
 
    /* Default output */
    strncpy(url, "/", size - 1);
    url[size - 1] = '\0';
 
    /* Example request line: "GET /path/to/resource HTTP/1.1" */
    const char* first_space = strchr(request, ' ');
    if (!first_space) {
        /* Malformed request, return default '/' */
        return FALSE;
    }
 
    const char* second_space = strchr(first_space + 1, ' ');
    if (!second_space) {
        /* Malformed request, return default '/' */
        return FALSE;
    }
 
    size_t len = (size_t)(second_space - first_space - 1);
    if (len >= size) {
        len = size - 1;
    }
 
    strncpy(url, first_space + 1, len);
    url[len] = '\0'; /* Null-terminate the URL */
 
    return TRUE;
}
 
char* netw_urldecode(const char* str) {
    __n_assert(str, return NULL);
    char* decoded = malloc(strlen(str) + 1);
    __n_assert(decoded, return NULL);
 
    char* p = decoded;
    while (*str) {
        if (*str == '%') {
            if (isxdigit((unsigned char)str[1]) && isxdigit((unsigned char)str[2])) {
                unsigned int value;
                if (sscanf(str + 1, "%2x", &value) >= 1) {
                    *p++ = (char)value;
                    str += 3;
                } else {
                    n_log(LOG_ERR, "sscanf could not parse char *str (%p) for a %%2x", str);
                    Free(decoded);
                    return NULL;
                }
            } else {
                *p++ = *str++;
            }
        } else if (*str == '+') {
            *p++ = ' ';
            str++;
        } else {
            *p++ = *str++;
        }
    }
    *p = '\0';
    return decoded;
}
 
HASH_TABLE* netw_parse_post_data(const char* post_data) {
    __n_assert(post_data, return NULL);
 
    // Create a copy of the post_data string because strtok modifies the string
    char* data = strdup(post_data);
    __n_assert(data, return NULL);
 
    char* pair = data;
 
    HASH_TABLE* post_data_table = new_ht(32);
 
    while (pair != NULL) {
        // Find the next key-value pair separated by '&'
        char* ampersand_pos = strchr(pair, '&');
 
        // If found, replace it with '\0' to isolate the current pair
        if (ampersand_pos != NULL) {
            *ampersand_pos = '\0';
        }
 
        // Now split each pair by '=' to get the key and value
        char* equal_pos = strchr(pair, '=');
        if (equal_pos != NULL) {
            *equal_pos = '\0';  // Terminate the key string
            const char* key = pair;
            const char* value = equal_pos + 1;
 
            // Decode the value since POST data is URL-encoded
            char* decoded_value = netw_urldecode(value);
            ht_put_string(post_data_table, key, decoded_value);
            // printf("Key: %s, Value: %s\n", key, decoded_value);
            free(decoded_value);
        }
        // Move to the next key-value pair (if any)
        pair = (ampersand_pos != NULL) ? (ampersand_pos + 1) : NULL;
    }
    // Free the duplicated string
    free(data);
    return post_data_table;
}
 
const char* netw_guess_http_content_type(const char* url) {
    __n_assert(url, return NULL);
 
    // Create a copy of the URL to work on (to avoid modifying the original string)
    char url_copy[1024];
    strncpy(url_copy, url, sizeof(url_copy) - 1);
    url_copy[sizeof(url_copy) - 1] = '\0';
 
    // Find if there is a '?' (indicating GET parameters) and terminate the string there
    char* query_start = strchr(url_copy, '?');
    if (query_start) {
        *query_start = '\0';  // Terminate the string before the query parameters
    }
 
    // Find the last occurrence of a dot in the URL (file extension)
    const char* ext = strrchr(url_copy, '.');
 
    // If no extension is found, return "unknown"
    if (!ext) {
        return "unknown";
    }
 
    // Compare the extension to known content types
    if (strcmp(ext, ".html") == 0 || strcmp(ext, ".htm") == 0) {
        return "text/html";
    } else if (strcmp(ext, ".txt") == 0) {
        return "text/plain";
    } else if (strcmp(ext, ".jpg") == 0 || strcmp(ext, ".jpeg") == 0) {
        return "image/jpeg";
    } else if (strcmp(ext, ".png") == 0) {
        return "image/png";
    } else if (strcmp(ext, ".gif") == 0) {
        return "image/gif";
    } else if (strcmp(ext, ".css") == 0) {
        return "text/css";
    } else if (strcmp(ext, ".js") == 0) {
        return "application/javascript";
    } else if (strcmp(ext, ".json") == 0) {
        return "application/json";
    } else if (strcmp(ext, ".xml") == 0) {
        return "application/xml";
    } else if (strcmp(ext, ".pdf") == 0) {
        return "application/pdf";
    } else if (strcmp(ext, ".zip") == 0) {
        return "application/zip";
    } else if (strcmp(ext, ".mp4") == 0) {
        return "video/mp4";
    } else if (strcmp(ext, ".mp3") == 0) {
        return "audio/mpeg";
    } else if (strcmp(ext, ".wav") == 0) {
        return "audio/wav";
    } else if (strcmp(ext, ".ogg") == 0) {
        return "audio/ogg";
    }
 
    // Return unknown for other types
    return "unknown";
}
 
const char* netw_get_http_status_message(int status_code) {
    switch (status_code) {
        case 200:
            return "OK";
        case 204:
            return "No Content";
        case 304:
            return "Not Modified";
        case 404:
            return "Not Found";
        case 500:
            return "Internal Server Error";
            // Add more status codes as needed
        default:
            return "Unknown";
    }
}
 
int n_http_status_class(int status_code) {
    if (status_code < 100 || status_code > 599)
        return 0;
    return status_code / 100;
}
 
int n_http_status_is_informational(int status_code) {
    return n_http_status_class(status_code) == 1;
}
 
int n_http_status_is_success(int status_code) {
    return n_http_status_class(status_code) == 2;
}
 
int n_http_status_is_redirect(int status_code) {
    return n_http_status_class(status_code) == 3;
}
 
int n_http_status_is_client_error(int status_code) {
    return n_http_status_class(status_code) == 4;
}
 
int n_http_status_is_server_error(int status_code) {
    return n_http_status_class(status_code) == 5;
}
 
/* Inflate src/len with the given zlib window bits into a fresh N_STR.
 * window_bits: 15+16 for gzip framing, -15 for raw deflate, 15 for zlib-wrapped.
 * Returns 0 on success (*out set), -1 on error. */
static int n_http_inflate(const unsigned char* src, size_t len, int window_bits, N_STR** out) {
    z_stream strm;
    size_t alloc, total = 0;
    char* buf;
    int ret;
    *out = NULL;
    memset(&strm, 0, sizeof(strm));
    if (inflateInit2(&strm, window_bits) != Z_OK)
        return -1;
    alloc = len * 4;
    if (alloc < 4096)
        alloc = 4096;
    buf = malloc(alloc);
    if (!buf) {
        inflateEnd(&strm);
        return -1;
    }
    strm.next_in = (Bytef*)src;
    strm.avail_in = (uInt)len;
    do {
        if (total >= alloc - 1) {
            char* tmp;
            alloc *= 2;
            tmp = realloc(buf, alloc);
            if (!tmp) {
                free(buf);
                inflateEnd(&strm);
                return -1;
            }
            buf = tmp;
        }
        strm.next_out = (Bytef*)(buf + total);
        strm.avail_out = (uInt)(alloc - total - 1);
        ret = inflate(&strm, Z_NO_FLUSH);
        if (ret == Z_STREAM_ERROR || ret == Z_DATA_ERROR || ret == Z_MEM_ERROR || ret == Z_NEED_DICT) {
            free(buf);
            inflateEnd(&strm);
            return -1;
        }
        total = alloc - 1 - strm.avail_out;
    } while (ret != Z_STREAM_END);
    inflateEnd(&strm);
    buf[total] = '\0';
    {
        N_STR* r = NULL;
        char_to_nstr_ex(buf, (NSTRBYTE)total, &r);
        free(buf);
        if (!r)
            return -1;
        *out = r;
    }
    return 0;
}
 
int n_http_decompress_body(const N_STR* body, const char* encoding, N_STR** out) {
    char enc[32];
    int is_gzip = 0, is_deflate = 0;
    if (!body || !out)
        return -1;
    *out = NULL;
 
    enc[0] = '\0';
    if (encoding) {
        size_t i;
        for (i = 0; i < sizeof(enc) - 1 && encoding[i]; i++)
            enc[i] = (char)tolower((unsigned char)encoding[i]);
        enc[i] = '\0';
    }
    if (strstr(enc, "gzip"))
        is_gzip = 1;
    else if (strstr(enc, "deflate"))
        is_deflate = 1;
 
    /* identity / unknown / empty body: pass a copy through unchanged */
    if ((!is_gzip && !is_deflate) || !body->data || body->written == 0) {
        N_STR* copy = nstrdup((N_STR*)body);
        if (!copy)
            return -1;
        *out = copy;
        return 0;
    }
 
    if (is_gzip)
        return n_http_inflate((const unsigned char*)body->data, body->written, 15 + 16, out);
    /* "deflate" is sent both raw (-15) and zlib-wrapped (15); try raw, then wrapped */
    if (n_http_inflate((const unsigned char*)body->data, body->written, -15, out) == 0)
        return 0;
    return n_http_inflate((const unsigned char*)body->data, body->written, 15, out);
}
 
/* Binary substring search: first offset of needle in hay, or -1. */
static long mp_find(const unsigned char* hay, size_t hlen, const char* needle, size_t nlen) {
    size_t i;
    if (nlen == 0 || nlen > hlen)
        return -1;
    for (i = 0; i + nlen <= hlen; i++) {
        if (hay[i] == (unsigned char)needle[0] && memcmp(hay + i, needle, nlen) == 0)
            return (long)i;
    }
    return -1;
}
 
/* Duplicate len bytes of s into a fresh NUL-terminated C string. */
static char* mp_strndup(const char* s, size_t len) {
    char* r = NULL;
    Malloc(r, char, len + 1);
    if (!r)
        return NULL;
    if (len)
        memcpy(r, s, len);
    r[len] = '\0';
    return r;
}
 
int n_http_multipart_boundary(const char* content_type, char* out, size_t outsz) {
    const char* p;
    size_t i;
    if (!content_type || !out || outsz == 0)
        return -1;
    /* case-insensitive search for "boundary=" */
    for (p = content_type; *p; p++) {
        if (strncasecmp(p, "boundary=", 9) == 0)
            break;
    }
    if (!*p)
        return -1;
    p += 9;
    i = 0;
    if (*p == '"') {
        p++;
        while (*p && *p != '"' && i + 1 < outsz)
            out[i++] = *p++;
    } else {
        while (*p && *p != ';' && *p != ' ' && *p != '\r' && *p != '\n' && i + 1 < outsz)
            out[i++] = *p++;
    }
    out[i] = '\0';
    return i > 0 ? 0 : -1;
}
 
/* Free an N_HTTP_MULTIPART_PART stored in a LIST. */
static void mp_part_free(void* ptr) {
    N_HTTP_MULTIPART_PART* mp = (N_HTTP_MULTIPART_PART*)ptr;
    if (!mp)
        return;
    FreeNoLog(mp->name);
    FreeNoLog(mp->filename);
    FreeNoLog(mp->content_type);
    if (mp->body)
        free_nstr(&mp->body);
    Free(mp);
}
 
void n_http_multipart_free(LIST** parts) {
    if (parts && *parts)
        list_destroy(parts);
}
 
/* Within a header block, find the value of the named header (case-insensitive),
 * returning a pointer to the value start and its length (trailing CRLF trimmed). */
static const char* mp_header_value(const char* block, size_t blen, const char* name, size_t* vlen) {
    size_t nlen = strlen(name);
    size_t i = 0;
    *vlen = 0;
    while (i < blen) {
        size_t line_end = i;
        while (line_end < blen && block[line_end] != '\n')
            line_end++;
        /* line spans [i, line_end) (may include a trailing '\r') */
        if (line_end - i > nlen + 1 && strncasecmp(block + i, name, nlen) == 0 && block[i + nlen] == ':') {
            const char* v = block + i + nlen + 1;
            size_t vl = line_end - (i + nlen + 1);
            while (vl > 0 && (*v == ' ' || *v == '\t')) {
                v++;
                vl--;
            }
            while (vl > 0 && (v[vl - 1] == '\r' || v[vl - 1] == ' ' || v[vl - 1] == '\t'))
                vl--;
            *vlen = vl;
            return v;
        }
        i = line_end + 1;
    }
    return NULL;
}
 
/* Extract a quoted (or token) parameter value from a Content-Disposition value,
 * e.g. param "name" from `form-data; name="x"; filename="y"`. */
static char* mp_disp_param(const char* disp, size_t dlen, const char* param) {
    char key[32];
    size_t klen, i;
    snprintf(key, sizeof(key), "%s=", param);
    klen = strlen(key);
    for (i = 0; i + klen <= dlen; i++) {
        if (strncasecmp(disp + i, key, klen) == 0) {
            const char* v = disp + i + klen;
            size_t avail = dlen - (i + klen);
            size_t j = 0;
            if (avail > 0 && *v == '"') {
                v++;
                avail--;
                while (j < avail && v[j] != '"')
                    j++;
            } else {
                while (j < avail && v[j] != ';' && v[j] != ' ')
                    j++;
            }
            return mp_strndup(v, j);
        }
    }
    return NULL;
}
 
LIST* n_http_parse_multipart(const N_STR* body, const char* boundary) {
    char dash[256];
    char crlf_dash[260];
    const unsigned char* data;
    size_t len, dlen, cdlen, cursor;
    long first;
    LIST* parts;
 
    if (!body || !body->data || !boundary || !boundary[0])
        return NULL;
    if (strlen(boundary) + 2 >= sizeof(dash))
        return NULL;
    snprintf(dash, sizeof(dash), "--%s", boundary);
    snprintf(crlf_dash, sizeof(crlf_dash), "\r\n--%s", boundary);
    dlen = strlen(dash);
    cdlen = strlen(crlf_dash);
 
    parts = new_generic_list(0);
    if (!parts)
        return NULL;
 
    data = (const unsigned char*)body->data;
    len = body->written;
    first = mp_find(data, len, dash, dlen);
    if (first < 0)
        return parts; /* no boundary present: empty result */
    cursor = (size_t)first + dlen;
 
    for (;;) {
        long rel;
        size_t part_start, part_end;
        size_t hvl;
        N_HTTP_MULTIPART_PART* mp;
        /* closing delimiter "--boundary--" */
        if (cursor + 2 <= len && data[cursor] == '-' && data[cursor + 1] == '-')
            break;
        /* skip the CRLF that follows the delimiter */
        if (cursor + 2 <= len && data[cursor] == '\r' && data[cursor + 1] == '\n')
            cursor += 2;
        else if (cursor < len && data[cursor] == '\n')
            cursor += 1;
        part_start = cursor;
        rel = mp_find(data + part_start, len - part_start, crlf_dash, cdlen);
        if (rel < 0)
            break; /* malformed: no closing delimiter */
        part_end = part_start + (size_t)rel;
 
        Malloc(mp, N_HTTP_MULTIPART_PART, 1);
        if (!mp)
            break;
        mp->name = NULL;
        mp->filename = NULL;
        mp->content_type = NULL;
        mp->body = NULL;
        /* split the part into its header block and body at the blank line */
        {
            long s = mp_find(data + part_start, part_end - part_start, "\r\n\r\n", 4);
            if (s >= 0) {
                size_t hlen = (size_t)s;
                size_t bbeg = part_start + (size_t)s + 4;
                const char* hblock = (const char*)(data + part_start);
                const char* hv = mp_header_value(hblock, hlen, "Content-Disposition", &hvl);
                if (hv) {
                    mp->name = mp_disp_param(hv, hvl, "name");
                    mp->filename = mp_disp_param(hv, hvl, "filename");
                }
                hv = mp_header_value(hblock, hlen, "Content-Type", &hvl);
                if (hv)
                    mp->content_type = mp_strndup(hv, hvl);
                {
                    size_t blen = part_end - bbeg;
                    mp->body = new_nstr(blen + 1);
                    if (mp->body) {
                        if (blen)
                            memcpy(mp->body->data, data + bbeg, blen);
                        mp->body->data[blen] = '\0';
                        mp->body->written = blen;
                    }
                }
            }
        }
        if (!mp->name)
            mp->name = mp_strndup("", 0);
        if (!mp->filename)
            mp->filename = mp_strndup("", 0);
        if (!mp->content_type)
            mp->content_type = mp_strndup("", 0);
        if (!mp->body)
            mp->body = new_nstr(1);
        list_push(parts, mp, mp_part_free);
 
        cursor = part_end + cdlen; /* skip "\r\n--boundary" to the next part/closing */
    }
    return parts;
}
 
/* Append n bytes to buf at *pos (sizing pass when buf == NULL). */
static void mp_put(char* buf, size_t* pos, const void* src, size_t n) {
    if (buf && n)
        memcpy(buf + *pos, src, n);
    *pos += n;
}
 
/* Append a NUL-terminated string (length via strlen). */
static void mp_puts(char* buf, size_t* pos, const char* s) {
    if (s)
        mp_put(buf, pos, s, strlen(s));
}
 
/* Emit the full multipart body into buf (or size it when buf == NULL). */
static void mp_emit(char* buf, size_t* pos, LIST* parts, const char* dash) {
    list_foreach(node, parts) {
        const N_HTTP_MULTIPART_PART* mp = (const N_HTTP_MULTIPART_PART*)node->ptr;
        if (!mp)
            continue;
        mp_puts(buf, pos, dash);
        mp_puts(buf, pos, "\r\nContent-Disposition: form-data; name=\"");
        mp_puts(buf, pos, mp->name ? mp->name : "");
        mp_puts(buf, pos, "\"");
        if (mp->filename && mp->filename[0]) {
            mp_puts(buf, pos, "; filename=\"");
            mp_puts(buf, pos, mp->filename);
            mp_puts(buf, pos, "\"");
        }
        mp_puts(buf, pos, "\r\n");
        if (mp->content_type && mp->content_type[0]) {
            mp_puts(buf, pos, "Content-Type: ");
            mp_puts(buf, pos, mp->content_type);
            mp_puts(buf, pos, "\r\n");
        }
        mp_puts(buf, pos, "\r\n");
        if (mp->body && mp->body->written)
            mp_put(buf, pos, mp->body->data, mp->body->written);
        mp_puts(buf, pos, "\r\n");
    }
    mp_puts(buf, pos, dash);
    mp_puts(buf, pos, "--\r\n");
}
 
N_STR* n_http_build_multipart(LIST* parts, const char* boundary) {
    char dash[256];
    size_t total = 0;
    char* buf;
    N_STR* out = NULL;
    if (!parts || !boundary || !boundary[0])
        return NULL;
    if (strlen(boundary) + 2 >= sizeof(dash))
        return NULL;
    snprintf(dash, sizeof(dash), "--%s", boundary);
 
    mp_emit(NULL, &total, parts, dash); /* sizing pass */
    Malloc(buf, char, total + 1);
    if (!buf)
        return NULL;
    total = 0;
    mp_emit(buf, &total, parts, dash); /* fill pass */
    buf[total] = '\0';
    char_to_nstr_ex(buf, (NSTRBYTE)total, &out);
    free(buf);
    return out;
}
 
int netw_get_http_date(char* buffer, size_t buffer_size) {
    __n_assert(buffer, return FALSE);
    const time_t now = time(NULL);
    struct tm gmt;
#ifdef _WIN32
    if (gmtime_s(&gmt, &now) != 0) {
        n_log(LOG_ERR, "gmtime_s failed");
        return FALSE;
    }
#else
    if (!gmtime_r(&now, &gmt)) {
        n_log(LOG_ERR, "gmtime_r returned NULL");
        return FALSE;
    }
#endif
    if (strftime(buffer, buffer_size, "%a, %d %b %Y %H:%M:%S GMT", &gmt) == 0) {
        n_log(LOG_ERR, "strftime failed: buffer too small");
        return FALSE;
    }
    return TRUE;
}
 
int netw_build_http_response(N_STR** http_response, int status_code, const char* server_name, const char* content_type, char* additional_headers, N_STR* body) {
    __n_assert(server_name, return FALSE);
    __n_assert(content_type, return FALSE);
    __n_assert(additional_headers, return FALSE);
 
    const char* status_message = netw_get_http_status_message(status_code);
    const char* connection_type = "close";
 
    // Buffer for the date header
    char date_buffer[128] = "";
    netw_get_http_date(date_buffer, sizeof(date_buffer));
 
    if ((*http_response)) {
        (*http_response)->written = 0;
    }
 
    if (!body || body->written == 0) {
        // Handle the case where there is no body
        nstrprintf((*http_response),
                   "HTTP/1.1 %d %s\r\n"
                   "Date: %s\r\n"
                   "Server: %s\r\n"
                   "Content-Length: 0\r\n"
                   "%s"
                   "Connection: %s\r\n\r\n",
                   status_code, status_message, date_buffer, server_name, additional_headers, connection_type);
        n_log(LOG_DEBUG, "empty response");
    } else {
        // Build the response with body
        nstrprintf((*http_response),
                   "HTTP/1.1 %d %s\r\n"
                   "Date: %s\r\n"
                   "Server: %s\r\n"
                   "Content-Type: %s\r\n"
                   "Content-Length: %zu\r\n"
                   "%s"
                   "Connection: %s\r\n\r\n",
                   status_code, status_message, date_buffer, server_name, content_type, body->written, additional_headers, connection_type);
        nstrcat((*http_response), body);
        n_log(LOG_DEBUG, "body response");
    }
    return TRUE;
}
 
#ifdef HAVE_OPENSSL
 
static ssize_t _ws_write(N_WS_CONN* conn, const void* buf, size_t len) {
    __n_assert(conn, return -1);
    __n_assert(conn->netw, return -1);
    if (conn->netw->crypto_algo == NETW_ENCRYPT_OPENSSL && conn->netw->ssl) {
        int ret = SSL_write(conn->netw->ssl, buf, (int)len);
        return (ret > 0) ? (ssize_t)ret : -1;
    }
    ssize_t ret = send(conn->netw->link.sock, buf, NETW_BUFLEN_CAST(len), NETFLAGS);
    return ret;
}
 
static ssize_t _ws_read(N_WS_CONN* conn, void* buf, size_t len) {
    __n_assert(conn, return -1);
    __n_assert(conn->netw, return -1);
    size_t total = 0;
    char* p = (char*)buf;
    while (total < len) {
        ssize_t ret = 0;
        if (conn->netw->crypto_algo == NETW_ENCRYPT_OPENSSL && conn->netw->ssl) {
            ret = SSL_read(conn->netw->ssl, p + total, (int)(len - total));
        } else {
            ret = recv(conn->netw->link.sock, p + total, NETW_BUFLEN_CAST(len - total), 0);
        }
        if (ret <= 0) {
            return -1;
        }
        total += (size_t)ret;
    }
    return (ssize_t)total;
}
 
N_WS_CONN* n_ws_connect(const char* host, const char* port, const char* path, int use_ssl) {
    __n_assert(host, return NULL);
    __n_assert(port, return NULL);
    __n_assert(path, return NULL);
 
    N_WS_CONN* conn = NULL;
    Malloc(conn, N_WS_CONN, 1);
    __n_assert(conn, return NULL);
 
    conn->netw = NULL;
    conn->connected = 0;
    conn->host = strdup(host);
    conn->path = strdup(path);
    if (!conn->host || !conn->path) {
        n_log(LOG_ERR, "n_ws_connect: strdup failed");
        goto ws_connect_fail;
    }
 
    /* establish TCP + optional SSL */
    if (use_ssl) {
        if (netw_ssl_connect_client(&conn->netw, (char*)host, (char*)port, NETWORK_IPALL) == FALSE) {
            n_log(LOG_ERR, "n_ws_connect: TCP+SSL context setup failed for %s:%s", host, port);
            goto ws_connect_fail;
        }
        if (netw_ssl_do_handshake(conn->netw, host) == FALSE) {
            _netw_capture_error(conn->netw, "n_ws_connect: SSL handshake failed for %s:%s", host, port);
            n_log(LOG_ERR, "n_ws_connect: SSL handshake failed for %s:%s", host, port);
            goto ws_connect_fail;
        }
    } else {
        if (netw_connect(&conn->netw, (char*)host, (char*)port, NETWORK_IPALL) == FALSE) {
            n_log(LOG_ERR, "n_ws_connect: TCP connect failed for %s:%s", host, port);
            goto ws_connect_fail;
        }
    }
 
    /* generate Sec-WebSocket-Key: base64 of 16 random bytes */
    unsigned char rand_bytes[16];
    if (RAND_bytes(rand_bytes, 16) != 1) {
        _netw_capture_error(conn->netw, "n_ws_connect: RAND_bytes failed");
        n_log(LOG_ERR, "n_ws_connect: RAND_bytes failed");
        goto ws_connect_fail;
    }
 
    N_STR* rand_nstr = new_nstr(16);
    __n_assert(rand_nstr, goto ws_connect_fail);
    memcpy(rand_nstr->data, rand_bytes, 16);
    rand_nstr->written = 16;
 
    N_STR* ws_key_nstr = n_base64_encode(rand_nstr);
    free_nstr(&rand_nstr);
    __n_assert(ws_key_nstr, goto ws_connect_fail);
    /* strip any trailing whitespace from base64 output */
    while (ws_key_nstr->written > 0 &&
           (ws_key_nstr->data[ws_key_nstr->written - 1] == '\n' ||
            ws_key_nstr->data[ws_key_nstr->written - 1] == '\r' ||
            ws_key_nstr->data[ws_key_nstr->written - 1] == ' ')) {
        ws_key_nstr->data[--ws_key_nstr->written] = '\0';
    }
 
    /* build HTTP upgrade request */
    char upgrade_req[2048];
    int req_len = snprintf(upgrade_req, sizeof(upgrade_req),
                           "GET %s HTTP/1.1\r\n"
                           "Host: %s\r\n"
                           "Upgrade: websocket\r\n"
                           "Connection: Upgrade\r\n"
                           "Sec-WebSocket-Key: %s\r\n"
                           "Sec-WebSocket-Version: 13\r\n"
                           "\r\n",
                           path, host, ws_key_nstr->data);
 
    if (req_len < 0 || (size_t)req_len >= sizeof(upgrade_req)) {
        _netw_capture_error(conn->netw, "n_ws_connect: upgrade request too large");
        n_log(LOG_ERR, "n_ws_connect: upgrade request too large");
        free_nstr(&ws_key_nstr);
        goto ws_connect_fail;
    }
 
    /* send upgrade request */
    if (_ws_write(conn, upgrade_req, (size_t)req_len) < 0) {
        _netw_capture_error(conn->netw, "n_ws_connect: failed to send upgrade request");
        n_log(LOG_ERR, "n_ws_connect: failed to send upgrade request");
        free_nstr(&ws_key_nstr);
        goto ws_connect_fail;
    }
 
    /* read response (up to 4096 bytes, look for \r\n\r\n) */
    char resp_buf[4096];
    memset(resp_buf, 0, sizeof(resp_buf));
    size_t resp_len = 0;
    while (resp_len < sizeof(resp_buf) - 1) {
        ssize_t r = 0;
        if (conn->netw->crypto_algo == NETW_ENCRYPT_OPENSSL && conn->netw->ssl) {
            r = SSL_read(conn->netw->ssl, resp_buf + resp_len, 1);
        } else {
            r = recv(conn->netw->link.sock, resp_buf + resp_len, 1, 0);
        }
        if (r <= 0) {
            _netw_capture_error(conn->netw, "n_ws_connect: failed reading handshake response");
            n_log(LOG_ERR, "n_ws_connect: failed reading handshake response");
            free_nstr(&ws_key_nstr);
            goto ws_connect_fail;
        }
        resp_len += (size_t)r;
        if (resp_len >= 4 &&
            resp_buf[resp_len - 4] == '\r' && resp_buf[resp_len - 3] == '\n' &&
            resp_buf[resp_len - 2] == '\r' && resp_buf[resp_len - 1] == '\n') {
            break;
        }
    }
    resp_buf[resp_len] = '\0';
 
    /* verify 101 Switching Protocols */
    if (strstr(resp_buf, "101") == NULL) {
        _netw_capture_error(conn->netw, "n_ws_connect: server did not return 101: %.128s", resp_buf);
        n_log(LOG_ERR, "n_ws_connect: server did not return 101: %.128s", resp_buf);
        free_nstr(&ws_key_nstr);
        goto ws_connect_fail;
    }
 
    /* verify Sec-WebSocket-Accept */
    static const char ws_magic[] = "258EAFA5-E914-47DA-95CA-5AB5FE44F513";
    char concat_key[256];
    snprintf(concat_key, sizeof(concat_key), "%s%s", ws_key_nstr->data, ws_magic);
    n_log(LOG_DEBUG, "n_ws_connect: key sent: [%s] len:%zu", ws_key_nstr->data, ws_key_nstr->written);
    n_log(LOG_DEBUG, "n_ws_connect: concat_key: [%s]", concat_key);
    free_nstr(&ws_key_nstr);
 
    unsigned char sha1_hash[SHA_DIGEST_LENGTH];
    SHA1((const unsigned char*)concat_key, strlen(concat_key), sha1_hash);
 
    N_STR* sha1_nstr = new_nstr(SHA_DIGEST_LENGTH);
    __n_assert(sha1_nstr, goto ws_connect_fail);
    memcpy(sha1_nstr->data, sha1_hash, SHA_DIGEST_LENGTH);
    sha1_nstr->written = SHA_DIGEST_LENGTH;
 
    N_STR* expected_accept = n_base64_encode(sha1_nstr);
    free_nstr(&sha1_nstr);
    __n_assert(expected_accept, goto ws_connect_fail);
    /* strip trailing whitespace from base64 output */
    while (expected_accept->written > 0 &&
           (expected_accept->data[expected_accept->written - 1] == '\n' ||
            expected_accept->data[expected_accept->written - 1] == '\r' ||
            expected_accept->data[expected_accept->written - 1] == ' ')) {
        expected_accept->data[--expected_accept->written] = '\0';
    }
 
    /* find Sec-WebSocket-Accept in response (case-insensitive search) */
    const char* accept_hdr = NULL;
    char* search_pos = resp_buf;
    while (*search_pos) {
        if (strncasecmp(search_pos, "Sec-WebSocket-Accept:", 21) == 0) {
            accept_hdr = search_pos + 21;
            break;
        }
        search_pos++;
    }
    if (!accept_hdr) {
        _netw_capture_error(conn->netw, "n_ws_connect: no Sec-WebSocket-Accept header in response");
        n_log(LOG_ERR, "n_ws_connect: no Sec-WebSocket-Accept header in response");
        free_nstr(&expected_accept);
        goto ws_connect_fail;
    }
    /* skip whitespace */
    while (*accept_hdr == ' ') accept_hdr++;
    /* compare up to expected length; trim trailing \r\n from accept_hdr */
    char accept_val[128];
    {
        int ai = 0;
        while (ai < (int)sizeof(accept_val) - 1 && accept_hdr[ai] && accept_hdr[ai] != '\r' && accept_hdr[ai] != '\n') {
            accept_val[ai] = accept_hdr[ai];
            ai++;
        }
        accept_val[ai] = '\0';
    }
    if (strcmp(accept_val, expected_accept->data) != 0) {
        /* Many proxies (Fly.io, Cloudflare, etc.) re-key the handshake,
         * so the accept may not match. Log as debug, not error. */
        n_log(LOG_DEBUG, "n_ws_connect: Sec-WebSocket-Accept mismatch (proxy?): got [%s] expected [%s]",
              accept_val, expected_accept->data);
    }
    free_nstr(&expected_accept);
 
    conn->connected = 1;
    n_log(LOG_INFO, "n_ws_connect: WebSocket handshake completed with %s:%s%s", host, port, path);
    return conn;
 
ws_connect_fail:
    n_ws_conn_free(&conn);
    return NULL;
}
 
int n_ws_send(N_WS_CONN* conn, const char* payload, size_t len, int opcode) {
    __n_assert(conn, return -1);
    __n_assert(conn->netw, return -1);
 
    /* max frame overhead: 2 (header) + 8 (ext len) + 4 (mask) = 14 */
    size_t frame_max = 14 + len;
    unsigned char* frame = NULL;
    Malloc(frame, unsigned char, frame_max);
    __n_assert(frame, return -1);
 
    size_t pos = 0;
 
    /* byte 0: FIN + opcode */
    frame[pos++] = (unsigned char)(0x80 | (opcode & 0x0F));
 
    /* byte 1+: mask bit set + payload length */
    if (len <= 125) {
        frame[pos++] = (unsigned char)(0x80 | len);
    } else if (len <= 65535) {
        frame[pos++] = (unsigned char)(0x80 | 126);
        frame[pos++] = (unsigned char)((len >> 8) & 0xFF);
        frame[pos++] = (unsigned char)(len & 0xFF);
    } else {
        frame[pos++] = (unsigned char)(0x80 | 127);
        for (int i = 7; i >= 0; i--) {
            frame[pos++] = (unsigned char)((len >> (8 * i)) & 0xFF);
        }
    }
 
    /* masking key: 4 random bytes */
    unsigned char mask_key[4];
    if (RAND_bytes(mask_key, 4) != 1) {
        _netw_capture_error(conn->netw, "n_ws_send: RAND_bytes failed for mask key");
        n_log(LOG_ERR, "n_ws_send: RAND_bytes failed for mask key");
        FreeNoLog(frame);
        return -1;
    }
    memcpy(frame + pos, mask_key, 4);
    pos += 4;
 
    /* masked payload */
    if (payload && len > 0) {
        for (size_t i = 0; i < len; i++) {
            frame[pos + i] = (unsigned char)((unsigned char)payload[i] ^ mask_key[i % 4]);
        }
        pos += len;
    }
 
    ssize_t written = _ws_write(conn, frame, pos);
    FreeNoLog(frame);
    if (written < 0 || (size_t)written != pos) {
        _netw_capture_error(conn->netw, "n_ws_send: write failed (wrote %zd of %zu)", written, pos);
        n_log(LOG_ERR, "n_ws_send: write failed (wrote %zd of %zu)", written, pos);
        return -1;
    }
    return 0;
}
 
int n_ws_recv(N_WS_CONN* conn, N_WS_MESSAGE* msg_out) {
    __n_assert(conn, return -1);
    __n_assert(conn->netw, return -1);
    __n_assert(msg_out, return -1);
 
    memset(msg_out, 0, sizeof(*msg_out));
 
    /* read 2-byte header */
    unsigned char hdr[2];
    if (_ws_read(conn, hdr, 2) < 0) {
        return -1;
    }
 
    /* int fin = (hdr[0] >> 7) & 1; */
    int opcode = hdr[0] & 0x0F;
    int mask_bit = (hdr[1] >> 7) & 1;
    uint64_t payload_len = hdr[1] & 0x7F;
 
    /* extended payload length */
    if (payload_len == 126) {
        unsigned char ext[2];
        if (_ws_read(conn, ext, 2) < 0) return -1;
        payload_len = ((uint64_t)ext[0] << 8) | (uint64_t)ext[1];
    } else if (payload_len == 127) {
        unsigned char ext[8];
        if (_ws_read(conn, ext, 8) < 0) return -1;
        payload_len = 0;
        for (int i = 0; i < 8; i++) {
            payload_len = (payload_len << 8) | (uint64_t)ext[i];
        }
    }
 
    /* read masking key if present */
    unsigned char mask_key[4] = {0};
    if (mask_bit) {
        if (_ws_read(conn, mask_key, 4) < 0) return -1;
    }
 
    /* read payload */
    N_STR* payload = new_nstr((size_t)payload_len + 1);
    __n_assert(payload, return -1);
 
    if (payload_len > 0) {
        if (_ws_read(conn, payload->data, (size_t)payload_len) < 0) {
            free_nstr(&payload);
            return -1;
        }
        /* unmask if needed */
        if (mask_bit) {
            for (uint64_t i = 0; i < payload_len; i++) {
                payload->data[i] = (char)((unsigned char)payload->data[i] ^ mask_key[i % 4]);
            }
        }
    }
    payload->written = (size_t)payload_len;
    payload->data[payload_len] = '\0';
 
    msg_out->opcode = opcode;
    msg_out->payload = payload;
    msg_out->masked = mask_bit;
 
    return 0;
}
 
void n_ws_close(N_WS_CONN* conn) {
    __n_assert(conn, return);
 
    if (conn->connected && conn->netw) {
        /* send close frame with empty payload */
        n_ws_send(conn, NULL, 0, N_WS_OP_CLOSE);
 
        /* try to read close response with a short timeout */
        /* set non-blocking or just try one read */
        N_WS_MESSAGE msg;
        memset(&msg, 0, sizeof(msg));
        /* best effort: read one frame, ignore errors */
        if (n_ws_recv(conn, &msg) == 0) {
            free_nstr(&msg.payload);
        }
        conn->connected = 0;
    }
 
    if (conn->netw) {
        netw_close(&conn->netw);
    }
}
 
void n_ws_conn_free(N_WS_CONN** conn) {
    __n_assert(conn, return);
    __n_assert(*conn, return);
 
    N_WS_CONN* c = *conn;
 
    if (c->connected) {
        n_ws_close(c);
    }
 
    if (c->netw) {
        netw_close(&c->netw);
    }
 
    FreeNoLog(c->host);
    FreeNoLog(c->path);
    FreeNoLog(c);
    *conn = NULL;
}
 
void n_sse_event_clean(N_SSE_EVENT* event) {
    if (!event) return;
    if (event->event) free_nstr(&event->event);
    if (event->data) free_nstr(&event->data);
    if (event->id) free_nstr(&event->id);
    event->retry = 0;
}
 
void n_sse_stop(N_SSE_CONN* conn) {
    __n_assert(conn, return);
    __atomic_store_n(&conn->stop_flag, 1, __ATOMIC_RELEASE);
}
 
void n_sse_conn_free(N_SSE_CONN** conn) {
    __n_assert(conn, return);
    __n_assert(*conn, return);
 
    N_SSE_CONN* c = *conn;
    if (c->netw) {
        netw_close(&c->netw);
    }
    FreeNoLog(c);
    *conn = NULL;
}
 
static ssize_t _sse_read_byte(NETWORK* netw, char* ch, volatile int* stop_flag) {
    __n_assert(netw, return -1);
 
    /* poll with 500ms timeout so we can check stop_flag periodically */
    for (;;) {
        if (stop_flag && __atomic_load_n(stop_flag, __ATOMIC_ACQUIRE)) {
            return -1;
        }
        struct timeval tv;
        tv.tv_sec = 0;
        tv.tv_usec = 500000; /* 500ms */
        fd_set fds;
        FD_ZERO(&fds);
        FD_SET(netw->link.sock, &fds);
 
        /* For SSL: check if there's already buffered data */
        int ready = 0;
        if (netw->crypto_algo == NETW_ENCRYPT_OPENSSL && netw->ssl) {
            if (SSL_pending(netw->ssl) > 0) {
                ready = 1;
            }
        }
        if (!ready) {
            int sel = select((int)netw->link.sock + 1, &fds, NULL, NULL, &tv);
            if (sel < 0) return -1; /* error */
            if (sel == 0) continue; /* timeout, loop back to check stop_flag */
        }
 
        ssize_t ret = 0;
        if (netw->crypto_algo == NETW_ENCRYPT_OPENSSL && netw->ssl) {
            ret = SSL_read(netw->ssl, ch, 1);
        } else {
            ret = recv(netw->link.sock, ch, 1, 0);
        }
        return (ret == 1) ? 1 : -1;
    }
}
 
static ssize_t _sse_write(NETWORK* netw, const void* buf, size_t len) {
    __n_assert(netw, return -1);
    if (netw->crypto_algo == NETW_ENCRYPT_OPENSSL && netw->ssl) {
        int ret = SSL_write(netw->ssl, buf, (int)len);
        return (ret > 0) ? (ssize_t)ret : -1;
    }
    ssize_t ret = send(netw->link.sock, buf, NETW_BUFLEN_CAST(len), NETFLAGS);
    return ret;
}
 
N_SSE_CONN* n_sse_connect(const char* host, const char* port, const char* path, int use_ssl, const char* user_agent, void (*on_event)(N_SSE_EVENT*, N_SSE_CONN*, void*), void* user_data) {
    __n_assert(host, return NULL);
    __n_assert(port, return NULL);
    __n_assert(path, return NULL);
    __n_assert(on_event, return NULL);
 
    N_SSE_CONN* conn = NULL;
    Malloc(conn, N_SSE_CONN, 1);
    __n_assert(conn, return NULL);
 
    conn->netw = NULL;
    conn->stop_flag = 0;
    conn->on_event = on_event;
    conn->user_data = user_data;
 
    /* establish TCP + optional SSL */
    if (use_ssl) {
        if (netw_ssl_connect_client(&conn->netw, (char*)host, (char*)port, NETWORK_IPALL) == FALSE) {
            n_log(LOG_ERR, "n_sse_connect: TCP+SSL context setup failed for %s:%s", host, port);
            goto sse_connect_fail;
        }
        if (netw_ssl_do_handshake(conn->netw, host) == FALSE) {
            _netw_capture_error(conn->netw, "n_sse_connect: SSL handshake failed for %s:%s", host, port);
            n_log(LOG_ERR, "n_sse_connect: SSL handshake failed for %s:%s", host, port);
            goto sse_connect_fail;
        }
    } else {
        if (netw_connect(&conn->netw, (char*)host, (char*)port, NETWORK_IPALL) == FALSE) {
            n_log(LOG_ERR, "n_sse_connect: TCP connect failed for %s:%s", host, port);
            goto sse_connect_fail;
        }
    }
 
    /* send HTTP GET with SSE headers */
    char request[4096];
    int req_len;
    if (user_agent && user_agent[0]) {
        req_len = snprintf(request, sizeof(request),
                           "GET %s HTTP/1.1\r\n"
                           "Host: %s\r\n"
                           "Accept: text/event-stream\r\n"
                           "Cache-Control: no-cache\r\n"
                           "Connection: keep-alive\r\n"
                           "User-Agent: %s\r\n"
                           "\r\n",
                           path, host, user_agent);
    } else {
        req_len = snprintf(request, sizeof(request),
                           "GET %s HTTP/1.1\r\n"
                           "Host: %s\r\n"
                           "Accept: text/event-stream\r\n"
                           "Cache-Control: no-cache\r\n"
                           "Connection: keep-alive\r\n"
                           "\r\n",
                           path, host);
    }
 
    if (req_len < 0 || (size_t)req_len >= sizeof(request)) {
        _netw_capture_error(conn->netw, "n_sse_connect: request too large");
        n_log(LOG_ERR, "n_sse_connect: request too large");
        goto sse_connect_fail;
    }
 
    if (_sse_write(conn->netw, request, (size_t)req_len) < 0) {
        _netw_capture_error(conn->netw, "n_sse_connect: failed to send HTTP request");
        n_log(LOG_ERR, "n_sse_connect: failed to send HTTP request");
        goto sse_connect_fail;
    }
 
    /* read HTTP response headers (byte by byte until \r\n\r\n) */
    char resp_buf[8192];
    size_t resp_len = 0;
    while (resp_len < sizeof(resp_buf) - 1) {
        char ch = 0;
        if (_sse_read_byte(conn->netw, &ch, NULL) < 0) {
            _netw_capture_error(conn->netw, "n_sse_connect: failed reading HTTP response");
            n_log(LOG_ERR, "n_sse_connect: failed reading HTTP response");
            goto sse_connect_fail;
        }
        resp_buf[resp_len++] = ch;
        if (resp_len >= 4 &&
            resp_buf[resp_len - 4] == '\r' && resp_buf[resp_len - 3] == '\n' &&
            resp_buf[resp_len - 2] == '\r' && resp_buf[resp_len - 1] == '\n') {
            break;
        }
    }
    resp_buf[resp_len] = '\0';
 
    /* verify HTTP 200 status */
    if (strstr(resp_buf, "200") == NULL) {
        _netw_capture_error(conn->netw, "n_sse_connect: server did not return 200: %.128s", resp_buf);
        n_log(LOG_ERR, "n_sse_connect: server did not return 200: %.128s", resp_buf);
        goto sse_connect_fail;
    }
 
    n_log(LOG_INFO, "n_sse_connect: SSE connected to %s:%s%s", host, port, path);
 
    /* enter SSE read loop */
    {
        N_SSE_EVENT current;
        memset(&current, 0, sizeof(current));
 
        /* line buffer for SSE parsing */
        char line[8192];
        size_t line_len = 0;
 
        while (!__atomic_load_n(&conn->stop_flag, __ATOMIC_ACQUIRE)) {
            char ch = 0;
            if (_sse_read_byte(conn->netw, &ch, &conn->stop_flag) < 0) {
                n_log(LOG_DEBUG, "n_sse_connect: connection closed or read error");
                break;
            }
 
            if (ch == '\n') {
                /* terminate line (strip trailing \r) */
                if (line_len > 0 && line[line_len - 1] == '\r') {
                    line_len--;
                }
                line[line_len] = '\0';
 
                if (line_len == 0) {
                    /* empty line = dispatch event if we have data */
                    if (current.data) {
                        conn->on_event(&current, conn, conn->user_data);
                        n_sse_event_clean(&current);
                        memset(&current, 0, sizeof(current));
                    }
                } else if (line[0] == ':') {
                    /* comment line, ignore */
                    n_log(LOG_DEBUG, "n_sse_connect: comment: %s", line + 1);
                } else {
                    /* parse field:value */
                    char* colon = strchr(line, ':');
                    const char* field = line;
                    const char* value = "";
                    if (colon) {
                        *colon = '\0';
                        value = colon + 1;
                        /* skip single leading space after colon */
                        if (*value == ' ') value++;
                    }
 
                    if (strcmp(field, "data") == 0) {
                        if (current.data) {
                            /* append newline + value to existing data */
                            nstrprintf_cat(current.data, "\n%s", value);
                        } else {
                            current.data = char_to_nstr((char*)value);
                        }
                    } else if (strcmp(field, "event") == 0) {
                        if (current.event) free_nstr(&current.event);
                        current.event = char_to_nstr((char*)value);
                    } else if (strcmp(field, "id") == 0) {
                        if (current.id) free_nstr(&current.id);
                        current.id = char_to_nstr((char*)value);
                    } else if (strcmp(field, "retry") == 0) {
                        current.retry = atoi(value);
                    }
                }
 
                line_len = 0;
            } else {
                if (line_len < sizeof(line) - 1) {
                    line[line_len++] = ch;
                }
            }
        }
 
        /* clean up any partial event */
        n_sse_event_clean(&current);
    }
 
    return conn;
 
sse_connect_fail:
    n_sse_conn_free(&conn);
    return NULL;
}
 
#endif /* HAVE_OPENSSL */
 
#define N_WS_FRAME_MAX_PAYLOAD (16U * 1024U * 1024U)
 
int n_ws_frame_parse(const unsigned char* buf, size_t len, N_WS_FRAME* frame, size_t* consumed) {
    size_t hdr = 2;
    uint64_t plen;
    int len7;
    if (!buf || !frame || !consumed)
        return -1;
    if (len < 2)
        return 0;
    frame->fin = (buf[0] & 0x80) ? 1 : 0;
    frame->rsv = (buf[0] >> 4) & 0x07;
    frame->opcode = buf[0] & 0x0F;
    frame->masked = (buf[1] & 0x80) ? 1 : 0;
    len7 = buf[1] & 0x7F;
    if (len7 < 126) {
        plen = (uint64_t)len7;
    } else if (len7 == 126) {
        if (len < 4)
            return 0;
        plen = ((uint64_t)buf[2] << 8) | (uint64_t)buf[3];
        hdr = 4;
    } else {
        int i;
        if (len < 10)
            return 0;
        plen = 0;
        for (i = 0; i < 8; i++)
            plen = (plen << 8) | (uint64_t)buf[2 + i];
        hdr = 10;
    }
    if (plen > N_WS_FRAME_MAX_PAYLOAD)
        return -1;
    if (frame->masked) {
        if (len < hdr + 4)
            return 0;
        memcpy(frame->mask, buf + hdr, 4);
        hdr += 4;
    } else {
        memset(frame->mask, 0, 4);
    }
    if (len < hdr + plen)
        return 0;
    frame->payload_len = plen;
    frame->payload = buf + hdr;
    *consumed = hdr + (size_t)plen;
    return 1;
}
 
void n_ws_unmask(unsigned char* dst, const unsigned char* src, size_t len, const unsigned char mask[4]) {
    size_t i;
    if (!dst || !src || !mask)
        return;
    for (i = 0; i < len; i++)
        dst[i] = (unsigned char)(src[i] ^ mask[i & 3]);
}
 
size_t n_ws_frame_build(int fin, int opcode, int do_mask, const unsigned char* payload, size_t len, const unsigned char mask_key[4], unsigned char* out, size_t out_cap) {
    size_t pos = 0;
    unsigned char b1 = (unsigned char)(do_mask ? 0x80 : 0);
    if (!out || out_cap < 2)
        return 0;
    out[pos++] = (unsigned char)((fin ? 0x80 : 0) | (opcode & 0x0F));
    if (len <= 125) {
        out[pos++] = (unsigned char)(b1 | (unsigned char)len);
    } else if (len <= 65535) {
        if (out_cap < pos + 3)
            return 0;
        out[pos++] = (unsigned char)(b1 | 126);
        out[pos++] = (unsigned char)((len >> 8) & 0xFF);
        out[pos++] = (unsigned char)(len & 0xFF);
    } else {
        int i;
        if (out_cap < pos + 9)
            return 0;
        out[pos++] = (unsigned char)(b1 | 127);
        for (i = 7; i >= 0; i--)
            out[pos++] = (unsigned char)((len >> (8 * i)) & 0xFF);
    }
    if (do_mask) {
        if (!mask_key || out_cap < pos + 4)
            return 0;
        memcpy(out + pos, mask_key, 4);
        pos += 4;
    }
    if (out_cap < pos + len)
        return 0;
    if (do_mask && mask_key) {
        size_t i;
        for (i = 0; i < len; i++)
            out[pos + i] = (unsigned char)((payload ? payload[i] : 0) ^ mask_key[i & 3]);
    } else if (payload && len > 0) {
        memcpy(out + pos, payload, len);
    }
    pos += len;
    return pos;
}
 
static void _n_mock_parse_request(const char* buf, N_HTTP_REQUEST* req) {
    if (!buf || !req) return;
 
    /* parse request line: METHOD PATH?QUERY HTTP/1.x */
    const char* line_end = strstr(buf, "\r\n");
    if (!line_end) line_end = strchr(buf, '\n');
    if (!line_end) return;
 
    size_t line_len = (size_t)(line_end - buf);
    char line[4096];
    if (line_len >= sizeof(line)) line_len = sizeof(line) - 1;
    memcpy(line, buf, line_len);
    line[line_len] = '\0';
 
    /* method */
    char* sp1 = strchr(line, ' ');
    if (!sp1) return;
    size_t mlen = (size_t)(sp1 - line);
    if (mlen >= sizeof(req->method)) mlen = sizeof(req->method) - 1;
    memcpy(req->method, line, mlen);
    req->method[mlen] = '\0';
 
    /* path and query */
    sp1++;
    char* sp2 = strchr(sp1, ' ');
    if (sp2) *sp2 = '\0';
    char* qmark = strchr(sp1, '?');
    if (qmark) {
        *qmark = '\0';
        strncpy(req->query, qmark + 1, sizeof(req->query) - 1);
        req->query[sizeof(req->query) - 1] = '\0';
    }
    strncpy(req->path, sp1, sizeof(req->path) - 1);
    req->path[sizeof(req->path) - 1] = '\0';
 
    /* headers: skip past request line */
    const char* hdr_start = line_end;
    if (*hdr_start == '\r') hdr_start++;
    if (*hdr_start == '\n') hdr_start++;
 
    req->headers = new_generic_list(0);
 
    const char* body_start = NULL;
    while (hdr_start && *hdr_start) {
        const char* next = strstr(hdr_start, "\r\n");
        if (!next) next = strchr(hdr_start, '\n');
        if (!next) break;
 
        size_t hlen = (size_t)(next - hdr_start);
        if (hlen == 0) {
            /* blank line = end of headers */
            body_start = next;
            if (*body_start == '\r') body_start++;
            if (*body_start == '\n') body_start++;
            break;
        }
 
        char* header_line = strndup(hdr_start, hlen);
        if (header_line) {
            list_push(req->headers, header_line, free);
        }
 
        hdr_start = next;
        if (*hdr_start == '\r') hdr_start++;
        if (*hdr_start == '\n') hdr_start++;
    }
 
    /* body */
    if (body_start && *body_start) {
        req->body = char_to_nstr(body_start);
    }
}
 
static void _n_mock_request_clean(N_HTTP_REQUEST* req) {
    if (!req) return;
    if (req->headers) list_destroy(&req->headers);
    if (req->body) free_nstr(&req->body);
}
 
N_MOCK_SERVER* n_mock_server_start(int port,
                                   void (*on_request)(N_HTTP_REQUEST*, N_HTTP_RESPONSE*, void*),
                                   void* user_data) {
    __n_assert(on_request, return NULL);
 
    N_MOCK_SERVER* server = NULL;
    Malloc(server, N_MOCK_SERVER, 1);
    __n_assert(server, return NULL);
    memset(server, 0, sizeof(*server));
 
    server->on_request = on_request;
    server->user_data = user_data;
    server->port = port;
    server->stop_flag = 0;
 
    char port_str[16];
    snprintf(port_str, sizeof(port_str), "%d", port);
 
    NETWORK* listener = NULL;
    if (netw_make_listening(&listener, NULL, port_str, 5, NETWORK_IPALL) != TRUE) {
        n_log(LOG_ERR, "n_mock_server_start: failed to listen on port %d", port);
        FreeNoLog(server);
        return NULL;
    }
    server->listener = listener;
 
    n_log(LOG_INFO, "mock server listening on port %d", port);
    return server;
}
 
void n_mock_server_run(N_MOCK_SERVER* server) {
    __n_assert(server, return);
    __n_assert(server->listener, return);
 
    while (!__atomic_load_n(&server->stop_flag, __ATOMIC_ACQUIRE)) {
        /* Use select with timeout to avoid blocking forever */
        fd_set readfds;
        FD_ZERO(&readfds);
        FD_SET(server->listener->link.sock, &readfds);
        struct timeval tv;
        tv.tv_sec = 0;
        tv.tv_usec = 200000; /* 200ms */
        int sel = select((int)(server->listener->link.sock + 1), &readfds, NULL, NULL, &tv);
        if (sel <= 0) continue;
 
        /* Accept connection using netw_accept_from_ex with 1000ms timeout */
        int ret = 0;
        NETWORK* client = netw_accept_from_ex(server->listener, 0, 0, 1000, &ret);
        if (!client) continue;
 
        /* Read HTTP request */
        char buf[8192];
        ssize_t n = recv(client->link.sock, buf, sizeof(buf) - 1, 0);
        if (n <= 0) {
            netw_close(&client);
            continue;
        }
        buf[n] = '\0';
 
        /* Parse request */
        N_HTTP_REQUEST req;
        memset(&req, 0, sizeof(req));
        _n_mock_parse_request(buf, &req);
 
        /* Prepare default response */
        N_HTTP_RESPONSE resp;
        memset(&resp, 0, sizeof(resp));
        resp.status_code = 404;
        strncpy(resp.content_type, "text/plain", sizeof(resp.content_type) - 1);
 
        /* Call handler */
        server->on_request(&req, &resp, server->user_data);
 
        /* Build HTTP response */
        const char* status_msg = netw_get_http_status_message(resp.status_code);
        if (!status_msg) status_msg = "Unknown";
 
        size_t body_len = 0;
        const char* body_data = "";
        if (resp.body && resp.body->data) {
            body_data = resp.body->data;
            body_len = resp.body->written;
        }
 
        char header_buf[1024];
        int hlen = snprintf(header_buf, sizeof(header_buf),
                            "HTTP/1.1 %d %s\r\n"
                            "Content-Type: %s\r\n"
                            "Content-Length: %zu\r\n"
                            "Connection: close\r\n"
                            "\r\n",
                            resp.status_code, status_msg,
                            resp.content_type,
                            body_len);
 
        if (hlen > 0) {
            send(client->link.sock, header_buf, NETW_BUFLEN_CAST(hlen), NETFLAGS);
        }
        if (body_len > 0) {
            send(client->link.sock, body_data, NETW_BUFLEN_CAST(body_len), NETFLAGS);
        }
 
        /* Cleanup */
        if (resp.body) free_nstr(&resp.body);
        _n_mock_request_clean(&req);
        netw_close(&client);
    }
 
    n_log(LOG_INFO, "mock server stopped");
}
 
void n_mock_server_stop(N_MOCK_SERVER* server) {
    __n_assert(server, return);
    __atomic_store_n(&server->stop_flag, 1, __ATOMIC_RELEASE);
}
 
void n_mock_server_free(N_MOCK_SERVER** server) {
    __n_assert(server && *server, return);
    if ((*server)->listener) {
        netw_close(&(*server)->listener);
    }
    FreeNoLog(*server);
    *server = NULL;
}
 
static void _n_parse_query_params(N_URL* u, const char* qs) {
    if (!u || !qs || !qs[0]) return;
    char* buf = strdup(qs);
    if (!buf) return;
    char* saveptr = NULL;
    const char* tok = strtok_r(buf, "&", &saveptr);
    while (tok && u->nb_params < N_URL_MAX_PARAMS) {
        char* eq = strchr(tok, '=');
        if (eq) {
            *eq = '\0';
            u->params[u->nb_params].key = strdup(tok);
            u->params[u->nb_params].value = strdup(eq + 1);
        } else {
            u->params[u->nb_params].key = strdup(tok);
            u->params[u->nb_params].value = strdup("");
        }
        u->nb_params++;
        tok = strtok_r(NULL, "&", &saveptr);
    }
    free(buf);
}
 
N_URL* n_url_parse(const char* url) {
    if (!url) return NULL;
    N_URL* u = NULL;
    Malloc(u, N_URL, 1);
    if (!u) return NULL;
    memset(u, 0, sizeof(*u));
    const char* p = url;
    const char* scheme_end = strstr(p, "://");
    if (scheme_end) {
        u->scheme = strndup(p, (size_t)(scheme_end - p));
        p = scheme_end + 3;
    } else {
        u->scheme = strdup("http");
    }
    const char* host_end = p;
    while (*host_end && *host_end != '/' && *host_end != '?' && *host_end != ':') host_end++;
    u->host = strndup(p, (size_t)(host_end - p));
    p = host_end;
    if (*p == ':') {
        p++;
        u->port = atoi(p);
        while (*p && *p != '/' && *p != '?') p++;
    }
    if (*p == '/') {
        const char* pe = p;
        while (*pe && *pe != '?') pe++;
        u->path = strndup(p, (size_t)(pe - p));
        p = pe;
    } else {
        u->path = strdup("/");
    }
    if (*p == '?') {
        p++;
        u->query = strdup(p);
        _n_parse_query_params(u, p);
    }
    return u;
}
 
N_STR* n_url_build(const N_URL* u) {
    if (!u) return NULL;
    N_STR* result = new_nstr(512);
    if (!result) return NULL;
    nstrprintf(result, "%s://%s", u->scheme ? u->scheme : "http", u->host ? u->host : "localhost");
    if (u->port > 0) {
        int dp = (u->scheme && strcmp(u->scheme, "https") == 0) ? 443 : 80;
        if (u->port != dp) nstrprintf_cat(result, ":%d", u->port);
    }
    nstrprintf_cat(result, "%s", u->path ? u->path : "/");
    if (u->query && u->query[0]) nstrprintf_cat(result, "?%s", u->query);
    return result;
}
 
static void _n_url_normalize_path(const char* path, char* out, size_t outsz) {
    const char* seg_starts[256];
    size_t seg_lens[256];
    int nb = 0;
    const char* p = (path && path[0]) ? path : "/";
    size_t pos = 0;
    int i;
    /* split on '/', applying the dot-segment rules */
    while (*p) {
        const char* slash;
        size_t slen;
        if (*p == '/') {
            p++;
            continue;
        }
        slash = strchr(p, '/');
        slen = slash ? (size_t)(slash - p) : strlen(p);
        if (slen == 1 && p[0] == '.') {
            /* skip "." */
        } else if (slen == 2 && p[0] == '.' && p[1] == '.') {
            if (nb > 0) nb--; /* pop one segment */
        } else if (nb < 256) {
            seg_starts[nb] = p;
            seg_lens[nb] = slen;
            nb++;
        }
        p += slen;
    }
    /* rebuild with a leading slash */
    if (outsz == 0) return;
    out[pos++] = '/';
    for (i = 0; i < nb && pos < outsz - 1; i++) {
        size_t k;
        if (i > 0 && pos < outsz - 1) out[pos++] = '/';
        for (k = 0; k < seg_lens[i] && pos < outsz - 1; k++)
            out[pos++] = seg_starts[i][k];
    }
    /* preserve a trailing slash from the original (it can be significant) */
    if (path && path[0] && path[strlen(path) - 1] == '/' && pos < outsz - 1 && (nb > 0))
        out[pos++] = '/';
    out[pos] = '\0';
}
 
N_STR* n_url_canonicalize(const N_URL* u) {
    N_STR* result = NULL;
    char scheme[16];
    char host[256];
    char path[2048];
    size_t i;
    if (!u) return NULL;
    snprintf(scheme, sizeof(scheme), "%s", u->scheme ? u->scheme : "http");
    snprintf(host, sizeof(host), "%s", u->host ? u->host : "");
    for (i = 0; scheme[i]; i++) scheme[i] = (char)tolower((unsigned char)scheme[i]);
    for (i = 0; host[i]; i++) host[i] = (char)tolower((unsigned char)host[i]);
    _n_url_normalize_path(u->path, path, sizeof(path));
    result = new_nstr(2560);
    if (!result) return NULL;
    nstrprintf(result, "%s://%s", scheme, host);
    if (u->port > 0) {
        int dp = (strcmp(scheme, "https") == 0) ? 443 : 80;
        if (u->port != dp) nstrprintf_cat(result, ":%d", u->port);
    }
    nstrprintf_cat(result, "%s", path);
    if (u->query && u->query[0]) nstrprintf_cat(result, "?%s", u->query);
    return result;
}
 
N_STR* n_url_canonicalize_string(const char* url) {
    N_URL* u = n_url_parse(url);
    N_STR* out;
    if (!u) return NULL;
    out = n_url_canonicalize(u);
    n_url_free(&u);
    return out;
}
 
static int _n_url_has_scheme(const char* s) {
    if (!s || !isalpha((unsigned char)s[0])) return 0;
    size_t i = 1;
    while (s[i] && (isalnum((unsigned char)s[i]) || s[i] == '+' || s[i] == '-' || s[i] == '.')) i++;
    return s[i] == ':';
}
 
N_STR* n_url_resolve(const char* base, const char* ref) {
    if (!base) return NULL;
 
    /* fragment-stripped working copy of the reference */
    char* refbuf = strdup(ref ? ref : "");
    if (!refbuf) return NULL;
    char* frag = strchr(refbuf, '#');
    if (frag) *frag = '\0';
 
    /* absolute reference: it carries its own scheme, return it verbatim */
    if (_n_url_has_scheme(refbuf)) {
        N_STR* out = new_nstr(strlen(refbuf) + 1);
        if (out) nstrprintf(out, "%s", refbuf);
        free(refbuf);
        return out;
    }
 
    N_URL* b = n_url_parse(base);
    if (!b) {
        free(refbuf);
        return NULL;
    }
 
    /* split the reference into its path and query parts at the first '?' */
    char* refq = strchr(refbuf, '?');
    const char* ref_query = NULL;
    if (refq) {
        *refq = '\0';
        ref_query = refq + 1;
    }
 
    /* base authority = host plus a non-elided port */
    char authority[300];
    if (b->port > 0)
        snprintf(authority, sizeof(authority), "%s:%d", b->host ? b->host : "", b->port);
    else
        snprintf(authority, sizeof(authority), "%s", b->host ? b->host : "");
 
    char rawpath[4096];
    const char* t_scheme = b->scheme ? b->scheme : "http";
    const char* t_query = NULL;
 
    if (refbuf[0] == '\0') {
        /* empty path: same resource; keep the base query unless one was given */
        snprintf(rawpath, sizeof(rawpath), "%s", b->path ? b->path : "/");
        t_query = refq ? ref_query : b->query;
    } else if (refbuf[0] == '/' && refbuf[1] == '/') {
        /* scheme-relative: base scheme, new authority + path from the reference */
        const char* a = refbuf + 2;
        const char* slash = strchr(a, '/');
        if (slash) {
            snprintf(authority, sizeof(authority), "%.*s", (int)(slash - a), a);
            snprintf(rawpath, sizeof(rawpath), "%s", slash);
        } else {
            snprintf(authority, sizeof(authority), "%s", a);
            snprintf(rawpath, sizeof(rawpath), "/");
        }
        t_query = ref_query;
    } else if (refbuf[0] == '/') {
        /* absolute-path reference */
        snprintf(rawpath, sizeof(rawpath), "%s", refbuf);
        t_query = ref_query;
    } else {
        /* relative-path reference: merge against the base path */
        const char* bp = (b->path && b->path[0]) ? b->path : "/";
        const char* lastslash = strrchr(bp, '/');
        size_t prefixlen = lastslash ? (size_t)(lastslash - bp) + 1 : 0;
        snprintf(rawpath, sizeof(rawpath), "%.*s%s", (int)prefixlen, bp, refbuf);
        t_query = ref_query;
    }
 
    char normpath[4096];
    _n_url_normalize_path(rawpath, normpath, sizeof(normpath));
 
    N_STR* out = new_nstr(strlen(authority) + sizeof(normpath) + 32);
    if (out) {
        nstrprintf(out, "%s://%s%s", t_scheme, authority, normpath);
        if (t_query && t_query[0]) nstrprintf_cat(out, "?%s", t_query);
    }
    n_url_free(&b);
    free(refbuf);
    return out;
}
 
N_STR* n_url_encode(const char* str) {
    return n_str_url_encode(str);
}
 
N_STR* n_url_decode(const char* str) {
    if (!str) return NULL;
    size_t len = strlen(str);
    N_STR* result = new_nstr(len + 1);
    if (!result) return NULL;
    for (size_t i = 0; i < len; i++) {
        if (str[i] == '%' && i + 2 < len && isxdigit((unsigned char)str[i + 1]) && isxdigit((unsigned char)str[i + 2])) {
            const char hex[3] = {str[i + 1], str[i + 2], '\0'};
            unsigned int val = 0;
            sscanf(hex, "%x", &val);
            nstrprintf_cat(result, "%c", (char)val);
            i += 2;
        } else if (str[i] == '+') {
            nstrprintf_cat(result, " ");
        } else {
            nstrprintf_cat(result, "%c", str[i]);
        }
    }
    return result;
}
 
void n_url_free(N_URL** u) {
    if (!u || !*u) return;
    N_URL* p = *u;
    FreeNoLog(p->scheme);
    FreeNoLog(p->host);
    FreeNoLog(p->path);
    FreeNoLog(p->query);
    for (int i = 0; i < p->nb_params; i++) {
        FreeNoLog(p->params[i].key);
        FreeNoLog(p->params[i].value);
    }
    FreeNoLog(p);
    *u = NULL;
}
 
static SOCKET _proxy_tcp_connect(const char* host, int port) {
    char port_str[16];
    snprintf(port_str, sizeof(port_str), "%d", port);
 
    struct addrinfo hints;
    memset(&hints, 0, sizeof(hints));
    hints.ai_family = AF_UNSPEC;
    hints.ai_socktype = SOCK_STREAM;
 
    struct addrinfo* res = NULL;
    int gai_rc = getaddrinfo(host, port_str, &hints, &res);
    if (gai_rc != 0 || !res) {
        n_log(LOG_ERR, "n_proxy: DNS lookup failed for %s:%d: %s",
              host, port, gai_strerror(gai_rc));
        return INVALID_SOCKET;
    }
 
    SOCKET fd = INVALID_SOCKET;
    struct addrinfo* rp = NULL;
    for (rp = res; rp; rp = rp->ai_next) {
        fd = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
        if (fd == INVALID_SOCKET) continue;
        if (connect(fd, rp->ai_addr, (socklen_t)rp->ai_addrlen) == 0) break;
        closesocket(fd);
        fd = INVALID_SOCKET;
    }
    freeaddrinfo(res);
 
    if (fd == INVALID_SOCKET) {
        n_log(LOG_ERR, "n_proxy: TCP connect to %s:%d failed", host, port);
    }
    return fd;
}
 
N_PROXY_CFG* n_proxy_cfg_parse(const char* url) {
    if (!url) return NULL;
 
    /* Expect scheme://... */
    const char* sep = strstr(url, "://");
    if (!sep) {
        n_log(LOG_ERR, "n_proxy_cfg_parse: no scheme in '%s'", url);
        return NULL;
    }
 
    size_t scheme_len = (size_t)(sep - url);
    if (scheme_len == 0 || scheme_len > 16) return NULL;
 
    char scheme[17];
    memcpy(scheme, url, scheme_len);
    scheme[scheme_len] = '\0';
 
    /* Only http, https, and socks5 */
    if (strcmp(scheme, "http") != 0 && strcmp(scheme, "https") != 0 && strcmp(scheme, "socks5") != 0) {
        n_log(LOG_ERR, "n_proxy_cfg_parse: unsupported scheme '%s'", scheme);
        return NULL;
    }
 
    const char* after = sep + 3; /* after :// */
    if (!*after) return NULL;
 
    /* Check for user:pass@host:port */
    const char* at = strchr(after, '@');
    const char* host_start = NULL;
    char* username = NULL;
    char* password = NULL;
 
    if (at) {
        /* Parse user:pass */
        const char* colon = strchr(after, ':');
        if (colon && colon < at) {
            username = strndup(after, (size_t)(colon - after));
            password = strndup(colon + 1, (size_t)(at - colon - 1));
        } else {
            username = strndup(after, (size_t)(at - after));
        }
        host_start = at + 1;
    } else {
        host_start = after;
    }
 
    /* Parse host:port */
    /* Handle IPv6 [host]:port */
    char* hostname = NULL;
    int port = 0;
 
    if (host_start[0] == '[') {
        const char* bracket = strchr(host_start, ']');
        if (!bracket) goto fail;
        hostname = strndup(host_start + 1, (size_t)(bracket - host_start - 1));
        if (bracket[1] == ':') {
            port = atoi(bracket + 2);
        }
    } else {
        const char* colon = strchr(host_start, ':');
        if (colon) {
            hostname = strndup(host_start, (size_t)(colon - host_start));
            port = atoi(colon + 1);
        } else {
            hostname = strdup(host_start);
        }
    }
 
    if (!hostname || !hostname[0]) goto fail;
    if (port <= 0 || port > 65535) {
        /* Default ports */
        if (strcmp(scheme, "http") == 0 || strcmp(scheme, "https") == 0)
            port = 3128;
        else if (strcmp(scheme, "socks5") == 0)
            port = 1080;
    }
 
    N_PROXY_CFG* cfg = NULL;
    Malloc(cfg, N_PROXY_CFG, 1);
    if (!cfg) goto fail;
    memset(cfg, 0, sizeof(*cfg));
    cfg->scheme = strdup(scheme);
    cfg->host = hostname;
    cfg->port = port;
    cfg->username = username;
    cfg->password = password;
    return cfg;
 
fail:
    FreeNoLog(hostname);
    FreeNoLog(username);
    FreeNoLog(password);
    return NULL;
}
 
void n_proxy_cfg_free(N_PROXY_CFG** cfg) {
    if (!cfg || !*cfg) return;
    N_PROXY_CFG* p = *cfg;
    FreeNoLog(p->scheme);
    FreeNoLog(p->host);
    FreeNoLog(p->username);
    FreeNoLog(p->password);
    FreeNoLog(p);
    *cfg = NULL;
}
 
int n_proxy_connect_tunnel(const N_PROXY_CFG* proxy,
                           const char* target_host,
                           int target_port) {
    if (!proxy || !target_host) return -1;
 
    SOCKET fd = _proxy_tcp_connect(proxy->host, proxy->port);
    if (fd == INVALID_SOCKET) return -1;
 
    /* Build CONNECT request */
    char connect_req[2048];
    int len = 0;
 
    len = snprintf(connect_req, sizeof(connect_req),
                   "CONNECT %s:%d HTTP/1.1\r\n"
                   "Host: %s:%d\r\n",
                   target_host, target_port,
                   target_host, target_port);
 
    /* Proxy-Authorization if credentials present */
    if (proxy->username && proxy->username[0]) {
        char cred[512];
        snprintf(cred, sizeof(cred), "%s:%s",
                 proxy->username, proxy->password ? proxy->password : "");
        N_STR* cred_nstr = char_to_nstr(cred);
        if (cred_nstr) {
            N_STR* b64 = n_base64_encode(cred_nstr);
            if (b64 && b64->data) {
                len += snprintf(connect_req + len,
                                sizeof(connect_req) - (size_t)len,
                                "Proxy-Authorization: Basic %s\r\n",
                                b64->data);
            }
            if (b64) free_nstr(&b64);
            free_nstr(&cred_nstr);
        }
    }
 
    len += snprintf(connect_req + len, sizeof(connect_req) - (size_t)len,
                    "\r\n");
 
    /* Send CONNECT */
    ssize_t sent = send(fd, connect_req, NETW_BUFLEN_CAST(len), 0);
    if (sent != (ssize_t)len) {
        n_log(LOG_ERR, "n_proxy_connect_tunnel: send CONNECT failed");
        closesocket(fd);
        return -1;
    }
 
    /* Read response */
    char resp_buf[4096];
    ssize_t nr = recv(fd, resp_buf, NETW_BUFLEN_CAST(sizeof(resp_buf) - 1), 0);
    if (nr <= 0) {
        n_log(LOG_ERR, "n_proxy_connect_tunnel: no response from proxy");
        closesocket(fd);
        return -1;
    }
    resp_buf[nr] = '\0';
 
    /* Check for "HTTP/1.x 200" */
    if (strstr(resp_buf, " 200 ") == NULL) {
        n_log(LOG_ERR, "n_proxy_connect_tunnel: proxy rejected CONNECT: %.*s",
              (int)(strchr(resp_buf, '\r') ? strchr(resp_buf, '\r') - resp_buf : nr),
              resp_buf);
        closesocket(fd);
        return -1;
    }
 
    n_log(LOG_DEBUG, "n_proxy_connect_tunnel: tunnel established to %s:%d via %s:%d",
          target_host, target_port, proxy->host, proxy->port);
    return (int)fd;
}
 
#ifdef HAVE_OPENSSL
int n_proxy_connect_tunnel_ssl(const N_PROXY_CFG* proxy,
                               const char* target_host,
                               int target_port) {
    if (!proxy || !target_host) return -1;
 
    SOCKET fd = _proxy_tcp_connect(proxy->host, proxy->port);
    if (fd == INVALID_SOCKET) return -1;
 
    /* TLS handshake to the proxy itself */
    netw_init_openssl();
 
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
    const SSL_METHOD* method = TLS_client_method();
#else
    const SSL_METHOD* method = TLSv1_2_client_method();
#endif
    SSL_CTX* ctx = SSL_CTX_new(method);
    if (!ctx) {
        n_log(LOG_ERR, "n_proxy_connect_tunnel_ssl: SSL_CTX_new failed");
        closesocket(fd);
        return -1;
    }
    SSL_CTX_set_default_verify_paths(ctx);
 
    SSL* ssl = SSL_new(ctx);
    if (!ssl) {
        n_log(LOG_ERR, "n_proxy_connect_tunnel_ssl: SSL_new failed");
        SSL_CTX_free(ctx);
        closesocket(fd);
        return -1;
    }
    SSL_set_fd(ssl, (int)fd);
    SSL_set_tlsext_host_name(ssl, proxy->host);
 
    if (SSL_connect(ssl) <= 0) {
        n_log(LOG_ERR, "n_proxy_connect_tunnel_ssl: TLS handshake to proxy %s:%d failed",
              proxy->host, proxy->port);
        SSL_free(ssl);
        SSL_CTX_free(ctx);
        closesocket(fd);
        return -1;
    }
 
    n_log(LOG_DEBUG, "n_proxy_connect_tunnel_ssl: TLS established to proxy %s:%d",
          proxy->host, proxy->port);
 
    /* Build CONNECT request */
    char connect_req[2048];
    int len = 0;
 
    len = snprintf(connect_req, sizeof(connect_req),
                   "CONNECT %s:%d HTTP/1.1\r\n"
                   "Host: %s:%d\r\n",
                   target_host, target_port,
                   target_host, target_port);
 
    /* Proxy-Authorization if credentials present */
    if (proxy->username && proxy->username[0]) {
        char cred[512];
        snprintf(cred, sizeof(cred), "%s:%s",
                 proxy->username, proxy->password ? proxy->password : "");
        N_STR* cred_nstr = char_to_nstr(cred);
        if (cred_nstr) {
            N_STR* b64 = n_base64_encode(cred_nstr);
            if (b64 && b64->data) {
                len += snprintf(connect_req + len,
                                sizeof(connect_req) - (size_t)len,
                                "Proxy-Authorization: Basic %s\r\n",
                                b64->data);
            }
            if (b64) free_nstr(&b64);
            free_nstr(&cred_nstr);
        }
    }
 
    len += snprintf(connect_req + len, sizeof(connect_req) - (size_t)len,
                    "\r\n");
 
    /* Send CONNECT over TLS */
    if (SSL_write(ssl, connect_req, len) != len) {
        n_log(LOG_ERR, "n_proxy_connect_tunnel_ssl: send CONNECT failed");
        SSL_free(ssl);
        SSL_CTX_free(ctx);
        closesocket(fd);
        return -1;
    }
 
    /* Read response over TLS */
    char resp_buf[4096];
    int nr = SSL_read(ssl, resp_buf, (int)(sizeof(resp_buf) - 1));
    if (nr <= 0) {
        n_log(LOG_ERR, "n_proxy_connect_tunnel_ssl: no response from proxy");
        SSL_free(ssl);
        SSL_CTX_free(ctx);
        closesocket(fd);
        return -1;
    }
    resp_buf[nr] = '\0';
 
    /* Check for "HTTP/1.x 200" */
    if (strstr(resp_buf, " 200 ") == NULL) {
        n_log(LOG_ERR, "n_proxy_connect_tunnel_ssl: proxy rejected CONNECT: %.*s",
              (int)(strchr(resp_buf, '\r') ? strchr(resp_buf, '\r') - resp_buf : nr),
              resp_buf);
        SSL_free(ssl);
        SSL_CTX_free(ctx);
        closesocket(fd);
        return -1;
    }
 
    /* Tunnel established, tear down the proxy TLS session but keep the fd.
     * SSL_shutdown sends close_notify; the proxy knows the CONNECT handshake
     * is done and the raw tunnel begins. We call SSL_set_quiet_shutdown to
     * avoid waiting for the peer's close_notify (the proxy won't send one
     * mid-tunnel). */
    SSL_set_quiet_shutdown(ssl, 1);
    SSL_shutdown(ssl);
    SSL_free(ssl);
    SSL_CTX_free(ctx);
 
    n_log(LOG_DEBUG, "n_proxy_connect_tunnel_ssl: tunnel established to %s:%d via https://%s:%d",
          target_host, target_port, proxy->host, proxy->port);
    return (int)fd;
}
#endif /* HAVE_OPENSSL */
 
int n_proxy_connect_socks5(const N_PROXY_CFG* proxy,
                           const char* target_host,
                           int target_port) {
    if (!proxy || !target_host) return -1;
 
    SOCKET fd = _proxy_tcp_connect(proxy->host, proxy->port);
    if (fd == INVALID_SOCKET) return -1;
 
    int use_auth = (proxy->username && proxy->username[0]) ? 1 : 0;
 
    /* SOCKS5 greeting */
    char greeting[4];
    if (use_auth) {
        greeting[0] = 0x05; /* version */
        greeting[1] = 0x02; /* 2 methods */
        greeting[2] = 0x00; /* no auth */
        greeting[3] = 0x02; /* user/pass */
        if (send(fd, greeting, 4, 0) != 4) goto fail;
    } else {
        greeting[0] = 0x05;
        greeting[1] = 0x01;
        greeting[2] = 0x00;
        if (send(fd, greeting, 3, 0) != 3) goto fail;
    }
 
    /* Read server method selection */
    char method_resp[2];
    if (recv(fd, method_resp, 2, 0) != 2) goto fail;
    if (method_resp[0] != 0x05) goto fail;
 
    if (method_resp[1] == 0x02 && use_auth) {
        /* User/pass auth sub-negotiation (RFC 1929) */
        size_t ulen = strlen(proxy->username);
        size_t plen = proxy->password ? strlen(proxy->password) : 0;
        if (ulen > 255 || plen > 255) goto fail;
 
        char auth_req[515]; /* 1+1+255+1+255 */
        size_t pos = 0;
        auth_req[pos++] = 0x01; /* version */
        auth_req[pos++] = (char)ulen;
        memcpy(auth_req + pos, proxy->username, ulen);
        pos += ulen;
        auth_req[pos++] = (char)plen;
        if (plen > 0) {
            memcpy(auth_req + pos, proxy->password, plen);
            pos += plen;
        }
        /* SOCKS5 username/password auth (RFC 1929) transmits the credentials
         * in cleartext by design; the protocol has no in-band encryption. A
         * caller needing confidentiality must tunnel this over an encrypted
         * link (e.g. an HTTPS CONNECT proxy). Not a fixable defect here. */
        if (send(fd, auth_req, NETW_BUFLEN_CAST(pos), 0) != (ssize_t)pos) goto fail;
 
        char auth_resp[2];
        if (recv(fd, auth_resp, 2, 0) != 2) goto fail;
        if (auth_resp[1] != 0x00) {
            n_log(LOG_ERR, "n_proxy_connect_socks5: auth rejected");
            goto fail;
        }
    } else if (method_resp[1] != 0x00) {
        n_log(LOG_ERR, "n_proxy_connect_socks5: no acceptable method");
        goto fail;
    }
 
    /* Send connect request (domain name addressing) */
    {
        size_t hlen = strlen(target_host);
        if (hlen > 255) goto fail;
 
        char conn_req[263]; /* 4 + 1 + 255 + 2 */
        size_t pos = 0;
        conn_req[pos++] = 0x05; /* version */
        conn_req[pos++] = 0x01; /* connect */
        conn_req[pos++] = 0x00; /* reserved */
        conn_req[pos++] = 0x03; /* domain name */
        conn_req[pos++] = (char)hlen;
        memcpy(conn_req + pos, target_host, hlen);
        pos += hlen;
        conn_req[pos++] = (char)((target_port >> 8) & 0xFF);
        conn_req[pos++] = (char)(target_port & 0xFF);
 
        if (send(fd, conn_req, NETW_BUFLEN_CAST(pos), 0) != (ssize_t)pos) goto fail;
    }
 
    /* Read connect response */
    {
        char conn_resp[10];
        /* Minimum response: 4 bytes header + address (varies) */
        ssize_t nr = recv(fd, conn_resp, NETW_BUFLEN_CAST(sizeof(conn_resp)), 0);
        if (nr < 4) goto fail;
        if (conn_resp[0] != 0x05 || conn_resp[1] != 0x00) {
            n_log(LOG_ERR, "n_proxy_connect_socks5: connect failed, reply=%02x",
                  conn_resp[1]);
            goto fail;
        }
 
        /* If address type is domain (0x03), we may need to read more */
        if (conn_resp[3] == 0x03 && nr < 5) {
            /* Read remaining bytes */
            char extra[256];
            recv(fd, extra, NETW_BUFLEN_CAST(sizeof(extra)), 0);
        } else if (conn_resp[3] == 0x04 && nr < 10) {
            /* IPv6: 16 + 2 bytes remaining */
            char extra[18];
            size_t need = 22 - (size_t)nr; /* total IPv6 response = 4+16+2=22 */
            if (need <= sizeof(extra)) {
                recv(fd, extra, NETW_BUFLEN_CAST(need), 0);
            }
        }
    }
 
    n_log(LOG_DEBUG, "n_proxy_connect_socks5: tunnel established to %s:%d via %s:%d",
          target_host, target_port, proxy->host, proxy->port);
    return (int)fd;
 
fail:
    n_log(LOG_ERR, "n_proxy_connect_socks5: handshake failed");
    closesocket(fd);
    return -1;
}
 
int netw_adopt_client_fd(NETWORK** netw, SOCKET fd, const char* host, const char* port) {
    __n_assert(netw, return FALSE);
    if ((*netw)) {
        n_log(LOG_ERR, "netw_adopt_client_fd: target NETWORK must be empty");
        return FALSE;
    }
    if (fd == INVALID_SOCKET) {
        n_log(LOG_ERR, "netw_adopt_client_fd: invalid socket");
        return FALSE;
    }
    if (netw_init_wsa(1, 2, 2) == FALSE) {
        n_log(LOG_ERR, "netw_adopt_client_fd: unable to load WSA dll's");
        return FALSE;
    }
    (*netw) = netw_new(MAX_LIST_ITEMS, MAX_LIST_ITEMS);
    __n_assert(netw && (*netw), return FALSE);
 
    (*netw)->link.sock = fd;
    (*netw)->link.ip = strdup(host ? host : "");
    if (!(*netw)->link.ip) {
        netw_close(netw);
        return FALSE;
    }
    (*netw)->link.port = strdup(port ? port : "");
    if (!(*netw)->link.port) {
        netw_close(netw);
        return FALSE;
    }
 
    netw_set((*netw), NETW_CLIENT | NETW_RUN | NETW_THR_ENGINE_STOPPED);
    n_log(LOG_DEBUG, "netw_adopt_client_fd: adopted socket %d for %s:%s", (int)fd, (*netw)->link.ip, (*netw)->link.port);
    return TRUE;
} /* netw_adopt_client_fd */