/* tcps_sess.c
 *
 * This implements a session of the tcpsrv object. For general
 * comments, see header of tcpsrv.c.
 *
 * NOTE: read comments in module-template.h to understand how this file
 *       works!
 *
 * File begun on 2008-03-01 by RGerhards (extracted from tcpsrv.c, which
 * based on the BSD-licensed syslogd.c)
 *
 * Copyright 2007-2026 Adiscon GmbH.
 *
 * This file is part of rsyslog.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *       http://www.apache.org/licenses/LICENSE-2.0
 *       -or-
 *       see COPYING.ASL20 in the source distribution
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include "config.h"
#include <limits.h>
#include <stdlib.h>
#include <string.h>
#include <assert.h>
#include <errno.h>
#include <ctype.h>
#ifdef ENABLE_LIBZSTD
    #define ZSTD_STATIC_LINKING_ONLY
    #include <zstd.h>
#endif

#include "rsyslog.h"
#include "dirty.h"
#include "unicode-helper.h"
#include "module-template.h"
#include "net.h"
#include "tcpsrv.h"
#include "tcps_sess.h"
#include "obj.h"
#include "errmsg.h"
#include "netstrm.h"
#include "msg.h"
#include "datetime.h"
#include "prop.h"
#include "ratelimit.h"
#include "debug.h"
#include "rsconf.h"

/* static data */
DEFobjStaticHelpers;
DEFobjCurrIf(glbl);
DEFobjCurrIf(netstrm);
DEFobjCurrIf(prop);
DEFobjCurrIf(datetime);
DEFobjCurrIf(regexp);


/* forward definitions */
static rsRetVal Close(tcps_sess_t *pThis);
static rsRetVal finishCompressedStream(tcps_sess_t *pThis);


/* Standard-Constructor */
BEGINobjConstruct(tcps_sess) /* be sure to specify the object type also in END macro! */
    size_t bufSize;

    pThis->iMsg = 0; /* just make sure... */
    pThis->iMaxLine = glbl.GetMaxLine(runConf);
    pThis->inputState = eAtStrtFram; /* indicate frame header expected */
    pThis->eFraming = TCP_FRAMING_OCTET_STUFFING; /* just make sure... */
    pthread_mutex_init(&pThis->mut, NULL);
    pThis->fromHost = NULL;
    pThis->fromHostIP = NULL;
    pThis->fromHostPort = NULL;
    pThis->iCurrLine = 0;
    pThis->pMsg_save = NULL;
    pThis->tlsProbeBytes = 0;
    pThis->tlsProbeDone = 0;
    pThis->tlsMismatchWarned = 0;
    pThis->compressionMode = TCPSRV_COMPRESS_NEVER;
    pThis->compressionDriver = TCPSRV_COMPRESS_DRIVER_ZLIB;
    pThis->compressionMaxTotalZstdWindowBytes = TCPSRV_COMPRESS_MAX_TOTAL_ZSTD_WINDOW_BYTES_DEFAULT;
    pThis->compressionTotalBytesIn = 0;
    pThis->compressionTotalBytesOut = 0;
    pThis->zipInitDone = 0;
    pThis->compressedStreamEnded = 0;
    pThis->streamDecompressed = 0;
    pThis->zstdDctx = NULL;
    pThis->zstd_frame_header_len = 0;
    pThis->zstd_frame_header_processed = 0;
    pThis->zstd_window_reservation = 0;
    memset(&pThis->zstrm, 0, sizeof(pThis->zstrm));
    memset(pThis->tlsProbeBuf, 0, sizeof(pThis->tlsProbeBuf));
    /* now allocate the message reception buffer */
    bufSize = (size_t)pThis->iMaxLine + 1;
    CHKmalloc(pThis->pMsg = (uchar *)malloc(bufSize));
finalize_it:
ENDobjConstruct(tcps_sess)


/* ConstructionFinalizer
 */
static rsRetVal tcps_sessConstructFinalize(tcps_sess_t *pThis) {
    DEFiRet;
    ISOBJ_TYPE_assert(pThis, tcps_sess);
#ifdef FEATURE_REGEXP
    if (pThis->pLstnInfo->bHasStartRegex) {
        size_t regexBufSize;
        uchar *pMsgTmp;

        if (pThis->iMaxLine > (INT_MAX - 1) / 2) {
            LogError(0, RS_RET_ERR,
                     "imtcp: framing.delimiter.regex requires maxMessageSize <= %d to avoid session buffer overflow",
                     (INT_MAX - 1) / 2);
            ABORT_FINALIZE(RS_RET_ERR);
        }
        regexBufSize = ((size_t)pThis->iMaxLine * 2) + 1;
        /* in this case, we need a second buffer and a larger primary one */
        CHKmalloc(pMsgTmp = (uchar *)realloc(pThis->pMsg, regexBufSize));
        pThis->pMsg = pMsgTmp;
        CHKmalloc(pThis->pMsg_save = (uchar *)malloc(regexBufSize));
    }
#endif
    if (pThis->pSrv->OnSessConstructFinalize != NULL) {
        CHKiRet(pThis->pSrv->OnSessConstructFinalize(&pThis->pUsr));
    }

finalize_it:
    RETiRet;
}


#ifdef ENABLE_LIBZSTD
static sbool reserve_zstd_window(tcps_sess_t *const pThis, const uint64 window_size) {
    tcpLstnPortList_t *const listener = pThis->pLstnInfo;
    const uint64 limit = pThis->compressionMaxTotalZstdWindowBytes;
    uint64 in_use;

    assert(listener != NULL);
    assert(pThis->zstd_window_reservation == 0);
    if (window_size > limit) return RSFALSE;

    in_use = ATOMIC_LOAD_uint64(&listener->compressionZstdWindowBytesInUse, &listener->mutCompressionZstdWindow);
    for (;;) {
        if (in_use > limit - window_size) return RSFALSE;
        if (ATOMIC_CAS_uint64(&listener->compressionZstdWindowBytesInUse, in_use, in_use + window_size,
                              &listener->mutCompressionZstdWindow)) {
            pThis->zstd_window_reservation = window_size;
            return RSTRUE;
        }
        in_use = ATOMIC_LOAD_uint64(&listener->compressionZstdWindowBytesInUse, &listener->mutCompressionZstdWindow);
    }
}

static void release_zstd_window_reservation(tcps_sess_t *const pThis) {
    if (pThis->zstd_window_reservation == 0 || pThis->pLstnInfo == NULL) return;

    assert(ATOMIC_LOAD_uint64(&pThis->pLstnInfo->compressionZstdWindowBytesInUse,
                              &pThis->pLstnInfo->mutCompressionZstdWindow) >= pThis->zstd_window_reservation);
    ATOMIC_SUB_uint64(&pThis->pLstnInfo->compressionZstdWindowBytesInUse, &pThis->pLstnInfo->mutCompressionZstdWindow,
                      pThis->zstd_window_reservation);
    pThis->zstd_window_reservation = 0;
}
#endif

static void release_zlib_decoder(tcps_sess_t *const pThis) {
    if (!pThis->zipInitDone) return;

    inflateEnd(&pThis->zstrm);
    memset(&pThis->zstrm, 0, sizeof(pThis->zstrm));
    pThis->zipInitDone = 0;
}


/* destructor for the tcps_sess object */
BEGINobjDestruct(tcps_sess) /* be sure to specify the object type also in END and CODESTART macros! */
    CODESTARTobjDestruct(tcps_sess);
    release_zlib_decoder(pThis);
#ifdef ENABLE_LIBZSTD
    if (pThis->zstdDctx != NULL) {
        ZSTD_freeDCtx((ZSTD_DCtx *)pThis->zstdDctx);
        pThis->zstdDctx = NULL;
    }
    release_zstd_window_reservation(pThis);
#endif
    if (pThis->pStrm != NULL) netstrm.Destruct(&pThis->pStrm);

    if (pThis->pSrv->pOnSessDestruct != NULL) {
        pThis->pSrv->pOnSessDestruct(&pThis->pUsr);
    }
    pthread_mutex_destroy(&pThis->mut);
    /* now destruct our own properties */
    if (pThis->fromHost != NULL) CHKiRet(prop.Destruct(&pThis->fromHost));
    if (pThis->fromHostIP != NULL) CHKiRet(prop.Destruct(&pThis->fromHostIP));
    if (pThis->fromHostPort != NULL) CHKiRet(prop.Destruct(&pThis->fromHostPort));
    free(pThis->pMsg);
    free(pThis->pMsg_save);
ENDobjDestruct(tcps_sess)


/* debugprint for the tcps_sess object */
BEGINobjDebugPrint(tcps_sess) /* be sure to specify the object type also in END and CODESTART macros! */
    CODESTARTobjDebugPrint(tcps_sess);
ENDobjDebugPrint(tcps_sess)


/* set property functions */
/* set the hostname. Note that the caller *hands over* the string. That is,
 * the caller no longer controls it once SetHost() has received it. Most importantly,
 * the caller must not free it. -- rgerhards, 2008-04-24
 */
static rsRetVal SetHost(tcps_sess_t *pThis, uchar *pszHost) {
    DEFiRet;

    ISOBJ_TYPE_assert(pThis, tcps_sess);

    if (pThis->fromHost == NULL) CHKiRet(prop.Construct(&pThis->fromHost));

    CHKiRet(prop.SetString(pThis->fromHost, pszHost, ustrlen(pszHost)));

finalize_it:
    free(pszHost); /* we must free according to our (old) calling conventions */
    RETiRet;
}

/* set the remote host's IP. Note that the caller *hands over* the property. That is,
 * the caller no longer controls it once SetHostIP() has received it. Most importantly,
 * the caller must not destruct it. -- rgerhards, 2008-05-16
 */
static rsRetVal SetHostIP(tcps_sess_t *pThis, prop_t *ip) {
    DEFiRet;
    ISOBJ_TYPE_assert(pThis, tcps_sess);

    if (pThis->fromHostIP != NULL) {
        prop.Destruct(&pThis->fromHostIP);
    }
    pThis->fromHostIP = ip;
    RETiRet;
}

static rsRetVal SetHostPort(tcps_sess_t *pThis, prop_t *port) {
    DEFiRet;
    ISOBJ_TYPE_assert(pThis, tcps_sess);

    if (pThis->fromHostPort != NULL) {
        prop.Destruct(&pThis->fromHostPort);
    }
    pThis->fromHostPort = port;
    RETiRet;
}

static rsRetVal SetStrm(tcps_sess_t *pThis, netstrm_t *pStrm) {
    DEFiRet;
    ISOBJ_TYPE_assert(pThis, tcps_sess);
    pThis->pStrm = pStrm;
    RETiRet;
}


static inline int isLikelyTlsClientHello(const uchar buf[5]) {
    if (buf[0] != 0x16) return 0; /* handshake record */
    if (buf[1] != 0x03) return 0; /* TLS major version */
    if (buf[2] > 0x04) return 0; /* accept TLS 1.0 - 1.3 */
    const unsigned recordLen = ((unsigned)buf[3] << 8) | buf[4];
    if (recordLen < 40 || recordLen > 16384) return 0; /* sanity */
    return 1;
}

static ATTR_NONNULL() rsRetVal maybeDetectTlsClientHello(tcps_sess_t *pThis, const char *data, size_t len) {
    DEFiRet;
    if (pThis->tlsProbeDone) FINALIZE;

    if (pThis->pSrv->pszOrigin == NULL || strcmp((const char *)pThis->pSrv->pszOrigin, "imtcp") != 0) {
        pThis->tlsProbeDone = 1;
        FINALIZE;
    }

    if (pThis->pSrv->iDrvrMode != 0) {
        pThis->tlsProbeDone = 1;
        FINALIZE;
    }

    while (len > 0 && pThis->tlsProbeBytes < sizeof(pThis->tlsProbeBuf)) {
        pThis->tlsProbeBuf[pThis->tlsProbeBytes++] = (uchar)*data++;
        --len;
    }

    if (pThis->tlsProbeBytes >= sizeof(pThis->tlsProbeBuf)) {
        if (!pThis->tlsMismatchWarned && isLikelyTlsClientHello(pThis->tlsProbeBuf)) {
            const char *const host = propGetSzStrOrDefault(pThis->fromHost, "(host unknown)");
            const char *const ip = propGetSzStrOrDefault(pThis->fromHostIP, "(IP unknown)");
            const char *const port = propGetSzStrOrDefault(pThis->fromHostPort, "(port unknown)");
            LogError(0, RS_RET_SERVER_NO_TLS,
                     "imtcp: TLS handshake detected from %s (%s:%s) but listener is not TLS-enabled. "
                     "Enable TLS on this listener or disable TLS on the client. "
                     "See https://www.rsyslog.com/doc/faq/imtcp-tls-gibberish.html for troubleshooting.",
                     host, ip, port);
            pThis->tlsMismatchWarned = 1;
            ABORT_FINALIZE(RS_RET_SERVER_NO_TLS);
        }
        pThis->tlsProbeDone = 1;
    }
finalize_it:
    RETiRet;
}


static rsRetVal SetMsgIdx(tcps_sess_t *pThis, int idx) {
    DEFiRet;
    ISOBJ_TYPE_assert(pThis, tcps_sess);
    pThis->iMsg = idx;
    RETiRet;
}


/* set our parent, the tcpsrv object */
static rsRetVal SetTcpsrv(tcps_sess_t *pThis, tcpsrv_t *pSrv) {
    DEFiRet;
    ISOBJ_TYPE_assert(pThis, tcps_sess);
    ISOBJ_TYPE_assert(pSrv, tcpsrv);
    pThis->pSrv = pSrv;
    RETiRet;
}


/* set our parent listener info*/
static rsRetVal SetLstnInfo(tcps_sess_t *pThis, tcpLstnPortList_t *pLstnInfo) {
    DEFiRet;
    ISOBJ_TYPE_assert(pThis, tcps_sess);
    assert(pLstnInfo != NULL);
    pThis->pLstnInfo = pLstnInfo;
    /* set cached elements */
    pThis->bSuppOctetFram = pLstnInfo->cnf_params->bSuppOctetFram;
    pThis->bSPFramingFix = pLstnInfo->cnf_params->bSPFramingFix;
    pThis->compressionMode = pLstnInfo->compressionMode;
    pThis->compressionDriver = pLstnInfo->compressionDriver;
    pThis->compressionMaxExpansionRatio = pLstnInfo->compressionMaxExpansionRatio;
    pThis->compressionMaxDecompressedBytesPerReceive = pLstnInfo->compressionMaxDecompressedBytesPerReceive;
    pThis->compressionMaxTotalZstdWindowBytes = pLstnInfo->compressionMaxTotalZstdWindowBytes;
    RETiRet;
}


static rsRetVal SetUsrP(tcps_sess_t *pThis, void *pUsr) {
    DEFiRet;
    pThis->pUsr = pUsr;
    RETiRet;
}


static rsRetVal SetOnMsgReceive(tcps_sess_t *pThis, rsRetVal (*OnMsgReceive)(tcps_sess_t *, uchar *, int)) {
    DEFiRet;
    pThis->DoSubmitMessage = OnMsgReceive;
    RETiRet;
}


/* This is a helper for submitting the message to the rsyslog core.
 * It does some common processing, including resetting the various
 * state variables to a "processed" state.
 * Note that this function is also called if we had a buffer overflow
 * due to a too-long message. So far, there is no indication this
 * happened and it may be worth thinking about different handling
 * of this case (what obviously would require a change to this
 * function or some related code).
 * rgerhards, 2009-04-23
 */
static rsRetVal defaultDoSubmitMessage(tcps_sess_t *pThis,
                                       struct syslogTime *stTime,
                                       time_t ttGenTime,
                                       multi_submit_t *pMultiSub) {
    smsg_t *pMsg;
    rsRetVal localRet;
    DEFiRet;

    ISOBJ_TYPE_assert(pThis, tcps_sess);
    const tcpLstnParams_t *const cnf_params = pThis->pLstnInfo->cnf_params;

    if (pThis->iMsg == 0) {
        DBGPRINTF("discarding zero-sized message\n");
        FINALIZE;
    }

    if (pThis->DoSubmitMessage != NULL) {
        pThis->DoSubmitMessage(pThis, pThis->pMsg, pThis->iMsg);
        FINALIZE;
    }

    /* we now create our own message object and submit it to the queue */
    CHKiRet(msgConstructWithTime(&pMsg, stTime, ttGenTime));
    MsgSetRawMsg(pMsg, (char *)pThis->pMsg, pThis->iMsg);
    MsgSetInputName(pMsg, cnf_params->pInputName);
    if (cnf_params->dfltTZ[0] != '\0') MsgSetDfltTZ(pMsg, (char *)cnf_params->dfltTZ);
    MsgSetFlowControlType(pMsg, pThis->pSrv->bUseFlowControl ? eFLOWCTL_LIGHT_DELAY : eFLOWCTL_NO_DELAY);
    pMsg->msgFlags = NEEDS_PARSING | PARSE_HOSTNAME;
    if (pThis->streamDecompressed) {
        pMsg->msgFlags |= NO_LEGACY_Z_DECOMPRESS;
    }
    MsgSetRcvFrom(pMsg, pThis->fromHost);
    CHKiRet(MsgSetRcvFromIP(pMsg, pThis->fromHostIP));
    CHKiRet(MsgSetRcvFromPort(pMsg, pThis->fromHostPort));
    MsgSetRuleset(pMsg, cnf_params->pRuleset);
    if (pThis->bFrameOversize) {
        writeOversizeMessageLog(pMsg);
    }

    localRet = ratelimitAddMsg(pThis->pLstnInfo->ratelimiter, pMultiSub, pMsg);

    if (localRet == RS_RET_OK) {
        STATSCOUNTER_INC(pThis->pLstnInfo->ctrSubmit, pThis->pLstnInfo->mutCtrSubmit);
    } else if (localRet == RS_RET_DISCARDMSG) {
        DBGPRINTF("tcps_sess: message discarded by ratelimit helper\n");
        iRet = RS_RET_OK;
    } else {
        DBGPRINTF("tcps_sess: ratelimit helper returned error %d, continuing\n", localRet);
        iRet = RS_RET_OK;
    }

finalize_it:
    /* reset status variables */
    pThis->iMsg = 0;
    pThis->bFrameOversize = 0;

    RETiRet;
}


/* This should be called before a normal (non forced) close
 * of a TCP session. This function checks if there is any unprocessed
 * message left in the TCP stream. Such a message is probably a
 * fragment. If everything goes well, we must be right at the
 * beginning of a new frame without any data received from it. If
 * not, there is some kind of a framing error. I think I remember that
 * some legacy syslog/TCP implementations have non-LF terminated
 * messages at the end of the stream. For now, we allow this behaviour.
 * Later, it should probably become a configuration option.
 * rgerhards, 2006-12-07
 */
static rsRetVal PrepareClose(tcps_sess_t *pThis) {
    struct syslogTime stTime;
    time_t ttGenTime;
    DEFiRet;

    ISOBJ_TYPE_assert(pThis, tcps_sess);

    CHKiRet(finishCompressedStream(pThis));

    if (pThis->inputState == eAtStrtFram) {
        /* this is how it should be. There is no unprocessed
         * data left and such we have nothing to do. For simplicity
         * reasons, we immediately return in that case.
         */
        FINALIZE;
    }

    /* we have some data left! */
    if (pThis->eFraming == TCP_FRAMING_OCTET_COUNTING) {
        /* In this case, we have an invalid frame count and thus
         * generate an error message and discard the frame.
         */
        LogError(0, NO_ERRCODE,
                 "Incomplete frame at end of stream in session %p - "
                 "ignoring extra data (a message may be lost).",
                 pThis->pStrm);
        /* nothing more to do */
    } else { /* here, we have traditional framing. Missing LF at the end
              * of message may occur. As such, we process the message in
              * this case.
              */
        DBGPRINTF("Extra data at end of stream in legacy syslog/tcp message - processing\n");
        datetime.getCurrTime(&stTime, &ttGenTime, TIME_IN_LOCALTIME);
        defaultDoSubmitMessage(pThis, &stTime, ttGenTime, NULL);
    }

finalize_it:
    RETiRet;
}


#ifdef FEATURE_REGEXP
static rsRetVal ATTR_NONNULL() processDataRcvd_regexFraming(tcps_sess_t *const __restrict__ pThis,
                                                            char **const buff,
                                                            struct syslogTime *const stTime,
                                                            const time_t ttGenTime,
                                                            multi_submit_t *const pMultiSub,
                                                            unsigned *const __restrict__ pnMsgs) {
    DEFiRet;
    const char c = **buff;

    if (pThis->iMsg >= 2 * pThis->iMaxLine) {
        LogError(0, RS_RET_OVERSIZE_MSG,
                 "imtcp: more then double max message size (%d) "
                 "received without finding frame terminator via regex - assuming "
                 "end of frame now.",
                 pThis->iMsg + 1);
        defaultDoSubmitMessage(pThis, stTime, ttGenTime, pMultiSub);
        ++(*pnMsgs);
        pThis->iMsg = 0;
        pThis->iCurrLine = 0;
    }

    pThis->pMsg[pThis->iMsg++] = c;
    pThis->pMsg[pThis->iMsg] = '\0';


    if (c == '\n') {
        pThis->iCurrLine = pThis->iMsg;
    } else {
        const int isMatch =
            !regexp.regexec(&pThis->pLstnInfo->start_preg, (char *)pThis->pMsg + pThis->iCurrLine, 0, NULL, 0);
        if (pThis->iCurrLine > 0 && isMatch) {
            DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg);
            const size_t len_save = pThis->iMsg - pThis->iCurrLine;
            memmove(pThis->pMsg_save, pThis->pMsg + pThis->iCurrLine, len_save);
            pThis->pMsg_save[len_save] = '\0';

            pThis->iMsg = pThis->iCurrLine - 1; /* remove trailing LF */

            defaultDoSubmitMessage(pThis, stTime, ttGenTime, pMultiSub);
            ++(*pnMsgs);

            memmove(pThis->pMsg, pThis->pMsg_save, len_save + 1);
            pThis->iMsg = len_save;
            pThis->iCurrLine = 0;
        }
    }

    RETiRet;
}
#endif

/**
 * @brief Close a TCP session and release session-owned properties.
 *
 * Tears down the network stream and frees per-session sender properties
 * (hostname/IP). This does not flush pending data; callers should invoke
 * PrepareClose() beforehand when needed. The netstrm close result is ignored
 * because we are shutting down a session and there is no recovery path for a
 * close failure.
 */
static rsRetVal Close(tcps_sess_t *pThis) {
    DEFiRet;

    ISOBJ_TYPE_assert(pThis, tcps_sess);
    if (pThis->pStrm != NULL) {
        netstrm.Destruct(&pThis->pStrm);
    }
    if (pThis->fromHost != NULL) {
        prop.Destruct(&pThis->fromHost);
    }
    if (pThis->fromHostIP != NULL) prop.Destruct(&pThis->fromHostIP);

    RETiRet;
}


/* process the data received. As TCP is stream based, we need to process the
 * data inside a state machine. The actual data received is passed in byte-by-byte
 * from DataRcvd, and this function here compiles messages from them and submits
 * the end result to the queue. Introducing this function fixes a long-term bug ;)
 * rgerhards, 2008-03-14
 */
static rsRetVal ATTR_NONNULL(1) processDataRcvd(tcps_sess_t *pThis,
                                                char **buff,
                                                const int buffLen,
                                                struct syslogTime *stTime,
                                                const time_t ttGenTime,
                                                multi_submit_t *pMultiSub,
                                                unsigned *const __restrict__ pnMsgs) {
    DEFiRet;
    const char c = **buff;
    const tcpLstnParams_t *const cnf_params = pThis->pLstnInfo->cnf_params;
    ISOBJ_TYPE_assert(pThis, tcps_sess);

#ifdef FEATURE_REGEXP
    if (pThis->pLstnInfo->bHasStartRegex) {
        processDataRcvd_regexFraming(pThis, buff, stTime, ttGenTime, pMultiSub, pnMsgs);
        FINALIZE;
    }
#endif

    if (pThis->inputState == eInMsgCheckMultiLine) {
        if (c == '<') {
            defaultDoSubmitMessage(pThis, stTime, ttGenTime, pMultiSub);
            ++(*pnMsgs);
            pThis->inputState = eAtStrtFram;
        } else {
            /* this was a continuation line, so we need to add the LF
             * that we "missed" at the end of the previous packet.
             */
            if (pThis->iMsg < pThis->iMaxLine) {
                *(pThis->pMsg + pThis->iMsg++) = '\n';
            }
            pThis->inputState = eInMsg;
        }
    }

    if (pThis->inputState == eAtStrtFram) {
        if (c >= '0' && c <= '9' && pThis->bSuppOctetFram) {
            pThis->inputState = eInOctetCnt;
            pThis->bFrameOversize = 0;
            pThis->iOctetsRemain = 0;
            pThis->eFraming = TCP_FRAMING_OCTET_COUNTING;
        } else if (c == ' ' && pThis->bSPFramingFix) {
            /* Cisco ASA very occasionally sends a SP after a LF, which
             * thrashes framing if not taken special care of. Here,
             * we permit space *in front of the next frame* and
             * ignore it.
             */
            FINALIZE;
        } else {
            pThis->inputState = eInMsg;
            pThis->bFrameOversize = 0;
            pThis->eFraming = TCP_FRAMING_OCTET_STUFFING;
        }
    }

    if (pThis->inputState == eInMsg) {
#if 0  // set to 1 for ultra-verbose
		DBGPRINTF("DEBUG: processDataRcvd c=%c remain=%d\n",
			c, pThis->iOctetsRemain);
#endif

        if ((((c == '\n') && !pThis->pSrv->bDisableLFDelim) ||
             ((pThis->pSrv->addtlFrameDelim != TCPSRV_NO_ADDTL_DELIMITER) && (c == pThis->pSrv->addtlFrameDelim))) &&
            pThis->eFraming == TCP_FRAMING_OCTET_STUFFING) { /* record delimiter? */
            if (cnf_params->bMultiLine) {
                if (buffLen > 1) {
                    if (*(*buff + 1) == '<') {
                        defaultDoSubmitMessage(pThis, stTime, ttGenTime, pMultiSub);
                        ++(*pnMsgs);
                        pThis->inputState = eAtStrtFram;
                    } else {
                        if (pThis->iMsg < pThis->iMaxLine) {
                            *(pThis->pMsg + pThis->iMsg++) = c;
                        }
                    }
                } else {
                    /* at end of buffer, check next packet */
                    pThis->inputState = eInMsgCheckMultiLine;
                    FINALIZE;
                }
            } else {
                defaultDoSubmitMessage(pThis, stTime, ttGenTime, pMultiSub);
                ++(*pnMsgs);
                pThis->inputState = eAtStrtFram;
            }
        } else {
            /* IMPORTANT: here we copy the actual frame content to the message - for BOTH framing modes!
             * If we have a message that is larger than the max msg size, we truncate it. This is the best
             * we can do in light of what the engine supports. -- rgerhards, 2008-03-14
             */
            if (pThis->iMsg < pThis->iMaxLine) {
                *(pThis->pMsg + pThis->iMsg++) = c;
            } else {
                /* emergency, we now need to flush, no matter if we are at end of message or not... */
                DBGPRINTF("error: message received is larger than max msg size, we %s it - c=%x\n",
                          pThis->pSrv->discardTruncatedMsg == 1 ? "truncate" : "split", c);
                pThis->bFrameOversize = 1;
                defaultDoSubmitMessage(pThis, stTime, ttGenTime, pMultiSub);
                ++(*pnMsgs);
                if (pThis->pSrv->discardTruncatedMsg == 1) {
                    if (pThis->eFraming == TCP_FRAMING_OCTET_COUNTING) {
                        pThis->iOctetsRemain--;
                        if (pThis->iOctetsRemain == 0) {
                            pThis->inputState = eAtStrtFram;
                            FINALIZE;
                        }
                    }
                    pThis->inputState = eInMsgTruncating;
                    FINALIZE;
                }
            }
        }

        if (pThis->eFraming == TCP_FRAMING_OCTET_COUNTING) {
            /* do we need to find end-of-frame via octet counting? */
            pThis->iOctetsRemain--;
            if (pThis->iOctetsRemain < 1) {
                /* we have end of frame! */
                defaultDoSubmitMessage(pThis, stTime, ttGenTime, pMultiSub);
                ++(*pnMsgs);
                pThis->inputState = eAtStrtFram;
            }
        }
    } else if (pThis->inputState == eInMsgTruncating) {
        if (pThis->eFraming == TCP_FRAMING_OCTET_COUNTING) {
            DBGPRINTF("DEBUG: TCP_FRAMING_OCTET_COUNTING eInMsgTruncating c=%c remain=%d\n", c, pThis->iOctetsRemain);

            pThis->iOctetsRemain--;
            if (pThis->iOctetsRemain < 1) {
                pThis->inputState = eAtStrtFram;
            }
        } else {
            if (((c == '\n') && !pThis->pSrv->bDisableLFDelim) ||
                ((pThis->pSrv->addtlFrameDelim != TCPSRV_NO_ADDTL_DELIMITER) && (c == pThis->pSrv->addtlFrameDelim))) {
                pThis->inputState = eAtStrtFram;
            }
        }
    } else {
        assert(pThis->inputState == eInOctetCnt);
        if (c >= '0' && c <= '9') { /* isdigit() the faster way */
            if (pThis->iOctetsRemain <= 200000000) {
                pThis->iOctetsRemain = pThis->iOctetsRemain * 10 + c - '0';
            }
            if (pThis->iMsg < pThis->iMaxLine) {
                *(pThis->pMsg + pThis->iMsg++) = c;
            }
        } else { /* done with the octet count, so this must be the SP terminator */
            DBGPRINTF("TCP Message with octet-counter, size %d.\n", pThis->iOctetsRemain);
            const char *const peerName = propGetSzStrOrDefault(pThis->fromHost, "(hostname unknown)");
            const char *const peerIP = propGetSzStrOrDefault(pThis->fromHostIP, "(IP unknown)");
            const char *const peerPort = propGetSzStrOrDefault(pThis->fromHostPort, "(port unknown)");
            if (c != ' ') {
                LogError(0, NO_ERRCODE,
                         "imtcp %s: Framing Error in received TCP message from "
                         "peer: (hostname) %s, (ip) %s, (port) %s: delimiter is not SP but has "
                         "ASCII value %d.",
                         cnf_params->pszInputName, peerName, peerIP, peerPort, c);
            }
            if (pThis->iOctetsRemain < 1) {
                LogError(0, NO_ERRCODE,
                         "imtcp %s: Framing Error in received TCP message from "
                         "peer: (hostname) %s, (ip) %s, (port) %s: invalid octet count %d.",
                         cnf_params->pszInputName, peerName, peerIP, peerPort, pThis->iOctetsRemain);
                pThis->eFraming = TCP_FRAMING_OCTET_STUFFING;
            } else if (pThis->iOctetsRemain > pThis->iMaxLine) {
                pThis->bFrameOversize = 1;
                /* while we can not do anything against it, we can at least log an indication
                 * that something went wrong) -- rgerhards, 2008-03-14
                 */
                LogError(0, NO_ERRCODE,
                         "imtcp %s: received oversize message from peer: "
                         "(hostname) %s, (ip) %s, (port) %s: size is %d bytes, max msg size "
                         "is %d, truncating...",
                         cnf_params->pszInputName, peerName, peerIP, peerPort, pThis->iOctetsRemain, pThis->iMaxLine);
            }
            if (pThis->iOctetsRemain > pThis->pSrv->maxFrameSize) {
                LogError(0, NO_ERRCODE,
                         "imtcp %s: Framing Error in received TCP message from "
                         "peer: (hostname) %s, (ip) %s, (port) %s: frame too large: %d, change "
                         "to octet stuffing",
                         cnf_params->pszInputName, peerName, peerIP, peerPort, pThis->iOctetsRemain);
                pThis->eFraming = TCP_FRAMING_OCTET_STUFFING;
            } else {
                pThis->iMsg = 0;
            }
            pThis->inputState = eInMsg;
        }
    }

finalize_it:
    RETiRet;
}


/* Processes the data received via a TCP session. If there
 * is no other way to handle it, data is discarded.
 * Input parameter data is the data received, iLen is its
 * len as returned from recv(). iLen must be 1 or more (that
 * is errors must be handled by caller!). iTCPSess must be
 * the index of the TCP session that received the data.
 * rgerhards 2005-07-04
 * And another change while generalizing. We now return either
 * RS_RET_OK, which means the session should be kept open
 * or anything else, which means it must be closed.
 * rgerhards, 2008-03-01
 * As a performance optimization, we pick up the timestamp here. Actually,
 * this *is* the *correct* reception step for all the data we received, because
 * we have just received a bunch of data! -- rgerhards, 2009-06-16
 */
#define NUM_MULTISUB 1024
static rsRetVal DataRcvdUncompressed(tcps_sess_t *pThis, char *pData, const size_t iLen, const sbool detectTls) {
    multi_submit_t multiSub;
    smsg_t *pMsgs[NUM_MULTISUB];
    struct syslogTime stTime;
    time_t ttGenTime;
    char *pEnd;
    unsigned nMsgs = 0;
    DEFiRet;

    ISOBJ_TYPE_assert(pThis, tcps_sess);
    assert(pData != NULL);
    assert(iLen > 0);

    if (detectTls) {
        CHKiRet(maybeDetectTlsClientHello(pThis, pData, iLen));
    }

    datetime.getCurrTime(&stTime, &ttGenTime, TIME_IN_LOCALTIME);
    multiSub.ppMsgs = pMsgs;
    multiSub.maxElem = NUM_MULTISUB;
    multiSub.nElem = 0;

    /* We now copy the message to the session buffer. */
    pEnd = pData + iLen; /* this is one off, which is intentional */

    while (pData < pEnd) {
        CHKiRet(processDataRcvd(pThis, &pData, pEnd - pData, &stTime, ttGenTime, &multiSub, &nMsgs));
        pData++;
    }
    iRet = multiSubmitFlush(&multiSub);

    if (runConf->globals.senderKeepTrack) statsRecordSender(propGetSzStr(pThis->fromHost), nMsgs, ttGenTime);

finalize_it:
    RETiRet;
}
#undef NUM_MULTISUB

static rsRetVal DataRcvdUncompressedFromStream(tcps_sess_t *const pThis,
                                               char *const pData,
                                               const size_t iLen,
                                               const sbool detectTls) {
    const sbool previous = pThis->streamDecompressed;
    pThis->streamDecompressed = RSTRUE;

    const rsRetVal localRet = DataRcvdUncompressed(pThis, pData, iLen, detectTls);
    pThis->streamDecompressed = previous;
    return localRet;
}

static const char *compressionDriverName(const tcps_sess_t *const pThis) {
    switch (pThis->compressionDriver) {
        case TCPSRV_COMPRESS_DRIVER_ZSTD:
            return "zstd";
        case TCPSRV_COMPRESS_DRIVER_ZLIB:
        default:
            return "zlib";
    }
}

static void logCompressedStreamFailure(tcps_sess_t *const pThis, const char *const reason, const char *const detail) {
    const char *const host = propGetSzStrOrDefault(pThis->fromHost, "(host unknown)");
    const char *const ip = propGetSzStrOrDefault(pThis->fromHostIP, "(IP unknown)");
    const char *const port = propGetSzStrOrDefault(pThis->fromHostPort, "(port unknown)");

    pThis->compressedStreamFailed = 1;
    STATSCOUNTER_INC(pThis->pLstnInfo->ctrDecompressErr, pThis->pLstnInfo->mutCtrDecompressErr);
    LogError(0, RS_RET_ZLIB_ERR, "imtcp: %s from %s (%s:%s), driver=%s%s%s", reason, host, ip, port,
             compressionDriverName(pThis), detail == NULL ? "" : ": ", detail == NULL ? "" : detail);
}

typedef struct decompressReceiveGuard_s {
    uint64_t decompressedBytes;
} decompressReceiveGuard_t;

static rsRetVal checkDecompressedBytesLimit(tcps_sess_t *const pThis,
                                            decompressReceiveGuard_t *const guard,
                                            const size_t len) {
    DEFiRet;

    if (UINT64_MAX - guard->decompressedBytes < len) {
        logCompressedStreamFailure(pThis, "received invalid compressed stream",
                                   "per-receive decompressed byte counter overflowed");
        ABORT_FINALIZE(RS_RET_ZLIB_ERR);
    }
    const uint64_t newReceiveTotal = guard->decompressedBytes + len;

    if (pThis->compressionMaxDecompressedBytesPerReceive != 0 &&
        newReceiveTotal > pThis->compressionMaxDecompressedBytesPerReceive) {
        logCompressedStreamFailure(pThis, "received invalid compressed stream",
                                   "decompressed bytes exceeded configured per-receive limit");
        ABORT_FINALIZE(RS_RET_ZLIB_ERR);
    }

    if (UINT64_MAX - pThis->compressionTotalBytesOut < len) {
        logCompressedStreamFailure(pThis, "received invalid compressed stream",
                                   "stream decompressed byte counter overflowed");
        ABORT_FINALIZE(RS_RET_ZLIB_ERR);
    }
    const uint64_t newStreamTotal = pThis->compressionTotalBytesOut + len;

    if (pThis->compressionMaxExpansionRatio != 0) {
        const uint64_t maxByRatio = pThis->compressionTotalBytesIn > UINT64_MAX / pThis->compressionMaxExpansionRatio
                                        ? UINT64_MAX
                                        : pThis->compressionTotalBytesIn * pThis->compressionMaxExpansionRatio;
        if (newStreamTotal > maxByRatio) {
            logCompressedStreamFailure(pThis, "received invalid compressed stream",
                                       "decompressed bytes exceeded configured expansion ratio");
            ABORT_FINALIZE(RS_RET_ZLIB_ERR);
        }
    }

    guard->decompressedBytes = newReceiveTotal;
    pThis->compressionTotalBytesOut = newStreamTotal;

finalize_it:
    RETiRet;
}

static rsRetVal DataRcvdCompressedZlib(tcps_sess_t *const pThis,
                                       char *const pData,
                                       const size_t iLen,
                                       decompressReceiveGuard_t *const guard) {
    uchar out[64 * 1024];
    DEFiRet;

    if (pThis->compressedStreamEnded) {
        logCompressedStreamFailure(pThis, "received invalid compressed stream", "data after end of zlib stream");
        ABORT_FINALIZE(RS_RET_ZLIB_ERR);
    }

    if (!pThis->zipInitDone) {
        memset(&pThis->zstrm, 0, sizeof(pThis->zstrm));
        const int zret = inflateInit(&pThis->zstrm);
        if (zret != Z_OK) {
            logCompressedStreamFailure(pThis, "received invalid compressed stream", "zlib inflateInit failed");
            ABORT_FINALIZE(RS_RET_ZLIB_ERR);
        }
        pThis->zipInitDone = 1;
    }

    pThis->zstrm.next_in = (Bytef *)pData;
    pThis->zstrm.avail_in = (uInt)iLen;

    do {
        pThis->zstrm.next_out = out;
        pThis->zstrm.avail_out = sizeof(out);
        const uInt oldAvailIn = pThis->zstrm.avail_in;
        const int zret = inflate(&pThis->zstrm, Z_SYNC_FLUSH);
        const size_t have = sizeof(out) - pThis->zstrm.avail_out;

        if (have != 0) {
            CHKiRet(checkDecompressedBytesLimit(pThis, guard, have));
            STATSCOUNTER_ADD(pThis->pLstnInfo->ctrBytesDecompressed, pThis->pLstnInfo->mutCtrBytesDecompressed, have);
            CHKiRet(DataRcvdUncompressedFromStream(pThis, (char *)out, have, 0));
        }

        if (zret == Z_STREAM_END) {
            pThis->compressedStreamEnded = 1;
            if (pThis->zstrm.avail_in != 0) {
                logCompressedStreamFailure(pThis, "received invalid compressed stream",
                                           "data after end of zlib stream");
                ABORT_FINALIZE(RS_RET_ZLIB_ERR);
            }
            release_zlib_decoder(pThis);
            DBGPRINTF("tcps_sess: released zlib decoder after stream completion\n");
            break;
        }

        if (zret != Z_OK && zret != Z_BUF_ERROR) {
            logCompressedStreamFailure(pThis, "received invalid compressed stream", "zlib inflate failed");
            ABORT_FINALIZE(RS_RET_ZLIB_ERR);
        }
        if (zret == Z_BUF_ERROR && have == 0 && pThis->zstrm.avail_in == oldAvailIn) {
            logCompressedStreamFailure(pThis, "received invalid compressed stream", "zlib inflate made no progress");
            ABORT_FINALIZE(RS_RET_ZLIB_ERR);
        }
    } while (pThis->zstrm.avail_in != 0 || pThis->zstrm.avail_out == 0);

finalize_it:
    if (iRet != RS_RET_OK) release_zlib_decoder(pThis);
    RETiRet;
}

static rsRetVal DataRcvdCompressedZstd(tcps_sess_t *const pThis,
                                       char *const pData,
                                       const size_t iLen,
                                       decompressReceiveGuard_t *const guard) {
#ifdef ENABLE_LIBZSTD
    uchar out[64 * 1024];
    DEFiRet;

    if (pThis->compressedStreamEnded) {
        logCompressedStreamFailure(pThis, "received invalid compressed stream", "data after end of zstd stream");
        ABORT_FINALIZE(RS_RET_ZLIB_ERR);
    }

    size_t input_offset = 0;
    while (pThis->compressionMaxTotalZstdWindowBytes != 0 && !pThis->zstd_frame_header_processed) {
        ZSTD_frameHeader frame_header;
        const size_t header_ret =
            ZSTD_getFrameHeader(&frame_header, pThis->zstd_frame_header, pThis->zstd_frame_header_len);
        if (ZSTD_isError(header_ret)) {
            logCompressedStreamFailure(pThis, "received invalid compressed stream", ZSTD_getErrorName(header_ret));
            ABORT_FINALIZE(RS_RET_ZLIB_ERR);
        }
        if (header_ret == 0) {
            if (frame_header.frameType == ZSTD_frame) {
                if (!reserve_zstd_window(pThis, frame_header.windowSize)) {
                    logCompressedStreamFailure(pThis, "received invalid compressed stream",
                                               "zstd decoder window budget exhausted");
                    ABORT_FINALIZE(RS_RET_ZLIB_ERR);
                }
            }
            pThis->zstd_frame_header_processed = RSTRUE;
            break;
        }

        if (header_ret > TCPSRV_ZSTD_FRAME_HEADER_MAX || header_ret <= pThis->zstd_frame_header_len) {
            logCompressedStreamFailure(pThis, "received invalid compressed stream", "invalid zstd frame header size");
            ABORT_FINALIZE(RS_RET_ZLIB_ERR);
        }

        const size_t need = header_ret - pThis->zstd_frame_header_len;
        const size_t available = iLen - input_offset;
        const size_t take = need < available ? need : available;
        memcpy(pThis->zstd_frame_header + pThis->zstd_frame_header_len, pData + input_offset, take);
        pThis->zstd_frame_header_len += take;
        input_offset += take;
        if (take < need) {
            FINALIZE;
        }
    }

    if (pThis->zstdDctx == NULL) {
        pThis->zstdDctx = ZSTD_createDCtx();
        if (pThis->zstdDctx == NULL) {
            logCompressedStreamFailure(pThis, "received invalid compressed stream", "zstd context allocation failed");
            ABORT_FINALIZE(RS_RET_ZLIB_ERR);
        }
    }

    const unsigned input_parts = pThis->compressionMaxTotalZstdWindowBytes == 0 ? 1 : 2;
    for (unsigned input_part = 0; input_part < input_parts; ++input_part) {
        ZSTD_inBuffer input;
        if (pThis->compressionMaxTotalZstdWindowBytes == 0) {
            input = (ZSTD_inBuffer){pData, iLen, 0};
        } else if (input_part == 0) {
            if (pThis->zstd_frame_header_len == 0) {
                continue;
            }
            input = (ZSTD_inBuffer){pThis->zstd_frame_header, pThis->zstd_frame_header_len, 0};
        } else {
            input = (ZSTD_inBuffer){pData + input_offset, iLen - input_offset, 0};
        }
        if (input.size == 0) {
            continue;
        }

        ZSTD_outBuffer output;
        do {
            output.dst = out;
            output.size = sizeof(out);
            output.pos = 0;
            const size_t old_input_pos = input.pos;
            const size_t remaining = ZSTD_decompressStream((ZSTD_DCtx *)pThis->zstdDctx, &output, &input);
            if (ZSTD_isError(remaining)) {
                logCompressedStreamFailure(pThis, "received invalid compressed stream", ZSTD_getErrorName(remaining));
                ABORT_FINALIZE(RS_RET_ZLIB_ERR);
            }

            if (output.pos != 0) {
                CHKiRet(checkDecompressedBytesLimit(pThis, guard, output.pos));
                STATSCOUNTER_ADD(pThis->pLstnInfo->ctrBytesDecompressed, pThis->pLstnInfo->mutCtrBytesDecompressed,
                                 output.pos);
                CHKiRet(DataRcvdUncompressedFromStream(pThis, (char *)out, output.pos, 0));
            }

            if (remaining == 0) {
                pThis->compressedStreamEnded = 1;
                if (input.pos != input.size ||
                    (pThis->compressionMaxTotalZstdWindowBytes != 0 && input_part == 0 && iLen != input_offset)) {
                    logCompressedStreamFailure(pThis, "received invalid compressed stream",
                                               "data after end of zstd stream");
                    ABORT_FINALIZE(RS_RET_ZLIB_ERR);
                }
                ZSTD_freeDCtx((ZSTD_DCtx *)pThis->zstdDctx);
                pThis->zstdDctx = NULL;
                release_zstd_window_reservation(pThis);
                break;
            }

            if (input.pos == old_input_pos && output.pos == 0) {
                break;
            }
        } while (input.pos < input.size || output.pos == output.size);

        if (pThis->compressedStreamEnded) {
            break;
        }
    }
    if (pThis->compressionMaxTotalZstdWindowBytes != 0 && pThis->zstd_frame_header_processed) {
        /* Incomplete headers exit through FINALIZE above and remain buffered across receives. */
        pThis->zstd_frame_header_len = 0;
    }

finalize_it:
    if (iRet != RS_RET_OK) {
        ZSTD_freeDCtx((ZSTD_DCtx *)pThis->zstdDctx);
        pThis->zstdDctx = NULL;
        release_zstd_window_reservation(pThis);
    }
    RETiRet;
#else
    DEFiRet;
    (void)pData;
    (void)iLen;
    (void)guard;
    logCompressedStreamFailure(pThis, "received invalid compressed stream", "zstd support is not built in");
    ABORT_FINALIZE(RS_RET_ZLIB_ERR);
finalize_it:
    RETiRet;
#endif
}

static rsRetVal finishCompressedStream(tcps_sess_t *pThis) {
    DEFiRet;

    if (pThis->compressionMode != TCPSRV_COMPRESS_STREAM_ALWAYS) {
        FINALIZE;
    }
    if (pThis->compressedStreamFailed) {
        FINALIZE;
    }

    if (pThis->compressionDriver == TCPSRV_COMPRESS_DRIVER_ZLIB) {
        if (!pThis->zipInitDone || pThis->compressedStreamEnded) {
            FINALIZE;
        }
        logCompressedStreamFailure(pThis, "detected truncated compressed stream", "zlib stream ended before trailer");
        release_zlib_decoder(pThis);
        ABORT_FINALIZE(RS_RET_ZLIB_ERR);
    }

    if (pThis->compressionDriver == TCPSRV_COMPRESS_DRIVER_ZSTD && !pThis->compressedStreamEnded) {
        if (pThis->zstdDctx == NULL && pThis->zstd_frame_header_len == 0) {
            FINALIZE;
        }
        logCompressedStreamFailure(pThis, "detected truncated compressed stream", "zstd stream ended before trailer");
        ABORT_FINALIZE(RS_RET_ZLIB_ERR);
    }

finalize_it:
    RETiRet;
}

static rsRetVal DataRcvd(tcps_sess_t *pThis, char *pData, const size_t iLen) {
    DEFiRet;

    ISOBJ_TYPE_assert(pThis, tcps_sess);
    assert(pData != NULL);
    assert(iLen > 0);

    STATSCOUNTER_ADD(pThis->pLstnInfo->ctrBytesRcvd, pThis->pLstnInfo->mutCtrBytesRcvd, iLen);

    if (pThis->compressionMode != TCPSRV_COMPRESS_STREAM_ALWAYS) {
        CHKiRet(DataRcvdUncompressed(pThis, pData, iLen, 1));
    } else {
        if (UINT64_MAX - pThis->compressionTotalBytesIn < iLen) {
            logCompressedStreamFailure(pThis, "received invalid compressed stream",
                                       "stream compressed byte counter overflowed");
            ABORT_FINALIZE(RS_RET_ZLIB_ERR);
        }
        pThis->compressionTotalBytesIn += iLen;
        decompressReceiveGuard_t guard = {.decompressedBytes = 0};
        if (pThis->compressionDriver == TCPSRV_COMPRESS_DRIVER_ZSTD) {
            CHKiRet(DataRcvdCompressedZstd(pThis, pData, iLen, &guard));
        } else {
            CHKiRet(DataRcvdCompressedZlib(pThis, pData, iLen, &guard));
        }
    }

finalize_it:
    RETiRet;
}


/* queryInterface function
 * rgerhards, 2008-02-29
 */
BEGINobjQueryInterface(tcps_sess)
    CODESTARTobjQueryInterface(tcps_sess);
    if (pIf->ifVersion != tcps_sessCURR_IF_VERSION) { /* check for current version, increment on each change */
        ABORT_FINALIZE(RS_RET_INTERFACE_NOT_SUPPORTED);
    }

    /* ok, we have the right interface, so let's fill it
     * Please note that we may also do some backwards-compatibility
     * work here (if we can support an older interface version - that,
     * of course, also affects the "if" above).
     */
    pIf->DebugPrint = tcps_sessDebugPrint;
    pIf->Construct = tcps_sessConstruct;
    pIf->ConstructFinalize = tcps_sessConstructFinalize;
    pIf->Destruct = tcps_sessDestruct;

    pIf->PrepareClose = PrepareClose;
    pIf->Close = Close;
    pIf->DataRcvd = DataRcvd;

    pIf->SetUsrP = SetUsrP;
    pIf->SetTcpsrv = SetTcpsrv;
    pIf->SetLstnInfo = SetLstnInfo;
    pIf->SetHost = SetHost;
    pIf->SetHostIP = SetHostIP;
    pIf->SetHostPort = SetHostPort;
    pIf->SetStrm = SetStrm;
    pIf->SetMsgIdx = SetMsgIdx;
    pIf->SetOnMsgReceive = SetOnMsgReceive;
finalize_it:
ENDobjQueryInterface(tcps_sess)


/* exit our class
 * rgerhards, 2008-03-10
 */
BEGINObjClassExit(tcps_sess, OBJ_IS_LOADABLE_MODULE) /* CHANGE class also in END MACRO! */
    CODESTARTObjClassExit(tcps_sess);
    /* release objects we no longer need */
    objRelease(netstrm, LM_NETSTRMS_FILENAME);
    objRelease(datetime, CORE_COMPONENT);
    objRelease(prop, CORE_COMPONENT);
#ifdef FEATURE_REGEXP
    objRelease(regexp, LM_REGEXP_FILENAME);
#endif
ENDObjClassExit(tcps_sess)


/* Initialize our class. Must be called as the very first method
 * before anything else is called inside this class.
 * rgerhards, 2008-02-29
 */
BEGINObjClassInit(tcps_sess, 1, OBJ_IS_CORE_MODULE) /* class, version - CHANGE class also in END MACRO! */
    /* request objects we use */
    CHKiRet(objUse(netstrm, LM_NETSTRMS_FILENAME));
    CHKiRet(objUse(datetime, CORE_COMPONENT));
    CHKiRet(objUse(prop, CORE_COMPONENT));
#ifdef FEATURE_REGEXP
    CHKiRet(objUse(regexp, LM_REGEXP_FILENAME));
#endif

    CHKiRet(objUse(glbl, CORE_COMPONENT));
    objRelease(glbl, CORE_COMPONENT);

    /* set our own handlers */
    OBJSetMethodHandler(objMethod_DEBUGPRINT, tcps_sessDebugPrint);
    OBJSetMethodHandler(objMethod_CONSTRUCTION_FINALIZER, tcps_sessConstructFinalize);
ENDObjClassInit(tcps_sess)

/* vim:set ai:
 */
