templ-tcp-hdr.c

/*
 This module edits an existing TCP packet, adding and removing
 options, setting the values of certain fields.

 From RFC793:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |          Source Port          |       Destination Port        |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |                        Sequence Number                        |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |                    Acknowledgment Number                      |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |  Data |           |U|A|P|R|S|F|                               |
 | Offset| Reserved  |R|C|S|S|Y|I|            Window             |
 |       |           |G|K|H|T|N|N|                               |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |           Checksum            |         Urgent Pointer        |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |                    Options                    |    Padding    |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |                             data                              |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 TCP Window Scale Option (WSopt):
 Kind: 3 Length: 3 bytes
 +---------+---------+---------+
 | Kind=3  |Length=3 |shift.cnt|
 +---------+---------+---------+

 TCP Timestamps Option (TSopt):
 Kind: 8
 Length: 10 bytes
 +-------+-------+---------------------+---------------------+
 |Kind=8 |  10   |   TS Value (TSval)  |TS Echo Reply (TSecr)|
 +-------+-------+---------------------+---------------------+
 1       1              4                     4

 TCP Sack-Permitted Option:
 Kind: 4
 +---------+---------+
 | Kind=4  | Length=2|
 +---------+---------+


 TCP SACK Option:
 Kind: 5
 Length: Variable

 +--------+--------+
 | Kind=5 | Length |
 +--------+--------+--------+--------+
 |      Left Edge of 1st Block       |
 +--------+--------+--------+--------+
 |      Right Edge of 1st Block      |
 +--------+--------+--------+--------+
 |                                   |
 /            . . .                  /
 |                                   |
 +--------+--------+--------+--------+
 |      Left Edge of nth Block       |
 +--------+--------+--------+--------+
 |      Right Edge of nth Block      |
 +--------+--------+--------+--------+

 */
#include "templ-tcp-hdr.h"
#include "templ-opts.h"
#include "logger.h"
#include "proto-preprocess.h"
#include <string.h>
#include <stdlib.h>
#include <ctype.h>

struct tcp_opt_t {
    const unsigned char *buf;
    size_t length;
    unsigned kind;
    bool is_found;
};

struct tcp_hdr_t {
    size_t begin;
    size_t max;
    size_t ip_offset;
    unsigned char ip_version;
    bool is_found;
};

/**
 * Do a memmove() of a chunk of memory within a buffer with bounds checking.
 */
static void
safe_memmove(unsigned char *buf, size_t length, size_t to, size_t from, size_t chunklength) {
    if (chunklength + to > length) {
        fprintf(stderr, "+"); fflush(stderr);
        chunklength = length - to;
    }
    if (chunklength + from > length) {
        fprintf(stderr, "-"); fflush(stderr);
        chunklength = length - from;
    }
    memmove(buf + to, buf + from, chunklength);
}

/**
 * Do a memset() of a chunk of memory within a buffer with bounds checking
 */
static void
safe_memset(unsigned char *buf, size_t length, size_t offset, int c, size_t chunklength) {
    if (chunklength + offset > length) {
        chunklength = length - offset;
        fprintf(stderr, "*"); fflush(stderr);
    }
    memset(buf + offset, c, chunklength);
}

/***************************************************************************
 * A typical hexdump function, but dumps specifically the <options-list>
 * section of a TCP header. An added feature is that it marks the byte
 * at "offset". This makes debugging easier, so I can see the <options-list>
 * as I'm stepping through code. You'll see this commented-out throughout
 * the code.
 ***************************************************************************/
static void
_HEXDUMP(const void *v, struct tcp_hdr_t hdr, size_t offset, const char *name)
{
    const unsigned char *p = ((const unsigned char *)v) + hdr.begin + 20;
    size_t i;
    size_t len = hdr.max - hdr.begin + 8 - 20;

    printf("%s:\n", name);
    offset -= hdr.begin + 20;

    for (i=0; i<len; i += 16) {
        size_t j;

        for (j=i; j<i+16 && j<len; j++) {
            char c = ' ';
            if (j == offset)
                c = '>';
            if (j + 1 == offset)
                c = '<';
            printf("%02x%c", p[j], c);
        }
        for (;j<i+16; j++)
            printf("   ");
        printf("  ");
        for (j=i; j<i+16 && j<len; j++) {
            char c = p[j];

            if (j == offset)
                c = '#';

            if (isprint(c&0xff) && !isspace(c&0xff))
                printf("%c", c);
            else
                printf(".");
        }
        printf("\n");
    }
}



/***************************************************************************
 * A quick macro to calculate the TCP header length, given a buffer
 * and an offset to the start of the TCP header.
 ***************************************************************************/
static unsigned inline
_tcp_header_length(const unsigned char *buf, size_t offset) {
    return (buf[offset + 12] >> 4) * 4;
}

/***************************************************************************
 * Does a consistency check of the whole packet, including IP header,
 * TCP header, and the options in the <options-list> field. This is used
 * in the self-test feature after test cases, to make sure the packet
 * hasn't bee corrupted.
 ***************************************************************************/
static int
_consistancy_check(const unsigned char *buf, size_t length,
                   const void *payload, size_t payload_length) {
    struct PreprocessedInfo parsed;
    unsigned is_success;

    /* Parse the packet */
    is_success = preprocess_frame(buf,
                                  (unsigned)length,
                                  1 /*enet*/,
                                  &parsed);
    if (!is_success || parsed.found != FOUND_TCP) {
        fprintf(stderr, "[-] check: TCP header not found\n");
        goto fail;
    }

    /* Check the lengths */
    switch (parsed.ip_version) {
        case 4:
            if (parsed.ip_length + 14 != length) {
                fprintf(stderr, "[-] check: IP length bad\n");
                goto fail;
            }
            break;
        case 6:
            break;
        default:
            fprintf(stderr, "[-] check: IPv?\n");
            goto fail;
    }

    /* Validate TCP header options */
    {
        size_t offset = parsed.transport_offset;
        size_t max = offset + _tcp_header_length(buf, offset);

        /* Get the start of the <options> section of the header. This is defined
         * as 20 bytes into the TCP header. */
        offset += 20;

        /* Enumerate any existing options one-by-one.  */
        while (offset < max) {
            unsigned kind;
            unsigned len;

            /* Get the option type (aka. "kind") */
            kind = buf[offset++];

            if (kind == 0x00) {
                /* EOL - end of options list
                 * According to the spec, processing should stop here, even if
                 * there are additional options after this point. */
                break;
            } else if (kind == 0x01) {
                /* NOP - No-operation
                 * This is a single byte option, used to pad other options to
                 * even 4 byte boundaries. Padding is optional. */
                continue;
            }

            /* If we've reached the end of */
            if (offset > max)
                goto fail;
            if (offset == max)
                break;
            len = buf[offset++];

            /* Check for corruption, the lenth field is inclusive, so should
             * equal at least two. It's maximum length should be bfore the end
             * of the packet */
            if (len < 2 || len > (max-offset+2)) {
                goto fail;
            }

            offset += len - 2;
        }
    }

    /* Check the payload */
    if (parsed.app_length != payload_length)
        goto fail;
    if (memcmp(buf + parsed.app_offset, payload, payload_length) != 0)
        goto fail;

    return 0;
fail:
    return 1;
}

/***************************************************************************
 * Find the TCP header in the packet. We can't be sure what's in the
 * current template because it could've been provided by the user, so
 * we instead parse it as if we've received it from the network wire.
 ***************************************************************************/
static struct tcp_hdr_t
_find_tcp_header(const unsigned char *buf, size_t length) {
    struct tcp_hdr_t hdr = {0};
    struct PreprocessedInfo parsed;
    unsigned is_success;

    /*
     * Parse the packet, telling us where the TCP header is. This works
     * for both IPv4 and IPv6, we care only about the TCP header portion.
     */
    is_success = preprocess_frame(buf, /* the packet, including Ethernet hdr */
                                  (unsigned)length,
                                  1 /*enet*/,
                                  &parsed);
    if (!is_success || parsed.found != FOUND_TCP) {
        /* We were unable to parse a well-formatted TCP packet. This
         * might've been UDP or something. */
        goto fail;
    }

    hdr.begin = parsed.transport_offset;
    hdr.max = hdr.begin + _tcp_header_length(buf, hdr.begin);
    hdr.ip_offset = parsed.ip_offset;
    hdr.ip_version = (unsigned char)parsed.ip_version;
    hdr.is_found = true;
    return hdr;

fail:
    hdr.is_found = false;
    return hdr;
}

/***************************************************************************
 * A quick macro at the start of for(;;) loops that enumerate all the
 * options in the <option-list>
 ***************************************************************************/
static inline size_t
_opt_begin(struct tcp_hdr_t hdr) {
    return hdr.begin + 20; /* start of <options> field */
}

/***************************************************************************
 * A quick macro in the for(;;) loop that enumerates all the options
 * in the <option-list>. It has three possibilities based on the KIND:
 * 0x00 - we've reached the end of the options-list
 * 0x01 - padding NOP byte, which we skipo
 * 0x?? - some option, the following byte is the length. We skip
 *        that `len` bytes.
 ***************************************************************************/
static inline size_t
_opt_next(struct tcp_hdr_t hdr, size_t offset, const unsigned char *buf) {
    unsigned kind = buf[offset];
    if (kind == 0x00) {
        return hdr.max;
    } else if (kind == 0x01) {
        return offset + 1;
    } else if (offset + 2 > hdr.max) {
        return hdr.max; /* corruption */
    } else {
        unsigned len = buf[offset+1];
        if (len < 2 || offset + len > hdr.max)
            return hdr.max; /* corruption */
        else
            return offset + len;
    }
}

/***************************************************************************
 ***************************************************************************/
static void
_HEXDUMPopt(const unsigned char *buf, size_t length, const char *name) {
    struct tcp_hdr_t hdr;

    hdr = _find_tcp_header(buf, length);
    if (!hdr.is_found) {
        fprintf(stderr, "[-] templ.tcp.hdr: failure\n");
    }
    _HEXDUMP(buf, hdr, _opt_begin(hdr), name);
}

/***************************************************************************
 * Search throgh the <option-list> until we find the specified option,
 * 'kind', or reach the end of the list. An impossible 'kind', like 0x100,
 * will force finding the end of the list before padding starts.
 ***************************************************************************/
static size_t
_find_opt(const unsigned char *buf, struct tcp_hdr_t hdr, unsigned in_kind,
          unsigned *nop_count) {
    size_t offset;

    /* This field is optional, if used, set it to zero */
    if (nop_count)
        *nop_count = 0;

    /* enumerate all <options> looking for a match */
    for (offset = _opt_begin(hdr);
         offset < hdr.max;
         offset = _opt_next(hdr, offset, buf)) {
        unsigned kind;

        /* get the option type/kind */
        kind = buf[offset];

        /* Stop search if we hit an EOL marker */
        if (kind == 0x00)
            break;

        /* Stop search when we find our option */
        if (kind == in_kind)
            break;

        /* Count the number of NOPs leading up to where we end */
        if (nop_count) {
            if (kind == 0x01)
                (*nop_count)++;
            else
                (*nop_count) = 0;
        }
    }
    return offset;
}

/***************************************************************************
 * Search the TCP header's <options> field for the specified kind/type.
 * Typical kinds of options are MSS, window scale, SACK, timestamp.
 ***************************************************************************/
static struct tcp_opt_t
tcp_find_opt(const unsigned char *buf, size_t length, unsigned in_kind) {
    struct tcp_opt_t result = {0};
    struct tcp_hdr_t hdr;
    size_t offset;

    /* Get the TCP header in the packet */
    hdr = _find_tcp_header(buf, length);
    if (!hdr.is_found)
        goto fail;

    /* Search for a matchin <option> */
    offset = _find_opt(buf, hdr, in_kind, 0);
    if (offset >= hdr.max || buf[offset] != in_kind)
        goto fail;

    /* We've found it! If we've passed all the checks above, we have
     * a well formatted field, so just return it. */
    result.kind = in_kind;
    result.buf = buf + offset + 2;
    result.length = buf[offset+1] - 2;
    if (offset + result.length >= hdr.max)
        goto fail;
    result.is_found = true;
    return result;

fail:
    result.is_found = false;
    return result;
}

/***************************************************************************
 * Adjusts the IP "total length" and TCP "header length" fields to match
 * recent additions/removals of options in the <option-list>
 ***************************************************************************/
static void
_adjust_length(unsigned char *buf, size_t length, int adjustment, struct tcp_hdr_t hdr) {
    size_t ip_offset = hdr.ip_offset;

    /* The adjustment should already have been aligned on an even 4 byte
     * boundary */
    if ((adjustment & 0x3) != 0) {
        fprintf(stderr, "[-] templ.tcp: impossible alignment error\n");
        return;
    }

    /* Adjust the IP header length */
    switch (hdr.ip_version) {
        case 4: {
            unsigned total_length;
            total_length = buf[ip_offset+2] << 8 | buf[ip_offset+3] << 0;
            total_length += adjustment;
            buf[ip_offset+2] = (unsigned char)(total_length>>8);
            buf[ip_offset+3] = (unsigned char)(total_length>>0);
            total_length = buf[ip_offset+2] << 8 |buf[ip_offset+3] << 0;
            if (total_length + 14 != length) {
                fprintf(stderr, "[-] IP length mismatch\n");
            }
            break;
        }
        case 6: {
            unsigned payload_length;
            payload_length = buf[ip_offset+4] << 8 | buf[ip_offset+5] << 0;
            payload_length += adjustment;
            buf[ip_offset+4] = (unsigned char)(payload_length>>8);
            buf[ip_offset+5] = (unsigned char)(payload_length>>0);
            break;
        }
    }

    /* Adjust the TCP header length */
    {
        size_t hdr_length;
        size_t offset = hdr.begin + 12;

        hdr_length = (buf[offset] >> 4) * 4;

        hdr_length += adjustment;

        if (hdr_length % 4 != 0) {
            fprintf(stderr, "[-] templ.tcp corruptoin\n");
        }

        buf[offset] = (unsigned char)((buf[offset] & 0x0F) | ((hdr_length/4) << 4));

        hdr_length = (buf[offset] >> 4) * 4;
        if (hdr.begin + hdr_length > length) {
            fprintf(stderr, "[-] templ.tcp corruptoin\n");
        }
    }
}

/***************************************************************************
 * After adding/removing an option, the <option-list> may no longer be
 * aligned on an even 4-byte boundary as required. This function
 * adds padding as necessary to align to the boundary.
 ***************************************************************************/
static void
_add_padding(unsigned char **inout_buf, size_t *inout_length, size_t offset, unsigned pad_count) {
    unsigned char *buf = *inout_buf;
    size_t length = *inout_length;

    length += pad_count;
    buf = realloc(buf, length);

    /* open space between headers and payload */
    safe_memmove(buf, length,
                offset + pad_count,
                offset,
                (length - pad_count) - offset);

    /* set padding to zero */
    safe_memset(buf, length,
                offset, 0, pad_count);

    /* Set the out parameters */
    *inout_buf = buf;
    *inout_length = length;
}

/***************************************************************************
 * Afte changes, there my be more padding bytes than necessary. This
 * reduces the number to 3 or less. Also, it changes any trailing NOPs
 * to EOL bytes, since there are no more options after that point.
 ***************************************************************************/
static bool
_normalize_padding(unsigned char **inout_buf, size_t *inout_length) {
    unsigned char *buf = *inout_buf;
    size_t length = *inout_length;
    struct tcp_hdr_t hdr;
    size_t offset;
    unsigned nop_count = 0;

    /* find TCP header */
    hdr = _find_tcp_header(buf, length);
    if (!hdr.is_found)
        goto fail;


    /* find the start of the padding field  */
    offset = _find_opt(buf, hdr, 0x100, &nop_count);
    if (offset >= hdr.max && nop_count == 0)
        goto success; /* no padding needing to be removed */

    /* If NOPs immediately before EOL, include them too */
    offset -= nop_count;

    {
        size_t remove_count = hdr.max - offset;

        /* the amount removed must be aligned on 4-byte boundary */
        while (remove_count % 4)
            remove_count--;

        /* If we have nothing left to remove, then exit.
         * THIS IS THE NORMAL CASE -- most of the time, we have no
         * extra padding to remove. */
        if (remove_count == 0)
            goto fail; /* likely, normal*/

        //_HEXDUMP(buf, hdr, offset, "before padding removal");

        safe_memmove(buf, length,
                        offset,
                        offset + remove_count,
                        length - (offset + remove_count));
        hdr.max -= remove_count;
        length -= remove_count;

        /* normalize all the bytes to zero, in case they aren't already */
        safe_memset(buf, length, offset, 0, hdr.max - offset);

        //_HEXDUMP(buf, hdr, offset, "after padding removal");

        /* fix the IP and TCP length fields */
        _adjust_length(buf, length, 0 - (int)remove_count, hdr);
    }

success:
    *inout_buf = buf;
    *inout_length = length;
    return true; /* success */
fail:
    *inout_buf = buf;
    *inout_length = length;
    return false; /* failure */

}


/***************************************************************************
 ***************************************************************************/
static bool
tcp_remove_opt(
        unsigned char **inout_buf, size_t *inout_length, unsigned in_kind
               ) {
    unsigned char *buf = *inout_buf;
    size_t length = *inout_length;
    struct tcp_hdr_t hdr;
    size_t offset;
    unsigned nop_count = 0;

    /* find the TCP header */
    hdr = _find_tcp_header(buf, length);
    if (!hdr.is_found)
        goto fail;

    /* enumerate all the <options> looking for a match  */
    offset = _find_opt(buf, hdr, in_kind, &nop_count);
    if (offset + 2 >= hdr.max)
        goto success; /* not found, no matching option type/kind */


    {
        unsigned opt_len = buf[offset+1];
        unsigned remove_length = opt_len;

        if (offset + opt_len > hdr.max)
            goto fail;

        /* Remove any trailing NOPs */
        while (offset + remove_length < hdr.max
               && buf[offset + remove_length] == 1)
            remove_length++;

        /* Remove any leading NOPs */
        offset -= nop_count;
        remove_length += nop_count;

        /* Remove the bytes from the current packet buffer.
         * Before this will be the ...IP/TCP headers plus maybe some options.
         * After this will be maybe some options, padding, then the TCP payload
         * */

        //_HEXDUMP(buf, hdr, offset, "before removal");

        safe_memmove(buf, length,
                        offset,
                        offset + remove_length,
                        length - (offset + remove_length));
        hdr.max -= remove_length;
        length -= remove_length;

        //_HEXDUMP(buf, hdr, offset, "after removal");


        /* Now we may need to add back padding  */
        if (remove_length % 4) {
            unsigned add_length = (remove_length % 4);
            _add_padding(&buf, &length, hdr.max, add_length);
            remove_length -= add_length;
            hdr.max += add_length;
        }

        //_HEXDUMP(buf, hdr, offset, "padding added");

        /* fix the IP and TCP length fields */
        _adjust_length(buf, length, 0 - remove_length, hdr);

        /* In case we've padded the packet with four 0x00, get rid
         * of them */
        _normalize_padding(&buf, &length);
    }

success:
    *inout_buf = buf;
    *inout_length = length;
    return true;

fail:
    *inout_buf = buf;
    *inout_length = length;
    return false;
}

/***************************************************************************
 ***************************************************************************/
static int
_insert_field(unsigned char **inout_buf,
              size_t *inout_length,
              size_t offset_begin,
              size_t offset_end,
              const unsigned char *new_data,
              size_t new_length
              ) {
    unsigned char *buf = *inout_buf;
    size_t length = *inout_length;
    int adjust = 0;

    /* can theoreitcally be negative, but that's ok */
    adjust = (int)new_length - ((int)offset_end - (int)offset_begin);
    if (adjust > 0) {
        length += adjust;
        buf = realloc(buf, length);
        safe_memmove(buf, length,
                        offset_begin + new_length,
                        offset_end,
                        (length - adjust) - offset_end);
    }
    if (adjust < 0) {
        safe_memmove(buf, length,
                        offset_begin + new_length,
                        offset_end,
                        length - offset_end);
        length += adjust;
        buf = realloc(buf, length);
    }

    /**/
    memcpy(buf + offset_begin,
           new_data,
           new_length);

    *inout_buf = buf;
    *inout_length = length;

    return adjust;
}

/** Calculate the total number of padding bytes, both NOPs in the middle
 * and EOLs at the end. We call this when there's not enough space for
 * another option, and we want to remove all the padding. */
#if 0
static unsigned
_calc_padding(const unsigned char *buf, struct tcp_hdr_t hdr) {
    size_t offset;
    unsigned result = 0;

    /* enumerate through all <option> fields */
    for (offset = _opt_begin(hdr);
         offset < hdr.max;
         offset = _opt_next(hdr, offset, buf)) {
        unsigned kind;

        /* Get the kind: 0=EOL, 1=NOP, 2=MSS, 3=Wscale, etc. */
        kind = buf[offset];

        /* If EOL, we end here, and all the remainder bytes are counted
         * as padding. */
        if (kind == 0) {
            result += (hdr.max - offset);
            break;
        }

        /* If a NOP, then this is a padding byte */
        if (kind == 1)
            result++;
    }

    return result;
}
#endif

/***************************************************************************
 * Remove all the padding bytes, and return an offset to the beginning
 * of the rest of the option field.
 ***************************************************************************/
static size_t
_squeeze_padding(unsigned char *buf, size_t length, struct tcp_hdr_t hdr, unsigned in_kind) {
    size_t offset;
    unsigned nop_count = 0;

    for (offset = _opt_begin(hdr);
         offset < hdr.max;
         offset = _opt_next(hdr, offset, buf)) {
        unsigned kind;
        unsigned len;

        //_HEXDUMP(buf, hdr, offset, "squeeze");

        /* Get the kind: 0=EOL, 1=NOP, 2=MSS, 3=Wscale, etc. */
        kind = buf[offset];

        /* If a NOP padding, simply count it until we reach something
         * more interesting */
        if (kind == 0x01) {
            nop_count++;
            continue;
        }

        /* If end of option list, any remaining padding bytes are added */
        if (kind == 0x00) {
            /* normalize the padding at the end */
            offset -= nop_count;
            safe_memset(buf, length, offset, 0, hdr.max - offset);

            //_HEXDUMP(buf, hdr, offset, "null");

            return offset;
        }

        /* If we match an existing field, all those bytes become padding */
        if (kind == in_kind) {
            len = buf[offset+1];
            safe_memset(buf, length, offset, 0x01, len);
            nop_count++;

            //_HEXDUMP(buf, hdr, offset, "VVVVV");

            continue;
        }

        if (nop_count == 0)
            continue; /*no squeezing needed */

        /* move this field backward overwriting NOPs */
        len = buf[offset+1];
        safe_memmove(buf, length,
                        offset - nop_count,
                        offset,
                        len);

        //_HEXDUMP(buf, hdr, offset - nop_count, "<<<<");

        /* now write NOPs where this field used to be */
        safe_memset(buf, length, 
                    offset + len - nop_count, 0x01, nop_count);

        //_HEXDUMP(buf, hdr, offset + len - nop_count, "!!!!!");

        /* reset the <offset> to the end of this relocated field */
        offset -= nop_count;
        nop_count = 0;
    }

    /* if we reach the end, then there were only NOPs at the end and no
     * EOL byte, so simply zero them out */
    safe_memset(buf, length, 
                offset - nop_count, 0x00, nop_count);
    offset -= nop_count;

    //_HEXDUMP(buf, hdr, offset, "");

    return offset;
}


/***************************************************************************
 ***************************************************************************/
static bool
tcp_add_opt(unsigned char **inout_buf,
            size_t *inout_length,
            unsigned opt_kind,
            unsigned opt_length,
            const unsigned char *opt_data) {
    unsigned char *buf = *inout_buf;
    size_t length = *inout_length;
    struct tcp_hdr_t hdr;
    size_t offset;
    unsigned nop_count = 0;
    int adjust = 0;


    /* Check for corruption:
     * The maximum size of a TCP header is 60 bytes (0x0F * 4), and the
     * rest of the header takes up 20 bytes. The [kind,length] takes up
     * another 2 bytes. Thus, the max option length is 38 bytes */
    if (opt_length > 38) {
        fprintf(stderr, "[-] templ.tcp.add_opt: opt_len too large\n");
        goto fail;
    }


    /* find TCP header */
    hdr = _find_tcp_header(buf, length);
    if (!hdr.is_found)
        goto fail;

    /* enumerate all existing options looking match */
    offset = _find_opt(buf, hdr, opt_kind, &nop_count);

    {
        size_t old_begin;
        size_t old_end;
        unsigned char new_field[64];
        size_t new_length;

        /* Create a well-formatted field that will be inserted */
        new_length = 1 + 1 + opt_length;
        new_field[0] = (unsigned char)opt_kind;
        new_field[1] = (unsigned char)new_length;
        memcpy(new_field + 2, opt_data, opt_length);

        /* Calculate the begin/end of the existing field in the packet */
        old_begin = offset;
        if (old_begin >= hdr.max)
            old_end = hdr.max; /* will insert end of header */
        else if (buf[offset] == 0x00)
            old_end = hdr.max; /* will insert start of padding */
        else if (buf[offset] == opt_kind) { /* will replace old field */
            size_t len = buf[offset + 1];
            old_end = offset + len;
        } else {
            fprintf(stderr, "[-] not possible i09670t\n");
            return false;
        }

        /* If the existing space is too small, try to expand it by
         * using neighboring (leading, trailing) NOPs */
        while ((old_end-old_begin) < new_length) {
            if (nop_count) {
                nop_count--;
                old_begin--;
            } else if (old_end < hdr.max && buf[old_end] == 0x01) {
                old_end++;
            } else
                break;
        }

        /* If the existing space is too small, and we are at the end,
         * and there's pading, then try to use the padding */
        if ((old_end-old_begin) < new_length) {
            if (old_end < hdr.max) {
                if (buf[old_end] == 0x00) {
                    /* normalize padding to all zeroes */
                    safe_memset(buf, length, old_end, 0, hdr.max - old_end);

                    while ((old_end-old_begin) < new_length) {
                        if (old_end >= hdr.max)
                            break;
                        old_end++;
                    }
                }
            }
        }

        /* Make sure we have enough space in the header */
        {
            static const size_t max_tcp_hdr = (0xF0>>4) * 4; /* 60 */
            size_t added = new_length - (old_end - old_begin);
            if (hdr.max + added > hdr.begin + max_tcp_hdr) {
                //unsigned total_padding = _calc_padding(buf, hdr);
                old_begin = _squeeze_padding(buf, length, hdr, opt_kind);
                old_end = hdr.max;
            }
        }


        /* Now insert the option field into packet. This may change the
         * sizeof the packet. The amount changed is indicated by 'adjust' */
        adjust = _insert_field(&buf, &length,
                               old_begin, old_end,
                               new_field, new_length);
        hdr.max += adjust;
    }

    if (adjust) {

        /* TCP headers have to be aligned to 4 byte boundaries, so we may need
         * to add padding of 0 at the end of the header to handle this */
        if (adjust % 4 && adjust > 0) {
            unsigned add_length = 4 - (adjust % 4);
            _add_padding(&buf, &length, hdr.max, add_length);
            hdr.max += add_length;
            adjust += add_length;
        } else if (adjust % 4 && adjust < 0) {
            unsigned add_length = 0 - (adjust % 4);

            //_HEXDUMP(buf, hdr, hdr.max, "pad before");
            _add_padding(&buf, &length, hdr.max, add_length);
            hdr.max += add_length;
            adjust += add_length;

            //_HEXDUMP(buf, hdr, hdr.max, "pad after");
        }

        /* fix the IP and TCP length fields */
        _adjust_length(buf, length, adjust, hdr);

        /* In case we've padded the packet with four 0x00, get rid
         * of them */
        _normalize_padding(&buf, &length);
    }

    *inout_buf = buf;
    *inout_length = length;
    return true;

fail:
    /* no changes were made */
    *inout_buf = buf;
    *inout_length = length;
    return false;
}

/***************************************************************************
 ***************************************************************************/
static unsigned
tcp_get_mss(const unsigned char *buf, size_t length, bool *is_found) {
    struct tcp_opt_t opt;
    unsigned result = 0;

    opt = tcp_find_opt(buf, length, 2 /* MSS */);
    if (is_found)
        *is_found = opt.is_found;
    if (!opt.is_found)
        return 0xFFFFffff;

    if (opt.length != 2) {
        /* corrupt */
        if (is_found)
            *is_found = false;
        return 0xFFFFffff;
    }

    result = opt.buf[0] << 8 | opt.buf[1];

    return result;
}

/***************************************************************************
 ***************************************************************************/
static unsigned
tcp_get_wscale(const unsigned char *buf, size_t length, bool *is_found) {
    struct tcp_opt_t opt;
    unsigned result = 0;

    opt = tcp_find_opt(buf, length, 3 /* Wscale */);
    if (is_found)
        *is_found = opt.is_found;
    if (!opt.is_found)
        return 0xFFFFffff;

    if (opt.length != 1) {
        /* corrupt */
        if (is_found)
            *is_found = false;
        return 0xFFFFffff;
    }

    result = opt.buf[0];

    return result;
}

/***************************************************************************
 ***************************************************************************/
static unsigned
tcp_get_sackperm(const unsigned char *buf, size_t length, bool *is_found) {
    struct tcp_opt_t opt;

    opt = tcp_find_opt(buf, length, 3 /* Wscale */);
    if (is_found)
        *is_found = opt.is_found;
    if (!opt.is_found)
        return 0xFFFFffff;

    if (opt.length != 1) {
        /* corrupt */
        if (is_found)
            *is_found = false;
        return 0xFFFFffff;
    }

    return 0;
}

/***************************************************************************
 * Called at the end of configuration, to change the TCP header template
 * according to configuration. For example, we might add a "sackperm" field,
 * or delete an "mss" field, or change the value of "mss".
 ***************************************************************************/
void
templ_tcp_apply_options(unsigned char **inout_buf, size_t *inout_length,
                  const struct TemplateOptions *templ_opts) {
    unsigned char *buf = *inout_buf;
    size_t length = *inout_length;

    if (templ_opts == NULL)
        return;

    /* --tcp-mss <num>
     * Sets maximum segment size */
    if (templ_opts->tcp.is_mss == Remove) {
        tcp_remove_opt(&buf, &length, 2 /* mss */);
    } else if (templ_opts->tcp.is_mss == Add) {
        unsigned char field[2];
        field[0] = (unsigned char)(templ_opts->tcp.mss>>8);
        field[1] = (unsigned char)(templ_opts->tcp.mss>>0);
        tcp_add_opt(&buf, &length, 2, 2, field);
    }

    /* --tcp-sackok
     * Sets option flag that permits selective acknowledgements */
    if (templ_opts->tcp.is_sackok == Remove) {
        tcp_remove_opt(&buf, &length, 4 /* sackok */);
    } else if (templ_opts->tcp.is_sackok == Add) {
        tcp_add_opt(&buf, &length, 4, 0, (const unsigned char*)"");
    }

    /* --tcp-wscale <num>
     * Sets window scale option  */
    if (templ_opts->tcp.is_wscale == Remove) {
        tcp_remove_opt(&buf, &length, 3 /* wscale */);
    } else if (templ_opts->tcp.is_wscale == Add) {
        unsigned char field[1];
        field[0] = (unsigned char)templ_opts->tcp.wscale;
        tcp_add_opt(&buf, &length, 3, 1, field);
    }

    /* --tcp-ts <num>
     * Timestamp */
    if (templ_opts->tcp.is_tsecho == Remove) {
        tcp_remove_opt(&buf, &length, 8 /* ts */);
    } else if (templ_opts->tcp.is_tsecho == Add) {
        unsigned char field[10] = {0};
        field[0] = (unsigned char)(templ_opts->tcp.tsecho>>24);
        field[1] = (unsigned char)(templ_opts->tcp.tsecho>>16);
        field[2] = (unsigned char)(templ_opts->tcp.tsecho>>8);
        field[2] = (unsigned char)(templ_opts->tcp.tsecho>>0);
        tcp_add_opt(&buf, &length, 8, 8, field);
    }


    *inout_buf = buf;
    *inout_length = length;
}

/***************************************************************************
 * Used during selftests in order to create a known options field as the
 * starting before before changing it somehow, followed by using
 * _compare_options() to test whether the change succeeded.
 ***************************************************************************/
static bool
_replace_options(unsigned char **inout_buf, size_t *inout_length,
                        const char *new_options, size_t new_length) {
    unsigned char *buf = *inout_buf;
    size_t length = *inout_length;
    struct tcp_hdr_t hdr;
    size_t offset;
    size_t old_length;
    char newnew_options[40] = {0};
    int adjust = 0;

    /* Maximum length of the options field is 40 bytes */
    if (new_length > 40)
        goto fail;

    /* Pad new options to 4 byte boundary */
    memcpy(newnew_options, new_options, new_length);
    while (new_length % 4)
        new_length++;

    /* find TCP header */
    hdr = _find_tcp_header(buf, length);
    if (!hdr.is_found)
        goto fail;

    /* Find start of options field */
    offset = _opt_begin(hdr);
    old_length = hdr.max - offset;

    /* Either increase or decrease the old length appropriately */
    //_HEXDUMPopt(buf, length, "resize before");
    adjust = (int)(new_length - old_length);
    if (adjust > 0) {
        length += adjust;
        buf = realloc(buf, length);
        safe_memmove(buf, length,
                        hdr.max + adjust,
                        hdr.max,
                        (length - adjust) - hdr.max);
    }
    if (adjust < 0) {
        safe_memmove(   buf, length,
                        hdr.max + adjust,
                        hdr.max,
                        length - hdr.max);
        length += adjust;
        buf = realloc(buf, length);
    }

    
    /* Now that we've resized the options field, overright
     * it with then new field */
    memcpy(buf + offset, newnew_options, new_length);

    /* fix the IP and TCP length fields */
    _adjust_length(buf, length, adjust, hdr);

    //_HEXDUMPopt(buf, length, "resize after");


    *inout_buf = buf;
    *inout_length = length;
    return true;
fail:
    *inout_buf = buf;
    *inout_length = length;
    return false;
}

/***************************************************************************
 ***************************************************************************/
enum {
    TST_NONE,
    TST_PADDING,
    TST_ADD,
    TST_REMOVE,
};

/***************************************************************************
 * This structure specifies test cases for the sefltest function. Each
 * test has a pre-condition <options-list>, and option to add/remove, and
 * a post-condition <options-list> that should match the result.
 ***************************************************************************/
struct mytests_t {
    struct {
        const char *options;
        size_t length;
    } pre;
    struct {
        int opcode;
        const char *data;
        size_t length;
    } test;
    struct {
        const char *options;
        size_t length;
    } post;
};

/***************************************************************************
 * The following tests add/remove options to a test packet. The goal of
 * these tests is code-coverage of all the conditions above, testing
 * all the boundary cases. Every code path that produces success is tested,
 * plus many code paths that produce failures.
 ***************************************************************************/
static struct mytests_t
tests[] = {
    /* A lot of these tests use 2-byte (\4\2) and 3-byte (\3\3\3) options.
     * The "\4\2" is "SACK permitted, kind=4, len=2, with no extra data.
     * The "\3\3\3" is "Window Scale, kind=3, len=3, data=3.
     * The "\2\4\5\6" is "Max Segment Size", kind=2, len=4, data=0x0506
     */

    /* Attempt removal of an option that doesn't exist. This is not
     * a failure, but a success, though nothing is changed*/

    {   {"\3\3\3\0", 4},
        {TST_REMOVE, "\x08", 1},
        {"\3\3\3\0", 4}
    },


    /* Test removal of an option. This will also involve removing
     the now unnecessary padding */
    {   {"\3\3\3\1\1\1\x08\x0a\x1d\xe9\xb2\x98\x00\x00\x00\x00", 16},
        {TST_REMOVE, "\x08", 1},
        {"\3\3\3\0", 4}
    },

    /* Test when trying to add a big option that won't fit unless we get
     * rid of all the padding */
    {   {   "\x02\x04\x05\xb4"
            "\x01\x03\x03\x06"
            "\x01\x01\x08\x0a\x1d\xe9\xb2\x98\x00\x00\x00\x00"
            "\x04\x02\x00\x00"
            "\0\0\0\0",
            28},
        {   TST_ADD,
            "\7\x14" "AAAAAAAAAAAAAAAAAAAA",
            20
        },
        {   "\x02\x04\x05\xb4"
            "\x03\x03\x06"
            "\x08\x0a\x1d\xe9\xb2\x98\x00\x00\x00\x00"
            "\x04\x02"
            "\7\x14" "AAAAAAAAAAAAAAAAAA"
            "\0",
            40
        }
    },

    /* same as a bove, but field exists*/
    {{  "\x02\x04\x05\xb4"
        "\x01\x03\x03\x06"
        "\x01\x01\x08\x0a\x1d\xe9\xb2\x98\x00\x00\x00\x00"
        "\7\4\1\1"
        "\x04\x02\x00\x00",
        28},
        {   TST_ADD,
            "\7\x14" "AAAAAAAAAAAAAAAAAAAA",
            20
        },
        {   "\x02\x04\x05\xb4"
            "\x03\x03\x06"
            "\x08\x0a\x1d\xe9\xb2\x98\x00\x00\x00\x00"
            "\x04\x02"
            "\7\x14" "AAAAAAAAAAAAAAAAAA"
            "\0",
            40
        }
    },
    
    /* Add a new value to full packet  */
    {{"\3\3\3", 3}, {TST_ADD, "\4\2", 2}, {"\3\3\3\4\2\0\0\0", 8}},

    /* Change a 3 byte to 5 byte in middle of packet  */
    {{"\1\7\3\3\1\1\4\2", 8}, {TST_ADD, "\7\5\5\5\5", 5}, {"\7\5\5\5\5\1\4\2", 8}},

    /* Change 3 to 4 byte at start */
    {{"\7\3\3\1\2\4\5\6", 8}, {TST_ADD, "\7\4\4\4", 4}, {"\7\4\4\4\2\4\5\6", 8}},

    /* Change a 2-byte option */
    {{"\4\2", 2}, {TST_ADD, "\4\2", 2}, {"\4\2\0\0", 4}},

    /* Change a 3-byte option */
    {{"\3\3\2", 3}, {TST_ADD, "\3\3\3", 3}, {"\3\3\3\0", 4}},

    /* Change a 4-byte option */
    {{"\2\4\1\1", 4}, {TST_ADD, "\2\4\5\6", 4}, {"\2\4\5\6", 4}},

    /* Add a 2-byte option to empty packet*/
    {{"", 0}, {TST_ADD, "\4\2", 2}, {"\4\2\0\0", 4}},

    /* Add a 3-byte option to empty packet*/
    {{"", 0}, {TST_ADD, "\3\3\3", 3}, {"\3\3\3\0", 4}},

    /* Add a 4-byte option to empty packet*/
    {{"", 0}, {TST_ADD, "\2\4\5\6", 4}, {"\2\4\5\6", 4}},

    /* Empty packet: padding normalization should make no changes */
    {{"", 0}, {TST_PADDING,0,0}, {"", 0}},

    /* Empty packet plus 4 bytes of padding, should be removed */
    {{"\0", 1}, {TST_PADDING,0,0}, {"", 0}},

    /* 8 bytes of padding, should only remove all of them */
    {{"\0\0\0\0\0\0\0\0", 8}, {TST_PADDING,0,0}, {"", 0}},

    /* some padding is nops, should remove all  */
    {{"\1\1\0\0\0\0\0\0", 8}, {TST_PADDING,0,0}, {"", 0}},

    /* any trailing NOPs should be converted to EOLs  */
    {{"\3\3\3\1\0\0\0\0", 8}, {TST_PADDING,0,0}, {"\3\3\3\0", 4}},

    /* only NOPs should still be removed */
    {{"\3\3\3\1\1\1\1\1", 8}, {TST_PADDING,0,0}, {"\3\3\3\0", 4}},

    {{0}}
};


/***************************************************************************
 * This function runs through the tests in the [tests] array above. It
 * first creates a packet accoding to a pre-condition that may have
 * options already. We then call a function to manipulate the packet,
 * such as adding/changing an option. We then verify that that the
 * <option-list> field now matches the post-condition. Along the way,
 * we look for any errors are consistency failures.
 ***************************************************************************/
static int
_selftests_run(void) {
    static unsigned char templ[] =
    "\0\1\2\3\4\5"  /* Ethernet: destination */
    "\6\7\x8\x9\xa\xb"  /* Ethernet: source */
    "\x08\x00"      /* Ethernet type: IPv4 */
    "\x45"          /* IP type */
    "\x00"
    "\x00\x48"      /* total length = 64 bytes */
    "\x00\x00"      /* identification */
    "\x00\x00"      /* fragmentation flags */
    "\xFF\x06"      /* TTL=255, proto=TCP */
    "\xFF\xFF"      /* checksum */
    "\0\0\0\0"      /* source address */
    "\0\0\0\0"      /* destination address */

    "\0\0"          /* source port */
    "\0\0"          /* destination port */
    "\0\0\0\0"      /* sequence number */
    "\0\0\0\0"      /* ACK number */
    "\xB0"          /* header length */
    "\x02"          /* SYN */
    "\x04\x01"      /* window fixed to 1024 */
    "\xFF\xFF"      /* checksum */
    "\x00\x00"      /* urgent pointer */

    "\x02\x04\x05\xb4"
    "\x01\x03\x03\x06"
    "\x01\x01\x08\x0a\x1d\xe9\xb2\x98\x00\x00\x00\x00"
    "\x04\x02\x00\x00"
    "DeadBeef"
    ;
    size_t i;

    /* execute all tests */
    for (i=0; tests[i].pre.options; i++) {
        unsigned char *buf;
        size_t length = sizeof(templ) - 1;
        bool success;
        struct tcp_hdr_t hdr;
        const unsigned char *field;
        size_t field_length;


        LOG(1, "[+] templ-tcp-hdr: run #%u\n", (unsigned)i);

        /* Each tests creates its own copy of the test packet, which it
         * will then alter according to the pre-conditions. */
        buf = malloc(length);
        memcpy(buf, templ, length);

        /* Set the pre-condition <option-list> field by replacing what
         * was there with a completely new field */
        success = _replace_options(&buf, &length,
                         tests[i].pre.options, tests[i].pre.length);
        if (!success)
            goto fail; /* this should never happen */
        if (_consistancy_check(buf, length, "DeadBeef", 8))
            goto fail; /* this shoiuld never happen*/


        //_HEXDUMPopt(buf, length, "[PRE]");

        /*
         * Run the desired test
         */
        switch (tests[i].test.opcode) {
            case TST_PADDING:
                /* We are testing the "normalize padding" function. This
                 * is called after ever 'add' or 'remove' to make sure that
                 * the padding at the end is consistent. Mostly, it means
                 * that when we remove a field, we'll probably have excess
                 * padding at the end, which needs to be trimmed to the
                 * minimum amount of padding */
                success = _normalize_padding(&buf, &length);
                if (!success)
                    goto fail;
                break;
            case TST_ADD:
                /* We are testing `tcp_add_opt()` function, which is called
                 * to either 'add' or 'change' an existing option. */
                field = (const unsigned char*)tests[i].test.data;
                field_length = tests[i].test.length;
                if (field_length < 2)
                    goto fail;
                else {
                    unsigned opt_kind = field[0];
                    unsigned opt_length = field[1];
                    const unsigned char *opt_data = field + 2;

                    if (field_length != opt_length)
                        goto fail;

                    /* skip the KIND and LENGTH fields, justa DATA length */
                    opt_length -= 2;

                    success = tcp_add_opt(&buf, &length,
                                          opt_kind,
                                          opt_length,
                                          opt_data);
                    if (!success)
                        goto fail;
                }
                break;
            case TST_REMOVE:
                /* We are testing `tcp_add_opt()` function, which is called
                 * to either 'add' or 'change' an existing option. */
                field = (const unsigned char*)tests[i].test.data;
                field_length = tests[i].test.length;
                if (field_length != 1)
                    goto fail;
                else {
                    unsigned opt_kind = field[0];

                    success = tcp_remove_opt(&buf, &length,
                                          opt_kind);

                    if (!success)
                        goto fail;
                }
                break;
            default:
                return 1; /* fail */
        }

        //_HEXDUMPopt(buf, length, "[POST]");

        if (_consistancy_check(buf, length, "DeadBeef", 8))
            goto fail;

        /*
         * Make sure output matches expected results
         */
        {
            size_t offset;
            int err;
            size_t post_length;

            /* Find the <options-list> field */
            hdr = _find_tcp_header(buf, length);
            if (!hdr.is_found)
                goto fail;
            offset = _opt_begin(hdr);

            /* Make sure the length matches the expected length */
            post_length = hdr.max - offset;
            if (tests[i].post.length != post_length)
                goto fail;

            /* makre sure the contents of the field match expected */
            err = memcmp(tests[i].post.options, buf+offset, (hdr.max-offset));
            if (err) {
                _HEXDUMPopt(buf, length, "[-] failed expectations");
                goto fail;
            }
        }

        free(buf);
    }

    return 0; /* success */
fail:
    fprintf(stderr, "[-] templ.tcp.selftest failed, test #%u\n",
            (unsigned)i);
    return 1;
};

/***************************************************************************
 * These self-tests manipulate a TCP header, adding and removing <option>
 * fields in various scenarios. We expose the `tcp_add_option()` function
 * to the end-user via the command-line, so we have to anticipate that
 * the option they want added is going to be corrupt. For example, the
 * end-user might try to add an option that overflows the <option-list>
 * field, which is rather small (only 40 bytes long).
 ***************************************************************************/
int
templ_tcp_selftest(void) {

    static unsigned char templ[] =
    "\0\1\2\3\4\5"  /* Ethernet: destination */
    "\6\7\x8\x9\xa\xb"  /* Ethernet: source */
    "\x08\x00"      /* Ethernet type: IPv4 */
    "\x45"          /* IP type */
    "\x00"
    "\x00\x48"      /* total length = 64 bytes */
    "\x00\x00"      /* identification */
    "\x00\x00"      /* fragmentation flags */
    "\xFF\x06"      /* TTL=255, proto=TCP */
    "\xFF\xFF"      /* checksum */
    "\0\0\0\0"      /* source address */
    "\0\0\0\0"      /* destination address */

    "\0\0"          /* source port */
    "\0\0"          /* destination port */
    "\0\0\0\0"      /* sequence number */
    "\0\0\0\0"      /* ACK number */
    "\xB0"          /* header length */
    "\x02"          /* SYN */
    "\x04\x01"      /* window fixed to 1024 */
    "\xFF\xFF"      /* checksum */
    "\x00\x00"      /* urgent pointer */

    "\x02\x04\x05\xb4"
    "\x01\x03\x03\x06"
    "\x01\x01\x08\x0a\x1d\xe9\xb2\x98\x00\x00\x00\x00"
    "\x04\x02\x00\x00"
    "DeadBeef"
    ;
    size_t length = sizeof(templ) - 1;
    unsigned char *buf;

    /* Execute planned selftests */
    if (_selftests_run())
        return 1;

    /* We need to make an allocated copy of the buffer, because the
     * size may change from `realloc()` */
    buf = malloc(length);
    memcpy(buf, templ, length);

    /*
     * Make sure we start wtih an un-corrupted test packet
     */
    if (_consistancy_check(buf, length, "DeadBeef", 8))
        goto fail;

    if (1460 != tcp_get_mss(buf, length, 0))
        goto fail;
    if (6 != tcp_get_wscale(buf, length, 0))
        goto fail;
    if (0 != tcp_get_sackperm(buf, length, 0))
        goto fail;

    tcp_add_opt(&buf, &length, 2, 2, (const unsigned char*)"\x12\x34");
    if (0x1234 != tcp_get_mss(buf, length, 0))
        goto fail;
    if (_consistancy_check(buf, length, "DeadBeef", 8))
        goto fail;

    tcp_remove_opt(&buf, &length, 3);
    if (0x1234 != tcp_get_mss(buf, length, 0))
        goto fail;
    if (0xFFFFffff != tcp_get_wscale(buf, length, 0))
        goto fail;
    if (_consistancy_check(buf, length, "DeadBeef", 8))
        goto fail;


    free(buf);
    return 0; /* success */
fail:
    free(buf);
    return 1; /* failure */
}