Add the config directive compression-level
[privoxy.git] / jcc.c
diff --git a/jcc.c b/jcc.c
index 03b2431..06418a8 100644 (file)
--- a/jcc.c
+++ b/jcc.c
@@ -1,4 +1,4 @@
-const char jcc_rcs[] = "$Id: jcc.c,v 1.256 2009/06/11 11:49:11 fabiankeil Exp $";
+const char jcc_rcs[] = "$Id: jcc.c,v 1.354 2011/07/03 17:54:29 fabiankeil Exp $";
 /*********************************************************************
  *
  * File        :  $Source: /cvsroot/ijbswa/current/jcc.c,v $
@@ -6,7 +6,7 @@ const char jcc_rcs[] = "$Id: jcc.c,v 1.256 2009/06/11 11:49:11 fabiankeil Exp $"
  * Purpose     :  Main file.  Contains main() method, main loop, and
  *                the main connection-handling function.
  *
- * Copyright   :  Written by and Copyright (C) 2001-2009 the SourceForge
+ * Copyright   :  Written by and Copyright (C) 2001-2010 the
  *                Privoxy team. http://www.privoxy.org/
  *
  *                Based on the Internet Junkbuster originally written
@@ -119,8 +119,8 @@ const char jcc_rcs[] = "$Id: jcc.c,v 1.256 2009/06/11 11:49:11 fabiankeil Exp $"
 const char jcc_h_rcs[] = JCC_H_VERSION;
 const char project_h_rcs[] = PROJECT_H_VERSION;
 
-int no_daemon = 0;
-struct client_state  clients[1];
+int daemon_mode = 1;
+struct client_states clients[1];
 struct file_list     files[1];
 
 #ifdef FEATURE_STATISTICS
@@ -244,16 +244,6 @@ static const char INVALID_SERVER_HEADERS_RESPONSE[] =
    "Connection: close\r\n\r\n"
    "Bad response. The server or forwarder response doesn't look like HTTP.\r\n";
 
-#if 0
-/* XXX: should be a template */
-static const char NULL_BYTE_RESPONSE[] =
-   "HTTP/1.0 400 Bad request received from client\r\n"
-   "Proxy-Agent: Privoxy " VERSION "\r\n"
-   "Content-Type: text/plain\r\n"
-   "Connection: close\r\n\r\n"
-   "Bad request. Null byte(s) before end of request.\r\n";
-#endif
-
 /* XXX: should be a template */
 static const char MESSED_UP_REQUEST_RESPONSE[] =
    "HTTP/1.0 400 Malformed request after rewriting\r\n"
@@ -625,39 +615,39 @@ static const char *crunch_reason(const struct http_response *rsp)
       return "Internal error while searching for crunch reason";
    }
 
-   switch (rsp->reason)
+   switch (rsp->crunch_reason)
    {
-      case RSP_REASON_UNSUPPORTED:
+      case UNSUPPORTED:
          reason = "Unsupported HTTP feature";
          break;
-      case RSP_REASON_BLOCKED:
+      case BLOCKED:
          reason = "Blocked";
          break;
-      case RSP_REASON_UNTRUSTED:
+      case UNTRUSTED:
          reason = "Untrusted";
          break;
-      case RSP_REASON_REDIRECTED:
+      case REDIRECTED:
          reason = "Redirected";
          break;
-      case RSP_REASON_CGI_CALL:
+      case CGI_CALL:
          reason = "CGI Call";
          break;
-      case RSP_REASON_NO_SUCH_DOMAIN:
+      case NO_SUCH_DOMAIN:
          reason = "DNS failure";
          break;
-      case RSP_REASON_FORWARDING_FAILED:
+      case FORWARDING_FAILED:
          reason = "Forwarding failed";
          break;
-      case RSP_REASON_CONNECT_FAILED:
+      case CONNECT_FAILED:
          reason = "Connection failure";
          break;
-      case RSP_REASON_OUT_OF_MEMORY:
+      case OUT_OF_MEMORY:
          reason = "Out of memory (may mask other reasons)";
          break;
-      case RSP_REASON_CONNECTION_TIMEOUT:
+      case CONNECTION_TIMEOUT:
          reason = "Connection timeout";
          break;
-      case RSP_REASON_NO_SERVER_DATA:
+      case NO_SERVER_DATA:
          reason = "No server data received";
          break;
       default:
@@ -694,24 +684,12 @@ static void send_crunch_response(const struct client_state *csp, struct http_res
 
       if (rsp == NULL)
       {
-         /*
-          * Not supposed to happen. If it does
-          * anyway, treat it as an unknown error.
-          */
-         cgi_error_unknown(csp, rsp, RSP_REASON_INTERNAL_ERROR);
-         /* return code doesn't matter */
-      }
-
-      if (rsp == NULL)
-      {
-         /* If rsp is still NULL, we have serious internal problems. */
-         log_error(LOG_LEVEL_FATAL,
-            "NULL response in send_crunch_response and cgi_error_unknown failed as well.");
+         log_error(LOG_LEVEL_FATAL, "NULL response in send_crunch_response.");
       }
 
       /*
        * Extract the status code from the actual head
-       * that was send to the client. It is the only
+       * that will be send to the client. It is the only
        * way to get it right for all requests, including
        * the fixed ones for out-of-memory problems.
        *
@@ -724,19 +702,21 @@ static void send_crunch_response(const struct client_state *csp, struct http_res
       status_code[2] = rsp->head[11];
       status_code[3] = '\0';
 
+      /* Log that the request was crunched and why. */
+      log_error(LOG_LEVEL_CRUNCH, "%s: %s", crunch_reason(rsp), http->url);
+      log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" %s %u",
+         csp->ip_addr_str, http->ocmd, status_code, rsp->content_length);
+
       /* Write the answer to the client */
       if (write_socket(csp->cfd, rsp->head, rsp->head_length)
        || write_socket(csp->cfd, rsp->body, rsp->content_length))
       {
          /* There is nothing we can do about it. */
-         log_error(LOG_LEVEL_ERROR, "write to: %s failed: %E", csp->http->host);
+         log_error(LOG_LEVEL_ERROR,
+            "Couldn't deliver the error message through client socket %d: %E",
+            csp->cfd);
       }
 
-      /* Log that the request was crunched and why. */
-      log_error(LOG_LEVEL_CRUNCH, "%s: %s", crunch_reason(rsp), http->url);
-      log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" %s %u",
-         csp->ip_addr_str, http->ocmd, status_code, rsp->content_length);
-
       /* Clean up and return */
       if (cgi_error_memory() != rsp)
       {
@@ -746,68 +726,6 @@ static void send_crunch_response(const struct client_state *csp, struct http_res
 }
 
 
-#if 0
-/*********************************************************************
- *
- * Function    :  request_contains_null_bytes
- *
- * Description :  Checks for NULL bytes in the request and sends
- *                an error message to the client if any were found.
- *
- *                XXX: currently not used, see comment in chat().
- *
- * Parameters  :
- *          1  :  csp = Current client state (buffers, headers, etc...)
- *          2  :  buf = Data from the client's request to check.
- *          3  :  len = The data length.
- *
- * Returns     :  TRUE if the request contained one or more NULL bytes, or
- *                FALSE otherwise.
- *
- *********************************************************************/
-static int request_contains_null_bytes(const struct client_state *csp, char *buf, int len)
-{
-   size_t c_len; /* Request lenght when treated as C string */
-
-   c_len = strlen(buf);
-
-   if (c_len < len)
-   {
-      /*
-       * Null byte(s) found. Log the request,
-       * return an error response and hang up.
-       */
-      size_t tmp_len = c_len;
-
-      do
-      {
-        /*
-         * Replace NULL byte(s) with '°' characters
-         * so the request can be logged as string.
-         * XXX: Is there a better replacement character?
-         */
-         buf[tmp_len]='°';
-         tmp_len += strlen(buf+tmp_len);
-      } while (tmp_len < len);
-
-      log_error(LOG_LEVEL_ERROR, "%s\'s request contains at least one NULL byte "
-         "(length=%d, strlen=%u).", csp->ip_addr_str, len, c_len);
-      log_error(LOG_LEVEL_HEADER, 
-         "Offending request data with NULL bytes turned into \'°\' characters: %s", buf);
-
-      write_socket(csp->cfd, NULL_BYTE_RESPONSE, strlen(NULL_BYTE_RESPONSE));
-
-      /* XXX: Log correct size */
-      log_error(LOG_LEVEL_CLF, "%s - - [%T] \"Invalid request\" 400 0", csp->ip_addr_str);
-
-      return TRUE;
-   }
-
-   return FALSE;
-}
-#endif
-
-
 /*********************************************************************
  *
  * Function    :  crunch_response_triggered
@@ -838,6 +756,7 @@ static int crunch_response_triggered(struct client_state *csp, const struct crun
    {
       /* Deliver, log and free the interception response. */
       send_crunch_response(csp, rsp);
+      csp->flags |= CSP_FLAG_CRUNCHED;
       return TRUE;
    }
 
@@ -857,6 +776,7 @@ static int crunch_response_triggered(struct client_state *csp, const struct crun
          {
             /* Deliver, log and free the interception response. */
             send_crunch_response(csp, rsp);
+            csp->flags |= CSP_FLAG_CRUNCHED;
 #ifdef FEATURE_STATISTICS
             if (c->flags & CF_COUNT_AS_REJECT)
             {
@@ -1012,7 +932,7 @@ static int server_response_is_complete(struct client_state *csp,
       content_length_known = TRUE;
    }
 
-   if (csp->http->status == 304)
+   if (csp->http->status == 204 || csp->http->status == 304)
    {
       /*
        * Expect no body. XXX: incomplete "list" of status codes?
@@ -1026,6 +946,7 @@ static int server_response_is_complete(struct client_state *csp,
 }
 
 
+#ifdef FEATURE_CONNECTION_SHARING
 /*********************************************************************
  *
  * Function    :  wait_for_alive_connections
@@ -1053,6 +974,7 @@ static void wait_for_alive_connections(void)
    log_error(LOG_LEVEL_CONNECT, "No connections to wait for left.");
 
 }
+#endif /* def FEATURE_CONNECTION_SHARING */
 
 
 /*********************************************************************
@@ -1077,6 +999,8 @@ void save_connection_destination(jb_socket sfd,
 {
    assert(sfd != JB_INVALID_SOCKET);
    assert(NULL != http->host);
+
+   server_connection->sfd = sfd;
    server_connection->host = strdup(http->host);
    if (NULL == server_connection->host)
    {
@@ -1120,6 +1044,94 @@ void save_connection_destination(jb_socket sfd,
    }
    server_connection->forward_port = fwd->forward_port;
 }
+
+
+/*********************************************************************
+ *
+ * Function    : verify_request_length
+ *
+ * Description : Checks if we already got the whole client requests
+ *               and sets CSP_FLAG_CLIENT_REQUEST_COMPLETELY_READ if
+ *               we do.
+ *
+ *               Data that doesn't belong to the current request is
+ *               thrown away to let the client retry on a clean socket.
+ *
+ *               XXX: This is a hack until we can deal with multiple
+ *                    pipelined requests at the same time.
+ *
+ *
+ * Parameters  :
+ *          1  :  csp = Current client state (buffers, headers, etc...)
+ *
+ * Returns     :  void
+ *
+ *********************************************************************/
+static void verify_request_length(struct client_state *csp)
+{
+   unsigned long long buffered_request_bytes =
+      (unsigned long long)(csp->iob->eod - csp->iob->cur);
+
+   if ((csp->expected_client_content_length != 0)
+      && (buffered_request_bytes != 0))
+   {
+      if (csp->expected_client_content_length >= buffered_request_bytes)
+      {
+         csp->expected_client_content_length -= buffered_request_bytes;
+         log_error(LOG_LEVEL_CONNECT, "Reduced expected bytes to %llu "
+            "to account for the %llu ones we already got.",
+            csp->expected_client_content_length, buffered_request_bytes);
+      }
+      else
+      {
+         assert(csp->iob->eod > csp->iob->cur + csp->expected_client_content_length);
+         csp->iob->eod = csp->iob->cur + csp->expected_client_content_length;
+         log_error(LOG_LEVEL_CONNECT, "Reducing expected bytes to 0. "
+            "Marking the server socket tainted after throwing %llu bytes away.",
+            buffered_request_bytes - csp->expected_client_content_length);
+         csp->expected_client_content_length = 0;
+         csp->flags |= CSP_FLAG_SERVER_SOCKET_TAINTED;
+      }
+
+      if (csp->expected_client_content_length == 0)
+      {
+         csp->flags |= CSP_FLAG_CLIENT_REQUEST_COMPLETELY_READ;
+      }
+   }
+
+   if (!(csp->flags & CSP_FLAG_CLIENT_REQUEST_COMPLETELY_READ)
+    && ((csp->iob->cur[0] != '\0') || (csp->expected_client_content_length != 0)))
+   {
+      csp->flags |= CSP_FLAG_SERVER_SOCKET_TAINTED;
+      if (strcmpic(csp->http->gpc, "GET")
+         && strcmpic(csp->http->gpc, "HEAD")
+         && strcmpic(csp->http->gpc, "TRACE")
+         && strcmpic(csp->http->gpc, "OPTIONS")
+         && strcmpic(csp->http->gpc, "DELETE"))
+      {
+         /* XXX: this is an incomplete hack */
+         csp->flags &= ~CSP_FLAG_CLIENT_REQUEST_COMPLETELY_READ;
+         log_error(LOG_LEVEL_CONNECT,
+            "There might be a request body. The connection will not be kept alive.");
+      }
+      else
+      {
+         /* XXX: and so is this */
+         csp->flags |= CSP_FLAG_CLIENT_REQUEST_COMPLETELY_READ;
+         log_error(LOG_LEVEL_CONNECT,
+            "Possible pipeline attempt detected. The connection will not "
+            "be kept alive and we will only serve the first request.");
+         /* Nuke the pipelined requests from orbit, just to be sure. */
+         csp->iob->buf[0] = '\0';
+         csp->iob->eod = csp->iob->cur = csp->iob->buf;
+      }
+   }
+   else
+   {
+      csp->flags |= CSP_FLAG_CLIENT_REQUEST_COMPLETELY_READ;
+      log_error(LOG_LEVEL_CONNECT, "Complete client request received.");
+   }
+}
 #endif /* FEATURE_CONNECTION_KEEP_ALIVE */
 
 
@@ -1139,11 +1151,20 @@ void save_connection_destination(jb_socket sfd,
  *********************************************************************/
 static void mark_server_socket_tainted(struct client_state *csp)
 {
-   if ((csp->flags & CSP_FLAG_SERVER_CONNECTION_KEEP_ALIVE))
+   /*
+    * For consistency we always mark the server socket
+    * tainted, however, to reduce the log noise we only
+    * emit a log message if the server socket could have
+    * actually been reused.
+    */
+   if ((csp->flags & CSP_FLAG_SERVER_CONNECTION_KEEP_ALIVE)
+      && !(csp->flags |= CSP_FLAG_SERVER_SOCKET_TAINTED))
    {
-      log_error(LOG_LEVEL_CONNECT, "Unsetting keep-alive flag.");
-      csp->flags &= ~CSP_FLAG_SERVER_CONNECTION_KEEP_ALIVE;
+      log_error(LOG_LEVEL_CONNECT,
+         "Marking the server socket %d tainted.",
+         csp->server_connection.sfd);
    }
+   csp->flags |= CSP_FLAG_SERVER_SOCKET_TAINTED;
 }
 
 /*********************************************************************
@@ -1170,8 +1191,9 @@ static char *get_request_line(struct client_state *csp)
    {
       if (!data_is_available(csp->cfd, csp->config->socket_timeout))
       {
-         log_error(LOG_LEVEL_ERROR,
-            "Stopped waiting for the request line.");
+         log_error(LOG_LEVEL_CONNECT,
+            "Stopped waiting for the request line. Timeout: %d.",
+            csp->config->socket_timeout);
          write_socket(csp->cfd, CLIENT_CONNECTION_TIMEOUT_RESPONSE,
             strlen(CLIENT_CONNECTION_TIMEOUT_RESPONSE));
          return NULL;
@@ -1236,6 +1258,7 @@ static jb_err receive_client_request(struct client_state *csp)
    req = get_request_line(csp);
    if (req == NULL)
    {
+      mark_server_socket_tainted(csp);
       return JB_ERR_PARSE;
    }
    assert(*req != '\0');
@@ -1329,7 +1352,7 @@ static jb_err receive_client_request(struct client_state *csp)
       {
          /*
           * We were able to read a complete
-          * header and can finaly enlist it.
+          * header and can finally enlist it.
           */
          enlist(headers, p);
          freez(p);
@@ -1414,6 +1437,16 @@ static jb_err parse_client_request(struct client_state *csp)
    struct http_request *http = csp->http;
    jb_err err;
 
+#ifdef FEATURE_CONNECTION_KEEP_ALIVE
+   if ((csp->config->feature_flags & RUNTIME_FEATURE_CONNECTION_KEEP_ALIVE)
+    && (!strcmpic(csp->http->ver, "HTTP/1.1"))
+    && (csp->http->ssl == 0))
+   {
+      /* Assume persistence until further notice */
+      csp->flags |= CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE;
+   }
+#endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
+
    err = sed(csp, FILTER_CLIENT_HEADERS);
    if (JB_ERR_OK != err)
    {
@@ -1442,6 +1475,13 @@ static jb_err parse_client_request(struct client_state *csp)
       return JB_ERR_PARSE;
    }
 
+#ifdef FEATURE_CONNECTION_KEEP_ALIVE
+   if (csp->http->ssl == 0)
+   {
+      verify_request_length(csp);
+   }
+#endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
+
    return JB_ERR_OK;
 
 }
@@ -1451,11 +1491,16 @@ static jb_err parse_client_request(struct client_state *csp)
  *
  * Function    :  chat
  *
- * Description :  Once a connection to the client has been accepted,
+ * Description :  Once a connection from the client has been accepted,
  *                this function is called (via serve()) to handle the
- *                main business of the communication.  When this
- *                function returns, the caller must close the client
- *                socket handle.
+ *                main business of the communication.  This function
+ *                returns after dealing with a single request. It can
+ *                be called multiple times with the same client socket
+ *                if the client is keeping the connection alive.
+ *
+ *                The decision whether or not a client connection will
+ *                be kept alive is up to the caller which also must
+ *                close the client socket when done.
  *
  *                FIXME: chat is nearly thousand lines long.
  *                Ridiculous.
@@ -1477,18 +1522,17 @@ static void chat(struct client_state *csp)
    int server_body;
    int ms_iis5_hack = 0;
    unsigned long long byte_count = 0;
-   int forwarded_connect_retries = 0;
-   int max_forwarded_connect_retries = csp->config->forwarded_connect_retries;
    const struct forward_spec *fwd;
    struct http_request *http;
    long len = 0; /* for buffer sizes (and negative error codes) */
-
-   /* Function that does the content filtering for the current request */
-   filter_function_ptr content_filter = NULL;
+   int buffer_and_filter_content = 0;
 
    /* Skeleton for HTTP response, if we should intercept the request */
    struct http_response *rsp;
    struct timeval timeout;
+#ifdef FEATURE_CONNECTION_KEEP_ALIVE
+   int watch_client_socket = 1;
+#endif
 
    memset(buf, 0, sizeof(buf));
 
@@ -1555,8 +1599,8 @@ static void chat(struct client_state *csp)
          csp->action->string[ACTION_STRING_LIMIT_CONNECT];
       assert(NULL != acceptable_connect_ports);
       log_error(LOG_LEVEL_INFO, "Request from %s marked for blocking. "
-         "limit-connect{%s} doesn't allow CONNECT requests to port %d.",
-         csp->ip_addr_str, acceptable_connect_ports, csp->http->port);
+         "limit-connect{%s} doesn't allow CONNECT requests to %s",
+         csp->ip_addr_str, acceptable_connect_ports, csp->http->hostport);
       csp->action->flags |= ACTION_BLOCK;
       http->ssl = 0;
    }
@@ -1573,12 +1617,8 @@ static void chat(struct client_state *csp)
    if (crunch_response_triggered(csp, crunchers_all))
    {
       /*
-       * Yes. The client got the crunch response
-       * and we are done here after cleaning up.
+       * Yes. The client got the crunch response and we're done here.
        */
-      /* XXX: why list_remove_all()? */
-      list_remove_all(csp->headers);
-
       return;
    }
 
@@ -1597,36 +1637,29 @@ static void chat(struct client_state *csp)
    /* here we connect to the server, gateway, or the forwarder */
 
 #ifdef FEATURE_CONNECTION_KEEP_ALIVE
-   if ((csp->sfd != JB_INVALID_SOCKET)
-      && socket_is_still_usable(csp->sfd)
+   if ((csp->server_connection.sfd != JB_INVALID_SOCKET)
+      && socket_is_still_alive(csp->server_connection.sfd)
       && connection_destination_matches(&csp->server_connection, http, fwd))
    {
       log_error(LOG_LEVEL_CONNECT,
          "Reusing server socket %u. Opened for %s.",
-         csp->sfd, csp->server_connection.host);
+         csp->server_connection.sfd, csp->server_connection.host);
    }
    else
    {
-      if (csp->sfd != JB_INVALID_SOCKET)
+      if (csp->server_connection.sfd != JB_INVALID_SOCKET)
       {
          log_error(LOG_LEVEL_CONNECT,
             "Closing server socket %u. Opened for %s.",
-            csp->sfd, csp->server_connection.host);
-         close_socket(csp->sfd);
+            csp->server_connection.sfd, csp->server_connection.host);
+         close_socket(csp->server_connection.sfd);
          mark_connection_closed(&csp->server_connection);
       }
 #endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
 
-      while ((csp->sfd = forwarded_connect(fwd, http, csp))
-         && (errno == EINVAL)
-         && (forwarded_connect_retries++ < max_forwarded_connect_retries))
-      {
-         log_error(LOG_LEVEL_ERROR,
-            "failed request #%u to connect to %s. Trying again.",
-            forwarded_connect_retries, http->hostport);
-      }
+      csp->server_connection.sfd = forwarded_connect(fwd, http, csp);
 
-      if (csp->sfd == JB_INVALID_SOCKET)
+      if (csp->server_connection.sfd == JB_INVALID_SOCKET)
       {
          if (fwd->type != SOCKS_NONE)
          {
@@ -1640,8 +1673,6 @@ static void chat(struct client_state *csp)
          else
          {
             rsp = error_response(csp, "connect-failed");
-            log_error(LOG_LEVEL_CONNECT, "connect to: %s failed: %E",
-               http->hostport);
          }
 
          /* Write the answer to the client */
@@ -1653,8 +1684,10 @@ static void chat(struct client_state *csp)
          return;
       }
 #ifdef FEATURE_CONNECTION_KEEP_ALIVE
-      save_connection_destination(csp->sfd, http, fwd, &csp->server_connection);
-      csp->server_connection.keep_alive_timeout = (unsigned)csp->config->keep_alive_timeout;
+      save_connection_destination(csp->server_connection.sfd,
+         http, fwd, &csp->server_connection);
+      csp->server_connection.keep_alive_timeout =
+         (unsigned)csp->config->keep_alive_timeout;
    }
 #endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
 
@@ -1672,8 +1705,8 @@ static void chat(struct client_state *csp)
        * Write the client's (modified) header to the server
        * (along with anything else that may be in the buffer)
        */
-      if (write_socket(csp->sfd, hdr, strlen(hdr))
-       || (flush_socket(csp->sfd, csp->iob) <  0))
+      if (write_socket(csp->server_connection.sfd, hdr, strlen(hdr))
+       || (flush_socket(csp->server_connection.sfd, csp->iob) <  0))
       {
          log_error(LOG_LEVEL_CONNECT,
             "write header to: %s failed: %E", http->hostport);
@@ -1705,10 +1738,13 @@ static void chat(struct client_state *csp)
 
    log_error(LOG_LEVEL_CONNECT, "to %s successful", http->hostport);
 
+   csp->server_connection.request_sent = time(NULL);
+
    /* we're finished with the client's header */
    freez(hdr);
 
-   maxfd = (csp->cfd > csp->sfd) ? csp->cfd : csp->sfd;
+   maxfd = (csp->cfd > csp->server_connection.sfd) ?
+      csp->cfd : csp->server_connection.sfd;
 
    /* pass data between the client and server
     * until one or the other shuts down the connection.
@@ -1727,8 +1763,18 @@ static void chat(struct client_state *csp)
 #else
       FD_ZERO(&rfds);
 #endif
-      FD_SET(csp->cfd, &rfds);
-      FD_SET(csp->sfd, &rfds);
+#ifdef FEATURE_CONNECTION_KEEP_ALIVE
+      if (!watch_client_socket)
+      {
+         maxfd = csp->server_connection.sfd;
+      }
+      else
+#endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
+      {
+         FD_SET(csp->cfd, &rfds);
+      }
+
+      FD_SET(csp->server_connection.sfd, &rfds);
 
 #ifdef FEATURE_CONNECTION_KEEP_ALIVE
       if ((csp->flags & CSP_FLAG_CHUNKED)
@@ -1736,19 +1782,34 @@ static void chat(struct client_state *csp)
          && ((csp->iob->eod - csp->iob->cur) >= 5)
          && !memcmp(csp->iob->eod-5, "0\r\n\r\n", 5))
       {
+         /*
+          * XXX: This check should be obsolete now,
+          *      but let's wait a while to be sure.
+          */
          log_error(LOG_LEVEL_CONNECT,
-            "Looks like we read the last chunk together with "
-            "the server headers. We better stop reading.");
+            "Looks like we got the last chunk together with "
+            "the server headers but didn't detect it earlier. "
+            "We better stop reading.");
          byte_count = (unsigned long long)(csp->iob->eod - csp->iob->cur);
          csp->expected_content_length = byte_count;
          csp->flags |= CSP_FLAG_CONTENT_LENGTH_SET;
       }
       if (server_body && server_response_is_complete(csp, byte_count))
       {
-         log_error(LOG_LEVEL_CONNECT,
-            "Done reading from server. Expected content length: %llu. "
-            "Actual content length: %llu. Most recently received: %d.",
-            csp->expected_content_length, byte_count, len);
+         if (csp->expected_content_length == byte_count)
+         {
+            log_error(LOG_LEVEL_CONNECT,
+               "Done reading from server. Content length: %llu as expected. "
+               "Bytes most recently read: %d.",
+               byte_count, len);
+         }
+         else
+         {
+            log_error(LOG_LEVEL_CONNECT,
+               "Done reading from server. Expected content length: %llu. "
+               "Actual content length: %llu. Bytes most recently read: %d.",
+               csp->expected_content_length, byte_count, len);
+         }
          len = 0;
          /*
           * XXX: should not jump around,
@@ -1789,7 +1850,51 @@ static void chat(struct client_state *csp)
        */
       if (FD_ISSET(csp->cfd, &rfds))
       {
-         len = read_socket(csp->cfd, buf, sizeof(buf) - 1);
+         int max_bytes_to_read = sizeof(buf) - 1;
+
+#ifdef FEATURE_CONNECTION_KEEP_ALIVE
+         if ((csp->flags & CSP_FLAG_CLIENT_REQUEST_COMPLETELY_READ))
+         {
+            if (data_is_available(csp->cfd, 0))
+            {
+               /*
+                * If the next request is already waiting, we have
+                * to stop select()ing the client socket. Otherwise
+                * we would always return right away and get nothing
+                * else done.
+                */
+               watch_client_socket = 0;
+               log_error(LOG_LEVEL_CONNECT,
+                  "Stopping to watch the client socket. "
+                  "There's already another request waiting.");
+               continue;
+            }
+            /*
+             * If the client socket is set, but there's no data
+             * available on the socket, the client went fishing
+             * and continuing talking to the server makes no sense.
+             */
+            log_error(LOG_LEVEL_CONNECT,
+               "The client closed socket %d while "
+               "the server socket %d is still open.",
+               csp->cfd, csp->server_connection.sfd);
+            mark_server_socket_tainted(csp);
+            break;
+         }
+         if (csp->expected_client_content_length != 0)
+         {
+            if (csp->expected_client_content_length < (sizeof(buf) - 1))
+            {
+               max_bytes_to_read = (int)csp->expected_client_content_length;
+            }
+            log_error(LOG_LEVEL_CONNECT,
+               "Waiting for up to %d bytes from the client.",
+               max_bytes_to_read);
+         }
+         assert(max_bytes_to_read < sizeof(buf));
+#endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
+
+         len = read_socket(csp->cfd, buf, max_bytes_to_read);
 
          if (len <= 0)
          {
@@ -1798,7 +1903,25 @@ static void chat(struct client_state *csp)
             break; /* "game over, man" */
          }
 
-         if (write_socket(csp->sfd, buf, (size_t)len))
+#ifdef FEATURE_CONNECTION_KEEP_ALIVE
+         if (csp->expected_client_content_length != 0)
+         {
+            assert(len <= max_bytes_to_read);
+            csp->expected_client_content_length -= (unsigned)len;
+            log_error(LOG_LEVEL_CONNECT,
+               "Expected client content length set to %llu "
+               "after reading %d bytes.",
+               csp->expected_client_content_length, len);
+            if (csp->expected_client_content_length == 0)
+            {
+               log_error(LOG_LEVEL_CONNECT,
+                  "Done reading from the client.");
+               csp->flags |= CSP_FLAG_CLIENT_REQUEST_COMPLETELY_READ;
+            }
+         }
+#endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
+
+         if (write_socket(csp->server_connection.sfd, buf, (size_t)len))
          {
             log_error(LOG_LEVEL_ERROR, "write to: %s failed: %E", http->host);
             mark_server_socket_tainted(csp);
@@ -1812,10 +1935,32 @@ static void chat(struct client_state *csp)
        * If `hdr' is null, then it's the header otherwise it's the body.
        * FIXME: Does `hdr' really mean `host'? No.
        */
-      if (FD_ISSET(csp->sfd, &rfds))
+      if (FD_ISSET(csp->server_connection.sfd, &rfds))
       {
+#ifdef FEATURE_CONNECTION_KEEP_ALIVE
+         /*
+          * If we are buffering content, we don't want to eat up to
+          * buffer-limit bytes if the client no longer cares about them.
+          * If we aren't buffering, however, a dead client socket will be
+          * noticed pretty much right away anyway, so we can reduce the
+          * overhead by skipping the check.
+          */
+         if (buffer_and_filter_content && !socket_is_still_alive(csp->cfd))
+         {
+#ifdef _WIN32
+            log_error(LOG_LEVEL_CONNECT,
+               "The server still wants to talk, but the client may already have hung up on us.");
+#else
+            log_error(LOG_LEVEL_CONNECT,
+               "The server still wants to talk, but the client hung up on us.");
+            mark_server_socket_tainted(csp);
+            return;
+#endif /* def _WIN32 */
+         }
+#endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
+
          fflush(NULL);
-         len = read_socket(csp->sfd, buf, sizeof(buf) - 1);
+         len = read_socket(csp->server_connection.sfd, buf, sizeof(buf) - 1);
 
          if (len < 0)
          {
@@ -1904,11 +2049,11 @@ static void chat(struct client_state *csp)
                 * now is the time to apply content modification
                 * and send the result to the client.
                 */
-               if (content_filter)
+               if (buffer_and_filter_content)
                {
-                  p = execute_content_filter(csp, content_filter);
+                  p = execute_content_filters(csp);
                   /*
-                   * If the content filter fails, use the original
+                   * If content filtering fails, use the original
                    * buffer and length.
                    * (see p != NULL ? p : csp->iob->cur below)
                    */
@@ -1916,6 +2061,20 @@ static void chat(struct client_state *csp)
                   {
                      csp->content_length = (size_t)(csp->iob->eod - csp->iob->cur);
                   }
+#ifdef FEATURE_COMPRESSION
+                  else if ((csp->flags & CSP_FLAG_CLIENT_SUPPORTS_DEFLATE)
+                     && (csp->content_length > LOWER_LENGTH_LIMIT_FOR_COMPRESSION))
+                  {
+                     char *compressed_content = compress_buffer(p,
+                        (size_t *)&csp->content_length, csp->config->compression_level);
+                     if (compressed_content != NULL)
+                     {
+                        freez(p);
+                        p = compressed_content;
+                        csp->flags |= CSP_FLAG_BUFFERED_CONTENT_DEFLATED;
+                     }
+                  }
+#endif
 
                   if (JB_ERR_OK != update_server_headers(csp))
                   {
@@ -1970,7 +2129,7 @@ static void chat(struct client_state *csp)
           */
          if (server_body || http->ssl)
          {
-            if (content_filter)
+            if (buffer_and_filter_content)
             {
                /*
                 * If there is no memory left for buffering the content, or the buffer limit
@@ -2018,7 +2177,7 @@ static void chat(struct client_state *csp)
                    */
                   byte_count = (unsigned long long)flushed;
                   freez(hdr);
-                  content_filter = NULL;
+                  buffer_and_filter_content = 0;
                   server_body = 1;
                }
             }
@@ -2036,7 +2195,6 @@ static void chat(struct client_state *csp)
          }
          else
          {
-            const char *header_start;
             /*
              * We're still looking for the end of the server's header.
              * Buffer up the data we just read.  If that fails, there's
@@ -2051,8 +2209,6 @@ static void chat(struct client_state *csp)
                return;
             }
 
-            header_start = csp->iob->cur;
-
             /* Convert iob into something sed() can digest */
             if (JB_ERR_PARSE == get_server_headers(csp))
             {
@@ -2078,22 +2234,40 @@ static void chat(struct client_state *csp)
                    * Since we have to wait for more from the server before
                    * we can parse the headers we just continue here.
                    */
-                  long header_offset = csp->iob->cur - header_start;
-                  assert(csp->iob->cur >= header_start);
-                  byte_count += (unsigned long long)(len - header_offset);
-                  log_error(LOG_LEVEL_CONNECT, "Continuing buffering headers. "
-                     "byte_count: %llu. header_offset: %d. len: %d.",
-                     byte_count, header_offset, len);
+                  log_error(LOG_LEVEL_CONNECT,
+                     "Continuing buffering headers. Bytes most recently read: %d.",
+                     len);
                   continue;
                }
             }
+            else
+            {
+               /*
+                * Account for the content bytes we
+                * might have gotten with the headers.
+                */
+               assert(csp->iob->eod >= csp->iob->cur);
+               byte_count = (unsigned long long)(csp->iob->eod - csp->iob->cur);
+            }
 
             /* Did we actually get anything? */
             if (NULL == csp->headers->first)
             {
-               log_error(LOG_LEVEL_ERROR, "Empty server or forwarder response.");
+               if ((csp->flags & CSP_FLAG_REUSED_CLIENT_CONNECTION))
+               {
+                  log_error(LOG_LEVEL_ERROR,
+                     "Empty server or forwarder response received on socket %d. "
+                     "Closing client socket %d without sending data.",
+                     csp->server_connection.sfd, csp->cfd);
+               }
+               else
+               {
+                  log_error(LOG_LEVEL_ERROR,
+                     "Empty server or forwarder response received on socket %d.",
+                     csp->server_connection.sfd);
+                  send_crunch_response(csp, error_response(csp, "no-server-data"));
+               }
                log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" 502 0", csp->ip_addr_str, http->cmd);
-               send_crunch_response(csp, error_response(csp, "no-server-data"));
                free_http_request(http);
                mark_server_socket_tainted(csp);
                return;
@@ -2139,6 +2313,21 @@ static void chat(struct client_state *csp)
                log_error(LOG_LEVEL_FATAL, "Out of memory parsing server header");
             }
 
+            if ((csp->flags & CSP_FLAG_CHUNKED)
+               && !(csp->flags & CSP_FLAG_CONTENT_LENGTH_SET)
+               && ((csp->iob->eod - csp->iob->cur) >= 5)
+               && !memcmp(csp->iob->eod-5, "0\r\n\r\n", 5))
+            {
+               log_error(LOG_LEVEL_CONNECT,
+                  "Looks like we got the last chunk together with "
+                  "the server headers. We better stop reading.");
+               byte_count = (unsigned long long)(csp->iob->eod - csp->iob->cur);
+               csp->expected_content_length = byte_count;
+               csp->flags |= CSP_FLAG_CONTENT_LENGTH_SET;
+            }
+
+            csp->server_connection.response_received = time(NULL);
+
             if (crunch_response_triggered(csp, crunchers_light))
             {
                /*
@@ -2155,12 +2344,12 @@ static void chat(struct client_state *csp)
 
             if (!http->ssl) /* We talk plaintext */
             {
-               content_filter = get_filter_function(csp);
+               buffer_and_filter_content = content_requires_filtering(csp);
             }
             /*
              * Only write if we're not buffering for content modification
              */
-            if (!content_filter)
+            if (!buffer_and_filter_content)
             {
                /*
                 * Write the server's (modified) header to
@@ -2181,18 +2370,6 @@ static void chat(struct client_state *csp)
                   mark_server_socket_tainted(csp);
                   return;
                }
-
-               byte_count += (unsigned long long)len;
-            }
-            else
-            {
-               /*
-                * XXX: the header lenght should probably
-                * be calculated by get_server_headers().
-                */
-               long header_length = csp->iob->cur - header_start;
-               assert(csp->iob->cur > header_start);
-               byte_count += (unsigned long long)(len - header_length);
             }
 
             /* we're finished with the server's header */
@@ -2227,7 +2404,7 @@ static void chat(struct client_state *csp)
    if (csp->content_length == 0)
    {
       /*
-       * If Privoxy didn't recalculate the Content-Lenght,
+       * If Privoxy didn't recalculate the Content-Length,
        * byte_count is still correct.
        */
       csp->content_length = byte_count;
@@ -2246,9 +2423,51 @@ static void chat(struct client_state *csp)
 
    log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" 200 %llu",
       csp->ip_addr_str, http->ocmd, csp->content_length);
+
+   csp->server_connection.timestamp = time(NULL);
 }
 
 
+#ifdef FEATURE_CONNECTION_KEEP_ALIVE
+/*********************************************************************
+ *
+ * Function    :  prepare_csp_for_next_request
+ *
+ * Description :  Put the csp in a mostly vergin state.
+ *
+ * Parameters  :
+ *          1  :  csp = Current client state (buffers, headers, etc...)
+ *
+ * Returns     :  N/A
+ *
+ *********************************************************************/
+static void prepare_csp_for_next_request(struct client_state *csp)
+{
+   csp->content_type = 0;
+   csp->content_length = 0;
+   csp->expected_content_length = 0;
+   csp->expected_client_content_length = 0;
+   list_remove_all(csp->headers);
+   freez(csp->iob->buf);
+   memset(csp->iob, 0, sizeof(csp->iob));
+   freez(csp->error_message);
+   free_http_request(csp->http);
+   destroy_list(csp->headers);
+   destroy_list(csp->tags);
+   free_current_action(csp->action);
+   if (NULL != csp->fwd)
+   {
+      unload_forward_spec(csp->fwd);
+      csp->fwd = NULL;
+   }
+   /* XXX: Store per-connection flags someplace else. */
+   csp->flags &= CSP_FLAG_TOGGLED_ON;
+   csp->flags |= CSP_FLAG_ACTIVE;
+   csp->flags |= CSP_FLAG_REUSED_CLIENT_CONNECTION;
+}
+#endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
+
+
 /*********************************************************************
  *
  * Function    :  serve
@@ -2270,66 +2489,101 @@ static void serve(struct client_state *csp)
 #endif /* def AMIGA */
 {
 #ifdef FEATURE_CONNECTION_KEEP_ALIVE
+#ifdef FEATURE_CONNECTION_SHARING
    static int monitor_thread_running = 0;
+#endif /* def FEATURE_CONNECTION_SHARING */
    int continue_chatting = 0;
+
    do
    {
+      unsigned int latency;
+      int config_file_change_detected = 0; /* Only used for debugging */
+
       chat(csp);
 
+      /*
+       * If the request has been crunched,
+       * the calculated latency is zero.
+       */
+      latency = (unsigned)(csp->server_connection.response_received -
+         csp->server_connection.request_sent) / 2;
+
       continue_chatting = (csp->config->feature_flags
          & RUNTIME_FEATURE_CONNECTION_KEEP_ALIVE)
-         && (csp->flags & CSP_FLAG_SERVER_CONNECTION_KEEP_ALIVE)
+         && (((csp->flags & CSP_FLAG_SERVER_CONNECTION_KEEP_ALIVE)
+               && !(csp->flags & CSP_FLAG_SERVER_SOCKET_TAINTED))
+            || (csp->flags & CSP_FLAG_CRUNCHED))
          && (csp->cfd != JB_INVALID_SOCKET)
-         && (csp->sfd != JB_INVALID_SOCKET)
-         && socket_is_still_usable(csp->sfd);
+         && (csp->flags & CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE);
 
-      if (continue_chatting)
+      if (continue_chatting && !(csp->flags & CSP_FLAG_CRUNCHED))
       {
-         log_error(LOG_LEVEL_CONNECT,
-            "Waiting for the next client request. "
-            "Keeping the server socket %d to %s open.",
-            csp->sfd, csp->server_connection.host);
-
-         if ((csp->flags & CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE)
-            && data_is_available(csp->cfd, (int)csp->server_connection.keep_alive_timeout)
-            && socket_is_still_usable(csp->cfd))
+         continue_chatting = (csp->server_connection.sfd != JB_INVALID_SOCKET)
+            && socket_is_still_alive(csp->server_connection.sfd);
+         if (continue_chatting)
          {
-            log_error(LOG_LEVEL_CONNECT, "Client request arrived in "
-               "time or the client closed the connection.");
-            /*
-             * Get the csp in a mostly vergin state again.
-             * XXX: Should be done elsewhere.
-             */
-            csp->content_type = 0;
-            csp->content_length = 0;
-            csp->expected_content_length = 0;
-            list_remove_all(csp->headers);
-            freez(csp->iob->buf);
-            memset(csp->iob, 0, sizeof(csp->iob));
-            freez(csp->error_message);
-            free_http_request(csp->http);
-            destroy_list(csp->headers);
-            destroy_list(csp->tags);
-            free_current_action(csp->action);
-            if (NULL != csp->fwd)
+            if (!(csp->flags & CSP_FLAG_SERVER_KEEP_ALIVE_TIMEOUT_SET))
             {
-               unload_forward_spec(csp->fwd);
-               csp->fwd = NULL;
+               csp->server_connection.keep_alive_timeout = csp->config->default_server_timeout;
+               log_error(LOG_LEVEL_CONNECT,
+                  "The server didn't specify how long the connection will stay open. "
+                  "Assumed timeout is: %u.", csp->server_connection.keep_alive_timeout);
             }
+            continue_chatting = (latency < csp->server_connection.keep_alive_timeout);
+         }
+      }
 
-            /* XXX: Store per-connection flags someplace else. */
-            csp->flags = CSP_FLAG_ACTIVE | (csp->flags & CSP_FLAG_TOGGLED_ON);
+      if (continue_chatting && any_loaded_file_changed(csp->config->config_file_list))
+      {
+         continue_chatting = 0;
+         config_file_change_detected = 1;
+      }
+
+      if (continue_chatting)
+      {
+         unsigned int client_timeout;
+
+         if (csp->server_connection.sfd != JB_INVALID_SOCKET)
+         {
+            client_timeout = (unsigned)csp->server_connection.keep_alive_timeout - latency;
+            log_error(LOG_LEVEL_CONNECT,
+               "Waiting for the next client request on socket %d. "
+               "Keeping the server socket %d to %s open.",
+               csp->cfd, csp->server_connection.sfd, csp->server_connection.host);
+         }
+         else
+         {
+            client_timeout = 1; /* XXX: Use something else here? */
+            log_error(LOG_LEVEL_CONNECT,
+               "Waiting for the next client request on socket %d. "
+               "No server socket to keep open.", csp->cfd);
+         }
+         if ((csp->flags & CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE)
+            && data_is_available(csp->cfd, (int)client_timeout)
+            && socket_is_still_alive(csp->cfd))
+         {
+            log_error(LOG_LEVEL_CONNECT,
+               "Client request arrived in time on socket %d.", csp->cfd);
+            prepare_csp_for_next_request(csp);
          }
          else
          {
             log_error(LOG_LEVEL_CONNECT,
-               "No additional client request received in time.");
-            if ((csp->config->feature_flags & RUNTIME_FEATURE_CONNECTION_SHARING))
+               "No additional client request received in time on socket %d.",
+                csp->cfd);
+#ifdef FEATURE_CONNECTION_SHARING
+            if ((csp->config->feature_flags & RUNTIME_FEATURE_CONNECTION_SHARING)
+               && (socket_is_still_alive(csp->server_connection.sfd)))
             {
-               remember_connection(csp->sfd, csp->http,
-                  forward_url(csp, csp->http),
-                  csp->server_connection.keep_alive_timeout);
-               csp->sfd = JB_INVALID_SOCKET;
+               time_t time_open = time(NULL) - csp->server_connection.timestamp;
+
+               if (csp->server_connection.keep_alive_timeout < time_open - (time_t)latency)
+               {
+                  break;
+               }
+
+               remember_connection(&csp->server_connection);
+               csp->server_connection.sfd = JB_INVALID_SOCKET;
                close_socket(csp->cfd);
                csp->cfd = JB_INVALID_SOCKET;
                privoxy_mutex_lock(&connection_reuse_mutex);
@@ -2343,30 +2597,46 @@ static void serve(struct client_state *csp)
                }
                privoxy_mutex_unlock(&connection_reuse_mutex);
             }
+#endif /* def FEATURE_CONNECTION_SHARING */
             break;
          }
       }
-      else if (csp->sfd != JB_INVALID_SOCKET)
+      else if (csp->server_connection.sfd != JB_INVALID_SOCKET)
       {
          log_error(LOG_LEVEL_CONNECT,
-            "The connection on server socket %d to %s isn't reusable. "
-            "Closing.", csp->sfd, csp->server_connection.host);
+            "The connection on server socket %d to %s isn't reusable. Closing. "
+            "Server connection: keep-alive %u, tainted: %u, socket alive %u. "
+            "Client connection: socket alive: %u. Server timeout: %u. "
+            "Configuration file change detected: %u",
+            csp->server_connection.sfd, csp->server_connection.host,
+            0 != (csp->flags & CSP_FLAG_SERVER_CONNECTION_KEEP_ALIVE),
+            0 != (csp->flags & CSP_FLAG_SERVER_SOCKET_TAINTED),
+            socket_is_still_alive(csp->server_connection.sfd),
+            socket_is_still_alive(csp->cfd),
+            csp->server_connection.keep_alive_timeout,
+            config_file_change_detected);
       }
    } while (continue_chatting);
 
-   mark_connection_closed(&csp->server_connection);
 #else
    chat(csp);
 #endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
 
-   if (csp->sfd != JB_INVALID_SOCKET)
+   if (csp->server_connection.sfd != JB_INVALID_SOCKET)
    {
-#ifdef FEATURE_CONNECTION_KEEP_ALIVE
-      forget_connection(csp->sfd);
-#endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
-      close_socket(csp->sfd);
+#ifdef FEATURE_CONNECTION_SHARING
+      if (csp->config->feature_flags & RUNTIME_FEATURE_CONNECTION_SHARING)
+      {
+         forget_connection(csp->server_connection.sfd);
+      }
+#endif /* def FEATURE_CONNECTION_SHARING */
+      close_socket(csp->server_connection.sfd);
    }
 
+#ifdef FEATURE_CONNECTION_KEEP_ALIVE
+   mark_connection_closed(&csp->server_connection);
+#endif
+
    if (csp->cfd != JB_INVALID_SOCKET)
    {
       close_socket(csp->cfd);
@@ -2597,9 +2867,9 @@ static void initialize_mutexes(void)
  *
  *********************************************************************/
 #ifdef __MINGW32__
-int real_main(int argc, const char *argv[])
+int real_main(int argc, char **argv)
 #else
-int main(int argc, const char *argv[])
+int main(int argc, char **argv)
 #endif
 {
    int argc_pos = 0;
@@ -2607,7 +2877,6 @@ int main(int argc, const char *argv[])
 #ifdef unix
    struct passwd *pw = NULL;
    struct group *grp = NULL;
-   char *p;
    int do_chroot = 0;
    char *pre_chroot_nslookup_to_load_resolver = NULL;
 #endif
@@ -2646,7 +2915,7 @@ int main(int argc, const char *argv[])
             pName++;
          exit( (install_service(pName)) ? 0 : 1 );
       }
-      else if (strncmp(argv[argc_pos], "--uninstall", 11) == 0)
+      else if (strncmp(argv[argc_pos], "--uninstall", 11) == 0)
       {
          const char *pName = argv[argc_pos] + 11;
          if (*pName == ':')
@@ -2681,7 +2950,7 @@ int main(int argc, const char *argv[])
       else if (strcmp(argv[argc_pos], "--no-daemon" ) == 0)
       {
          set_debug_level(LOG_LEVEL_FATAL | LOG_LEVEL_ERROR | LOG_LEVEL_INFO);
-         no_daemon = 1;
+         daemon_mode = 0;
       }
 
       else if (strcmp(argv[argc_pos], "--pidfile" ) == 0)
@@ -2692,23 +2961,39 @@ int main(int argc, const char *argv[])
 
       else if (strcmp(argv[argc_pos], "--user" ) == 0)
       {
+         char *user_arg;
+         char *group_name;
+
          if (++argc_pos == argc) usage(argv[argc_pos]);
 
-         if ((NULL != (p = strchr(argv[argc_pos], '.'))) && *(p + 1) != '0')
+         user_arg = strdup(argv[argc_pos]);
+         if (NULL == user_arg)
          {
-            *p++ = '\0';
-            if (NULL == (grp = getgrnam(p)))
+            log_error(LOG_LEVEL_FATAL,
+               "Out of memory splitting --user argument '%s'.", argv[argc_pos]);
+         }
+         group_name = strchr(user_arg, '.');
+         if (NULL != group_name)
+         {
+            /* Nul-terminate the user name */
+            *group_name = '\0';
+
+            /* Skip the former delimiter to actually reach the group name */
+            group_name++;
+
+            grp = getgrnam(group_name);
+            if (NULL == grp)
             {
-               log_error(LOG_LEVEL_FATAL, "Group %s not found.", p);
+               log_error(LOG_LEVEL_FATAL, "Group '%s' not found.", group_name);
             }
          }
-
-         if (NULL == (pw = getpwnam(argv[argc_pos])))
+         pw = getpwnam(user_arg);
+         if (NULL == pw)
          {
-            log_error(LOG_LEVEL_FATAL, "User %s not found.", argv[argc_pos]);
+            log_error(LOG_LEVEL_FATAL, "User '%s' not found.", user_arg);
          }
 
-         if (p != NULL) *--p = '\0';
+         freez(user_arg);
       }
 
       else if (strcmp(argv[argc_pos], "--pre-chroot-nslookup" ) == 0)
@@ -2847,14 +3132,10 @@ int main(int argc, const char *argv[])
     */
 #if defined(unix)
 {
-   pid_t pid = 0;
-#if 0
-   int   fd;
-#endif
-
-   if (!no_daemon)
+   if (daemon_mode)
    {
-      pid  = fork();
+      int fd;
+      pid_t pid = fork();
 
       if ( pid < 0 ) /* error */
       {
@@ -2878,33 +3159,50 @@ int main(int argc, const char *argv[])
          exit( 0 );
       }
       /* child */
-#if 1
-      /* Should be more portable, but not as well tested */
+
       setsid();
-#else /* !1 */
-#ifdef __FreeBSD__
-      setpgrp(0,0);
-#else /* ndef __FreeBSD__ */
-      setpgrp();
-#endif /* ndef __FreeBSD__ */
-      fd = open("/dev/tty", O_RDONLY);
-      if ( fd )
-      {
-         /* no error check here */
-         ioctl( fd, TIOCNOTTY,0 );
-         close ( fd );
-      }
-#endif /* 1 */
+
       /*
        * stderr (fd 2) will be closed later on,
        * when the config file has been parsed.
        */
+      close(0);
+      close(1);
+
+      /*
+       * Reserve fd 0 and 1 to prevent abort() and friends
+       * from sending stuff to the clients or servers.
+       */
+      fd = open("/dev/null", O_RDONLY);
+      if (fd == -1)
+      {
+         log_error(LOG_LEVEL_FATAL, "Failed to open /dev/null: %E");
+      }
+      else if (fd != 0)
+      {
+         if (dup2(fd, 0) == -1)
+         {
+            log_error(LOG_LEVEL_FATAL, "Failed to reserve fd 0: %E");
+         }
+         close(fd);
+      }
+      fd = open("/dev/null", O_WRONLY);
+      if (fd == -1)
+      {
+         log_error(LOG_LEVEL_FATAL, "Failed to open /dev/null: %E");
+      }
+      else if (fd != 1)
+      {
+         if (dup2(fd, 1) == -1)
+         {
+            log_error(LOG_LEVEL_FATAL, "Failed to reserve fd 1: %E");
+         }
+         close(fd);
+      }
 
-      close( 0 );
-      close( 1 );
       chdir("/");
 
-   } /* -END- if (!no_daemon) */
+   } /* -END- if (daemon_mode) */
 
    /*
     * As soon as we have written the PID file, we can switch
@@ -3068,7 +3366,7 @@ static jb_socket bind_port_helper(struct configuration_spec * config)
                (NULL != config->haddr) ? config->haddr : "INADDR_ANY", config->hport);
 
          default :
-            log_error(LOG_LEVEL_FATAL, "can't bind to %s:%d: because %E",
+            log_error(LOG_LEVEL_FATAL, "can't bind to %s:%d: %E",
                (NULL != config->haddr) ? config->haddr : "INADDR_ANY", config->hport);
       }
 
@@ -3106,6 +3404,7 @@ void w32_service_listen_loop(void *p)
  *********************************************************************/
 static void listen_loop(void)
 {
+   struct client_states *csp_list = NULL;
    struct client_state *csp = NULL;
    jb_socket bfd;
    struct configuration_spec *config;
@@ -3113,13 +3412,13 @@ static void listen_loop(void)
 
    config = load_config();
 
-#ifdef FEATURE_CONNECTION_KEEP_ALIVE
+#ifdef FEATURE_CONNECTION_SHARING
    /*
     * XXX: Should be relocated once it no
     * longer needs to emit log messages.
     */
    initialize_reusable_connections();
-#endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
+#endif /* def FEATURE_CONNECTION_SHARING */
 
    bfd = bind_port_helper(config);
 
@@ -3155,14 +3454,39 @@ static void listen_loop(void)
       }
 #endif
 
-      if ( NULL == (csp = (struct client_state *) zalloc(sizeof(*csp))) )
+      csp_list = (struct client_states *)zalloc(sizeof(*csp_list));
+      if (NULL == csp_list)
       {
-         log_error(LOG_LEVEL_FATAL, "malloc(%d) for csp failed: %E", sizeof(*csp));
+         log_error(LOG_LEVEL_FATAL,
+            "malloc(%d) for csp_list failed: %E", sizeof(*csp_list));
          continue;
       }
+      csp = &csp_list->csp;
+
+      log_error(LOG_LEVEL_CONNECT, "Listening for new connections ... ");
+
+      if (!accept_connection(csp, bfd))
+      {
+         log_error(LOG_LEVEL_CONNECT, "accept failed: %E");
+
+#ifdef AMIGA
+         if(!childs)
+         {
+            exit(1);
+         }
+#endif
+         freez(csp_list);
+         continue;
+      }
+      else
+      {
+         log_error(LOG_LEVEL_CONNECT,
+            "accepted connection from %s on socket %d",
+            csp->ip_addr_str, csp->cfd);
+      }
 
       csp->flags |= CSP_FLAG_ACTIVE;
-      csp->sfd    = JB_INVALID_SOCKET;
+      csp->server_connection.sfd = JB_INVALID_SOCKET;
 
       csp->config = config = load_config();
 
@@ -3186,26 +3510,6 @@ static void listen_loop(void)
          bfd = bind_port_helper(config);
       }
 
-      log_error(LOG_LEVEL_CONNECT, "Listening for new connections ... ");
-
-      if (!accept_connection(csp, bfd))
-      {
-         log_error(LOG_LEVEL_CONNECT, "accept failed: %E");
-
-#ifdef AMIGA
-         if(!childs)
-         {
-            exit(1);
-         }
-#endif
-         freez(csp);
-         continue;
-      }
-      else
-      {
-         log_error(LOG_LEVEL_CONNECT, "accepted connection from %s", csp->ip_addr_str);
-      }
-
 #ifdef FEATURE_TOGGLE
       if (global_toggle_state)
 #endif /* def FEATURE_TOGGLE */
@@ -3225,7 +3529,7 @@ static void listen_loop(void)
          log_error(LOG_LEVEL_CONNECT, "Connection from %s dropped due to ACL", csp->ip_addr_str);
          close_socket(csp->cfd);
          freez(csp->ip_addr_str);
-         freez(csp);
+         freez(csp_list);
          continue;
       }
 #endif /* def FEATURE_ACL */
@@ -3240,19 +3544,19 @@ static void listen_loop(void)
             strlen(TOO_MANY_CONNECTIONS_RESPONSE));
          close_socket(csp->cfd);
          freez(csp->ip_addr_str);
-         freez(csp);
+         freez(csp_list);
          continue;
       }
 
       /* add it to the list of clients */
-      csp->next = clients->next;
-      clients->next = csp;
+      csp_list->next = clients->next;
+      clients->next = csp_list;
 
       if (config->multi_threaded)
       {
          int child_id;
 
-/* this is a switch () statment in the C preprocessor - ugh */
+/* this is a switch () statement in the C preprocessor - ugh */
 #undef SELECTED_ONE_OPTION
 
 /* Use Pthreads in preference to native code */
@@ -3465,7 +3769,6 @@ static void listen_loop(void)
 #if defined(unix)
    freez(basedir);
 #endif
-   freez(configfile);
 
 #if defined(_WIN32) && !defined(_WIN_CONSOLE)
    /* Cleanup - remove taskbar icon etc. */