Add LOG_LEVEL_ACTIONS to log the applying actions
[privoxy.git] / jcc.c
diff --git a/jcc.c b/jcc.c
index 582c882..8f35b32 100644 (file)
--- a/jcc.c
+++ b/jcc.c
@@ -1,4 +1,4 @@
-const char jcc_rcs[] = "$Id: jcc.c,v 1.334 2010/12/26 16:18:30 fabiankeil Exp $";
+const char jcc_rcs[] = "$Id: jcc.c,v 1.384 2012/07/27 17:31:10 fabiankeil Exp $";
 /*********************************************************************
  *
  * File        :  $Source: /cvsroot/ijbswa/current/jcc.c,v $
@@ -151,7 +151,9 @@ static void serve(struct client_state *csp);
 static void usage(const char *myname);
 #endif
 static void initialize_mutexes(void);
-static jb_socket bind_port_helper(struct configuration_spec *config);
+static jb_socket bind_port_helper(const char *haddr, int hport);
+static void bind_ports_helper(struct configuration_spec *config, jb_socket sockets[]);
+static void close_ports_helper(jb_socket sockets[]);
 static void listen_loop(void);
 
 #ifdef AMIGA
@@ -206,31 +208,31 @@ static int received_hup_signal = 0;
 
 /* HTTP snipplets. */
 static const char CSUCCEED[] =
-   "HTTP/1.0 200 Connection established\r\n"
+   "HTTP/1.1 200 Connection established\r\n"
    "Proxy-Agent: Privoxy/" VERSION "\r\n\r\n";
 
 static const char CHEADER[] =
-   "HTTP/1.0 400 Invalid header received from client\r\n"
+   "HTTP/1.1 400 Invalid header received from client\r\n"
    "Proxy-Agent: Privoxy " VERSION "\r\n"
    "Content-Type: text/plain\r\n"
    "Connection: close\r\n\r\n"
    "Invalid header received from client.\r\n";
 
 static const char FTP_RESPONSE[] =
-   "HTTP/1.0 400 Invalid request received from client\r\n"
+   "HTTP/1.1 400 Invalid request received from client\r\n"
    "Content-Type: text/plain\r\n"
    "Connection: close\r\n\r\n"
    "Invalid request. Privoxy doesn't support FTP.\r\n";
 
 static const char GOPHER_RESPONSE[] =
-   "HTTP/1.0 400 Invalid request received from client\r\n"
+   "HTTP/1.1 400 Invalid request received from client\r\n"
    "Content-Type: text/plain\r\n"
    "Connection: close\r\n\r\n"
    "Invalid request. Privoxy doesn't support gopher.\r\n";
 
 /* XXX: should be a template */
 static const char MISSING_DESTINATION_RESPONSE[] =
-   "HTTP/1.0 400 Bad request received from client\r\n"
+   "HTTP/1.1 400 Bad request received from client\r\n"
    "Proxy-Agent: Privoxy " VERSION "\r\n"
    "Content-Type: text/plain\r\n"
    "Connection: close\r\n\r\n"
@@ -238,7 +240,7 @@ static const char MISSING_DESTINATION_RESPONSE[] =
 
 /* XXX: should be a template */
 static const char INVALID_SERVER_HEADERS_RESPONSE[] =
-   "HTTP/1.0 502 Server or forwarder response invalid\r\n"
+   "HTTP/1.1 502 Server or forwarder response invalid\r\n"
    "Proxy-Agent: Privoxy " VERSION "\r\n"
    "Content-Type: text/plain\r\n"
    "Connection: close\r\n\r\n"
@@ -246,21 +248,21 @@ static const char INVALID_SERVER_HEADERS_RESPONSE[] =
 
 /* XXX: should be a template */
 static const char MESSED_UP_REQUEST_RESPONSE[] =
-   "HTTP/1.0 400 Malformed request after rewriting\r\n"
+   "HTTP/1.1 400 Malformed request after rewriting\r\n"
    "Proxy-Agent: Privoxy " VERSION "\r\n"
    "Content-Type: text/plain\r\n"
    "Connection: close\r\n\r\n"
    "Bad request. Messed up with header filters.\r\n";
 
 static const char TOO_MANY_CONNECTIONS_RESPONSE[] =
-   "HTTP/1.0 503 Too many open connections\r\n"
+   "HTTP/1.1 503 Too many open connections\r\n"
    "Proxy-Agent: Privoxy " VERSION "\r\n"
    "Content-Type: text/plain\r\n"
    "Connection: close\r\n\r\n"
    "Maximum number of open connections reached.\r\n";
 
 static const char CLIENT_CONNECTION_TIMEOUT_RESPONSE[] =
-   "HTTP/1.0 504 Connection timeout\r\n"
+   "HTTP/1.1 504 Connection timeout\r\n"
    "Proxy-Agent: Privoxy " VERSION "\r\n"
    "Content-Type: text/plain\r\n"
    "Connection: close\r\n\r\n"
@@ -315,7 +317,7 @@ static const struct cruncher crunchers_light[] = {
 #if !defined(_WIN32) && !defined(__OS2__) && !defined(AMIGA)
 /*********************************************************************
  *
- * Function    :  sig_handler 
+ * Function    :  sig_handler
  *
  * Description :  Signal handler for different signals.
  *                Exit gracefully on TERM and INT
@@ -325,7 +327,7 @@ static const struct cruncher crunchers_light[] = {
  * Parameters  :
  *          1  :  the_signal = the signal cause this function to call
  *
- * Returns     :  - 
+ * Returns     :  -
  *
  *********************************************************************/
 static void sig_handler(int the_signal)
@@ -336,7 +338,7 @@ static void sig_handler(int the_signal)
       case SIGINT:
          log_error(LOG_LEVEL_INFO, "exiting by signal %d .. bye", the_signal);
 #if defined(unix)
-         if(pidfile)
+         if (pidfile)
          {
             unlink(pidfile);
          }
@@ -348,10 +350,10 @@ static void sig_handler(int the_signal)
 #if defined(unix)
          received_hup_signal = 1;
 #endif
-         break;         
+         break;
 
       default:
-         /* 
+         /*
           * We shouldn't be here, unless we catch signals
           * in main() that we can't handle here!
           */
@@ -563,7 +565,7 @@ static jb_err get_server_headers(struct client_state *csp)
          log_error(LOG_LEVEL_HEADER, "Continue hack in da house.");
          continue_hack_in_da_house = 1;
       }
-      else if (*header == '\0') 
+      else if (*header == '\0')
       {
          /*
           * If the header is empty, but the Continue hack
@@ -659,6 +661,34 @@ static const char *crunch_reason(const struct http_response *rsp)
 }
 
 
+/*********************************************************************
+ *
+ * Function    :  log_applied_actions
+ *
+ * Description :  Logs the applied actions if LOG_LEVEL_ACTIONS is
+ *                enabled.
+ *
+ * Parameters  :
+ *          1  :  actions = Current action spec to log
+ *
+ * Returns     :  Nothing.
+ *
+ *********************************************************************/
+static void log_applied_actions(const struct current_action_spec *actions)
+{
+   /*
+    * The conversion to text requires lots of memory allocations so
+    * we only do the conversion if the user is actually interested.
+    */
+   if (debug_level_is_enabled(LOG_LEVEL_ACTIONS))
+   {
+      char *actions_as_text = actions_to_line_of_text(actions);
+      log_error(LOG_LEVEL_ACTIONS, "%s", actions_as_text);
+      freez(actions_as_text);
+   }
+}
+
+
 /*********************************************************************
  *
  * Function    :  send_crunch_response
@@ -703,6 +733,7 @@ static void send_crunch_response(const struct client_state *csp, struct http_res
       status_code[3] = '\0';
 
       /* Log that the request was crunched and why. */
+      log_applied_actions(csp->action);
       log_error(LOG_LEVEL_CRUNCH, "%s: %s", crunch_reason(rsp), http->url);
       log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" %s %u",
          csp->ip_addr_str, http->ocmd, status_code, rsp->content_length);
@@ -721,7 +752,7 @@ static void send_crunch_response(const struct client_state *csp, struct http_res
       if (cgi_error_memory() != rsp)
       {
          free_http_response(rsp);
-      } 
+      }
       return;
 }
 
@@ -749,7 +780,7 @@ static int crunch_response_triggered(struct client_state *csp, const struct crun
    /*
     * If CGI request crunching is disabled,
     * check the CGI dispatcher out of order to
-    * prevent unintentional blocks or redirects. 
+    * prevent unintentional blocks or redirects.
     */
    if (!(csp->config->feature_flags & RUNTIME_FEATURE_CGI_CRUNCHING)
        && (NULL != (rsp = dispatch_cgi(csp))))
@@ -821,16 +852,11 @@ static void build_request_line(struct client_state *csp, const struct forward_sp
     * Downgrade http version from 1.1 to 1.0
     * if +downgrade action applies.
     */
-   if ( (csp->action->flags & ACTION_DOWNGRADE)
+   if ((csp->action->flags & ACTION_DOWNGRADE)
      && (!strcmpic(http->ver, "HTTP/1.1")))
    {
       freez(http->ver);
-      http->ver = strdup("HTTP/1.0");
-
-      if (http->ver == NULL)
-      {
-         log_error(LOG_LEVEL_FATAL, "Out of memory downgrading HTTP version");
-      }
+      http->ver = strdup_or_die("HTTP/1.0");
    }
 
    /*
@@ -889,12 +915,7 @@ static jb_err change_request_destination(struct client_state *csp)
    else
    {
       /* XXX: ocmd is a misleading name */
-      http->ocmd = strdup(http->cmd);
-      if (http->ocmd == NULL)
-      {
-         log_error(LOG_LEVEL_FATAL,
-            "Out of memory copying rewritten HTTP request line");
-      }
+      http->ocmd = strdup_or_die(http->cmd);
    }
 
    return err;
@@ -1001,11 +1022,7 @@ void save_connection_destination(jb_socket sfd,
    assert(NULL != http->host);
 
    server_connection->sfd = sfd;
-   server_connection->host = strdup(http->host);
-   if (NULL == server_connection->host)
-   {
-      log_error(LOG_LEVEL_FATAL, "Out of memory saving socket.");
-   }
+   server_connection->host = strdup_or_die(http->host);
    server_connection->port = http->port;
 
    assert(NULL != fwd);
@@ -1018,11 +1035,7 @@ void save_connection_destination(jb_socket sfd,
    server_connection->forwarder_type = fwd->type;
    if (NULL != fwd->gateway_host)
    {
-      server_connection->gateway_host = strdup(fwd->gateway_host);
-      if (NULL == server_connection->gateway_host)
-      {
-         log_error(LOG_LEVEL_FATAL, "Out of memory saving gateway_host.");
-      }
+      server_connection->gateway_host = strdup_or_die(fwd->gateway_host);
    }
    else
    {
@@ -1032,11 +1045,7 @@ void save_connection_destination(jb_socket sfd,
 
    if (NULL != fwd->forward_host)
    {
-      server_connection->forward_host = strdup(fwd->forward_host);
-      if (NULL == server_connection->forward_host)
-      {
-         log_error(LOG_LEVEL_FATAL, "Out of memory saving forward_host.");
-      }
+      server_connection->forward_host = strdup_or_die(fwd->forward_host);
    }
    else
    {
@@ -1191,11 +1200,20 @@ static char *get_request_line(struct client_state *csp)
    {
       if (!data_is_available(csp->cfd, csp->config->socket_timeout))
       {
-         log_error(LOG_LEVEL_CONNECT,
-            "Stopped waiting for the request line. Timeout: %d.",
-            csp->config->socket_timeout);
-         write_socket(csp->cfd, CLIENT_CONNECTION_TIMEOUT_RESPONSE,
-            strlen(CLIENT_CONNECTION_TIMEOUT_RESPONSE));
+         if (socket_is_still_alive(csp->cfd))
+         {
+            log_error(LOG_LEVEL_CONNECT,
+               "No request line on socket %d received in time. Timeout: %d.",
+               csp->cfd, csp->config->socket_timeout);
+            write_socket(csp->cfd, CLIENT_CONNECTION_TIMEOUT_RESPONSE,
+               strlen(CLIENT_CONNECTION_TIMEOUT_RESPONSE));
+         }
+         else
+         {
+            log_error(LOG_LEVEL_CONNECT,
+               "The client side of the connection on socket %d got "
+               "closed without sending a complete request line.", csp->cfd);
+         }
          return NULL;
       }
 
@@ -1228,10 +1246,6 @@ static char *get_request_line(struct client_state *csp)
  * Description : Read the client's request (more precisely the
  *               client headers) and answer it if necessary.
  *
- *               Note that since we're not using select() we could get
- *               blocked here if a client connected, then didn't say
- *               anything!
- *
  * Parameters  :
  *          1  :  csp = Current client state (buffers, headers, etc...)
  *
@@ -1337,7 +1351,7 @@ static jb_err receive_client_request(struct client_state *csp)
             destroy_list(headers);
             return JB_ERR_PARSE;
          }
-         
+
          if (add_to_iob(csp, buf, len))
          {
             /*
@@ -1352,7 +1366,7 @@ static jb_err receive_client_request(struct client_state *csp)
       {
          /*
           * We were able to read a complete
-          * header and can finaly enlist it.
+          * header and can finally enlist it.
           */
          enlist(headers, p);
          freez(p);
@@ -1395,15 +1409,10 @@ static jb_err receive_client_request(struct client_state *csp)
       get_url_actions(csp, http);
    }
 
-   /* 
+   /*
     * Save a copy of the original request for logging
     */
-   http->ocmd = strdup(http->cmd);
-   if (http->ocmd == NULL)
-   {
-      log_error(LOG_LEVEL_FATAL,
-         "Out of memory copying HTTP request line");
-   }
+   http->ocmd = strdup_or_die(http->cmd);
    enlist(csp->headers, http->cmd);
 
    /* Append the previously read headers */
@@ -1495,7 +1504,7 @@ static jb_err parse_client_request(struct client_state *csp)
  *                this function is called (via serve()) to handle the
  *                main business of the communication.  This function
  *                returns after dealing with a single request. It can
- *                be called multiple times witht the same client socket
+ *                be called multiple times with the same client socket
  *                if the client is keeping the connection alive.
  *
  *                The decision whether or not a client connection will
@@ -1522,8 +1531,6 @@ static void chat(struct client_state *csp)
    int server_body;
    int ms_iis5_hack = 0;
    unsigned long long byte_count = 0;
-   int forwarded_connect_retries = 0;
-   int max_forwarded_connect_retries = csp->config->forwarded_connect_retries;
    const struct forward_spec *fwd;
    struct http_request *http;
    long len = 0; /* for buffer sizes (and negative error codes) */
@@ -1601,8 +1608,8 @@ static void chat(struct client_state *csp)
          csp->action->string[ACTION_STRING_LIMIT_CONNECT];
       assert(NULL != acceptable_connect_ports);
       log_error(LOG_LEVEL_INFO, "Request from %s marked for blocking. "
-         "limit-connect{%s} doesn't allow CONNECT requests to port %d.",
-         csp->ip_addr_str, acceptable_connect_ports, csp->http->port);
+         "limit-connect{%s} doesn't allow CONNECT requests to %s",
+         csp->ip_addr_str, acceptable_connect_ports, csp->http->hostport);
       csp->action->flags |= ACTION_BLOCK;
       http->ssl = 0;
    }
@@ -1624,6 +1631,7 @@ static void chat(struct client_state *csp)
       return;
    }
 
+   log_applied_actions(csp->action);
    log_error(LOG_LEVEL_GPC, "%s%s", http->hostport, http->path);
 
    if (fwd->forward_host)
@@ -1659,14 +1667,7 @@ static void chat(struct client_state *csp)
       }
 #endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
 
-      while ((csp->server_connection.sfd = forwarded_connect(fwd, http, csp))
-         && (errno == EINVAL)
-         && (forwarded_connect_retries++ < max_forwarded_connect_retries))
-      {
-         log_error(LOG_LEVEL_ERROR,
-            "failed request #%u to connect to %s. Trying again.",
-            forwarded_connect_retries, http->hostport);
-      }
+      csp->server_connection.sfd = forwarded_connect(fwd, http, csp);
 
       if (csp->server_connection.sfd == JB_INVALID_SOCKET)
       {
@@ -1682,8 +1683,6 @@ static void chat(struct client_state *csp)
          else
          {
             rsp = error_response(csp, "connect-failed");
-            log_error(LOG_LEVEL_CONNECT, "connect to: %s failed: %E",
-               http->hostport);
          }
 
          /* Write the answer to the client */
@@ -1702,16 +1701,16 @@ static void chat(struct client_state *csp)
    }
 #endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
 
-   hdr = list_to_text(csp->headers);
-   if (hdr == NULL)
-   {
-      /* FIXME Should handle error properly */
-      log_error(LOG_LEVEL_FATAL, "Out of memory parsing client header");
-   }
-   list_remove_all(csp->headers);
-
    if (fwd->forward_host || (http->ssl == 0))
    {
+      hdr = list_to_text(csp->headers);
+      if (hdr == NULL)
+      {
+         /* FIXME Should handle error properly */
+         log_error(LOG_LEVEL_FATAL, "Out of memory parsing client header");
+      }
+      list_remove_all(csp->headers);
+
       /*
        * Write the client's (modified) header to the server
        * (along with anything else that may be in the buffer)
@@ -1731,17 +1730,18 @@ static void chat(struct client_state *csp)
          freez(hdr);
          return;
       }
+      freez(hdr);
    }
    else
    {
       /*
        * We're running an SSL tunnel and we're not forwarding,
-       * so just send the "connect succeeded" message to the
-       * client, flush the rest, and get out of the way.
+       * so just ditch the client headers, send the "connect succeeded"
+       * message to the client, flush the rest, and get out of the way.
        */
+      list_remove_all(csp->headers);
       if (write_socket(csp->cfd, CSUCCEED, strlen(CSUCCEED)))
       {
-         freez(hdr);
          return;
       }
       IOB_RESET(csp);
@@ -1751,9 +1751,6 @@ static void chat(struct client_state *csp)
 
    csp->server_connection.request_sent = time(NULL);
 
-   /* we're finished with the client's header */
-   freez(hdr);
-
    maxfd = (csp->cfd > csp->server_connection.sfd) ?
       csp->cfd : csp->server_connection.sfd;
 
@@ -1876,8 +1873,9 @@ static void chat(struct client_state *csp)
                 */
                watch_client_socket = 0;
                log_error(LOG_LEVEL_CONNECT,
-                  "Stopping to watch the client socket. "
-                  "There's already another request waiting.");
+                  "Stopping to watch the client socket %d. "
+                  "There's already another request waiting.",
+                  csp->cfd);
                continue;
             }
             /*
@@ -1949,7 +1947,14 @@ static void chat(struct client_state *csp)
       if (FD_ISSET(csp->server_connection.sfd, &rfds))
       {
 #ifdef FEATURE_CONNECTION_KEEP_ALIVE
-         if (!socket_is_still_alive(csp->cfd))
+         /*
+          * If we are buffering content, we don't want to eat up to
+          * buffer-limit bytes if the client no longer cares about them.
+          * If we aren't buffering, however, a dead client socket will be
+          * noticed pretty much right away anyway, so we can reduce the
+          * overhead by skipping the check.
+          */
+         if (buffer_and_filter_content && !socket_is_still_alive(csp->cfd))
          {
 #ifdef _WIN32
             log_error(LOG_LEVEL_CONNECT,
@@ -2065,6 +2070,20 @@ static void chat(struct client_state *csp)
                   {
                      csp->content_length = (size_t)(csp->iob->eod - csp->iob->cur);
                   }
+#ifdef FEATURE_COMPRESSION
+                  else if ((csp->flags & CSP_FLAG_CLIENT_SUPPORTS_DEFLATE)
+                     && (csp->content_length > LOWER_LENGTH_LIMIT_FOR_COMPRESSION))
+                  {
+                     char *compressed_content = compress_buffer(p,
+                        (size_t *)&csp->content_length, csp->config->compression_level);
+                     if (compressed_content != NULL)
+                     {
+                        freez(p);
+                        p = compressed_content;
+                        csp->flags |= CSP_FLAG_BUFFERED_CONTENT_DEFLATED;
+                     }
+                  }
+#endif
 
                   if (JB_ERR_OK != update_server_headers(csp))
                   {
@@ -2137,7 +2156,7 @@ static void chat(struct client_state *csp)
                   hdr = list_to_text(csp->headers);
                   if (hdr == NULL)
                   {
-                     /* 
+                     /*
                       * Memory is too tight to even generate the header.
                       * Send our static "Out-of-memory" page.
                       */
@@ -2194,7 +2213,7 @@ static void chat(struct client_state *csp)
             {
                log_error(LOG_LEVEL_ERROR, "Out of memory while looking for end of server headers.");
                rsp = cgi_error_memory();
-               send_crunch_response(csp, rsp);               
+               send_crunch_response(csp, rsp);
                mark_server_socket_tainted(csp);
                return;
             }
@@ -2246,18 +2265,19 @@ static void chat(struct client_state *csp)
                if ((csp->flags & CSP_FLAG_REUSED_CLIENT_CONNECTION))
                {
                   log_error(LOG_LEVEL_ERROR,
-                     "Empty server or forwarder response received on socket %d. "
+                     "No server or forwarder response received on socket %d. "
                      "Closing client socket %d without sending data.",
                      csp->server_connection.sfd, csp->cfd);
+                  log_error(LOG_LEVEL_CLF,
+                     "%s - - [%T] \"%s\" 502 0", csp->ip_addr_str, http->cmd);
                }
                else
                {
                   log_error(LOG_LEVEL_ERROR,
-                     "Empty server or forwarder response received on socket %d.",
+                     "No server or forwarder response received on socket %d.",
                      csp->server_connection.sfd);
                   send_crunch_response(csp, error_response(csp, "no-server-data"));
                }
-               log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" 502 0", csp->ip_addr_str, http->cmd);
                free_http_request(http);
                mark_server_socket_tainted(csp);
                return;
@@ -2394,7 +2414,7 @@ static void chat(struct client_state *csp)
    if (csp->content_length == 0)
    {
       /*
-       * If Privoxy didn't recalculate the Content-Lenght,
+       * If Privoxy didn't recalculate the Content-Length,
        * byte_count is still correct.
        */
       csp->content_length = byte_count;
@@ -2433,6 +2453,8 @@ static void chat(struct client_state *csp)
  *********************************************************************/
 static void prepare_csp_for_next_request(struct client_state *csp)
 {
+   unsigned int toggled_on_flag_set = (0 != (csp->flags & CSP_FLAG_TOGGLED_ON));
+
    csp->content_type = 0;
    csp->content_length = 0;
    csp->expected_content_length = 0;
@@ -2451,9 +2473,11 @@ static void prepare_csp_for_next_request(struct client_state *csp)
       csp->fwd = NULL;
    }
    /* XXX: Store per-connection flags someplace else. */
-   csp->flags &= CSP_FLAG_TOGGLED_ON;
-   csp->flags |= CSP_FLAG_ACTIVE;
-   csp->flags |= CSP_FLAG_REUSED_CLIENT_CONNECTION;
+   csp->flags = (CSP_FLAG_ACTIVE | CSP_FLAG_REUSED_CLIENT_CONNECTION);
+   if (toggled_on_flag_set)
+   {
+      csp->flags |= CSP_FLAG_TOGGLED_ON;
+   }
 }
 #endif /* def FEATURE_CONNECTION_KEEP_ALIVE */
 
@@ -2500,10 +2524,13 @@ static void serve(struct client_state *csp)
 
       continue_chatting = (csp->config->feature_flags
          & RUNTIME_FEATURE_CONNECTION_KEEP_ALIVE)
-         && (((csp->flags & CSP_FLAG_SERVER_CONNECTION_KEEP_ALIVE)
-               && !(csp->flags & CSP_FLAG_SERVER_SOCKET_TAINTED))
-            || (csp->flags & CSP_FLAG_CRUNCHED))
-         && (csp->cfd != JB_INVALID_SOCKET);
+         && !(csp->flags & CSP_FLAG_SERVER_SOCKET_TAINTED)
+         && ((csp->flags & CSP_FLAG_SERVER_CONNECTION_KEEP_ALIVE)
+             || (csp->flags & CSP_FLAG_CRUNCHED))
+         && (csp->cfd != JB_INVALID_SOCKET)
+         && ((csp->flags & CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE)
+             || (csp->config->feature_flags &
+                RUNTIME_FEATURE_CONNECTION_SHARING));
 
       if (continue_chatting && !(csp->flags & CSP_FLAG_CRUNCHED))
       {
@@ -2530,37 +2557,41 @@ static void serve(struct client_state *csp)
 
       if (continue_chatting)
       {
-         unsigned int client_timeout;
+         unsigned int client_timeout = 1; /* XXX: Use something else here? */
 
-         if (csp->server_connection.sfd != JB_INVALID_SOCKET)
+         if (0 != (csp->flags & CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE))
          {
-            client_timeout = (unsigned)csp->server_connection.keep_alive_timeout - latency;
-            log_error(LOG_LEVEL_CONNECT,
-               "Waiting for the next client request on socket %d. "
-               "Keeping the server socket %d to %s open.",
-               csp->cfd, csp->server_connection.sfd, csp->server_connection.host);
-         }
-         else
-         {
-            client_timeout = 1; /* XXX: Use something else here? */
-            log_error(LOG_LEVEL_CONNECT,
-               "Waiting for the next client request on socket %d. "
-               "No server socket to keep open.", csp->cfd);
+            if (csp->server_connection.sfd != JB_INVALID_SOCKET)
+            {
+               client_timeout = (unsigned)csp->server_connection.keep_alive_timeout - latency;
+               log_error(LOG_LEVEL_CONNECT,
+                  "Waiting for the next client request on socket %d. "
+                  "Keeping the server socket %d to %s open.",
+                  csp->cfd, csp->server_connection.sfd, csp->server_connection.host);
+            }
+            else
+            {
+               log_error(LOG_LEVEL_CONNECT,
+                  "Waiting for the next client request on socket %d. "
+                  "No server socket to keep open.", csp->cfd);
+            }
          }
          if ((csp->flags & CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE)
             && data_is_available(csp->cfd, (int)client_timeout)
             && socket_is_still_alive(csp->cfd))
          {
-            log_error(LOG_LEVEL_CONNECT, "Client request arrived in "
-               "time or the client closed the connection on socket %d.",
-                csp->cfd);
+            log_error(LOG_LEVEL_CONNECT,
+               "Client request arrived in time on socket %d.", csp->cfd);
             prepare_csp_for_next_request(csp);
          }
          else
          {
-            log_error(LOG_LEVEL_CONNECT,
-               "No additional client request received in time on socket %d.",
-                csp->cfd);
+            if (0 != (csp->flags & CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE))
+            {
+               log_error(LOG_LEVEL_CONNECT,
+                  "No additional client request received in time on socket %d.",
+                  csp->cfd);
+            }
 #ifdef FEATURE_CONNECTION_SHARING
             if ((csp->config->feature_flags & RUNTIME_FEATURE_CONNECTION_SHARING)
                && (socket_is_still_alive(csp->server_connection.sfd)))
@@ -2594,16 +2625,14 @@ static void serve(struct client_state *csp)
       else if (csp->server_connection.sfd != JB_INVALID_SOCKET)
       {
          log_error(LOG_LEVEL_CONNECT,
-            "The connection on server socket %d to %s isn't reusable. "
-            "Closing. Server connection: keep-alive %u, tainted: %u, "
-            "socket alive %u. Client connection: crunched: %u, "
-            "socket alive: %u. Server timeout: %u. "
+            "The connection on server socket %d to %s isn't reusable. Closing. "
+            "Server connection: keep-alive %u, tainted: %u, socket alive %u. "
+            "Client connection: socket alive: %u. Server timeout: %u. "
             "Configuration file change detected: %u",
             csp->server_connection.sfd, csp->server_connection.host,
             0 != (csp->flags & CSP_FLAG_SERVER_CONNECTION_KEEP_ALIVE),
             0 != (csp->flags & CSP_FLAG_SERVER_SOCKET_TAINTED),
             socket_is_still_alive(csp->server_connection.sfd),
-            0 != (csp->flags & CSP_FLAG_CRUNCHED),
             socket_is_still_alive(csp->cfd),
             csp->server_connection.keep_alive_timeout,
             config_file_change_detected);
@@ -2631,6 +2660,10 @@ static void serve(struct client_state *csp)
 
    if (csp->cfd != JB_INVALID_SOCKET)
    {
+      log_error(LOG_LEVEL_CONNECT, "Closing client socket %d. "
+         "Keep-alive: %u, Socket alive: %u. Data available: %u.",
+         csp->cfd, 0 != (csp->flags & CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE),
+         socket_is_still_alive(csp->cfd), data_is_available(csp->cfd, 0));
       close_socket(csp->cfd);
    }
 
@@ -2831,6 +2864,7 @@ static void initialize_mutexes(void)
 #ifndef HAVE_RANDOM
    privoxy_mutex_init(&rand_mutex);
 #endif /* ndef HAVE_RANDOM */
+
 #endif /* def MUTEX_LOCKS_AVAILABLE */
 }
 
@@ -2869,7 +2903,6 @@ int main(int argc, char **argv)
 #ifdef unix
    struct passwd *pw = NULL;
    struct group *grp = NULL;
-   char *p;
    int do_chroot = 0;
    char *pre_chroot_nslookup_to_load_resolver = NULL;
 #endif
@@ -2906,16 +2939,16 @@ int main(int argc, char **argv)
          const char *pName = argv[argc_pos] + 9;
          if (*pName == ':')
             pName++;
-         exit( (install_service(pName)) ? 0 : 1 );
+         exit((install_service(pName)) ? 0 : 1);
       }
-      else if (strncmp(argv[argc_pos], "--uninstall", 11) == 0)
+      else if (strncmp(argv[argc_pos], "--uninstall", 11) == 0)
       {
          const char *pName = argv[argc_pos] + 11;
          if (*pName == ':')
             pName++;
          exit((uninstall_service(pName)) ? 0 : 1);
       }
-      else if (strcmp(argv[argc_pos], "--service" ) == 0)
+      else if (strcmp(argv[argc_pos], "--service") == 0)
       {
          bRunAsService = TRUE;
          w32_set_service_cwd();
@@ -2932,7 +2965,7 @@ int main(int argc, char **argv)
          usage(argv[0]);
       }
 
-      else if(strcmp(argv[argc_pos], "--version") == 0)
+      else if (strcmp(argv[argc_pos], "--version") == 0)
       {
          printf("Privoxy version " VERSION " (" HOME_PAGE_URL ")\n");
          exit(0);
@@ -2940,46 +2973,57 @@ int main(int argc, char **argv)
 
 #if defined(unix)
 
-      else if (strcmp(argv[argc_pos], "--no-daemon" ) == 0)
+      else if (strcmp(argv[argc_pos], "--no-daemon") == 0)
       {
          set_debug_level(LOG_LEVEL_FATAL | LOG_LEVEL_ERROR | LOG_LEVEL_INFO);
          daemon_mode = 0;
       }
 
-      else if (strcmp(argv[argc_pos], "--pidfile" ) == 0)
+      else if (strcmp(argv[argc_pos], "--pidfile") == 0)
       {
          if (++argc_pos == argc) usage(argv[0]);
-         pidfile = strdup(argv[argc_pos]);
+         pidfile = strdup_or_die(argv[argc_pos]);
       }
 
-      else if (strcmp(argv[argc_pos], "--user" ) == 0)
+      else if (strcmp(argv[argc_pos], "--user") == 0)
       {
+         char *user_arg;
+         char *group_name;
+
          if (++argc_pos == argc) usage(argv[argc_pos]);
 
-         if ((NULL != (p = strchr(argv[argc_pos], '.'))) && *(p + 1) != '0')
+         user_arg = strdup_or_die(argv[argc_pos]);
+         group_name = strchr(user_arg, '.');
+         if (NULL != group_name)
          {
-            *p++ = '\0';
-            if (NULL == (grp = getgrnam(p)))
+            /* Nul-terminate the user name */
+            *group_name = '\0';
+
+            /* Skip the former delimiter to actually reach the group name */
+            group_name++;
+
+            grp = getgrnam(group_name);
+            if (NULL == grp)
             {
-               log_error(LOG_LEVEL_FATAL, "Group %s not found.", p);
+               log_error(LOG_LEVEL_FATAL, "Group '%s' not found.", group_name);
             }
          }
-
-         if (NULL == (pw = getpwnam(argv[argc_pos])))
+         pw = getpwnam(user_arg);
+         if (NULL == pw)
          {
-            log_error(LOG_LEVEL_FATAL, "User %s not found.", argv[argc_pos]);
+            log_error(LOG_LEVEL_FATAL, "User '%s' not found.", user_arg);
          }
 
-         if (p != NULL) *--p = '\0';
+         freez(user_arg);
       }
 
-      else if (strcmp(argv[argc_pos], "--pre-chroot-nslookup" ) == 0)
+      else if (strcmp(argv[argc_pos], "--pre-chroot-nslookup") == 0)
       {
          if (++argc_pos == argc) usage(argv[0]);
-         pre_chroot_nslookup_to_load_resolver = strdup(argv[argc_pos]);
+         pre_chroot_nslookup_to_load_resolver = strdup_or_die(argv[argc_pos]);
       }
 
-      else if (strcmp(argv[argc_pos], "--chroot" ) == 0)
+      else if (strcmp(argv[argc_pos], "--chroot") == 0)
       {
          do_chroot = 1;
       }
@@ -3006,31 +3050,25 @@ int main(int argc, char **argv)
    show_version(Argv[0]);
 
 #if defined(unix)
-   if ( *configfile != '/' )
+   if (*configfile != '/')
    {
       char cwd[BUFFER_SIZE];
       char *abs_file;
-      size_t abs_file_size; 
+      size_t abs_file_size;
 
       /* make config-filename absolute here */
       if (NULL == getcwd(cwd, sizeof(cwd)))
       {
          perror("failed to get current working directory");
-         exit( 1 );
+         exit(1);
       }
 
+      basedir = strdup_or_die(cwd);
       /* XXX: why + 5? */
       abs_file_size = strlen(cwd) + strlen(configfile) + 5;
-      basedir = strdup(cwd);
-
-      if (NULL == basedir ||
-          NULL == (abs_file = malloc(abs_file_size)))
-      {
-         perror("malloc failed");
-         exit( 1 );
-      }
+      abs_file = malloc_or_die(abs_file_size);
       strlcpy(abs_file, basedir, abs_file_size);
-      strlcat(abs_file, "/", abs_file_size );
+      strlcat(abs_file, "/", abs_file_size);
       strlcat(abs_file, configfile, abs_file_size);
       configfile = abs_file;
    }
@@ -3064,12 +3102,11 @@ int main(int argc, char **argv)
 #if !defined(_WIN32) && !defined(__OS2__) && !defined(AMIGA)
 {
    int idx;
-   const int catched_signals[] = { SIGTERM, SIGINT, SIGHUP, 0 };
-   const int ignored_signals[] = { SIGPIPE, 0 };
+   const int catched_signals[] = { SIGTERM, SIGINT, SIGHUP };
 
-   for (idx = 0; catched_signals[idx] != 0; idx++)
+   for (idx = 0; idx < SZ(catched_signals); idx++)
    {
-#ifdef sun /* FIXME: Is it safe to check for HAVE_SIGSET instead? */ 
+#ifdef sun /* FIXME: Is it safe to check for HAVE_SIGSET instead? */
       if (sigset(catched_signals[idx], sig_handler) == SIG_ERR)
 #else
       if (signal(catched_signals[idx], sig_handler) == SIG_ERR)
@@ -3079,12 +3116,9 @@ int main(int argc, char **argv)
       }
    }
 
-   for (idx = 0; ignored_signals[idx] != 0; idx++)
+   if (signal(SIGPIPE, SIG_IGN) == SIG_ERR)
    {
-      if (signal(ignored_signals[idx], SIG_IGN) == SIG_ERR)
-      {
-         log_error(LOG_LEVEL_FATAL, "Can't set ignore-handler for signal %d: %E", ignored_signals[idx]);
-      }
+      log_error(LOG_LEVEL_FATAL, "Can't set ignore-handler for SIGPIPE: %E");
    }
 
 }
@@ -3114,12 +3148,12 @@ int main(int argc, char **argv)
       int fd;
       pid_t pid = fork();
 
-      if ( pid < 0 ) /* error */
+      if (pid < 0) /* error */
       {
          perror("fork");
-         exit( 3 );
+         exit(3);
       }
-      else if ( pid != 0 ) /* parent */
+      else if (pid != 0) /* parent */
       {
          int status;
          pid_t wpid;
@@ -3127,13 +3161,13 @@ int main(int argc, char **argv)
           * must check for errors
           * child died due to missing files aso
           */
-         sleep( 1 );
-         wpid = waitpid( pid, &status, WNOHANG );
-         if ( wpid != 0 )
+         sleep(1);
+         wpid = waitpid(pid, &status, WNOHANG);
+         if (wpid != 0)
          {
-            exit( 1 );
+            exit(1);
          }
-         exit( 0 );
+         exit(0);
       }
       /* child */
 
@@ -3239,7 +3273,7 @@ int main(int argc, char **argv)
          if (putenv(putenv_dummy) != 0)
          {
             log_error(LOG_LEVEL_FATAL, "Cannot putenv(): HOME");
-         }                
+         }
 
          snprintf(putenv_dummy, sizeof(putenv_dummy), "USER=%s", pw->pw_name);
          if (putenv(putenv_dummy) != 0)
@@ -3260,7 +3294,7 @@ int main(int argc, char **argv)
     */
    if (bRunAsService)
    {
-      /* Yup, so now we must attempt to establish a connection 
+      /* Yup, so now we must attempt to establish a connection
        * with the service dispatcher. This will only work if this
        * process was launched by the service control manager to
        * actually run as a service. If this isn't the case, i've
@@ -3302,61 +3336,127 @@ int main(int argc, char **argv)
  *                on failure.
  *
  * Parameters  :
- *          1  :  config = Privoxy configuration.  Specifies port
- *                         to bind to.
+ *          1  :  haddr = Host addres to bind to. Use NULL to bind to
+ *                        INADDR_ANY.
+ *          2  :  hport = Specifies port to bind to.
  *
  * Returns     :  Port that was opened.
  *
  *********************************************************************/
-static jb_socket bind_port_helper(struct configuration_spec * config)
+static jb_socket bind_port_helper(const char *haddr, int hport)
 {
    int result;
    jb_socket bfd;
 
-   if (config->haddr == NULL)
-   {
-      log_error(LOG_LEVEL_INFO, "Listening on port %d on all IP addresses",
-                config->hport);
-   }
-   else
-   {
-      log_error(LOG_LEVEL_INFO, "Listening on port %d on IP address %s",
-                config->hport, config->haddr);
-   }
-
-   result = bind_port(config->haddr, config->hport, &bfd);
+   result = bind_port(haddr, hport, &bfd);
 
    if (result < 0)
    {
+      const char *bind_address = (NULL != haddr) ? haddr : "INADDR_ANY";
       switch(result)
       {
-         case -3 :
-            log_error(LOG_LEVEL_FATAL, "can't bind to %s:%d: "
-               "There may be another Privoxy or some other "
-               "proxy running on port %d",
-               (NULL != config->haddr) ? config->haddr : "INADDR_ANY",
-                      config->hport, config->hport);
+         case -3:
+            log_error(LOG_LEVEL_FATAL,
+               "can't bind to %s:%d: There may be another Privoxy "
+               "or some other proxy running on port %d",
+               bind_address, hport, hport);
 
-         case -2 :
-            log_error(LOG_LEVEL_FATAL, "can't bind to %s:%d: " 
-               "The hostname is not resolvable",
-               (NULL != config->haddr) ? config->haddr : "INADDR_ANY", config->hport);
+         case -2:
+            log_error(LOG_LEVEL_FATAL,
+               "can't bind to %s:%d: The hostname is not resolvable",
+               bind_address, hport);
 
-         default :
+         default:
             log_error(LOG_LEVEL_FATAL, "can't bind to %s:%d: %E",
-               (NULL != config->haddr) ? config->haddr : "INADDR_ANY", config->hport);
+               bind_address, hport);
       }
 
       /* shouldn't get here */
       return JB_INVALID_SOCKET;
    }
 
-   config->need_bind = 0;
+   if (haddr == NULL)
+   {
+      log_error(LOG_LEVEL_INFO, "Listening on port %d on all IP addresses",
+         hport);
+   }
+   else
+   {
+      log_error(LOG_LEVEL_INFO, "Listening on port %d on IP address %s",
+         hport, haddr);
+   }
 
    return bfd;
 }
 
 
+/*********************************************************************
+ *
+ * Function    :  bind_ports_helper
+ *
+ * Description :  Bind the listen ports.  Handles logging, and aborts
+ *                on failure.
+ *
+ * Parameters  :
+ *          1  :  config = Privoxy configuration.  Specifies ports
+ *                         to bind to.
+ *          2  :  sockets = Preallocated array of opened sockets
+ *                          corresponding to specification in config.
+ *                          All non-opened sockets will be set to
+ *                          JB_INVALID_SOCKET.
+ *
+ * Returns     :  Nothing. Inspect sockets argument.
+ *
+ *********************************************************************/
+static void bind_ports_helper(struct configuration_spec * config,
+                              jb_socket sockets[])
+{
+   int i;
+
+   for (i = 0; i < MAX_LISTENING_SOCKETS; i++)
+   {
+      if (config->hport[i])
+      {
+         sockets[i] = bind_port_helper(config->haddr[i], config->hport[i]);
+      }
+      else
+      {
+         sockets[i] = JB_INVALID_SOCKET;
+      }
+   }
+   config->need_bind = 0;
+}
+
+
+/*********************************************************************
+ *
+ * Function    :  close_ports_helper
+ *
+ * Description :  Close listenings ports.
+ *
+ * Parameters  :
+ *          1  :  sockets = Array of opened and non-opened sockets to
+ *                          close. All sockets will be set to
+ *                          JB_INVALID_SOCKET.
+ *
+ * Returns     :  Nothing.
+ *
+ *********************************************************************/
+static void close_ports_helper(jb_socket sockets[])
+{
+   int i;
+
+   for (i = 0; i < MAX_LISTENING_SOCKETS; i++)
+   {
+      if (JB_INVALID_SOCKET != sockets[i])
+      {
+         close_socket(sockets[i]);
+      }
+      sockets[i] = JB_INVALID_SOCKET;
+   }
+}
+
+
 #ifdef _WIN32
 /* Without this simple workaround we get this compiler warning from _beginthread
  *     warning C4028: formal parameter 1 different from declaration
@@ -3383,7 +3483,7 @@ static void listen_loop(void)
 {
    struct client_states *csp_list = NULL;
    struct client_state *csp = NULL;
-   jb_socket bfd;
+   jb_socket bfds[MAX_LISTENING_SOCKETS];
    struct configuration_spec *config;
    unsigned int active_threads = 0;
 
@@ -3397,7 +3497,7 @@ static void listen_loop(void)
    initialize_reusable_connections();
 #endif /* def FEATURE_CONNECTION_SHARING */
 
-   bfd = bind_port_helper(config);
+   bind_ports_helper(config, bfds);
 
 #ifdef FEATURE_GRACEFUL_TERMINATION
    while (!g_terminate)
@@ -3440,12 +3540,34 @@ static void listen_loop(void)
       }
       csp = &csp_list->csp;
 
+      log_error(LOG_LEVEL_CONNECT, "Listening for new connections ... ");
+
+      if (!accept_connection(csp, bfds))
+      {
+         log_error(LOG_LEVEL_CONNECT, "accept failed: %E");
+
+#ifdef AMIGA
+         if (!childs)
+         {
+            exit(1);
+         }
+#endif
+         freez(csp_list);
+         continue;
+      }
+      else
+      {
+         log_error(LOG_LEVEL_CONNECT,
+            "accepted connection from %s on socket %d",
+            csp->ip_addr_str, csp->cfd);
+      }
+
       csp->flags |= CSP_FLAG_ACTIVE;
       csp->server_connection.sfd = JB_INVALID_SOCKET;
 
       csp->config = config = load_config();
 
-      if ( config->need_bind )
+      if (config->need_bind)
       {
          /*
           * Since we were listening to the "old port", we will not see
@@ -3460,31 +3582,9 @@ static void listen_loop(void)
           * that this will hurt people's feelings.
           */
 
-         close_socket(bfd);
+         close_ports_helper(bfds);
 
-         bfd = bind_port_helper(config);
-      }
-
-      log_error(LOG_LEVEL_CONNECT, "Listening for new connections ... ");
-
-      if (!accept_connection(csp, bfd))
-      {
-         log_error(LOG_LEVEL_CONNECT, "accept failed: %E");
-
-#ifdef AMIGA
-         if(!childs)
-         {
-            exit(1);
-         }
-#endif
-         freez(csp_list);
-         continue;
-      }
-      else
-      {
-         log_error(LOG_LEVEL_CONNECT,
-            "accepted connection from %s on socket %d",
-            csp->ip_addr_str, csp->cfd);
+         bind_ports_helper(config, bfds);
       }
 
 #ifdef FEATURE_TOGGLE
@@ -3503,7 +3603,8 @@ static void listen_loop(void)
 #ifdef FEATURE_ACL
       if (block_acl(NULL,csp))
       {
-         log_error(LOG_LEVEL_CONNECT, "Connection from %s dropped due to ACL", csp->ip_addr_str);
+         log_error(LOG_LEVEL_CONNECT,
+            "Connection from %s on socket %d dropped due to ACL", csp->ip_addr_str, csp->cfd);
          close_socket(csp->cfd);
          freez(csp->ip_addr_str);
          freez(csp_list);
@@ -3533,7 +3634,7 @@ static void listen_loop(void)
       {
          int child_id;
 
-/* this is a switch () statment in the C preprocessor - ugh */
+/* this is a switch () statement in the C preprocessor - ugh */
 #undef SELECTED_ONE_OPTION
 
 /* Use Pthreads in preference to native code */
@@ -3589,7 +3690,7 @@ static void listen_loop(void)
 #if defined(AMIGA) && !defined(SELECTED_ONE_OPTION)
 #define SELECTED_ONE_OPTION
          csp->cfd = ReleaseSocket(csp->cfd, -1);
-         
+
 #ifdef __amigaos4__
          child_id = (int)CreateNewProcTags(NP_Entry, (ULONG)server_thread,
                                            NP_Output, Output(),
@@ -3605,7 +3706,7 @@ static void listen_loop(void)
                                            NP_StackSize, 200*1024,
                                            TAG_DONE);
 #endif
-         if(0 != child_id)
+         if (0 != child_id)
          {
             childs++;
             ((struct Task *)child_id)->tc_UserData = csp;
@@ -3630,7 +3731,7 @@ static void listen_loop(void)
 
             serve(csp);
 
-            /* 
+            /*
              * If we've been toggled or we've blocked the request, tell Mom
              */
 
@@ -3641,7 +3742,7 @@ static void listen_loop(void)
             }
 #endif /* def FEATURE_TOGGLE */
 
-#ifdef FEATURE_STATISTICS  
+#ifdef FEATURE_STATISTICS
             if (csp->flags & CSP_FLAG_REJECTED)
             {
                rc |= RC_FLAG_BLOCKED;
@@ -3659,9 +3760,9 @@ static void listen_loop(void)
             int child_status;
 #if !defined(_WIN32) && !defined(__CYGWIN__)
 
-            wait( &child_status );
+            wait(&child_status);
 
-            /* 
+            /*
              * Evaluate child's return code: If the child has
              *  - been toggled, toggle ourselves
              *  - blocked its request, bump up the stats counter
@@ -3680,7 +3781,7 @@ static void listen_loop(void)
             {
                urls_rejected++;
             }
-#endif /* def FEATURE_STATISTICS */ 
+#endif /* def FEATURE_STATISTICS */
 
 #endif /* !defined(_WIN32) && defined(__CYGWIN__) */
             close_socket(csp->cfd);
@@ -3746,7 +3847,6 @@ static void listen_loop(void)
 #if defined(unix)
    freez(basedir);
 #endif
-   freez(configfile);
 
 #if defined(_WIN32) && !defined(_WIN_CONSOLE)
    /* Cleanup - remove taskbar icon etc. */