ruby-lsapi 4.0 → 4.1

checksums.yaml

@@ -0,0 +1,15 @@
+---
+!binary "U0hBMQ==":
+  metadata.gz: !binary |-
+    ZTBmYTY2NTdiZDk3NjAxNTViYmExOTc4ZDU5ZjJhYjk1MmFmNjhiZA==
+  data.tar.gz: !binary |-
+    YmRkNDNhMGZiMmI5Y2I2YjQ0M2Q4OTkzZWVhMjRkMmFmZjA4ZDFlYQ==
+!binary "U0hBNTEy":
+  metadata.gz: !binary |-
+    NTg2NGQ5Zjc1NWUyYTExNDUzMTYzN2VhODAyMDI4N2Y0MDFhMTBiMThkMWNm
+    MWU3NDY0Njg4MzcxZDUyYmYzYjJjMjIyYTUxNGU4YTUyOGQ1ZDIxZDg1YWJh
+    YjZlNDJlNTJhMWJkMzZiOWVjMmE2ODQ2ZGNmMTkzMzk1MDRhMDg=
+  data.tar.gz: !binary |-
+    MzBmZDNhMmY5NGQ3NWY0NmJmMDIyMTgzNTUyMDBhZDczMzM2Y2MwY2I5YzAx
+    NGYxN2M0OWEyYTQ1YjYzNTEwNzlmNGQ3ZGY4ZDU1MGM3MTQ2NThlZDkwODBi
+    MjExZWRkOWIxZTI1NGVjMWEwMDNmYzBkNTBjMTBhNmFlZTc5ZTM=

data/ext/lsapi/lsapidef.h

@@ -31,7 +31,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
 
 /***************************************************************************
-    $Id: lsapidef.h,v 1.15 2008/01/03 18:31:50 gwang Exp $
+    $Id: lsapidef.h,v 1.17 2012/12/01 19:23:31 gwang Exp $
                          -------------------
     begin                : Thu Feb 10 2005
     author               : George Wang
@@ -100,12 +100,14 @@ enum
 #define LSAPI_RESP_END              5
 #define LSAPI_STDERR_STREAM         6
 #define LSAPI_REQ_RECEIVED          7
+#define LSAPI_CONN_CLOSE            8
+#define LSAPI_INTERNAL_ERROR        9
 
 
 #define LSAPI_MAX_HEADER_LEN        65535
 #define LSAPI_MAX_DATA_PACKET_LEN   16384
 
-#define LSAPI_RESP_HTTP_HEADER_MAX  4096
+#define LSAPI_RESP_HTTP_HEADER_MAX  32768
 #define LSAPI_PACKET_HEADER_LEN     8
 
 

data/ext/lsapi/lsapilib.c

@@ -39,17 +39,12 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  ***************************************************************************/
 
 
-#include <lsapilib.h>
-
 #include <ctype.h>
+#include <dlfcn.h>
 #include <errno.h>
 #include <fcntl.h>
 
-#include <arpa/inet.h>
-#include <netdb.h>
-#include <netinet/in.h>
-#include <netinet/tcp.h>
-#include <sys/un.h>
+#include <sys/stat.h>
 #include <signal.h>
 #include <stdlib.h>
 #include <stdio.h>
@@ -60,8 +55,48 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #include <sys/time.h>
 #include <sys/uio.h>
 #include <sys/wait.h>
+#include <grp.h>
+#include <pwd.h>
 #include <time.h>
 #include <unistd.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <sys/un.h>
+
+#include "lsapilib.h"
+
+#if defined(linux) || defined(__linux) || defined(__linux__) || defined(__gnu_linux__)
+#include <sys/prctl.h>
+#endif
+
+#if defined(__FreeBSD__ ) || defined(__NetBSD__) || defined(__OpenBSD__) \
+    || defined(macintosh) || defined(__APPLE__) || defined(__APPLE_CC__)
+#include <sys/sysctl.h>
+#endif
+
+#include <inttypes.h>
+#ifndef uint32
+#define uint32 uint32_t
+#endif
+
+struct lsapi_MD5Context {
+    uint32 buf[4];
+    uint32 bits[2];
+    unsigned char in[64];
+};
+
+void lsapi_MD5Init(struct lsapi_MD5Context *context);
+void lsapi_MD5Update(struct lsapi_MD5Context *context, unsigned char const *buf,
+           unsigned len);
+void lsapi_MD5Final(unsigned char digest[16], struct lsapi_MD5Context *context);
+
+/*
+ * This is needed to make RSAREF happy on some MS-DOS compilers.
+ */
+typedef struct lsapi_MD5Context lsapi_MD5_CTX;
+
 
 #define LSAPI_ST_REQ_HEADER     1
 #define LSAPI_ST_REQ_BODY       2
@@ -72,12 +107,19 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #define LSAPI_INIT_RESP_HEADER_LEN 4096
 
 
+
 static int g_inited = 0;
 static int g_running = 1;
 static int s_ppid;
 static int s_slow_req_msecs = 0;
+static int s_keepListener = 0;
+static int s_dump_debug_info = 0;
+
 LSAPI_Request g_req = { -1, -1 };
 
+static char         s_pSecret[24];
+
+
 void Flush_RespBuf_r( LSAPI_Request * pReq );
 
 static const char *CGI_HEADERS[H_TRANSFER_ENCODING+1] =
@@ -160,6 +202,35 @@ static void lsapi_signal(int signo, sighandler_t handler)
 }
 
 
+static int s_enable_core_dump = 0;
+static void lsapi_enable_core_dump()
+{
+#if defined(__FreeBSD__ ) || defined(__NetBSD__) || defined(__OpenBSD__) \
+    || defined(macintosh) || defined(__APPLE__) || defined(__APPLE_CC__)
+    int  mib[2];
+    size_t len;    
+
+    len = 2;
+    if ( sysctlnametomib("kern.sugid_coredump", mib, &len) == 0 )
+    {
+        len = sizeof(s_enable_core_dump);
+        if (sysctl(mib, 2, NULL, 0, &s_enable_core_dump, len) == -1)
+            perror( "sysctl: Failed to set 'kern.sugid_coredump', "
+                    "core dump may not be available!");
+    }
+
+    
+#endif
+
+#if defined(linux) || defined(__linux) || defined(__linux__) || defined(__gnu_linux__)
+    if (prctl(PR_SET_DUMPABLE, s_enable_core_dump,0,0,0) == -1)
+        perror( "prctl: Failed to set dumpable, "
+                    "core dump may not be available!");
+#endif
+}
+
+
+
 static inline void lsapi_buildPacketHeader( struct lsapi_packet_header * pHeader,
                                 char type, int len )
 {
@@ -202,9 +273,9 @@ static int lsapi_close( int fd )
     }
 }
 
-static inline int lsapi_read( int fd, void * pBuf, int len )
+static inline ssize_t lsapi_read( int fd, void * pBuf, size_t len )
 {
-    int ret;
+    ssize_t ret;
     while( 1 )
     {
         ret = read( fd, (char *)pBuf, len );
@@ -251,7 +322,7 @@ static int lsapi_writev( int fd, struct iovec ** pVec, int count, int totalLen )
                 return totalLen - left;
             while( ret > 0 )
             {
-                if ( (*pVec)->iov_len <= ret )
+                if ( (*pVec)->iov_len <= (unsigned int )ret )
                 {
                     ret -= (*pVec)->iov_len;
                     ++(*pVec);
@@ -475,8 +546,426 @@ static void fixHeaderIndexEndian( LSAPI_Request * pReq )
             swapIntEndian( &pCur->valueLen );
             ++pCur;
         }
-    }    
+    }
+}
+
+static uid_t s_uid = 0;
+static uid_t s_defaultUid;  //web server need set this
+static gid_t s_defaultGid;
+
+#if defined(linux) || defined(__linux) || defined(__linux__) || defined(__gnu_linux__)
+
+#define LSAPI_LVE_DISABLED  0
+#define LSAPI_LVE_ENABLED   1
+#define LSAPI_CAGEFS_ENABLED 2
+#define LSAPI_CAGEFS_NO_SUEXEC 3
+struct liblve;
+static int s_enable_lve = LSAPI_LVE_DISABLED;
+static struct liblve * s_lve = NULL;
+
+static void *s_liblve;
+static int (*fp_lve_is_available)(void) = NULL;
+static int (*fp_lve_instance_init)(struct liblve *) = NULL;
+static int (*fp_lve_destroy)(struct liblve *) = NULL;
+static int (*fp_lve_enter)(struct liblve *, uint32_t, int32_t, int32_t, uint32_t *) = NULL;
+static int (*fp_lve_leave)(struct liblve *, uint32_t *) = NULL;
+static int (*fp_lve_jail)( struct passwd *, char *) = NULL;
+static int lsapi_load_lve_lib()
+{
+    s_liblve = dlopen("liblve.so.0", RTLD_LAZY);
+    if (s_liblve)
+    {
+        fp_lve_is_available = dlsym(s_liblve, "lve_is_available");
+        if (dlerror() == NULL) 
+        {
+            if ( !(*fp_lve_is_available)() )
+            {
+                int uid = getuid();
+                if ( uid )
+                {
+                    setreuid( s_uid, uid );
+                    if ( !(*fp_lve_is_available)() )
+                        s_enable_lve = 0;
+                    setreuid( uid, s_uid );
+                }
+            }
+        }
+    }
+    else
+    {
+        s_enable_lve = LSAPI_LVE_DISABLED;
+    }
+    return (s_liblve)? 0 : -1;
+}
+
+static int init_lve_ex()
+{
+    int rc;
+    if ( !s_liblve )
+        return -1; 
+    fp_lve_instance_init = dlsym(s_liblve, "lve_instance_init");
+    fp_lve_destroy = dlsym(s_liblve, "lve_destroy");
+    fp_lve_enter = dlsym(s_liblve, "lve_enter");
+    fp_lve_leave = dlsym(s_liblve, "lve_leave");
+    if ( s_enable_lve >= LSAPI_CAGEFS_ENABLED )
+        fp_lve_jail = dlsym(s_liblve, "jail" );
+
+    if ( s_lve == NULL ) 
+    {
+        rc = (*fp_lve_instance_init)(NULL);
+        s_lve = malloc(rc);
+    }
+    rc = (*fp_lve_instance_init)(s_lve);
+    if (rc != 0) 
+    {
+        perror( "LSAPI: Unable to initialize LVE" );
+        free( s_lve );
+        s_lve = NULL;
+        return -1;
+    }
+    return 0;
+    
+}
+
+#endif
+
+
+
+static int readSecret( const char * pSecretFile )
+{
+    struct stat st;
+    int fd = open( pSecretFile, O_RDONLY , 0600 );
+    if ( fd == -1 )
+    {
+        fprintf( stderr, "LSAPI: failed to open secret file: %s!\n", pSecretFile );
+        return -1;
+    }
+    if ( fstat( fd, &st ) == -1 )
+    {
+        fprintf( stderr, "LSAPI: failed to check state of file: %s!\n", pSecretFile );
+        close( fd );
+        return -1;
+    }
+/*
+    if ( st.st_uid != s_uid )
+    {
+        fprintf( stderr, "LSAPI: file owner check failure: %s!\n", pSecretFile );
+        close( fd );
+        return -1;
+    }
+*/
+    if ( st.st_mode & 0077 )
+    {
+        fprintf( stderr, "LSAPI: file permission check failure: %s\n", pSecretFile );
+        close( fd );
+        return -1;
+    }
+    if ( read( fd, s_pSecret, 16 ) < 16 )
+    {
+        fprintf( stderr, "LSAPI: failed to read secret from secret file: %s\n", pSecretFile );
+        close( fd );
+        return -1;
+    }
+    close( fd );
+    return 0;
+}
+
+static int lsapi_initSuEXEC()
+{
+    int i;
+    struct passwd * pw;
+    pw = getpwnam( "nobody" );
+    s_defaultUid = pw->pw_uid;
+    s_defaultGid = pw->pw_gid;
+    if ( s_uid == 0 )
+    {
+        const char * p = getenv( "LSAPI_DEFAULT_UID" );
+        if ( p )
+        {
+            i = atoi( p );
+            if ( i > 0 )
+                s_defaultUid = i;
+        }
+        p = getenv( "LSAPI_DEFAULT_GID" );
+        if ( p )
+        {
+            i = atoi( p );
+            if ( i > 0 )
+                s_defaultGid = i;
+        }
+        p = getenv( "LSAPI_SECRET" );
+        if (( !p )||( readSecret(p) == -1 ))
+                return -1;	
+    }
+    return 0;
+}
+
+int LSAPI_is_suEXEC_Daemon()
+{
+    if (( !s_uid )&&( s_pSecret[0] ))
+        return 1;
+    else
+        return 0;
+}
+
+static int LSAPI_perror_r( LSAPI_Request * pReq, const char * pErr1, const char *pErr2 )
+{
+    char achError[1024];
+    int n = snprintf(achError, 1024, "%s:%s: %s\n", pErr1, (pErr2)?pErr2:"", strerror( errno ) );
+    if ( pReq )
+        LSAPI_Write_Stderr_r( pReq, achError, n );
+    else
+        write( STDERR_FILENO, achError, n );
+    return 0;
+}
+
+static int lsapi_enterLVE( LSAPI_Request * pReq, uid_t uid )
+{
+#if defined(linux) || defined(__linux) || defined(__linux__) || defined(__gnu_linux__)
+    if ( s_lve && uid ) //root user should not do that
+    {
+        uint32_t cookie;
+        int ret = -1;
+        ret = (*fp_lve_enter)(s_lve, uid, -1, -1, &cookie);
+        if ( ret < 0 )
+        {
+            fprintf( stderr, "Pid (%d): enter LVE (%d) : ressult: %d !\n", getpid(), uid, ret );
+            LSAPI_perror_r(pReq, "LSAPI: lve_enter() failure, reached resource limit.", NULL );
+            return -1;
+        }
+    }
+#endif
+
+    return 0;
+}
+
+static int lsapi_jailLVE( LSAPI_Request * pReq, uid_t uid, struct passwd * pw )
+{
+    int ret = 0;
+#if defined(linux) || defined(__linux) || defined(__linux__) || defined(__gnu_linux__)
+    char  error_msg[1024] = "";
+    ret = (*fp_lve_jail)( pw, error_msg );
+    if ( ret < 0 )
+    {
+        fprintf( stderr, "LSAPI (%d): LVE jail(%d) ressult: %d, error: %s !\n", 
+                        getpid(), uid, ret, error_msg );
+        LSAPI_perror_r( pReq, "LSAPI: jail() failure.", NULL );
+        return -1;
+    }
+#endif
+    return ret;
+}
+
+
+#if defined(linux) || defined(__linux) || defined(__linux__) || defined(__gnu_linux__)
+static int lsapi_initLVE()
+{
+    const char * pEnv;
+    if ( (pEnv = getenv( "LSAPI_LVE_ENABLE" ))!= NULL )
+    {
+        s_enable_lve = atol( pEnv );
+        pEnv = NULL;
+    }
+    else if ( (pEnv = getenv( "LVE_ENABLE" ))!= NULL )
+    {
+        s_enable_lve = atol( pEnv );
+        pEnv = NULL;
+    }
+    if ( s_enable_lve && !s_uid )
+    {
+        lsapi_load_lve_lib();
+        if ( s_enable_lve )
+        {
+            return init_lve_ex();
+        }
+
+    }
+    return 0;
 }
+#endif
+
+
+static int setUID_LVE(LSAPI_Request * pReq, uid_t uid, gid_t gid, const char * pChroot)
+{
+    int rv;
+    struct passwd * pw;
+    pw = getpwuid( uid );
+#if defined(linux) || defined(__linux) || defined(__linux__) || defined(__gnu_linux__)
+    if ( s_lve )
+    { 
+        if( lsapi_enterLVE( pReq, uid ) == -1 )
+            return -1;
+        if ( pw && fp_lve_jail)
+        {
+            rv = lsapi_jailLVE( pReq, uid, pw );
+            if ( rv == -1 )
+                return -1;
+            if (( rv == 1 )&&(s_enable_lve == LSAPI_CAGEFS_NO_SUEXEC ))    //this mode only use cageFS, does not use suEXEC
+            {
+                uid = s_defaultUid;
+                gid = s_defaultGid;
+                pw = getpwuid( uid );
+            }
+        }
+    }
+#endif
+    //if ( !uid || !gid )  //do not allow root 
+    //{
+    //    return -1;
+    //}
+
+#if defined(__FreeBSD__ ) || defined(__NetBSD__) || defined(__OpenBSD__) \
+    || defined(macintosh) || defined(__APPLE__) || defined(__APPLE_CC__)
+    if ( s_enable_core_dump )
+        lsapi_enable_core_dump();
+#endif
+
+    rv = setgid(gid);
+    if (rv == -1)
+    {
+        LSAPI_perror_r(pReq, "LSAPI: setgid()", NULL);
+        return -1;
+    }
+    if ( pw && (pw->pw_gid == gid ))
+    {
+        rv = initgroups( pw->pw_name, gid );
+        if (rv == -1)
+        {
+            LSAPI_perror_r(pReq, "LSAPI: initgroups()", NULL);
+            return -1;
+        }
+    }
+    else
+    {
+        rv = setgroups(1, &gid);
+        if (rv == -1)
+        {
+            LSAPI_perror_r(pReq, "LSAPI: setgroups()", NULL);
+        }
+    }
+    if ( pChroot )
+    {
+        rv = chroot( pChroot );
+        if ( rv == -1 )
+        {
+            LSAPI_perror_r(pReq, "LSAPI: chroot()", NULL);
+            return -1;
+        }
+    }
+    rv = setuid(uid);
+    if (rv == -1)
+    {
+        LSAPI_perror_r(pReq, "LSAPI: setuid()", NULL);
+        return -1;
+    }
+#if defined(linux) || defined(__linux) || defined(__linux__) || defined(__gnu_linux__)
+    if ( s_enable_core_dump )
+        lsapi_enable_core_dump();
+#endif
+    return 0;
+}
+
+static int lsapi_suexec_auth( LSAPI_Request *pReq, 
+            char * pAuth, int len, char * pUgid, int ugidLen )
+{
+    lsapi_MD5_CTX md5ctx;
+    unsigned char achMD5[16];
+    if ( len < 32 )
+        return -1;
+    memmove( achMD5, pAuth + 16, 16 );
+    memmove( pAuth + 16, s_pSecret, 16 );
+    lsapi_MD5Init( &md5ctx );
+    lsapi_MD5Update( &md5ctx, (unsigned char *)pAuth, 32 );
+    lsapi_MD5Update( &md5ctx, (unsigned char *)pUgid, 8 );
+    lsapi_MD5Final( (unsigned char *)pAuth + 16, &md5ctx);
+    if ( memcmp( achMD5, pAuth + 16, 16 ) == 0 )
+        return 0;
+    return 1;
+}
+
+
+static int lsapi_changeUGid( LSAPI_Request * pReq )
+{
+    int uid = s_defaultUid;
+    int gid = s_defaultGid;
+    const char * pChroot = NULL;
+    struct LSAPI_key_value_pair * pEnv;
+    struct LSAPI_key_value_pair * pAuth;
+    int i;
+    if ( s_uid )
+        return 0;
+    //with special ID  0x00
+    //authenticate the suEXEC request;
+    //first one should be MD5( nonce + lscgid secret )
+    //remember to clear the secret after verification 
+    //it should be set at the end of special env
+    i = pReq->m_pHeader->m_cntSpecialEnv - 1;
+    if ( i >= 0 )
+    {
+        pEnv = pReq->m_pSpecialEnvList + i;
+        if (( *pEnv->pKey == '\000' )&&
+            ( strcmp( pEnv->pKey+1, "SUEXEC_AUTH" ) == 0 ))
+        {
+            --pReq->m_pHeader->m_cntSpecialEnv;
+            pAuth = pEnv--;
+            if (( *pEnv->pKey == '\000' )&&
+                ( strcmp( pEnv->pKey+1, "SUEXEC_UGID" ) == 0 ))
+            {
+                --pReq->m_pHeader->m_cntSpecialEnv;
+                uid = *(uint32_t *)pEnv->pValue;
+                gid = *(((uint32_t *)pEnv->pValue) + 1 ); 
+                //fprintf( stderr, "LSAPI: SUEXEC_UGID set UID: %d, GID: %d\n", uid, gid );
+            }
+            else
+            {
+                fprintf( stderr, "LSAPI: missing SUEXEC_UGID env, use default user!\n" );
+                pEnv = NULL;
+            }
+            if ( pEnv&& lsapi_suexec_auth( pReq, pAuth->pValue, pAuth->valLen, pEnv->pValue, pEnv->valLen ) == 0 )
+            {
+                //read UID, GID from specialEnv 
+                
+            }
+            else
+            {
+                //authentication error
+                fprintf( stderr, "LSAPI: SUEXEC_AUTH authentication failed, use default user!\n" );
+                uid = 0;
+            }
+        }
+        else
+        {
+            //fprintf( stderr, "LSAPI: no SUEXEC_AUTH env, use default user!\n" );
+        }
+    }
+
+
+    if ( !uid )
+    {
+        uid = s_defaultUid;
+        gid = s_defaultGid;
+    }
+
+    //change uid
+    if ( setUID_LVE( pReq, uid, gid, pChroot ) == -1 )
+    {
+        return -1;
+    }
+
+    s_uid = uid; 	
+
+    return 0;
+ 
+}
+
+static int parseContentLenFromHeader(LSAPI_Request * pReq)
+{
+    const char * pContentLen = LSAPI_GetHeader_r( pReq, H_CONTENT_LENGTH );
+    if ( pContentLen )
+        pReq->m_reqBodyLen = strtoll( pContentLen, NULL, 10 );
+    return 0;
+}
+
 
 static int parseRequest( LSAPI_Request * pReq, int totalLen )
 {
@@ -523,13 +1012,21 @@ static int parseRequest( LSAPI_Request * pReq, int totalLen )
     pReq->m_pHttpHeader = pBegin;
     pBegin += pReq->m_pHeader->m_httpHeaderLen;
     if ( pBegin != pEnd )
+    {
+        fprintf( stderr, "%d: request header does match total size, total: %d, real: %ld\n", getpid(), totalLen,
+                    pBegin - pReq->m_pReqBuf );
         return -1;
-
+    }
     if ( shouldFixEndian )
     {
         fixHeaderIndexEndian( pReq );
     }
-
+    pReq->m_reqBodyLen = pReq->m_pHeader->m_reqBodyLen;
+    if ( pReq->m_reqBodyLen == -2 )
+    {
+        parseContentLenFromHeader(pReq);
+    }
+    
     return 0;
 }
 
@@ -546,11 +1043,45 @@ static inline int notify_req_received( int fd )
     return 0;
 }
 
+static inline int lsapi_notify_pid( int fd )
+{
+    char achBuf[16];
+    lsapi_buildPacketHeader( (struct lsapi_packet_header *)achBuf, LSAPI_STDERR_STREAM,
+                        8 + LSAPI_PACKET_HEADER_LEN );
+    memmove( &achBuf[8], "\0PID", 4 );
+    *((int *)&achBuf[12]) = getpid();
+    
+    if ( write( fd, achBuf, 16 ) < 16 )
+        return -1;
+    return 0;
+}
+
+static char s_conn_key_packet[16];
+static inline int init_conn_key( int fd )
+{
+    struct lsapi_packet_header * pHeader = (struct lsapi_packet_header *)s_conn_key_packet;
+    struct timeval tv;
+    int i;
+    gettimeofday( &tv, NULL );
+    srand( (tv.tv_sec % 0x1000 + tv.tv_usec) ^ rand() );
+    for( i = 8; i < 16; ++i )
+    {
+        s_conn_key_packet[i]=(int) (256.0*rand()/(RAND_MAX+1.0));
+    }
+    lsapi_buildPacketHeader( pHeader, LSAPI_REQ_RECEIVED,
+                        8 + LSAPI_PACKET_HEADER_LEN );
+    if ( write( fd, s_conn_key_packet, LSAPI_PACKET_HEADER_LEN+8 )
+                < LSAPI_PACKET_HEADER_LEN+8 )
+        return -1;
+    return 0;
+    
+
+}
 
 static int readReq( LSAPI_Request * pReq )
 {
-        int len;
-        int packetLen;
+    int len;
+    int packetLen;
     if ( !pReq )
         return -1;
     if ( pReq->m_reqBufSize < 8192 )
@@ -570,9 +1101,15 @@ static int readReq( LSAPI_Request * pReq )
 
     packetLen = verifyHeader( &pReq->m_pHeader->m_pktHeader, LSAPI_BEGIN_REQUEST );
     if ( packetLen < 0 )
+    {
+        fprintf( stderr, "%d: packetLen < 0\n", getpid() );
         return -1;
+    }
     if ( packetLen > LSAPI_MAX_HEADER_LEN )
+    {
+        fprintf( stderr, "%d: packetLen > %d\n", getpid(), LSAPI_MAX_HEADER_LEN );
         return -1;
+    }
 
     if ( packetLen + 1024 > pReq->m_reqBufSize )
     {
@@ -587,7 +1124,13 @@ static int readReq( LSAPI_Request * pReq )
         pReq->m_bufRead += len;
     }
     if ( parseRequest( pReq, packetLen ) < 0 )
+    {
+        fprintf( stderr, "%d: parseRequest error\n", getpid() );
         return -1;
+    }
+    if ( !s_uid )
+        if ( lsapi_changeUGid( pReq ) )
+            return -1;
     pReq->m_bufProcessed = packetLen;
     pReq->m_reqState = LSAPI_ST_REQ_BODY | LSAPI_ST_RESP_HEADER;
 
@@ -604,6 +1147,8 @@ int LSAPI_Init(void)
 {
     if ( !g_inited )
     {
+        s_uid = geteuid();
+        s_pSecret[0] = 0;
         lsapi_signal(SIGPIPE, lsapi_sigpipe);
         lsapi_signal(SIGUSR1, lsapi_siguser1);
 
@@ -683,6 +1228,7 @@ int LSAPI_Accept_r( LSAPI_Request * pReq )
         return -1;
     if ( LSAPI_Finish_r( pReq ) == -1 )
         return -1;
+    lsapi_set_nblock( pReq->m_fdListen , 0 );
     while( g_running )
     {
         if ( pReq->m_fd == -1 )
@@ -707,9 +1253,11 @@ int LSAPI_Accept_r( LSAPI_Request * pReq )
                         setsockopt(pReq->m_fd, IPPROTO_TCP, TCP_NODELAY,
                                    (char *)&nodelay, sizeof(nodelay));
                     }
+                    //init_conn_key( pReq->m_fd );
                     //OPTIMIZATION
                     if ( s_accept_notify )
-                        return notify_req_received( pReq->m_fd );
+                        if ( notify_req_received( pReq->m_fd ) == -1 )
+                                return -1;
                 }
             }
             else
@@ -717,6 +1265,7 @@ int LSAPI_Accept_r( LSAPI_Request * pReq )
         }
         if ( !readReq( pReq ) )
             break;
+        //abort();
         lsapi_close( pReq->m_fd );
         pReq->m_fd = -1;
         LSAPI_Reset_r( pReq );
@@ -799,13 +1348,13 @@ char * LSAPI_GetHeader_r( LSAPI_Request * pReq, int headerIndex )
 
 static int readBodyToReqBuf( LSAPI_Request * pReq )
 {
-    int bodyLeft;
-    int len = pReq->m_bufRead - pReq->m_bufProcessed;
+    off_t bodyLeft;
+    ssize_t len = pReq->m_bufRead - pReq->m_bufProcessed;
     if ( len > 0 )
         return len;
     pReq->m_bufRead = pReq->m_bufProcessed = pReq->m_pHeader->m_pktHeader.m_packetLen.m_iLen;
 
-    bodyLeft = pReq->m_pHeader->m_reqBodyLen - pReq->m_reqBodyRead;
+    bodyLeft = pReq->m_reqBodyLen - pReq->m_reqBodyRead;
     len = pReq->m_reqBufSize - pReq->m_bufRead;
     if ( len < 0 )
         return -1;
@@ -834,10 +1383,10 @@ int LSAPI_ReqBodyGetChar_r( LSAPI_Request * pReq )
 
 
 
-int LSAPI_ReqBodyGetLine_r( LSAPI_Request * pReq, char * pBuf, int bufLen, int *getLF )
+int LSAPI_ReqBodyGetLine_r( LSAPI_Request * pReq, char * pBuf, size_t bufLen, int *getLF )
 {
-    int len;
-    int left;
+    ssize_t len;
+    ssize_t left;
     char * pBufEnd = pBuf + bufLen - 1;
     char * pBufCur = pBuf;
     char * pCur;
@@ -881,15 +1430,15 @@ int LSAPI_ReqBodyGetLine_r( LSAPI_Request * pReq, char * pBuf, int bufLen, int *
 }
 
 
-int LSAPI_ReadReqBody_r( LSAPI_Request * pReq, char * pBuf, int bufLen )
+ssize_t LSAPI_ReadReqBody_r( LSAPI_Request * pReq, char * pBuf, size_t bufLen )
 {
-    int len;
-    int total;
+    ssize_t len;
+    off_t total;
     /* char *pOldBuf = pBuf; */
     if (!pReq || (pReq->m_fd ==-1) || ( !pBuf )||(bufLen < 0 ))
         return -1;
 
-    total = pReq->m_pHeader->m_reqBodyLen - pReq->m_reqBodyRead;
+    total = pReq->m_reqBodyLen - pReq->m_reqBodyRead;
     
     if ( total <= 0 )
         return 0;
@@ -930,14 +1479,14 @@ int LSAPI_ReadReqBody_r( LSAPI_Request * pReq, char * pBuf, int bufLen )
 }
 
 
-int LSAPI_Write_r( LSAPI_Request * pReq, const char * pBuf, int len )
+ssize_t LSAPI_Write_r( LSAPI_Request * pReq, const char * pBuf, size_t len )
 {
     struct lsapi_packet_header * pHeader;
     const char * pEnd;
     const char * p;
-    int bufLen;
-    int toWrite;
-    int packetLen;
+    ssize_t bufLen;
+    ssize_t toWrite;
+    ssize_t packetLen;
     int skip = 0;
     
     if ( !pReq || !pBuf || (pReq->m_fd == -1) )
@@ -1015,6 +1564,95 @@ int LSAPI_Write_r( LSAPI_Request * pReq, const char * pBuf, int len )
     return p - pBuf;
 }
 
+#if defined(__FreeBSD__ ) || defined(__NetBSD__) || defined(__OpenBSD__) 
+ssize_t gsendfile( int fdOut, int fdIn, off_t* off, size_t size )
+{
+    ssize_t ret;
+    off_t written;
+    ret = sendfile( fdIn, fdOut, *off, size, NULL, &written, 0 );
+    if ( written > 0 )
+    {
+        ret = written;
+        *off += ret;
+    }
+    return ret;
+}
+#endif
+
+#if defined(macintosh) || defined(__APPLE__) || defined(__APPLE_CC__)
+ssize_t gsendfile( int fdOut, int fdIn, off_t* off, size_t size )
+{
+    ssize_t ret;
+    off_t len = size;
+    ret = sendfile( fdIn, fdOut, *off, &len, NULL, 0 );
+    if (( ret == 0 )&&( len > 0 ))
+    {
+        ret = len;
+        *off += len;
+    }
+    return ret;
+}
+#endif
+    
+#if defined(sun) || defined(__sun)
+#include <sys/sendfile.h>
+ssize_t gsendfile( int fdOut, int fdIn, off_t *off, size_t size )
+{
+    int n = 0 ;
+    sendfilevec_t vec[1];
+
+    vec[n].sfv_fd   = fdIn;
+    vec[n].sfv_flag = 0;
+    vec[n].sfv_off  = *off;
+    vec[n].sfv_len  = size;
+    ++n;
+
+    size_t written;
+    ssize_t ret = ::sendfilev( fdOut, vec, n, &written );
+    if (( !ret )||( errno == EAGAIN ))
+        ret = written;
+    if ( ret > 0 )
+        *off += ret;
+    return ret;
+}
+#endif
+
+#if defined(linux) || defined(__linux) || defined(__linux__) || \
+    defined(__gnu_linux__)
+#include <sys/sendfile.h>
+#define gsendfile sendfile
+#endif
+#if defined(HPUX)
+ssize_t gsendfile( int fdOut, int fdIn, off_t * off, size_t size )
+{
+    return sendfile( fdOut, fdIn, off, size, NULL, 0 );
+}
+#endif
+
+ssize_t LSAPI_sendfile_r( LSAPI_Request * pReq, int fdIn, off_t* off, size_t size )
+{
+    struct lsapi_packet_header * pHeader = pReq->m_respPktHeader;
+    if ( !pReq || (pReq->m_fd == -1) || fdIn == -1 )
+        return -1;
+    if ( pReq->m_reqState & LSAPI_ST_RESP_HEADER )
+    {
+        LSAPI_FinalizeRespHeaders_r( pReq );
+    }
+    pReq->m_reqState |= LSAPI_ST_RESP_BODY;
+    
+    LSAPI_Flush_r(pReq);
+    
+    lsapi_buildPacketHeader( pHeader, LSAPI_RESP_STREAM,
+                            size + LSAPI_PACKET_HEADER_LEN );
+   
+
+    if (write(pReq->m_fd,  (const char *) pHeader, LSAPI_PACKET_HEADER_LEN ) != LSAPI_PACKET_HEADER_LEN)
+        return -1;
+    
+    return gsendfile( pReq->m_fd, fdIn, off, size );
+}
+
+
 void Flush_RespBuf_r( LSAPI_Request * pReq )
 {
     struct lsapi_packet_header * pHeader = pReq->m_respPktHeader;
@@ -1085,13 +1723,13 @@ int LSAPI_Flush_r( LSAPI_Request * pReq )
 }
 
 
-int LSAPI_Write_Stderr_r( LSAPI_Request * pReq, const char * pBuf, int len )
+ssize_t LSAPI_Write_Stderr_r( LSAPI_Request * pReq, const char * pBuf, size_t len )
 {
     struct lsapi_packet_header header;
     const char * pEnd;
     const char * p;
-    int packetLen;
-    int totalLen;
+    ssize_t packetLen;
+    ssize_t totalLen;
     int ret;
     struct iovec iov[2];
     struct iovec *pIov;
@@ -1200,6 +1838,20 @@ char * LSAPI_GetEnv_r( LSAPI_Request * pReq, const char * name )
     return NULL;
 }
 
+struct _headerInfo
+{
+    const char * _name;
+    int          _nameLen;
+    const char * _value;
+    int          _valueLen;
+};
+
+int compareValueLocation(const void * v1, const void *v2 )
+{
+    return ((const struct _headerInfo *)v1)->_value -
+           ((const struct _headerInfo *)v2)->_value; 
+}
+
 int LSAPI_ForeachOrgHeader_r( LSAPI_Request * pReq,
             LSAPI_CB_EnvHandler fn, void * arg )
 {
@@ -1208,8 +1860,10 @@ int LSAPI_ForeachOrgHeader_r( LSAPI_Request * pReq,
     char * pValue;
     int ret;
     int count = 0;
+    struct _headerInfo headers[512];
     if ( !pReq || !fn )
         return -1;
+    
     for( i = 0; i < H_TRANSFER_ENCODING; ++i )
     {
         if ( pReq->m_pHeaderIndex->m_headerOff[i] )
@@ -1217,11 +1871,16 @@ int LSAPI_ForeachOrgHeader_r( LSAPI_Request * pReq,
             len = pReq->m_pHeaderIndex->m_headerLen[i];
             pValue = pReq->m_pHttpHeader + pReq->m_pHeaderIndex->m_headerOff[i];
             *(pValue + len ) = 0;
-            ret = (*fn)( HTTP_HEADERS[i], HTTP_HEADER_LEN[i],
-                        pValue, len, arg );
+            headers[count]._name = HTTP_HEADERS[i];
+            headers[count]._nameLen = HTTP_HEADER_LEN[i];
+            headers[count]._value = pValue;
+            headers[count]._valueLen = len;
             ++count;
-            if ( ret <= 0 )
-                return ret;
+        
+            //ret = (*fn)( HTTP_HEADERS[i], HTTP_HEADER_LEN[i],
+            //            pValue, len, arg );
+            //if ( ret <= 0 )
+            //    return ret;
         }
     }
     if ( pReq->m_pHeader->m_cntUnknownHeaders > 0 )
@@ -1238,14 +1897,29 @@ int LSAPI_ForeachOrgHeader_r( LSAPI_Request * pReq,
 
             pValue = pReq->m_pHttpHeader + pCur->valueOff;
             *(pValue + pCur->valueLen ) = 0;
-            ret = (*fn)( pKey, keyLen, 
-                        pValue, pCur->valueLen, arg );
-            if ( ret <= 0 )
-                return ret;
+            headers[count]._name = pKey;
+            headers[count]._nameLen = keyLen;
+            headers[count]._value = pValue;
+            headers[count]._valueLen = pCur->valueLen;
+            ++count;
+            if ( count == 512 )
+                break;
+            //ret = (*fn)( pKey, keyLen, 
+            //            pValue, pCur->valueLen, arg );
+            //if ( ret <= 0 )
+            //    return ret;
             ++pCur;
         }
     }
-    return count + pReq->m_pHeader->m_cntUnknownHeaders;
+    qsort( headers, count, sizeof( struct _headerInfo ), compareValueLocation );
+    for( i = 0; i < count; ++i )
+    {
+        ret = (*fn)( headers[i]._name, headers[i]._nameLen, 
+                    headers[i]._value, headers[i]._valueLen, arg );
+        if ( ret <= 0 )
+            return ret;
+    }
+    return count;
     
 }
 
@@ -1288,11 +1962,11 @@ int LSAPI_ForeachHeader_r( LSAPI_Request * pReq,
         {
             pKey = pReq->m_pHttpHeader + pCur->nameOff;
             keyLen = pCur->nameLen;
+            if ( keyLen > 250 )
+                keyLen = 250;
             pKeyEnd = pKey + keyLen;
             memcpy( achHeaderName, "HTTP_", 5 );
             p = &achHeaderName[5];
-            if ( keyLen > 250 )
-                keyLen = 250;
 
             while( pKey < pKeyEnd )
             {
@@ -1397,9 +2071,64 @@ int LSAPI_FinalizeRespHeaders_r( LSAPI_Request * pReq )
 }
 
 
+int LSAPI_AppendRespHeader2_r( LSAPI_Request * pReq, const char * pHeaderName, 
+                              const char * pHeaderValue )
+{
+    int nameLen, valLen, len;
+    if ( !pReq || !pHeaderName || !pHeaderValue ) 
+        return -1;
+    if ( pReq->m_reqState & LSAPI_ST_RESP_BODY )
+        return -1;
+    if ( pReq->m_respHeader.m_respInfo.m_cntHeaders >= LSAPI_MAX_RESP_HEADERS )
+        return -1;
+    nameLen = strlen( pHeaderName );
+    valLen = strlen( pHeaderValue );
+    if ( nameLen == 0 )
+        return -1;
+    while( nameLen > 0 )
+    {
+        char ch = *(pHeaderName + nameLen - 1 );
+        if (( ch == '\n' )||( ch == '\r' ))
+            --nameLen;
+        else
+            break;
+    }
+    if ( nameLen <= 0 )
+        return 0;
+    while( valLen > 0 )
+    {
+        char ch = *(pHeaderValue + valLen - 1 );
+        if (( ch == '\n' )||( ch == '\r' ))
+            --valLen;
+        else
+            break;
+    }
+    len = nameLen + valLen + 1;
+    if ( len > LSAPI_RESP_HTTP_HEADER_MAX )
+        return -1;
+
+    if ( pReq->m_pRespHeaderBufPos + len + 1 > pReq->m_pRespHeaderBufEnd )
+    {
+        int newlen = pReq->m_pRespHeaderBufPos + len + 4096 - pReq->m_pRespHeaderBuf;
+        newlen -= newlen % 4096;
+        if ( allocateRespHeaderBuf( pReq, newlen ) == -1 )
+            return -1;
+    }
+    memmove( pReq->m_pRespHeaderBufPos, pHeaderName, nameLen );
+    pReq->m_pRespHeaderBufPos += nameLen;
+    *pReq->m_pRespHeaderBufPos++ = ':';
+    memmove( pReq->m_pRespHeaderBufPos, pHeaderValue, valLen );
+    pReq->m_pRespHeaderBufPos += valLen;
+    *pReq->m_pRespHeaderBufPos++ = 0;
+    ++len;  /* add one byte padding for \0 */
+    pReq->m_respHeaderLen[pReq->m_respHeader.m_respInfo.m_cntHeaders] = len;
+    ++pReq->m_respHeader.m_respInfo.m_cntHeaders;
+    return 0;
+}
+
 
 
-int LSAPI_AppendRespHeader_r( LSAPI_Request * pReq, char * pBuf, int len )
+int LSAPI_AppendRespHeader_r( LSAPI_Request * pReq, const char * pBuf, int len )
 {
     if ( !pReq || !pBuf || len <= 0 || len > LSAPI_RESP_HTTP_HEADER_MAX )
         return -1;
@@ -1494,7 +2223,7 @@ int LSAPI_ParseSockAddr( const char * pBind, struct sockaddr * pAddr )
     if ( !pBind )
         return -1;
 
-    while( isspace( *p ) )
+    while( isspace( *pBind ) )
         ++pBind;
 
     strncpy( achAddr, pBind, 256 );
@@ -1551,7 +2280,7 @@ int LSAPI_ParseSockAddr( const char * pBind, struct sockaddr * pAddr )
         ++pEnd;
         
     port = atoi( pEnd );
-    if (( port <= 0 )||( port > 655535 ))
+    if (( port <= 0 )||( port > 65535 ))
         return -1;
     if ( doAddrInfo )
     {
@@ -1597,9 +2326,11 @@ static fn_select_t g_fnSelect = select;
 typedef struct _lsapi_child_status
 {
     int     m_pid;
+    long    m_tmStart;
 
     volatile short   m_iKillSent;
     volatile short   m_inProcess;
+    volatile int     m_iReqCounter;
 
     volatile long    m_tmWaitBegin;
     volatile long    m_tmReqBegin;
@@ -1629,6 +2360,7 @@ static lsapi_prefork_server * g_prefork_server = NULL;
 
 int LSAPI_Init_Prefork_Server( int max_children, fn_select_t fp, int avoidFork )
 {
+    int pid;
     if ( g_prefork_server )
         return 0;
     if ( max_children <= 1 )
@@ -1646,11 +2378,15 @@ int LSAPI_Init_Prefork_Server( int max_children, fn_select_t fp, int avoidFork )
         g_fnSelect = fp;
 
     s_ppid = getppid();
+    pid = getpid();
+    setpgid( pid, pid );
     g_prefork_server->m_iAvoidFork = avoidFork;
     g_prefork_server->m_iMaxChildren = max_children;
     
     g_prefork_server->m_iExtraChildren = ( avoidFork ) ? 0 : (max_children / 3) ;
     g_prefork_server->m_iMaxIdleChildren = ( avoidFork ) ? (max_children + 1) : (max_children / 3);
+    if ( g_prefork_server->m_iMaxIdleChildren == 0 )
+        g_prefork_server->m_iMaxIdleChildren = 1;
     g_prefork_server->m_iChildrenMaxIdleTime = 300;
     g_prefork_server->m_iMaxReqProcessTime = 300;
     return 0;    
@@ -1679,9 +2415,10 @@ static int lsapi_accept( int fdListen )
             setsockopt( fd, IPPROTO_TCP, TCP_NODELAY,
                     (char *)&nodelay, sizeof(nodelay));
         }
+
         //OPTIMIZATION
-        if ( s_accept_notify )
-            notify_req_received( fd );
+        //if ( s_accept_notify )
+        //    notify_req_received( fd );
     }
     return fd;
 
@@ -1727,10 +2464,18 @@ static void lsapi_sigchild( int signal )
         {
             break;
         }
+        if ( WIFSIGNALED( status ))
+        {
+            int sig_num = WTERMSIG( status );
+            int dump = WCOREDUMP( status );
+            fprintf( stderr, "Child process with pid: %d was killed by signal: %d, core dump: %d\n", pid, sig_num, dump );
+        }
         child_status = find_child_status( pid );
         if ( child_status )
+        {
             child_status->m_pid = 0;
-        --g_prefork_server->m_iCurChildren;
+            --g_prefork_server->m_iCurChildren;
+        }
     }
 
 }
@@ -1754,70 +2499,87 @@ static int lsapi_init_children_status()
     return 0;
 }
 
+static void dump_debug_info( lsapi_child_status * pStatus, long tmCur )
+{
+    char achCmd[1024];
+    int pid = fork();
+    if ( pid != 0 )
+        return;
+    fprintf( stderr, "[%s] Possible runaway process, PPID: %d, PID: %d, reqCount: %d, process time: %ld, checkpoint time: %ld, start time: %ld\n", 
+                ctime(&tmCur), getpid(), pStatus->m_pid, pStatus->m_iReqCounter, 
+                tmCur - pStatus->m_tmReqBegin, tmCur - pStatus->m_tmLastCheckPoint, tmCur - pStatus->m_tmStart ); 
+    snprintf( achCmd, 1024, "gdb --batch -ex \"attach %d\" -ex \"set height 0\" -ex \"bt\" >&2;PATH=$PATH:/usr/sbin lsof -p %d >&2", pStatus->m_pid, pStatus->m_pid );
+    if ( system( achCmd ) == -1 )
+        perror( "system()" );
+    exit( 0 );
+}
+
 static void lsapi_check_child_status( long tmCur )
 {
     int idle = 0;
     int tobekilled;
     int dying = 0;
+    int count = 0;
     lsapi_child_status * pStatus = g_prefork_server->m_pChildrenStatus;
     lsapi_child_status * pEnd = g_prefork_server->m_pChildrenStatus + g_prefork_server->m_iMaxChildren * 2;
     while( pStatus < pEnd )
     {
-        tobekilled = pStatus->m_iKillSent;
+        tobekilled = 0;
         if ( pStatus->m_pid != 0 )
         {
-            if ( !tobekilled )
+            ++count;
+            if ( !pStatus->m_inProcess )
             {
-                if ( !pStatus->m_inProcess )
+                
+                if (( g_prefork_server->m_iCurChildren - dying > g_prefork_server->m_iMaxChildren)||
+                    ( idle > g_prefork_server->m_iMaxIdleChildren ))
                 {
-                    
-                    if (( g_prefork_server->m_iCurChildren - dying > g_prefork_server->m_iMaxChildren)||
-                        ( idle >= g_prefork_server->m_iMaxIdleChildren ))
-                    {
-                        tobekilled = 1;
-                    }
-                    else
-                    {
-                        if (( s_max_idle_secs> 0)&&(tmCur - pStatus->m_tmWaitBegin > s_max_idle_secs + 5 ))
-                            tobekilled = 1;
-                    }
-                    if ( !tobekilled )
-                        ++idle;
+                    tobekilled = SIGUSR1;
                 }
                 else
                 {
-                    if ( tmCur - pStatus->m_tmReqBegin > 
-                            g_prefork_server->m_iMaxReqProcessTime )
-                        tobekilled = 1;
+                    if (( s_max_idle_secs> 0)&&(tmCur - pStatus->m_tmWaitBegin > s_max_idle_secs + 5 ))
+                    {
+                        tobekilled = SIGUSR1;
+                    }
                 }
+                if ( !tobekilled )
+                    ++idle;
             }
             else
             {
-                if ( pStatus->m_inProcess )
-                    tobekilled = pStatus->m_iKillSent = 0;
+                if ( tmCur - pStatus->m_tmReqBegin > 
+                        g_prefork_server->m_iMaxReqProcessTime )
+                {
+                    if (( ( pStatus->m_iKillSent % 5 ) == 0 )&&( s_dump_debug_info ))
+                        dump_debug_info( pStatus, tmCur );
+                    if ( pStatus->m_iKillSent > 5 )
+                    {
+                        tobekilled = SIGKILL;
+                        fprintf( stderr, "Force killing runaway process PID: %d with SIGKILL\n", pStatus->m_pid );
+                    }
+                    else
+                    {
+                        tobekilled = SIGTERM;
+                        fprintf( stderr, "Killing runaway process PID: %d with SIGTERM\n", pStatus->m_pid );
+                    }
+                }
             }
             if ( tobekilled )
             {
-                tobekilled = 0;
-                if ( pStatus->m_iKillSent > 5 )
-                    tobekilled = SIGKILL;
-                else if ( pStatus->m_iKillSent == 3 )
-                    tobekilled = SIGTERM;
-                else if ( pStatus->m_iKillSent == 1 )
-                {
-                    tobekilled = SIGUSR1;
-                }
-                if ( tobekilled )
-                    kill( pStatus->m_pid, tobekilled );
+                kill( pStatus->m_pid, tobekilled );
                 ++pStatus->m_iKillSent;
                 ++dying;
             }
-                
         }
-        else
-            ++dying;
         ++pStatus;
     }
+    if ( g_prefork_server->m_iCurChildren != count )
+    {
+        fprintf( stderr, "Children tracking is wrong: PID: %d, Cur Childen: %d, count: %d, idle: %d, dying: %d\n", getpid(), 
+                g_prefork_server->m_iCurChildren, count, idle, dying );
+
+    }
 }
 
 static int lsapi_all_children_must_die()
@@ -1880,10 +2642,7 @@ static int lsapi_prefork_server_accept( lsapi_prefork_server * pServer, LSAPI_Re
     s_stop = 0;
     while( !s_stop )
     {
-        if ( ret )
-            curTime = time( NULL );
-        else
-            ++curTime;
+        curTime = time( NULL );
         if (curTime != lastTime )
         {
             lastTime = curTime;
@@ -1914,6 +2673,7 @@ static int lsapi_prefork_server_accept( lsapi_prefork_server * pServer, LSAPI_Re
         timeout.tv_sec = 1; timeout.tv_usec = 0;
         if ((ret = (*g_fnSelect)(pServer->m_fd+1, &readfds, NULL, NULL, &timeout)) == 1 )
         {
+            /*
             if ( pServer->m_iCurChildren >= 0 )
             {
                 usleep( 10 );
@@ -1922,7 +2682,7 @@ static int lsapi_prefork_server_accept( lsapi_prefork_server * pServer, LSAPI_Re
                 timeout.tv_sec = 0; timeout.tv_usec = 0;
                 if ( (*g_fnSelect)(pServer->m_fd+1, &readfds, NULL, NULL, &timeout) == 0 )
                     continue;
-            }
+            }*/
         }
         else if ( ret == -1 )
         {
@@ -1940,6 +2700,8 @@ static int lsapi_prefork_server_accept( lsapi_prefork_server * pServer, LSAPI_Re
         if ( pReq->m_fd != -1 )
         {
             child_status = find_child_status( 0 );
+            if ( child_status )
+                memset( child_status, 0, sizeof( *child_status ) );
             pid = fork();
             if ( !pid )
             {
@@ -1947,15 +2709,22 @@ static int lsapi_prefork_server_accept( lsapi_prefork_server * pServer, LSAPI_Re
                 s_ppid = getppid();
                 s_req_processed = 0;
                 s_pChildStatus = child_status;
-                child_status->m_iKillSent = 0;
                 lsapi_set_nblock( pReq->m_fd, 0 );
-
+                if ( pReq->m_fdListen != -1 )
+                {
+                    close( pReq->m_fdListen );
+                    pReq->m_fdListen = -1;
+                }
                 /* don't catch our signals */
                 sigaction( SIGCHLD, &old_child, 0 );
                 sigaction( SIGTERM, &old_term, 0 );
                 sigaction( SIGQUIT, &old_quit, 0 );
                 sigaction( SIGINT,  &old_int,  0 );
                 sigaction( SIGUSR1, &old_usr1, 0 );
+                //init_conn_key( pReq->m_fd );
+                lsapi_notify_pid( pReq->m_fd );
+                if ( s_accept_notify )
+                    return notify_req_received( pReq->m_fd );
                 return 0;
             }
             else if ( pid == -1 )
@@ -1968,8 +2737,8 @@ static int lsapi_prefork_server_accept( lsapi_prefork_server * pServer, LSAPI_Re
                 if ( child_status )
                 {
                     child_status->m_pid = pid;
-                    child_status->m_iKillSent = 0;
-                    child_status->m_tmWaitBegin = time(NULL);
+                    child_status->m_tmWaitBegin = curTime;
+                    child_status->m_tmStart = curTime;
                 }
             }
             close( pReq->m_fd );
@@ -1991,7 +2760,7 @@ static int lsapi_prefork_server_accept( lsapi_prefork_server * pServer, LSAPI_Re
 
 }
 
-void lsapi_error( char * pMessage, int err_no )
+void lsapi_error( const char * pMessage, int err_no )
 {
     fprintf( stderr, "%d: %s, errno: %d (%s)\n", getpid(), pMessage, err_no, strerror( err_no ) );
 }
@@ -2020,6 +2789,7 @@ int LSAPI_Prefork_Accept_r( LSAPI_Request * pReq )
     {
         s_pChildStatus->m_tmWaitBegin = time( NULL );
     }
+
     
     while( g_running )
     {
@@ -2031,8 +2801,7 @@ int LSAPI_Prefork_Accept_r( LSAPI_Request * pReq )
             fd = pReq->m_fdListen;
         else
         {
-            lsapi_error( "no available fd", 0 );
-            return -1;
+            break;
         }
         wait_secs = 0;
         while( 1 )
@@ -2076,6 +2845,15 @@ int LSAPI_Prefork_Accept_r( LSAPI_Request * pReq )
                     {
                         fd = pReq->m_fd;
                         lsapi_set_nblock( fd, 0 );
+                        //init_conn_key( pReq->m_fd );
+                        if ( !s_keepListener )
+                        {
+                            close( pReq->m_fdListen );
+                            pReq->m_fdListen = -1;
+                        }
+                        if ( s_accept_notify )
+                            if ( notify_req_received( pReq->m_fd ) == -1 )
+                                return -1;
                     }
                     else
                     {
@@ -2094,7 +2872,9 @@ int LSAPI_Prefork_Accept_r( LSAPI_Request * pReq )
         {
             if ( s_pChildStatus )
             {
+                s_pChildStatus->m_iKillSent = 0;
                 s_pChildStatus->m_inProcess = 1;
+                ++s_pChildStatus->m_iReqCounter;
                 s_pChildStatus->m_tmReqBegin = s_pChildStatus->m_tmLastCheckPoint = time(NULL);
             }
             ++s_req_processed;
@@ -2176,7 +2956,8 @@ static void unset_lsapi_envs()
 #endif
     while( env != NULL && *env != NULL ) 
     {
-        if (!strncmp(*env, "LSAPI_", 6) || !strncmp( *env, "PHP_LSAPI_", 10 ) ) 
+        if (!strncmp(*env, "LSAPI_", 6) || !strncmp( *env, "PHP_LSAPI_", 10 ) 
+            || (!strncmp( *env, "PHPRC=", 6 )&&(!s_uid))) 
         {   
             char ** del = env;
             do 
@@ -2188,7 +2969,7 @@ static void unset_lsapi_envs()
     }  
 }
 
-void LSAPI_Init_Env_Parameters( fn_select_t fp )
+int LSAPI_Init_Env_Parameters( fn_select_t fp )
 {
     const char *p;
     int n;
@@ -2229,6 +3010,9 @@ void LSAPI_Init_Env_Parameters( fn_select_t fp )
         struct rlimit limit = { 0, 0 };
         setrlimit( RLIMIT_CORE, &limit );
     }
+    else
+        s_enable_core_dump = 1;
+
 #endif
 
     p = getenv( "LSAPI_MAX_IDLE" );
@@ -2238,6 +3022,14 @@ void LSAPI_Init_Env_Parameters( fn_select_t fp )
         LSAPI_Set_Max_Idle( n );
     }
 
+    p = getenv( "LSAPI_KEEP_LISTEN" );
+    if ( p )
+    {
+        n = atoi( p );
+        s_keepListener = n;
+    }
+
+
     if ( LSAPI_Is_Listen() )
     {
         n = 0;
@@ -2274,8 +3066,246 @@ void LSAPI_Init_Env_Parameters( fn_select_t fp )
         {
             LSAPI_No_Check_ppid();
         }
+        
+        p = getenv( "LSAPI_DUMP_DEBUG_INFO" );
+        if ( p )
+            s_dump_debug_info = atoi( p );
+
+        if ( lsapi_initSuEXEC() == -1 )
+            return -1;
+#if defined(linux) || defined(__linux) || defined(__linux__) || defined(__gnu_linux__)
+        lsapi_initLVE();
+#endif
     }
     unset_lsapi_envs();
+    return 0;
+}
+
+
+
+
+
+static void lsapi_MD5Transform(uint32 buf[4], uint32 const in[16]);
+
+/*
+ * Note: this code is harmless on little-endian machines.
+ */
+static void byteReverse(unsigned char *buf, unsigned longs)
+{
+    uint32 t;
+    do {
+        t = (uint32) ((unsigned) buf[3] << 8 | buf[2]) << 16 |
+            ((unsigned) buf[1] << 8 | buf[0]);
+        *(uint32 *) buf = t;
+        buf += 4;
+    } while (--longs);
 }
 
+/*
+ * Start MD5 accumulation.  Set bit count to 0 and buffer to mysterious
+ * initialization constants.
+ */
+void lsapi_MD5Init(struct lsapi_MD5Context *ctx)
+{
+    ctx->buf[0] = 0x67452301;
+    ctx->buf[1] = 0xefcdab89;
+    ctx->buf[2] = 0x98badcfe;
+    ctx->buf[3] = 0x10325476;
+
+    ctx->bits[0] = 0;
+    ctx->bits[1] = 0;
+}
+
+/*
+ * Update context to reflect the concatenation of another buffer full
+ * of bytes.
+ */
+void lsapi_MD5Update(struct lsapi_MD5Context *ctx, unsigned char const *buf, unsigned len)
+{
+    register uint32 t;
+
+    /* Update bitcount */
+
+    t = ctx->bits[0];
+    if ((ctx->bits[0] = t + ((uint32) len << 3)) < t)
+        ctx->bits[1]++;                /* Carry from low to high */
+    ctx->bits[1] += len >> 29;
+
+    t = (t >> 3) & 0x3f;        /* Bytes already in shsInfo->data */
+
+    /* Handle any leading odd-sized chunks */
+
+    if (t) {
+        unsigned char *p = (unsigned char *) ctx->in + t;
+
+        t = 64 - t;
+        if (len < t) {
+            memmove(p, buf, len);
+            return;
+        }
+        memmove(p, buf, t);
+        byteReverse(ctx->in, 16);
+        lsapi_MD5Transform(ctx->buf, (uint32 *) ctx->in);
+        buf += t;
+        len -= t;
+    }
+    /* Process data in 64-byte chunks */
+
+    while (len >= 64) {
+        memmove(ctx->in, buf, 64);
+        byteReverse(ctx->in, 16);
+        lsapi_MD5Transform(ctx->buf, (uint32 *) ctx->in);
+        buf += 64;
+        len -= 64;
+    }
+
+    /* Handle any remaining bytes of data. */
+
+    memmove(ctx->in, buf, len);
+}
+
+/*
+ * Final wrapup - pad to 64-byte boundary with the bit pattern
+ * 1 0* (64-bit count of bits processed, MSB-first)
+ */
+void lsapi_MD5Final(unsigned char digest[16], struct lsapi_MD5Context *ctx)
+{
+    unsigned int count;
+    unsigned char *p;
+
+    /* Compute number of bytes mod 64 */
+    count = (ctx->bits[0] >> 3) & 0x3F;
+
+    /* Set the first char of padding to 0x80.  This is safe since there is
+       always at least one byte free */
+    p = ctx->in + count;
+    *p++ = 0x80;
+
+    /* Bytes of padding needed to make 64 bytes */
+    count = 64 - 1 - count;
+
+    /* Pad out to 56 mod 64 */
+    if (count < 8) {
+        /* Two lots of padding:  Pad the first block to 64 bytes */
+        memset(p, 0, count);
+        byteReverse(ctx->in, 16);
+        lsapi_MD5Transform(ctx->buf, (uint32 *) ctx->in);
+
+        /* Now fill the next block with 56 bytes */
+        memset(ctx->in, 0, 56);
+    } else {
+        /* Pad block to 56 bytes */
+        memset(p, 0, count - 8);
+    }
+    byteReverse(ctx->in, 14);
+
+    /* Append length in bits and transform */
+    ((uint32 *) ctx->in)[14] = ctx->bits[0];
+    ((uint32 *) ctx->in)[15] = ctx->bits[1];
+
+    lsapi_MD5Transform(ctx->buf, (uint32 *) ctx->in);
+    byteReverse((unsigned char *) ctx->buf, 4);
+    memmove(digest, ctx->buf, 16);
+    memset(ctx, 0, sizeof(ctx));        /* In case it's sensitive */
+}
+
+/* The four core functions - F1 is optimized somewhat */
+
+/* #define F1(x, y, z) (x & y | ~x & z) */
+#define F1(x, y, z) (z ^ (x & (y ^ z)))
+#define F2(x, y, z) F1(z, x, y)
+#define F3(x, y, z) (x ^ y ^ z)
+#define F4(x, y, z) (y ^ (x | ~z))
+
+/* This is the central step in the MD5 algorithm. */
+#define MD5STEP(f, w, x, y, z, data, s) \
+        ( w += f(x, y, z) + data,  w = w<<s | w>>(32-s),  w += x )
+
+/*
+ * The core of the MD5 algorithm, this alters an existing MD5 hash to
+ * reflect the addition of 16 longwords of new data.  MD5Update blocks
+ * the data and converts bytes into longwords for this routine.
+ */
+static void lsapi_MD5Transform(uint32 buf[4], uint32 const in[16])
+{
+    register uint32 a, b, c, d;
+
+    a = buf[0];
+    b = buf[1];
+    c = buf[2];
+    d = buf[3];
+
+    MD5STEP(F1, a, b, c, d, in[0] + 0xd76aa478, 7);
+    MD5STEP(F1, d, a, b, c, in[1] + 0xe8c7b756, 12);
+    MD5STEP(F1, c, d, a, b, in[2] + 0x242070db, 17);
+    MD5STEP(F1, b, c, d, a, in[3] + 0xc1bdceee, 22);
+    MD5STEP(F1, a, b, c, d, in[4] + 0xf57c0faf, 7);
+    MD5STEP(F1, d, a, b, c, in[5] + 0x4787c62a, 12);
+    MD5STEP(F1, c, d, a, b, in[6] + 0xa8304613, 17);
+    MD5STEP(F1, b, c, d, a, in[7] + 0xfd469501, 22);
+    MD5STEP(F1, a, b, c, d, in[8] + 0x698098d8, 7);
+    MD5STEP(F1, d, a, b, c, in[9] + 0x8b44f7af, 12);
+    MD5STEP(F1, c, d, a, b, in[10] + 0xffff5bb1, 17);
+    MD5STEP(F1, b, c, d, a, in[11] + 0x895cd7be, 22);
+    MD5STEP(F1, a, b, c, d, in[12] + 0x6b901122, 7);
+    MD5STEP(F1, d, a, b, c, in[13] + 0xfd987193, 12);
+    MD5STEP(F1, c, d, a, b, in[14] + 0xa679438e, 17);
+    MD5STEP(F1, b, c, d, a, in[15] + 0x49b40821, 22);
+
+    MD5STEP(F2, a, b, c, d, in[1] + 0xf61e2562, 5);
+    MD5STEP(F2, d, a, b, c, in[6] + 0xc040b340, 9);
+    MD5STEP(F2, c, d, a, b, in[11] + 0x265e5a51, 14);
+    MD5STEP(F2, b, c, d, a, in[0] + 0xe9b6c7aa, 20);
+    MD5STEP(F2, a, b, c, d, in[5] + 0xd62f105d, 5);
+    MD5STEP(F2, d, a, b, c, in[10] + 0x02441453, 9);
+    MD5STEP(F2, c, d, a, b, in[15] + 0xd8a1e681, 14);
+    MD5STEP(F2, b, c, d, a, in[4] + 0xe7d3fbc8, 20);
+    MD5STEP(F2, a, b, c, d, in[9] + 0x21e1cde6, 5);
+    MD5STEP(F2, d, a, b, c, in[14] + 0xc33707d6, 9);
+    MD5STEP(F2, c, d, a, b, in[3] + 0xf4d50d87, 14);
+    MD5STEP(F2, b, c, d, a, in[8] + 0x455a14ed, 20);
+    MD5STEP(F2, a, b, c, d, in[13] + 0xa9e3e905, 5);
+    MD5STEP(F2, d, a, b, c, in[2] + 0xfcefa3f8, 9);
+    MD5STEP(F2, c, d, a, b, in[7] + 0x676f02d9, 14);
+    MD5STEP(F2, b, c, d, a, in[12] + 0x8d2a4c8a, 20);
+
+    MD5STEP(F3, a, b, c, d, in[5] + 0xfffa3942, 4);
+    MD5STEP(F3, d, a, b, c, in[8] + 0x8771f681, 11);
+    MD5STEP(F3, c, d, a, b, in[11] + 0x6d9d6122, 16);
+    MD5STEP(F3, b, c, d, a, in[14] + 0xfde5380c, 23);
+    MD5STEP(F3, a, b, c, d, in[1] + 0xa4beea44, 4);
+    MD5STEP(F3, d, a, b, c, in[4] + 0x4bdecfa9, 11);
+    MD5STEP(F3, c, d, a, b, in[7] + 0xf6bb4b60, 16);
+    MD5STEP(F3, b, c, d, a, in[10] + 0xbebfbc70, 23);
+    MD5STEP(F3, a, b, c, d, in[13] + 0x289b7ec6, 4);
+    MD5STEP(F3, d, a, b, c, in[0] + 0xeaa127fa, 11);
+    MD5STEP(F3, c, d, a, b, in[3] + 0xd4ef3085, 16);
+    MD5STEP(F3, b, c, d, a, in[6] + 0x04881d05, 23);
+    MD5STEP(F3, a, b, c, d, in[9] + 0xd9d4d039, 4);
+    MD5STEP(F3, d, a, b, c, in[12] + 0xe6db99e5, 11);
+    MD5STEP(F3, c, d, a, b, in[15] + 0x1fa27cf8, 16);
+    MD5STEP(F3, b, c, d, a, in[2] + 0xc4ac5665, 23);
+
+    MD5STEP(F4, a, b, c, d, in[0] + 0xf4292244, 6);
+    MD5STEP(F4, d, a, b, c, in[7] + 0x432aff97, 10);
+    MD5STEP(F4, c, d, a, b, in[14] + 0xab9423a7, 15);
+    MD5STEP(F4, b, c, d, a, in[5] + 0xfc93a039, 21);
+    MD5STEP(F4, a, b, c, d, in[12] + 0x655b59c3, 6);
+    MD5STEP(F4, d, a, b, c, in[3] + 0x8f0ccc92, 10);
+    MD5STEP(F4, c, d, a, b, in[10] + 0xffeff47d, 15);
+    MD5STEP(F4, b, c, d, a, in[1] + 0x85845dd1, 21);
+    MD5STEP(F4, a, b, c, d, in[8] + 0x6fa87e4f, 6);
+    MD5STEP(F4, d, a, b, c, in[15] + 0xfe2ce6e0, 10);
+    MD5STEP(F4, c, d, a, b, in[6] + 0xa3014314, 15);
+    MD5STEP(F4, b, c, d, a, in[13] + 0x4e0811a1, 21);
+    MD5STEP(F4, a, b, c, d, in[4] + 0xf7537e82, 6);
+    MD5STEP(F4, d, a, b, c, in[11] + 0xbd3af235, 10);
+    MD5STEP(F4, c, d, a, b, in[2] + 0x2ad7d2bb, 15);
+    MD5STEP(F4, b, c, d, a, in[9] + 0xeb86d391, 21);
+
+    buf[0] += a;
+    buf[1] += b;
+    buf[2] += c;
+    buf[3] += d;
+}